projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Updated GnuTLS error messages
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef
PH		 183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
c46782ef 186 #endif
ed7f7860 187 CONTROL_DEBUG,
80a47a2c 188 #ifndef DISABLE_DKIM
f7572e5a
TK		 189 CONTROL_DKIM_VERIFY,
190 #endif
4840604e
TL		 191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH		 208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
cf8b11a5 211 CONTROL_NO_MULTILINE,
047bdd8c 212 CONTROL_NO_PIPELINING,
4c590bd1
PH		 213 CONTROL_NO_DELAY_FLUSH,
214 CONTROL_NO_CALLOUT_FLUSH
c46782ef 215};
9a26b6b2 216
8800895a
PH		 217/* ACL control names; keep in step with the table above! This list is used for
218turning ids into names. The actual list of recognized names is in the variable
219control_def controls_list[] below. The fact that there are two lists is a mess
220and should be tidied up. */
9a26b6b2
PH		 221
222static uschar *controls[] = {
c46782ef 223 US"allow_auth_unadvertised",
9a26b6b2
PH		 224 #ifdef EXPERIMENTAL_BRIGHTMAIL
225 US"bmi_run",
226 #endif
ed7f7860 227 US"debug",
80a47a2c
TK		 228 #ifndef DISABLE_DKIM
229 US"dkim_disable_verify",
f7572e5a 230 #endif
4840604e
TL		 231 #ifdef EXPERIMENTAL_DMARC
232 US"dmarc_disable_verify",
233 US"dmarc_enable_forensic",
234 #endif
13363eba 235 US"dscp",
c46782ef
PH		 236 US"error",
237 US"caseful_local_part",
238 US"caselower_local_part",
e4bdf652 239 US"cutthrough_delivery",
c46782ef
PH		 240 US"enforce_sync",
241 US"no_enforce_sync",
242 US"freeze",
243 US"queue_only",
244 US"submission",
245 US"suppress_local_fixups",
9a26b6b2
PH		 246 #ifdef WITH_CONTENT_SCAN
247 US"no_mbox_unspool",
248 #endif
cf8b11a5
PH		 249 US"fakedefer",
250 US"fakereject",
aa6dc513 251 US"no_multiline_responses",
cf8b11a5 252 US"no_pipelining",
4c590bd1
PH		 253 US"no_delay_flush",
254 US"no_callout_flush"
c46782ef 255};
059ec3d9 256
047bdd8c 257/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 258at the outer level. In the other cases, expansion already occurs in the
259checking functions. */
260
261static uschar cond_expand_at_top[] = {
7421ecab 262 FALSE, /* acl */
3e536984 263 TRUE, /* add_header */
059ec3d9 264 FALSE, /* authenticated */
8523533c
TK		 265#ifdef EXPERIMENTAL_BRIGHTMAIL
266 TRUE, /* bmi_optin */
8e669ac1 267#endif
059ec3d9 268 TRUE, /* condition */
c3611384 269 TRUE, /* continue */
059ec3d9 270 TRUE, /* control */
6a8f9482
TK		 271#ifdef EXPERIMENTAL_DCC
272 TRUE, /* dcc */
273#endif
8523533c
TK		 274#ifdef WITH_CONTENT_SCAN
275 TRUE, /* decode */
276#endif
059ec3d9 277 TRUE, /* delay */
8523533c
TK		 278#ifdef WITH_OLD_DEMIME
279 TRUE, /* demime */
fb2274d4 280#endif
80a47a2c
TK		 281#ifndef DISABLE_DKIM
282 TRUE, /* dkim_signers */
283 TRUE, /* dkim_status */
4840604e
TL		 284#endif
285#ifdef EXPERIMENTAL_DMARC
286 TRUE, /* dmarc_status */
8523533c 287#endif
059ec3d9
PH		 288 TRUE, /* dnslists */
289 FALSE, /* domains */
290 FALSE, /* encrypted */
291 TRUE, /* endpass */
292 FALSE, /* hosts */
293 FALSE, /* local_parts */
294 TRUE, /* log_message */
6ea85e9a 295 TRUE, /* log_reject_target */
059ec3d9 296 TRUE, /* logwrite */
8523533c
TK		 297#ifdef WITH_CONTENT_SCAN
298 TRUE, /* malware */
299#endif
059ec3d9 300 TRUE, /* message */
8523533c
TK		 301#ifdef WITH_CONTENT_SCAN
302 TRUE, /* mime_regex */
303#endif
870f6ba8 304 TRUE, /* ratelimit */
059ec3d9 305 FALSE, /* recipients */
8523533c
TK		 306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* regex */
308#endif
e7568d51 309 TRUE, /* remove_header */
059ec3d9
PH		 310 FALSE, /* sender_domains */
311 FALSE, /* senders */
312 TRUE, /* set */
8523533c
TK		 313#ifdef WITH_CONTENT_SCAN
314 TRUE, /* spam */
315#endif
316#ifdef EXPERIMENTAL_SPF
317 TRUE, /* spf */
65a7d8c3 318 TRUE, /* spf_guess */
8523533c 319#endif
b0019c78 320 TRUE, /* udpsend */
059ec3d9
PH		 321 TRUE /* verify */
322};
323
324/* Flags to identify the modifiers */
325
326static uschar cond_modifiers[] = {
327 FALSE, /* acl */
3e536984 328 TRUE, /* add_header */
059ec3d9 329 FALSE, /* authenticated */
8523533c
TK		 330#ifdef EXPERIMENTAL_BRIGHTMAIL
331 TRUE, /* bmi_optin */
8e669ac1 332#endif
059ec3d9 333 FALSE, /* condition */
c3611384 334 TRUE, /* continue */
059ec3d9 335 TRUE, /* control */
6a8f9482
TK		 336#ifdef EXPERIMENTAL_DCC
337 FALSE, /* dcc */
338#endif
8523533c
TK		 339#ifdef WITH_CONTENT_SCAN
340 FALSE, /* decode */
341#endif
059ec3d9 342 TRUE, /* delay */
8523533c
TK		 343#ifdef WITH_OLD_DEMIME
344 FALSE, /* demime */
fb2274d4 345#endif
80a47a2c
TK		 346#ifndef DISABLE_DKIM
347 FALSE, /* dkim_signers */
348 FALSE, /* dkim_status */
4840604e
TL		 349#endif
350#ifdef EXPERIMENTAL_DMARC
351 FALSE, /* dmarc_status */
8523533c 352#endif
059ec3d9
PH		 353 FALSE, /* dnslists */
354 FALSE, /* domains */
355 FALSE, /* encrypted */
356 TRUE, /* endpass */
357 FALSE, /* hosts */
358 FALSE, /* local_parts */
359 TRUE, /* log_message */
6ea85e9a 360 TRUE, /* log_reject_target */
8523533c
TK		 361 TRUE, /* logwrite */
362#ifdef WITH_CONTENT_SCAN
363 FALSE, /* malware */
364#endif
059ec3d9 365 TRUE, /* message */
8523533c
TK		 366#ifdef WITH_CONTENT_SCAN
367 FALSE, /* mime_regex */
368#endif
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 400 #ifdef EXPERIMENTAL_PRDR
401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
fd98a5c6
JH		 415 #ifdef EXPERIMENTAL_PRDR
416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6
JH		 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
437 #ifdef EXPERIMENTAL_PRDR
438 (1<<ACL_WHERE_PRDR)|
439 #endif /* EXPERIMENTAL_PRDR */
440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
71fafd95 450 #ifdef WITH_OLD_DEMIME
2f079f46 451 (unsigned int)
fd98a5c6
JH		 452 ~((1<<ACL_WHERE_DATA)| /* demime */
453 #ifdef EXPERIMENTAL_PRDR
454 (1<<ACL_WHERE_PRDR)|
455 #endif /* EXPERIMENTAL_PRDR */
456 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 457 #endif
8e669ac1 458
80a47a2c
TK		 459 #ifndef DISABLE_DKIM
460 (unsigned int)
461 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 462
80a47a2c
TK		 463 (unsigned int)
464 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 465 #endif
fb2274d4 466
4840604e
TL		 467 #ifdef EXPERIMENTAL_DMARC
468 (unsigned int)
469 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
470 #endif
471
45b91596
PH		 472 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
473 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 474
2f079f46 475 (unsigned int)
fd98a5c6
JH		 476 ~((1<<ACL_WHERE_RCPT) /* domains */
477 #ifdef EXPERIMENTAL_PRDR
478 |(1<<ACL_WHERE_PRDR)
479 #endif
480 ),
059ec3d9 481
45b91596
PH		 482 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
483 (1<<ACL_WHERE_CONNECT)|
484 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 485 (1<<ACL_WHERE_HELO),
8e669ac1 486
059ec3d9 487 0, /* endpass */
8e669ac1 488
45b91596
PH		 489 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
490 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 491
2f079f46 492 (unsigned int)
fd98a5c6
JH		 493 ~((1<<ACL_WHERE_RCPT) /* local_parts */
494 #ifdef EXPERIMENTAL_PRDR
495 |(1<<ACL_WHERE_PRDR)
496 #endif
497 ),
059ec3d9
PH		 498
499 0, /* log_message */
8e669ac1 500
6ea85e9a
PH		 501 0, /* log_reject_target */
502
059ec3d9 503 0, /* logwrite */
8e669ac1 504
71fafd95 505 #ifdef WITH_CONTENT_SCAN
2f079f46 506 (unsigned int)
fd98a5c6
JH		 507 ~((1<<ACL_WHERE_DATA)| /* malware */
508 #ifdef EXPERIMENTAL_PRDR
509 (1<<ACL_WHERE_PRDR)|
510 #endif /* EXPERIMENTAL_PRDR */
511 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 512 #endif
8523533c 513
059ec3d9
PH		 514 0, /* message */
515
71fafd95 516 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 517 (unsigned int)
518 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 519 #endif
8523533c 520
870f6ba8
TF		 521 0, /* ratelimit */
522
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46 527 (unsigned int)
fd98a5c6
JH		 528 ~((1<<ACL_WHERE_DATA)| /* regex */
529 #ifdef EXPERIMENTAL_PRDR
530 (1<<ACL_WHERE_PRDR)|
531 #endif /* EXPERIMENTAL_PRDR */
532 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 533 (1<<ACL_WHERE_MIME)),
71fafd95 534 #endif
8523533c 535
e7568d51
TL		 536 (unsigned int)
537 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
538 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 539 #ifdef EXPERIMENTAL_PRDR
540 (1<<ACL_WHERE_PRDR)|
541 #endif
e7568d51
TL		 542 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
543 (1<<ACL_WHERE_NOTSMTP_START)),
544
059ec3d9
PH		 545 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
546 (1<<ACL_WHERE_HELO)|
547 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
548 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
549 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 0, /* set */
558
71fafd95 559 #ifdef WITH_CONTENT_SCAN
2f079f46 560 (unsigned int)
fd98a5c6
JH		 561 ~((1<<ACL_WHERE_DATA)| /* spam */
562 #ifdef EXPERIMENTAL_PRDR
563 (1<<ACL_WHERE_PRDR)|
564 #endif /* EXPERIMENTAL_PRDR */
565 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 566 #endif
8523533c 567
71fafd95 568 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 569 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
570 (1<<ACL_WHERE_HELO)|
571 (1<<ACL_WHERE_MAILAUTH)|
572 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 573 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
574 (1<<ACL_WHERE_NOTSMTP)|
575 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 576
577 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
578 (1<<ACL_WHERE_HELO)|
579 (1<<ACL_WHERE_MAILAUTH)|
580 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
581 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
582 (1<<ACL_WHERE_NOTSMTP)|
583 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 584 #endif
8523533c 585
b0019c78
TF		 586 0, /* udpsend */
587
059ec3d9
PH		 588 /* Certain types of verify are always allowed, so we let it through
589 always and check in the verify function itself */
590
591 0 /* verify */
059ec3d9
PH		 592};
593
594
c5fcb476
PH		 595/* Bit map vector of which controls are not allowed at certain times. For
596each control, there's a bitmap of dis-allowed times. For some, it is easier to
597specify the negation of a small number of allowed times. */
598
599static unsigned int control_forbids[] = {
c46782ef
PH		 600 (unsigned int)
601 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
602
603 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 604 0, /* bmi_run */
c46782ef
PH		 605 #endif
606
ed7f7860
PP		 607 0, /* debug */
608
80a47a2c
TK		 609 #ifndef DISABLE_DKIM
610 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
fd98a5c6
JH		 611 #ifdef EXPERIMENTAL_PRDR
612 (1<<ACL_WHERE_PRDR)|
613 #endif /* EXPERIMENTAL_PRDR */
f7572e5a
TK		 614 (1<<ACL_WHERE_NOTSMTP_START),
615 #endif
616
4840604e
TL		 617 #ifdef EXPERIMENTAL_DMARC
618 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
619 (1<<ACL_WHERE_NOTSMTP_START),
620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
621 (1<<ACL_WHERE_NOTSMTP_START),
622 #endif
623
13363eba
PP		 624 (1<<ACL_WHERE_NOTSMTP)|
625 (1<<ACL_WHERE_NOTSMTP_START)|
626 (1<<ACL_WHERE_NOTQUIT), /* dscp */
627
c5fcb476 628 0, /* error */
8e669ac1
PH		 629
630 (unsigned int)
c5fcb476 631 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 632
633 (unsigned int)
c5fcb476 634 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 635
e4bdf652
JH		 636 (unsigned int)
637 0, /* cutthrough_delivery */
638
45b91596
PH		 639 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
640 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 641
45b91596
PH		 642 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
643 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 644
645 (unsigned int)
c5fcb476
PH		 646 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
647 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 648 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 649 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 659 (1<<ACL_WHERE_PREDATA)),
8523533c 660
8800895a
PH		 661 (unsigned int)
662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 663 (1<<ACL_WHERE_PREDATA)|
664 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 665
c46782ef 666 #ifdef WITH_CONTENT_SCAN
8e669ac1 667 (unsigned int)
14d57970 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 669 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 670 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 671 (1<<ACL_WHERE_MIME)),
c46782ef 672 #endif
a6c4ab60 673
29aba418
TF		 674 (unsigned int)
675 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
676 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 677 #ifdef EXPERIMENTAL_PRDR
678 (1<<ACL_WHERE_PRDR)|
679 #endif /* EXPERIMENTAL_PRDR */
29aba418
TF		 680 (1<<ACL_WHERE_MIME)),
681
8e669ac1 682 (unsigned int)
a6c4ab60 683 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 684 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 685 #ifdef EXPERIMENTAL_PRDR
686 (1<<ACL_WHERE_PRDR)|
687 #endif /* EXPERIMENTAL_PRDR */
e715ad22 688 (1<<ACL_WHERE_MIME)),
8523533c 689
45b91596 690 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 691 (1<<ACL_WHERE_NOTSMTP_START),
692
693 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 694 (1<<ACL_WHERE_NOTSMTP_START),
695
696 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 697 (1<<ACL_WHERE_NOTSMTP_START),
698
699 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 700 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 701};
702
703/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 704
705typedef struct control_def {
706 uschar *name;
707 int value; /* CONTROL_xxx value */
059ec3d9
PH		 708 BOOL has_option; /* Has /option(s) following */
709} control_def;
710
711static control_def controls_list[] = {
c46782ef 712 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 713#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 714 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 715#endif
ed7f7860 716 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK		 717#ifndef DISABLE_DKIM
718 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 719#endif
720#ifdef EXPERIMENTAL_DMARC
721 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
722 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 723#endif
13363eba 724 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH		 725 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
726 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
727 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
728 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 729 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 730 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH		 731 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
732 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 733 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 734 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 735#ifdef WITH_CONTENT_SCAN
c46782ef 736 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 737#endif
c46782ef
PH		 738 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
739 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
740 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH		 741 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
742 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH		 743 };
744
e5a9dba6
PH		 745/* Support data structures for Client SMTP Authorization. acl_verify_csa()
746caches its result in a tree to avoid repeated DNS queries. The result is an
747integer code which is used as an index into the following tables of
748explanatory strings and verification return codes. */
749
750static tree_node *csa_cache = NULL;
751
752enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
753 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
754
755/* The acl_verify_csa() return code is translated into an acl_verify() return
756code using the following table. It is OK unless the client is definitely not
757authorized. This is because CSA is supposed to be optional for sending sites,
758so recipients should not be too strict about checking it - especially because
759DNS problems are quite likely to occur. It's possible to use $csa_status in
760further ACL conditions to distinguish ok, unknown, and defer if required, but
761the aim is to make the usual configuration simple. */
762
763static int csa_return_code[] = {
764 OK, OK, OK, OK,
765 FAIL, FAIL, FAIL, FAIL
766};
767
768static uschar *csa_status_string[] = {
769 US"unknown", US"ok", US"defer", US"defer",
770 US"fail", US"fail", US"fail", US"fail"
771};
772
773static uschar *csa_reason_string[] = {
774 US"unknown",
775 US"ok",
776 US"deferred (SRV lookup failed)",
777 US"deferred (target address lookup failed)",
778 US"failed (explicit authorization required)",
779 US"failed (host name not authorized)",
780 US"failed (no authorized addresses)",
781 US"failed (client address mismatch)"
782};
783
c99ce5c9
TF		 784/* Options for the ratelimit condition. Note that there are two variants of
785the per_rcpt option, depending on the ACL that is used to measure the rate.
