projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Disallow queue= modifier from DATA ACL
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
80a47a2c
TK		 68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
4840604e
TL		 71#endif
72#ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
8e669ac1 74#endif
71fafd95
PH		 75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
6ea85e9a 82 ACLC_LOG_REJECT_TARGET,
71fafd95 83 ACLC_LOGWRITE,
8523533c
TK		 84#ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86#endif
87 ACLC_MESSAGE,
88#ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90#endif
b0b9dbb1 91 ACLC_QUEUE,
870f6ba8 92 ACLC_RATELIMIT,
8523533c
TK		 93 ACLC_RECIPIENTS,
94#ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96#endif
e7568d51 97 ACLC_REMOVE_HEADER,
71fafd95
PH		 98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
8523533c 101#ifdef WITH_CONTENT_SCAN
8e669ac1 102 ACLC_SPAM,
8523533c
TK		 103#endif
104#ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
65a7d8c3 106 ACLC_SPF_GUESS,
8523533c 107#endif
b0019c78 108 ACLC_UDPSEND,
8523533c 109 ACLC_VERIFY };
059ec3d9 110
c3611384 111/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 112"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH		 113modifiers that look like conditions but always return TRUE. They are used for
114their side effects. */
059ec3d9 115
9a26b6b2
PH		 116static uschar *conditions[] = {
117 US"acl",
71fafd95 118 US"add_header",
9a26b6b2 119 US"authenticated",
8523533c
TK		 120#ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122#endif
123 US"condition",
c3611384 124 US"continue",
8e669ac1 125 US"control",
6a8f9482
TK		 126#ifdef EXPERIMENTAL_DCC
127 US"dcc",
128#endif
8523533c
TK		 129#ifdef WITH_CONTENT_SCAN
130 US"decode",
131#endif
132 US"delay",
80a47a2c
TK		 133#ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
4840604e
TL		 136#endif
137#ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
8523533c 139#endif
6ea85e9a
PH		 140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
8523533c
TK		 149#ifdef WITH_CONTENT_SCAN
150 US"malware",
151#endif
152 US"message",
153#ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155#endif
b0b9dbb1 156 US"queue",
870f6ba8 157 US"ratelimit",
8523533c
TK		 158 US"recipients",
159#ifdef WITH_CONTENT_SCAN
160 US"regex",
161#endif
e7568d51 162 US"remove_header",
b0b9dbb1
JH		 163 US"sender_domains",
164 US"senders",
165 US"set",
8523533c
TK		 166#ifdef WITH_CONTENT_SCAN
167 US"spam",
168#endif
169#ifdef EXPERIMENTAL_SPF
170 US"spf",
65a7d8c3 171 US"spf_guess",
8523533c 172#endif
b0019c78 173 US"udpsend",
059ec3d9 174 US"verify" };
8e669ac1 175
c5fcb476 176
9a26b6b2
PH		 177/* Return values from decode_control(); keep in step with the table of names
178that follows! */
179
180enum {
c46782ef 181 CONTROL_AUTH_UNADVERTISED,
3c8b3577 182#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 183 CONTROL_BMI_RUN,
3c8b3577 184#endif
ed7f7860 185 CONTROL_DEBUG,
3c8b3577 186#ifndef DISABLE_DKIM
f7572e5a 187 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 188#endif
189#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 190 CONTROL_DMARC_VERIFY,
191 CONTROL_DMARC_FORENSIC,
3c8b3577 192#endif
13363eba 193 CONTROL_DSCP,
c46782ef
PH		 194 CONTROL_ERROR,
195 CONTROL_CASEFUL_LOCAL_PART,
196 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 197 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 198 CONTROL_ENFORCE_SYNC,
199 CONTROL_NO_ENFORCE_SYNC,
200 CONTROL_FREEZE,
201 CONTROL_QUEUE_ONLY,
202 CONTROL_SUBMISSION,
203 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 204#ifdef WITH_CONTENT_SCAN
9a26b6b2 205 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 206#endif
c46782ef
PH		 207 CONTROL_FAKEDEFER,
208 CONTROL_FAKEREJECT,
8c5d388a 209#ifdef SUPPORT_I18N
3c8b3577
JH		 210 CONTROL_UTF8_DOWNCONVERT,
211#endif
cf8b11a5 212 CONTROL_NO_MULTILINE,
047bdd8c 213 CONTROL_NO_PIPELINING,
4c590bd1
PH		 214 CONTROL_NO_DELAY_FLUSH,
215 CONTROL_NO_CALLOUT_FLUSH
c46782ef 216};
9a26b6b2 217
8800895a
PH		 218/* ACL control names; keep in step with the table above! This list is used for
219turning ids into names. The actual list of recognized names is in the variable
220control_def controls_list[] below. The fact that there are two lists is a mess
221and should be tidied up. */
9a26b6b2
PH		 222
223static uschar *controls[] = {
c46782ef 224 US"allow_auth_unadvertised",
3c8b3577 225#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 226 US"bmi_run",
3c8b3577 227#endif
ed7f7860 228 US"debug",
3c8b3577 229#ifndef DISABLE_DKIM
80a47a2c 230 US"dkim_disable_verify",
3c8b3577
JH		 231#endif
232#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 233 US"dmarc_disable_verify",
234 US"dmarc_enable_forensic",
3c8b3577 235#endif
13363eba 236 US"dscp",
c46782ef
PH		 237 US"error",
238 US"caseful_local_part",
239 US"caselower_local_part",
e4bdf652 240 US"cutthrough_delivery",
c46782ef
PH		 241 US"enforce_sync",
242 US"no_enforce_sync",
243 US"freeze",
244 US"queue_only",
245 US"submission",
246 US"suppress_local_fixups",
3c8b3577 247#ifdef WITH_CONTENT_SCAN
9a26b6b2 248 US"no_mbox_unspool",
3c8b3577 249#endif
cf8b11a5
PH		 250 US"fakedefer",
251 US"fakereject",
8c5d388a 252#ifdef SUPPORT_I18N
3c8b3577
JH		 253 US"utf8_downconvert",
254#endif
aa6dc513 255 US"no_multiline_responses",
cf8b11a5 256 US"no_pipelining",
4c590bd1
PH		 257 US"no_delay_flush",
258 US"no_callout_flush"
c46782ef 259};
059ec3d9 260
047bdd8c 261/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 262at the outer level. In the other cases, expansion already occurs in the
263checking functions. */
264
265static uschar cond_expand_at_top[] = {
7421ecab 266 FALSE, /* acl */
3e536984 267 TRUE, /* add_header */
059ec3d9 268 FALSE, /* authenticated */
8523533c
TK		 269#ifdef EXPERIMENTAL_BRIGHTMAIL
270 TRUE, /* bmi_optin */
8e669ac1 271#endif
059ec3d9 272 TRUE, /* condition */
c3611384 273 TRUE, /* continue */
059ec3d9 274 TRUE, /* control */
6a8f9482
TK		 275#ifdef EXPERIMENTAL_DCC
276 TRUE, /* dcc */
277#endif
8523533c
TK		 278#ifdef WITH_CONTENT_SCAN
279 TRUE, /* decode */
280#endif
059ec3d9 281 TRUE, /* delay */
80a47a2c
TK		 282#ifndef DISABLE_DKIM
283 TRUE, /* dkim_signers */
284 TRUE, /* dkim_status */
4840604e
TL		 285#endif
286#ifdef EXPERIMENTAL_DMARC
287 TRUE, /* dmarc_status */
8523533c 288#endif
059ec3d9
PH		 289 TRUE, /* dnslists */
290 FALSE, /* domains */
291 FALSE, /* encrypted */
292 TRUE, /* endpass */
293 FALSE, /* hosts */
294 FALSE, /* local_parts */
295 TRUE, /* log_message */
6ea85e9a 296 TRUE, /* log_reject_target */
059ec3d9 297 TRUE, /* logwrite */
8523533c
TK		 298#ifdef WITH_CONTENT_SCAN
299 TRUE, /* malware */
300#endif
059ec3d9 301 TRUE, /* message */
8523533c
TK		 302#ifdef WITH_CONTENT_SCAN
303 TRUE, /* mime_regex */
304#endif
b0b9dbb1 305 TRUE, /* queue */
870f6ba8 306 TRUE, /* ratelimit */
059ec3d9 307 FALSE, /* recipients */
8523533c
TK		 308#ifdef WITH_CONTENT_SCAN
309 TRUE, /* regex */
310#endif
e7568d51 311 TRUE, /* remove_header */
059ec3d9
PH		 312 FALSE, /* sender_domains */
313 FALSE, /* senders */
314 TRUE, /* set */
8523533c
TK		 315#ifdef WITH_CONTENT_SCAN
316 TRUE, /* spam */
317#endif
318#ifdef EXPERIMENTAL_SPF
319 TRUE, /* spf */
65a7d8c3 320 TRUE, /* spf_guess */
8523533c 321#endif
b0019c78 322 TRUE, /* udpsend */
059ec3d9
PH		 323 TRUE /* verify */
324};
325
326/* Flags to identify the modifiers */
327
328static uschar cond_modifiers[] = {
329 FALSE, /* acl */
3e536984 330 TRUE, /* add_header */
059ec3d9 331 FALSE, /* authenticated */
8523533c
TK		 332#ifdef EXPERIMENTAL_BRIGHTMAIL
333 TRUE, /* bmi_optin */
8e669ac1 334#endif
059ec3d9 335 FALSE, /* condition */
c3611384 336 TRUE, /* continue */
059ec3d9 337 TRUE, /* control */
6a8f9482
TK		 338#ifdef EXPERIMENTAL_DCC
339 FALSE, /* dcc */
340#endif
8523533c
TK		 341#ifdef WITH_CONTENT_SCAN
342 FALSE, /* decode */
343#endif
059ec3d9 344 TRUE, /* delay */
80a47a2c
TK		 345#ifndef DISABLE_DKIM
346 FALSE, /* dkim_signers */
347 FALSE, /* dkim_status */
4840604e
TL		 348#endif
349#ifdef EXPERIMENTAL_DMARC
350 FALSE, /* dmarc_status */
8523533c 351#endif
059ec3d9
PH		 352 FALSE, /* dnslists */
353 FALSE, /* domains */
354 FALSE, /* encrypted */
355 TRUE, /* endpass */
356 FALSE, /* hosts */
357 FALSE, /* local_parts */
358 TRUE, /* log_message */
6ea85e9a 359 TRUE, /* log_reject_target */
8523533c
TK		 360 TRUE, /* logwrite */
361#ifdef WITH_CONTENT_SCAN
362 FALSE, /* malware */
363#endif
059ec3d9 364 TRUE, /* message */
8523533c
TK		 365#ifdef WITH_CONTENT_SCAN
366 FALSE, /* mime_regex */
367#endif
b0b9dbb1 368 TRUE, /* queue */
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
80a47a2c
TK		 450 #ifndef DISABLE_DKIM
451 (unsigned int)
452 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 453
80a47a2c
TK		 454 (unsigned int)
455 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 456 #endif
fb2274d4 457
4840604e
TL		 458 #ifdef EXPERIMENTAL_DMARC
459 (unsigned int)
460 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
461 #endif
462
379ba7d0
JH		 463 /* Explicit key lookups can be made in non-smtp ACLs so pass
464 always and check in the verify processing itself. */
465
466 0, /* dnslists */
059ec3d9 467
2f079f46 468 (unsigned int)
fd98a5c6 469 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 470 |(1<<ACL_WHERE_VRFY)
8ccd00b1 471 #ifndef DISABLE_PRDR
fd98a5c6
JH		 472 |(1<<ACL_WHERE_PRDR)
473 #endif
474 ),
059ec3d9 475
45b91596
PH		 476 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
477 (1<<ACL_WHERE_CONNECT)|
478 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 479 (1<<ACL_WHERE_HELO),
8e669ac1 480
059ec3d9 481 0, /* endpass */
8e669ac1 482
45b91596
PH		 483 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
484 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 485
2f079f46 486 (unsigned int)
fd98a5c6 487 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 488 |(1<<ACL_WHERE_VRFY)
2e6afa4f 489 #ifndef DISABLE_PRDR
fd98a5c6
JH		 490 |(1<<ACL_WHERE_PRDR)
491 #endif
492 ),
059ec3d9
PH		 493
494 0, /* log_message */
8e669ac1 495
6ea85e9a
PH		 496 0, /* log_reject_target */
497
059ec3d9 498 0, /* logwrite */
8e669ac1 499
71fafd95 500 #ifdef WITH_CONTENT_SCAN
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 503 #ifndef DISABLE_PRDR
fd98a5c6 504 (1<<ACL_WHERE_PRDR)|
8ccd00b1 505 #endif
fd98a5c6 506 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 507 #endif
8523533c 508
059ec3d9
PH		 509 0, /* message */
510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 512 (unsigned int)
513 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 514 #endif
8523533c 515
ecc5f51a
JH		 516 (1<<ACL_WHERE_NOTSMTP)| /* queue */
517 #ifndef DISABLE_PRDR
518 (1<<ACL_WHERE_PRDR)|
519 #endif
520 (1<<ACL_WHERE_DATA),
521
870f6ba8
TF		 522 0, /* ratelimit */
523
2f079f46
PH		 524 (unsigned int)
525 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 526
71fafd95 527 #ifdef WITH_CONTENT_SCAN
2f079f46 528 (unsigned int)
fd98a5c6 529 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 530 #ifndef DISABLE_PRDR
fd98a5c6 531 (1<<ACL_WHERE_PRDR)|
8ccd00b1 532 #endif
fd98a5c6 533 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 534 (1<<ACL_WHERE_MIME)),
71fafd95 535 #endif
8523533c 536
e7568d51
TL		 537 (unsigned int)
538 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
539 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 540 #ifndef DISABLE_PRDR
fd98a5c6
JH		 541 (1<<ACL_WHERE_PRDR)|
542 #endif
e7568d51
TL		 543 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
544 (1<<ACL_WHERE_NOTSMTP_START)),
545
059ec3d9
PH		 546 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
547 (1<<ACL_WHERE_HELO)|
548 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
549 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
550 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
551
552 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
553 (1<<ACL_WHERE_HELO)|
554 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
555 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
556 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
557
558 0, /* set */
559
71fafd95 560 #ifdef WITH_CONTENT_SCAN
2f079f46 561 (unsigned int)
fd98a5c6 562 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 563 #ifndef DISABLE_PRDR
fd98a5c6 564 (1<<ACL_WHERE_PRDR)|
8ccd00b1 565 #endif
fd98a5c6 566 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 567 #endif
8523533c 568
71fafd95 569 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 570 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
571 (1<<ACL_WHERE_HELO)|
572 (1<<ACL_WHERE_MAILAUTH)|
573 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 574 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
575 (1<<ACL_WHERE_NOTSMTP)|
576 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 577
578 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
579 (1<<ACL_WHERE_HELO)|
580 (1<<ACL_WHERE_MAILAUTH)|
581 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
582 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
583 (1<<ACL_WHERE_NOTSMTP)|
584 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 585 #endif
8523533c 586
b0019c78
TF		 587 0, /* udpsend */
588
059ec3d9
PH		 589 /* Certain types of verify are always allowed, so we let it through
590 always and check in the verify function itself */
591
592 0 /* verify */
059ec3d9
PH		 593};
594
595
c5fcb476
PH		 596/* Bit map vector of which controls are not allowed at certain times. For
597each control, there's a bitmap of dis-allowed times. For some, it is easier to
598specify the negation of a small number of allowed times. */
599
600static unsigned int control_forbids[] = {
c46782ef
PH		 601 (unsigned int)
602 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
603
3c8b3577 604#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 605 0, /* bmi_run */
3c8b3577 606#endif
c46782ef 607
ed7f7860
PP		 608 0, /* debug */
609
3c8b3577 610#ifndef DISABLE_DKIM
80a47a2c 611 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 612# ifndef DISABLE_PRDR
fd98a5c6 613 (1<<ACL_WHERE_PRDR)|
3c8b3577 614# endif
f7572e5a 615 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 616#endif
f7572e5a 617
3c8b3577 618#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 619 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
620 (1<<ACL_WHERE_NOTSMTP_START),
621 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
622 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 623#endif
4840604e 624
13363eba
PP		 625 (1<<ACL_WHERE_NOTSMTP)|
626 (1<<ACL_WHERE_NOTSMTP_START)|
627 (1<<ACL_WHERE_NOTQUIT), /* dscp */
628
c5fcb476 629 0, /* error */
8e669ac1
PH		 630
631 (unsigned int)
c5fcb476 632 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 633
634 (unsigned int)
c5fcb476 635 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 636
e4bdf652
JH		 637 (unsigned int)
638 0, /* cutthrough_delivery */
639
45b91596
PH		 640 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
641 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 642
45b91596
PH		 643 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
644 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 645
646 (unsigned int)
c5fcb476
PH		 647 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
648 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 649 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 650 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 651
652 (unsigned int)
c5fcb476
PH		 653 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
654 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 655 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 656 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 657
658 (unsigned int)
c5fcb476 659 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 660 (1<<ACL_WHERE_PREDATA)),
8523533c 661
8800895a
PH		 662 (unsigned int)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 664 (1<<ACL_WHERE_PREDATA)|
665 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 666
3c8b3577 667#ifdef WITH_CONTENT_SCAN
8e669ac1 668 (unsigned int)
14d57970 669 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 670 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 671 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 672 (1<<ACL_WHERE_MIME)),
3c8b3577 673#endif
a6c4ab60 674
29aba418
TF		 675 (unsigned int)
676 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
677 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 678#ifndef DISABLE_PRDR
fd98a5c6 679 (1<<ACL_WHERE_PRDR)|
3c8b3577 680#endif
29aba418
TF		 681 (1<<ACL_WHERE_MIME)),
682
8e669ac1 683 (unsigned int)
a6c4ab60 684 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 685 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 686#ifndef DISABLE_PRDR
fd98a5c6 687 (1<<ACL_WHERE_PRDR)|
3c8b3577 688#endif
e715ad22 689 (1<<ACL_WHERE_MIME)),
8523533c 690
8c5d388a 691#ifdef SUPPORT_I18N
3c8b3577
JH		 692 0, /* utf8_downconvert */
693#endif
694
45b91596 695 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 696 (1<<ACL_WHERE_NOTSMTP_START),
697
698 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 699 (1<<ACL_WHERE_NOTSMTP_START),
700
701 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 702 (1<<ACL_WHERE_NOTSMTP_START),
703
704 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 705 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 706};
707
708/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 709
710typedef struct control_def {
711 uschar *name;
712 int value; /* CONTROL_xxx value */
059ec3d9
PH		 713 BOOL has_option; /* Has /option(s) following */
714} control_def;
715
716static control_def controls_list[] = {
3c8b3577 717 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 718#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 719 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 720#endif
3c8b3577 721 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 722#ifndef DISABLE_DKIM
3c8b3577 723 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 724#endif
725#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 726 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
727 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 728#endif
3c8b3577
JH		 729 { US"dscp", CONTROL_DSCP, TRUE },
730 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
731 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
732 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
733 { US"freeze", CONTROL_FREEZE, TRUE },
734 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
735 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
736 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
737 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
738 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
739 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 740#ifdef WITH_CONTENT_SCAN
3c8b3577 741 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 742#endif
3c8b3577
JH		 743 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
744 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
745 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 746 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577 747 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
8c5d388a 748#ifdef SUPPORT_I18N
3c8b3577
JH		 749 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
750#endif
059ec3d9
PH		 751 };
752
e5a9dba6
PH		 753/* Support data structures for Client SMTP Authorization. acl_verify_csa()
754caches its result in a tree to avoid repeated DNS queries. The result is an
755integer code which is used as an index into the following tables of
756explanatory strings and verification return codes. */
757
758static tree_node *csa_cache = NULL;
759
760enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
761 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
762
763/* The acl_verify_csa() return code is translated into an acl_verify() return
764code using the following table. It is OK unless the client is definitely not
765authorized. This is because CSA is supposed to be optional for sending sites,
766so recipients should not be too strict about checking it - especially because
767DNS problems are quite likely to occur. It's possible to use $csa_status in
768further ACL conditions to distinguish ok, unknown, and defer if required, but
769the aim is to make the usual configuration simple. */
770
771static int csa_return_code[] = {
772 OK, OK, OK, OK,
773 FAIL, FAIL, FAIL, FAIL
774};
775
776static uschar *csa_status_string[] = {
777 US"unknown", US"ok", US"defer", US"defer",
778 US"fail", US"fail", US"fail", US"fail"
779};
780
781static uschar *csa_reason_string[] = {
782 US"unknown",
783 US"ok",
784 US"deferred (SRV lookup failed)",
785 US"deferred (target address lookup failed)",
786 US"failed (explicit authorization required)",
787 US"failed (host name not authorized)",
788 US"failed (no authorized addresses)",
789 US"failed (client address mismatch)"
790};
791
c99ce5c9
TF		 792/* Options for the ratelimit condition. Note that there are two variants of
793the per_rcpt option, depending on the ACL that is used to measure the rate.
