projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tidying
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
80a47a2c
TK		 68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
4840604e
TL		 71#endif
72#ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
8e669ac1 74#endif
71fafd95
PH		 75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
6ea85e9a 82 ACLC_LOG_REJECT_TARGET,
71fafd95 83 ACLC_LOGWRITE,
8523533c
TK		 84#ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86#endif
87 ACLC_MESSAGE,
88#ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90#endif
b0b9dbb1 91 ACLC_QUEUE,
870f6ba8 92 ACLC_RATELIMIT,
8523533c
TK		 93 ACLC_RECIPIENTS,
94#ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96#endif
e7568d51 97 ACLC_REMOVE_HEADER,
71fafd95
PH		 98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
8523533c 101#ifdef WITH_CONTENT_SCAN
8e669ac1 102 ACLC_SPAM,
8523533c
TK		 103#endif
104#ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
65a7d8c3 106 ACLC_SPF_GUESS,
8523533c 107#endif
b0019c78 108 ACLC_UDPSEND,
8523533c 109 ACLC_VERIFY };
059ec3d9 110
c3611384 111/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 112"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH		 113modifiers that look like conditions but always return TRUE. They are used for
114their side effects. */
059ec3d9 115
9a26b6b2
PH		 116static uschar *conditions[] = {
117 US"acl",
71fafd95 118 US"add_header",
9a26b6b2 119 US"authenticated",
8523533c
TK		 120#ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122#endif
123 US"condition",
c3611384 124 US"continue",
8e669ac1 125 US"control",
6a8f9482
TK		 126#ifdef EXPERIMENTAL_DCC
127 US"dcc",
128#endif
8523533c
TK		 129#ifdef WITH_CONTENT_SCAN
130 US"decode",
131#endif
132 US"delay",
80a47a2c
TK		 133#ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
4840604e
TL		 136#endif
137#ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
8523533c 139#endif
6ea85e9a
PH		 140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
8523533c
TK		 149#ifdef WITH_CONTENT_SCAN
150 US"malware",
151#endif
152 US"message",
153#ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155#endif
b0b9dbb1 156 US"queue",
870f6ba8 157 US"ratelimit",
8523533c
TK		 158 US"recipients",
159#ifdef WITH_CONTENT_SCAN
160 US"regex",
161#endif
e7568d51 162 US"remove_header",
b0b9dbb1
JH		 163 US"sender_domains",
164 US"senders",
165 US"set",
8523533c
TK		 166#ifdef WITH_CONTENT_SCAN
167 US"spam",
168#endif
169#ifdef EXPERIMENTAL_SPF
170 US"spf",
65a7d8c3 171 US"spf_guess",
8523533c 172#endif
b0019c78 173 US"udpsend",
059ec3d9 174 US"verify" };
8e669ac1 175
c5fcb476 176
9a26b6b2
PH		 177/* Return values from decode_control(); keep in step with the table of names
178that follows! */
179
180enum {
c46782ef 181 CONTROL_AUTH_UNADVERTISED,
3c8b3577 182#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 183 CONTROL_BMI_RUN,
3c8b3577 184#endif
ed7f7860 185 CONTROL_DEBUG,
3c8b3577 186#ifndef DISABLE_DKIM
f7572e5a 187 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 188#endif
189#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 190 CONTROL_DMARC_VERIFY,
191 CONTROL_DMARC_FORENSIC,
3c8b3577 192#endif
13363eba 193 CONTROL_DSCP,
c46782ef
PH		 194 CONTROL_ERROR,
195 CONTROL_CASEFUL_LOCAL_PART,
196 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 197 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 198 CONTROL_ENFORCE_SYNC,
199 CONTROL_NO_ENFORCE_SYNC,
200 CONTROL_FREEZE,
201 CONTROL_QUEUE_ONLY,
202 CONTROL_SUBMISSION,
203 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 204#ifdef WITH_CONTENT_SCAN
9a26b6b2 205 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 206#endif
c46782ef
PH		 207 CONTROL_FAKEDEFER,
208 CONTROL_FAKEREJECT,
8c5d388a 209#ifdef SUPPORT_I18N
3c8b3577
JH		 210 CONTROL_UTF8_DOWNCONVERT,
211#endif
cf8b11a5 212 CONTROL_NO_MULTILINE,
047bdd8c 213 CONTROL_NO_PIPELINING,
4c590bd1
PH		 214 CONTROL_NO_DELAY_FLUSH,
215 CONTROL_NO_CALLOUT_FLUSH
c46782ef 216};
9a26b6b2 217
8800895a
PH		 218/* ACL control names; keep in step with the table above! This list is used for
219turning ids into names. The actual list of recognized names is in the variable
220control_def controls_list[] below. The fact that there are two lists is a mess
221and should be tidied up. */
9a26b6b2
PH		 222
223static uschar *controls[] = {
c46782ef 224 US"allow_auth_unadvertised",
3c8b3577 225#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 226 US"bmi_run",
3c8b3577 227#endif
ed7f7860 228 US"debug",
3c8b3577 229#ifndef DISABLE_DKIM
80a47a2c 230 US"dkim_disable_verify",
3c8b3577
JH		 231#endif
232#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 233 US"dmarc_disable_verify",
234 US"dmarc_enable_forensic",
3c8b3577 235#endif
13363eba 236 US"dscp",
c46782ef
PH		 237 US"error",
238 US"caseful_local_part",
239 US"caselower_local_part",
e4bdf652 240 US"cutthrough_delivery",
c46782ef
PH		 241 US"enforce_sync",
242 US"no_enforce_sync",
243 US"freeze",
244 US"queue_only",
245 US"submission",
246 US"suppress_local_fixups",
3c8b3577 247#ifdef WITH_CONTENT_SCAN
9a26b6b2 248 US"no_mbox_unspool",
3c8b3577 249#endif
cf8b11a5
PH		 250 US"fakedefer",
251 US"fakereject",
8c5d388a 252#ifdef SUPPORT_I18N
3c8b3577
JH		 253 US"utf8_downconvert",
254#endif
aa6dc513 255 US"no_multiline_responses",
cf8b11a5 256 US"no_pipelining",
4c590bd1
PH		 257 US"no_delay_flush",
258 US"no_callout_flush"
c46782ef 259};
059ec3d9 260
047bdd8c 261/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 262at the outer level. In the other cases, expansion already occurs in the
263checking functions. */
264
265static uschar cond_expand_at_top[] = {
7421ecab 266 FALSE, /* acl */
3e536984 267 TRUE, /* add_header */
059ec3d9 268 FALSE, /* authenticated */
8523533c
TK		 269#ifdef EXPERIMENTAL_BRIGHTMAIL
270 TRUE, /* bmi_optin */
8e669ac1 271#endif
059ec3d9 272 TRUE, /* condition */
c3611384 273 TRUE, /* continue */
059ec3d9 274 TRUE, /* control */
6a8f9482
TK		 275#ifdef EXPERIMENTAL_DCC
276 TRUE, /* dcc */
277#endif
8523533c
TK		 278#ifdef WITH_CONTENT_SCAN
279 TRUE, /* decode */
280#endif
059ec3d9 281 TRUE, /* delay */
80a47a2c
TK		 282#ifndef DISABLE_DKIM
283 TRUE, /* dkim_signers */
284 TRUE, /* dkim_status */
4840604e
TL		 285#endif
286#ifdef EXPERIMENTAL_DMARC
287 TRUE, /* dmarc_status */
8523533c 288#endif
059ec3d9
PH		 289 TRUE, /* dnslists */
290 FALSE, /* domains */
291 FALSE, /* encrypted */
292 TRUE, /* endpass */
293 FALSE, /* hosts */
294 FALSE, /* local_parts */
295 TRUE, /* log_message */
6ea85e9a 296 TRUE, /* log_reject_target */
059ec3d9 297 TRUE, /* logwrite */
8523533c
TK		 298#ifdef WITH_CONTENT_SCAN
299 TRUE, /* malware */
300#endif
059ec3d9 301 TRUE, /* message */
8523533c
TK		 302#ifdef WITH_CONTENT_SCAN
303 TRUE, /* mime_regex */
304#endif
b0b9dbb1 305 TRUE, /* queue */
870f6ba8 306 TRUE, /* ratelimit */
059ec3d9 307 FALSE, /* recipients */
8523533c
TK		 308#ifdef WITH_CONTENT_SCAN
309 TRUE, /* regex */
310#endif
e7568d51 311 TRUE, /* remove_header */
059ec3d9
PH		 312 FALSE, /* sender_domains */
313 FALSE, /* senders */
314 TRUE, /* set */
8523533c
TK		 315#ifdef WITH_CONTENT_SCAN
316 TRUE, /* spam */
317#endif
318#ifdef EXPERIMENTAL_SPF
319 TRUE, /* spf */
65a7d8c3 320 TRUE, /* spf_guess */
8523533c 321#endif
b0019c78 322 TRUE, /* udpsend */
059ec3d9
PH		 323 TRUE /* verify */
324};
325
326/* Flags to identify the modifiers */
327
328static uschar cond_modifiers[] = {
329 FALSE, /* acl */
3e536984 330 TRUE, /* add_header */
059ec3d9 331 FALSE, /* authenticated */
8523533c
TK		 332#ifdef EXPERIMENTAL_BRIGHTMAIL
333 TRUE, /* bmi_optin */
8e669ac1 334#endif
059ec3d9 335 FALSE, /* condition */
c3611384 336 TRUE, /* continue */
059ec3d9 337 TRUE, /* control */
6a8f9482
TK		 338#ifdef EXPERIMENTAL_DCC
339 FALSE, /* dcc */
340#endif
8523533c
TK		 341#ifdef WITH_CONTENT_SCAN
342 FALSE, /* decode */
343#endif
059ec3d9 344 TRUE, /* delay */
80a47a2c
TK		 345#ifndef DISABLE_DKIM
346 FALSE, /* dkim_signers */
347 FALSE, /* dkim_status */
4840604e
TL		 348#endif
349#ifdef EXPERIMENTAL_DMARC
350 FALSE, /* dmarc_status */
8523533c 351#endif
059ec3d9
PH		 352 FALSE, /* dnslists */
353 FALSE, /* domains */
354 FALSE, /* encrypted */
355 TRUE, /* endpass */
356 FALSE, /* hosts */
357 FALSE, /* local_parts */
358 TRUE, /* log_message */
6ea85e9a 359 TRUE, /* log_reject_target */
8523533c
TK		 360 TRUE, /* logwrite */
361#ifdef WITH_CONTENT_SCAN
362 FALSE, /* malware */
363#endif
059ec3d9 364 TRUE, /* message */
8523533c
TK		 365#ifdef WITH_CONTENT_SCAN
366 FALSE, /* mime_regex */
367#endif
b0b9dbb1 368 TRUE, /* queue */
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
80a47a2c
TK		 450 #ifndef DISABLE_DKIM
451 (unsigned int)
452 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 453
80a47a2c
TK		 454 (unsigned int)
455 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 456 #endif
fb2274d4 457
4840604e
TL		 458 #ifdef EXPERIMENTAL_DMARC
459 (unsigned int)
460 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
461 #endif
462
379ba7d0
JH		 463 /* Explicit key lookups can be made in non-smtp ACLs so pass
464 always and check in the verify processing itself. */
465
466 0, /* dnslists */
059ec3d9 467
2f079f46 468 (unsigned int)
fd98a5c6 469 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 470 |(1<<ACL_WHERE_VRFY)
8ccd00b1 471 #ifndef DISABLE_PRDR
fd98a5c6
JH		 472 |(1<<ACL_WHERE_PRDR)
473 #endif
474 ),
059ec3d9 475
45b91596
PH		 476 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
477 (1<<ACL_WHERE_CONNECT)|
478 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 479 (1<<ACL_WHERE_HELO),
8e669ac1 480
059ec3d9 481 0, /* endpass */
8e669ac1 482
45b91596
PH		 483 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
484 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 485
2f079f46 486 (unsigned int)
fd98a5c6 487 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 488 |(1<<ACL_WHERE_VRFY)
2e6afa4f 489 #ifndef DISABLE_PRDR
fd98a5c6
JH		 490 |(1<<ACL_WHERE_PRDR)
491 #endif
492 ),
059ec3d9
PH		 493
494 0, /* log_message */
8e669ac1 495
6ea85e9a
PH		 496 0, /* log_reject_target */
497
059ec3d9 498 0, /* logwrite */
8e669ac1 499
71fafd95 500 #ifdef WITH_CONTENT_SCAN
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 503 #ifndef DISABLE_PRDR
fd98a5c6 504 (1<<ACL_WHERE_PRDR)|
8ccd00b1 505 #endif
fd98a5c6 506 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 507 #endif
8523533c 508
059ec3d9
PH		 509 0, /* message */
510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 512 (unsigned int)
513 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 514 #endif
8523533c 515
ecc5f51a
JH		 516 (1<<ACL_WHERE_NOTSMTP)| /* queue */
517 #ifndef DISABLE_PRDR
518 (1<<ACL_WHERE_PRDR)|
519 #endif
520 (1<<ACL_WHERE_DATA),
521
870f6ba8
TF		 522 0, /* ratelimit */
523
2f079f46
PH		 524 (unsigned int)
525 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 526
71fafd95 527 #ifdef WITH_CONTENT_SCAN
2f079f46 528 (unsigned int)
fd98a5c6 529 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 530 #ifndef DISABLE_PRDR
fd98a5c6 531 (1<<ACL_WHERE_PRDR)|
8ccd00b1 532 #endif
fd98a5c6 533 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 534 (1<<ACL_WHERE_MIME)),
71fafd95 535 #endif
8523533c 536
e7568d51
TL		 537 (unsigned int)
538 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
539 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 540 #ifndef DISABLE_PRDR
fd98a5c6
JH		 541 (1<<ACL_WHERE_PRDR)|
542 #endif
e7568d51
TL		 543 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
544 (1<<ACL_WHERE_NOTSMTP_START)),
545
059ec3d9
PH		 546 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
547 (1<<ACL_WHERE_HELO)|
548 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
549 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
550 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
551
552 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
553 (1<<ACL_WHERE_HELO)|
554 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
555 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
556 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
557
558 0, /* set */
559
71fafd95 560 #ifdef WITH_CONTENT_SCAN
2f079f46 561 (unsigned int)
fd98a5c6 562 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 563 #ifndef DISABLE_PRDR
fd98a5c6 564 (1<<ACL_WHERE_PRDR)|
8ccd00b1 565 #endif
fd98a5c6 566 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 567 #endif
8523533c 568
71fafd95 569 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 570 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
571 (1<<ACL_WHERE_HELO)|
572 (1<<ACL_WHERE_MAILAUTH)|
573 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 574 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
575 (1<<ACL_WHERE_NOTSMTP)|
576 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 577
578 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
579 (1<<ACL_WHERE_HELO)|
580 (1<<ACL_WHERE_MAILAUTH)|
581 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
582 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
583 (1<<ACL_WHERE_NOTSMTP)|
584 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 585 #endif
8523533c 586
b0019c78
TF		 587 0, /* udpsend */
588
059ec3d9
PH		 589 /* Certain types of verify are always allowed, so we let it through
590 always and check in the verify function itself */
591
592 0 /* verify */
059ec3d9
PH		 593};
594
595
c5fcb476
PH		 596/* Bit map vector of which controls are not allowed at certain times. For
597each control, there's a bitmap of dis-allowed times. For some, it is easier to
598specify the negation of a small number of allowed times. */
599
600static unsigned int control_forbids[] = {
c46782ef
PH		 601 (unsigned int)
602 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
603
3c8b3577 604#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 605 0, /* bmi_run */
3c8b3577 606#endif
c46782ef 607
ed7f7860
PP		 608 0, /* debug */
609
3c8b3577 610#ifndef DISABLE_DKIM
80a47a2c 611 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 612# ifndef DISABLE_PRDR
fd98a5c6 613 (1<<ACL_WHERE_PRDR)|
3c8b3577 614# endif
f7572e5a 615 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 616#endif
f7572e5a 617
3c8b3577 618#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 619 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
620 (1<<ACL_WHERE_NOTSMTP_START),
621 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
622 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 623#endif
4840604e 624
13363eba
PP		 625 (1<<ACL_WHERE_NOTSMTP)|
626 (1<<ACL_WHERE_NOTSMTP_START)|
627 (1<<ACL_WHERE_NOTQUIT), /* dscp */
628
c5fcb476 629 0, /* error */
8e669ac1
PH		 630
631 (unsigned int)
c5fcb476 632 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 633
634 (unsigned int)
c5fcb476 635 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 636
e4bdf652
JH		 637 (unsigned int)
638 0, /* cutthrough_delivery */
639
45b91596
PH		 640 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
641 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 642
45b91596
PH		 643 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
644 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 645
646 (unsigned int)
c5fcb476
PH		 647 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
648 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 649 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 650 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 651
652 (unsigned int)
c5fcb476
PH		 653 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
654 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 655 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 656 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 657
658 (unsigned int)
c5fcb476 659 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 660 (1<<ACL_WHERE_PREDATA)),
8523533c 661
8800895a
PH		 662 (unsigned int)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 664 (1<<ACL_WHERE_PREDATA)|
665 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 666
3c8b3577 667#ifdef WITH_CONTENT_SCAN
8e669ac1 668 (unsigned int)
14d57970 669 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 670 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 671 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 672 (1<<ACL_WHERE_MIME)),
3c8b3577 673#endif
a6c4ab60 674
29aba418
TF		 675 (unsigned int)
676 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
677 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 678#ifndef DISABLE_PRDR
fd98a5c6 679 (1<<ACL_WHERE_PRDR)|
3c8b3577 680#endif
29aba418
TF		 681 (1<<ACL_WHERE_MIME)),
682
8e669ac1 683 (unsigned int)
a6c4ab60 684 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 685 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 686#ifndef DISABLE_PRDR
fd98a5c6 687 (1<<ACL_WHERE_PRDR)|
3c8b3577 688#endif
e715ad22 689 (1<<ACL_WHERE_MIME)),
8523533c 690
8c5d388a 691#ifdef SUPPORT_I18N
3c8b3577
JH		 692 0, /* utf8_downconvert */
693#endif
694
45b91596 695 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 696 (1<<ACL_WHERE_NOTSMTP_START),
697
698 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 699 (1<<ACL_WHERE_NOTSMTP_START),
700
701 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 702 (1<<ACL_WHERE_NOTSMTP_START),
703
704 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 705 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 706};
707
708/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 709
710typedef struct control_def {
711 uschar *name;
712 int value; /* CONTROL_xxx value */
059ec3d9
PH		 713 BOOL has_option; /* Has /option(s) following */
714} control_def;
715
716static control_def controls_list[] = {
3c8b3577 717 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 718#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 719 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 720#endif
3c8b3577 721 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 722#ifndef DISABLE_DKIM
3c8b3577 723 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 724#endif
725#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 726 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
727 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 728#endif
3c8b3577
JH		 729 { US"dscp", CONTROL_DSCP, TRUE },
730 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
731 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
732 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
733 { US"freeze", CONTROL_FREEZE, TRUE },
734 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
735 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
736 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
737 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
738 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
739 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 740#ifdef WITH_CONTENT_SCAN
3c8b3577 741 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 742#endif
3c8b3577
JH		 743 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
744 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
745 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 746 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
ff5929e3 747 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, TRUE },
8c5d388a 748#ifdef SUPPORT_I18N
3c8b3577
JH		 749 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
750#endif
059ec3d9
PH		 751 };
752
e5a9dba6
PH		 753/* Support data structures for Client SMTP Authorization. acl_verify_csa()
754caches its result in a tree to avoid repeated DNS queries. The result is an
755integer code which is used as an index into the following tables of
756explanatory strings and verification return codes. */
757
758static tree_node *csa_cache = NULL;
759
760enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
761 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
762
763/* The acl_verify_csa() return code is translated into an acl_verify() return
764code using the following table. It is OK unless the client is definitely not
765authorized. This is because CSA is supposed to be optional for sending sites,
766so recipients should not be too strict about checking it - especially because
767DNS problems are quite likely to occur. It's possible to use $csa_status in
768further ACL conditions to distinguish ok, unknown, and defer if required, but
769the aim is to make the usual configuration simple. */
770
771static int csa_return_code[] = {
772 OK, OK, OK, OK,
773 FAIL, FAIL, FAIL, FAIL
774};
775
776static uschar *csa_status_string[] = {
777 US"unknown", US"ok", US"defer", US"defer",
778 US"fail", US"fail", US"fail", US"fail"
779};
780
781static uschar *csa_reason_string[] = {
782 US"unknown",
783 US"ok",
784 US"deferred (SRV lookup failed)",
785 US"deferred (target address lookup failed)",
786 US"failed (explicit authorization required)",
787 US"failed (host name not authorized)",
788 US"failed (no authorized addresses)",
789 US"failed (client address mismatch)"
790};
791
c99ce5c9
TF		 792/* Options for the ratelimit condition. Note that there are two variants of
793the per_rcpt option, depending on the ACL that is used to measure the rate.