786However any ACL must be able to look up per_rcpt rates in /noupdate mode,
787so the two variants must have the same internal representation as well as
788the same configuration string. */
789
790enum {
791 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
792 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
793};
794
795#define RATE_SET(var,new) \
796 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
797
798static uschar *ratelimit_option_string[] = {
799 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
800 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
801};
802
059ec3d9
PH		 803/* Enable recursion between acl_check_internal() and acl_check_condition() */
804
f60d98e8
JH		 805static int acl_check_wargs(int, address_item *, uschar *, int, uschar **,
806 uschar **);
059ec3d9
PH		 807
808
809/*************************************************
810* Pick out name from list *
811*************************************************/
812
813/* Use a binary chop method
814
815Arguments:
816 name name to find
817 list list of names
818 end size of list
819
820Returns: offset in list, or -1 if not found
821*/
822
823static int
824acl_checkname(uschar *name, uschar **list, int end)
825{
826int start = 0;
827
828while (start < end)
829 {
830 int mid = (start + end)/2;
831 int c = Ustrcmp(name, list[mid]);
832 if (c == 0) return mid;
833 if (c < 0) end = mid; else start = mid + 1;
834 }
835
836return -1;
837}
838
839
840/*************************************************
841* Read and parse one ACL *
842*************************************************/
843
844/* This function is called both from readconf in order to parse the ACLs in the
845configuration file, and also when an ACL is encountered dynamically (e.g. as
846the result of an expansion). It is given a function to call in order to
847retrieve the lines of the ACL. This function handles skipping comments and
848blank lines (where relevant).
849
850Arguments:
851 func function to get next line of ACL
852 error where to put an error message
853
854Returns: pointer to ACL, or NULL
855 NULL can be legal (empty ACL); in this case error will be NULL
856*/
857
858acl_block *
859acl_read(uschar *(*func)(void), uschar **error)
860{
861acl_block *yield = NULL;
862acl_block **lastp = &yield;
863acl_block *this = NULL;
864acl_condition_block *cond;
865acl_condition_block **condp = NULL;
866uschar *s;
867
868*error = NULL;
869
870while ((s = (*func)()) != NULL)
871 {
872 int v, c;
873 BOOL negated = FALSE;
874 uschar *saveline = s;
875 uschar name[64];
876
877 /* Conditions (but not verbs) are allowed to be negated by an initial
878 exclamation mark. */
879
880 while (isspace(*s)) s++;
881 if (*s == '!')
882 {
883 negated = TRUE;
884 s++;
885 }
886
cf00dad6
PH		 887 /* Read the name of a verb or a condition, or the start of a new ACL, which
888 can be started by a name, or by a macro definition. */
059ec3d9
PH		 889
890 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 891 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 892
893 /* If a verb is unrecognized, it may be another condition or modifier that
894 continues the previous verb. */
895
896 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
897 if (v < 0)
898 {
899 if (this == NULL)
900 {
4e167a8c
PH		 901 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
902 saveline);
059ec3d9
PH		 903 return NULL;
904 }
905 }
906
907 /* New verb */
908
909 else
910 {
911 if (negated)
912 {
913 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
914 return NULL;
915 }
916 this = store_get(sizeof(acl_block));
917 *lastp = this;
918 lastp = &(this->next);
919 this->next = NULL;
920 this->verb = v;
921 this->condition = NULL;
922 condp = &(this->condition);
923 if (*s == 0) continue; /* No condition on this line */
924 if (*s == '!')
925 {
926 negated = TRUE;
927 s++;
928 }
929 s = readconf_readname(name, sizeof(name), s); /* Condition name */
930 }
931
932 /* Handle a condition or modifier. */
933
934 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
935 if (c < 0)
936 {
937 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
938 saveline);
939 return NULL;
940 }
941
942 /* The modifiers may not be negated */
943
944 if (negated && cond_modifiers[c])
945 {
946 *error = string_sprintf("ACL error: negation is not allowed with "
947 "\"%s\"", conditions[c]);
948 return NULL;
949 }
950
951 /* ENDPASS may occur only with ACCEPT or DISCARD. */
952
953 if (c == ACLC_ENDPASS &&
954 this->verb != ACL_ACCEPT &&
955 this->verb != ACL_DISCARD)
956 {
957 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
958 conditions[c], verbs[this->verb]);
959 return NULL;
960 }
961
962 cond = store_get(sizeof(acl_condition_block));
963 cond->next = NULL;
964 cond->type = c;
965 cond->u.negated = negated;
966
967 *condp = cond;
968 condp = &(cond->next);
969
970 /* The "set" modifier is different in that its argument is "name=value"
971 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 972 gives us a variable name to insert into the data block. The original ACL
973 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
974 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 975 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
976 After that, we allow alphanumerics and underscores, but the first character
977 after c or m must be a digit or an underscore. This retains backwards
978 compatibility. */
059ec3d9
PH		 979
980 if (c == ACLC_SET)
981 {
47ca6d6c
PH		 982 uschar *endptr;
983
38a0a95f
PH		 984 if (Ustrncmp(s, "acl_c", 5) != 0 &&
985 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 986 {
38a0a95f
PH		 987 *error = string_sprintf("invalid variable name after \"set\" in ACL "
988 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
989 return NULL;
47ca6d6c 990 }
38a0a95f
PH		 991
992 endptr = s + 5;
641cb756
PH		 993 if (!isdigit(*endptr) && *endptr != '_')
994 {
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
997 s);
998 return NULL;
999 }
1000
38a0a95f 1001 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1002 {
38a0a95f
PH		 1003 if (!isalnum(*endptr) && *endptr != '_')
1004 {
1005 *error = string_sprintf("invalid character \"%c\" in variable name "
1006 "in ACL modifier \"set %s\"", *endptr, s);
1007 return NULL;
1008 }
1009 endptr++;
47ca6d6c 1010 }
47ca6d6c 1011
38a0a95f 1012 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1013 s = endptr;
059ec3d9
PH		 1014 while (isspace(*s)) s++;
1015 }
1016
1017 /* For "set", we are now positioned for the data. For the others, only
1018 "endpass" has no data */
1019
1020 if (c != ACLC_ENDPASS)
1021 {
1022 if (*s++ != '=')
1023 {
1024 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1025 cond_modifiers[c]? US"modifier" : US"condition");
1026 return NULL;
1027 }
1028 while (isspace(*s)) s++;
1029 cond->arg = string_copy(s);
1030 }
1031 }
1032
1033return yield;
1034}
1035
1036
1037
71fafd95
PH		 1038/*************************************************
1039* Set up added header line(s) *
1040*************************************************/
1041
1042/* This function is called by the add_header modifier, and also from acl_warn()
1043to implement the now-deprecated way of adding header lines using "message" on a
1044"warn" verb. The argument is treated as a sequence of header lines which are
1045added to a chain, provided there isn't an identical one already there.
1046
1047Argument: string of header lines
1048Returns: nothing
1049*/
1050
1051static void
1052setup_header(uschar *hstring)
1053{
1054uschar *p, *q;
1055int hlen = Ustrlen(hstring);
1056
b1b05573
JH		 1057/* Ignore any leading newlines */
1058while (*hstring == '\n') hstring++, hlen--;
71fafd95 1059
b1b05573 1060/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1061if (hlen <= 0) return;
b1b05573
JH		 1062if (hstring[--hlen] != '\n') hstring = string_sprintf("%s\n", hstring);
1063else while(hstring[--hlen] == '\n') hstring[hlen+1] = '\0';
71fafd95
PH		 1064
1065/* Loop for multiple header lines, taking care about continuations */
1066
1067for (p = q = hstring; *p != 0; )
1068 {
1069 uschar *s;
1070 int newtype = htype_add_bot;
1071 header_line **hptr = &acl_added_headers;
1072
1073 /* Find next header line within the string */
1074
1075 for (;;)
1076 {
1077 q = Ustrchr(q, '\n');
1078 if (*(++q) != ' ' && *q != '\t') break;
1079 }
1080
1081 /* If the line starts with a colon, interpret the instruction for where to
1082 add it. This temporarily sets up a new type. */
1083
1084 if (*p == ':')
1085 {
1086 if (strncmpic(p, US":after_received:", 16) == 0)
1087 {
1088 newtype = htype_add_rec;
1089 p += 16;
1090 }
1091 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1092 {
1093 newtype = htype_add_rfc;
1094 p += 14;
1095 }
1096 else if (strncmpic(p, US":at_start:", 10) == 0)
1097 {
1098 newtype = htype_add_top;
1099 p += 10;
1100 }
1101 else if (strncmpic(p, US":at_end:", 8) == 0)
1102 {
1103 newtype = htype_add_bot;
1104 p += 8;
1105 }
1106 while (*p == ' ' || *p == '\t') p++;
1107 }
1108
1109 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1110 to the front of it. */
1111
1112 for (s = p; s < q - 1; s++)
1113 {
1114 if (*s == ':' || !isgraph(*s)) break;
1115 }
1116
438257ba 1117 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
71fafd95
PH		 1118 hlen = Ustrlen(s);
1119
1120 /* See if this line has already been added */
1121
1122 while (*hptr != NULL)
1123 {
1124 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
1125 hptr = &((*hptr)->next);
1126 }
1127
1128 /* Add if not previously present */
1129
1130 if (*hptr == NULL)
1131 {
1132 header_line *h = store_get(sizeof(header_line));
1133 h->text = s;
1134 h->next = NULL;
1135 h->type = newtype;
1136 h->slen = hlen;
1137 *hptr = h;
1138 hptr = &(h->next);
1139 }
1140
1141 /* Advance for next header line within the string */
1142
1143 p = q;
1144 }
1145}
1146
1147
1148
362145b5
JH		 1149/*************************************************
1150* List the added header lines *
1151*************************************************/
1152uschar *
1153fn_hdrs_added(void)
1154{
1155uschar * ret = NULL;
1156header_line * h = acl_added_headers;
1157uschar * s;
1158uschar * cp;
1159int size = 0;
1160int ptr = 0;
1161
1162if (!h) return NULL;
1163
1164do
1165 {
1166 s = h->text;
1167 while ((cp = Ustrchr(s, '\n')) != NULL)
1168 {
1169 if (cp[1] == '\0') break;
1170
1171 /* contains embedded newline; needs doubling */
1172 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1173 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1174 s = cp+1;
1175 }
1176 /* last bit of header */
1177
1178 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1179 }
6d9cfc47 1180while((h = h->next));
362145b5
JH		 1181
1182ret[ptr-1] = '\0'; /* overwrite last newline */
1183return ret;
1184}
1185
1186
e7568d51
TL		 1187/*************************************************
1188* Set up removed header line(s) *
1189*************************************************/
1190
1191/* This function is called by the remove_header modifier. The argument is
1192treated as a sequence of header names which are added to a colon separated
1193list, provided there isn't an identical one already there.
1194
1195Argument: string of header names
1196Returns: nothing
1197*/
1198
1199static void
1200setup_remove_header(uschar *hnames)
1201{
1202if (*hnames != 0)
1203 {
1204 if (acl_removed_headers == NULL)
1205 acl_removed_headers = hnames;
1206 else
1207 acl_removed_headers = string_sprintf("%s : %s", acl_removed_headers, hnames);
1208 }
1209}
1210
1211
71fafd95 1212
059ec3d9
PH		 1213/*************************************************
1214* Handle warnings *
1215*************************************************/
1216
1217/* This function is called when a WARN verb's conditions are true. It adds to
1218the message's headers, and/or writes information to the log. In each case, this
1219only happens once (per message for headers, per connection for log).
1220
71fafd95
PH		 1221** NOTE: The header adding action using the "message" setting is historic, and
1222its use is now deprecated. The new add_header modifier should be used instead.
1223
059ec3d9
PH		 1224Arguments:
1225 where ACL_WHERE_xxxx indicating which ACL this is
1226 user_message message for adding to headers
1227 log_message message for logging, if different
1228
1229Returns: nothing
1230*/
1231
1232static void
1233acl_warn(int where, uschar *user_message, uschar *log_message)
1234{
059ec3d9
PH		 1235if (log_message != NULL && log_message != user_message)
1236 {
1237 uschar *text;
1238 string_item *logged;
1239
1240 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1241 string_printing(log_message));
1242
1243 /* If a sender verification has failed, and the log message is "sender verify
1244 failed", add the failure message. */
1245
1246 if (sender_verified_failed != NULL &&
1247 sender_verified_failed->message != NULL &&
1248 strcmpic(log_message, US"sender verify failed") == 0)
1249 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1250
9c7a242c
PH		 1251 /* Search previously logged warnings. They are kept in malloc
1252 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1253
1254 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1255 if (Ustrcmp(logged->text, text) == 0) break;
1256
1257 if (logged == NULL)
1258 {
1259 int length = Ustrlen(text) + 1;
1260 log_write(0, LOG_MAIN, "%s", text);
1261 logged = store_malloc(sizeof(string_item) + length);
1262 logged->text = (uschar *)logged + sizeof(string_item);
1263 memcpy(logged->text, text, length);
1264 logged->next = acl_warn_logged;
1265 acl_warn_logged = logged;
1266 }
1267 }
1268
1269/* If there's no user message, we are done. */
1270
1271if (user_message == NULL) return;
1272
1273/* If this isn't a message ACL, we can't do anything with a user message.
1274Log an error. */
1275
1276if (where > ACL_WHERE_NOTSMTP)
1277 {
1278 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1279 "found in a non-message (%s) ACL: cannot specify header lines here: "
1280 "message ignored", acl_wherenames[where]);
1281 return;
1282 }
1283
71fafd95
PH		 1284/* The code for setting up header lines is now abstracted into a separate
1285function so that it can be used for the add_header modifier as well. */
059ec3d9 1286
71fafd95 1287setup_header(user_message);
059ec3d9
PH		 1288}
1289
1290
1291
1292/*************************************************
1293* Verify and check reverse DNS *
1294*************************************************/
1295
1296/* Called from acl_verify() below. We look up the host name(s) of the client IP
1297address if this has not yet been done. The host_name_lookup() function checks
1298that one of these names resolves to an address list that contains the client IP
1299address, so we don't actually have to do the check here.
1300
1301Arguments:
1302 user_msgptr pointer for user message
1303 log_msgptr pointer for log message
1304
1305Returns: OK verification condition succeeded
1306 FAIL verification failed
1307 DEFER there was a problem verifying
1308*/
1309
1310static int
1311acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1312{
1313int rc;
1314
1315user_msgptr = user_msgptr; /* stop compiler warning */
1316
1317/* Previous success */
1318
1319if (sender_host_name != NULL) return OK;
1320
1321/* Previous failure */
1322
1323if (host_lookup_failed)
1324 {
1325 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1326 return FAIL;
1327 }
1328
1329/* Need to do a lookup */
1330
1331HDEBUG(D_acl)
1332 debug_printf("looking up host name to force name/address consistency check\n");
1333
1334if ((rc = host_name_lookup()) != OK)
1335 {
1336 *log_msgptr = (rc == DEFER)?