794However any ACL must be able to look up per_rcpt rates in /noupdate mode,
795so the two variants must have the same internal representation as well as
796the same configuration string. */
797
798enum {
799 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
800 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
801};
802
803#define RATE_SET(var,new) \
804 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
805
806static uschar *ratelimit_option_string[] = {
807 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
808 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
809};
810
059ec3d9
PH		 811/* Enable recursion between acl_check_internal() and acl_check_condition() */
812
55414b25 813static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 814 uschar **);
059ec3d9
PH		 815
816
817/*************************************************
818* Pick out name from list *
819*************************************************/
820
821/* Use a binary chop method
822
823Arguments:
824 name name to find
825 list list of names
826 end size of list
827
828Returns: offset in list, or -1 if not found
829*/
830
831static int
832acl_checkname(uschar *name, uschar **list, int end)
833{
834int start = 0;
835
836while (start < end)
837 {
838 int mid = (start + end)/2;
839 int c = Ustrcmp(name, list[mid]);
840 if (c == 0) return mid;
841 if (c < 0) end = mid; else start = mid + 1;
842 }
843
844return -1;
845}
846
847
848/*************************************************
849* Read and parse one ACL *
850*************************************************/
851
852/* This function is called both from readconf in order to parse the ACLs in the
853configuration file, and also when an ACL is encountered dynamically (e.g. as
854the result of an expansion). It is given a function to call in order to
855retrieve the lines of the ACL. This function handles skipping comments and
856blank lines (where relevant).
857
858Arguments:
859 func function to get next line of ACL
860 error where to put an error message
861
862Returns: pointer to ACL, or NULL
863 NULL can be legal (empty ACL); in this case error will be NULL
864*/
865
866acl_block *
867acl_read(uschar *(*func)(void), uschar **error)
868{
869acl_block *yield = NULL;
870acl_block **lastp = &yield;
871acl_block *this = NULL;
872acl_condition_block *cond;
873acl_condition_block **condp = NULL;
874uschar *s;
875
876*error = NULL;
877
878while ((s = (*func)()) != NULL)
879 {
880 int v, c;
881 BOOL negated = FALSE;
882 uschar *saveline = s;
883 uschar name[64];
884
885 /* Conditions (but not verbs) are allowed to be negated by an initial
886 exclamation mark. */
887
888 while (isspace(*s)) s++;
889 if (*s == '!')
890 {
891 negated = TRUE;
892 s++;
893 }
894
cf00dad6
PH		 895 /* Read the name of a verb or a condition, or the start of a new ACL, which
896 can be started by a name, or by a macro definition. */
059ec3d9
PH		 897
898 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 899 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 900
901 /* If a verb is unrecognized, it may be another condition or modifier that
902 continues the previous verb. */
903
904 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
905 if (v < 0)
906 {
907 if (this == NULL)
908 {
4e167a8c
PH		 909 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
910 saveline);
059ec3d9
PH		 911 return NULL;
912 }
913 }
914
915 /* New verb */
916
917 else
918 {
919 if (negated)
920 {
921 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
922 return NULL;
923 }
924 this = store_get(sizeof(acl_block));
925 *lastp = this;
926 lastp = &(this->next);
927 this->next = NULL;
928 this->verb = v;
929 this->condition = NULL;
930 condp = &(this->condition);
931 if (*s == 0) continue; /* No condition on this line */
932 if (*s == '!')
933 {
934 negated = TRUE;
935 s++;
936 }
937 s = readconf_readname(name, sizeof(name), s); /* Condition name */
938 }
939
940 /* Handle a condition or modifier. */
941
942 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
943 if (c < 0)
944 {
945 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
946 saveline);
947 return NULL;
948 }
949
950 /* The modifiers may not be negated */
951
952 if (negated && cond_modifiers[c])
953 {
954 *error = string_sprintf("ACL error: negation is not allowed with "
955 "\"%s\"", conditions[c]);
956 return NULL;
957 }
958
959 /* ENDPASS may occur only with ACCEPT or DISCARD. */
960
961 if (c == ACLC_ENDPASS &&
962 this->verb != ACL_ACCEPT &&
963 this->verb != ACL_DISCARD)
964 {
965 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
966 conditions[c], verbs[this->verb]);
967 return NULL;
968 }
969
970 cond = store_get(sizeof(acl_condition_block));
971 cond->next = NULL;
972 cond->type = c;
973 cond->u.negated = negated;
974
975 *condp = cond;
976 condp = &(cond->next);
977
978 /* The "set" modifier is different in that its argument is "name=value"
979 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 980 gives us a variable name to insert into the data block. The original ACL
981 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
982 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 983 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
984 After that, we allow alphanumerics and underscores, but the first character
985 after c or m must be a digit or an underscore. This retains backwards
986 compatibility. */
059ec3d9
PH		 987
988 if (c == ACLC_SET)
989 {
47ca6d6c
PH		 990 uschar *endptr;
991
38a0a95f
PH		 992 if (Ustrncmp(s, "acl_c", 5) != 0 &&
993 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 994 {
38a0a95f
PH		 995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
997 return NULL;
47ca6d6c 998 }
38a0a95f
PH		 999
1000 endptr = s + 5;
641cb756
PH		 1001 if (!isdigit(*endptr) && *endptr != '_')
1002 {
1003 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1004 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1005 s);
1006 return NULL;
1007 }
1008
38a0a95f 1009 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1010 {
38a0a95f
PH		 1011 if (!isalnum(*endptr) && *endptr != '_')
1012 {
1013 *error = string_sprintf("invalid character \"%c\" in variable name "
1014 "in ACL modifier \"set %s\"", *endptr, s);
1015 return NULL;
1016 }
1017 endptr++;
47ca6d6c 1018 }
47ca6d6c 1019
38a0a95f 1020 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1021 s = endptr;
059ec3d9
PH		 1022 while (isspace(*s)) s++;
1023 }
1024
1025 /* For "set", we are now positioned for the data. For the others, only
1026 "endpass" has no data */
1027
1028 if (c != ACLC_ENDPASS)
1029 {
1030 if (*s++ != '=')
1031 {
1032 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1033 cond_modifiers[c]? US"modifier" : US"condition");
1034 return NULL;
1035 }
1036 while (isspace(*s)) s++;
1037 cond->arg = string_copy(s);
1038 }
1039 }
1040
1041return yield;
1042}
1043
1044
1045
71fafd95
PH		 1046/*************************************************
1047* Set up added header line(s) *
1048*************************************************/
1049
1050/* This function is called by the add_header modifier, and also from acl_warn()
1051to implement the now-deprecated way of adding header lines using "message" on a
1052"warn" verb. The argument is treated as a sequence of header lines which are
1053added to a chain, provided there isn't an identical one already there.
1054
1055Argument: string of header lines
1056Returns: nothing
1057*/
1058
1059static void
55414b25 1060setup_header(const uschar *hstring)
71fafd95 1061{
55414b25 1062const uschar *p, *q;
71fafd95
PH		 1063int hlen = Ustrlen(hstring);
1064
b1b05573
JH		 1065/* Ignore any leading newlines */
1066while (*hstring == '\n') hstring++, hlen--;
71fafd95 1067
b1b05573 1068/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1069if (hlen <= 0) return;
96f5fe4c 1070if (hstring[--hlen] != '\n') /* no newline */
55414b25 1071 q = string_sprintf("%s\n", hstring);
96f5fe4c 1072else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 1073 {
1074 uschar * s = string_copy(hstring);
1075 while(s[--hlen] == '\n')
1076 s[hlen+1] = '\0';
1077 q = s;
1078 }
1079else
1080 q = hstring;
71fafd95
PH		 1081
1082/* Loop for multiple header lines, taking care about continuations */
1083
55414b25 1084for (p = q; *p != 0; )
71fafd95 1085 {
55414b25
JH		 1086 const uschar *s;
1087 uschar * hdr;
71fafd95
PH		 1088 int newtype = htype_add_bot;
1089 header_line **hptr = &acl_added_headers;
1090
1091 /* Find next header line within the string */
1092
1093 for (;;)
1094 {
96f5fe4c 1095 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH		 1096 if (*(++q) != ' ' && *q != '\t') break;
1097 }
1098
1099 /* If the line starts with a colon, interpret the instruction for where to
1100 add it. This temporarily sets up a new type. */
1101
1102 if (*p == ':')
1103 {
1104 if (strncmpic(p, US":after_received:", 16) == 0)
1105 {
1106 newtype = htype_add_rec;
1107 p += 16;
1108 }
1109 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1110 {
1111 newtype = htype_add_rfc;
1112 p += 14;
1113 }
1114 else if (strncmpic(p, US":at_start:", 10) == 0)
1115 {
1116 newtype = htype_add_top;
1117 p += 10;
1118 }
1119 else if (strncmpic(p, US":at_end:", 8) == 0)
1120 {
1121 newtype = htype_add_bot;
1122 p += 8;
1123 }
1124 while (*p == ' ' || *p == '\t') p++;
1125 }
1126
1127 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1128 to the front of it. */
1129
1130 for (s = p; s < q - 1; s++)
1131 {
1132 if (*s == ':' || !isgraph(*s)) break;
1133 }
1134
55414b25
JH		 1135 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1136 hlen = Ustrlen(hdr);
71fafd95
PH		 1137
1138 /* See if this line has already been added */
1139
1140 while (*hptr != NULL)
1141 {
55414b25 1142 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1143 hptr = &((*hptr)->next);
1144 }
1145
1146 /* Add if not previously present */
1147
1148 if (*hptr == NULL)
1149 {
1150 header_line *h = store_get(sizeof(header_line));
55414b25 1151 h->text = hdr;
71fafd95
PH		 1152 h->next = NULL;
1153 h->type = newtype;
1154 h->slen = hlen;
1155 *hptr = h;
1156 hptr = &(h->next);
1157 }
1158
1159 /* Advance for next header line within the string */
1160
1161 p = q;
1162 }
1163}
1164
1165
1166
362145b5
JH		 1167/*************************************************
1168* List the added header lines *
1169*************************************************/
1170uschar *
1171fn_hdrs_added(void)
1172{
1173uschar * ret = NULL;
5f5be492
JH		 1174int size = 0;
1175int ptr = 0;
362145b5
JH		 1176header_line * h = acl_added_headers;
1177uschar * s;
1178uschar * cp;
362145b5
JH		 1179
1180if (!h) return NULL;
1181
1182do
1183 {
1184 s = h->text;
1185 while ((cp = Ustrchr(s, '\n')) != NULL)
1186 {
1187 if (cp[1] == '\0') break;
1188
1189 /* contains embedded newline; needs doubling */
c2f669a4
JH		 1190 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1191 ret = string_catn(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1192 s = cp+1;
1193 }
1194 /* last bit of header */
1195
c2f669a4 1196 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
362145b5 1197 }
6d9cfc47 1198while((h = h->next));
362145b5
JH		 1199
1200ret[ptr-1] = '\0'; /* overwrite last newline */
1201return ret;
1202}
1203
1204
e7568d51
TL		 1205/*************************************************
1206* Set up removed header line(s) *
1207*************************************************/
1208
1209/* This function is called by the remove_header modifier. The argument is
1210treated as a sequence of header names which are added to a colon separated
1211list, provided there isn't an identical one already there.