794However any ACL must be able to look up per_rcpt rates in /noupdate mode,
795so the two variants must have the same internal representation as well as
796the same configuration string. */
797
798enum {
799 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
800 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
801};
802
803#define RATE_SET(var,new) \
804 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
805
806static uschar *ratelimit_option_string[] = {
807 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
808 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
809};
810
059ec3d9
PH		 811/* Enable recursion between acl_check_internal() and acl_check_condition() */
812
55414b25 813static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 814 uschar **);
059ec3d9
PH		 815
816
817/*************************************************
818* Pick out name from list *
819*************************************************/
820
821/* Use a binary chop method
822
823Arguments:
824 name name to find
825 list list of names
826 end size of list
827
828Returns: offset in list, or -1 if not found
829*/
830
831static int
832acl_checkname(uschar *name, uschar **list, int end)
833{
834int start = 0;
835
836while (start < end)
837 {
838 int mid = (start + end)/2;
839 int c = Ustrcmp(name, list[mid]);
840 if (c == 0) return mid;
841 if (c < 0) end = mid; else start = mid + 1;
842 }
843
844return -1;
845}
846
847
848/*************************************************
849* Read and parse one ACL *
850*************************************************/
851
852/* This function is called both from readconf in order to parse the ACLs in the
853configuration file, and also when an ACL is encountered dynamically (e.g. as
854the result of an expansion). It is given a function to call in order to
855retrieve the lines of the ACL. This function handles skipping comments and
856blank lines (where relevant).
857
858Arguments:
859 func function to get next line of ACL
860 error where to put an error message
861
862Returns: pointer to ACL, or NULL
863 NULL can be legal (empty ACL); in this case error will be NULL
864*/
865
866acl_block *
867acl_read(uschar *(*func)(void), uschar **error)
868{
869acl_block *yield = NULL;
870acl_block **lastp = &yield;
871acl_block *this = NULL;
872acl_condition_block *cond;
873acl_condition_block **condp = NULL;
874uschar *s;
875
876*error = NULL;
877
878while ((s = (*func)()) != NULL)
879 {
880 int v, c;
881 BOOL negated = FALSE;
882 uschar *saveline = s;
883 uschar name[64];
884
885 /* Conditions (but not verbs) are allowed to be negated by an initial
886 exclamation mark. */
887
888 while (isspace(*s)) s++;
889 if (*s == '!')
890 {
891 negated = TRUE;
892 s++;
893 }
894
cf00dad6
PH		 895 /* Read the name of a verb or a condition, or the start of a new ACL, which
896 can be started by a name, or by a macro definition. */
059ec3d9
PH		 897
898 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 899 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 900
901 /* If a verb is unrecognized, it may be another condition or modifier that
902 continues the previous verb. */
903
904 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
905 if (v < 0)
906 {
907 if (this == NULL)
908 {
4e167a8c
PH		 909 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
910 saveline);
059ec3d9
PH		 911 return NULL;
912 }
913 }
914
915 /* New verb */
916
917 else
918 {
919 if (negated)
920 {
921 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
922 return NULL;
923 }
924 this = store_get(sizeof(acl_block));
925 *lastp = this;
926 lastp = &(this->next);
927 this->next = NULL;
928 this->verb = v;
929 this->condition = NULL;
930 condp = &(this->condition);
931 if (*s == 0) continue; /* No condition on this line */
932 if (*s == '!')
933 {
934 negated = TRUE;
935 s++;
936 }
937 s = readconf_readname(name, sizeof(name), s); /* Condition name */
938 }
939
940 /* Handle a condition or modifier. */
941
942 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
943 if (c < 0)
944 {
945 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
946 saveline);
947 return NULL;
948 }
949
950 /* The modifiers may not be negated */
951
952 if (negated && cond_modifiers[c])
953 {
954 *error = string_sprintf("ACL error: negation is not allowed with "
955 "\"%s\"", conditions[c]);
956 return NULL;
957 }
958
959 /* ENDPASS may occur only with ACCEPT or DISCARD. */
960
961 if (c == ACLC_ENDPASS &&
962 this->verb != ACL_ACCEPT &&
963 this->verb != ACL_DISCARD)
964 {
965 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
966 conditions[c], verbs[this->verb]);
967 return NULL;
968 }
969
970 cond = store_get(sizeof(acl_condition_block));
971 cond->next = NULL;
972 cond->type = c;
973 cond->u.negated = negated;
974
975 *condp = cond;
976 condp = &(cond->next);
977
978 /* The "set" modifier is different in that its argument is "name=value"
979 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 980 gives us a variable name to insert into the data block. The original ACL
981 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
982 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 983 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
984 After that, we allow alphanumerics and underscores, but the first character
985 after c or m must be a digit or an underscore. This retains backwards
986 compatibility. */
059ec3d9
PH		 987
988 if (c == ACLC_SET)
989 {
47ca6d6c
PH		 990 uschar *endptr;
991
38a0a95f
PH		 992 if (Ustrncmp(s, "acl_c", 5) != 0 &&
993 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 994 {
38a0a95f
PH		 995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
997 return NULL;
47ca6d6c 998 }
38a0a95f
PH		 999
1000 endptr = s + 5;
641cb756
PH		 1001 if (!isdigit(*endptr) && *endptr != '_')
1002 {
1003 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1004 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1005 s);
1006 return NULL;
1007 }
1008
38a0a95f 1009 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1010 {
38a0a95f
PH		 1011 if (!isalnum(*endptr) && *endptr != '_')
1012 {
1013 *error = string_sprintf("invalid character \"%c\" in variable name "
1014 "in ACL modifier \"set %s\"", *endptr, s);
1015 return NULL;
1016 }
1017 endptr++;
47ca6d6c 1018 }
47ca6d6c 1019
38a0a95f 1020 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1021 s = endptr;
059ec3d9
PH		 1022 while (isspace(*s)) s++;
1023 }
1024
1025 /* For "set", we are now positioned for the data. For the others, only
1026 "endpass" has no data */
1027
1028 if (c != ACLC_ENDPASS)
1029 {
1030 if (*s++ != '=')
1031 {
1032 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1033 cond_modifiers[c]? US"modifier" : US"condition");
1034 return NULL;
1035 }
1036 while (isspace(*s)) s++;
1037 cond->arg = string_copy(s);
1038 }
1039 }
1040
1041return yield;
1042}
1043
1044
1045
71fafd95
PH		 1046/*************************************************
1047* Set up added header line(s) *
1048*************************************************/
1049
1050/* This function is called by the add_header modifier, and also from acl_warn()
1051to implement the now-deprecated way of adding header lines using "message" on a
1052"warn" verb. The argument is treated as a sequence of header lines which are
1053added to a chain, provided there isn't an identical one already there.
1054
1055Argument: string of header lines
1056Returns: nothing
1057*/
1058
1059static void
55414b25 1060setup_header(const uschar *hstring)
71fafd95 1061{
55414b25 1062const uschar *p, *q;
71fafd95
PH		 1063int hlen = Ustrlen(hstring);
1064
b1b05573
JH		 1065/* Ignore any leading newlines */
1066while (*hstring == '\n') hstring++, hlen--;
71fafd95 1067
b1b05573 1068/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1069if (hlen <= 0) return;
96f5fe4c 1070if (hstring[--hlen] != '\n') /* no newline */
55414b25 1071 q = string_sprintf("%s\n", hstring);
96f5fe4c 1072else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 1073 {
1074 uschar * s = string_copy(hstring);
1075 while(s[--hlen] == '\n')
1076 s[hlen+1] = '\0';
1077 q = s;
1078 }
1079else
1080 q = hstring;
71fafd95
PH		 1081
1082/* Loop for multiple header lines, taking care about continuations */
1083
55414b25 1084for (p = q; *p != 0; )
71fafd95 1085 {
55414b25
JH		 1086 const uschar *s;
1087 uschar * hdr;
71fafd95
PH		 1088 int newtype = htype_add_bot;
1089 header_line **hptr = &acl_added_headers;
1090
1091 /* Find next header line within the string */
1092
1093 for (;;)
1094 {
96f5fe4c 1095 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH		 1096 if (*(++q) != ' ' && *q != '\t') break;
1097 }
1098
1099 /* If the line starts with a colon, interpret the instruction for where to
1100 add it. This temporarily sets up a new type. */
1101
1102 if (*p == ':')
1103 {
1104 if (strncmpic(p, US":after_received:", 16) == 0)
1105 {
1106 newtype = htype_add_rec;
1107 p += 16;
1108 }
1109 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1110 {
1111 newtype = htype_add_rfc;
1112 p += 14;
1113 }
1114 else if (strncmpic(p, US":at_start:", 10) == 0)
1115 {
1116 newtype = htype_add_top;
1117 p += 10;
1118 }
1119 else if (strncmpic(p, US":at_end:", 8) == 0)
1120 {
1121 newtype = htype_add_bot;
1122 p += 8;
1123 }
1124 while (*p == ' ' || *p == '\t') p++;
1125 }
1126
1127 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1128 to the front of it. */
1129
1130 for (s = p; s < q - 1; s++)
1131 {
1132 if (*s == ':' || !isgraph(*s)) break;
1133 }
1134
55414b25
JH		 1135 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1136 hlen = Ustrlen(hdr);
71fafd95
PH		 1137
1138 /* See if this line has already been added */
1139
1140 while (*hptr != NULL)
1141 {
55414b25 1142 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1143 hptr = &((*hptr)->next);
1144 }
1145
1146 /* Add if not previously present */
1147
1148 if (*hptr == NULL)
1149 {
1150 header_line *h = store_get(sizeof(header_line));
55414b25 1151 h->text = hdr;
71fafd95
PH		 1152 h->next = NULL;
1153 h->type = newtype;
1154 h->slen = hlen;
1155 *hptr = h;
1156 hptr = &(h->next);
1157 }
1158
1159 /* Advance for next header line within the string */
1160
1161 p = q;
1162 }
1163}
1164
1165
1166
362145b5
JH		 1167/*************************************************
1168* List the added header lines *
1169*************************************************/
1170uschar *
1171fn_hdrs_added(void)
1172{
1173uschar * ret = NULL;
5f5be492
JH		 1174int size = 0;
1175int ptr = 0;
362145b5
JH		 1176header_line * h = acl_added_headers;
1177uschar * s;
1178uschar * cp;
362145b5
JH		 1179
1180if (!h) return NULL;
1181
1182do
1183 {
1184 s = h->text;
1185 while ((cp = Ustrchr(s, '\n')) != NULL)
1186 {
1187 if (cp[1] == '\0') break;
1188
1189 /* contains embedded newline; needs doubling */
c2f669a4
JH		 1190 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1191 ret = string_catn(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1192 s = cp+1;
1193 }
1194 /* last bit of header */
1195
c2f669a4 1196 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
362145b5 1197 }
6d9cfc47 1198while((h = h->next));
362145b5
JH		 1199
1200ret[ptr-1] = '\0'; /* overwrite last newline */
1201return ret;
1202}
1203
1204
e7568d51
TL		 1205/*************************************************
1206* Set up removed header line(s) *
1207*************************************************/
1208
1209/* This function is called by the remove_header modifier. The argument is
1210treated as a sequence of header names which are added to a colon separated
1211list, provided there isn't an identical one already there.
1212
1213Argument: string of header names
1214Returns: nothing
1215*/
1216
1217static void
55414b25 1218setup_remove_header(const uschar *hnames)
e7568d51
TL		 1219{
1220if (*hnames != 0)
55414b25
JH		 1221 acl_removed_headers = acl_removed_headers
1222 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1223 : string_copy(hnames);
e7568d51
TL		 1224}
1225
1226
71fafd95 1227
059ec3d9
PH		 1228/*************************************************
1229* Handle warnings *
1230*************************************************/
1231
1232/* This function is called when a WARN verb's conditions are true. It adds to
1233the message's headers, and/or writes information to the log. In each case, this
1234only happens once (per message for headers, per connection for log).
1235
71fafd95
PH		 1236** NOTE: The header adding action using the "message" setting is historic, and
1237its use is now deprecated. The new add_header modifier should be used instead.