1337 US"host lookup deferred for reverse lookup check"
1338 :
1339 string_sprintf("host lookup failed for reverse lookup check%s",
1340 host_lookup_msg);
1341 return rc; /* DEFER or FAIL */
1342 }
1343
1344host_build_sender_fullhost();
1345return OK;
1346}
1347
1348
1349
e5a9dba6
PH		 1350/*************************************************
1351* Check client IP address matches CSA target *
1352*************************************************/
1353
1354/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1355response for address records belonging to the CSA target hostname. The section
1356is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1357If one of the addresses matches the client's IP address, then the client is
1358authorized by CSA. If there are target IP addresses but none of them match
1359then the client is using an unauthorized IP address. If there are no target IP
1360addresses then the client cannot be using an authorized IP address. (This is
1361an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1362
1363Arguments:
1364 dnsa the DNS answer block
1365 dnss a DNS scan block for us to use
1366 reset option specifing what portion to scan, as described above
1367 target the target hostname to use for matching RR names
1368
1369Returns: CSA_OK successfully authorized
1370 CSA_FAIL_MISMATCH addresses found but none matched
1371 CSA_FAIL_NOADDR no target addresses found
1372*/
1373
1374static int
1375acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1376 uschar *target)
1377{
1378dns_record *rr;
1379dns_address *da;
1380
1381BOOL target_found = FALSE;
1382
1383for (rr = dns_next_rr(dnsa, dnss, reset);
1384 rr != NULL;
1385 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1386 {
1387 /* Check this is an address RR for the target hostname. */
1388
1389 if (rr->type != T_A
1390 #if HAVE_IPV6
1391 && rr->type != T_AAAA
1392 #ifdef SUPPORT_A6
1393 && rr->type != T_A6
1394 #endif
1395 #endif
1396 ) continue;
1397
1398 if (strcmpic(target, rr->name) != 0) continue;
1399
1400 target_found = TRUE;
1401
1402 /* Turn the target address RR into a list of textual IP addresses and scan
1403 the list. There may be more than one if it is an A6 RR. */
1404
1405 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1406 {
1407 /* If the client IP address matches the target IP address, it's good! */
1408
1409 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1410
1411 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1412 }
1413 }
1414
1415/* If we found some target addresses but none of them matched, the client is
1416using an unauthorized IP address, otherwise the target has no authorized IP
1417addresses. */
1418
1419if (target_found) return CSA_FAIL_MISMATCH;
1420else return CSA_FAIL_NOADDR;
1421}
1422
1423
1424
1425/*************************************************
1426* Verify Client SMTP Authorization *
1427*************************************************/
1428
1429/* Called from acl_verify() below. This routine calls dns_lookup_special()
1430to find the CSA SRV record corresponding to the domain argument, or
1431$sender_helo_name if no argument is provided. It then checks that the
1432client is authorized, and that its IP address corresponds to the SRV
1433target's address by calling acl_verify_csa_address() above. The address
1434should have been returned in the DNS response's ADDITIONAL section, but if
1435not we perform another DNS lookup to get it.
1436
1437Arguments:
1438 domain pointer to optional parameter following verify = csa
1439
1440Returns: CSA_UNKNOWN no valid CSA record found
1441 CSA_OK successfully authorized
1442 CSA_FAIL_* client is definitely not authorized
1443 CSA_DEFER_* there was a DNS problem
1444*/
1445
1446static int
1447acl_verify_csa(uschar *domain)
1448{
1449tree_node *t;
1450uschar *found, *p;
1451int priority, weight, port;
1452dns_answer dnsa;
1453dns_scan dnss;
1454dns_record *rr;
1455int rc, type;
1456uschar target[256];
1457
1458/* Work out the domain we are using for the CSA lookup. The default is the
1459client's HELO domain. If the client has not said HELO, use its IP address
1460instead. If it's a local client (exim -bs), CSA isn't applicable. */
1461
1462while (isspace(*domain) && *domain != '\0') ++domain;
1463if (*domain == '\0') domain = sender_helo_name;
1464if (domain == NULL) domain = sender_host_address;
1465if (sender_host_address == NULL) return CSA_UNKNOWN;
1466
1467/* If we have an address literal, strip off the framing ready for turning it
1468into a domain. The framing consists of matched square brackets possibly
1469containing a keyword and a colon before the actual IP address. */
1470
1471if (domain[0] == '[')
1472 {
1473 uschar *start = Ustrchr(domain, ':');
1474 if (start == NULL) start = domain;
1475 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1476 }
1477
1478/* Turn domains that look like bare IP addresses into domains in the reverse
1479DNS. This code also deals with address literals and $sender_host_address. It's
1480not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1481address literals, but it's probably the most friendly thing to do. This is an
1482extension to CSA, so we allow it to be turned off for proper conformance. */
1483
7e66e54d 1484if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1485 {
1486 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1487 dns_build_reverse(domain, target);
1488 domain = target;
1489 }
1490
1491/* Find out if we've already done the CSA check for this domain. If we have,
1492return the same result again. Otherwise build a new cached result structure
1493for this domain. The name is filled in now, and the value is filled in when
1494we return from this function. */
1495
1496t = tree_search(csa_cache, domain);
1497if (t != NULL) return t->data.val;
1498
1499t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1500Ustrcpy(t->name, domain);
1501(void)tree_insertnode(&csa_cache, t);
1502
1503/* Now we are ready to do the actual DNS lookup(s). */
1504
28e6ef29 1505found = domain;
e5a9dba6
PH		 1506switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1507 {
1508 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1509
1510 default:
1511 return t->data.val = CSA_DEFER_SRV;
1512
1513 /* If we found nothing, the client's authorization is unknown. */
1514
1515 case DNS_NOMATCH:
1516 case DNS_NODATA:
1517 return t->data.val = CSA_UNKNOWN;
1518
1519 /* We got something! Go on to look at the reply in more detail. */
1520
1521 case DNS_SUCCEED:
1522 break;
1523 }
1524
1525/* Scan the reply for well-formed CSA SRV records. */
1526
1527for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1528 rr != NULL;
1529 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1530 {
1531 if (rr->type != T_SRV) continue;
1532
1533 /* Extract the numerical SRV fields (p is incremented) */
1534
1535 p = rr->data;
1536 GETSHORT(priority, p);
1537 GETSHORT(weight, p);
1538 GETSHORT(port, p);
1539
1540 DEBUG(D_acl)
1541 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1542
1543 /* Check the CSA version number */
1544
1545 if (priority != 1) continue;
1546
1547 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1548 found by dns_special_lookup() is a parent of the one we asked for), we check
1549 the subdomain assertions in the port field. At the moment there's only one
1550 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1551 SRV records of their own. */
1552
1553 if (found != domain)
1554 {
1555 if (port & 1)
1556 return t->data.val = CSA_FAIL_EXPLICIT;
1557 else
1558 return t->data.val = CSA_UNKNOWN;
1559 }
1560
1561 /* This CSA SRV record refers directly to our domain, so we check the value
1562 in the weight field to work out the domain's authorization. 0 and 1 are
1563 unauthorized; 3 means the client is authorized but we can't check the IP
1564 address in order to authenticate it, so we treat it as unknown; values
1565 greater than 3 are undefined. */
1566
1567 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1568
1569 if (weight > 2) continue;
1570
1571 /* Weight == 2, which means the domain is authorized. We must check that the
1572 client's IP address is listed as one of the SRV target addresses. Save the
1573 target hostname then break to scan the additional data for its addresses. */
1574
1575 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1576 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1577
1578 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1579
1580 break;
1581 }
1582
1583/* If we didn't break the loop then no appropriate records were found. */
1584
1585if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1586
1587/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1588A target of "." indicates there are no valid addresses, so the client cannot
1589be authorized. (This is an odd configuration because weight=2 target=. is
1590equivalent to weight=1, but we check for it in order to keep load off the
1591root name servers.) Note that dn_expand() turns "." into "". */
1592
1593if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1594
1595/* Scan the additional section of the CSA SRV reply for addresses belonging
1596to the target. If the name server didn't return any additional data (e.g.
1597because it does not fully support SRV records), we need to do another lookup
1598to obtain the target addresses; otherwise we have a definitive result. */
1599
1600rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1601if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1602
1603/* The DNS lookup type corresponds to the IP version used by the client. */
1604
1605#if HAVE_IPV6
1606if (Ustrchr(sender_host_address, ':') != NULL)
1607 type = T_AAAA;
1608else
1609#endif /* HAVE_IPV6 */
1610 type = T_A;
1611
1612
1613#if HAVE_IPV6 && defined(SUPPORT_A6)
1614DNS_LOOKUP_AGAIN:
1615#endif
1616
1617switch (dns_lookup(&dnsa, target, type, NULL))
1618 {
1619 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1620
1621 default:
1622 return t->data.val = CSA_DEFER_ADDR;
1623
1624 /* If the query succeeded, scan the addresses and return the result. */
1625
1626 case DNS_SUCCEED:
1627 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1628 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1629 /* else fall through */
1630
1631 /* If the target has no IP addresses, the client cannot have an authorized
1632 IP address. However, if the target site uses A6 records (not AAAA records)
1633 we have to do yet another lookup in order to check them. */
1634
1635 case DNS_NOMATCH:
1636 case DNS_NODATA:
1637
1638 #if HAVE_IPV6 && defined(SUPPORT_A6)
1639 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1640 #endif
1641
1642 return t->data.val = CSA_FAIL_NOADDR;
1643 }
1644}
1645
1646
1647
059ec3d9
PH		 1648/*************************************************
1649* Handle verification (address & other) *
1650*************************************************/
1651
89583014 1652enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1653 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1654 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1655 };
1656typedef struct {
1657 uschar * name;
1658 int value;
1659 unsigned where_allowed; /* bitmap */
1660 BOOL no_options; /* Never has /option(s) following */
1661 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1662 } verify_type_t;
1663static verify_type_t verify_type_list[] = {
1664 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, TRUE, 0 },
1665 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1666 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1667 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1668 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1669 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1670 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1671 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1672 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1673 FALSE, 6 },
770747fd
MFM		 1674 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1675 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1676 };
1677
1678
1679enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1680 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1681 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1682 CALLOUT_TIME
1683 };
1684typedef struct {
1685 uschar * name;
1686 int value;
1687 int flag;
1688 BOOL has_option; /* Has =option(s) following */
1689 BOOL timeval; /* Has a time value */
1690 } callout_opt_t;
1691static callout_opt_t callout_opt_list[] = {
1692 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1693 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1694 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1695 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1696 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1697 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1698 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1699 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1700 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1701 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1702 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1703 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1704 };
1705
1706
1707
059ec3d9
PH		 1708/* This function implements the "verify" condition. It is called when
1709encountered in any ACL, because some tests are almost always permitted. Some
1710just don't make sense, and always fail (for example, an attempt to test a host
1711lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1712
1713Arguments:
1714 where where called from
1715 addr the recipient address that the ACL is handling, or NULL
1716 arg the argument of "verify"
1717 user_msgptr pointer for user message
1718 log_msgptr pointer for log message
1719 basic_errno where to put verify errno
1720
1721Returns: OK verification condition succeeded
1722 FAIL verification failed
1723 DEFER there was a problem verifying
1724 ERROR syntax error
1725*/
1726
1727static int
1728acl_verify(int where, address_item *addr, uschar *arg,
1729 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1730{
1731int sep = '/';
1732int callout = -1;
1733int callout_overall = -1;
4deaf07d 1734int callout_connect = -1;
059ec3d9
PH		 1735int verify_options = 0;
1736int rc;
1737BOOL verify_header_sender = FALSE;
1738BOOL defer_ok = FALSE;
1739BOOL callout_defer_ok = FALSE;
1740BOOL no_details = FALSE;
eafd343b 1741BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1742address_item *sender_vaddr = NULL;
1743uschar *verify_sender_address = NULL;
1744uschar *pm_mailfrom = NULL;
1745uschar *se_mailfrom = NULL;
596875b3
PH		 1746
1747/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1748an error if options are given for items that don't expect them.