1212
1213Argument: string of header names
1214Returns: nothing
1215*/
1216
1217static void
55414b25 1218setup_remove_header(const uschar *hnames)
e7568d51
TL		 1219{
1220if (*hnames != 0)
55414b25
JH		 1221 acl_removed_headers = acl_removed_headers
1222 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1223 : string_copy(hnames);
e7568d51
TL		 1224}
1225
1226
71fafd95 1227
059ec3d9
PH		 1228/*************************************************
1229* Handle warnings *
1230*************************************************/
1231
1232/* This function is called when a WARN verb's conditions are true. It adds to
1233the message's headers, and/or writes information to the log. In each case, this
1234only happens once (per message for headers, per connection for log).
1235
71fafd95
PH		 1236** NOTE: The header adding action using the "message" setting is historic, and
1237its use is now deprecated. The new add_header modifier should be used instead.
1238
059ec3d9
PH		 1239Arguments:
1240 where ACL_WHERE_xxxx indicating which ACL this is
1241 user_message message for adding to headers
1242 log_message message for logging, if different
1243
1244Returns: nothing
1245*/
1246
1247static void
1248acl_warn(int where, uschar *user_message, uschar *log_message)
1249{
059ec3d9
PH		 1250if (log_message != NULL && log_message != user_message)
1251 {
1252 uschar *text;
1253 string_item *logged;
1254
1255 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1256 string_printing(log_message));
1257
1258 /* If a sender verification has failed, and the log message is "sender verify
1259 failed", add the failure message. */
1260
1261 if (sender_verified_failed != NULL &&
1262 sender_verified_failed->message != NULL &&
1263 strcmpic(log_message, US"sender verify failed") == 0)
1264 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1265
9c7a242c
PH		 1266 /* Search previously logged warnings. They are kept in malloc
1267 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1268
1269 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1270 if (Ustrcmp(logged->text, text) == 0) break;
1271
1272 if (logged == NULL)
1273 {
1274 int length = Ustrlen(text) + 1;
1275 log_write(0, LOG_MAIN, "%s", text);
1276 logged = store_malloc(sizeof(string_item) + length);
1277 logged->text = (uschar *)logged + sizeof(string_item);
1278 memcpy(logged->text, text, length);
1279 logged->next = acl_warn_logged;
1280 acl_warn_logged = logged;
1281 }
1282 }
1283
1284/* If there's no user message, we are done. */
1285
1286if (user_message == NULL) return;
1287
1288/* If this isn't a message ACL, we can't do anything with a user message.
1289Log an error. */
1290
1291if (where > ACL_WHERE_NOTSMTP)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1294 "found in a non-message (%s) ACL: cannot specify header lines here: "
1295 "message ignored", acl_wherenames[where]);
1296 return;
1297 }
1298
71fafd95
PH		 1299/* The code for setting up header lines is now abstracted into a separate
1300function so that it can be used for the add_header modifier as well. */
059ec3d9 1301
71fafd95 1302setup_header(user_message);
059ec3d9
PH		 1303}
1304
1305
1306
1307/*************************************************
1308* Verify and check reverse DNS *
1309*************************************************/
1310
1311/* Called from acl_verify() below. We look up the host name(s) of the client IP
1312address if this has not yet been done. The host_name_lookup() function checks
1313that one of these names resolves to an address list that contains the client IP
1314address, so we don't actually have to do the check here.
1315
1316Arguments:
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319
1320Returns: OK verification condition succeeded
1321 FAIL verification failed
1322 DEFER there was a problem verifying
1323*/
1324
1325static int
1326acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1327{
1328int rc;
1329
1330user_msgptr = user_msgptr; /* stop compiler warning */
1331
1332/* Previous success */
1333
1334if (sender_host_name != NULL) return OK;
1335
1336/* Previous failure */
1337
1338if (host_lookup_failed)
1339 {
1340 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1341 return FAIL;
1342 }
1343
1344/* Need to do a lookup */
1345
1346HDEBUG(D_acl)
1347 debug_printf("looking up host name to force name/address consistency check\n");
1348
1349if ((rc = host_name_lookup()) != OK)
1350 {
1351 *log_msgptr = (rc == DEFER)?
1352 US"host lookup deferred for reverse lookup check"
1353 :
1354 string_sprintf("host lookup failed for reverse lookup check%s",
1355 host_lookup_msg);
1356 return rc; /* DEFER or FAIL */
1357 }
1358
1359host_build_sender_fullhost();
1360return OK;
1361}
1362
1363
1364
e5a9dba6
PH		 1365/*************************************************
1366* Check client IP address matches CSA target *
1367*************************************************/
1368
1369/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1370response for address records belonging to the CSA target hostname. The section
1371is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1372If one of the addresses matches the client's IP address, then the client is
1373authorized by CSA. If there are target IP addresses but none of them match
1374then the client is using an unauthorized IP address. If there are no target IP
1375addresses then the client cannot be using an authorized IP address. (This is
1376an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1377
1378Arguments:
1379 dnsa the DNS answer block
1380 dnss a DNS scan block for us to use
1381 reset option specifing what portion to scan, as described above
1382 target the target hostname to use for matching RR names
1383
1384Returns: CSA_OK successfully authorized
1385 CSA_FAIL_MISMATCH addresses found but none matched
1386 CSA_FAIL_NOADDR no target addresses found
1387*/
1388
1389static int
1390acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1391 uschar *target)
1392{
1393dns_record *rr;
1394dns_address *da;
1395
1396BOOL target_found = FALSE;
1397
1398for (rr = dns_next_rr(dnsa, dnss, reset);
1399 rr != NULL;
1400 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1401 {
1402 /* Check this is an address RR for the target hostname. */
1403
1404 if (rr->type != T_A
1405 #if HAVE_IPV6
1406 && rr->type != T_AAAA
e5a9dba6
PH		 1407 #endif
1408 ) continue;
1409
1410 if (strcmpic(target, rr->name) != 0) continue;
1411
1412 target_found = TRUE;
1413
1414 /* Turn the target address RR into a list of textual IP addresses and scan
1415 the list. There may be more than one if it is an A6 RR. */
1416
1417 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1418 {
1419 /* If the client IP address matches the target IP address, it's good! */
1420
1421 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1422
1423 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1424 }
1425 }
1426
1427/* If we found some target addresses but none of them matched, the client is
1428using an unauthorized IP address, otherwise the target has no authorized IP
1429addresses. */
1430
1431if (target_found) return CSA_FAIL_MISMATCH;
1432else return CSA_FAIL_NOADDR;
1433}
1434
1435
1436
1437/*************************************************
1438* Verify Client SMTP Authorization *
1439*************************************************/
1440
1441/* Called from acl_verify() below. This routine calls dns_lookup_special()
1442to find the CSA SRV record corresponding to the domain argument, or
1443$sender_helo_name if no argument is provided. It then checks that the
1444client is authorized, and that its IP address corresponds to the SRV
1445target's address by calling acl_verify_csa_address() above. The address
1446should have been returned in the DNS response's ADDITIONAL section, but if
1447not we perform another DNS lookup to get it.
1448
1449Arguments:
1450 domain pointer to optional parameter following verify = csa
1451
1452Returns: CSA_UNKNOWN no valid CSA record found
1453 CSA_OK successfully authorized
1454 CSA_FAIL_* client is definitely not authorized
1455 CSA_DEFER_* there was a DNS problem
1456*/
1457
1458static int
55414b25 1459acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1460{
1461tree_node *t;
55414b25
JH		 1462const uschar *found;
1463uschar *p;
e5a9dba6
PH		 1464int priority, weight, port;
1465dns_answer dnsa;
1466dns_scan dnss;
1467dns_record *rr;
1468int rc, type;
1469uschar target[256];
1470
1471/* Work out the domain we are using for the CSA lookup. The default is the
1472client's HELO domain. If the client has not said HELO, use its IP address
1473instead. If it's a local client (exim -bs), CSA isn't applicable. */
1474
1475while (isspace(*domain) && *domain != '\0') ++domain;
1476if (*domain == '\0') domain = sender_helo_name;
1477if (domain == NULL) domain = sender_host_address;
1478if (sender_host_address == NULL) return CSA_UNKNOWN;
1479
1480/* If we have an address literal, strip off the framing ready for turning it
1481into a domain. The framing consists of matched square brackets possibly
1482containing a keyword and a colon before the actual IP address. */
1483
1484if (domain[0] == '[')
1485 {
55414b25 1486 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1487 if (start == NULL) start = domain;
1488 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1489 }
1490
1491/* Turn domains that look like bare IP addresses into domains in the reverse
1492DNS. This code also deals with address literals and $sender_host_address. It's
1493not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1494address literals, but it's probably the most friendly thing to do. This is an
1495extension to CSA, so we allow it to be turned off for proper conformance. */
1496
7e66e54d 1497if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1498 {
1499 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1500 dns_build_reverse(domain, target);
1501 domain = target;
1502 }
1503
1504/* Find out if we've already done the CSA check for this domain. If we have,
1505return the same result again. Otherwise build a new cached result structure
1506for this domain. The name is filled in now, and the value is filled in when
1507we return from this function. */
1508
1509t = tree_search(csa_cache, domain);
1510if (t != NULL) return t->data.val;
1511
1512t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1513Ustrcpy(t->name, domain);
1514(void)tree_insertnode(&csa_cache, t);
1515
1516/* Now we are ready to do the actual DNS lookup(s). */
1517
28e6ef29 1518found = domain;
e5a9dba6
PH		 1519switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1520 {
1521 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1522
1523 default:
1524 return t->data.val = CSA_DEFER_SRV;
1525
1526 /* If we found nothing, the client's authorization is unknown. */
1527
1528 case DNS_NOMATCH:
1529 case DNS_NODATA:
1530 return t->data.val = CSA_UNKNOWN;
1531
1532 /* We got something! Go on to look at the reply in more detail. */
1533
1534 case DNS_SUCCEED:
1535 break;
1536 }
1537
1538/* Scan the reply for well-formed CSA SRV records. */
1539
1540for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1541 rr != NULL;
1542 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1543 {
1544 if (rr->type != T_SRV) continue;
1545
1546 /* Extract the numerical SRV fields (p is incremented) */
1547
1548 p = rr->data;
1549 GETSHORT(priority, p);
1550 GETSHORT(weight, p);
1551 GETSHORT(port, p);
1552
1553 DEBUG(D_acl)
1554 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1555
1556 /* Check the CSA version number */
1557
1558 if (priority != 1) continue;
1559
1560 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1561 found by dns_special_lookup() is a parent of the one we asked for), we check
1562 the subdomain assertions in the port field. At the moment there's only one
1563 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1564 SRV records of their own. */
1565
1dc92d5a 1566 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1567 {
1568 if (port & 1)
1569 return t->data.val = CSA_FAIL_EXPLICIT;
1570 else
1571 return t->data.val = CSA_UNKNOWN;
1572 }
1573
1574 /* This CSA SRV record refers directly to our domain, so we check the value
1575 in the weight field to work out the domain's authorization. 0 and 1 are
1576 unauthorized; 3 means the client is authorized but we can't check the IP
1577 address in order to authenticate it, so we treat it as unknown; values
1578 greater than 3 are undefined. */
1579
1580 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1581
1582 if (weight > 2) continue;
1583
1584 /* Weight == 2, which means the domain is authorized. We must check that the
1585 client's IP address is listed as one of the SRV target addresses. Save the
1586 target hostname then break to scan the additional data for its addresses. */
1587
1588 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1589 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1590
1591 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1592
1593 break;
1594 }
1595
1596/* If we didn't break the loop then no appropriate records were found. */
1597
1598if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1599
1600/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1601A target of "." indicates there are no valid addresses, so the client cannot
1602be authorized. (This is an odd configuration because weight=2 target=. is
1603equivalent to weight=1, but we check for it in order to keep load off the
1604root name servers.) Note that dn_expand() turns "." into "". */
1605
1606if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1607
1608/* Scan the additional section of the CSA SRV reply for addresses belonging
1609to the target. If the name server didn't return any additional data (e.g.
1610because it does not fully support SRV records), we need to do another lookup
1611to obtain the target addresses; otherwise we have a definitive result. */
1612
1613rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1614if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1615
1616/* The DNS lookup type corresponds to the IP version used by the client. */
1617
1618#if HAVE_IPV6
1619if (Ustrchr(sender_host_address, ':') != NULL)
1620 type = T_AAAA;
1621else
1622#endif /* HAVE_IPV6 */
1623 type = T_A;
1624
1625
4e0983dc 1626lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1627switch (dns_lookup(&dnsa, target, type, NULL))
1628 {
1629 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1630
1631 default:
cc00f4af 1632 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1633
1634 /* If the query succeeded, scan the addresses and return the result. */
1635
1636 case DNS_SUCCEED:
cc00f4af
JH		 1637 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1638 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1639 /* else fall through */
e5a9dba6
PH		 1640
1641 /* If the target has no IP addresses, the client cannot have an authorized
1642 IP address. However, if the target site uses A6 records (not AAAA records)
1643 we have to do yet another lookup in order to check them. */
1644
1645 case DNS_NOMATCH:
1646 case DNS_NODATA:
cc00f4af 1647 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1648 }
1649}
1650
1651
1652
059ec3d9
PH		 1653/*************************************************
1654* Handle verification (address & other) *
1655*************************************************/
1656
89583014 1657enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1658 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1659 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1660 };
1661typedef struct {
1662 uschar * name;
1663 int value;
1664 unsigned where_allowed; /* bitmap */
1665 BOOL no_options; /* Never has /option(s) following */
1666 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1667 } verify_type_t;
1668static verify_type_t verify_type_list[] = {
7e8360e6 1669 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1670 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1671 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1672 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1673 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1674 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1675 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1676 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1677 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1678 FALSE, 6 },
770747fd
MFM		 1679 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1680 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1681 };
1682
1683
1684enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1685 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1686 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1687 CALLOUT_TIME
1688 };
1689typedef struct {
1690 uschar * name;
1691 int value;
1692 int flag;
1693 BOOL has_option; /* Has =option(s) following */
1694 BOOL timeval; /* Has a time value */
1695 } callout_opt_t;
1696static callout_opt_t callout_opt_list[] = {
1697 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1698 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1699 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1700 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1701 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1702 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1703 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1704 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1705 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1706 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1707 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1708 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1709 };
1710
1711
1712
059ec3d9
PH		 1713/* This function implements the "verify" condition. It is called when
1714encountered in any ACL, because some tests are almost always permitted. Some
1715just don't make sense, and always fail (for example, an attempt to test a host
1716lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1717
1718Arguments:
1719 where where called from
1720 addr the recipient address that the ACL is handling, or NULL
1721 arg the argument of "verify"
1722 user_msgptr pointer for user message
1723 log_msgptr pointer for log message
1724 basic_errno where to put verify errno
1725
1726Returns: OK verification condition succeeded
1727 FAIL verification failed
1728 DEFER there was a problem verifying
1729 ERROR syntax error
1730*/
1731
1732static int
55414b25 1733acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1734 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1735{
1736int sep = '/';
1737int callout = -1;
1738int callout_overall = -1;
4deaf07d 1739int callout_connect = -1;
059ec3d9
PH		 1740int verify_options = 0;
1741int rc;
1742BOOL verify_header_sender = FALSE;
1743BOOL defer_ok = FALSE;
1744BOOL callout_defer_ok = FALSE;
1745BOOL no_details = FALSE;
eafd343b 1746BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1747address_item *sender_vaddr = NULL;
1748uschar *verify_sender_address = NULL;
1749uschar *pm_mailfrom = NULL;
1750uschar *se_mailfrom = NULL;
596875b3
PH		 1751
1752/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1753an error if options are given for items that don't expect them.