1238
059ec3d9
PH		 1239Arguments:
1240 where ACL_WHERE_xxxx indicating which ACL this is
1241 user_message message for adding to headers
1242 log_message message for logging, if different
1243
1244Returns: nothing
1245*/
1246
1247static void
1248acl_warn(int where, uschar *user_message, uschar *log_message)
1249{
059ec3d9
PH		 1250if (log_message != NULL && log_message != user_message)
1251 {
1252 uschar *text;
1253 string_item *logged;
1254
1255 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1256 string_printing(log_message));
1257
1258 /* If a sender verification has failed, and the log message is "sender verify
1259 failed", add the failure message. */
1260
1261 if (sender_verified_failed != NULL &&
1262 sender_verified_failed->message != NULL &&
1263 strcmpic(log_message, US"sender verify failed") == 0)
1264 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1265
9c7a242c
PH		 1266 /* Search previously logged warnings. They are kept in malloc
1267 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1268
1269 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1270 if (Ustrcmp(logged->text, text) == 0) break;
1271
1272 if (logged == NULL)
1273 {
1274 int length = Ustrlen(text) + 1;
1275 log_write(0, LOG_MAIN, "%s", text);
1276 logged = store_malloc(sizeof(string_item) + length);
1277 logged->text = (uschar *)logged + sizeof(string_item);
1278 memcpy(logged->text, text, length);
1279 logged->next = acl_warn_logged;
1280 acl_warn_logged = logged;
1281 }
1282 }
1283
1284/* If there's no user message, we are done. */
1285
1286if (user_message == NULL) return;
1287
1288/* If this isn't a message ACL, we can't do anything with a user message.
1289Log an error. */
1290
1291if (where > ACL_WHERE_NOTSMTP)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1294 "found in a non-message (%s) ACL: cannot specify header lines here: "
1295 "message ignored", acl_wherenames[where]);
1296 return;
1297 }
1298
71fafd95
PH		 1299/* The code for setting up header lines is now abstracted into a separate
1300function so that it can be used for the add_header modifier as well. */
059ec3d9 1301
71fafd95 1302setup_header(user_message);
059ec3d9
PH		 1303}
1304
1305
1306
1307/*************************************************
1308* Verify and check reverse DNS *
1309*************************************************/
1310
1311/* Called from acl_verify() below. We look up the host name(s) of the client IP
1312address if this has not yet been done. The host_name_lookup() function checks
1313that one of these names resolves to an address list that contains the client IP
1314address, so we don't actually have to do the check here.
1315
1316Arguments:
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319
1320Returns: OK verification condition succeeded
1321 FAIL verification failed
1322 DEFER there was a problem verifying
1323*/
1324
1325static int
1326acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1327{
1328int rc;
1329
1330user_msgptr = user_msgptr; /* stop compiler warning */
1331
1332/* Previous success */
1333
1334if (sender_host_name != NULL) return OK;
1335
1336/* Previous failure */
1337
1338if (host_lookup_failed)
1339 {
1340 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1341 return FAIL;
1342 }
1343
1344/* Need to do a lookup */
1345
1346HDEBUG(D_acl)
1347 debug_printf("looking up host name to force name/address consistency check\n");
1348
1349if ((rc = host_name_lookup()) != OK)
1350 {
1351 *log_msgptr = (rc == DEFER)?
1352 US"host lookup deferred for reverse lookup check"
1353 :
1354 string_sprintf("host lookup failed for reverse lookup check%s",
1355 host_lookup_msg);
1356 return rc; /* DEFER or FAIL */
1357 }
1358
1359host_build_sender_fullhost();
1360return OK;
1361}
1362
1363
1364
e5a9dba6
PH		 1365/*************************************************
1366* Check client IP address matches CSA target *
1367*************************************************/
1368
1369/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1370response for address records belonging to the CSA target hostname. The section
1371is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1372If one of the addresses matches the client's IP address, then the client is
1373authorized by CSA. If there are target IP addresses but none of them match
1374then the client is using an unauthorized IP address. If there are no target IP
1375addresses then the client cannot be using an authorized IP address. (This is
1376an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1377
1378Arguments:
1379 dnsa the DNS answer block
1380 dnss a DNS scan block for us to use
1381 reset option specifing what portion to scan, as described above
1382 target the target hostname to use for matching RR names
1383
1384Returns: CSA_OK successfully authorized
1385 CSA_FAIL_MISMATCH addresses found but none matched
1386 CSA_FAIL_NOADDR no target addresses found
1387*/
1388
1389static int
1390acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1391 uschar *target)
1392{
1393dns_record *rr;
1394dns_address *da;
1395
1396BOOL target_found = FALSE;
1397
1398for (rr = dns_next_rr(dnsa, dnss, reset);
1399 rr != NULL;
1400 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1401 {
1402 /* Check this is an address RR for the target hostname. */
1403
1404 if (rr->type != T_A
1405 #if HAVE_IPV6
1406 && rr->type != T_AAAA
e5a9dba6
PH		 1407 #endif
1408 ) continue;
1409
1410 if (strcmpic(target, rr->name) != 0) continue;
1411
1412 target_found = TRUE;
1413
1414 /* Turn the target address RR into a list of textual IP addresses and scan
1415 the list. There may be more than one if it is an A6 RR. */
1416
1417 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1418 {
1419 /* If the client IP address matches the target IP address, it's good! */
1420
1421 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1422
1423 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1424 }
1425 }
1426
1427/* If we found some target addresses but none of them matched, the client is
1428using an unauthorized IP address, otherwise the target has no authorized IP
1429addresses. */
1430
1431if (target_found) return CSA_FAIL_MISMATCH;
1432else return CSA_FAIL_NOADDR;
1433}
1434
1435
1436
1437/*************************************************
1438* Verify Client SMTP Authorization *
1439*************************************************/
1440
1441/* Called from acl_verify() below. This routine calls dns_lookup_special()
1442to find the CSA SRV record corresponding to the domain argument, or
1443$sender_helo_name if no argument is provided. It then checks that the
1444client is authorized, and that its IP address corresponds to the SRV
1445target's address by calling acl_verify_csa_address() above. The address
1446should have been returned in the DNS response's ADDITIONAL section, but if
1447not we perform another DNS lookup to get it.
1448
1449Arguments:
1450 domain pointer to optional parameter following verify = csa
1451
1452Returns: CSA_UNKNOWN no valid CSA record found
1453 CSA_OK successfully authorized
1454 CSA_FAIL_* client is definitely not authorized
1455 CSA_DEFER_* there was a DNS problem
1456*/
1457
1458static int
55414b25 1459acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1460{
1461tree_node *t;
55414b25
JH		 1462const uschar *found;
1463uschar *p;
e5a9dba6
PH		 1464int priority, weight, port;
1465dns_answer dnsa;
1466dns_scan dnss;
1467dns_record *rr;
1468int rc, type;
1469uschar target[256];
1470
1471/* Work out the domain we are using for the CSA lookup. The default is the
1472client's HELO domain. If the client has not said HELO, use its IP address
1473instead. If it's a local client (exim -bs), CSA isn't applicable. */
1474
1475while (isspace(*domain) && *domain != '\0') ++domain;
1476if (*domain == '\0') domain = sender_helo_name;
1477if (domain == NULL) domain = sender_host_address;
1478if (sender_host_address == NULL) return CSA_UNKNOWN;
1479
1480/* If we have an address literal, strip off the framing ready for turning it
1481into a domain. The framing consists of matched square brackets possibly
1482containing a keyword and a colon before the actual IP address. */
1483
1484if (domain[0] == '[')
1485 {
55414b25 1486 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1487 if (start == NULL) start = domain;
1488 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1489 }
1490
1491/* Turn domains that look like bare IP addresses into domains in the reverse
1492DNS. This code also deals with address literals and $sender_host_address. It's
1493not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1494address literals, but it's probably the most friendly thing to do. This is an
1495extension to CSA, so we allow it to be turned off for proper conformance. */
1496
7e66e54d 1497if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1498 {
1499 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1500 dns_build_reverse(domain, target);
1501 domain = target;
1502 }
1503
1504/* Find out if we've already done the CSA check for this domain. If we have,
1505return the same result again. Otherwise build a new cached result structure
1506for this domain. The name is filled in now, and the value is filled in when
1507we return from this function. */
1508
1509t = tree_search(csa_cache, domain);
1510if (t != NULL) return t->data.val;
1511
1512t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1513Ustrcpy(t->name, domain);
1514(void)tree_insertnode(&csa_cache, t);
1515
1516/* Now we are ready to do the actual DNS lookup(s). */
1517
28e6ef29 1518found = domain;
e5a9dba6
PH		 1519switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1520 {
1521 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1522
1523 default:
1524 return t->data.val = CSA_DEFER_SRV;
1525
1526 /* If we found nothing, the client's authorization is unknown. */
1527
1528 case DNS_NOMATCH:
1529 case DNS_NODATA:
1530 return t->data.val = CSA_UNKNOWN;
1531
1532 /* We got something! Go on to look at the reply in more detail. */
1533
1534 case DNS_SUCCEED:
1535 break;
1536 }
1537
1538/* Scan the reply for well-formed CSA SRV records. */
1539
1540for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1541 rr != NULL;
1542 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1543 {
1544 if (rr->type != T_SRV) continue;
1545
1546 /* Extract the numerical SRV fields (p is incremented) */
1547
1548 p = rr->data;
1549 GETSHORT(priority, p);
1550 GETSHORT(weight, p);
1551 GETSHORT(port, p);
1552
1553 DEBUG(D_acl)
1554 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1555
1556 /* Check the CSA version number */
1557
1558 if (priority != 1) continue;
1559
1560 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1561 found by dns_special_lookup() is a parent of the one we asked for), we check
1562 the subdomain assertions in the port field. At the moment there's only one
1563 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1564 SRV records of their own. */
1565
1dc92d5a 1566 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1567 {
1568 if (port & 1)
1569 return t->data.val = CSA_FAIL_EXPLICIT;
1570 else
1571 return t->data.val = CSA_UNKNOWN;
1572 }
1573
1574 /* This CSA SRV record refers directly to our domain, so we check the value
1575 in the weight field to work out the domain's authorization. 0 and 1 are
1576 unauthorized; 3 means the client is authorized but we can't check the IP
1577 address in order to authenticate it, so we treat it as unknown; values
1578 greater than 3 are undefined. */
1579
1580 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1581
1582 if (weight > 2) continue;
1583
1584 /* Weight == 2, which means the domain is authorized. We must check that the
1585 client's IP address is listed as one of the SRV target addresses. Save the
1586 target hostname then break to scan the additional data for its addresses. */
1587
1588 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1589 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1590
1591 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1592
1593 break;
1594 }
1595
1596/* If we didn't break the loop then no appropriate records were found. */
1597
1598if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1599
1600/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1601A target of "." indicates there are no valid addresses, so the client cannot
1602be authorized. (This is an odd configuration because weight=2 target=. is
1603equivalent to weight=1, but we check for it in order to keep load off the
1604root name servers.) Note that dn_expand() turns "." into "". */
1605
1606if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1607
1608/* Scan the additional section of the CSA SRV reply for addresses belonging
1609to the target. If the name server didn't return any additional data (e.g.
1610because it does not fully support SRV records), we need to do another lookup
1611to obtain the target addresses; otherwise we have a definitive result. */
1612
1613rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1614if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1615
1616/* The DNS lookup type corresponds to the IP version used by the client. */
1617
1618#if HAVE_IPV6
1619if (Ustrchr(sender_host_address, ':') != NULL)
1620 type = T_AAAA;
1621else
1622#endif /* HAVE_IPV6 */
1623 type = T_A;
1624
1625
4e0983dc 1626lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1627switch (dns_lookup(&dnsa, target, type, NULL))
1628 {
1629 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1630
1631 default:
cc00f4af 1632 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1633
1634 /* If the query succeeded, scan the addresses and return the result. */
1635
1636 case DNS_SUCCEED:
cc00f4af
JH		 1637 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1638 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1639 /* else fall through */
e5a9dba6
PH		 1640
1641 /* If the target has no IP addresses, the client cannot have an authorized
1642 IP address. However, if the target site uses A6 records (not AAAA records)
1643 we have to do yet another lookup in order to check them. */
1644
1645 case DNS_NOMATCH:
1646 case DNS_NODATA:
cc00f4af 1647 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1648 }
1649}
1650
1651
1652
059ec3d9
PH		 1653/*************************************************
1654* Handle verification (address & other) *
1655*************************************************/
1656
89583014 1657enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1658 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1659 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1660 };
1661typedef struct {
1662 uschar * name;
1663 int value;
1664 unsigned where_allowed; /* bitmap */
1665 BOOL no_options; /* Never has /option(s) following */
1666 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1667 } verify_type_t;
1668static verify_type_t verify_type_list[] = {
7e8360e6 1669 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1670 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1671 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1672 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1673 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1674 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1675 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1676 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1677 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1678 FALSE, 6 },
770747fd
MFM		 1679 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1680 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1681 };
1682
1683
1684enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1685 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1686 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1687 CALLOUT_TIME
1688 };
1689typedef struct {
1690 uschar * name;
1691 int value;
1692 int flag;
1693 BOOL has_option; /* Has =option(s) following */
1694 BOOL timeval; /* Has a time value */
1695 } callout_opt_t;
1696static callout_opt_t callout_opt_list[] = {
1697 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1698 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1699 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1700 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1701 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1702 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1703 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1704 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1705 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1706 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1707 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1708 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1709 };
1710
1711
1712
059ec3d9
PH		 1713/* This function implements the "verify" condition. It is called when
1714encountered in any ACL, because some tests are almost always permitted. Some
1715just don't make sense, and always fail (for example, an attempt to test a host
1716lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1717
1718Arguments:
1719 where where called from
1720 addr the recipient address that the ACL is handling, or NULL
1721 arg the argument of "verify"
1722 user_msgptr pointer for user message
1723 log_msgptr pointer for log message
1724 basic_errno where to put verify errno
1725
1726Returns: OK verification condition succeeded
1727 FAIL verification failed
1728 DEFER there was a problem verifying
1729 ERROR syntax error
1730*/
1731
1732static int
55414b25 1733acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1734 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1735{
1736int sep = '/';
1737int callout = -1;
1738int callout_overall = -1;
4deaf07d 1739int callout_connect = -1;
059ec3d9
PH		 1740int verify_options = 0;
1741int rc;
1742BOOL verify_header_sender = FALSE;
1743BOOL defer_ok = FALSE;
1744BOOL callout_defer_ok = FALSE;
1745BOOL no_details = FALSE;
eafd343b 1746BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1747address_item *sender_vaddr = NULL;
1748uschar *verify_sender_address = NULL;
1749uschar *pm_mailfrom = NULL;
1750uschar *se_mailfrom = NULL;
596875b3
PH		 1751
1752/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1753an error if options are given for items that don't expect them.