596875b3
PH		 1749*/
1750
1751uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH		 1752uschar *list = arg;
1753uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1754verify_type_t * vp;
059ec3d9
PH		 1755
1756if (ss == NULL) goto BAD_VERIFY;
1757
1758/* Handle name/address consistency verification in a separate function. */
1759
89583014
JH		 1760for (vp= verify_type_list;
1761 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1762 vp++
1763 )
1764 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1765 : strcmpic (ss, vp->name) == 0)
1766 break;
1767if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1768 goto BAD_VERIFY;
1769
1770if (vp->no_options && slash != NULL)
059ec3d9 1771 {
89583014
JH		 1772 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1773 "(this verify item has no options)", arg);
1774 return ERROR;
059ec3d9 1775 }
89583014 1776if (!(vp->where_allowed & (1<<where)))
059ec3d9 1777 {
89583014
JH		 1778 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1779 return ERROR;
059ec3d9 1780 }
89583014 1781switch(vp->value)
596875b3 1782 {
89583014
JH		 1783 case VERIFY_REV_HOST_LKUP:
1784 if (sender_host_address == NULL) return OK;
1785 return acl_verify_reverse(user_msgptr, log_msgptr);
059ec3d9 1786
89583014
JH		 1787 case VERIFY_CERT:
1788 /* TLS certificate verification is done at STARTTLS time; here we just
1789 test whether it was successful or not. (This is for optional verification; for
1790 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1791
817d9f57 1792 if (tls_in.certificate_verified) return OK;
89583014
JH		 1793 *user_msgptr = US"no verified certificate";
1794 return FAIL;
e5a9dba6 1795
89583014
JH		 1796 case VERIFY_HELO:
1797 /* We can test the result of optional HELO verification that might have
1798 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1799
89583014
JH		 1800 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1801 return helo_verified? OK : FAIL;
059ec3d9 1802
89583014
JH		 1803 case VERIFY_CSA:
1804 /* Do Client SMTP Authorization checks in a separate function, and turn the
1805 result code into user-friendly strings. */
1c41c9cc 1806
89583014
JH		 1807 rc = acl_verify_csa(list);
1808 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1809 csa_reason_string[rc]);
1810 csa_status = csa_status_string[rc];
1811 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1812 return csa_return_code[rc];
1813
1814 case VERIFY_HDR_SYNTAX:
1815 /* Check that all relevant header lines have the correct syntax. If there is
1816 a syntax error, we return details of the error to the sender if configured to
1817 send out full details. (But a "message" setting on the ACL can override, as
1818 always). */
1819
1820 rc = verify_check_headers(log_msgptr);
1821 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1822 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1823 return rc;
059ec3d9 1824
770747fd
MFM		 1825 case VERIFY_HDR_NAMES_ASCII:
1826 /* Check that all header names are true 7 bit strings
1827 See RFC 5322, 2.2. and RFC 6532, 3. */
1828
1829 rc = verify_check_header_names_ascii(log_msgptr);
1830 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1831 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1832 return rc;
1833
89583014
JH		 1834 case VERIFY_NOT_BLIND:
1835 /* Check that no recipient of this message is "blind", that is, every envelope
1836 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1837
89583014
JH		 1838 rc = verify_check_notblind();
1839 if (rc != OK)
1840 {
1841 *log_msgptr = string_sprintf("bcc recipient detected");
1842 if (smtp_return_error_details)
1843 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1844 }
1845 return rc;
059ec3d9 1846
89583014
JH		 1847 /* The remaining verification tests check recipient and sender addresses,
1848 either from the envelope or from the header. There are a number of
1849 slash-separated options that are common to all of them. */
059ec3d9 1850
89583014
JH		 1851 case VERIFY_HDR_SNDR:
1852 verify_header_sender = TRUE;
1853 break;
059ec3d9 1854
89583014
JH		 1855 case VERIFY_SNDR:
1856 /* In the case of a sender, this can optionally be followed by an address to use
1857 in place of the actual sender (rare special-case requirement). */
059ec3d9 1858 {
89583014
JH		 1859 uschar *s = ss + 6;
1860 if (*s == 0)
1861 verify_sender_address = sender_address;
1862 else
1863 {
1864 while (isspace(*s)) s++;
1865 if (*s++ != '=') goto BAD_VERIFY;
1866 while (isspace(*s)) s++;
1867 verify_sender_address = string_copy(s);
1868 }
059ec3d9 1869 }
89583014
JH		 1870 break;
1871
1872 case VERIFY_RCPT:
1873 break;
059ec3d9
PH		 1874 }
1875
89583014
JH		 1876
1877
596875b3
PH		 1878/* Remaining items are optional; they apply to sender and recipient
1879verification, including "header sender" verification. */
059ec3d9
PH		 1880
1881while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1882 != NULL)
1883 {
1884 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1885 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1886 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1887
1888 /* These two old options are left for backwards compatibility */
1889
1890 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1891 {
1892 callout_defer_ok = TRUE;
1893 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1894 }
1895
1896 else if (strcmpic(ss, US"check_postmaster") == 0)
1897 {
1898 pm_mailfrom = US"";
1899 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1900 }
1901
1902 /* The callout option has a number of sub-options, comma separated */
1903
1904 else if (strncmpic(ss, US"callout", 7) == 0)
1905 {
1906 callout = CALLOUT_TIMEOUT_DEFAULT;
1907 ss += 7;
1908 if (*ss != 0)
1909 {
1910 while (isspace(*ss)) ss++;
1911 if (*ss++ == '=')
1912 {
1913 int optsep = ',';
1914 uschar *opt;
1915 uschar buffer[256];
1916 while (isspace(*ss)) ss++;
8e669ac1 1917
059ec3d9
PH		 1918 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1919 != NULL)
1920 {
89583014 1921 callout_opt_t * op;
438257ba 1922 double period = 1.0F;
059ec3d9 1923
89583014 1924 for (op= callout_opt_list; op->name; op++)
438257ba 1925 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1926 break;
059ec3d9 1927
89583014
JH		 1928 verify_options |= op->flag;
1929 if (op->has_option)
1930 {
438257ba 1931 opt += Ustrlen(op->name);
4deaf07d
PH		 1932 while (isspace(*opt)) opt++;
1933 if (*opt++ != '=')
1934 {
1935 *log_msgptr = string_sprintf("'=' expected after "
89583014 1936 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1937 return ERROR;
1938 }
1939 while (isspace(*opt)) opt++;
89583014
JH		 1940 }
1941 if (op->timeval)
1942 {
1943 period = readconf_readtime(opt, 0, FALSE);
1944 if (period < 0)
4deaf07d
PH		 1945 {
1946 *log_msgptr = string_sprintf("bad time value in ACL condition "
1947 "\"verify %s\"", arg);
1948 return ERROR;
1949 }
89583014
JH		 1950 }
1951
1952 switch(op->value)
1953 {
1954 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1955 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1956 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1957 case CALLOUT_MAILFROM:
1958 if (!verify_header_sender)
1959 {
1960 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1961 "callout option only for verify=header_sender (detected in ACL "
1962 "condition \"%s\")", arg);
1963 return ERROR;
1964 }
1965 se_mailfrom = string_copy(opt);
1966 break;
1967 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1968 case CALLOUT_MAXWAIT: callout_overall = period; break;
1969 case CALLOUT_CONNECT: callout_connect = period; break;
1970 case CALLOUT_TIME: callout = period; break;
1971 }
059ec3d9
PH		 1972 }
1973 }
1974 else
1975 {
1976 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1977 "ACL condition \"%s\"", arg);
1978 return ERROR;
1979 }
1980 }
1981 }
1982
1983 /* Option not recognized */
1984
1985 else
1986 {
1987 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1988 "condition \"verify %s\"", ss, arg);
1989 return ERROR;
1990 }
1991 }
1992
1993if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1994 (vopt_callout_recipsender|vopt_callout_recippmaster))
1995 {
1996 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1997 "for a recipient callout";
1998 return ERROR;
1999 }
2000
2001/* Handle sender-in-header verification. Default the user message to the log
2002message if giving out verification details. */
2003
2004if (verify_header_sender)
2005 {
8e669ac1 2006 int verrno;
059ec3d9 2007 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2008 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2009 &verrno);
2010 if (rc != OK)
8e669ac1 2011 {
fe5b5d0b
PH		 2012 *basic_errno = verrno;
2013 if (smtp_return_error_details)
2014 {
2015 if (*user_msgptr == NULL && *log_msgptr != NULL)
2016 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2017 if (rc == DEFER) acl_temp_details = TRUE;
2018 }
8e669ac1 2019 }
059ec3d9
PH		 2020 }
2021
2022/* Handle a sender address. The default is to verify *the* sender address, but
2023optionally a different address can be given, for special requirements. If the
2024address is empty, we are dealing with a bounce message that has no sender, so
2025we cannot do any checking. If the real sender address gets rewritten during
2026verification (e.g. DNS widening), set the flag to stop it being rewritten again
2027during message reception.
2028
2029A list of verified "sender" addresses is kept to try to avoid doing to much
2030work repetitively when there are multiple recipients in a message and they all
2031require sender verification. However, when callouts are involved, it gets too
2032complicated because different recipients may require different callout options.
2033Therefore, we always do a full sender verify when any kind of callout is
2034specified. Caching elsewhere, for instance in the DNS resolver and in the
2035callout handling, should ensure that this is not terribly inefficient. */
2036
2037else if (verify_sender_address != NULL)
2038 {
2039 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2040 != 0)
2041 {
2042 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2043 "sender verify callout";
2044 return ERROR;
2045 }
2046
2047 sender_vaddr = verify_checked_sender(verify_sender_address);
2048 if (sender_vaddr != NULL && /* Previously checked */
2049 callout <= 0) /* No callout needed this time */
2050 {
2051 /* If the "routed" flag is set, it means that routing worked before, so
2052 this check can give OK (the saved return code value, if set, belongs to a
2053 callout that was done previously). If the "routed" flag is not set, routing
2054 must have failed, so we use the saved return code. */
2055
2056 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2057 {
2058 rc = sender_vaddr->special_action;
2059 *basic_errno = sender_vaddr->basic_errno;
2060 }
2061 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2062 }
2063
2064 /* Do a new verification, and cache the result. The cache is used to avoid
2065 verifying the sender multiple times for multiple RCPTs when callouts are not
2066 specified (see comments above).
2067
2068 The cache is also used on failure to give details in response to the first
2069 RCPT that gets bounced for this reason. However, this can be suppressed by
2070 the no_details option, which sets the flag that says "this detail has already
2071 been sent". The cache normally contains just one address, but there may be
2072 more in esoteric circumstances. */
2073
2074 else
2075 {
2076 BOOL routed = TRUE;
2a3eea10 2077 uschar *save_address_data = deliver_address_data;
8e669ac1 2078
059ec3d9
PH		 2079 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2080 if (no_details) setflag(sender_vaddr, af_sverify_told);
2081 if (verify_sender_address[0] != 0)
2082 {
2083 /* If this is the real sender address, save the unrewritten version
2084 for use later in receive. Otherwise, set a flag so that rewriting the
2085 sender in verify_address() does not update sender_address. */
2086
2087 if (verify_sender_address == sender_address)
2088 sender_address_unrewritten = sender_address;
2089 else
2090 verify_options |= vopt_fake_sender;
2091
eafd343b
TK		 2092 if (success_on_redirect)
2093 verify_options |= vopt_success_on_redirect;
2094
059ec3d9
PH		 2095 /* The recipient, qualify, and expn options are never set in
2096 verify_options. */
2097
2098 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2099 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2100
2101 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2102
2103 if (rc == OK)
2104 {
2105 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2106 {
2107 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2108 verify_sender_address, sender_vaddr->address);
2109 }
2110 else
2111 {
2112 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2113 verify_sender_address);
2114 }
2115 }
2116 else *basic_errno = sender_vaddr->basic_errno;
2117 }
2118 else rc = OK; /* Null sender */
2119
2120 /* Cache the result code */
2121
2122 if (routed) setflag(sender_vaddr, af_verify_routed);
2123 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2124 sender_vaddr->special_action = rc;
2125 sender_vaddr->next = sender_verified_list;
2126 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2127
2128 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2129 the sender verification. */
8e669ac1 2130
2a3eea10 2131 deliver_address_data = save_address_data;
059ec3d9 2132 }
8e669ac1 2133
2a3eea10
PH		 2134 /* Put the sender address_data value into $sender_address_data */
2135
8e669ac1 2136 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH		 2137 }
2138
2139/* A recipient address just gets a straightforward verify; again we must handle
2140the DEFER overrides. */
2141
2142else
2143 {
2144 address_item addr2;
2145
eafd343b
TK		 2146 if (success_on_redirect)
2147 verify_options |= vopt_success_on_redirect;
2148
059ec3d9
PH		 2149 /* We must use a copy of the address for verification, because it might
2150 get rewritten. */
2151
2152 addr2 = *addr;
2153 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2154 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2155 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2156
42855d71 2157 *basic_errno = addr2.basic_errno;
059ec3d9 2158 *log_msgptr = addr2.message;
8e669ac1 2159 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2160 addr2.user_message : addr2.message;
42855d71
PH		 2161
2162 /* Allow details for temporary error if the address is so flagged. */
2163 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2164
2165 /* Make $address_data visible */
2166 deliver_address_data = addr2.p.address_data;
2167 }
2168
2169/* We have a result from the relevant test. Handle defer overrides first. */
2170
2171if (rc == DEFER && (defer_ok ||
2172 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2173 {
2174 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2175 defer_ok? "defer_ok" : "callout_defer_ok");
2176 rc = OK;
2177 }
2178
2179/* If we've failed a sender, set up a recipient message, and point
2180sender_verified_failed to the address item that actually failed. */
2181
2182if (rc != OK && verify_sender_address != NULL)
2183 {
2184 if (rc != DEFER)
2185 {
2186 *log_msgptr = *user_msgptr = US"Sender verify failed";
2187 }
2188 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2189 {
2190 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2191 }
2192 else
2193 {
2194 *log_msgptr = US"Could not complete sender verify callout";
2195 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2196 *log_msgptr;
2197 }
2198
2199 sender_verified_failed = sender_vaddr;
2200 }
2201
2202/* Verifying an address messes up the values of $domain and $local_part,
2203so reset them before returning if this is a RCPT ACL. */
2204
2205if (addr != NULL)
2206 {
2207 deliver_domain = addr->domain;
2208 deliver_localpart = addr->local_part;
2209 }
2210return rc;
2211
2212/* Syntax errors in the verify argument come here. */
2213
2214BAD_VERIFY:
2215*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2216 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2217 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2218 "\"verify %s\"", arg);
2219return ERROR;
2220}
2221
2222
2223
2224
2225/*************************************************
2226* Check argument for control= modifier *
2227*************************************************/
2228
2229/* Called from acl_check_condition() below
2230
2231Arguments:
2232 arg the argument string for control=
2233 pptr set to point to the terminating character
2234 where which ACL we are in
2235 log_msgptr for error messages
2236
2237Returns: CONTROL_xxx value
2238*/
2239
2240static int
2241decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2242{
2243int len;
2244control_def *d;
2245
2246for (d = controls_list;
2247 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2248 d++)
2249 {
2250 len = Ustrlen(d->name);
2251 if (Ustrncmp(d->name, arg, len) == 0) break;
2252 }
2253
2254if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2255 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2256 {
2257 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2258 return CONTROL_ERROR;
2259 }
2260
059ec3d9
PH		 2261*pptr = arg + len;
2262return d->value;
2263}
2264
2265
2266
c99ce5c9
TF		 2267
2268/*************************************************
2269* Return a ratelimit error *
2270*************************************************/
2271
2272/* Called from acl_ratelimit() below
2273
2274Arguments:
2275 log_msgptr for error messages
2276 format format string
2277 ... supplementary arguments
2278 ss ratelimit option name
2279 where ACL_WHERE_xxxx indicating which ACL this is
2280
2281Returns: ERROR
2282*/
2283
2284static int
2285ratelimit_error(uschar **log_msgptr, const char *format, ...)
2286{
2287va_list ap;
2288uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2289va_start(ap, format);
2290if (!string_vformat(buffer, sizeof(buffer), format, ap))
2291 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2292 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2293va_end(ap);
2294*log_msgptr = string_sprintf(
2295 "error in arguments to \"ratelimit\" condition: %s", buffer);
2296return ERROR;
2297}
2298
2299
2300
2301
870f6ba8
TF		 2302/*************************************************
2303* Handle rate limiting *
2304*************************************************/
2305
2306/* Called by acl_check_condition() below to calculate the result
2307of the ACL ratelimit condition.
2308
2309Note that the return value might be slightly unexpected: if the
2310sender's rate is above the limit then the result is OK. This is
2311similar to the dnslists condition, and is so that you can write
2312ACL clauses like: defer ratelimit = 15 / 1h
2313
2314Arguments:
2315 arg the option string for ratelimit=
90fc3069 2316 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2317 log_msgptr for error messages
2318
2319Returns: OK - Sender's rate is above limit
2320 FAIL - Sender's rate is below limit
2321 DEFER - Problem opening ratelimit database
2322 ERROR - Syntax error in options.
2323*/
2324
2325static int
90fc3069 2326acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2327{
c99ce5c9 2328double limit, period, count;
8f240103
PH		 2329uschar *ss;
2330uschar *key = NULL;
c99ce5c9 2331uschar *unique = NULL;
870f6ba8 2332int sep = '/';
c99ce5c9
TF		 2333BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2334BOOL noupdate = FALSE, badacl = FALSE;
2335int mode = RATE_PER_WHAT;
870f6ba8
TF		 2336int old_pool, rc;
2337tree_node **anchor, *t;
2338open_db dbblock, *dbm;
c99ce5c9 2339int dbdb_size;
870f6ba8 2340dbdata_ratelimit *dbd;
c99ce5c9 2341dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2342struct timeval tv;
2343
2344/* Parse the first two options and record their values in expansion
2345variables. These variables allow the configuration to have informative
2346error messages based on rate limits obtained from a table lookup. */
2347
c99ce5c9 2348/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2349size, which must be greater than or equal to zero. Zero is useful for
2350rate measurement as opposed to rate limiting. */
2351
2352sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2353if (sender_rate_limit == NULL)
2354 limit = -1.0;
2355else
2356 {
2357 limit = Ustrtod(sender_rate_limit, &ss);
2358 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2359 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2360 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2361 }
c99ce5c9
TF		 2362if (limit < 0.0 || *ss != '\0')
2363 return ratelimit_error(log_msgptr,
2364 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2365
c99ce5c9 2366/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2367constant. This must be strictly greater than zero, because zero leads to
2368run-time division errors. */
2369
2370sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2371if (sender_rate_period == NULL) period = -1.0;
2372else period = readconf_readtime(sender_rate_period, 0, FALSE);
2373if (period <= 0.0)
c99ce5c9
TF		 2374 return ratelimit_error(log_msgptr,
2375 "\"%s\" is not a time value", sender_rate_period);
2376
2377/* By default we are counting one of something, but the per_rcpt,
2378per_byte, and count options can change this. */
2379
2380count = 1.0;
870f6ba8 2381
c99ce5c9 2382/* Parse the other options. */
870f6ba8
TF		 2383
2384while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2385 != NULL)
2386 {
2387 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2388 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2389 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2390 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2391 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2392 else if (strcmpic(ss, US"per_conn") == 0)
2393 {
2394 RATE_SET(mode, PER_CONN);
2395 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2396 badacl = TRUE;
2397 }
2398 else if (strcmpic(ss, US"per_mail") == 0)
2399 {
2400 RATE_SET(mode, PER_MAIL);
2401 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2402 }
2403 else if (strcmpic(ss, US"per_rcpt") == 0)
2404 {
2405 /* If we are running in the RCPT ACL, then we'll count the recipients
2406 one by one, but if we are running when we have accumulated the whole
2407 list then we'll add them all in one batch. */
2408 if (where == ACL_WHERE_RCPT)
2409 RATE_SET(mode, PER_RCPT);
2410 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2411 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2412 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2413 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2414 }
2415 else if (strcmpic(ss, US"per_byte") == 0)
2416 {
2417 /* If we have not yet received the message data and there was no SIZE
2418 declaration on the MAIL comand, then it's safe to just use a value of
2419 zero and let the recorded rate decay as if nothing happened. */
2420 RATE_SET(mode, PER_MAIL);
2421 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2422 else count = message_size < 0 ? 0.0 : (double)message_size;
2423 }
2424 else if (strcmpic(ss, US"per_addr") == 0)
2425 {
2426 RATE_SET(mode, PER_RCPT);
438257ba 2427 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2428 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2429 }
2430 else if (strncmpic(ss, US"count=", 6) == 0)
2431 {
2432 uschar *e;
2433 count = Ustrtod(ss+6, &e);
2434 if (count < 0.0 || *e != '\0')
2435 return ratelimit_error(log_msgptr,
2436 "\"%s\" is not a positive number", ss);
2437 }
2438 else if (strncmpic(ss, US"unique=", 7) == 0)
2439 unique = string_copy(ss + 7);
2440 else if (key == NULL)
2441 key = string_copy(ss);
2442 else
2443 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2444 }
2445
c99ce5c9
TF		 2446/* Sanity check. When the badacl flag is set the update mode must either
2447be readonly (which is the default if it is omitted) or, for backwards
2448compatibility, a combination of noupdate and strict or leaky. */
2449
2450if (mode == RATE_PER_CLASH)
2451 return ratelimit_error(log_msgptr, "conflicting per_* options");
2452if (leaky + strict + readonly > 1)
2453 return ratelimit_error(log_msgptr, "conflicting update modes");
2454if (badacl && (leaky || strict) && !noupdate)
2455 return ratelimit_error(log_msgptr,
2456 "\"%s\" must not have /leaky or /strict option in %s ACL",
2457 ratelimit_option_string[mode], acl_wherenames[where]);
2458
2459/* Set the default values of any unset options. In readonly mode we
2460perform the rate computation without any increment so that its value
2461decays to eventually allow over-limit senders through. */
2462
2463if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2464if (badacl) readonly = TRUE;
2465if (readonly) count = 0.0;
2466if (!strict && !readonly) leaky = TRUE;
2467if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2468
8f240103
PH		 2469/* Create the lookup key. If there is no explicit key, use sender_host_address.