596875b3
PH		 1754*/
1755
1756uschar *slash = Ustrchr(arg, '/');
55414b25 1757const uschar *list = arg;
059ec3d9 1758uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1759verify_type_t * vp;
059ec3d9
PH		 1760
1761if (ss == NULL) goto BAD_VERIFY;
1762
1763/* Handle name/address consistency verification in a separate function. */
1764
89583014
JH		 1765for (vp= verify_type_list;
1766 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1767 vp++
1768 )
1769 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1770 : strcmpic (ss, vp->name) == 0)
1771 break;
1772if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1773 goto BAD_VERIFY;
1774
1775if (vp->no_options && slash != NULL)
059ec3d9 1776 {
89583014
JH		 1777 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1778 "(this verify item has no options)", arg);
1779 return ERROR;
059ec3d9 1780 }
89583014 1781if (!(vp->where_allowed & (1<<where)))
059ec3d9 1782 {
89583014
JH		 1783 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786switch(vp->value)
596875b3 1787 {
89583014
JH		 1788 case VERIFY_REV_HOST_LKUP:
1789 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1790 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1791 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1792 if (strcmpic(ss, US"defer_ok") == 0)
1793 return OK;
1794 return rc;
059ec3d9 1795
89583014
JH		 1796 case VERIFY_CERT:
1797 /* TLS certificate verification is done at STARTTLS time; here we just
1798 test whether it was successful or not. (This is for optional verification; for
1799 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1800
3703d818
JH		 1801 if (tls_in.certificate_verified) return OK;
1802 *user_msgptr = US"no verified certificate";
1803 return FAIL;
e5a9dba6 1804
89583014
JH		 1805 case VERIFY_HELO:
1806 /* We can test the result of optional HELO verification that might have
1807 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1808
3703d818
JH		 1809 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1810 return helo_verified? OK : FAIL;
059ec3d9 1811
89583014
JH		 1812 case VERIFY_CSA:
1813 /* Do Client SMTP Authorization checks in a separate function, and turn the
1814 result code into user-friendly strings. */
1c41c9cc 1815
3703d818
JH		 1816 rc = acl_verify_csa(list);
1817 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1818 csa_reason_string[rc]);
3703d818
JH		 1819 csa_status = csa_status_string[rc];
1820 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1821 return csa_return_code[rc];
89583014
JH		 1822
1823 case VERIFY_HDR_SYNTAX:
1824 /* Check that all relevant header lines have the correct syntax. If there is
1825 a syntax error, we return details of the error to the sender if configured to
1826 send out full details. (But a "message" setting on the ACL can override, as
1827 always). */
1828
1829 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1830 if (rc != OK && *log_msgptr)
1831 if (smtp_return_error_details)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 else
1834 acl_verify_message = *log_msgptr;
89583014 1835 return rc;
059ec3d9 1836
770747fd
MFM		 1837 case VERIFY_HDR_NAMES_ASCII:
1838 /* Check that all header names are true 7 bit strings
1839 See RFC 5322, 2.2. and RFC 6532, 3. */
1840
1841 rc = verify_check_header_names_ascii(log_msgptr);
1842 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1843 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1844 return rc;
1845
89583014
JH		 1846 case VERIFY_NOT_BLIND:
1847 /* Check that no recipient of this message is "blind", that is, every envelope
1848 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1849
89583014
JH		 1850 rc = verify_check_notblind();
1851 if (rc != OK)
1852 {
1853 *log_msgptr = string_sprintf("bcc recipient detected");
1854 if (smtp_return_error_details)
1855 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1856 }
1857 return rc;
059ec3d9 1858
89583014
JH		 1859 /* The remaining verification tests check recipient and sender addresses,
1860 either from the envelope or from the header. There are a number of
1861 slash-separated options that are common to all of them. */
059ec3d9 1862
89583014
JH		 1863 case VERIFY_HDR_SNDR:
1864 verify_header_sender = TRUE;
1865 break;
059ec3d9 1866
89583014
JH		 1867 case VERIFY_SNDR:
1868 /* In the case of a sender, this can optionally be followed by an address to use
1869 in place of the actual sender (rare special-case requirement). */
059ec3d9 1870 {
89583014
JH		 1871 uschar *s = ss + 6;
1872 if (*s == 0)
1873 verify_sender_address = sender_address;
1874 else
1875 {
1876 while (isspace(*s)) s++;
1877 if (*s++ != '=') goto BAD_VERIFY;
1878 while (isspace(*s)) s++;
1879 verify_sender_address = string_copy(s);
1880 }
059ec3d9 1881 }
89583014
JH		 1882 break;
1883
1884 case VERIFY_RCPT:
1885 break;
059ec3d9
PH		 1886 }
1887
89583014
JH		 1888
1889
596875b3
PH		 1890/* Remaining items are optional; they apply to sender and recipient
1891verification, including "header sender" verification. */
059ec3d9
PH		 1892
1893while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1894 != NULL)
1895 {
1896 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1897 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1898 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1899
1900 /* These two old options are left for backwards compatibility */
1901
1902 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1903 {
1904 callout_defer_ok = TRUE;
1905 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1906 }
1907
1908 else if (strcmpic(ss, US"check_postmaster") == 0)
1909 {
1910 pm_mailfrom = US"";
1911 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1912 }
1913
1914 /* The callout option has a number of sub-options, comma separated */
1915
1916 else if (strncmpic(ss, US"callout", 7) == 0)
1917 {
1918 callout = CALLOUT_TIMEOUT_DEFAULT;
1919 ss += 7;
1920 if (*ss != 0)
1921 {
1922 while (isspace(*ss)) ss++;
1923 if (*ss++ == '=')
1924 {
55414b25 1925 const uschar * sublist = ss;
059ec3d9
PH		 1926 int optsep = ',';
1927 uschar *opt;
1928 uschar buffer[256];
55414b25 1929 while (isspace(*sublist)) sublist++;
8e669ac1 1930
55414b25 1931 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1932 != NULL)
1933 {
89583014 1934 callout_opt_t * op;
438257ba 1935 double period = 1.0F;
059ec3d9 1936
89583014 1937 for (op= callout_opt_list; op->name; op++)
438257ba 1938 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1939 break;
059ec3d9 1940
89583014
JH		 1941 verify_options |= op->flag;
1942 if (op->has_option)
1943 {
438257ba 1944 opt += Ustrlen(op->name);
4deaf07d
PH		 1945 while (isspace(*opt)) opt++;
1946 if (*opt++ != '=')
1947 {
1948 *log_msgptr = string_sprintf("'=' expected after "
89583014 1949 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1950 return ERROR;
1951 }
1952 while (isspace(*opt)) opt++;
89583014
JH		 1953 }
1954 if (op->timeval)
1955 {
1956 period = readconf_readtime(opt, 0, FALSE);
1957 if (period < 0)
4deaf07d
PH		 1958 {
1959 *log_msgptr = string_sprintf("bad time value in ACL condition "
1960 "\"verify %s\"", arg);
1961 return ERROR;
1962 }
89583014
JH		 1963 }
1964
1965 switch(op->value)
1966 {
1967 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1968 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1969 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1970 case CALLOUT_MAILFROM:
1971 if (!verify_header_sender)
1972 {
1973 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1974 "callout option only for verify=header_sender (detected in ACL "
1975 "condition \"%s\")", arg);
1976 return ERROR;
1977 }
1978 se_mailfrom = string_copy(opt);
1979 break;
1980 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1981 case CALLOUT_MAXWAIT: callout_overall = period; break;
1982 case CALLOUT_CONNECT: callout_connect = period; break;
1983 case CALLOUT_TIME: callout = period; break;
1984 }
059ec3d9
PH		 1985 }
1986 }
1987 else
1988 {
1989 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1990 "ACL condition \"%s\"", arg);
1991 return ERROR;
1992 }
1993 }
1994 }
1995
1996 /* Option not recognized */
1997
1998 else
1999 {
2000 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2001 "condition \"verify %s\"", ss, arg);
2002 return ERROR;
2003 }
2004 }
2005
2006if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2007 (vopt_callout_recipsender|vopt_callout_recippmaster))
2008 {
2009 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2010 "for a recipient callout";
2011 return ERROR;
2012 }
2013
2014/* Handle sender-in-header verification. Default the user message to the log
2015message if giving out verification details. */
2016
2017if (verify_header_sender)
2018 {
8e669ac1 2019 int verrno;
059ec3d9 2020 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2021 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2022 &verrno);
2023 if (rc != OK)
8e669ac1 2024 {
fe5b5d0b
PH		 2025 *basic_errno = verrno;
2026 if (smtp_return_error_details)
2027 {
2028 if (*user_msgptr == NULL && *log_msgptr != NULL)
2029 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2030 if (rc == DEFER) acl_temp_details = TRUE;
2031 }
8e669ac1 2032 }
059ec3d9
PH		 2033 }
2034
2035/* Handle a sender address. The default is to verify *the* sender address, but
2036optionally a different address can be given, for special requirements. If the
2037address is empty, we are dealing with a bounce message that has no sender, so
2038we cannot do any checking. If the real sender address gets rewritten during
2039verification (e.g. DNS widening), set the flag to stop it being rewritten again
2040during message reception.
2041
2042A list of verified "sender" addresses is kept to try to avoid doing to much
2043work repetitively when there are multiple recipients in a message and they all
2044require sender verification. However, when callouts are involved, it gets too
2045complicated because different recipients may require different callout options.
2046Therefore, we always do a full sender verify when any kind of callout is
2047specified. Caching elsewhere, for instance in the DNS resolver and in the
2048callout handling, should ensure that this is not terribly inefficient. */
2049
2050else if (verify_sender_address != NULL)
2051 {
2052 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2053 != 0)
2054 {
2055 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2056 "sender verify callout";
2057 return ERROR;
2058 }
2059
2060 sender_vaddr = verify_checked_sender(verify_sender_address);
2061 if (sender_vaddr != NULL && /* Previously checked */
2062 callout <= 0) /* No callout needed this time */
2063 {
2064 /* If the "routed" flag is set, it means that routing worked before, so
2065 this check can give OK (the saved return code value, if set, belongs to a
2066 callout that was done previously). If the "routed" flag is not set, routing
2067 must have failed, so we use the saved return code. */
2068
2069 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2070 {
2071 rc = sender_vaddr->special_action;
2072 *basic_errno = sender_vaddr->basic_errno;
2073 }
2074 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2075 }
2076
2077 /* Do a new verification, and cache the result. The cache is used to avoid
2078 verifying the sender multiple times for multiple RCPTs when callouts are not
2079 specified (see comments above).
2080
2081 The cache is also used on failure to give details in response to the first
2082 RCPT that gets bounced for this reason. However, this can be suppressed by
2083 the no_details option, which sets the flag that says "this detail has already
2084 been sent". The cache normally contains just one address, but there may be
2085 more in esoteric circumstances. */
2086
2087 else
2088 {
2089 BOOL routed = TRUE;
2a3eea10 2090 uschar *save_address_data = deliver_address_data;
8e669ac1 2091
059ec3d9 2092 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2093#ifdef SUPPORT_I18N
3c8b3577
JH		 2094 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2095 {
2096 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2097 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2098 }
f358d5e0 2099#endif
059ec3d9
PH		 2100 if (no_details) setflag(sender_vaddr, af_sverify_told);
2101 if (verify_sender_address[0] != 0)
2102 {
2103 /* If this is the real sender address, save the unrewritten version
2104 for use later in receive. Otherwise, set a flag so that rewriting the
2105 sender in verify_address() does not update sender_address. */
2106
2107 if (verify_sender_address == sender_address)
2108 sender_address_unrewritten = sender_address;
2109 else
2110 verify_options |= vopt_fake_sender;
2111
eafd343b
TK		 2112 if (success_on_redirect)
2113 verify_options |= vopt_success_on_redirect;
2114
059ec3d9
PH		 2115 /* The recipient, qualify, and expn options are never set in
2116 verify_options. */
2117
2118 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2119 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2120
2121 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2122
2123 if (rc == OK)
2124 {
2125 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2126 {
2127 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2128 verify_sender_address, sender_vaddr->address);
2129 }
2130 else
2131 {
2132 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2133 verify_sender_address);
2134 }
2135 }
2136 else *basic_errno = sender_vaddr->basic_errno;
2137 }
2138 else rc = OK; /* Null sender */
2139
2140 /* Cache the result code */
2141
2142 if (routed) setflag(sender_vaddr, af_verify_routed);
2143 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2144 sender_vaddr->special_action = rc;
2145 sender_vaddr->next = sender_verified_list;
2146 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2147
2148 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2149 the sender verification. */
8e669ac1 2150
2a3eea10 2151 deliver_address_data = save_address_data;
059ec3d9 2152 }
8e669ac1 2153
2a3eea10
PH		 2154 /* Put the sender address_data value into $sender_address_data */
2155
d43cbe25 2156 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2157 }
2158
2159/* A recipient address just gets a straightforward verify; again we must handle
2160the DEFER overrides. */
2161
2162else
2163 {
2164 address_item addr2;
2165
eafd343b
TK		 2166 if (success_on_redirect)
2167 verify_options |= vopt_success_on_redirect;
2168
059ec3d9
PH		 2169 /* We must use a copy of the address for verification, because it might
2170 get rewritten. */
2171
2172 addr2 = *addr;
2173 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2174 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2175 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2176
42855d71 2177 *basic_errno = addr2.basic_errno;
059ec3d9 2178 *log_msgptr = addr2.message;
8e669ac1 2179 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2180 addr2.user_message : addr2.message;
42855d71
PH		 2181
2182 /* Allow details for temporary error if the address is so flagged. */
2183 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2184
2185 /* Make $address_data visible */
d43cbe25 2186 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2187 }
2188
2189/* We have a result from the relevant test. Handle defer overrides first. */
2190
2191if (rc == DEFER && (defer_ok ||
2192 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2193 {
2194 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2195 defer_ok? "defer_ok" : "callout_defer_ok");
2196 rc = OK;
2197 }
2198
2199/* If we've failed a sender, set up a recipient message, and point
2200sender_verified_failed to the address item that actually failed. */
2201
2202if (rc != OK && verify_sender_address != NULL)
2203 {
2204 if (rc != DEFER)
059ec3d9 2205 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2206 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2208 else
2209 {
2210 *log_msgptr = US"Could not complete sender verify callout";
2211 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2212 *log_msgptr;
2213 }
2214
2215 sender_verified_failed = sender_vaddr;
2216 }
2217
2218/* Verifying an address messes up the values of $domain and $local_part,
2219so reset them before returning if this is a RCPT ACL. */
2220
2221if (addr != NULL)
2222 {
2223 deliver_domain = addr->domain;
2224 deliver_localpart = addr->local_part;
2225 }
2226return rc;
2227
2228/* Syntax errors in the verify argument come here. */
2229
2230BAD_VERIFY:
2231*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2232 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2233 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2234 "\"verify %s\"", arg);
2235return ERROR;
2236}
2237
2238
2239
2240
2241/*************************************************
2242* Check argument for control= modifier *
2243*************************************************/
2244
2245/* Called from acl_check_condition() below
2246
2247Arguments:
2248 arg the argument string for control=
2249 pptr set to point to the terminating character
2250 where which ACL we are in
2251 log_msgptr for error messages
2252
2253Returns: CONTROL_xxx value
2254*/
2255
2256static int
55414b25 2257decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2258{
2259int len;
2260control_def *d;
2261
2262for (d = controls_list;
2263 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2264 d++)
2265 {
2266 len = Ustrlen(d->name);
2267 if (Ustrncmp(d->name, arg, len) == 0) break;
2268 }
2269
2270if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2271 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2272 {
2273 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2274 return CONTROL_ERROR;
2275 }
2276
059ec3d9
PH		 2277*pptr = arg + len;
2278return d->value;
2279}
2280
2281
2282
c99ce5c9
TF		 2283
2284/*************************************************
2285* Return a ratelimit error *
2286*************************************************/
2287
2288/* Called from acl_ratelimit() below
2289
2290Arguments:
2291 log_msgptr for error messages
2292 format format string
2293 ... supplementary arguments
2294 ss ratelimit option name
2295 where ACL_WHERE_xxxx indicating which ACL this is
2296
2297Returns: ERROR
2298*/
2299
2300static int
2301ratelimit_error(uschar **log_msgptr, const char *format, ...)
2302{
2303va_list ap;
2304uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2305va_start(ap, format);
2306if (!string_vformat(buffer, sizeof(buffer), format, ap))
2307 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2308 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2309va_end(ap);
2310*log_msgptr = string_sprintf(
2311 "error in arguments to \"ratelimit\" condition: %s", buffer);
2312return ERROR;
2313}
2314
2315
2316
2317
870f6ba8
TF		 2318/*************************************************
2319* Handle rate limiting *
2320*************************************************/
2321
2322/* Called by acl_check_condition() below to calculate the result
2323of the ACL ratelimit condition.