596875b3
PH		 1754*/
1755
1756uschar *slash = Ustrchr(arg, '/');
55414b25 1757const uschar *list = arg;
059ec3d9 1758uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1759verify_type_t * vp;
059ec3d9
PH		 1760
1761if (ss == NULL) goto BAD_VERIFY;
1762
1763/* Handle name/address consistency verification in a separate function. */
1764
89583014
JH		 1765for (vp= verify_type_list;
1766 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1767 vp++
1768 )
1769 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1770 : strcmpic (ss, vp->name) == 0)
1771 break;
1772if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1773 goto BAD_VERIFY;
1774
1775if (vp->no_options && slash != NULL)
059ec3d9 1776 {
89583014
JH		 1777 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1778 "(this verify item has no options)", arg);
1779 return ERROR;
059ec3d9 1780 }
89583014 1781if (!(vp->where_allowed & (1<<where)))
059ec3d9 1782 {
89583014
JH		 1783 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786switch(vp->value)
596875b3 1787 {
89583014
JH		 1788 case VERIFY_REV_HOST_LKUP:
1789 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1790 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1791 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1792 if (strcmpic(ss, US"defer_ok") == 0)
1793 return OK;
1794 return rc;
059ec3d9 1795
89583014
JH		 1796 case VERIFY_CERT:
1797 /* TLS certificate verification is done at STARTTLS time; here we just
1798 test whether it was successful or not. (This is for optional verification; for
1799 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1800
3703d818
JH		 1801 if (tls_in.certificate_verified) return OK;
1802 *user_msgptr = US"no verified certificate";
1803 return FAIL;
e5a9dba6 1804
89583014
JH		 1805 case VERIFY_HELO:
1806 /* We can test the result of optional HELO verification that might have
1807 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1808
3703d818
JH		 1809 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1810 return helo_verified? OK : FAIL;
059ec3d9 1811
89583014
JH		 1812 case VERIFY_CSA:
1813 /* Do Client SMTP Authorization checks in a separate function, and turn the
1814 result code into user-friendly strings. */
1c41c9cc 1815
3703d818
JH		 1816 rc = acl_verify_csa(list);
1817 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1818 csa_reason_string[rc]);
3703d818
JH		 1819 csa_status = csa_status_string[rc];
1820 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1821 return csa_return_code[rc];
89583014
JH		 1822
1823 case VERIFY_HDR_SYNTAX:
1824 /* Check that all relevant header lines have the correct syntax. If there is
1825 a syntax error, we return details of the error to the sender if configured to
1826 send out full details. (But a "message" setting on the ACL can override, as
1827 always). */
1828
1829 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1830 if (rc != OK && *log_msgptr)
1831 if (smtp_return_error_details)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 else
1834 acl_verify_message = *log_msgptr;
89583014 1835 return rc;
059ec3d9 1836
770747fd
MFM		 1837 case VERIFY_HDR_NAMES_ASCII:
1838 /* Check that all header names are true 7 bit strings
1839 See RFC 5322, 2.2. and RFC 6532, 3. */
1840
1841 rc = verify_check_header_names_ascii(log_msgptr);
1842 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1843 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1844 return rc;
1845
89583014
JH		 1846 case VERIFY_NOT_BLIND:
1847 /* Check that no recipient of this message is "blind", that is, every envelope
1848 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1849
89583014
JH		 1850 rc = verify_check_notblind();
1851 if (rc != OK)
1852 {
1853 *log_msgptr = string_sprintf("bcc recipient detected");
1854 if (smtp_return_error_details)
1855 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1856 }
1857 return rc;
059ec3d9 1858
89583014
JH		 1859 /* The remaining verification tests check recipient and sender addresses,
1860 either from the envelope or from the header. There are a number of
1861 slash-separated options that are common to all of them. */
059ec3d9 1862
89583014
JH		 1863 case VERIFY_HDR_SNDR:
1864 verify_header_sender = TRUE;
1865 break;
059ec3d9 1866
89583014
JH		 1867 case VERIFY_SNDR:
1868 /* In the case of a sender, this can optionally be followed by an address to use
1869 in place of the actual sender (rare special-case requirement). */
059ec3d9 1870 {
89583014
JH		 1871 uschar *s = ss + 6;
1872 if (*s == 0)
1873 verify_sender_address = sender_address;
1874 else
1875 {
1876 while (isspace(*s)) s++;
1877 if (*s++ != '=') goto BAD_VERIFY;
1878 while (isspace(*s)) s++;
1879 verify_sender_address = string_copy(s);
1880 }
059ec3d9 1881 }
89583014
JH		 1882 break;
1883
1884 case VERIFY_RCPT:
1885 break;
059ec3d9
PH		 1886 }
1887
89583014
JH		 1888
1889
596875b3
PH		 1890/* Remaining items are optional; they apply to sender and recipient
1891verification, including "header sender" verification. */
059ec3d9
PH		 1892
1893while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1894 != NULL)
1895 {
1896 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1897 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1898 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1899
1900 /* These two old options are left for backwards compatibility */
1901
1902 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1903 {
1904 callout_defer_ok = TRUE;
1905 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1906 }
1907
1908 else if (strcmpic(ss, US"check_postmaster") == 0)
1909 {
1910 pm_mailfrom = US"";
1911 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1912 }
1913
1914 /* The callout option has a number of sub-options, comma separated */
1915
1916 else if (strncmpic(ss, US"callout", 7) == 0)
1917 {
1918 callout = CALLOUT_TIMEOUT_DEFAULT;
1919 ss += 7;
1920 if (*ss != 0)
1921 {
1922 while (isspace(*ss)) ss++;
1923 if (*ss++ == '=')
1924 {
55414b25 1925 const uschar * sublist = ss;
059ec3d9
PH		 1926 int optsep = ',';
1927 uschar *opt;
1928 uschar buffer[256];
55414b25 1929 while (isspace(*sublist)) sublist++;
8e669ac1 1930
55414b25 1931 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1932 != NULL)
1933 {
89583014 1934 callout_opt_t * op;
438257ba 1935 double period = 1.0F;
059ec3d9 1936
89583014 1937 for (op= callout_opt_list; op->name; op++)
438257ba 1938 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1939 break;
059ec3d9 1940
89583014
JH		 1941 verify_options |= op->flag;
1942 if (op->has_option)
1943 {
438257ba 1944 opt += Ustrlen(op->name);
4deaf07d
PH		 1945 while (isspace(*opt)) opt++;
1946 if (*opt++ != '=')
1947 {
1948 *log_msgptr = string_sprintf("'=' expected after "
89583014 1949 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1950 return ERROR;
1951 }
1952 while (isspace(*opt)) opt++;
89583014
JH		 1953 }
1954 if (op->timeval)
1955 {
1956 period = readconf_readtime(opt, 0, FALSE);
1957 if (period < 0)
4deaf07d
PH		 1958 {
1959 *log_msgptr = string_sprintf("bad time value in ACL condition "
1960 "\"verify %s\"", arg);
1961 return ERROR;
1962 }
89583014
JH		 1963 }
1964
1965 switch(op->value)
1966 {
1967 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1968 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1969 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1970 case CALLOUT_MAILFROM:
1971 if (!verify_header_sender)
1972 {
1973 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1974 "callout option only for verify=header_sender (detected in ACL "
1975 "condition \"%s\")", arg);
1976 return ERROR;
1977 }
1978 se_mailfrom = string_copy(opt);
1979 break;
1980 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1981 case CALLOUT_MAXWAIT: callout_overall = period; break;
1982 case CALLOUT_CONNECT: callout_connect = period; break;
1983 case CALLOUT_TIME: callout = period; break;
1984 }
059ec3d9
PH		 1985 }
1986 }
1987 else
1988 {
1989 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1990 "ACL condition \"%s\"", arg);
1991 return ERROR;
1992 }
1993 }
1994 }
1995
1996 /* Option not recognized */
1997
1998 else
1999 {
2000 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2001 "condition \"verify %s\"", ss, arg);
2002 return ERROR;
2003 }
2004 }
2005
2006if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2007 (vopt_callout_recipsender|vopt_callout_recippmaster))
2008 {
2009 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2010 "for a recipient callout";
2011 return ERROR;
2012 }
2013
2014/* Handle sender-in-header verification. Default the user message to the log
2015message if giving out verification details. */
2016
2017if (verify_header_sender)
2018 {
8e669ac1 2019 int verrno;
2f682e45
JH		 2020
2021 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 2022 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 2023 &verrno)) != OK)
8e669ac1 2024 {
fe5b5d0b
PH		 2025 *basic_errno = verrno;
2026 if (smtp_return_error_details)
2027 {
2f682e45 2028 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH		 2029 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2030 if (rc == DEFER) acl_temp_details = TRUE;
2031 }
8e669ac1 2032 }
059ec3d9
PH		 2033 }
2034
2035/* Handle a sender address. The default is to verify *the* sender address, but
2036optionally a different address can be given, for special requirements. If the
2037address is empty, we are dealing with a bounce message that has no sender, so
2038we cannot do any checking. If the real sender address gets rewritten during
2039verification (e.g. DNS widening), set the flag to stop it being rewritten again
2040during message reception.
2041
2042A list of verified "sender" addresses is kept to try to avoid doing to much
2043work repetitively when there are multiple recipients in a message and they all
2044require sender verification. However, when callouts are involved, it gets too
2045complicated because different recipients may require different callout options.
2046Therefore, we always do a full sender verify when any kind of callout is
2047specified. Caching elsewhere, for instance in the DNS resolver and in the
2048callout handling, should ensure that this is not terribly inefficient. */
2049
2f682e45 2050else if (verify_sender_address)
059ec3d9 2051 {
2f682e45 2052 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH		 2053 {
2054 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2055 "sender verify callout";
2056 return ERROR;
2057 }
2058
2059 sender_vaddr = verify_checked_sender(verify_sender_address);
2060 if (sender_vaddr != NULL && /* Previously checked */
2061 callout <= 0) /* No callout needed this time */
2062 {
2063 /* If the "routed" flag is set, it means that routing worked before, so
2064 this check can give OK (the saved return code value, if set, belongs to a
2065 callout that was done previously). If the "routed" flag is not set, routing
2066 must have failed, so we use the saved return code. */
2067
2f682e45
JH		 2068 if (testflag(sender_vaddr, af_verify_routed))
2069 rc = OK;
2070 else
059ec3d9
PH		 2071 {
2072 rc = sender_vaddr->special_action;
2073 *basic_errno = sender_vaddr->basic_errno;
2074 }
2075 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2076 }
2077
2078 /* Do a new verification, and cache the result. The cache is used to avoid
2079 verifying the sender multiple times for multiple RCPTs when callouts are not
2080 specified (see comments above).
2081
2082 The cache is also used on failure to give details in response to the first
2083 RCPT that gets bounced for this reason. However, this can be suppressed by
2084 the no_details option, which sets the flag that says "this detail has already
2085 been sent". The cache normally contains just one address, but there may be
2086 more in esoteric circumstances. */
2087
2088 else
2089 {
2090 BOOL routed = TRUE;
2a3eea10 2091 uschar *save_address_data = deliver_address_data;
8e669ac1 2092
059ec3d9 2093 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2094#ifdef SUPPORT_I18N
3c8b3577
JH		 2095 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2096 {
2097 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2098 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2099 }
f358d5e0 2100#endif
059ec3d9
PH		 2101 if (no_details) setflag(sender_vaddr, af_sverify_told);
2102 if (verify_sender_address[0] != 0)
2103 {
2104 /* If this is the real sender address, save the unrewritten version
2105 for use later in receive. Otherwise, set a flag so that rewriting the
2106 sender in verify_address() does not update sender_address. */
2107
2108 if (verify_sender_address == sender_address)
2109 sender_address_unrewritten = sender_address;
2110 else
2111 verify_options |= vopt_fake_sender;
2112
eafd343b
TK		 2113 if (success_on_redirect)
2114 verify_options |= vopt_success_on_redirect;
2115
059ec3d9
PH		 2116 /* The recipient, qualify, and expn options are never set in
2117 verify_options. */
2118
2119 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2120 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2121
2122 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2123
2f682e45
JH		 2124 if (rc != OK)
2125 *basic_errno = sender_vaddr->basic_errno;
2126 else
2127 DEBUG(D_acl)
2128 {
2129 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2130 debug_printf("sender %s verified ok as %s\n",
2131 verify_sender_address, sender_vaddr->address);
2132 else
2133 debug_printf("sender %s verified ok\n",
2134 verify_sender_address);
2135 }
059ec3d9 2136 }
2f682e45
JH		 2137 else
2138 rc = OK; /* Null sender */
059ec3d9
PH		 2139
2140 /* Cache the result code */
2141
2142 if (routed) setflag(sender_vaddr, af_verify_routed);
2143 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2144 sender_vaddr->special_action = rc;
2145 sender_vaddr->next = sender_verified_list;
2146 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2147
2148 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2149 the sender verification. */
8e669ac1 2150
2a3eea10 2151 deliver_address_data = save_address_data;
059ec3d9 2152 }
8e669ac1 2153
2a3eea10
PH		 2154 /* Put the sender address_data value into $sender_address_data */
2155
d43cbe25 2156 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2157 }
2158
2159/* A recipient address just gets a straightforward verify; again we must handle
2160the DEFER overrides. */
2161
2162else
2163 {
2164 address_item addr2;
2165
eafd343b
TK		 2166 if (success_on_redirect)
2167 verify_options |= vopt_success_on_redirect;
2168
059ec3d9
PH		 2169 /* We must use a copy of the address for verification, because it might
2170 get rewritten. */
2171
2172 addr2 = *addr;
2173 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2174 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2175 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2176
42855d71 2177 *basic_errno = addr2.basic_errno;
059ec3d9 2178 *log_msgptr = addr2.message;
8e669ac1 2179 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2180 addr2.user_message : addr2.message;
42855d71
PH		 2181
2182 /* Allow details for temporary error if the address is so flagged. */
2183 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2184
2185 /* Make $address_data visible */
d43cbe25 2186 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2187 }
2188
2189/* We have a result from the relevant test. Handle defer overrides first. */
2190
2191if (rc == DEFER && (defer_ok ||
2192 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2193 {
2194 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2195 defer_ok? "defer_ok" : "callout_defer_ok");
2196 rc = OK;
2197 }
2198
2199/* If we've failed a sender, set up a recipient message, and point
2200sender_verified_failed to the address item that actually failed. */
2201
2202if (rc != OK && verify_sender_address != NULL)
2203 {
2204 if (rc != DEFER)
059ec3d9 2205 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2206 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2208 else
2209 {
2210 *log_msgptr = US"Could not complete sender verify callout";
2211 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2212 *log_msgptr;
2213 }
2214
2215 sender_verified_failed = sender_vaddr;
2216 }
2217
2218/* Verifying an address messes up the values of $domain and $local_part,
2219so reset them before returning if this is a RCPT ACL. */
2220
2221if (addr != NULL)
2222 {
2223 deliver_domain = addr->domain;
2224 deliver_localpart = addr->local_part;
2225 }
2226return rc;
2227
2228/* Syntax errors in the verify argument come here. */
2229
2230BAD_VERIFY:
2231*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2232 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2233 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2234 "\"verify %s\"", arg);
2235return ERROR;
2236}
2237
2238
2239
2240
2241/*************************************************
2242* Check argument for control= modifier *
2243*************************************************/
2244
2245/* Called from acl_check_condition() below
2246
2247Arguments:
2248 arg the argument string for control=
2249 pptr set to point to the terminating character
2250 where which ACL we are in
2251 log_msgptr for error messages
2252
2253Returns: CONTROL_xxx value
2254*/
2255
2256static int
55414b25 2257decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2258{
2259int len;
2260control_def *d;
2261
2262for (d = controls_list;
2263 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2264 d++)
2265 {
2266 len = Ustrlen(d->name);
2267 if (Ustrncmp(d->name, arg, len) == 0) break;
2268 }
2269
2270if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2271 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2272 {
2273 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2274 return CONTROL_ERROR;
2275 }
2276
059ec3d9
PH		 2277*pptr = arg + len;
2278return d->value;
2279}
2280
2281
2282
c99ce5c9
TF		 2283
2284/*************************************************
2285* Return a ratelimit error *
2286*************************************************/
2287
2288/* Called from acl_ratelimit() below
2289
2290Arguments:
2291 log_msgptr for error messages
2292 format format string
2293 ... supplementary arguments
2294 ss ratelimit option name
2295 where ACL_WHERE_xxxx indicating which ACL this is
2296
2297Returns: ERROR
2298*/
2299
2300static int
2301ratelimit_error(uschar **log_msgptr, const char *format, ...)
2302{
2303va_list ap;
2304uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2305va_start(ap, format);
2306if (!string_vformat(buffer, sizeof(buffer), format, ap))
2307 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2308 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2309va_end(ap);
2310*log_msgptr = string_sprintf(
2311 "error in arguments to \"ratelimit\" condition: %s", buffer);
2312return ERROR;
2313}
2314
2315
2316
2317
870f6ba8
TF		 2318/*************************************************
2319* Handle rate limiting *
2320*************************************************/
2321
2322/* Called by acl_check_condition() below to calculate the result
2323of the ACL ratelimit condition.