2470If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2471omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2472are added to the key because they alter the meaning of the stored data. */
2473
2474if (key == NULL)
2475 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2476
c99ce5c9 2477key = string_sprintf("%s/%s/%s%s",
8f240103 2478 sender_rate_period,
c99ce5c9
TF		 2479 ratelimit_option_string[mode],
2480 unique == NULL ? "" : "unique/",
8f240103 2481 key);
870f6ba8 2482
c99ce5c9
TF		 2483HDEBUG(D_acl)
2484 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2485
8f240103
PH		 2486/* See if we have already computed the rate by looking in the relevant tree.
2487For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2488pool so that they survive across resets. In readonly mode we only remember the
2489result for the rest of this command in case a later command changes it. After
2490this bit of logic the code is independent of the per_* mode. */
870f6ba8 2491
870f6ba8
TF		 2492old_pool = store_pool;
2493
c99ce5c9
TF		 2494if (readonly)
2495 anchor = &ratelimiters_cmd;
2496else switch(mode) {
2497case RATE_PER_CONN:
870f6ba8
TF		 2498 anchor = &ratelimiters_conn;
2499 store_pool = POOL_PERM;
c99ce5c9
TF		 2500 break;
2501case RATE_PER_BYTE:
2502case RATE_PER_MAIL:
2503case RATE_PER_ALLRCPTS:
870f6ba8 2504 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2505 break;
2506case RATE_PER_ADDR:
2507case RATE_PER_CMD:
2508case RATE_PER_RCPT:
fe0dab11 2509 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2510 break;
2511default:
3399bb60 2512 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2513 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2514 "internal ACL error: unknown ratelimit mode %d", mode);
2515 break;
2516}
870f6ba8 2517
c99ce5c9
TF		 2518t = tree_search(*anchor, key);
2519if (t != NULL)
870f6ba8
TF		 2520 {
2521 dbd = t->data.ptr;
2522 /* The following few lines duplicate some of the code below. */
8f240103 2523 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2524 store_pool = old_pool;
2525 sender_rate = string_sprintf("%.1f", dbd->rate);
2526 HDEBUG(D_acl)
2527 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2528 return rc;
2529 }
2530
c99ce5c9
TF		 2531/* We aren't using a pre-computed rate, so get a previously recorded rate
2532from the database, which will be updated and written back if required. */
870f6ba8
TF		 2533
2534dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2535if (dbm == NULL)
2536 {
2537 store_pool = old_pool;
2538 sender_rate = NULL;
2539 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2540 *log_msgptr = US"ratelimit database not available";
2541 return DEFER;
2542 }
c99ce5c9
TF		 2543dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2544dbd = NULL;
870f6ba8
TF		 2545
2546gettimeofday(&tv, NULL);
2547
c99ce5c9
TF		 2548if (dbdb != NULL)
2549 {
2550 /* Locate the basic ratelimit block inside the DB data. */
2551 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2552 dbd = &dbdb->dbd;
2553
2554 /* Forget the old Bloom filter if it is too old, so that we count each
2555 repeating event once per period. We don't simply clear and re-use the old
2556 filter because we want its size to change if the limit changes. Note that
2557 we keep the dbd pointer for copying the rate into the new data block. */
2558
2559 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2560 {
2561 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2562 dbdb = NULL;
2563 }
2564
2565 /* Sanity check. */
2566
2567 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2568 {
2569 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2570 dbdb = NULL;
2571 }
2572 }
2573
2574/* Allocate a new data block if the database lookup failed
2575or the Bloom filter passed its age limit. */
2576
2577if (dbdb == NULL)
2578 {
2579 if (unique == NULL)
2580 {
2581 /* No Bloom filter. This basic ratelimit block is initialized below. */
2582 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2583 dbdb_size = sizeof(*dbd);
2584 dbdb = store_get(dbdb_size);
2585 }
2586 else
2587 {
2588 int extra;
2589 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2590
2591 /* See the long comment below for an explanation of the magic number 2.
2592 The filter has a minimum size in case the rate limit is very small;
2593 this is determined by the definition of dbdata_ratelimit_unique. */
2594
2595 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2596 if (extra < 0) extra = 0;
2597 dbdb_size = sizeof(*dbdb) + extra;
2598 dbdb = store_get(dbdb_size);
2599 dbdb->bloom_epoch = tv.tv_sec;
2600 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2601 memset(dbdb->bloom, 0, dbdb->bloom_size);
2602
2603 /* Preserve any basic ratelimit data (which is our longer-term memory)
2604 by copying it from the discarded block. */
2605
2606 if (dbd != NULL)
2607 {
2608 dbdb->dbd = *dbd;
2609 dbd = &dbdb->dbd;
2610 }
2611 }
2612 }
2613
2614/* If we are counting unique events, find out if this event is new or not.
2615If the client repeats the event during the current period then it should be
2616counted. We skip this code in readonly mode for efficiency, because any
2617changes to the filter will be discarded and because count is already set to
2618zero. */
2619
2620if (unique != NULL && !readonly)
2621 {
2622 /* We identify unique events using a Bloom filter. (You can find my
2623 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2624 With the per_addr option, an "event" is a recipient address, though the
2625 user can use the unique option to define their own events. We only count
2626 an event if we have not seen it before.
2627
2628 We size the filter according to the rate limit, which (in leaky mode)
2629 is the limit on the population of the filter. We allow 16 bits of space
2630 per entry (see the construction code above) and we set (up to) 8 of them
2631 when inserting an element (see the loop below). The probability of a false
2632 positive (an event we have not seen before but which we fail to count) is
2633
2634 size = limit * 16
2635 numhash = 8
2636 allzero = exp(-numhash * pop / size)
2637 = exp(-0.5 * pop / limit)
2638 fpr = pow(1 - allzero, numhash)
2639
2640 For senders at the limit the fpr is 0.06% or 1 in 1700
2641 and for senders at half the limit it is 0.0006% or 1 in 170000
2642
2643 In strict mode the Bloom filter can fill up beyond the normal limit, in
2644 which case the false positive rate will rise. This means that the
2645 measured rate for very fast senders can bogusly drop off after a while.
2646
2647 At twice the limit, the fpr is 2.5% or 1 in 40
2648 At four times the limit, it is 31% or 1 in 3.2
2649
2650 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2651 decay below the limit, and if this is more than one then the Bloom filter
2652 will be discarded before the decay gets that far. The false positive rate
2653 at this threshold is 9.3% or 1 in 10.7. */
2654
2655 BOOL seen;
2656 unsigned n, hash, hinc;
2657 uschar md5sum[16];
2658 md5 md5info;
2659
2660 /* Instead of using eight independent hash values, we combine two values
2661 using the formula h1 + n * h2. This does not harm the Bloom filter's
2662 performance, and means the amount of hash we need is independent of the
2663 number of bits we set in the filter. */
2664
2665 md5_start(&md5info);
2666 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2667 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2668 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2669
2670 /* Scan the bits corresponding to this event. A zero bit means we have
2671 not seen it before. Ensure all bits are set to record this event. */
2672
2673 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2674
2675 seen = TRUE;
2676 for (n = 0; n < 8; n++, hash += hinc)
2677 {
2678 int bit = 1 << (hash % 8);
2679 int byte = (hash / 8) % dbdb->bloom_size;
2680 if ((dbdb->bloom[byte] & bit) == 0)
2681 {
2682 dbdb->bloom[byte] |= bit;
2683 seen = FALSE;
2684 }
2685 }
2686
2687 /* If this event has occurred before, do not count it. */
2688
2689 if (seen)
2690 {
2691 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2692 count = 0.0;
2693 }
2694 else
2695 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2696 }
2697
2698/* If there was no previous ratelimit data block for this key, initialize
2699the new one, otherwise update the block from the database. The initial rate
2700is what would be computed by the code below for an infinite interval. */
2701
870f6ba8
TF		 2702if (dbd == NULL)
2703 {
c99ce5c9
TF		 2704 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2705 dbd = &dbdb->dbd;
870f6ba8
TF		 2706 dbd->time_stamp = tv.tv_sec;
2707 dbd->time_usec = tv.tv_usec;
c99ce5c9 2708 dbd->rate = count;
870f6ba8
TF		 2709 }
2710else
2711 {
2712 /* The smoothed rate is computed using an exponentially weighted moving
2713 average adjusted for variable sampling intervals. The standard EWMA for
2714 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2715 where f() is the measured value and f'() is the smoothed value.
2716
2717 Old data decays out of the smoothed value exponentially, such that data n
2718 samples old is multiplied by a^n. The exponential decay time constant p
2719 is defined such that data p samples old is multiplied by 1/e, which means
2720 that a = exp(-1/p). We can maintain the same time constant for a variable
2721 sampling interval i by using a = exp(-i/p).
2722
2723 The rate we are measuring is messages per period, suitable for directly
2724 comparing with the limit. The average rate between now and the previous
2725 message is period / interval, which we feed into the EWMA as the sample.
2726
2727 It turns out that the number of messages required for the smoothed rate
2728 to reach the limit when they are sent in a burst is equal to the limit.
2729 This can be seen by analysing the value of the smoothed rate after N
2730 messages sent at even intervals. Let k = (1 - a) * p/i
2731
2732 rate_1 = (1 - a) * p/i + a * rate_0
2733 = k + a * rate_0
2734 rate_2 = k + a * rate_1
2735 = k + a * k + a^2 * rate_0
2736 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2737 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2738 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2739 = rate_0 * a^N + p/i * (1 - a^N)
2740
2741 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2742
2743 rate_N = p/i + (rate_0 - p/i) * a^N
2744 a^N = (rate_N - p/i) / (rate_0 - p/i)
2745 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2746 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2747
2748 Numerical analysis of the above equation, setting the computed rate to
2749 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2750 rates, p/i, the number of messages N = limit. So limit serves as both the
2751 maximum rate measured in messages per period, and the maximum number of
2752 messages that can be sent in a fast burst. */
2753
2754 double this_time = (double)tv.tv_sec
2755 + (double)tv.tv_usec / 1000000.0;
2756 double prev_time = (double)dbd->time_stamp
2757 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2758
2759 /* We must avoid division by zero, and deal gracefully with the clock going
2760 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2761 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2762
e5d5a95f
TF		 2763 double interval = this_time - prev_time <= 0.0 ? 1e-9
2764 : this_time - prev_time;
2765
2766 double i_over_p = interval / period;
2767 double a = exp(-i_over_p);
870f6ba8 2768
c99ce5c9
TF		 2769 /* Combine the instantaneous rate (period / interval) with the previous rate
2770 using the smoothing factor a. In order to measure sized events, multiply the
2771 instantaneous rate by the count of bytes or recipients etc. */
2772
870f6ba8
TF		 2773 dbd->time_stamp = tv.tv_sec;
2774 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2775 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2776
2777 /* When events are very widely spaced the computed rate tends towards zero.
2778 Although this is accurate it turns out not to be useful for our purposes,
2779 especially when the first event after a long silence is the start of a spam
2780 run. A more useful model is that the rate for an isolated event should be the
2781 size of the event per the period size, ignoring the lack of events outside
2782 the current period and regardless of where the event falls in the period. So,
2783 if the interval was so long that the calculated rate is unhelpfully small, we
2784 re-intialize the rate. In the absence of higher-rate bursts, the condition
2785 below is true if the interval is greater than the period. */
2786
2787 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2788 }
2789
c99ce5c9
TF		 2790/* Clients sending at the limit are considered to be over the limit.
2791This matters for edge cases such as a limit of zero, when the client
2792should be completely blocked. */
3348576f 2793
8f240103 2794rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2795
2796/* Update the state if the rate is low or if we are being strict. If we
2797are in leaky mode and the sender's rate is too high, we do not update
2798the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2799rate preventing them from getting any email through. If readonly is set,
2800neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2801
c99ce5c9 2802if ((rc == FAIL && leaky) || strict)
8f240103 2803 {
c99ce5c9 2804 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2805 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2806 }
2807else
2808 {
2809 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2810 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2811 }
2812
870f6ba8
TF		 2813dbfn_close(dbm);
2814
c99ce5c9 2815/* Store the result in the tree for future reference. */
870f6ba8 2816
c99ce5c9
TF		 2817t = store_get(sizeof(tree_node) + Ustrlen(key));
2818t->data.ptr = dbd;
2819Ustrcpy(t->name, key);
2820(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2821
2822/* We create the formatted version of the sender's rate very late in
2823order to ensure that it is done using the correct storage pool. */
2824
2825store_pool = old_pool;
2826sender_rate = string_sprintf("%.1f", dbd->rate);
2827
2828HDEBUG(D_acl)
2829 debug_printf("ratelimit computed rate %s\n", sender_rate);
2830
2831return rc;
2832}
2833
2834
2835
b0019c78
TF		 2836/*************************************************
2837* The udpsend ACL modifier *
2838*************************************************/
2839
2840/* Called by acl_check_condition() below.
2841
2842Arguments:
2843 arg the option string for udpsend=
2844 log_msgptr for error messages
2845
2846Returns: OK - Completed.