2324
2325Note that the return value might be slightly unexpected: if the
2326sender's rate is above the limit then the result is OK. This is
2327similar to the dnslists condition, and is so that you can write
2328ACL clauses like: defer ratelimit = 15 / 1h
2329
2330Arguments:
2331 arg the option string for ratelimit=
90fc3069 2332 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2333 log_msgptr for error messages
2334
2335Returns: OK - Sender's rate is above limit
2336 FAIL - Sender's rate is below limit
2337 DEFER - Problem opening ratelimit database
2338 ERROR - Syntax error in options.
2339*/
2340
2341static int
55414b25 2342acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2343{
c99ce5c9 2344double limit, period, count;
8f240103
PH		 2345uschar *ss;
2346uschar *key = NULL;
c99ce5c9 2347uschar *unique = NULL;
870f6ba8 2348int sep = '/';
c99ce5c9
TF		 2349BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2350BOOL noupdate = FALSE, badacl = FALSE;
2351int mode = RATE_PER_WHAT;
870f6ba8
TF		 2352int old_pool, rc;
2353tree_node **anchor, *t;
2354open_db dbblock, *dbm;
c99ce5c9 2355int dbdb_size;
870f6ba8 2356dbdata_ratelimit *dbd;
c99ce5c9 2357dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2358struct timeval tv;
2359
2360/* Parse the first two options and record their values in expansion
2361variables. These variables allow the configuration to have informative
2362error messages based on rate limits obtained from a table lookup. */
2363
c99ce5c9 2364/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2365size, which must be greater than or equal to zero. Zero is useful for
2366rate measurement as opposed to rate limiting. */
2367
2368sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2369if (sender_rate_limit == NULL)
96f5fe4c
JH		 2370 return ratelimit_error(log_msgptr, "sender rate limit not set");
2371
2372limit = Ustrtod(sender_rate_limit, &ss);
2373if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2374else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2375else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2376
c99ce5c9
TF		 2377if (limit < 0.0 || *ss != '\0')
2378 return ratelimit_error(log_msgptr,
2379 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2380
c99ce5c9 2381/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2382constant. This must be strictly greater than zero, because zero leads to
2383run-time division errors. */
2384
2385sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2386if (sender_rate_period == NULL) period = -1.0;
2387else period = readconf_readtime(sender_rate_period, 0, FALSE);
2388if (period <= 0.0)
c99ce5c9
TF		 2389 return ratelimit_error(log_msgptr,
2390 "\"%s\" is not a time value", sender_rate_period);
2391
2392/* By default we are counting one of something, but the per_rcpt,
2393per_byte, and count options can change this. */
2394
2395count = 1.0;
870f6ba8 2396
c99ce5c9 2397/* Parse the other options. */
870f6ba8
TF		 2398
2399while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2400 != NULL)
2401 {
2402 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2403 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2404 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2405 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2406 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2407 else if (strcmpic(ss, US"per_conn") == 0)
2408 {
2409 RATE_SET(mode, PER_CONN);
2410 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2411 badacl = TRUE;
2412 }
2413 else if (strcmpic(ss, US"per_mail") == 0)
2414 {
2415 RATE_SET(mode, PER_MAIL);
2416 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2417 }
2418 else if (strcmpic(ss, US"per_rcpt") == 0)
2419 {
2420 /* If we are running in the RCPT ACL, then we'll count the recipients
2421 one by one, but if we are running when we have accumulated the whole
2422 list then we'll add them all in one batch. */
2423 if (where == ACL_WHERE_RCPT)
2424 RATE_SET(mode, PER_RCPT);
2425 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2426 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2427 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2429 }
2430 else if (strcmpic(ss, US"per_byte") == 0)
2431 {
2432 /* If we have not yet received the message data and there was no SIZE
2433 declaration on the MAIL comand, then it's safe to just use a value of
2434 zero and let the recorded rate decay as if nothing happened. */
2435 RATE_SET(mode, PER_MAIL);
2436 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2437 else count = message_size < 0 ? 0.0 : (double)message_size;
2438 }
2439 else if (strcmpic(ss, US"per_addr") == 0)
2440 {
2441 RATE_SET(mode, PER_RCPT);
438257ba 2442 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2443 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2444 }
2445 else if (strncmpic(ss, US"count=", 6) == 0)
2446 {
2447 uschar *e;
2448 count = Ustrtod(ss+6, &e);
2449 if (count < 0.0 || *e != '\0')
2450 return ratelimit_error(log_msgptr,
2451 "\"%s\" is not a positive number", ss);
2452 }
2453 else if (strncmpic(ss, US"unique=", 7) == 0)
2454 unique = string_copy(ss + 7);
2455 else if (key == NULL)
2456 key = string_copy(ss);
2457 else
2458 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2459 }
2460
c99ce5c9
TF		 2461/* Sanity check. When the badacl flag is set the update mode must either
2462be readonly (which is the default if it is omitted) or, for backwards
2463compatibility, a combination of noupdate and strict or leaky. */
2464
2465if (mode == RATE_PER_CLASH)
2466 return ratelimit_error(log_msgptr, "conflicting per_* options");
2467if (leaky + strict + readonly > 1)
2468 return ratelimit_error(log_msgptr, "conflicting update modes");
2469if (badacl && (leaky || strict) && !noupdate)
2470 return ratelimit_error(log_msgptr,
2471 "\"%s\" must not have /leaky or /strict option in %s ACL",
2472 ratelimit_option_string[mode], acl_wherenames[where]);
2473
2474/* Set the default values of any unset options. In readonly mode we
2475perform the rate computation without any increment so that its value
2476decays to eventually allow over-limit senders through. */
2477
2478if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2479if (badacl) readonly = TRUE;
2480if (readonly) count = 0.0;
2481if (!strict && !readonly) leaky = TRUE;
2482if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2483
8f240103
PH		 2484/* Create the lookup key. If there is no explicit key, use sender_host_address.
2485If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2486omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2487are added to the key because they alter the meaning of the stored data. */
2488
2489if (key == NULL)
2490 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2491
c99ce5c9 2492key = string_sprintf("%s/%s/%s%s",
8f240103 2493 sender_rate_period,
c99ce5c9
TF		 2494 ratelimit_option_string[mode],
2495 unique == NULL ? "" : "unique/",
8f240103 2496 key);
870f6ba8 2497
c99ce5c9
TF		 2498HDEBUG(D_acl)
2499 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2500
8f240103
PH		 2501/* See if we have already computed the rate by looking in the relevant tree.
2502For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2503pool so that they survive across resets. In readonly mode we only remember the
2504result for the rest of this command in case a later command changes it. After
2505this bit of logic the code is independent of the per_* mode. */
870f6ba8 2506
870f6ba8
TF		 2507old_pool = store_pool;
2508
c99ce5c9
TF		 2509if (readonly)
2510 anchor = &ratelimiters_cmd;
2511else switch(mode) {
2512case RATE_PER_CONN:
870f6ba8
TF		 2513 anchor = &ratelimiters_conn;
2514 store_pool = POOL_PERM;
c99ce5c9
TF		 2515 break;
2516case RATE_PER_BYTE:
2517case RATE_PER_MAIL:
2518case RATE_PER_ALLRCPTS:
870f6ba8 2519 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2520 break;
2521case RATE_PER_ADDR:
2522case RATE_PER_CMD:
2523case RATE_PER_RCPT:
fe0dab11 2524 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2525 break;
2526default:
3399bb60 2527 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2528 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2529 "internal ACL error: unknown ratelimit mode %d", mode);
2530 break;
2531}
870f6ba8 2532
c99ce5c9
TF		 2533t = tree_search(*anchor, key);
2534if (t != NULL)
870f6ba8
TF		 2535 {
2536 dbd = t->data.ptr;
2537 /* The following few lines duplicate some of the code below. */
8f240103 2538 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2539 store_pool = old_pool;
2540 sender_rate = string_sprintf("%.1f", dbd->rate);
2541 HDEBUG(D_acl)
2542 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2543 return rc;
2544 }
2545
c99ce5c9
TF		 2546/* We aren't using a pre-computed rate, so get a previously recorded rate
2547from the database, which will be updated and written back if required. */
870f6ba8
TF		 2548
2549dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2550if (dbm == NULL)
2551 {
2552 store_pool = old_pool;
2553 sender_rate = NULL;
2554 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2556 return DEFER;
2557 }
c99ce5c9
TF		 2558dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2559dbd = NULL;
870f6ba8
TF		 2560
2561gettimeofday(&tv, NULL);
2562
c99ce5c9
TF		 2563if (dbdb != NULL)
2564 {
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2567 dbd = &dbdb->dbd;
2568
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2573
2574 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2575 {
2576 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2577 dbdb = NULL;
2578 }
2579
2580 /* Sanity check. */
2581
2582 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2583 {
2584 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2585 dbdb = NULL;
2586 }
2587 }
2588
2589/* Allocate a new data block if the database lookup failed
2590or the Bloom filter passed its age limit. */
2591
2592if (dbdb == NULL)
2593 {
2594 if (unique == NULL)
2595 {
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size);
2600 }
2601 else
2602 {
2603 int extra;
2604 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2605
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2609
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2617
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2620
2621 if (dbd != NULL)
2622 {
2623 dbdb->dbd = *dbd;
2624 dbd = &dbdb->dbd;
2625 }
2626 }
2627 }
2628
2629/* If we are counting unique events, find out if this event is new or not.
2630If the client repeats the event during the current period then it should be
2631counted. We skip this code in readonly mode for efficiency, because any
2632changes to the filter will be discarded and because count is already set to
2633zero. */
2634
2635if (unique != NULL && !readonly)
2636 {
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2642
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2648
2649 size = limit * 16
2650 numhash = 8
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2654
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2657
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2661
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2664
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2669
2670 BOOL seen;
2671 unsigned n, hash, hinc;
2672 uschar md5sum[16];
2673 md5 md5info;
2674
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2679
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2684
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2687
2688 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2689
2690 seen = TRUE;
2691 for (n = 0; n < 8; n++, hash += hinc)
2692 {
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2696 {
2697 dbdb->bloom[byte] |= bit;
2698 seen = FALSE;
2699 }
2700 }
2701
2702 /* If this event has occurred before, do not count it. */
2703
2704 if (seen)
2705 {
2706 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2707 count = 0.0;
2708 }
2709 else
2710 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2711 }
2712
2713/* If there was no previous ratelimit data block for this key, initialize
2714the new one, otherwise update the block from the database. The initial rate
2715is what would be computed by the code below for an infinite interval. */
2716
870f6ba8
TF		 2717if (dbd == NULL)
2718 {
c99ce5c9
TF		 2719 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2720 dbd = &dbdb->dbd;
870f6ba8
TF		 2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
c99ce5c9 2723 dbd->rate = count;
870f6ba8
TF		 2724 }
2725else
2726 {
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2731
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2737
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2741
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2746
2747 rate_1 = (1 - a) * p/i + a * rate_0
2748 = k + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2755
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2757
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2762
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2768
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2773
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2776 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2777
e5d5a95f
TF		 2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2780
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
870f6ba8 2783
c99ce5c9
TF		 2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2787
870f6ba8
TF		 2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2791
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-intialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2801
2802 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2803 }
2804
c99ce5c9
TF		 2805/* Clients sending at the limit are considered to be over the limit.
2806This matters for edge cases such as a limit of zero, when the client
2807should be completely blocked. */
3348576f 2808
8f240103 2809rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2810
2811/* Update the state if the rate is low or if we are being strict. If we
2812are in leaky mode and the sender's rate is too high, we do not update
2813the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2814rate preventing them from getting any email through. If readonly is set,
2815neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2816
c99ce5c9 2817if ((rc == FAIL && leaky) || strict)
8f240103 2818 {
c99ce5c9 2819 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2820 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2821 }
2822else
2823 {
2824 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2825 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2826 }
2827
870f6ba8
TF		 2828dbfn_close(dbm);
2829
c99ce5c9 2830/* Store the result in the tree for future reference. */
870f6ba8 2831
c99ce5c9
TF		 2832t = store_get(sizeof(tree_node) + Ustrlen(key));
2833t->data.ptr = dbd;
2834Ustrcpy(t->name, key);
2835(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2836
2837/* We create the formatted version of the sender's rate very late in
2838order to ensure that it is done using the correct storage pool. */
2839
2840store_pool = old_pool;
2841sender_rate = string_sprintf("%.1f", dbd->rate);
2842
2843HDEBUG(D_acl)
2844 debug_printf("ratelimit computed rate %s\n", sender_rate);
2845
2846return rc;
2847}
2848
2849
2850
b0019c78
TF		 2851/*************************************************
2852* The udpsend ACL modifier *
2853*************************************************/
2854
2855/* Called by acl_check_condition() below.
2856
2857Arguments:
2858 arg the option string for udpsend=
2859 log_msgptr for error messages
2860
2861Returns: OK - Completed.
2862 DEFER - Problem with DNS lookup.
2863 ERROR - Syntax error in options.
2864*/
2865
2866static int
55414b25 2867acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2868{
2869int sep = 0;
2870uschar *hostname;
2871uschar *portstr;
2872uschar *portend;
2873host_item *h;
2874int portnum;
b0019c78
TF		 2875int len;
2876int r, s;
b1f8e4f8 2877uschar * errstr;
b0019c78
TF		 2878
2879hostname = string_nextinlist(&arg, &sep, NULL, 0);
2880portstr = string_nextinlist(&arg, &sep, NULL, 0);
2881
2882if (hostname == NULL)
2883 {
217b0e56 2884 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2885 return ERROR;
2886 }
2887if (portstr == NULL)
2888 {
217b0e56 2889 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2890 return ERROR;
2891 }
2892if (arg == NULL)
2893 {
217b0e56 2894 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2895 return ERROR;
2896 }
2897portnum = Ustrtol(portstr, &portend, 10);
2898if (*portend != '\0')
2899 {
217b0e56 2900 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2901 return ERROR;
2902 }
2903
2904/* Make a single-item host list. */
2905h = store_get(sizeof(host_item));
2906memset(h, 0, sizeof(host_item));
2907h->name = hostname;
2908h->port = portnum;
2909h->mx = MX_NONE;
2910
2911if (string_is_ip_address(hostname, NULL))
2912 h->address = hostname, r = HOST_FOUND;
2913else
2914 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2915if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2916 {
217b0e56 2917 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2918 return DEFER;
2919 }
2920
2921HDEBUG(D_acl)
2922 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2923
b1f8e4f8
JH		 2924r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2925 1, NULL, &errstr);
b0019c78 2926if (r < 0) goto defer;
27f9999e 2927len = Ustrlen(arg);
9cb1785a 2928r = send(s, arg, len, 0);
b1f8e4f8
JH		 2929if (r < 0)
2930 {
2931 errstr = US strerror(errno);
2932 close(s);
2933 goto defer;
2934 }
2935close(s);
b0019c78
TF		 2936if (r < len)
2937 {
2938 *log_msgptr =
2939 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2940 return DEFER;
2941 }
2942
2943HDEBUG(D_acl)
2944 debug_printf("udpsend %d bytes\n", r);
2945
2946return OK;
2947
2948defer:
b1f8e4f8 2949*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2950return DEFER;
2951}
2952
2953
2954
059ec3d9
PH		 2955/*************************************************
2956* Handle conditions/modifiers on an ACL item *
2957*************************************************/
2958
2959/* Called from acl_check() below.