2324
2325Note that the return value might be slightly unexpected: if the
2326sender's rate is above the limit then the result is OK. This is
2327similar to the dnslists condition, and is so that you can write
2328ACL clauses like: defer ratelimit = 15 / 1h
2329
2330Arguments:
2331 arg the option string for ratelimit=
90fc3069 2332 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2333 log_msgptr for error messages
2334
2335Returns: OK - Sender's rate is above limit
2336 FAIL - Sender's rate is below limit
2337 DEFER - Problem opening ratelimit database
2338 ERROR - Syntax error in options.
2339*/
2340
2341static int
55414b25 2342acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2343{
c99ce5c9 2344double limit, period, count;
8f240103
PH		 2345uschar *ss;
2346uschar *key = NULL;
c99ce5c9 2347uschar *unique = NULL;
870f6ba8 2348int sep = '/';
c99ce5c9
TF		 2349BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2350BOOL noupdate = FALSE, badacl = FALSE;
2351int mode = RATE_PER_WHAT;
870f6ba8
TF		 2352int old_pool, rc;
2353tree_node **anchor, *t;
2354open_db dbblock, *dbm;
c99ce5c9 2355int dbdb_size;
870f6ba8 2356dbdata_ratelimit *dbd;
c99ce5c9 2357dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2358struct timeval tv;
2359
2360/* Parse the first two options and record their values in expansion
2361variables. These variables allow the configuration to have informative
2362error messages based on rate limits obtained from a table lookup. */
2363
c99ce5c9 2364/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2365size, which must be greater than or equal to zero. Zero is useful for
2366rate measurement as opposed to rate limiting. */
2367
2368sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2369if (sender_rate_limit == NULL)
96f5fe4c
JH		 2370 return ratelimit_error(log_msgptr, "sender rate limit not set");
2371
2372limit = Ustrtod(sender_rate_limit, &ss);
2373if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2374else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2375else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2376
c99ce5c9
TF		 2377if (limit < 0.0 || *ss != '\0')
2378 return ratelimit_error(log_msgptr,
2379 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2380
c99ce5c9 2381/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2382constant. This must be strictly greater than zero, because zero leads to
2383run-time division errors. */
2384
2385sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2386if (sender_rate_period == NULL) period = -1.0;
2387else period = readconf_readtime(sender_rate_period, 0, FALSE);
2388if (period <= 0.0)
c99ce5c9
TF		 2389 return ratelimit_error(log_msgptr,
2390 "\"%s\" is not a time value", sender_rate_period);
2391
2392/* By default we are counting one of something, but the per_rcpt,
2393per_byte, and count options can change this. */
2394
2395count = 1.0;
870f6ba8 2396
c99ce5c9 2397/* Parse the other options. */
870f6ba8
TF		 2398
2399while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2400 != NULL)
2401 {
2402 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2403 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2404 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2405 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2406 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2407 else if (strcmpic(ss, US"per_conn") == 0)
2408 {
2409 RATE_SET(mode, PER_CONN);
2410 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2411 badacl = TRUE;
2412 }
2413 else if (strcmpic(ss, US"per_mail") == 0)
2414 {
2415 RATE_SET(mode, PER_MAIL);
2416 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2417 }
2418 else if (strcmpic(ss, US"per_rcpt") == 0)
2419 {
2420 /* If we are running in the RCPT ACL, then we'll count the recipients
2421 one by one, but if we are running when we have accumulated the whole
2422 list then we'll add them all in one batch. */
2423 if (where == ACL_WHERE_RCPT)
2424 RATE_SET(mode, PER_RCPT);
2425 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2426 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2427 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2429 }
2430 else if (strcmpic(ss, US"per_byte") == 0)
2431 {
2432 /* If we have not yet received the message data and there was no SIZE
2433 declaration on the MAIL comand, then it's safe to just use a value of
2434 zero and let the recorded rate decay as if nothing happened. */
2435 RATE_SET(mode, PER_MAIL);
2436 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2437 else count = message_size < 0 ? 0.0 : (double)message_size;
2438 }
2439 else if (strcmpic(ss, US"per_addr") == 0)
2440 {
2441 RATE_SET(mode, PER_RCPT);
438257ba 2442 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2443 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2444 }
2445 else if (strncmpic(ss, US"count=", 6) == 0)
2446 {
2447 uschar *e;
2448 count = Ustrtod(ss+6, &e);
2449 if (count < 0.0 || *e != '\0')
2450 return ratelimit_error(log_msgptr,
2451 "\"%s\" is not a positive number", ss);
2452 }
2453 else if (strncmpic(ss, US"unique=", 7) == 0)
2454 unique = string_copy(ss + 7);
2455 else if (key == NULL)
2456 key = string_copy(ss);
2457 else
2458 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2459 }
2460
c99ce5c9
TF		 2461/* Sanity check. When the badacl flag is set the update mode must either
2462be readonly (which is the default if it is omitted) or, for backwards
2463compatibility, a combination of noupdate and strict or leaky. */
2464
2465if (mode == RATE_PER_CLASH)
2466 return ratelimit_error(log_msgptr, "conflicting per_* options");
2467if (leaky + strict + readonly > 1)
2468 return ratelimit_error(log_msgptr, "conflicting update modes");
2469if (badacl && (leaky || strict) && !noupdate)
2470 return ratelimit_error(log_msgptr,
2471 "\"%s\" must not have /leaky or /strict option in %s ACL",
2472 ratelimit_option_string[mode], acl_wherenames[where]);
2473
2474/* Set the default values of any unset options. In readonly mode we
2475perform the rate computation without any increment so that its value
2476decays to eventually allow over-limit senders through. */
2477
2478if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2479if (badacl) readonly = TRUE;
2480if (readonly) count = 0.0;
2481if (!strict && !readonly) leaky = TRUE;
2482if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2483
8f240103
PH		 2484/* Create the lookup key. If there is no explicit key, use sender_host_address.
2485If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2486omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2487are added to the key because they alter the meaning of the stored data. */
2488
2489if (key == NULL)
2490 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2491
c99ce5c9 2492key = string_sprintf("%s/%s/%s%s",
8f240103 2493 sender_rate_period,
c99ce5c9
TF		 2494 ratelimit_option_string[mode],
2495 unique == NULL ? "" : "unique/",
8f240103 2496 key);
870f6ba8 2497
c99ce5c9
TF		 2498HDEBUG(D_acl)
2499 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2500
8f240103
PH		 2501/* See if we have already computed the rate by looking in the relevant tree.
2502For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2503pool so that they survive across resets. In readonly mode we only remember the
2504result for the rest of this command in case a later command changes it. After
2505this bit of logic the code is independent of the per_* mode. */
870f6ba8 2506
870f6ba8
TF		 2507old_pool = store_pool;
2508
c99ce5c9
TF		 2509if (readonly)
2510 anchor = &ratelimiters_cmd;
2511else switch(mode) {
2512case RATE_PER_CONN:
870f6ba8
TF		 2513 anchor = &ratelimiters_conn;
2514 store_pool = POOL_PERM;
c99ce5c9
TF		 2515 break;
2516case RATE_PER_BYTE:
2517case RATE_PER_MAIL:
2518case RATE_PER_ALLRCPTS:
870f6ba8 2519 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2520 break;
2521case RATE_PER_ADDR:
2522case RATE_PER_CMD:
2523case RATE_PER_RCPT:
fe0dab11 2524 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2525 break;
2526default:
3399bb60 2527 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2528 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2529 "internal ACL error: unknown ratelimit mode %d", mode);
2530 break;
2531}
870f6ba8 2532
c99ce5c9
TF		 2533t = tree_search(*anchor, key);
2534if (t != NULL)
870f6ba8
TF		 2535 {
2536 dbd = t->data.ptr;
2537 /* The following few lines duplicate some of the code below. */
8f240103 2538 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2539 store_pool = old_pool;
2540 sender_rate = string_sprintf("%.1f", dbd->rate);
2541 HDEBUG(D_acl)
2542 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2543 return rc;
2544 }
2545
c99ce5c9
TF		 2546/* We aren't using a pre-computed rate, so get a previously recorded rate
2547from the database, which will be updated and written back if required. */
870f6ba8
TF		 2548
2549dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2550if (dbm == NULL)
2551 {
2552 store_pool = old_pool;
2553 sender_rate = NULL;
2554 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2556 return DEFER;
2557 }
c99ce5c9
TF		 2558dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2559dbd = NULL;
870f6ba8
TF		 2560
2561gettimeofday(&tv, NULL);
2562
c99ce5c9
TF		 2563if (dbdb != NULL)
2564 {
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2567 dbd = &dbdb->dbd;
2568
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2573
2574 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2575 {
2576 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2577 dbdb = NULL;
2578 }
2579
2580 /* Sanity check. */
2581
2582 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2583 {
2584 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2585 dbdb = NULL;
2586 }
2587 }
2588
2589/* Allocate a new data block if the database lookup failed
2590or the Bloom filter passed its age limit. */
2591
2592if (dbdb == NULL)
2593 {
2594 if (unique == NULL)
2595 {
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size);
2600 }
2601 else
2602 {
2603 int extra;
2604 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2605
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2609
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2617
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2620
2621 if (dbd != NULL)
2622 {
2623 dbdb->dbd = *dbd;
2624 dbd = &dbdb->dbd;
2625 }
2626 }
2627 }
2628
2629/* If we are counting unique events, find out if this event is new or not.
2630If the client repeats the event during the current period then it should be
2631counted. We skip this code in readonly mode for efficiency, because any
2632changes to the filter will be discarded and because count is already set to
2633zero. */
2634
2635if (unique != NULL && !readonly)
2636 {
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2642
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2648
2649 size = limit * 16
2650 numhash = 8
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2654
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2657
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2661
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2664
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2669
2670 BOOL seen;
2671 unsigned n, hash, hinc;
2672 uschar md5sum[16];
2673 md5 md5info;
2674
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2679
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2684
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2687
2688 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2689
2690 seen = TRUE;
2691 for (n = 0; n < 8; n++, hash += hinc)
2692 {
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2696 {
2697 dbdb->bloom[byte] |= bit;
2698 seen = FALSE;
2699 }
2700 }
2701
2702 /* If this event has occurred before, do not count it. */
2703
2704 if (seen)
2705 {
2706 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2707 count = 0.0;
2708 }
2709 else
2710 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2711 }
2712
2713/* If there was no previous ratelimit data block for this key, initialize
2714the new one, otherwise update the block from the database. The initial rate
2715is what would be computed by the code below for an infinite interval. */
2716
870f6ba8
TF		 2717if (dbd == NULL)
2718 {
c99ce5c9
TF		 2719 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2720 dbd = &dbdb->dbd;
870f6ba8
TF		 2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
c99ce5c9 2723 dbd->rate = count;
870f6ba8
TF		 2724 }
2725else
2726 {
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2731
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2737
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2741
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2746
2747 rate_1 = (1 - a) * p/i + a * rate_0
2748 = k + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2755
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2757
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2762
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2768
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2773
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2776 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2777
e5d5a95f
TF		 2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2780
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
870f6ba8 2783
c99ce5c9
TF		 2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2787
870f6ba8
TF		 2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2791
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-intialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2801
2802 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2803 }
2804
c99ce5c9
TF		 2805/* Clients sending at the limit are considered to be over the limit.
2806This matters for edge cases such as a limit of zero, when the client
2807should be completely blocked. */
3348576f 2808
8f240103 2809rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2810
2811/* Update the state if the rate is low or if we are being strict. If we
2812are in leaky mode and the sender's rate is too high, we do not update
2813the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2814rate preventing them from getting any email through. If readonly is set,
2815neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2816
c99ce5c9 2817if ((rc == FAIL && leaky) || strict)
8f240103 2818 {
c99ce5c9 2819 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2820 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2821 }
2822else
2823 {
2824 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2825 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2826 }
2827
870f6ba8
TF		 2828dbfn_close(dbm);
2829
c99ce5c9 2830/* Store the result in the tree for future reference. */
870f6ba8 2831
c99ce5c9
TF		 2832t = store_get(sizeof(tree_node) + Ustrlen(key));
2833t->data.ptr = dbd;
2834Ustrcpy(t->name, key);
2835(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2836
2837/* We create the formatted version of the sender's rate very late in
2838order to ensure that it is done using the correct storage pool. */
2839
2840store_pool = old_pool;
2841sender_rate = string_sprintf("%.1f", dbd->rate);
2842
2843HDEBUG(D_acl)
2844 debug_printf("ratelimit computed rate %s\n", sender_rate);
2845
2846return rc;
2847}
2848
2849
2850
b0019c78
TF		 2851/*************************************************
2852* The udpsend ACL modifier *
2853*************************************************/
2854
2855/* Called by acl_check_condition() below.
2856
2857Arguments:
2858 arg the option string for udpsend=
2859 log_msgptr for error messages
2860
2861Returns: OK - Completed.
2862 DEFER - Problem with DNS lookup.
2863 ERROR - Syntax error in options.
2864*/
2865
2866static int
55414b25 2867acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2868{
2869int sep = 0;
2870uschar *hostname;
2871uschar *portstr;
2872uschar *portend;
2873host_item *h;
2874int portnum;
b0019c78
TF		 2875int len;
2876int r, s;
b1f8e4f8 2877uschar * errstr;
b0019c78
TF		 2878
2879hostname = string_nextinlist(&arg, &sep, NULL, 0);
2880portstr = string_nextinlist(&arg, &sep, NULL, 0);
2881
2882if (hostname == NULL)
2883 {
217b0e56 2884 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2885 return ERROR;
2886 }
2887if (portstr == NULL)
2888 {
217b0e56 2889 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2890 return ERROR;
2891 }
2892if (arg == NULL)
2893 {
217b0e56 2894 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2895 return ERROR;
2896 }
2897portnum = Ustrtol(portstr, &portend, 10);
2898if (*portend != '\0')
2899 {
217b0e56 2900 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2901 return ERROR;
2902 }
2903
2904/* Make a single-item host list. */
2905h = store_get(sizeof(host_item));
2906memset(h, 0, sizeof(host_item));
2907h->name = hostname;
2908h->port = portnum;
2909h->mx = MX_NONE;
2910
2911if (string_is_ip_address(hostname, NULL))
2912 h->address = hostname, r = HOST_FOUND;
2913else
2914 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2915if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2916 {
217b0e56 2917 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2918 return DEFER;
2919 }
2920
2921HDEBUG(D_acl)
2922 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2923
b1f8e4f8
JH		 2924r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2925 1, NULL, &errstr);
b0019c78 2926if (r < 0) goto defer;
27f9999e 2927len = Ustrlen(arg);
9cb1785a 2928r = send(s, arg, len, 0);
b1f8e4f8
JH		 2929if (r < 0)
2930 {
2931 errstr = US strerror(errno);
2932 close(s);
2933 goto defer;
2934 }
2935close(s);
b0019c78
TF		 2936if (r < len)
2937 {
2938 *log_msgptr =
2939 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2940 return DEFER;
2941 }
2942
2943HDEBUG(D_acl)
2944 debug_printf("udpsend %d bytes\n", r);
2945
2946return OK;
2947
2948defer:
b1f8e4f8 2949*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2950return DEFER;
2951}
2952
2953
2954
059ec3d9
PH		 2955/*************************************************
2956* Handle conditions/modifiers on an ACL item *
2957*************************************************/
2958
2959/* Called from acl_check() below.