2847 DEFER - Problem with DNS lookup.
2848 ERROR - Syntax error in options.
2849*/
2850
2851static int
2852acl_udpsend(uschar *arg, uschar **log_msgptr)
2853{
2854int sep = 0;
2855uschar *hostname;
2856uschar *portstr;
2857uschar *portend;
2858host_item *h;
2859int portnum;
b0019c78
TF		 2860int len;
2861int r, s;
b1f8e4f8 2862uschar * errstr;
b0019c78
TF		 2863
2864hostname = string_nextinlist(&arg, &sep, NULL, 0);
2865portstr = string_nextinlist(&arg, &sep, NULL, 0);
2866
2867if (hostname == NULL)
2868 {
217b0e56 2869 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2870 return ERROR;
2871 }
2872if (portstr == NULL)
2873 {
217b0e56 2874 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2875 return ERROR;
2876 }
2877if (arg == NULL)
2878 {
217b0e56 2879 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2880 return ERROR;
2881 }
2882portnum = Ustrtol(portstr, &portend, 10);
2883if (*portend != '\0')
2884 {
217b0e56 2885 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2886 return ERROR;
2887 }
2888
2889/* Make a single-item host list. */
2890h = store_get(sizeof(host_item));
2891memset(h, 0, sizeof(host_item));
2892h->name = hostname;
2893h->port = portnum;
2894h->mx = MX_NONE;
2895
2896if (string_is_ip_address(hostname, NULL))
2897 h->address = hostname, r = HOST_FOUND;
2898else
2899 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2900if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2901 {
217b0e56 2902 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2903 return DEFER;
2904 }
2905
2906HDEBUG(D_acl)
2907 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2908
b1f8e4f8
JH		 2909r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2910 1, NULL, &errstr);
b0019c78 2911if (r < 0) goto defer;
27f9999e 2912len = Ustrlen(arg);
9cb1785a 2913r = send(s, arg, len, 0);
b1f8e4f8
JH		 2914if (r < 0)
2915 {
2916 errstr = US strerror(errno);
2917 close(s);
2918 goto defer;
2919 }
2920close(s);
b0019c78
TF		 2921if (r < len)
2922 {
2923 *log_msgptr =
2924 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2925 return DEFER;
2926 }
2927
2928HDEBUG(D_acl)
2929 debug_printf("udpsend %d bytes\n", r);
2930
2931return OK;
2932
2933defer:
b1f8e4f8 2934*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2935return DEFER;
2936}
2937
2938
2939
059ec3d9
PH		 2940/*************************************************
2941* Handle conditions/modifiers on an ACL item *
2942*************************************************/
2943
2944/* Called from acl_check() below.
2945
2946Arguments:
2947 verb ACL verb
2948 cb ACL condition block - if NULL, result is OK
2949 where where called from
2950 addr the address being checked for RCPT, or NULL
2951 level the nesting level
2952 epp pointer to pass back TRUE if "endpass" encountered
2953 (applies only to "accept" and "discard")
2954 user_msgptr user message pointer
2955 log_msgptr log message pointer
2956 basic_errno pointer to where to put verify error
2957
2958Returns: OK - all conditions are met
2959 DISCARD - an "acl" condition returned DISCARD - only allowed
2960 for "accept" or "discard" verbs
2961 FAIL - at least one condition fails
2962 FAIL_DROP - an "acl" condition returned FAIL_DROP
2963 DEFER - can't tell at the moment (typically, lookup defer,
2964 but can be temporary callout problem)
2965 ERROR - ERROR from nested ACL or expansion failure or other
2966 error
2967*/
2968
2969static int
2970acl_check_condition(int verb, acl_condition_block *cb, int where,
2971 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2972 uschar **log_msgptr, int *basic_errno)
2973{
2974uschar *user_message = NULL;
2975uschar *log_message = NULL;
ed7f7860
PP		 2976uschar *debug_tag = NULL;
2977uschar *debug_opts = NULL;
91ecef39 2978uschar *p = NULL;
059ec3d9 2979int rc = OK;
8523533c
TK		 2980#ifdef WITH_CONTENT_SCAN
2981int sep = '/';
2982#endif
059ec3d9
PH		 2983
2984for (; cb != NULL; cb = cb->next)
2985 {
2986 uschar *arg;
8e669ac1 2987 int control_type;
059ec3d9
PH		 2988
2989 /* The message and log_message items set up messages to be used in
2990 case of rejection. They are expanded later. */
2991
2992 if (cb->type == ACLC_MESSAGE)
2993 {
2994 user_message = cb->arg;
2995 continue;
2996 }
2997
2998 if (cb->type == ACLC_LOG_MESSAGE)
2999 {
3000 log_message = cb->arg;
3001 continue;
3002 }
3003
3004 /* The endpass "condition" just sets a flag to show it occurred. This is
3005 checked at compile time to be on an "accept" or "discard" item. */
3006
3007 if (cb->type == ACLC_ENDPASS)
3008 {
3009 *epp = TRUE;
3010 continue;
3011 }
3012
3013 /* For other conditions and modifiers, the argument is expanded now for some
3014 of them, but not for all, because expansion happens down in some lower level
3015 checking functions in some cases. */
3016
3017 if (cond_expand_at_top[cb->type])
3018 {
3019 arg = expand_string(cb->arg);
3020 if (arg == NULL)
3021 {
3022 if (expand_string_forcedfail) continue;
3023 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3024 cb->arg, expand_string_message);
3025 return search_find_defer? DEFER : ERROR;
3026 }
3027 }
3028 else arg = cb->arg;
3029
3030 /* Show condition, and expanded condition if it's different */
3031
3032 HDEBUG(D_acl)
3033 {
3034 int lhswidth = 0;
3035 debug_printf("check %s%s %n",
3036 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3037 conditions[cb->type], &lhswidth);
3038
3039 if (cb->type == ACLC_SET)
3040 {
38a0a95f
PH		 3041 debug_printf("acl_%s ", cb->u.varname);
3042 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3043 }
3044
3045 debug_printf("= %s\n", cb->arg);
3046
3047 if (arg != cb->arg)
3048 debug_printf("%.*s= %s\n", lhswidth,
3049 US" ", CS arg);
3050 }
3051
3052 /* Check that this condition makes sense at this time */
3053
3054 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3055 {
3056 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3057 cond_modifiers[cb->type]? "use" : "test",
3058 conditions[cb->type], acl_wherenames[where]);
3059 return ERROR;
3060 }
3061
3062 /* Run the appropriate test for each condition, or take the appropriate
3063 action for the remaining modifiers. */
3064
3065 switch(cb->type)
3066 {
71fafd95
PH		 3067 case ACLC_ADD_HEADER:
3068 setup_header(arg);
3069 break;
3070
059ec3d9
PH		 3071 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3072 "discard" verb. */
71fafd95 3073
059ec3d9 3074 case ACLC_ACL:
f60d98e8 3075 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3076 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3077 {
3078 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3079 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3080 verbs[verb]);
3081 return ERROR;
3082 }
059ec3d9
PH		 3083 break;
3084
3085 case ACLC_AUTHENTICATED:
3086 rc = (sender_host_authenticated == NULL)? FAIL :
3087 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3088 TRUE, NULL);
3089 break;
3090
71fafd95 3091 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3092 case ACLC_BMI_OPTIN:
3093 {
3094 int old_pool = store_pool;
3095 store_pool = POOL_PERM;
3096 bmi_current_optin = string_copy(arg);
3097 store_pool = old_pool;
3098 }
3099 break;
71fafd95 3100 #endif
8523533c 3101
059ec3d9 3102 case ACLC_CONDITION:
f3766eb5
NM		 3103 /* The true/false parsing here should be kept in sync with that used in
3104 expand.c when dealing with ECOND_BOOL so that we don't have too many
3105 different definitions of what can be a boolean. */
51c7471d
JH		 3106 if (*arg == '-'
3107 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3108 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3109 rc = (Uatoi(arg) == 0)? FAIL : OK;
3110 else
3111 rc = (strcmpic(arg, US"no") == 0 ||
3112 strcmpic(arg, US"false") == 0)? FAIL :
3113 (strcmpic(arg, US"yes") == 0 ||
3114 strcmpic(arg, US"true") == 0)? OK : DEFER;
3115 if (rc == DEFER)
3116 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3117 break;
3118
c3611384
PH		 3119 case ACLC_CONTINUE: /* Always succeeds */
3120 break;
3121
059ec3d9 3122 case ACLC_CONTROL:
c5fcb476
PH		 3123 control_type = decode_control(arg, &p, where, log_msgptr);
3124
8523533c 3125 /* Check if this control makes sense at this time */
c5fcb476
PH		 3126
3127 if ((control_forbids[control_type] & (1 << where)) != 0)
3128 {
3129 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3130 controls[control_type], acl_wherenames[where]);
3131 return ERROR;
8e669ac1 3132 }
c5fcb476
PH		 3133
3134 switch(control_type)
059ec3d9 3135 {
c46782ef
PH		 3136 case CONTROL_AUTH_UNADVERTISED:
3137 allow_auth_unadvertised = TRUE;
3138 break;
3139
3140 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3141 case CONTROL_BMI_RUN:
3142 bmi_run = 1;
3143 break;
c46782ef
PH		 3144 #endif
3145
80a47a2c 3146 #ifndef DISABLE_DKIM
f7572e5a 3147 case CONTROL_DKIM_VERIFY:
80a47a2c 3148 dkim_disable_verify = TRUE;
4840604e
TL		 3149 #ifdef EXPERIMENTAL_DMARC
3150 /* Since DKIM was blocked, skip DMARC too */
3151 dmarc_disable_verify = TRUE;
3152 dmarc_enable_forensic = FALSE;
3153 #endif
3154 break;
3155 #endif
3156
3157 #ifdef EXPERIMENTAL_DMARC
3158 case CONTROL_DMARC_VERIFY:
3159 dmarc_disable_verify = TRUE;
3160 break;
3161
3162 case CONTROL_DMARC_FORENSIC:
3163 dmarc_enable_forensic = TRUE;
f7572e5a
TK		 3164 break;
3165 #endif
3166
13363eba
PP		 3167 case CONTROL_DSCP:
3168 if (*p == '/')
3169 {
3170 int fd, af, level, optname, value;
3171 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3172 a socket; we can accept that, we'll just debug-log failures anyway. */
3173 fd = fileno(smtp_in);
3174 af = ip_get_address_family(fd);
3175 if (af < 0)
3176 {
3177 HDEBUG(D_acl)
3178 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3179 strerror(errno));
3180 break;
3181 }
3182 if (dscp_lookup(p+1, af, &level, &optname, &value))
3183 {
3184 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3185 {
3186 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3187 p+1, strerror(errno));
3188 }
3189 else
3190 {
3191 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3192 }
3193 }
3194 else
3195 {
3196 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3197 return ERROR;
3198 }
3199 }
3200 else
3201 {
3202 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3203 return ERROR;
3204 }
3205 break;
3206
059ec3d9
PH		 3207 case CONTROL_ERROR:
3208 return ERROR;
3209
3210 case CONTROL_CASEFUL_LOCAL_PART:
3211 deliver_localpart = addr->cc_local_part;
3212 break;
3213
3214 case CONTROL_CASELOWER_LOCAL_PART:
3215 deliver_localpart = addr->lc_local_part;
3216 break;
3217
3218 case CONTROL_ENFORCE_SYNC:
3219 smtp_enforce_sync = TRUE;
3220 break;
3221
3222 case CONTROL_NO_ENFORCE_SYNC:
3223 smtp_enforce_sync = FALSE;
3224 break;
3225
c46782ef 3226 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3227 case CONTROL_NO_MBOX_UNSPOOL:
3228 no_mbox_unspool = TRUE;
3229 break;
c46782ef 3230 #endif
8523533c 3231
059ec3d9
PH		 3232 case CONTROL_NO_MULTILINE:
3233 no_multiline_responses = TRUE;
3234 break;
3235
cf8b11a5
PH		 3236 case CONTROL_NO_PIPELINING:
3237 pipelining_enable = FALSE;
3238 break;
3239
047bdd8c
PH		 3240 case CONTROL_NO_DELAY_FLUSH:
3241 disable_delay_flush = TRUE;
3242 break;
3243
4c590bd1
PH		 3244 case CONTROL_NO_CALLOUT_FLUSH:
3245 disable_callout_flush = TRUE;
3246 break;
3247
29aba418 3248 case CONTROL_FAKEDEFER:
8523533c 3249 case CONTROL_FAKEREJECT:
29aba418 3250 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 3251 if (*p == '/')
8e669ac1 3252 {
8523533c 3253 uschar *pp = p + 1;
8e669ac1 3254 while (*pp != 0) pp++;
29aba418 3255 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK		 3256 p = pp;
3257 }
3258 else
3259 {
3260 /* Explicitly reset to default string */
29aba418 3261 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK		 3262 }
3263 break;
8523533c 3264
059ec3d9
PH		 3265 case CONTROL_FREEZE:
3266 deliver_freeze = TRUE;
3267 deliver_frozen_at = time(NULL);
6a3f1455
PH		 3268 freeze_tell = freeze_tell_config; /* Reset to configured value */
3269 if (Ustrncmp(p, "/no_tell", 8) == 0)
3270 {
3271 p += 8;
3272 freeze_tell = NULL;
3273 }
3274 if (*p != 0)
3275 {
3276 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3277 return ERROR;
3278 }
059ec3d9
PH		 3279 break;
3280
3281 case CONTROL_QUEUE_ONLY:
3282 queue_only_policy = TRUE;
3283 break;
3284
3285 case CONTROL_SUBMISSION:
87ba3f5f 3286 originator_name = US"";
059ec3d9 3287 submission_mode = TRUE;
69358f02 3288 while (*p == '/')
8e669ac1 3289 {
69358f02
PH		 3290 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3291 {
3292 p += 14;
3293 active_local_sender_retain = TRUE;
8e669ac1
PH		 3294 active_local_from_check = FALSE;
3295 }
69358f02
PH		 3296 else if (Ustrncmp(p, "/domain=", 8) == 0)
3297 {
3298 uschar *pp = p + 8;
8e669ac1 3299 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH		 3300 submission_domain = string_copyn(p+8, pp-p-8);
3301 p = pp;
3302 }
8857ccfd
PH		 3303 /* The name= option must be last, because it swallows the rest of
3304 the string. */
87ba3f5f
PH		 3305 else if (Ustrncmp(p, "/name=", 6) == 0)
3306 {
3307 uschar *pp = p + 6;
8857ccfd 3308 while (*pp != 0) pp++;
2fe1a124 3309 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 3310 big_buffer, big_buffer_size));
8e669ac1 3311 p = pp;
69358f02 3312 }
8e669ac1
PH		 3313 else break;
3314 }
69358f02 3315 if (*p != 0)
059ec3d9 3316 {
69358f02 3317 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH		 3318 return ERROR;
3319 }
3320 break;
8800895a 3321
ed7f7860
PP		 3322 case CONTROL_DEBUG:
3323 while (*p == '/')
3324 {
3325 if (Ustrncmp(p, "/tag=", 5) == 0)
3326 {
3327 uschar *pp = p + 5;
3328 while (*pp != '\0' && *pp != '/') pp++;
3329 debug_tag = string_copyn(p+5, pp-p-5);
3330 p = pp;
3331 }
3332 else if (Ustrncmp(p, "/opts=", 6) == 0)
3333 {
3334 uschar *pp = p + 6;
3335 while (*pp != '\0' && *pp != '/') pp++;
3336 debug_opts = string_copyn(p+6, pp-p-6);
3337 p = pp;
3338 }
3339 }
3340 debug_logging_activate(debug_tag, debug_opts);
3341 break;
3342
8800895a
PH		 3343 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3344 suppress_local_fixups = TRUE;
3345 break;
e4bdf652
JH		 3346
3347 case CONTROL_CUTTHROUGH_DELIVERY:
3348 if (deliver_freeze)
3349 {
3350 *log_msgptr = string_sprintf("\"control=%s\" on frozen item", arg);
3351 return ERROR;
3352 }
3353 if (queue_only_policy)
3354 {
3355 *log_msgptr = string_sprintf("\"control=%s\" on queue-only item", arg);
3356 return ERROR;
3357 }
3358 cutthrough_delivery = TRUE;
3359 break;
059ec3d9
PH		 3360 }
3361 break;
3362
6a8f9482
TK		 3363 #ifdef EXPERIMENTAL_DCC
3364 case ACLC_DCC:
3365 {
3366 /* Seperate the regular expression and any optional parameters. */
3367 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3368 /* Run the dcc backend. */
3369 rc = dcc_process(&ss);
3370 /* Modify return code based upon the existance of options. */
3371 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3372 != NULL) {
3373 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3374 {
3375 /* FAIL so that the message is passed to the next ACL */
3376 rc = FAIL;
3377 }
3378 }
3379 }
3380 break;
3381 #endif
3382
71fafd95 3383 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3384 case ACLC_DECODE:
3385 rc = mime_decode(&arg);
3386 break;
71fafd95 3387 #endif
8523533c 3388
059ec3d9
PH		 3389 case ACLC_DELAY:
3390 {
3391 int delay = readconf_readtime(arg, 0, FALSE);
3392 if (delay < 0)
3393 {
3394 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3395 "modifier: \"%s\" is not a time value", arg);
3396 return ERROR;
3397 }
3398 else
3399 {
3400 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3401 delay);
3402 if (host_checking)
3403 {
3404 HDEBUG(D_acl)
3405 debug_printf("delay skipped in -bh checking mode\n");
3406 }
010c2d14
PH		 3407
3408 /* It appears to be impossible to detect that a TCP/IP connection has
3409 gone away without reading from it. This means that we cannot shorten
3410 the delay below if the client goes away, because we cannot discover
3411 that the client has closed its end of the connection. (The connection
3412 is actually in a half-closed state, waiting for the server to close its
3413 end.) It would be nice to be able to detect this state, so that the
3414 Exim process is not held up unnecessarily. However, it seems that we
3415 can't. The poll() function does not do the right thing, and in any case
3416 it is not always available.