2960
2961Arguments:
2962 verb ACL verb
2963 cb ACL condition block - if NULL, result is OK
2964 where where called from
2965 addr the address being checked for RCPT, or NULL
2966 level the nesting level
2967 epp pointer to pass back TRUE if "endpass" encountered
2968 (applies only to "accept" and "discard")
2969 user_msgptr user message pointer
2970 log_msgptr log message pointer
2971 basic_errno pointer to where to put verify error
2972
2973Returns: OK - all conditions are met
2974 DISCARD - an "acl" condition returned DISCARD - only allowed
2975 for "accept" or "discard" verbs
2976 FAIL - at least one condition fails
2977 FAIL_DROP - an "acl" condition returned FAIL_DROP
2978 DEFER - can't tell at the moment (typically, lookup defer,
2979 but can be temporary callout problem)
2980 ERROR - ERROR from nested ACL or expansion failure or other
2981 error
2982*/
2983
2984static int
2985acl_check_condition(int verb, acl_condition_block *cb, int where,
2986 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2987 uschar **log_msgptr, int *basic_errno)
2988{
2989uschar *user_message = NULL;
2990uschar *log_message = NULL;
ed7f7860
PP		 2991uschar *debug_tag = NULL;
2992uschar *debug_opts = NULL;
059ec3d9 2993int rc = OK;
8523533c 2994#ifdef WITH_CONTENT_SCAN
0f0c8159 2995int sep = -'/';
8523533c 2996#endif
059ec3d9
PH		 2997
2998for (; cb != NULL; cb = cb->next)
2999 {
55414b25 3000 const uschar *arg;
8e669ac1 3001 int control_type;
059ec3d9
PH		 3002
3003 /* The message and log_message items set up messages to be used in
3004 case of rejection. They are expanded later. */
3005
3006 if (cb->type == ACLC_MESSAGE)
3007 {
187bc588 3008 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3009 user_message = cb->arg;
3010 continue;
3011 }
3012
3013 if (cb->type == ACLC_LOG_MESSAGE)
3014 {
187bc588 3015 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3016 log_message = cb->arg;
3017 continue;
3018 }
3019
3020 /* The endpass "condition" just sets a flag to show it occurred. This is
3021 checked at compile time to be on an "accept" or "discard" item. */
3022
3023 if (cb->type == ACLC_ENDPASS)
3024 {
3025 *epp = TRUE;
3026 continue;
3027 }
3028
3029 /* For other conditions and modifiers, the argument is expanded now for some
3030 of them, but not for all, because expansion happens down in some lower level
3031 checking functions in some cases. */
3032
3033 if (cond_expand_at_top[cb->type])
3034 {
3035 arg = expand_string(cb->arg);
3036 if (arg == NULL)
3037 {
3038 if (expand_string_forcedfail) continue;
3039 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3040 cb->arg, expand_string_message);
3041 return search_find_defer? DEFER : ERROR;
3042 }
3043 }
3044 else arg = cb->arg;
3045
3046 /* Show condition, and expanded condition if it's different */
3047
3048 HDEBUG(D_acl)
3049 {
3050 int lhswidth = 0;
3051 debug_printf("check %s%s %n",
3052 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3053 conditions[cb->type], &lhswidth);
3054
3055 if (cb->type == ACLC_SET)
3056 {
38a0a95f
PH		 3057 debug_printf("acl_%s ", cb->u.varname);
3058 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3059 }
3060
3061 debug_printf("= %s\n", cb->arg);
3062
3063 if (arg != cb->arg)
3064 debug_printf("%.*s= %s\n", lhswidth,
3065 US" ", CS arg);
3066 }
3067
3068 /* Check that this condition makes sense at this time */
3069
3070 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3071 {
3072 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3073 cond_modifiers[cb->type]? "use" : "test",
3074 conditions[cb->type], acl_wherenames[where]);
3075 return ERROR;
3076 }
3077
3078 /* Run the appropriate test for each condition, or take the appropriate
3079 action for the remaining modifiers. */
3080
3081 switch(cb->type)
3082 {
71fafd95
PH		 3083 case ACLC_ADD_HEADER:
3084 setup_header(arg);
3085 break;
3086
059ec3d9
PH		 3087 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3088 "discard" verb. */
71fafd95 3089
059ec3d9 3090 case ACLC_ACL:
f60d98e8 3091 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3092 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3093 {
3094 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3095 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3096 verbs[verb]);
3097 return ERROR;
3098 }
059ec3d9
PH		 3099 break;
3100
3101 case ACLC_AUTHENTICATED:
3102 rc = (sender_host_authenticated == NULL)? FAIL :
3103 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3104 TRUE, NULL);
3105 break;
3106
71fafd95 3107 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3108 case ACLC_BMI_OPTIN:
3109 {
3110 int old_pool = store_pool;
3111 store_pool = POOL_PERM;
3112 bmi_current_optin = string_copy(arg);
3113 store_pool = old_pool;
3114 }
3115 break;
71fafd95 3116 #endif
8523533c 3117
059ec3d9 3118 case ACLC_CONDITION:
f3766eb5
NM		 3119 /* The true/false parsing here should be kept in sync with that used in
3120 expand.c when dealing with ECOND_BOOL so that we don't have too many
3121 different definitions of what can be a boolean. */
51c7471d
JH		 3122 if (*arg == '-'
3123 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3124 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3125 rc = (Uatoi(arg) == 0)? FAIL : OK;
3126 else
3127 rc = (strcmpic(arg, US"no") == 0 ||
3128 strcmpic(arg, US"false") == 0)? FAIL :
3129 (strcmpic(arg, US"yes") == 0 ||
3130 strcmpic(arg, US"true") == 0)? OK : DEFER;
3131 if (rc == DEFER)
3132 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3133 break;
3134
c3611384
PH		 3135 case ACLC_CONTINUE: /* Always succeeds */
3136 break;
3137
059ec3d9 3138 case ACLC_CONTROL:
c5fcb476 3139 {
55414b25
JH		 3140 const uschar *p = NULL;
3141 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3142
55414b25 3143 /* Check if this control makes sense at this time */
f7572e5a 3144
55414b25
JH		 3145 if ((control_forbids[control_type] & (1 << where)) != 0)
3146 {
3147 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3148 controls[control_type], acl_wherenames[where]);
3149 return ERROR;
3150 }
8800895a 3151
55414b25
JH		 3152 switch(control_type)
3153 {
3154 case CONTROL_AUTH_UNADVERTISED:
3155 allow_auth_unadvertised = TRUE;
3156 break;
3157
3158 #ifdef EXPERIMENTAL_BRIGHTMAIL
3159 case CONTROL_BMI_RUN:
3160 bmi_run = 1;
3161 break;
3162 #endif
3163
3164 #ifndef DISABLE_DKIM
3165 case CONTROL_DKIM_VERIFY:
3166 dkim_disable_verify = TRUE;
3167 #ifdef EXPERIMENTAL_DMARC
3168 /* Since DKIM was blocked, skip DMARC too */
3169 dmarc_disable_verify = TRUE;
3170 dmarc_enable_forensic = FALSE;
3171 #endif
3172 break;
3173 #endif
3174
3175 #ifdef EXPERIMENTAL_DMARC
3176 case CONTROL_DMARC_VERIFY:
3177 dmarc_disable_verify = TRUE;
3178 break;
3179
3180 case CONTROL_DMARC_FORENSIC:
3181 dmarc_enable_forensic = TRUE;
3182 break;
3183 #endif
3184
3185 case CONTROL_DSCP:
3186 if (*p == '/')
3187 {
3188 int fd, af, level, optname, value;
3189 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3190 a socket; we can accept that, we'll just debug-log failures anyway. */
3191 fd = fileno(smtp_in);
3192 af = ip_get_address_family(fd);
3193 if (af < 0)
3194 {
3195 HDEBUG(D_acl)
3196 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3197 strerror(errno));
3198 break;
3199 }
3200 if (dscp_lookup(p+1, af, &level, &optname, &value))
3201 {
3202 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3203 {
3204 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3205 p+1, strerror(errno));
3206 }
3207 else
3208 {
3209 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3210 }
3211 }
3212 else
3213 {
3214 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3215 return ERROR;
3216 }
3217 }
3218 else
3219 {
3220 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3221 return ERROR;
3222 }
3223 break;
3224
3225 case CONTROL_ERROR:
3226 return ERROR;
3227
3228 case CONTROL_CASEFUL_LOCAL_PART:
3229 deliver_localpart = addr->cc_local_part;
3230 break;
3231
3232 case CONTROL_CASELOWER_LOCAL_PART:
3233 deliver_localpart = addr->lc_local_part;
3234 break;
3235
3236 case CONTROL_ENFORCE_SYNC:
3237 smtp_enforce_sync = TRUE;
3238 break;
3239
3240 case CONTROL_NO_ENFORCE_SYNC:
3241 smtp_enforce_sync = FALSE;
3242 break;
3243
3244 #ifdef WITH_CONTENT_SCAN
3245 case CONTROL_NO_MBOX_UNSPOOL:
3246 no_mbox_unspool = TRUE;
3247 break;
3248 #endif
3249
3250 case CONTROL_NO_MULTILINE:
3251 no_multiline_responses = TRUE;
3252 break;
3253
3254 case CONTROL_NO_PIPELINING:
3255 pipelining_enable = FALSE;
3256 break;
3257
3258 case CONTROL_NO_DELAY_FLUSH:
3259 disable_delay_flush = TRUE;
3260 break;
3261
3262 case CONTROL_NO_CALLOUT_FLUSH:
3263 disable_callout_flush = TRUE;
3264 break;
3265
3266 case CONTROL_FAKEREJECT:
3267 cancel_cutthrough_connection("fakereject");
3268 case CONTROL_FAKEDEFER:
3269 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3270 if (*p == '/')
3271 {
3272 const uschar *pp = p + 1;
3273 while (*pp != 0) pp++;
3274 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3275 p = pp;
3276 }
3277 else
3278 {
3279 /* Explicitly reset to default string */
3280 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3281 }
3282 break;
ed7f7860 3283
55414b25
JH		 3284 case CONTROL_FREEZE:
3285 deliver_freeze = TRUE;
3286 deliver_frozen_at = time(NULL);
3287 freeze_tell = freeze_tell_config; /* Reset to configured value */
3288 if (Ustrncmp(p, "/no_tell", 8) == 0)
3289 {
3290 p += 8;
3291 freeze_tell = NULL;
3292 }
3293 if (*p != 0)
3294 {
3295 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3296 return ERROR;
3297 }
3298 cancel_cutthrough_connection("item frozen");
3299 break;
3300
3301 case CONTROL_QUEUE_ONLY:
3302 queue_only_policy = TRUE;
3303 cancel_cutthrough_connection("queueing forced");
3304 break;
3305
3306 case CONTROL_SUBMISSION:
3307 originator_name = US"";
3308 submission_mode = TRUE;
3309 while (*p == '/')
3310 {
3311 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3312 {
3313 p += 14;
3314 active_local_sender_retain = TRUE;
3315 active_local_from_check = FALSE;
3316 }
3317 else if (Ustrncmp(p, "/domain=", 8) == 0)
3318 {
3319 const uschar *pp = p + 8;
3320 while (*pp != 0 && *pp != '/') pp++;
3321 submission_domain = string_copyn(p+8, pp-p-8);
3322 p = pp;
3323 }
3324 /* The name= option must be last, because it swallows the rest of
3325 the string. */
3326 else if (Ustrncmp(p, "/name=", 6) == 0)
3327 {
3328 const uschar *pp = p + 6;
3329 while (*pp != 0) pp++;
3330 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3331 big_buffer, big_buffer_size));
3332 p = pp;
3333 }
3334 else break;
3335 }
3336 if (*p != 0)
3337 {
3338 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3339 return ERROR;
3340 }
3341 break;
e4bdf652 3342
55414b25
JH		 3343 case CONTROL_DEBUG:
3344 while (*p == '/')
3345 {
3346 if (Ustrncmp(p, "/tag=", 5) == 0)
3347 {
3348 const uschar *pp = p + 5;
3349 while (*pp != '\0' && *pp != '/') pp++;
3350 debug_tag = string_copyn(p+5, pp-p-5);
3351 p = pp;
3352 }
3353 else if (Ustrncmp(p, "/opts=", 6) == 0)
3354 {
3355 const uschar *pp = p + 6;
3356 while (*pp != '\0' && *pp != '/') pp++;
3357 debug_opts = string_copyn(p+6, pp-p-6);
3358 p = pp;
3359 }
3360 }
3361 debug_logging_activate(debug_tag, debug_opts);
3362 break;
3363
3364 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3365 suppress_local_fixups = TRUE;
3366 break;
3367
3368 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3369#ifndef DISABLE_PRDR
55414b25 3370 if (prdr_requested)
a2b89db1
PP		 3371#else
3372 if (0)
3373#endif
55414b25
JH		 3374 /* Too hard to think about for now. We might in future cutthrough
3375 the case where both sides handle prdr and this-node prdr acl
3376 is "accept" */
93a6fce2 3377 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3378 else
3379 {
55414b25
JH		 3380 if (deliver_freeze)
3381 *log_msgptr = US"frozen";
3382 else if (queue_only_policy)
3383 *log_msgptr = US"queue-only";
3384 else if (fake_response == FAIL)
3385 *log_msgptr = US"fakereject";
3386 else
3387 {
3388 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3389 break;
3390 }
3391 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3392 arg, *log_msgptr);
5032d1cf 3393 }
55414b25 3394 return ERROR;
3c8b3577 3395
8c5d388a 3396#ifdef SUPPORT_I18N
3c8b3577
JH		 3397 case CONTROL_UTF8_DOWNCONVERT:
3398 if (*p == '/')
3399 {
921dfc11
JH		 3400 if (p[1] == '1')
3401 {
3402 message_utf8_downconvert = 1;
3403 addr->prop.utf8_downcvt = TRUE;
3404 addr->prop.utf8_downcvt_maybe = FALSE;
3405 p += 2;
3406 break;
3407 }
3408 if (p[1] == '0')
3409 {
3410 message_utf8_downconvert = 0;
3411 addr->prop.utf8_downcvt = FALSE;
3412 addr->prop.utf8_downcvt_maybe = FALSE;
3413 p += 2;
3414 break;
3415 }
3c8b3577 3416 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3417 {
3418 message_utf8_downconvert = -1;
3419 addr->prop.utf8_downcvt = FALSE;
3420 addr->prop.utf8_downcvt_maybe = TRUE;
3421 p += 3;
3422 break;
3423 }
3c8b3577
JH		 3424 *log_msgptr = US"bad option value for control=utf8_downconvert";
3425 }
3426 else
3427 {
921dfc11
JH		 3428 message_utf8_downconvert = 1;
3429 addr->prop.utf8_downcvt = TRUE;
3430 addr->prop.utf8_downcvt_maybe = FALSE;
3431 break;
3c8b3577
JH		 3432 }
3433 return ERROR;
8c5d388a 3434#endif
3c8b3577 3435
9171d434 3436 }
55414b25 3437 break;
059ec3d9 3438 }
059ec3d9 3439
6a8f9482
TK		 3440 #ifdef EXPERIMENTAL_DCC
3441 case ACLC_DCC:
3442 {
3443 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3444 const uschar * list = arg;
3445 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3446 /* Run the dcc backend. */
3447 rc = dcc_process(&ss);
3448 /* Modify return code based upon the existance of options. */
3c8b3577 3449 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3450 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3451 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3452 }
3453 break;
3454 #endif
3455
71fafd95 3456 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3457 case ACLC_DECODE:
3458 rc = mime_decode(&arg);
3459 break;
71fafd95 3460 #endif
8523533c 3461
059ec3d9
PH		 3462 case ACLC_DELAY:
3463 {
3464 int delay = readconf_readtime(arg, 0, FALSE);
3465 if (delay < 0)
3466 {
3467 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3468 "modifier: \"%s\" is not a time value", arg);
3469 return ERROR;
3470 }
3471 else
3472 {
3473 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3474 delay);
3475 if (host_checking)
3476 {
3477 HDEBUG(D_acl)
3478 debug_printf("delay skipped in -bh checking mode\n");
3479 }
010c2d14 3480
ae9d18bc
JH		 3481 /* NOTE 1: Remember that we may be
3482 dealing with stdin/stdout here, in addition to TCP/IP connections.
3483 Also, delays may be specified for non-SMTP input, where smtp_out and
3484 smtp_in will be NULL. Whatever is done must work in all cases.
3485
3486 NOTE 2: The added feature of flushing the output before a delay must
3487 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3488 */
3489
3490 else
3491 {
3492 if (smtp_out != NULL && !disable_delay_flush)
3493 mac_smtp_fflush();
3494
861a7c51 3495#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3496 {
3497 struct pollfd p;
3498 nfds_t n = 0;
3499 if (smtp_out)
3500 {
3501 p.fd = fileno(smtp_out);
3502 p.events = POLLRDHUP;
3503 n = 1;
3504 }
3505 if (poll(&p, n, delay*1000) > 0)
3506 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3507 }
3508#else
010c2d14
PH		 3509 /* It appears to be impossible to detect that a TCP/IP connection has
3510 gone away without reading from it. This means that we cannot shorten
3511 the delay below if the client goes away, because we cannot discover
3512 that the client has closed its end of the connection. (The connection
3513 is actually in a half-closed state, waiting for the server to close its
3514 end.) It would be nice to be able to detect this state, so that the
3515 Exim process is not held up unnecessarily. However, it seems that we
3516 can't. The poll() function does not do the right thing, and in any case
3517 it is not always available.