2960
2961Arguments:
2962 verb ACL verb
2963 cb ACL condition block - if NULL, result is OK
2964 where where called from
2965 addr the address being checked for RCPT, or NULL
2966 level the nesting level
2967 epp pointer to pass back TRUE if "endpass" encountered
2968 (applies only to "accept" and "discard")
2969 user_msgptr user message pointer
2970 log_msgptr log message pointer
2971 basic_errno pointer to where to put verify error
2972
2973Returns: OK - all conditions are met
2974 DISCARD - an "acl" condition returned DISCARD - only allowed
2975 for "accept" or "discard" verbs
2976 FAIL - at least one condition fails
2977 FAIL_DROP - an "acl" condition returned FAIL_DROP
2978 DEFER - can't tell at the moment (typically, lookup defer,
2979 but can be temporary callout problem)
2980 ERROR - ERROR from nested ACL or expansion failure or other
2981 error
2982*/
2983
2984static int
2985acl_check_condition(int verb, acl_condition_block *cb, int where,
2986 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2987 uschar **log_msgptr, int *basic_errno)
2988{
2989uschar *user_message = NULL;
2990uschar *log_message = NULL;
059ec3d9 2991int rc = OK;
8523533c 2992#ifdef WITH_CONTENT_SCAN
0f0c8159 2993int sep = -'/';
8523533c 2994#endif
059ec3d9
PH		 2995
2996for (; cb != NULL; cb = cb->next)
2997 {
55414b25 2998 const uschar *arg;
8e669ac1 2999 int control_type;
059ec3d9
PH		 3000
3001 /* The message and log_message items set up messages to be used in
3002 case of rejection. They are expanded later. */
3003
3004 if (cb->type == ACLC_MESSAGE)
3005 {
187bc588 3006 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3007 user_message = cb->arg;
3008 continue;
3009 }
3010
3011 if (cb->type == ACLC_LOG_MESSAGE)
3012 {
187bc588 3013 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3014 log_message = cb->arg;
3015 continue;
3016 }
3017
3018 /* The endpass "condition" just sets a flag to show it occurred. This is
3019 checked at compile time to be on an "accept" or "discard" item. */
3020
3021 if (cb->type == ACLC_ENDPASS)
3022 {
3023 *epp = TRUE;
3024 continue;
3025 }
3026
3027 /* For other conditions and modifiers, the argument is expanded now for some
3028 of them, but not for all, because expansion happens down in some lower level
3029 checking functions in some cases. */
3030
3031 if (cond_expand_at_top[cb->type])
3032 {
3033 arg = expand_string(cb->arg);
3034 if (arg == NULL)
3035 {
3036 if (expand_string_forcedfail) continue;
3037 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3038 cb->arg, expand_string_message);
3039 return search_find_defer? DEFER : ERROR;
3040 }
3041 }
3042 else arg = cb->arg;
3043
3044 /* Show condition, and expanded condition if it's different */
3045
3046 HDEBUG(D_acl)
3047 {
3048 int lhswidth = 0;
3049 debug_printf("check %s%s %n",
3050 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3051 conditions[cb->type], &lhswidth);
3052
3053 if (cb->type == ACLC_SET)
3054 {
38a0a95f
PH		 3055 debug_printf("acl_%s ", cb->u.varname);
3056 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3057 }
3058
3059 debug_printf("= %s\n", cb->arg);
3060
3061 if (arg != cb->arg)
3062 debug_printf("%.*s= %s\n", lhswidth,
3063 US" ", CS arg);
3064 }
3065
3066 /* Check that this condition makes sense at this time */
3067
3068 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3069 {
3070 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3071 cond_modifiers[cb->type]? "use" : "test",
3072 conditions[cb->type], acl_wherenames[where]);
3073 return ERROR;
3074 }
3075
3076 /* Run the appropriate test for each condition, or take the appropriate
3077 action for the remaining modifiers. */
3078
3079 switch(cb->type)
3080 {
71fafd95
PH		 3081 case ACLC_ADD_HEADER:
3082 setup_header(arg);
3083 break;
3084
059ec3d9
PH		 3085 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3086 "discard" verb. */
71fafd95 3087
059ec3d9 3088 case ACLC_ACL:
f60d98e8 3089 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3090 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3091 {
3092 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3093 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3094 verbs[verb]);
3095 return ERROR;
3096 }
059ec3d9
PH		 3097 break;
3098
3099 case ACLC_AUTHENTICATED:
3100 rc = (sender_host_authenticated == NULL)? FAIL :
3101 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3102 TRUE, NULL);
3103 break;
3104
71fafd95 3105 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3106 case ACLC_BMI_OPTIN:
3107 {
3108 int old_pool = store_pool;
3109 store_pool = POOL_PERM;
3110 bmi_current_optin = string_copy(arg);
3111 store_pool = old_pool;
3112 }
3113 break;
71fafd95 3114 #endif
8523533c 3115
059ec3d9 3116 case ACLC_CONDITION:
f3766eb5
NM		 3117 /* The true/false parsing here should be kept in sync with that used in
3118 expand.c when dealing with ECOND_BOOL so that we don't have too many
3119 different definitions of what can be a boolean. */
51c7471d
JH		 3120 if (*arg == '-'
3121 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3122 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3123 rc = (Uatoi(arg) == 0)? FAIL : OK;
3124 else
3125 rc = (strcmpic(arg, US"no") == 0 ||
3126 strcmpic(arg, US"false") == 0)? FAIL :
3127 (strcmpic(arg, US"yes") == 0 ||
3128 strcmpic(arg, US"true") == 0)? OK : DEFER;
3129 if (rc == DEFER)
3130 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3131 break;
3132
c3611384
PH		 3133 case ACLC_CONTINUE: /* Always succeeds */
3134 break;
3135
059ec3d9 3136 case ACLC_CONTROL:
c5fcb476 3137 {
55414b25
JH		 3138 const uschar *p = NULL;
3139 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3140
55414b25 3141 /* Check if this control makes sense at this time */
f7572e5a 3142
55414b25
JH		 3143 if ((control_forbids[control_type] & (1 << where)) != 0)
3144 {
3145 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3146 controls[control_type], acl_wherenames[where]);
3147 return ERROR;
3148 }
8800895a 3149
55414b25
JH		 3150 switch(control_type)
3151 {
3152 case CONTROL_AUTH_UNADVERTISED:
3153 allow_auth_unadvertised = TRUE;
3154 break;
3155
3156 #ifdef EXPERIMENTAL_BRIGHTMAIL
3157 case CONTROL_BMI_RUN:
3158 bmi_run = 1;
3159 break;
3160 #endif
3161
3162 #ifndef DISABLE_DKIM
3163 case CONTROL_DKIM_VERIFY:
3164 dkim_disable_verify = TRUE;
3165 #ifdef EXPERIMENTAL_DMARC
3166 /* Since DKIM was blocked, skip DMARC too */
3167 dmarc_disable_verify = TRUE;
3168 dmarc_enable_forensic = FALSE;
3169 #endif
3170 break;
3171 #endif
3172
3173 #ifdef EXPERIMENTAL_DMARC
3174 case CONTROL_DMARC_VERIFY:
3175 dmarc_disable_verify = TRUE;
3176 break;
3177
3178 case CONTROL_DMARC_FORENSIC:
3179 dmarc_enable_forensic = TRUE;
3180 break;
3181 #endif
3182
3183 case CONTROL_DSCP:
3184 if (*p == '/')
3185 {
3186 int fd, af, level, optname, value;
3187 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3188 a socket; we can accept that, we'll just debug-log failures anyway. */
3189 fd = fileno(smtp_in);
3190 af = ip_get_address_family(fd);
3191 if (af < 0)
3192 {
3193 HDEBUG(D_acl)
3194 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3195 strerror(errno));
3196 break;
3197 }
3198 if (dscp_lookup(p+1, af, &level, &optname, &value))
3199 {
3200 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3201 {
3202 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3203 p+1, strerror(errno));
3204 }
3205 else
3206 {
3207 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3208 }
3209 }
3210 else
3211 {
3212 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3213 return ERROR;
3214 }
3215 }
3216 else
3217 {
3218 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3219 return ERROR;
3220 }
3221 break;
3222
3223 case CONTROL_ERROR:
3224 return ERROR;
3225
3226 case CONTROL_CASEFUL_LOCAL_PART:
3227 deliver_localpart = addr->cc_local_part;
3228 break;
3229
3230 case CONTROL_CASELOWER_LOCAL_PART:
3231 deliver_localpart = addr->lc_local_part;
3232 break;
3233
3234 case CONTROL_ENFORCE_SYNC:
3235 smtp_enforce_sync = TRUE;
3236 break;
3237
3238 case CONTROL_NO_ENFORCE_SYNC:
3239 smtp_enforce_sync = FALSE;
3240 break;
3241
3242 #ifdef WITH_CONTENT_SCAN
3243 case CONTROL_NO_MBOX_UNSPOOL:
3244 no_mbox_unspool = TRUE;
3245 break;
3246 #endif
3247
3248 case CONTROL_NO_MULTILINE:
3249 no_multiline_responses = TRUE;
3250 break;
3251
3252 case CONTROL_NO_PIPELINING:
3253 pipelining_enable = FALSE;
3254 break;
3255
3256 case CONTROL_NO_DELAY_FLUSH:
3257 disable_delay_flush = TRUE;
3258 break;
3259
3260 case CONTROL_NO_CALLOUT_FLUSH:
3261 disable_callout_flush = TRUE;
3262 break;
3263
3264 case CONTROL_FAKEREJECT:
3265 cancel_cutthrough_connection("fakereject");
3266 case CONTROL_FAKEDEFER:
3267 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3268 if (*p == '/')
3269 {
3270 const uschar *pp = p + 1;
3271 while (*pp != 0) pp++;
3272 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3273 p = pp;
3274 }
3275 else
3276 {
3277 /* Explicitly reset to default string */
3278 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3279 }
3280 break;
ed7f7860 3281
55414b25
JH		 3282 case CONTROL_FREEZE:
3283 deliver_freeze = TRUE;
3284 deliver_frozen_at = time(NULL);
3285 freeze_tell = freeze_tell_config; /* Reset to configured value */
3286 if (Ustrncmp(p, "/no_tell", 8) == 0)
3287 {
3288 p += 8;
3289 freeze_tell = NULL;
3290 }
3291 if (*p != 0)
3292 {
3293 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3294 return ERROR;
3295 }
3296 cancel_cutthrough_connection("item frozen");
3297 break;
3298
3299 case CONTROL_QUEUE_ONLY:
3300 queue_only_policy = TRUE;
3301 cancel_cutthrough_connection("queueing forced");
3302 break;
3303
3304 case CONTROL_SUBMISSION:
3305 originator_name = US"";
3306 submission_mode = TRUE;
3307 while (*p == '/')
3308 {
3309 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3310 {
3311 p += 14;
3312 active_local_sender_retain = TRUE;
3313 active_local_from_check = FALSE;
3314 }
3315 else if (Ustrncmp(p, "/domain=", 8) == 0)
3316 {
3317 const uschar *pp = p + 8;
3318 while (*pp != 0 && *pp != '/') pp++;
3319 submission_domain = string_copyn(p+8, pp-p-8);
3320 p = pp;
3321 }
3322 /* The name= option must be last, because it swallows the rest of
3323 the string. */
3324 else if (Ustrncmp(p, "/name=", 6) == 0)
3325 {
3326 const uschar *pp = p + 6;
3327 while (*pp != 0) pp++;
3328 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3329 big_buffer, big_buffer_size));
3330 p = pp;
3331 }
3332 else break;
3333 }
3334 if (*p != 0)
3335 {
3336 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3337 return ERROR;
3338 }
3339 break;
e4bdf652 3340
55414b25 3341 case CONTROL_DEBUG:
55414b25 3342 {
b0d68adc
JH		 3343 uschar * debug_tag = NULL;
3344 uschar * debug_opts = NULL;
3345 BOOL kill = FALSE;
3346
3347 while (*p == '/')
55414b25 3348 {
b0d68adc
JH		 3349 const uschar * pp = p+1;
3350 if (Ustrncmp(pp, "tag=", 4) == 0)
3351 {
3352 for (pp += 4; *pp && *pp != '/';) pp++;
3353 debug_tag = string_copyn(p+5, pp-p-5);
3354 }
3355 else if (Ustrncmp(pp, "opts=", 5) == 0)
3356 {
3357 for (pp += 5; *pp && *pp != '/';) pp++;
3358 debug_opts = string_copyn(p+6, pp-p-6);
3359 }
3360 else if (Ustrncmp(pp, "kill", 4) == 0)
3361 {
3362 for (pp += 4; *pp && *pp != '/';) pp++;
3363 kill = TRUE;
3364 }
3365 else
3366 while (*pp && *pp != '/') pp++;
55414b25
JH		 3367 p = pp;
3368 }
b0d68adc
JH		 3369
3370 if (kill)
3371 debug_logging_stop();
3372 else
3373 debug_logging_activate(debug_tag, debug_opts);
55414b25 3374 }
55414b25
JH		 3375 break;
3376
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 suppress_local_fixups = TRUE;
3379 break;
3380
3381 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3382#ifndef DISABLE_PRDR
55414b25 3383 if (prdr_requested)
a2b89db1
PP		 3384#else
3385 if (0)
3386#endif
55414b25
JH		 3387 /* Too hard to think about for now. We might in future cutthrough
3388 the case where both sides handle prdr and this-node prdr acl
3389 is "accept" */
93a6fce2 3390 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3391 else
3392 {
55414b25
JH		 3393 if (deliver_freeze)
3394 *log_msgptr = US"frozen";
3395 else if (queue_only_policy)
3396 *log_msgptr = US"queue-only";
3397 else if (fake_response == FAIL)
3398 *log_msgptr = US"fakereject";
3399 else
3400 {
ff5929e3
JH		 3401 if (rcpt_count == 1)
3402 {
3403 cutthrough.delivery = TRUE;
3404 while (*p == '/')
3405 {
3406 const uschar * pp = p+1;
3407 if (Ustrncmp(pp, "defer=", 6) == 0)
3408 {
3409 pp += 6;
3410 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3411 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3412 }
3413 else
3414 while (*pp && *pp != '/') pp++;
3415 p = pp;
3416 }
3417 }
55414b25
JH		 3418 break;
3419 }
3420 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3421 arg, *log_msgptr);
5032d1cf 3422 }
55414b25 3423 return ERROR;
3c8b3577 3424
8c5d388a 3425#ifdef SUPPORT_I18N
3c8b3577
JH		 3426 case CONTROL_UTF8_DOWNCONVERT:
3427 if (*p == '/')
3428 {
921dfc11
JH		 3429 if (p[1] == '1')
3430 {
3431 message_utf8_downconvert = 1;
3432 addr->prop.utf8_downcvt = TRUE;
3433 addr->prop.utf8_downcvt_maybe = FALSE;
3434 p += 2;
3435 break;
3436 }
3437 if (p[1] == '0')
3438 {
3439 message_utf8_downconvert = 0;
3440 addr->prop.utf8_downcvt = FALSE;
3441 addr->prop.utf8_downcvt_maybe = FALSE;
3442 p += 2;
3443 break;
3444 }
3c8b3577 3445 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3446 {
3447 message_utf8_downconvert = -1;
3448 addr->prop.utf8_downcvt = FALSE;
3449 addr->prop.utf8_downcvt_maybe = TRUE;
3450 p += 3;
3451 break;
3452 }
3c8b3577
JH		 3453 *log_msgptr = US"bad option value for control=utf8_downconvert";
3454 }
3455 else
3456 {
921dfc11
JH		 3457 message_utf8_downconvert = 1;
3458 addr->prop.utf8_downcvt = TRUE;
3459 addr->prop.utf8_downcvt_maybe = FALSE;
3460 break;
3c8b3577
JH		 3461 }
3462 return ERROR;
8c5d388a 3463#endif
3c8b3577 3464
9171d434 3465 }
55414b25 3466 break;
059ec3d9 3467 }
059ec3d9 3468
6a8f9482
TK		 3469 #ifdef EXPERIMENTAL_DCC
3470 case ACLC_DCC:
3471 {
3472 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3473 const uschar * list = arg;
3474 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3475 /* Run the dcc backend. */
3476 rc = dcc_process(&ss);
3477 /* Modify return code based upon the existance of options. */
3c8b3577 3478 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3479 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3480 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3481 }
3482 break;
3483 #endif
3484
71fafd95 3485 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3486 case ACLC_DECODE:
3487 rc = mime_decode(&arg);
3488 break;
71fafd95 3489 #endif
8523533c 3490
059ec3d9
PH		 3491 case ACLC_DELAY:
3492 {
3493 int delay = readconf_readtime(arg, 0, FALSE);
3494 if (delay < 0)
3495 {
3496 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3497 "modifier: \"%s\" is not a time value", arg);
3498 return ERROR;
3499 }
3500 else
3501 {
3502 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3503 delay);
3504 if (host_checking)
3505 {
3506 HDEBUG(D_acl)
3507 debug_printf("delay skipped in -bh checking mode\n");
3508 }
010c2d14 3509
ae9d18bc
JH		 3510 /* NOTE 1: Remember that we may be
3511 dealing with stdin/stdout here, in addition to TCP/IP connections.
3512 Also, delays may be specified for non-SMTP input, where smtp_out and
3513 smtp_in will be NULL. Whatever is done must work in all cases.
3514
3515 NOTE 2: The added feature of flushing the output before a delay must
3516 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3517 */
3518
3519 else
3520 {
3521 if (smtp_out != NULL && !disable_delay_flush)
3522 mac_smtp_fflush();
3523
861a7c51 3524#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3525 {
3526 struct pollfd p;
3527 nfds_t n = 0;
3528 if (smtp_out)
3529 {
3530 p.fd = fileno(smtp_out);
3531 p.events = POLLRDHUP;
3532 n = 1;
3533 }
3534 if (poll(&p, n, delay*1000) > 0)
3535 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3536 }
3537#else
010c2d14
PH		 3538 /* It appears to be impossible to detect that a TCP/IP connection has
3539 gone away without reading from it. This means that we cannot shorten
3540 the delay below if the client goes away, because we cannot discover
3541 that the client has closed its end of the connection. (The connection
3542 is actually in a half-closed state, waiting for the server to close its
3543 end.) It would be nice to be able to detect this state, so that the
3544 Exim process is not held up unnecessarily. However, it seems that we
3545 can't. The poll() function does not do the right thing, and in any case
3546 it is not always available.