3417
047bdd8c 3418 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3419 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3420 Also, delays may be specified for non-SMTP input, where smtp_out and
3421 smtp_in will be NULL. Whatever is done must work in all cases.
3422
3423 NOTE 2: The added feature of flushing the output before a delay must
3424 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3425 */
010c2d14 3426
8e669ac1 3427 else
86b8287f 3428 {
14f4a80d 3429 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3430 while (delay > 0) delay = sleep(delay);
8e669ac1 3431 }
059ec3d9
PH		 3432 }
3433 }
3434 break;
3435
71fafd95 3436 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3437 case ACLC_DEMIME:
3438 rc = demime(&arg);
3439 break;
71fafd95 3440 #endif
8523533c 3441
80a47a2c
TK		 3442 #ifndef DISABLE_DKIM
3443 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3444 if (dkim_cur_signer != NULL)
3445 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3446 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3447 else
80a47a2c 3448 rc = FAIL;
71fafd95
PH		 3449 break;
3450
80a47a2c
TK		 3451 case ACLC_DKIM_STATUS:
3452 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3453 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3454 break;
3455 #endif
fb2274d4 3456
4840604e
TL		 3457 #ifdef EXPERIMENTAL_DMARC
3458 case ACLC_DMARC_STATUS:
4a8ce2d8 3459 if (!dmarc_has_been_checked)
4840604e 3460 dmarc_process();
4a8ce2d8 3461 dmarc_has_been_checked = TRUE;
4840604e
TL		 3462 /* used long way of dmarc_exim_expand_query() in case we need more
3463 * view into the process in the future. */
3464 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3465 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3466 break;
3467 #endif
3468
059ec3d9
PH		 3469 case ACLC_DNSLISTS:
3470 rc = verify_check_dnsbl(&arg);
3471 break;
3472
3473 case ACLC_DOMAINS:
3474 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3475 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
3476 break;
3477
3478 /* The value in tls_cipher is the full cipher name, for example,
3479 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3480 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3481 what may in practice come out of the SSL library - which at the time of
3482 writing is poorly documented. */
3483
3484 case ACLC_ENCRYPTED:
817d9f57 3485 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3486 {
3487 uschar *endcipher = NULL;
817d9f57
JH		 3488 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3489 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3490 {
3491 endcipher = Ustrchr(++cipher, ':');
3492 if (endcipher != NULL) *endcipher = 0;
3493 }
3494 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3495 if (endcipher != NULL) *endcipher = ':';
3496 }
3497 break;
3498
3499 /* Use verify_check_this_host() instead of verify_check_host() so that
3500 we can pass over &host_data to catch any looked up data. Once it has been
3501 set, it retains its value so that it's still there if another ACL verb
3502 comes through here and uses the cache. However, we must put it into
3503 permanent store in case it is also expected to be used in a subsequent
3504 message in the same SMTP connection. */
3505
3506 case ACLC_HOSTS:
3507 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3508 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
3509 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3510 break;
3511
3512 case ACLC_LOCAL_PARTS:
3513 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3514 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3515 &deliver_localpart_data);
3516 break;
3517
6ea85e9a
PH		 3518 case ACLC_LOG_REJECT_TARGET:
3519 {
3520 int logbits = 0;
3521 int sep = 0;
3522 uschar *s = arg;
3523 uschar *ss;
3524 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3525 != NULL)
3526 {
3527 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3528 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3529 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3530 else
3531 {
3532 logbits |= LOG_MAIN|LOG_REJECT;
3533 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3534 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3535 }
3536 }
3537 log_reject_target = logbits;
3538 }
3539 break;
3540
059ec3d9
PH		 3541 case ACLC_LOGWRITE:
3542 {
3543 int logbits = 0;
3544 uschar *s = arg;
3545 if (*s == ':')
3546 {
3547 s++;
3548 while (*s != ':')
3549 {
3550 if (Ustrncmp(s, "main", 4) == 0)
3551 { logbits |= LOG_MAIN; s += 4; }
3552 else if (Ustrncmp(s, "panic", 5) == 0)
3553 { logbits |= LOG_PANIC; s += 5; }
3554 else if (Ustrncmp(s, "reject", 6) == 0)
3555 { logbits |= LOG_REJECT; s += 6; }
3556 else
3557 {
3558 logbits = LOG_MAIN|LOG_PANIC;
3559 s = string_sprintf(":unknown log name in \"%s\" in "
3560 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3561 }
3562 if (*s == ',') s++;
3563 }
3564 s++;
3565 }
3566 while (isspace(*s)) s++;
6ea85e9a
PH		 3567
3568
059ec3d9
PH		 3569 if (logbits == 0) logbits = LOG_MAIN;
3570 log_write(0, logbits, "%s", string_printing(s));
3571 }
3572 break;
8e669ac1 3573
71fafd95 3574 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3575 case ACLC_MALWARE:
3576 {
6ea85e9a 3577 /* Separate the regular expression and any optional parameters. */
8523533c
TK		 3578 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3579 /* Run the malware backend. */
3580 rc = malware(&ss);
3581 /* Modify return code based upon the existance of options. */
3582 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3583 != NULL) {
3584 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3585 {
3586 /* FAIL so that the message is passed to the next ACL */
3587 rc = FAIL;
3588 }
3589 }
3590 }
3591 break;
3592
3593 case ACLC_MIME_REGEX:
71fafd95 3594 rc = mime_regex(&arg);
8523533c 3595 break;
71fafd95 3596 #endif
059ec3d9 3597
870f6ba8 3598 case ACLC_RATELIMIT:
90fc3069 3599 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3600 break;
3601
059ec3d9
PH		 3602 case ACLC_RECIPIENTS:
3603 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3604 &recipient_data);
3605 break;
3606
71fafd95
PH		 3607 #ifdef WITH_CONTENT_SCAN
3608 case ACLC_REGEX:
3609 rc = regex(&arg);
8523533c 3610 break;
71fafd95 3611 #endif
8523533c 3612
e7568d51
TL		 3613 case ACLC_REMOVE_HEADER:
3614 setup_remove_header(arg);
3615 break;
3616
059ec3d9
PH		 3617 case ACLC_SENDER_DOMAINS:
3618 {
3619 uschar *sdomain;
3620 sdomain = Ustrrchr(sender_address, '@');
3621 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3622 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3623 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3624 }
3625 break;
3626
3627 case ACLC_SENDERS:
3628 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
3629 sender_address_cache, -1, 0, &sender_data);
3630 break;
3631
3632 /* Connection variables must persist forever */
3633
3634 case ACLC_SET:
3635 {
3636 int old_pool = store_pool;
38a0a95f
PH		 3637 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3638 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3639 store_pool = old_pool;
3640 }
3641 break;
3642
71fafd95 3643 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3644 case ACLC_SPAM:
3645 {
3646 /* Seperate the regular expression and any optional parameters. */
3647 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3648 /* Run the spam backend. */
3649 rc = spam(&ss);
3650 /* Modify return code based upon the existance of options. */
3651 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3652 != NULL) {
3653 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3654 {
3655 /* FAIL so that the message is passed to the next ACL */
3656 rc = FAIL;
3657 }
3658 }
3659 }
3660 break;
71fafd95 3661 #endif
8523533c 3662
71fafd95 3663 #ifdef EXPERIMENTAL_SPF
8523533c 3664 case ACLC_SPF:
65a7d8c3
NM		 3665 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3666 break;
3667 case ACLC_SPF_GUESS:
3668 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3669 break;
71fafd95 3670 #endif
8523533c 3671
b0019c78
TF		 3672 case ACLC_UDPSEND:
3673 rc = acl_udpsend(arg, log_msgptr);
3674 break;
3675
059ec3d9
PH		 3676 /* If the verb is WARN, discard any user message from verification, because
3677 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3678 only from explicit "message" modifiers. However, put the user message into
3679 $acl_verify_message so it can be used in subsequent conditions or modifiers
3680 (until something changes it). */
059ec3d9
PH		 3681
3682 case ACLC_VERIFY:
3683 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3684 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3685 if (verb == ACL_WARN) *user_msgptr = NULL;
3686 break;
3687
3688 default:
3689 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3690 "condition %d", cb->type);
3691 break;
3692 }
3693
3694 /* If a condition was negated, invert OK/FAIL. */
3695
3696 if (!cond_modifiers[cb->type] && cb->u.negated)
3697 {
3698 if (rc == OK) rc = FAIL;
3699 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3700 }
3701
3702 if (rc != OK) break; /* Conditions loop */
3703 }
3704
3705
3706/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3707handle the values of these modifiers. If there isn't a log message set, we make
3708it the same as the user message.
059ec3d9
PH		 3709
3710"message" is a user message that will be included in an SMTP response. Unless
3711it is empty, it overrides any previously set user message.
3712
3713"log_message" is a non-user message, and it adds to any existing non-user
3714message that is already set.
3715
4e88a19f
PH		 3716Most verbs have but a single return for which the messages are relevant, but
3717for "discard", it's useful to have the log message both when it succeeds and
3718when it fails. For "accept", the message is used in the OK case if there is no
3719"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3720present. */
059ec3d9 3721
4e88a19f
PH		 3722if (*epp && rc == OK) user_message = NULL;
3723
3724if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3725 {
3726 uschar *expmessage;
4e88a19f
PH		 3727 uschar *old_user_msgptr = *user_msgptr;
3728 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3729
3730 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3731 nested ACLs) are always discarded. This also happens for acceptance verbs
3732 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3733 However, the value of an existing message is available in $acl_verify_message
3734 during expansions. */
3735
4e88a19f
PH		 3736 if (verb == ACL_WARN ||
3737 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3738 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3739
3740 if (user_message != NULL)
3741 {
3742 acl_verify_message = old_user_msgptr;
3743 expmessage = expand_string(user_message);
3744 if (expmessage == NULL)
3745 {
3746 if (!expand_string_forcedfail)
3747 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3748 user_message, expand_string_message);
3749 }
3750 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3751 }
3752
3753 if (log_message != NULL)
3754 {
3755 acl_verify_message = old_log_msgptr;
3756 expmessage = expand_string(log_message);
3757 if (expmessage == NULL)
3758 {
3759 if (!expand_string_forcedfail)
3760 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3761 log_message, expand_string_message);
3762 }
3763 else if (expmessage[0] != 0)
3764 {
3765 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3766 string_sprintf("%s: %s", expmessage, *log_msgptr);
3767 }
3768 }
3769
3770 /* If no log message, default it to the user message */
3771
3772 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3773 }
3774
3775acl_verify_message = NULL;
3776return rc;
3777}
3778
3779
3780
3781
3782
3783/*************************************************
3784* Get line from a literal ACL *
3785*************************************************/
3786
3787/* This function is passed to acl_read() in order to extract individual lines
3788of a literal ACL, which we access via static pointers. We can destroy the
3789contents because this is called only once (the compiled ACL is remembered).
3790
3791This code is intended to treat the data in the same way as lines in the main
3792Exim configuration file. That is:
3793
3794 . Leading spaces are ignored.
3795
3796 . A \ at the end of a line is a continuation - trailing spaces after the \
3797 are permitted (this is because I don't believe in making invisible things
3798 significant). Leading spaces on the continued part of a line are ignored.
3799
3800 . Physical lines starting (significantly) with # are totally ignored, and
3801 may appear within a sequence of backslash-continued lines.
3802
3803 . Blank lines are ignored, but will end a sequence of continuations.
3804
3805Arguments: none
3806Returns: a pointer to the next line
3807*/
3808
3809
3810static uschar *acl_text; /* Current pointer in the text */
3811static uschar *acl_text_end; /* Points one past the terminating '0' */
3812
3813
3814static uschar *
3815acl_getline(void)
3816{
3817uschar *yield;
3818
3819/* This loop handles leading blank lines and comments. */
3820
3821for(;;)
3822 {
3823 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3824 if (*acl_text == 0) return NULL; /* No more data */
3825 yield = acl_text; /* Potential data line */
3826
3827 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3828
3829 /* If we hit the end before a newline, we have the whole logical line. If
3830 it's a comment, there's no more data to be given. Otherwise, yield it. */
3831
3832 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3833
3834 /* After reaching a newline, end this loop if the physical line does not
3835 start with '#'. If it does, it's a comment, and the loop continues. */
3836
3837 if (*yield != '#') break;
3838 }
3839
3840/* This loop handles continuations. We know we have some real data, ending in
3841newline. See if there is a continuation marker at the end (ignoring trailing
3842white space). We know that *yield is not white space, so no need to test for
3843cont > yield in the backwards scanning loop. */
3844
3845for(;;)
3846 {
3847 uschar *cont;
3848 for (cont = acl_text - 1; isspace(*cont); cont--);
3849
3850 /* If no continuation follows, we are done. Mark the end of the line and
3851 return it. */
3852
3853 if (*cont != '\\')
3854 {
3855 *acl_text++ = 0;
3856 return yield;
3857 }
3858
3859 /* We have encountered a continuation. Skip over whitespace at the start of
3860 the next line, and indeed the whole of the next line or lines if they are
3861 comment lines. */
3862
3863 for (;;)
3864 {
3865 while (*(++acl_text) == ' ' || *acl_text == '\t');
3866 if (*acl_text != '#') break;
3867 while (*(++acl_text) != 0 && *acl_text != '\n');
3868 }
3869
3870 /* We have the start of a continuation line. Move all the rest of the data
3871 to join onto the previous line, and then find its end. If the end is not a
3872 newline, we are done. Otherwise loop to look for another continuation. */
3873
3874 memmove(cont, acl_text, acl_text_end - acl_text);
3875 acl_text_end -= acl_text - cont;
3876 acl_text = cont;
3877 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3878 if (*acl_text == 0) return yield;
3879 }
3880
3881/* Control does not reach here */
3882}
3883
3884
3885
3886
3887
3888/*************************************************
3889* Check access using an ACL *
3890*************************************************/
3891
3892/* This function is called from address_check. It may recurse via
3893acl_check_condition() - hence the use of a level to stop looping. The ACL is
3894passed as a string which is expanded. A forced failure implies no access check
3895is required. If the result is a single word, it is taken as the name of an ACL
3896which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3897text, complete with newlines, and parsed as such. In both cases, the ACL check
3898is then run. This function uses an auxiliary function for acl_read() to call
3899for reading individual lines of a literal ACL. This is acl_getline(), which
3900appears immediately above.