047bdd8c 3518 */
010c2d14 3519
86b8287f 3520 while (delay > 0) delay = sleep(delay);
ae9d18bc 3521#endif
8e669ac1 3522 }
059ec3d9
PH		 3523 }
3524 }
3525 break;
3526
80a47a2c
TK		 3527 #ifndef DISABLE_DKIM
3528 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3529 if (dkim_cur_signer != NULL)
3530 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3531 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3532 else
b0b9dbb1 3533 rc = FAIL;
71fafd95
PH		 3534 break;
3535
80a47a2c
TK		 3536 case ACLC_DKIM_STATUS:
3537 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3538 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3539 break;
3540 #endif
fb2274d4 3541
4840604e
TL		 3542 #ifdef EXPERIMENTAL_DMARC
3543 case ACLC_DMARC_STATUS:
4a8ce2d8 3544 if (!dmarc_has_been_checked)
4840604e 3545 dmarc_process();
4a8ce2d8 3546 dmarc_has_been_checked = TRUE;
4840604e
TL		 3547 /* used long way of dmarc_exim_expand_query() in case we need more
3548 * view into the process in the future. */
3549 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3550 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3551 break;
3552 #endif
3553
059ec3d9 3554 case ACLC_DNSLISTS:
379ba7d0 3555 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3556 break;
3557
3558 case ACLC_DOMAINS:
3559 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3560 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3561 break;
3562
3563 /* The value in tls_cipher is the full cipher name, for example,
3564 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3565 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3566 what may in practice come out of the SSL library - which at the time of
3567 writing is poorly documented. */
3568
3569 case ACLC_ENCRYPTED:
817d9f57 3570 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3571 {
3572 uschar *endcipher = NULL;
817d9f57
JH		 3573 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3574 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3575 {
3576 endcipher = Ustrchr(++cipher, ':');
3577 if (endcipher != NULL) *endcipher = 0;
3578 }
3579 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3580 if (endcipher != NULL) *endcipher = ':';
3581 }
3582 break;
3583
3584 /* Use verify_check_this_host() instead of verify_check_host() so that
3585 we can pass over &host_data to catch any looked up data. Once it has been
3586 set, it retains its value so that it's still there if another ACL verb
3587 comes through here and uses the cache. However, we must put it into
3588 permanent store in case it is also expected to be used in a subsequent
3589 message in the same SMTP connection. */
3590
3591 case ACLC_HOSTS:
3592 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3593 (sender_host_address == NULL)? US"" : sender_host_address,
3594 CUSS &host_data);
4a452c43
JH		 3595 if (rc == DEFER) *log_msgptr = search_error_message;
3596 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3597 break;
3598
3599 case ACLC_LOCAL_PARTS:
3600 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3601 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3602 CUSS &deliver_localpart_data);
059ec3d9
PH		 3603 break;
3604
6ea85e9a
PH		 3605 case ACLC_LOG_REJECT_TARGET:
3606 {
3607 int logbits = 0;
3608 int sep = 0;
55414b25 3609 const uschar *s = arg;
6ea85e9a 3610 uschar *ss;
4a452c43 3611 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3612 {
3613 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3614 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3615 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3616 else
3617 {
3618 logbits |= LOG_MAIN|LOG_REJECT;
3619 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3620 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3621 }
3622 }
3623 log_reject_target = logbits;
3624 }
3625 break;
3626
059ec3d9
PH		 3627 case ACLC_LOGWRITE:
3628 {
3629 int logbits = 0;
55414b25 3630 const uschar *s = arg;
059ec3d9
PH		 3631 if (*s == ':')
3632 {
3633 s++;
3634 while (*s != ':')
3635 {
3636 if (Ustrncmp(s, "main", 4) == 0)
3637 { logbits |= LOG_MAIN; s += 4; }
3638 else if (Ustrncmp(s, "panic", 5) == 0)
3639 { logbits |= LOG_PANIC; s += 5; }
3640 else if (Ustrncmp(s, "reject", 6) == 0)
3641 { logbits |= LOG_REJECT; s += 6; }
3642 else
3643 {
3644 logbits = LOG_MAIN|LOG_PANIC;
3645 s = string_sprintf(":unknown log name in \"%s\" in "
3646 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3647 }
3648 if (*s == ',') s++;
3649 }
3650 s++;
3651 }
3652 while (isspace(*s)) s++;
6ea85e9a
PH		 3653
3654
059ec3d9
PH		 3655 if (logbits == 0) logbits = LOG_MAIN;
3656 log_write(0, logbits, "%s", string_printing(s));
3657 }
3658 break;
8e669ac1 3659
71fafd95 3660 #ifdef WITH_CONTENT_SCAN
0f0c8159 3661 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3662 {
6ea85e9a 3663 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3664 const uschar * list = arg;
3665 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3666 uschar *opt;
3667 BOOL defer_ok = FALSE;
3668 int timeout = 0;
3669
55414b25 3670 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3671 if (strcmpic(opt, US"defer_ok") == 0)
3672 defer_ok = TRUE;
3673 else if ( strncmpic(opt, US"tmo=", 4) == 0
3674 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3675 )
3676 {
3677 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3678 return ERROR;
3679 }
3680
3681 rc = malware(ss, timeout);
3682 if (rc == DEFER && defer_ok)
3683 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3684 }
3685 break;
3686
3687 case ACLC_MIME_REGEX:
71fafd95 3688 rc = mime_regex(&arg);
8523533c 3689 break;
71fafd95 3690 #endif
059ec3d9 3691
b0b9dbb1
JH		 3692 case ACLC_QUEUE:
3693 queue_name = string_copy_malloc(arg);
3694 break;
3695
870f6ba8 3696 case ACLC_RATELIMIT:
90fc3069 3697 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3698 break;
3699
059ec3d9 3700 case ACLC_RECIPIENTS:
55414b25
JH		 3701 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3702 CUSS &recipient_data);
059ec3d9
PH		 3703 break;
3704
71fafd95
PH		 3705 #ifdef WITH_CONTENT_SCAN
3706 case ACLC_REGEX:
3707 rc = regex(&arg);
8523533c 3708 break;
71fafd95 3709 #endif
8523533c 3710
e7568d51
TL		 3711 case ACLC_REMOVE_HEADER:
3712 setup_remove_header(arg);
3713 break;
3714
059ec3d9
PH		 3715 case ACLC_SENDER_DOMAINS:
3716 {
3717 uschar *sdomain;
3718 sdomain = Ustrrchr(sender_address, '@');
3719 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3720 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3721 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3722 }
3723 break;
3724
3725 case ACLC_SENDERS:
55414b25
JH		 3726 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3727 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3728 break;
3729
3730 /* Connection variables must persist forever */
3731
3732 case ACLC_SET:
3733 {
3734 int old_pool = store_pool;
5ef5dd52 3735 if ( cb->u.varname[0] == 'c'
0cbf2b82 3736#ifndef DISABLE_EVENT
5ef5dd52
JB		 3737 || event_name /* An event is being delivered */
3738#endif
3739 )
3740 store_pool = POOL_PERM;
38a0a95f 3741 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3742 store_pool = old_pool;
3743 }
3744 break;
3745
71fafd95 3746 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3747 case ACLC_SPAM:
3748 {
3749 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3750 const uschar * list = arg;
3751 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3752 /* Run the spam backend. */
55414b25 3753 rc = spam(CUSS &ss);
8523533c 3754 /* Modify return code based upon the existance of options. */
55414b25 3755 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3756 != NULL) {
3757 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3758 {
3759 /* FAIL so that the message is passed to the next ACL */
3760 rc = FAIL;
3761 }
3762 }
3763 }
3764 break;
71fafd95 3765 #endif
8523533c 3766
71fafd95 3767 #ifdef EXPERIMENTAL_SPF
8523533c 3768 case ACLC_SPF:
65a7d8c3
NM		 3769 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3770 break;
3771 case ACLC_SPF_GUESS:
3772 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3773 break;
71fafd95 3774 #endif
8523533c 3775
b0019c78
TF		 3776 case ACLC_UDPSEND:
3777 rc = acl_udpsend(arg, log_msgptr);
3778 break;
3779
059ec3d9
PH		 3780 /* If the verb is WARN, discard any user message from verification, because
3781 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3782 only from explicit "message" modifiers. However, put the user message into
3783 $acl_verify_message so it can be used in subsequent conditions or modifiers
3784 (until something changes it). */
059ec3d9
PH		 3785
3786 case ACLC_VERIFY:
3787 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3788 if (*user_msgptr)
3789 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3790 if (verb == ACL_WARN) *user_msgptr = NULL;
3791 break;
3792
3793 default:
3794 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3795 "condition %d", cb->type);
3796 break;
3797 }
3798
3799 /* If a condition was negated, invert OK/FAIL. */
3800
3801 if (!cond_modifiers[cb->type] && cb->u.negated)
3802 {
3803 if (rc == OK) rc = FAIL;
3804 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3805 }
3806
3807 if (rc != OK) break; /* Conditions loop */
3808 }
3809
3810
3811/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3812handle the values of these modifiers. If there isn't a log message set, we make
3813it the same as the user message.
059ec3d9
PH		 3814
3815"message" is a user message that will be included in an SMTP response. Unless
3816it is empty, it overrides any previously set user message.
3817
3818"log_message" is a non-user message, and it adds to any existing non-user
3819message that is already set.
3820
4e88a19f
PH		 3821Most verbs have but a single return for which the messages are relevant, but
3822for "discard", it's useful to have the log message both when it succeeds and
3823when it fails. For "accept", the message is used in the OK case if there is no
3824"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3825present. */
059ec3d9 3826
4e88a19f
PH		 3827if (*epp && rc == OK) user_message = NULL;
3828
3829if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3830 {
3831 uschar *expmessage;
4e88a19f
PH		 3832 uschar *old_user_msgptr = *user_msgptr;
3833 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3834
3835 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3836 nested ACLs) are always discarded. This also happens for acceptance verbs
3837 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3838 However, the value of an existing message is available in $acl_verify_message
3839 during expansions. */
3840
4e88a19f
PH		 3841 if (verb == ACL_WARN ||
3842 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3843 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3844
3845 if (user_message != NULL)
3846 {
3847 acl_verify_message = old_user_msgptr;
3848 expmessage = expand_string(user_message);
3849 if (expmessage == NULL)
3850 {
3851 if (!expand_string_forcedfail)
3852 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3853 user_message, expand_string_message);
3854 }
3855 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3856 }
3857
3858 if (log_message != NULL)
3859 {
3860 acl_verify_message = old_log_msgptr;
3861 expmessage = expand_string(log_message);
3862 if (expmessage == NULL)
3863 {
3864 if (!expand_string_forcedfail)
3865 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3866 log_message, expand_string_message);
3867 }
3868 else if (expmessage[0] != 0)
3869 {
3870 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3871 string_sprintf("%s: %s", expmessage, *log_msgptr);
3872 }
3873 }
3874
3875 /* If no log message, default it to the user message */
3876
3877 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3878 }
3879
3880acl_verify_message = NULL;
3881return rc;
3882}
3883
3884
3885
3886
3887
3888/*************************************************
3889* Get line from a literal ACL *
3890*************************************************/
3891
3892/* This function is passed to acl_read() in order to extract individual lines
3893of a literal ACL, which we access via static pointers. We can destroy the
3894contents because this is called only once (the compiled ACL is remembered).
3895
3896This code is intended to treat the data in the same way as lines in the main
3897Exim configuration file. That is:
3898
3899 . Leading spaces are ignored.
3900
3901 . A \ at the end of a line is a continuation - trailing spaces after the \
3902 are permitted (this is because I don't believe in making invisible things
3903 significant). Leading spaces on the continued part of a line are ignored.
3904
3905 . Physical lines starting (significantly) with # are totally ignored, and
3906 may appear within a sequence of backslash-continued lines.
3907
3908 . Blank lines are ignored, but will end a sequence of continuations.
3909
3910Arguments: none
3911Returns: a pointer to the next line
3912*/
3913
3914
3915static uschar *acl_text; /* Current pointer in the text */
3916static uschar *acl_text_end; /* Points one past the terminating '0' */
3917
3918
3919static uschar *
3920acl_getline(void)
3921{
3922uschar *yield;
3923
3924/* This loop handles leading blank lines and comments. */
3925
3926for(;;)
3927 {
3928 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3929 if (*acl_text == 0) return NULL; /* No more data */
3930 yield = acl_text; /* Potential data line */
3931
3932 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3933
3934 /* If we hit the end before a newline, we have the whole logical line. If
3935 it's a comment, there's no more data to be given. Otherwise, yield it. */
3936
3937 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3938
3939 /* After reaching a newline, end this loop if the physical line does not
3940 start with '#'. If it does, it's a comment, and the loop continues. */
3941
3942 if (*yield != '#') break;
3943 }
3944
3945/* This loop handles continuations. We know we have some real data, ending in
3946newline. See if there is a continuation marker at the end (ignoring trailing
3947white space). We know that *yield is not white space, so no need to test for
3948cont > yield in the backwards scanning loop. */
3949
3950for(;;)
3951 {
3952 uschar *cont;
3953 for (cont = acl_text - 1; isspace(*cont); cont--);
3954
3955 /* If no continuation follows, we are done. Mark the end of the line and
3956 return it. */
3957
3958 if (*cont != '\\')
3959 {
3960 *acl_text++ = 0;
3961 return yield;
3962 }
3963
3964 /* We have encountered a continuation. Skip over whitespace at the start of
3965 the next line, and indeed the whole of the next line or lines if they are
3966 comment lines. */
3967
3968 for (;;)
3969 {
3970 while (*(++acl_text) == ' ' || *acl_text == '\t');
3971 if (*acl_text != '#') break;
3972 while (*(++acl_text) != 0 && *acl_text != '\n');
3973 }
3974
3975 /* We have the start of a continuation line. Move all the rest of the data
3976 to join onto the previous line, and then find its end. If the end is not a
3977 newline, we are done. Otherwise loop to look for another continuation. */
3978
3979 memmove(cont, acl_text, acl_text_end - acl_text);
3980 acl_text_end -= acl_text - cont;
3981 acl_text = cont;
3982 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3983 if (*acl_text == 0) return yield;
3984 }
3985
3986/* Control does not reach here */
3987}
3988
3989
3990
3991
3992
3993/*************************************************
3994* Check access using an ACL *
3995*************************************************/
3996
3997/* This function is called from address_check. It may recurse via
3998acl_check_condition() - hence the use of a level to stop looping. The ACL is
3999passed as a string which is expanded. A forced failure implies no access check
4000is required. If the result is a single word, it is taken as the name of an ACL
4001which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4002text, complete with newlines, and parsed as such. In both cases, the ACL check
4003is then run. This function uses an auxiliary function for acl_read() to call
4004for reading individual lines of a literal ACL. This is acl_getline(), which
4005appears immediately above.
4006
4007Arguments:
4008 where where called from
4009 addr address item when called from RCPT; otherwise NULL
4010 s the input string; NULL is the same as an empty ACL => DENY
4011 level the nesting level
4012 user_msgptr where to put a user error (for SMTP response)
4013 log_msgptr where to put a logging message (not for SMTP response)
4014
4015Returns: OK access is granted
4016 DISCARD access is apparently granted...
4017 FAIL access is denied
4018 FAIL_DROP access is denied; drop the connection
4019 DEFER can't tell at the moment
4020 ERROR disaster
4021*/
4022
4023static int
4024acl_check_internal(int where, address_item *addr, uschar *s, int level,
4025 uschar **user_msgptr, uschar **log_msgptr)
4026{
4027int fd = -1;
4028acl_block *acl = NULL;
4029uschar *acl_name = US"inline ACL";
4030uschar *ss;
4031
4032/* Catch configuration loops */
4033
4034if (level > 20)
4035 {
4036 *log_msgptr = US"ACL nested too deep: possible loop";
4037 return ERROR;
4038 }
4039
4040if (s == NULL)
4041 {
4042 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4043 return FAIL;
4044 }
4045
4046/* At top level, we expand the incoming string. At lower levels, it has already
4047been expanded as part of condition processing. */
4048
4049if (level == 0)
4050 {
4051 ss = expand_string(s);
4052 if (ss == NULL)
4053 {
4054 if (expand_string_forcedfail) return OK;
4055 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4056 expand_string_message);
4057 return ERROR;
4058 }
4059 }
4060else ss = s;
4061
4062while (isspace(*ss))ss++;
4063
4064/* If we can't find a named ACL, the default is to parse it as an inline one.