047bdd8c 3547 */
010c2d14 3548
86b8287f 3549 while (delay > 0) delay = sleep(delay);
ae9d18bc 3550#endif
8e669ac1 3551 }
059ec3d9
PH		 3552 }
3553 }
3554 break;
3555
80a47a2c
TK		 3556 #ifndef DISABLE_DKIM
3557 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3558 if (dkim_cur_signer != NULL)
3559 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3560 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3561 else
b0b9dbb1 3562 rc = FAIL;
71fafd95
PH		 3563 break;
3564
80a47a2c
TK		 3565 case ACLC_DKIM_STATUS:
3566 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3567 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3568 break;
3569 #endif
fb2274d4 3570
4840604e
TL		 3571 #ifdef EXPERIMENTAL_DMARC
3572 case ACLC_DMARC_STATUS:
4a8ce2d8 3573 if (!dmarc_has_been_checked)
4840604e 3574 dmarc_process();
4a8ce2d8 3575 dmarc_has_been_checked = TRUE;
4840604e
TL		 3576 /* used long way of dmarc_exim_expand_query() in case we need more
3577 * view into the process in the future. */
3578 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3579 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3580 break;
3581 #endif
3582
059ec3d9 3583 case ACLC_DNSLISTS:
379ba7d0 3584 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3585 break;
3586
3587 case ACLC_DOMAINS:
3588 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3589 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3590 break;
3591
3592 /* The value in tls_cipher is the full cipher name, for example,
3593 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3594 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3595 what may in practice come out of the SSL library - which at the time of
3596 writing is poorly documented. */
3597
3598 case ACLC_ENCRYPTED:
817d9f57 3599 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3600 {
3601 uschar *endcipher = NULL;
817d9f57
JH		 3602 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3603 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3604 {
3605 endcipher = Ustrchr(++cipher, ':');
3606 if (endcipher != NULL) *endcipher = 0;
3607 }
3608 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3609 if (endcipher != NULL) *endcipher = ':';
3610 }
3611 break;
3612
3613 /* Use verify_check_this_host() instead of verify_check_host() so that
3614 we can pass over &host_data to catch any looked up data. Once it has been
3615 set, it retains its value so that it's still there if another ACL verb
3616 comes through here and uses the cache. However, we must put it into
3617 permanent store in case it is also expected to be used in a subsequent
3618 message in the same SMTP connection. */
3619
3620 case ACLC_HOSTS:
3621 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3622 (sender_host_address == NULL)? US"" : sender_host_address,
3623 CUSS &host_data);
4a452c43
JH		 3624 if (rc == DEFER) *log_msgptr = search_error_message;
3625 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3626 break;
3627
3628 case ACLC_LOCAL_PARTS:
3629 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3630 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3631 CUSS &deliver_localpart_data);
059ec3d9
PH		 3632 break;
3633
6ea85e9a
PH		 3634 case ACLC_LOG_REJECT_TARGET:
3635 {
3636 int logbits = 0;
3637 int sep = 0;
55414b25 3638 const uschar *s = arg;
6ea85e9a 3639 uschar *ss;
4a452c43 3640 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3641 {
3642 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3643 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3644 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3645 else
3646 {
3647 logbits |= LOG_MAIN|LOG_REJECT;
3648 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3649 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3650 }
3651 }
3652 log_reject_target = logbits;
3653 }
3654 break;
3655
059ec3d9
PH		 3656 case ACLC_LOGWRITE:
3657 {
3658 int logbits = 0;
55414b25 3659 const uschar *s = arg;
059ec3d9
PH		 3660 if (*s == ':')
3661 {
3662 s++;
3663 while (*s != ':')
3664 {
3665 if (Ustrncmp(s, "main", 4) == 0)
3666 { logbits |= LOG_MAIN; s += 4; }
3667 else if (Ustrncmp(s, "panic", 5) == 0)
3668 { logbits |= LOG_PANIC; s += 5; }
3669 else if (Ustrncmp(s, "reject", 6) == 0)
3670 { logbits |= LOG_REJECT; s += 6; }
3671 else
3672 {
3673 logbits = LOG_MAIN|LOG_PANIC;
3674 s = string_sprintf(":unknown log name in \"%s\" in "
3675 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3676 }
3677 if (*s == ',') s++;
3678 }
3679 s++;
3680 }
3681 while (isspace(*s)) s++;
6ea85e9a
PH		 3682
3683
059ec3d9
PH		 3684 if (logbits == 0) logbits = LOG_MAIN;
3685 log_write(0, logbits, "%s", string_printing(s));
3686 }
3687 break;
8e669ac1 3688
71fafd95 3689 #ifdef WITH_CONTENT_SCAN
0f0c8159 3690 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3691 {
6ea85e9a 3692 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3693 const uschar * list = arg;
3694 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3695 uschar *opt;
3696 BOOL defer_ok = FALSE;
3697 int timeout = 0;
3698
55414b25 3699 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3700 if (strcmpic(opt, US"defer_ok") == 0)
3701 defer_ok = TRUE;
3702 else if ( strncmpic(opt, US"tmo=", 4) == 0
3703 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3704 )
3705 {
3706 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3707 return ERROR;
3708 }
3709
3710 rc = malware(ss, timeout);
3711 if (rc == DEFER && defer_ok)
3712 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3713 }
3714 break;
3715
3716 case ACLC_MIME_REGEX:
71fafd95 3717 rc = mime_regex(&arg);
8523533c 3718 break;
71fafd95 3719 #endif
059ec3d9 3720
b0b9dbb1
JH		 3721 case ACLC_QUEUE:
3722 queue_name = string_copy_malloc(arg);
3723 break;
3724
870f6ba8 3725 case ACLC_RATELIMIT:
90fc3069 3726 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3727 break;
3728
059ec3d9 3729 case ACLC_RECIPIENTS:
55414b25
JH		 3730 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3731 CUSS &recipient_data);
059ec3d9
PH		 3732 break;
3733
71fafd95
PH		 3734 #ifdef WITH_CONTENT_SCAN
3735 case ACLC_REGEX:
3736 rc = regex(&arg);
8523533c 3737 break;
71fafd95 3738 #endif
8523533c 3739
e7568d51
TL		 3740 case ACLC_REMOVE_HEADER:
3741 setup_remove_header(arg);
3742 break;
3743
059ec3d9
PH		 3744 case ACLC_SENDER_DOMAINS:
3745 {
3746 uschar *sdomain;
3747 sdomain = Ustrrchr(sender_address, '@');
3748 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3749 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3750 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3751 }
3752 break;
3753
3754 case ACLC_SENDERS:
55414b25
JH		 3755 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3756 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3757 break;
3758
3759 /* Connection variables must persist forever */
3760
3761 case ACLC_SET:
3762 {
3763 int old_pool = store_pool;
5ef5dd52 3764 if ( cb->u.varname[0] == 'c'
0cbf2b82 3765#ifndef DISABLE_EVENT
5ef5dd52
JB		 3766 || event_name /* An event is being delivered */
3767#endif
3768 )
3769 store_pool = POOL_PERM;
38a0a95f 3770 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3771 store_pool = old_pool;
3772 }
3773 break;
3774
71fafd95 3775 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3776 case ACLC_SPAM:
3777 {
3778 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3779 const uschar * list = arg;
3780 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3781 /* Run the spam backend. */
55414b25 3782 rc = spam(CUSS &ss);
8523533c 3783 /* Modify return code based upon the existance of options. */
55414b25 3784 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3785 != NULL) {
3786 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3787 {
3788 /* FAIL so that the message is passed to the next ACL */
3789 rc = FAIL;
3790 }
3791 }
3792 }
3793 break;
71fafd95 3794 #endif
8523533c 3795
71fafd95 3796 #ifdef EXPERIMENTAL_SPF
8523533c 3797 case ACLC_SPF:
65a7d8c3
NM		 3798 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3799 break;
3800 case ACLC_SPF_GUESS:
3801 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3802 break;
71fafd95 3803 #endif
8523533c 3804
b0019c78
TF		 3805 case ACLC_UDPSEND:
3806 rc = acl_udpsend(arg, log_msgptr);
3807 break;
3808
059ec3d9
PH		 3809 /* If the verb is WARN, discard any user message from verification, because
3810 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3811 only from explicit "message" modifiers. However, put the user message into
3812 $acl_verify_message so it can be used in subsequent conditions or modifiers
3813 (until something changes it). */
059ec3d9
PH		 3814
3815 case ACLC_VERIFY:
3816 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3817 if (*user_msgptr)
3818 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3819 if (verb == ACL_WARN) *user_msgptr = NULL;
3820 break;
3821
3822 default:
3823 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3824 "condition %d", cb->type);
3825 break;
3826 }
3827
3828 /* If a condition was negated, invert OK/FAIL. */
3829
3830 if (!cond_modifiers[cb->type] && cb->u.negated)
3831 {
3832 if (rc == OK) rc = FAIL;
3833 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3834 }
3835
3836 if (rc != OK) break; /* Conditions loop */
3837 }
3838
3839
3840/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3841handle the values of these modifiers. If there isn't a log message set, we make
3842it the same as the user message.
059ec3d9
PH		 3843
3844"message" is a user message that will be included in an SMTP response. Unless
3845it is empty, it overrides any previously set user message.
3846
3847"log_message" is a non-user message, and it adds to any existing non-user
3848message that is already set.
3849
4e88a19f
PH		 3850Most verbs have but a single return for which the messages are relevant, but
3851for "discard", it's useful to have the log message both when it succeeds and
3852when it fails. For "accept", the message is used in the OK case if there is no
3853"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3854present. */
059ec3d9 3855
4e88a19f
PH		 3856if (*epp && rc == OK) user_message = NULL;
3857
3858if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3859 {
3860 uschar *expmessage;
4e88a19f
PH		 3861 uschar *old_user_msgptr = *user_msgptr;
3862 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3863
3864 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3865 nested ACLs) are always discarded. This also happens for acceptance verbs
3866 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3867 However, the value of an existing message is available in $acl_verify_message
3868 during expansions. */
3869
4e88a19f
PH		 3870 if (verb == ACL_WARN ||
3871 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3872 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3873
3874 if (user_message != NULL)
3875 {
3876 acl_verify_message = old_user_msgptr;
3877 expmessage = expand_string(user_message);
3878 if (expmessage == NULL)
3879 {
3880 if (!expand_string_forcedfail)
3881 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3882 user_message, expand_string_message);
3883 }
3884 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3885 }
3886
3887 if (log_message != NULL)
3888 {
3889 acl_verify_message = old_log_msgptr;
3890 expmessage = expand_string(log_message);
3891 if (expmessage == NULL)
3892 {
3893 if (!expand_string_forcedfail)
3894 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3895 log_message, expand_string_message);
3896 }
3897 else if (expmessage[0] != 0)
3898 {
3899 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3900 string_sprintf("%s: %s", expmessage, *log_msgptr);
3901 }
3902 }
3903
3904 /* If no log message, default it to the user message */
3905
3906 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3907 }
3908
3909acl_verify_message = NULL;
3910return rc;
3911}
3912
3913
3914
3915
3916
3917/*************************************************
3918* Get line from a literal ACL *
3919*************************************************/
3920
3921/* This function is passed to acl_read() in order to extract individual lines
3922of a literal ACL, which we access via static pointers. We can destroy the
3923contents because this is called only once (the compiled ACL is remembered).
3924
3925This code is intended to treat the data in the same way as lines in the main
3926Exim configuration file. That is:
3927
3928 . Leading spaces are ignored.
3929
3930 . A \ at the end of a line is a continuation - trailing spaces after the \
3931 are permitted (this is because I don't believe in making invisible things
3932 significant). Leading spaces on the continued part of a line are ignored.
3933
3934 . Physical lines starting (significantly) with # are totally ignored, and
3935 may appear within a sequence of backslash-continued lines.
3936
3937 . Blank lines are ignored, but will end a sequence of continuations.
3938
3939Arguments: none
3940Returns: a pointer to the next line
3941*/
3942
3943
3944static uschar *acl_text; /* Current pointer in the text */
3945static uschar *acl_text_end; /* Points one past the terminating '0' */
3946
3947
3948static uschar *
3949acl_getline(void)
3950{
3951uschar *yield;
3952
3953/* This loop handles leading blank lines and comments. */
3954
3955for(;;)
3956 {
3957 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3958 if (*acl_text == 0) return NULL; /* No more data */
3959 yield = acl_text; /* Potential data line */
3960
3961 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3962
3963 /* If we hit the end before a newline, we have the whole logical line. If
3964 it's a comment, there's no more data to be given. Otherwise, yield it. */
3965
3966 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3967
3968 /* After reaching a newline, end this loop if the physical line does not
3969 start with '#'. If it does, it's a comment, and the loop continues. */
3970
3971 if (*yield != '#') break;
3972 }
3973
3974/* This loop handles continuations. We know we have some real data, ending in
3975newline. See if there is a continuation marker at the end (ignoring trailing
3976white space). We know that *yield is not white space, so no need to test for
3977cont > yield in the backwards scanning loop. */
3978
3979for(;;)
3980 {
3981 uschar *cont;
3982 for (cont = acl_text - 1; isspace(*cont); cont--);
3983
3984 /* If no continuation follows, we are done. Mark the end of the line and
3985 return it. */
3986
3987 if (*cont != '\\')
3988 {
3989 *acl_text++ = 0;
3990 return yield;
3991 }
3992
3993 /* We have encountered a continuation. Skip over whitespace at the start of
3994 the next line, and indeed the whole of the next line or lines if they are
3995 comment lines. */
3996
3997 for (;;)
3998 {
3999 while (*(++acl_text) == ' ' || *acl_text == '\t');
4000 if (*acl_text != '#') break;
4001 while (*(++acl_text) != 0 && *acl_text != '\n');
4002 }
4003
4004 /* We have the start of a continuation line. Move all the rest of the data
4005 to join onto the previous line, and then find its end. If the end is not a
4006 newline, we are done. Otherwise loop to look for another continuation. */
4007
4008 memmove(cont, acl_text, acl_text_end - acl_text);
4009 acl_text_end -= acl_text - cont;
4010 acl_text = cont;
4011 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
4012 if (*acl_text == 0) return yield;
4013 }
4014
4015/* Control does not reach here */
4016}
4017
4018
4019
4020
4021
4022/*************************************************
4023* Check access using an ACL *
4024*************************************************/
4025
4026/* This function is called from address_check. It may recurse via
4027acl_check_condition() - hence the use of a level to stop looping. The ACL is
4028passed as a string which is expanded. A forced failure implies no access check
4029is required. If the result is a single word, it is taken as the name of an ACL
4030which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4031text, complete with newlines, and parsed as such. In both cases, the ACL check
4032is then run. This function uses an auxiliary function for acl_read() to call
4033for reading individual lines of a literal ACL. This is acl_getline(), which
4034appears immediately above.
4035
4036Arguments:
4037 where where called from
4038 addr address item when called from RCPT; otherwise NULL
4039 s the input string; NULL is the same as an empty ACL => DENY
4040 level the nesting level
4041 user_msgptr where to put a user error (for SMTP response)
4042 log_msgptr where to put a logging message (not for SMTP response)
4043
4044Returns: OK access is granted
4045 DISCARD access is apparently granted...
4046 FAIL access is denied
4047 FAIL_DROP access is denied; drop the connection
4048 DEFER can't tell at the moment
4049 ERROR disaster
4050*/
4051
4052static int
4053acl_check_internal(int where, address_item *addr, uschar *s, int level,
4054 uschar **user_msgptr, uschar **log_msgptr)
4055{
4056int fd = -1;
4057acl_block *acl = NULL;
4058uschar *acl_name = US"inline ACL";
4059uschar *ss;
4060
4061/* Catch configuration loops */
4062
4063if (level > 20)
4064 {
4065 *log_msgptr = US"ACL nested too deep: possible loop";
4066 return ERROR;
4067 }
4068
4069if (s == NULL)
4070 {
4071 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4072 return FAIL;
4073 }
4074
4075/* At top level, we expand the incoming string. At lower levels, it has already
4076been expanded as part of condition processing. */
4077
4078if (level == 0)
4079 {
4080 ss = expand_string(s);
4081 if (ss == NULL)
4082 {
4083 if (expand_string_forcedfail) return OK;
4084 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4085 expand_string_message);
4086 return ERROR;
4087 }
4088 }
4089else ss = s;
4090
4091while (isspace(*ss))ss++;
4092
4093/* If we can't find a named ACL, the default is to parse it as an inline one.
4094(Unless it begins with a slash; non-existent files give rise to an error.) */
4095
4096acl_text = ss;
4097
4098/* Handle the case of a string that does not contain any spaces. Look for a
4099named ACL among those read from the configuration, or a previously read file.