3901
3902Arguments:
3903 where where called from
3904 addr address item when called from RCPT; otherwise NULL
3905 s the input string; NULL is the same as an empty ACL => DENY
3906 level the nesting level
3907 user_msgptr where to put a user error (for SMTP response)
3908 log_msgptr where to put a logging message (not for SMTP response)
3909
3910Returns: OK access is granted
3911 DISCARD access is apparently granted...
3912 FAIL access is denied
3913 FAIL_DROP access is denied; drop the connection
3914 DEFER can't tell at the moment
3915 ERROR disaster
3916*/
3917
3918static int
3919acl_check_internal(int where, address_item *addr, uschar *s, int level,
3920 uschar **user_msgptr, uschar **log_msgptr)
3921{
3922int fd = -1;
3923acl_block *acl = NULL;
3924uschar *acl_name = US"inline ACL";
3925uschar *ss;
3926
3927/* Catch configuration loops */
3928
3929if (level > 20)
3930 {
3931 *log_msgptr = US"ACL nested too deep: possible loop";
3932 return ERROR;
3933 }
3934
3935if (s == NULL)
3936 {
3937 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3938 return FAIL;
3939 }
3940
3941/* At top level, we expand the incoming string. At lower levels, it has already
3942been expanded as part of condition processing. */
3943
3944if (level == 0)
3945 {
3946 ss = expand_string(s);
3947 if (ss == NULL)
3948 {
3949 if (expand_string_forcedfail) return OK;
3950 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3951 expand_string_message);
3952 return ERROR;
3953 }
3954 }
3955else ss = s;
3956
3957while (isspace(*ss))ss++;
3958
3959/* If we can't find a named ACL, the default is to parse it as an inline one.
3960(Unless it begins with a slash; non-existent files give rise to an error.) */
3961
3962acl_text = ss;
3963
3964/* Handle the case of a string that does not contain any spaces. Look for a
3965named ACL among those read from the configuration, or a previously read file.
3966It is possible that the pointer to the ACL is NULL if the configuration
3967contains a name with no data. If not found, and the text begins with '/',
3968read an ACL from a file, and save it so it can be re-used. */
3969
3970if (Ustrchr(ss, ' ') == NULL)
3971 {
3972 tree_node *t = tree_search(acl_anchor, ss);
3973 if (t != NULL)
3974 {
3975 acl = (acl_block *)(t->data.ptr);
3976 if (acl == NULL)
3977 {
3978 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3979 return FAIL;
3980 }
3981 acl_name = string_sprintf("ACL \"%s\"", ss);
3982 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3983 }
3984
3985 else if (*ss == '/')
3986 {
3987 struct stat statbuf;
3988 fd = Uopen(ss, O_RDONLY, 0);
3989 if (fd < 0)
3990 {
3991 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3992 strerror(errno));
3993 return ERROR;
3994 }
3995
3996 if (fstat(fd, &statbuf) != 0)
3997 {
3998 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3999 strerror(errno));
4000 return ERROR;
4001 }
4002
4003 acl_text = store_get(statbuf.st_size + 1);
4004 acl_text_end = acl_text + statbuf.st_size + 1;
4005
4006 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4007 {
4008 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4009 ss, strerror(errno));
4010 return ERROR;
4011 }
4012 acl_text[statbuf.st_size] = 0;
f1e894f3 4013 (void)close(fd);
059ec3d9
PH		 4014
4015 acl_name = string_sprintf("ACL \"%s\"", ss);
4016 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4017 }
4018 }
4019
4020/* Parse an ACL that is still in text form. If it came from a file, remember it
4021in the ACL tree, having read it into the POOL_PERM store pool so that it
4022persists between multiple messages. */
4023
4024if (acl == NULL)
4025 {
4026 int old_pool = store_pool;
4027 if (fd >= 0) store_pool = POOL_PERM;
4028 acl = acl_read(acl_getline, log_msgptr);
4029 store_pool = old_pool;
4030 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4031 if (fd >= 0)
4032 {
4033 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4034 Ustrcpy(t->name, ss);
4035 t->data.ptr = acl;
4036 (void)tree_insertnode(&acl_anchor, t);
4037 }
4038 }
4039
4040/* Now we have an ACL to use. It's possible it may be NULL. */
4041
4042while (acl != NULL)
4043 {
4044 int cond;
4045 int basic_errno = 0;
4046 BOOL endpass_seen = FALSE;
4047
4048 *log_msgptr = *user_msgptr = NULL;
4049 acl_temp_details = FALSE;
4050
7353285c 4051 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
059ec3d9
PH		 4052 acl->verb != ACL_ACCEPT &&
4053 acl->verb != ACL_WARN)
4054 {
7353285c 4055 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
059ec3d9
PH		 4056 verbs[acl->verb]);
4057 return ERROR;
4058 }
4059
4060 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4061
4062 /* Clear out any search error message from a previous check before testing
4063 this condition. */
4064
4065 search_error_message = NULL;
4066 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4067 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4068
4069 /* Handle special returns: DEFER causes a return except on a WARN verb;
4070 ERROR always causes a return. */
4071
4072 switch (cond)
4073 {
4074 case DEFER:
6968512f 4075 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4076 if (basic_errno != ERRNO_CALLOUTDEFER)
4077 {
4078 if (search_error_message != NULL && *search_error_message != 0)
4079 *log_msgptr = search_error_message;
4080 if (smtp_return_error_details) acl_temp_details = TRUE;
4081 }
4082 else
4083 {
4084 acl_temp_details = TRUE;
4085 }
4086 if (acl->verb != ACL_WARN) return DEFER;
4087 break;
4088
4089 default: /* Paranoia */
4090 case ERROR:
6968512f 4091 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4092 return ERROR;
4093
4094 case OK:
6968512f
JH		 4095 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4096 verbs[acl->verb], acl_name);
059ec3d9
PH		 4097 break;
4098
4099 case FAIL:
6968512f 4100 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4101 break;
4102
4103 /* DISCARD and DROP can happen only from a nested ACL condition, and
4104 DISCARD can happen only for an "accept" or "discard" verb. */
4105
4106 case DISCARD:
6968512f
JH		 4107 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4108 verbs[acl->verb], acl_name);
059ec3d9
PH		 4109 break;
4110
4111 case FAIL_DROP:
6968512f
JH		 4112 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4113 verbs[acl->verb], acl_name);
059ec3d9
PH		 4114 break;
4115 }
4116
4117 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4118 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4119 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4120
4121 switch(acl->verb)
4122 {
4123 case ACL_ACCEPT:
4124 if (cond == OK || cond == DISCARD) return cond;
4125 if (endpass_seen)
4126 {
4127 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4128 return cond;
4129 }
4130 break;
4131
4132 case ACL_DEFER:
4133 if (cond == OK)
4134 {
4135 acl_temp_details = TRUE;
4136 return DEFER;
4137 }
4138 break;
4139
4140 case ACL_DENY:
4141 if (cond == OK) return FAIL;
4142 break;
4143
4144 case ACL_DISCARD:
4145 if (cond == OK || cond == DISCARD) return DISCARD;
4146 if (endpass_seen)
4147 {
4148 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4149 return cond;
4150 }
4151 break;
4152
4153 case ACL_DROP:
4154 if (cond == OK) return FAIL_DROP;
4155 break;
4156
4157 case ACL_REQUIRE:
4158 if (cond != OK) return cond;
4159 break;
4160
4161 case ACL_WARN:
4162 if (cond == OK)
4163 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4164 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4165 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4166 "condition test deferred%s%s", host_and_ident(TRUE),
4167 (*log_msgptr == NULL)? US"" : US": ",
4168 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4169 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4170 break;
4171
4172 default:
4173 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4174 acl->verb);
4175 break;
4176 }
4177
4178 /* Pass to the next ACL item */
4179
4180 acl = acl->next;
4181 }
4182
4183/* We have reached the end of the ACL. This is an implicit DENY. */
4184
4185HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4186return FAIL;
4187}
4188
4189
333eea9c
JH		 4190
4191
4192/* Same args as acl_check_internal() above, but the string s is
4193the name of an ACL followed optionally by up to 9 space-separated arguments.
4194The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8
JH		 4195static int
4196acl_check_wargs(int where, address_item *addr, uschar *s, int level,
333eea9c
JH		 4197 uschar **user_msgptr, uschar **log_msgptr)
4198{
4199uschar * tmp;
bef3ea7f 4200uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4201uschar * sav_arg[9]; /* must match acl_arg[] */
4202int sav_narg;
333eea9c 4203uschar * name;
bef3ea7f 4204int i;
ef21c07d 4205int ret;
333eea9c
JH		 4206
4207if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4208 goto bad;
4209
bef3ea7f 4210for (i = 0; i < 9; i++)
333eea9c
JH		 4211 {
4212 while (*s && isspace(*s)) s++;
4213 if (!*s) break;
bef3ea7f 4214 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4215 {
4216 tmp = name;
4217 goto bad;
4218 }
4219 }
ef21c07d
JH		 4220
4221sav_narg = acl_narg;
bef3ea7f 4222acl_narg = i;
ef21c07d
JH		 4223for (i = 0; i < acl_narg; i++)
4224 {
4225 sav_arg[i] = acl_arg[i];
4226 acl_arg[i] = tmp_arg[i];
4227 }
4228while (i < 9)
4229 {
4230 sav_arg[i] = acl_arg[i];
4231 acl_arg[i++] = NULL;
4232 }
4233
4234ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4235
ef21c07d
JH		 4236acl_narg = sav_narg;
4237for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4238return ret;
333eea9c
JH		 4239
4240bad:
4241if (expand_string_forcedfail) return ERROR;
4242*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4243 tmp, expand_string_message);
4244return search_find_defer?DEFER:ERROR;
4245}
4246
4247
4248
059ec3d9
PH		 4249/*************************************************
4250* Check access using an ACL *
4251*************************************************/
4252
faa05a93
JH		 4253/* Alternate interface for ACL, used by expansions */
4254int
05caaeaa 4255acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4256{
faa05a93
JH		 4257address_item adb;
4258address_item *addr = NULL;
4259
4260*user_msgptr = *log_msgptr = NULL;
4261sender_verified_failed = NULL;
4262ratelimiters_cmd = NULL;
4263log_reject_target = LOG_MAIN|LOG_REJECT;
4264
4265if (where == ACL_WHERE_RCPT)
4266 {
4267 adb = address_defaults;
4268 addr = &adb;
05caaeaa
JH		 4269 addr->address = expand_string(US"$local_part@$domain");
4270 addr->domain = deliver_domain;
4271 addr->local_part = deliver_localpart;
4272 addr->cc_local_part = deliver_localpart;
4273 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4274 }
4275
4276return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4277}
4278
4279
4280
059ec3d9
PH		 4281/* This is the external interface for ACL checks. It sets up an address and the
4282expansions for $domain and $local_part when called after RCPT, then calls
4283acl_check_internal() to do the actual work.
4284
4285Arguments:
4286 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4287 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4288 s the input string; NULL is the same as an empty ACL => DENY
4289 user_msgptr where to put a user error (for SMTP response)
4290 log_msgptr where to put a logging message (not for SMTP response)
4291
4292Returns: OK access is granted by an ACCEPT verb
4293 DISCARD access is granted by a DISCARD verb
4294 FAIL access is denied
4295 FAIL_DROP access is denied; drop the connection
4296 DEFER can't tell at the moment
4297 ERROR disaster
4298*/
faa05a93 4299int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4300
4301int
64ffc24f 4302acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4303 uschar **log_msgptr)
4304{
4305int rc;
4306address_item adb;
64ffc24f 4307address_item *addr = NULL;
059ec3d9
PH		 4308
4309*user_msgptr = *log_msgptr = NULL;
4310sender_verified_failed = NULL;
fe0dab11 4311ratelimiters_cmd = NULL;
6ea85e9a 4312log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4313
fd98a5c6
JH		 4314#ifdef EXPERIMENTAL_PRDR
4315if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR )
4316#else
4317if (where == ACL_WHERE_RCPT )
4318#endif
059ec3d9
PH		 4319 {
4320 adb = address_defaults;
4321 addr = &adb;
64ffc24f 4322 addr->address = recipient;
059ec3d9
PH		 4323 if (deliver_split_address(addr) == DEFER)
4324 {
4325 *log_msgptr = US"defer in percent_hack_domains check";
4326 return DEFER;
4327 }
4328 deliver_domain = addr->domain;
4329 deliver_localpart = addr->local_part;
4330 }
059ec3d9 4331
faa05a93 4332acl_where = where;
059ec3d9 4333rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4334acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4335
817d9f57
JH		 4336/* Cutthrough - if requested,
4337and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4338and rcpt acl returned accept,
4339and first recipient (cancel on any subsequents)
e4bdf652 4340open one now and run it up to RCPT acceptance.
e4bdf652 4341A failed verify should cancel cutthrough request.
e4bdf652 4342
817d9f57 4343Initial implementation: dual-write to spool.
e4bdf652
JH		 4344Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4345
4346Cease cutthrough copy on rxd final dot; do not send one.
4347
4348On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4349
4350On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4351perm-rejected, reflect that to the original sender - and dump the spooled copy.
4352If temp-reject, close the conn (and keep the spooled copy).
4353If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4354*/
4355switch (where)
4356{
4357case ACL_WHERE_RCPT:
fd98a5c6
JH		 4358#ifdef EXPERIMENTAL_PRDR
4359case ACL_WHERE_PRDR:
4360#endif
e4bdf652 4361 if( rcpt_count > 1 )
2e5b33cd 4362 cancel_cutthrough_connection("more than one recipient");
e4bdf652
JH		 4363 else if (rc == OK && cutthrough_delivery && cutthrough_fd < 0)
4364 open_cutthrough_connection(addr);
4365 break;
4366
4367case ACL_WHERE_PREDATA:
4368 if( rc == OK )
4369 cutthrough_predata();
4370 else
2e5b33cd 4371 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4372 break;
4373
4374case ACL_WHERE_QUIT:
4375case ACL_WHERE_NOTQUIT:
2e5b33cd 4376 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4377 break;
4378
4379default:
4380 break;
4381}
4382
64ffc24f
PH		 4383deliver_domain = deliver_localpart = deliver_address_data =
4384 sender_address_data = NULL;
059ec3d9
PH		 4385
4386/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4387ACL, which is really in the middle of an SMTP command. */
4388
4389if (rc == DISCARD)
4390 {
4391 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4392 {
4393 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4394 "ACL", acl_wherenames[where]);
4395 return ERROR;
4396 }
4397 return DISCARD;
4398 }
4399
4400/* A DROP response is not permitted from MAILAUTH */
4401
4402if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4403 {
4404 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4405 "ACL", acl_wherenames[where]);
4406 return ERROR;
4407 }
4408
4e88a19f
PH		 4409/* Before giving a response, take a look at the length of any user message, and
4410split it up into multiple lines if possible. */
059ec3d9 4411
e28326d8
PH		 4412*user_msgptr = string_split_message(*user_msgptr);
4413if (fake_response != OK)
4414 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4415
4416return rc;
4417}
4418
38a0a95f 4419
38a0a95f
PH		 4420/*************************************************
4421* Create ACL variable *
4422*************************************************/
4423
4424/* Create an ACL variable or reuse an existing one. ACL variables are in a
4425binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4426
4427Argument:
4428 name pointer to the variable's name, starting with c or m
4429
4430Returns the pointer to variable's tree node
4431*/
4432
4433tree_node *
4434acl_var_create(uschar *name)
4435{
4436tree_node *node, **root;
4437root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4438node = tree_search(*root, name);
4439if (node == NULL)
4440 {
4441 node = store_get(sizeof(tree_node) + Ustrlen(name));
4442 Ustrcpy(node->name, name);
4443 (void)tree_insertnode(root, node);
4444 }
4445node->data.ptr = NULL;
4446return node;
4447}
4448
4449
4450
4451/*************************************************
4452* Write an ACL variable in spool format *
4453*************************************************/
4454
4455/* This function is used as a callback for tree_walk when writing variables to
4456the spool file. To retain spool file compatibility, what is written is -aclc or
4457-aclm followed by the rest of the name and the data length, space separated,
4458then the value itself, starting on a new line, and terminated by an additional
4459newline. When we had only numbered ACL variables, the first line might look
4460like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4461acl_cfoo.
4462
4463Arguments:
4464 name of the variable
4465 value of the variable
4466 ctx FILE pointer (as a void pointer)
4467
4468Returns: nothing
4469*/
4470
4471void
4472acl_var_write(uschar *name, uschar *value, void *ctx)
4473{
4474FILE *f = (FILE *)ctx;
4475fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4476}
4477
059ec3d9 4478/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.