4065(Unless it begins with a slash; non-existent files give rise to an error.) */
4066
4067acl_text = ss;
4068
4069/* Handle the case of a string that does not contain any spaces. Look for a
4070named ACL among those read from the configuration, or a previously read file.
4071It is possible that the pointer to the ACL is NULL if the configuration
4072contains a name with no data. If not found, and the text begins with '/',
4073read an ACL from a file, and save it so it can be re-used. */
4074
4075if (Ustrchr(ss, ' ') == NULL)
4076 {
4077 tree_node *t = tree_search(acl_anchor, ss);
4078 if (t != NULL)
4079 {
4080 acl = (acl_block *)(t->data.ptr);
4081 if (acl == NULL)
4082 {
4083 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4084 return FAIL;
4085 }
4086 acl_name = string_sprintf("ACL \"%s\"", ss);
4087 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4088 }
4089
4090 else if (*ss == '/')
4091 {
4092 struct stat statbuf;
4093 fd = Uopen(ss, O_RDONLY, 0);
4094 if (fd < 0)
4095 {
4096 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4097 strerror(errno));
4098 return ERROR;
4099 }
4100
4101 if (fstat(fd, &statbuf) != 0)
4102 {
4103 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4104 strerror(errno));
4105 return ERROR;
4106 }
4107
4108 acl_text = store_get(statbuf.st_size + 1);
4109 acl_text_end = acl_text + statbuf.st_size + 1;
4110
4111 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4112 {
4113 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4114 ss, strerror(errno));
4115 return ERROR;
4116 }
4117 acl_text[statbuf.st_size] = 0;
f1e894f3 4118 (void)close(fd);
059ec3d9
PH		 4119
4120 acl_name = string_sprintf("ACL \"%s\"", ss);
4121 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4122 }
4123 }
4124
4125/* Parse an ACL that is still in text form. If it came from a file, remember it
4126in the ACL tree, having read it into the POOL_PERM store pool so that it
4127persists between multiple messages. */
4128
4129if (acl == NULL)
4130 {
4131 int old_pool = store_pool;
4132 if (fd >= 0) store_pool = POOL_PERM;
4133 acl = acl_read(acl_getline, log_msgptr);
4134 store_pool = old_pool;
4135 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4136 if (fd >= 0)
4137 {
4138 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4139 Ustrcpy(t->name, ss);
4140 t->data.ptr = acl;
4141 (void)tree_insertnode(&acl_anchor, t);
4142 }
4143 }
4144
4145/* Now we have an ACL to use. It's possible it may be NULL. */
4146
4147while (acl != NULL)
4148 {
4149 int cond;
4150 int basic_errno = 0;
4151 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4152 BOOL acl_quit_check = level == 0
4153 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4154
4155 *log_msgptr = *user_msgptr = NULL;
4156 acl_temp_details = FALSE;
4157
059ec3d9
PH		 4158 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4159
4160 /* Clear out any search error message from a previous check before testing
4161 this condition. */
4162
4163 search_error_message = NULL;
4164 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4165 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4166
4167 /* Handle special returns: DEFER causes a return except on a WARN verb;
4168 ERROR always causes a return. */
4169
4170 switch (cond)
4171 {
4172 case DEFER:
6968512f 4173 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4174 if (basic_errno != ERRNO_CALLOUTDEFER)
4175 {
4176 if (search_error_message != NULL && *search_error_message != 0)
4177 *log_msgptr = search_error_message;
4178 if (smtp_return_error_details) acl_temp_details = TRUE;
4179 }
4180 else
4181 {
4182 acl_temp_details = TRUE;
4183 }
4184 if (acl->verb != ACL_WARN) return DEFER;
4185 break;
4186
4187 default: /* Paranoia */
4188 case ERROR:
6968512f 4189 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4190 return ERROR;
4191
4192 case OK:
6968512f
JH		 4193 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4194 verbs[acl->verb], acl_name);
059ec3d9
PH		 4195 break;
4196
4197 case FAIL:
6968512f 4198 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4199 break;
4200
4201 /* DISCARD and DROP can happen only from a nested ACL condition, and
4202 DISCARD can happen only for an "accept" or "discard" verb. */
4203
4204 case DISCARD:
6968512f
JH		 4205 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4206 verbs[acl->verb], acl_name);
059ec3d9
PH		 4207 break;
4208
4209 case FAIL_DROP:
6968512f
JH		 4210 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4211 verbs[acl->verb], acl_name);
059ec3d9
PH		 4212 break;
4213 }
4214
4215 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4216 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4217 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4218
4219 switch(acl->verb)
4220 {
4221 case ACL_ACCEPT:
a7538db1
JH		 4222 if (cond == OK || cond == DISCARD)
4223 {
4224 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4225 return cond;
4226 }
059ec3d9
PH		 4227 if (endpass_seen)
4228 {
4229 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4230 return cond;
4231 }
4232 break;
4233
4234 case ACL_DEFER:
4235 if (cond == OK)
4236 {
a7538db1 4237 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4238 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4239 acl_temp_details = TRUE;
4240 return DEFER;
4241 }
4242 break;
4243
4244 case ACL_DENY:
a7538db1
JH		 4245 if (cond == OK)
4246 {
4247 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4248 if (acl_quit_check) goto badquit;
a7538db1
JH		 4249 return FAIL;
4250 }
059ec3d9
PH		 4251 break;
4252
4253 case ACL_DISCARD:
a7538db1
JH		 4254 if (cond == OK || cond == DISCARD)
4255 {
4256 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4257 if (acl_quit_check) goto badquit;
a7538db1
JH		 4258 return DISCARD;
4259 }
059ec3d9
PH		 4260 if (endpass_seen)
4261 {
4262 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4263 return cond;
4264 }
4265 break;
4266
4267 case ACL_DROP:
a7538db1
JH		 4268 if (cond == OK)
4269 {
4270 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4271 if (acl_quit_check) goto badquit;
a7538db1
JH		 4272 return FAIL_DROP;
4273 }
059ec3d9
PH		 4274 break;
4275
4276 case ACL_REQUIRE:
a7538db1
JH		 4277 if (cond != OK)
4278 {
4279 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4280 if (acl_quit_check) goto badquit;
a7538db1
JH		 4281 return cond;
4282 }
059ec3d9
PH		 4283 break;
4284
4285 case ACL_WARN:
4286 if (cond == OK)
4287 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4288 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4289 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4290 "condition test deferred%s%s", host_and_ident(TRUE),
4291 (*log_msgptr == NULL)? US"" : US": ",
4292 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4293 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4294 break;
4295
4296 default:
4297 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4298 acl->verb);
4299 break;
4300 }
4301
4302 /* Pass to the next ACL item */
4303
4304 acl = acl->next;
4305 }
4306
4307/* We have reached the end of the ACL. This is an implicit DENY. */
4308
4309HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4310return FAIL;
82c0c8ea
JH		 4311
4312badquit:
4313 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4314 "('%s' verb used incorrectly)", verbs[acl->verb]);
4315 return ERROR;
059ec3d9
PH		 4316}
4317
4318
333eea9c
JH		 4319
4320
4321/* Same args as acl_check_internal() above, but the string s is
4322the name of an ACL followed optionally by up to 9 space-separated arguments.
4323The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4324static int
55414b25 4325acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4326 uschar **user_msgptr, uschar **log_msgptr)
4327{
4328uschar * tmp;
bef3ea7f 4329uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4330uschar * sav_arg[9]; /* must match acl_arg[] */
4331int sav_narg;
333eea9c 4332uschar * name;
bef3ea7f 4333int i;
ef21c07d 4334int ret;
333eea9c
JH		 4335
4336if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4337 goto bad;
4338
bef3ea7f 4339for (i = 0; i < 9; i++)
333eea9c
JH		 4340 {
4341 while (*s && isspace(*s)) s++;
4342 if (!*s) break;
bef3ea7f 4343 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4344 {
4345 tmp = name;
4346 goto bad;
4347 }
4348 }
ef21c07d
JH		 4349
4350sav_narg = acl_narg;
bef3ea7f 4351acl_narg = i;
ef21c07d
JH		 4352for (i = 0; i < acl_narg; i++)
4353 {
4354 sav_arg[i] = acl_arg[i];
4355 acl_arg[i] = tmp_arg[i];
4356 }
4357while (i < 9)
4358 {
4359 sav_arg[i] = acl_arg[i];
4360 acl_arg[i++] = NULL;
4361 }
4362
4363ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4364
ef21c07d
JH		 4365acl_narg = sav_narg;
4366for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4367return ret;
333eea9c
JH		 4368
4369bad:
4370if (expand_string_forcedfail) return ERROR;
4371*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4372 tmp, expand_string_message);
4373return search_find_defer?DEFER:ERROR;
4374}
4375
4376
4377
059ec3d9
PH		 4378/*************************************************
4379* Check access using an ACL *
4380*************************************************/
4381
faa05a93
JH		 4382/* Alternate interface for ACL, used by expansions */
4383int
05caaeaa 4384acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4385{
faa05a93
JH		 4386address_item adb;
4387address_item *addr = NULL;
4388
4389*user_msgptr = *log_msgptr = NULL;
4390sender_verified_failed = NULL;
4391ratelimiters_cmd = NULL;
4392log_reject_target = LOG_MAIN|LOG_REJECT;
4393
4394if (where == ACL_WHERE_RCPT)
4395 {
4396 adb = address_defaults;
4397 addr = &adb;
05caaeaa
JH		 4398 addr->address = expand_string(US"$local_part@$domain");
4399 addr->domain = deliver_domain;
4400 addr->local_part = deliver_localpart;
4401 addr->cc_local_part = deliver_localpart;
4402 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4403 }
4404
4405return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4406}
4407
4408
4409
059ec3d9
PH		 4410/* This is the external interface for ACL checks. It sets up an address and the
4411expansions for $domain and $local_part when called after RCPT, then calls
4412acl_check_internal() to do the actual work.
4413
4414Arguments:
4415 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4416 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4417 s the input string; NULL is the same as an empty ACL => DENY
4418 user_msgptr where to put a user error (for SMTP response)
4419 log_msgptr where to put a logging message (not for SMTP response)
4420
4421Returns: OK access is granted by an ACCEPT verb
4422 DISCARD access is granted by a DISCARD verb
4423 FAIL access is denied
4424 FAIL_DROP access is denied; drop the connection
4425 DEFER can't tell at the moment
4426 ERROR disaster
4427*/
faa05a93 4428int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4429
4430int
64ffc24f 4431acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4432 uschar **log_msgptr)
4433{
4434int rc;
4435address_item adb;
64ffc24f 4436address_item *addr = NULL;
059ec3d9
PH		 4437
4438*user_msgptr = *log_msgptr = NULL;
4439sender_verified_failed = NULL;
fe0dab11 4440ratelimiters_cmd = NULL;
6ea85e9a 4441log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4442
8ccd00b1 4443#ifndef DISABLE_PRDR
4f6ae5c3 4444if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4445#else
4f6ae5c3 4446if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4447#endif
059ec3d9
PH		 4448 {
4449 adb = address_defaults;
4450 addr = &adb;
64ffc24f 4451 addr->address = recipient;
059ec3d9
PH		 4452 if (deliver_split_address(addr) == DEFER)
4453 {
4454 *log_msgptr = US"defer in percent_hack_domains check";
4455 return DEFER;
4456 }
8c5d388a 4457#ifdef SUPPORT_I18N
3c8b3577
JH		 4458 if ((addr->prop.utf8_msg = message_smtputf8))
4459 {
4460 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4461 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4462 }
9bfc60eb 4463#endif
059ec3d9
PH		 4464 deliver_domain = addr->domain;
4465 deliver_localpart = addr->local_part;
4466 }
059ec3d9 4467
faa05a93 4468acl_where = where;
059ec3d9 4469rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4470acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4471
817d9f57
JH		 4472/* Cutthrough - if requested,
4473and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4474and rcpt acl returned accept,
4475and first recipient (cancel on any subsequents)
e4bdf652 4476open one now and run it up to RCPT acceptance.
f9334a28
JH		 4477A failed verify should cancel cutthrough request,
4478and will pass the fail to the originator.
817d9f57 4479Initial implementation: dual-write to spool.
e4bdf652
JH		 4480Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4481
4482Cease cutthrough copy on rxd final dot; do not send one.
4483
4484On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4485
4486On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4487perm-rejected, reflect that to the original sender - and dump the spooled copy.
4488If temp-reject, close the conn (and keep the spooled copy).
4489If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4490*/
4491switch (where)
4492{
4493case ACL_WHERE_RCPT:
8ccd00b1 4494#ifndef DISABLE_PRDR
fd98a5c6
JH		 4495case ACL_WHERE_PRDR:
4496#endif
59eaad2b
JH		 4497 if (host_checking_callout) /* -bhc mode */
4498 cancel_cutthrough_connection("host-checking mode");
4499 else if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
f9334a28 4500 rc = open_cutthrough_connection(addr);
e4bdf652
JH		 4501 break;
4502
4503case ACL_WHERE_PREDATA:
59eaad2b 4504 if (rc == OK)
e4bdf652
JH		 4505 cutthrough_predata();
4506 else
2e5b33cd 4507 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4508 break;
4509
4510case ACL_WHERE_QUIT:
4511case ACL_WHERE_NOTQUIT:
2e5b33cd 4512 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4513 break;
4514
4515default:
4516 break;
4517}
4518
64ffc24f
PH		 4519deliver_domain = deliver_localpart = deliver_address_data =
4520 sender_address_data = NULL;
059ec3d9
PH		 4521
4522/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4523ACL, which is really in the middle of an SMTP command. */
4524
4525if (rc == DISCARD)
4526 {
4527 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4528 {
4529 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4530 "ACL", acl_wherenames[where]);
4531 return ERROR;
4532 }
4533 return DISCARD;
4534 }
4535
4536/* A DROP response is not permitted from MAILAUTH */
4537
4538if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4539 {
4540 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4541 "ACL", acl_wherenames[where]);
4542 return ERROR;
4543 }
4544
4e88a19f
PH		 4545/* Before giving a response, take a look at the length of any user message, and
4546split it up into multiple lines if possible. */
059ec3d9 4547
e28326d8
PH		 4548*user_msgptr = string_split_message(*user_msgptr);
4549if (fake_response != OK)
4550 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4551
4552return rc;
4553}
4554
38a0a95f 4555
38a0a95f
PH		 4556/*************************************************
4557* Create ACL variable *
4558*************************************************/
4559
4560/* Create an ACL variable or reuse an existing one. ACL variables are in a
4561binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4562
4563Argument:
4564 name pointer to the variable's name, starting with c or m
4565
4566Returns the pointer to variable's tree node
4567*/
4568
4569tree_node *
4570acl_var_create(uschar *name)
4571{
4572tree_node *node, **root;
4573root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4574node = tree_search(*root, name);
4575if (node == NULL)
4576 {
4577 node = store_get(sizeof(tree_node) + Ustrlen(name));
4578 Ustrcpy(node->name, name);
4579 (void)tree_insertnode(root, node);
4580 }
4581node->data.ptr = NULL;
4582return node;
4583}
4584
4585
4586
4587/*************************************************
4588* Write an ACL variable in spool format *
4589*************************************************/
4590
4591/* This function is used as a callback for tree_walk when writing variables to
4592the spool file. To retain spool file compatibility, what is written is -aclc or
4593-aclm followed by the rest of the name and the data length, space separated,
4594then the value itself, starting on a new line, and terminated by an additional
4595newline. When we had only numbered ACL variables, the first line might look
4596like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4597acl_cfoo.
4598
4599Arguments:
4600 name of the variable
4601 value of the variable
4602 ctx FILE pointer (as a void pointer)
4603
4604Returns: nothing
4605*/
4606
4607void
4608acl_var_write(uschar *name, uschar *value, void *ctx)
4609{
4610FILE *f = (FILE *)ctx;
4611fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4612}
4613
9171d434
JH		 4614/* vi: aw ai sw=2
4615*/
059ec3d9 4616/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.