4100It is possible that the pointer to the ACL is NULL if the configuration
4101contains a name with no data. If not found, and the text begins with '/',
4102read an ACL from a file, and save it so it can be re-used. */
4103
4104if (Ustrchr(ss, ' ') == NULL)
4105 {
4106 tree_node *t = tree_search(acl_anchor, ss);
4107 if (t != NULL)
4108 {
4109 acl = (acl_block *)(t->data.ptr);
4110 if (acl == NULL)
4111 {
4112 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4113 return FAIL;
4114 }
4115 acl_name = string_sprintf("ACL \"%s\"", ss);
4116 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4117 }
4118
4119 else if (*ss == '/')
4120 {
4121 struct stat statbuf;
4122 fd = Uopen(ss, O_RDONLY, 0);
4123 if (fd < 0)
4124 {
4125 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4126 strerror(errno));
4127 return ERROR;
4128 }
4129
4130 if (fstat(fd, &statbuf) != 0)
4131 {
4132 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4133 strerror(errno));
4134 return ERROR;
4135 }
4136
4137 acl_text = store_get(statbuf.st_size + 1);
4138 acl_text_end = acl_text + statbuf.st_size + 1;
4139
4140 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4141 {
4142 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4143 ss, strerror(errno));
4144 return ERROR;
4145 }
4146 acl_text[statbuf.st_size] = 0;
f1e894f3 4147 (void)close(fd);
059ec3d9
PH		 4148
4149 acl_name = string_sprintf("ACL \"%s\"", ss);
4150 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4151 }
4152 }
4153
4154/* Parse an ACL that is still in text form. If it came from a file, remember it
4155in the ACL tree, having read it into the POOL_PERM store pool so that it
4156persists between multiple messages. */
4157
4158if (acl == NULL)
4159 {
4160 int old_pool = store_pool;
4161 if (fd >= 0) store_pool = POOL_PERM;
4162 acl = acl_read(acl_getline, log_msgptr);
4163 store_pool = old_pool;
4164 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4165 if (fd >= 0)
4166 {
4167 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4168 Ustrcpy(t->name, ss);
4169 t->data.ptr = acl;
4170 (void)tree_insertnode(&acl_anchor, t);
4171 }
4172 }
4173
4174/* Now we have an ACL to use. It's possible it may be NULL. */
4175
4176while (acl != NULL)
4177 {
4178 int cond;
4179 int basic_errno = 0;
4180 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4181 BOOL acl_quit_check = level == 0
4182 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4183
4184 *log_msgptr = *user_msgptr = NULL;
4185 acl_temp_details = FALSE;
4186
059ec3d9
PH		 4187 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4188
4189 /* Clear out any search error message from a previous check before testing
4190 this condition. */
4191
4192 search_error_message = NULL;
4193 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4194 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4195
4196 /* Handle special returns: DEFER causes a return except on a WARN verb;
4197 ERROR always causes a return. */
4198
4199 switch (cond)
4200 {
4201 case DEFER:
6968512f 4202 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4203 if (basic_errno != ERRNO_CALLOUTDEFER)
4204 {
4205 if (search_error_message != NULL && *search_error_message != 0)
4206 *log_msgptr = search_error_message;
4207 if (smtp_return_error_details) acl_temp_details = TRUE;
4208 }
4209 else
4210 {
4211 acl_temp_details = TRUE;
4212 }
4213 if (acl->verb != ACL_WARN) return DEFER;
4214 break;
4215
4216 default: /* Paranoia */
4217 case ERROR:
6968512f 4218 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4219 return ERROR;
4220
4221 case OK:
6968512f
JH		 4222 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4223 verbs[acl->verb], acl_name);
059ec3d9
PH		 4224 break;
4225
4226 case FAIL:
6968512f 4227 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4228 break;
4229
4230 /* DISCARD and DROP can happen only from a nested ACL condition, and
4231 DISCARD can happen only for an "accept" or "discard" verb. */
4232
4233 case DISCARD:
6968512f
JH		 4234 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4235 verbs[acl->verb], acl_name);
059ec3d9
PH		 4236 break;
4237
4238 case FAIL_DROP:
6968512f
JH		 4239 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4240 verbs[acl->verb], acl_name);
059ec3d9
PH		 4241 break;
4242 }
4243
4244 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4245 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4246 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4247
4248 switch(acl->verb)
4249 {
4250 case ACL_ACCEPT:
a7538db1
JH		 4251 if (cond == OK || cond == DISCARD)
4252 {
4253 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4254 return cond;
4255 }
059ec3d9
PH		 4256 if (endpass_seen)
4257 {
4258 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4259 return cond;
4260 }
4261 break;
4262
4263 case ACL_DEFER:
4264 if (cond == OK)
4265 {
a7538db1 4266 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4267 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4268 acl_temp_details = TRUE;
4269 return DEFER;
4270 }
4271 break;
4272
4273 case ACL_DENY:
a7538db1
JH		 4274 if (cond == OK)
4275 {
4276 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4277 if (acl_quit_check) goto badquit;
a7538db1
JH		 4278 return FAIL;
4279 }
059ec3d9
PH		 4280 break;
4281
4282 case ACL_DISCARD:
a7538db1
JH		 4283 if (cond == OK || cond == DISCARD)
4284 {
4285 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4286 if (acl_quit_check) goto badquit;
a7538db1
JH		 4287 return DISCARD;
4288 }
059ec3d9
PH		 4289 if (endpass_seen)
4290 {
4291 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4292 return cond;
4293 }
4294 break;
4295
4296 case ACL_DROP:
a7538db1
JH		 4297 if (cond == OK)
4298 {
4299 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4300 if (acl_quit_check) goto badquit;
a7538db1
JH		 4301 return FAIL_DROP;
4302 }
059ec3d9
PH		 4303 break;
4304
4305 case ACL_REQUIRE:
a7538db1
JH		 4306 if (cond != OK)
4307 {
4308 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4309 if (acl_quit_check) goto badquit;
a7538db1
JH		 4310 return cond;
4311 }
059ec3d9
PH		 4312 break;
4313
4314 case ACL_WARN:
4315 if (cond == OK)
4316 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4317 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4318 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4319 "condition test deferred%s%s", host_and_ident(TRUE),
4320 (*log_msgptr == NULL)? US"" : US": ",
4321 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4322 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4323 break;
4324
4325 default:
4326 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4327 acl->verb);
4328 break;
4329 }
4330
4331 /* Pass to the next ACL item */
4332
4333 acl = acl->next;
4334 }
4335
4336/* We have reached the end of the ACL. This is an implicit DENY. */
4337
4338HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4339return FAIL;
82c0c8ea
JH		 4340
4341badquit:
4342 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4343 "('%s' verb used incorrectly)", verbs[acl->verb]);
4344 return ERROR;
059ec3d9
PH		 4345}
4346
4347
333eea9c
JH		 4348
4349
4350/* Same args as acl_check_internal() above, but the string s is
4351the name of an ACL followed optionally by up to 9 space-separated arguments.
4352The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4353static int
55414b25 4354acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4355 uschar **user_msgptr, uschar **log_msgptr)
4356{
4357uschar * tmp;
bef3ea7f 4358uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4359uschar * sav_arg[9]; /* must match acl_arg[] */
4360int sav_narg;
333eea9c 4361uschar * name;
bef3ea7f 4362int i;
ef21c07d 4363int ret;
333eea9c
JH		 4364
4365if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4366 goto bad;
4367
bef3ea7f 4368for (i = 0; i < 9; i++)
333eea9c
JH		 4369 {
4370 while (*s && isspace(*s)) s++;
4371 if (!*s) break;
bef3ea7f 4372 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4373 {
4374 tmp = name;
4375 goto bad;
4376 }
4377 }
ef21c07d
JH		 4378
4379sav_narg = acl_narg;
bef3ea7f 4380acl_narg = i;
ef21c07d
JH		 4381for (i = 0; i < acl_narg; i++)
4382 {
4383 sav_arg[i] = acl_arg[i];
4384 acl_arg[i] = tmp_arg[i];
4385 }
4386while (i < 9)
4387 {
4388 sav_arg[i] = acl_arg[i];
4389 acl_arg[i++] = NULL;
4390 }
4391
4392ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4393
ef21c07d
JH		 4394acl_narg = sav_narg;
4395for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4396return ret;
333eea9c
JH		 4397
4398bad:
4399if (expand_string_forcedfail) return ERROR;
4400*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4401 tmp, expand_string_message);
4402return search_find_defer?DEFER:ERROR;
4403}
4404
4405
4406
059ec3d9
PH		 4407/*************************************************
4408* Check access using an ACL *
4409*************************************************/
4410
faa05a93
JH		 4411/* Alternate interface for ACL, used by expansions */
4412int
05caaeaa 4413acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4414{
faa05a93
JH		 4415address_item adb;
4416address_item *addr = NULL;
4417
4418*user_msgptr = *log_msgptr = NULL;
4419sender_verified_failed = NULL;
4420ratelimiters_cmd = NULL;
4421log_reject_target = LOG_MAIN|LOG_REJECT;
4422
4423if (where == ACL_WHERE_RCPT)
4424 {
4425 adb = address_defaults;
4426 addr = &adb;
05caaeaa
JH		 4427 addr->address = expand_string(US"$local_part@$domain");
4428 addr->domain = deliver_domain;
4429 addr->local_part = deliver_localpart;
4430 addr->cc_local_part = deliver_localpart;
4431 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4432 }
4433
4434return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4435}
4436
4437
4438
059ec3d9
PH		 4439/* This is the external interface for ACL checks. It sets up an address and the
4440expansions for $domain and $local_part when called after RCPT, then calls
4441acl_check_internal() to do the actual work.
4442
4443Arguments:
4444 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4445 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4446 s the input string; NULL is the same as an empty ACL => DENY
4447 user_msgptr where to put a user error (for SMTP response)
4448 log_msgptr where to put a logging message (not for SMTP response)
4449
4450Returns: OK access is granted by an ACCEPT verb
4451 DISCARD access is granted by a DISCARD verb
4452 FAIL access is denied
4453 FAIL_DROP access is denied; drop the connection
4454 DEFER can't tell at the moment
4455 ERROR disaster
4456*/
faa05a93 4457int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4458
4459int
64ffc24f 4460acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4461 uschar **log_msgptr)
4462{
4463int rc;
4464address_item adb;
64ffc24f 4465address_item *addr = NULL;
059ec3d9
PH		 4466
4467*user_msgptr = *log_msgptr = NULL;
4468sender_verified_failed = NULL;
fe0dab11 4469ratelimiters_cmd = NULL;
6ea85e9a 4470log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4471
8ccd00b1 4472#ifndef DISABLE_PRDR
4f6ae5c3 4473if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4474#else
4f6ae5c3 4475if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4476#endif
059ec3d9
PH		 4477 {
4478 adb = address_defaults;
4479 addr = &adb;
64ffc24f 4480 addr->address = recipient;
059ec3d9
PH		 4481 if (deliver_split_address(addr) == DEFER)
4482 {
4483 *log_msgptr = US"defer in percent_hack_domains check";
4484 return DEFER;
4485 }
8c5d388a 4486#ifdef SUPPORT_I18N
3c8b3577
JH		 4487 if ((addr->prop.utf8_msg = message_smtputf8))
4488 {
4489 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4490 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4491 }
9bfc60eb 4492#endif
059ec3d9
PH		 4493 deliver_domain = addr->domain;
4494 deliver_localpart = addr->local_part;
4495 }
059ec3d9 4496
faa05a93 4497acl_where = where;
059ec3d9 4498rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4499acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4500
817d9f57
JH		 4501/* Cutthrough - if requested,
4502and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4503and rcpt acl returned accept,
4504and first recipient (cancel on any subsequents)
e4bdf652 4505open one now and run it up to RCPT acceptance.
f9334a28
JH		 4506A failed verify should cancel cutthrough request,
4507and will pass the fail to the originator.
817d9f57 4508Initial implementation: dual-write to spool.
e4bdf652
JH		 4509Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4510
4511Cease cutthrough copy on rxd final dot; do not send one.
4512
4513On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4514
4515On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4516perm-rejected, reflect that to the original sender - and dump the spooled copy.
4517If temp-reject, close the conn (and keep the spooled copy).
4518If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4519*/
4520switch (where)
ff5929e3
JH		 4521 {
4522 case ACL_WHERE_RCPT:
8ccd00b1 4523#ifndef DISABLE_PRDR
ff5929e3 4524 case ACL_WHERE_PRDR:
fd98a5c6 4525#endif
ff5929e3
JH		 4526 if (host_checking_callout) /* -bhc mode */
4527 cancel_cutthrough_connection("host-checking mode");
4528
4529 else if ( rc == OK
4530 && cutthrough.delivery
4531 && rcpt_count > cutthrough.nrcpt
4532 && (rc = open_cutthrough_connection(addr)) == DEFER
4533 )
4534 if (cutthrough.defer_pass)
4535 {
4536 uschar * s = addr->message;
4537 /* Horrid kludge to recover target's SMTP message */
4538 while (*s) s++;
4539 do --s; while (!isdigit(*s));
4540 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4541 acl_temp_details = TRUE;
4542 }
4543 else
4544 {
4545 HDEBUG(D_acl) debug_printf("cutthrough defer; will spool\n");
4546 rc = OK;
4547 }
4548 break;
e4bdf652 4549
ff5929e3
JH		 4550 case ACL_WHERE_PREDATA:
4551 if (rc == OK)
4552 cutthrough_predata();
4553 else
4554 cancel_cutthrough_connection("predata acl not ok");
4555 break;
e4bdf652 4556
ff5929e3
JH		 4557 case ACL_WHERE_QUIT:
4558 case ACL_WHERE_NOTQUIT:
4559 cancel_cutthrough_connection("quit or notquit");
4560 break;
e4bdf652 4561
ff5929e3
JH		 4562 default:
4563 break;
4564 }
e4bdf652 4565
64ffc24f
PH		 4566deliver_domain = deliver_localpart = deliver_address_data =
4567 sender_address_data = NULL;
059ec3d9
PH		 4568
4569/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4570ACL, which is really in the middle of an SMTP command. */
4571
4572if (rc == DISCARD)
4573 {
4574 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4575 {
4576 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4577 "ACL", acl_wherenames[where]);
4578 return ERROR;
4579 }
4580 return DISCARD;
4581 }
4582
4583/* A DROP response is not permitted from MAILAUTH */
4584
4585if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4586 {
4587 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4588 "ACL", acl_wherenames[where]);
4589 return ERROR;
4590 }
4591
4e88a19f
PH		 4592/* Before giving a response, take a look at the length of any user message, and
4593split it up into multiple lines if possible. */
059ec3d9 4594
e28326d8
PH		 4595*user_msgptr = string_split_message(*user_msgptr);
4596if (fake_response != OK)
4597 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4598
4599return rc;
4600}
4601
38a0a95f 4602
38a0a95f
PH		 4603/*************************************************
4604* Create ACL variable *
4605*************************************************/
4606
4607/* Create an ACL variable or reuse an existing one. ACL variables are in a
4608binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4609
4610Argument:
4611 name pointer to the variable's name, starting with c or m
4612
4613Returns the pointer to variable's tree node
4614*/
4615
4616tree_node *
4617acl_var_create(uschar *name)
4618{
4619tree_node *node, **root;
4620root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4621node = tree_search(*root, name);
4622if (node == NULL)
4623 {
4624 node = store_get(sizeof(tree_node) + Ustrlen(name));
4625 Ustrcpy(node->name, name);
4626 (void)tree_insertnode(root, node);
4627 }
4628node->data.ptr = NULL;
4629return node;
4630}
4631
4632
4633
4634/*************************************************
4635* Write an ACL variable in spool format *
4636*************************************************/
4637
4638/* This function is used as a callback for tree_walk when writing variables to
4639the spool file. To retain spool file compatibility, what is written is -aclc or
4640-aclm followed by the rest of the name and the data length, space separated,
4641then the value itself, starting on a new line, and terminated by an additional
4642newline. When we had only numbered ACL variables, the first line might look
4643like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4644acl_cfoo.
4645
4646Arguments:
4647 name of the variable
4648 value of the variable
4649 ctx FILE pointer (as a void pointer)
4650
4651Returns: nothing
4652*/
4653
4654void
4655acl_var_write(uschar *name, uschar *value, void *ctx)
4656{
4657FILE *f = (FILE *)ctx;
4658fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4659}
4660
9171d434
JH		 4661/* vi: aw ai sw=2
4662*/
059ec3d9 4663/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.