projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Testsuite: permit use of IPv6 loopback
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef
PH		 183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
c46782ef 186 #endif
ed7f7860 187 CONTROL_DEBUG,
80a47a2c 188 #ifndef DISABLE_DKIM
f7572e5a
TK		 189 CONTROL_DKIM_VERIFY,
190 #endif
4840604e
TL		 191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH		 208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
cf8b11a5 211 CONTROL_NO_MULTILINE,
047bdd8c 212 CONTROL_NO_PIPELINING,
4c590bd1
PH		 213 CONTROL_NO_DELAY_FLUSH,
214 CONTROL_NO_CALLOUT_FLUSH
c46782ef 215};
9a26b6b2 216
8800895a
PH		 217/* ACL control names; keep in step with the table above! This list is used for
218turning ids into names. The actual list of recognized names is in the variable
219control_def controls_list[] below. The fact that there are two lists is a mess
220and should be tidied up. */
9a26b6b2
PH		 221
222static uschar *controls[] = {
c46782ef 223 US"allow_auth_unadvertised",
9a26b6b2
PH		 224 #ifdef EXPERIMENTAL_BRIGHTMAIL
225 US"bmi_run",
226 #endif
ed7f7860 227 US"debug",
80a47a2c
TK		 228 #ifndef DISABLE_DKIM
229 US"dkim_disable_verify",
f7572e5a 230 #endif
4840604e
TL		 231 #ifdef EXPERIMENTAL_DMARC
232 US"dmarc_disable_verify",
233 US"dmarc_enable_forensic",
234 #endif
13363eba 235 US"dscp",
c46782ef
PH		 236 US"error",
237 US"caseful_local_part",
238 US"caselower_local_part",
e4bdf652 239 US"cutthrough_delivery",
c46782ef
PH		 240 US"enforce_sync",
241 US"no_enforce_sync",
242 US"freeze",
243 US"queue_only",
244 US"submission",
245 US"suppress_local_fixups",
9a26b6b2
PH		 246 #ifdef WITH_CONTENT_SCAN
247 US"no_mbox_unspool",
248 #endif
cf8b11a5
PH		 249 US"fakedefer",
250 US"fakereject",
aa6dc513 251 US"no_multiline_responses",
cf8b11a5 252 US"no_pipelining",
4c590bd1
PH		 253 US"no_delay_flush",
254 US"no_callout_flush"
c46782ef 255};
059ec3d9 256
047bdd8c 257/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 258at the outer level. In the other cases, expansion already occurs in the
259checking functions. */
260
261static uschar cond_expand_at_top[] = {
7421ecab 262 FALSE, /* acl */
3e536984 263 TRUE, /* add_header */
059ec3d9 264 FALSE, /* authenticated */
8523533c
TK		 265#ifdef EXPERIMENTAL_BRIGHTMAIL
266 TRUE, /* bmi_optin */
8e669ac1 267#endif
059ec3d9 268 TRUE, /* condition */
c3611384 269 TRUE, /* continue */
059ec3d9 270 TRUE, /* control */
6a8f9482
TK		 271#ifdef EXPERIMENTAL_DCC
272 TRUE, /* dcc */
273#endif
8523533c
TK		 274#ifdef WITH_CONTENT_SCAN
275 TRUE, /* decode */
276#endif
059ec3d9 277 TRUE, /* delay */
8523533c
TK		 278#ifdef WITH_OLD_DEMIME
279 TRUE, /* demime */
fb2274d4 280#endif
80a47a2c
TK		 281#ifndef DISABLE_DKIM
282 TRUE, /* dkim_signers */
283 TRUE, /* dkim_status */
4840604e
TL		 284#endif
285#ifdef EXPERIMENTAL_DMARC
286 TRUE, /* dmarc_status */
8523533c 287#endif
059ec3d9
PH		 288 TRUE, /* dnslists */
289 FALSE, /* domains */
290 FALSE, /* encrypted */
291 TRUE, /* endpass */
292 FALSE, /* hosts */
293 FALSE, /* local_parts */
294 TRUE, /* log_message */
6ea85e9a 295 TRUE, /* log_reject_target */
059ec3d9 296 TRUE, /* logwrite */
8523533c
TK		 297#ifdef WITH_CONTENT_SCAN
298 TRUE, /* malware */
299#endif
059ec3d9 300 TRUE, /* message */
8523533c
TK		 301#ifdef WITH_CONTENT_SCAN
302 TRUE, /* mime_regex */
303#endif
870f6ba8 304 TRUE, /* ratelimit */
059ec3d9 305 FALSE, /* recipients */
8523533c
TK		 306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* regex */
308#endif
e7568d51 309 TRUE, /* remove_header */
059ec3d9
PH		 310 FALSE, /* sender_domains */
311 FALSE, /* senders */
312 TRUE, /* set */
8523533c
TK		 313#ifdef WITH_CONTENT_SCAN
314 TRUE, /* spam */
315#endif
316#ifdef EXPERIMENTAL_SPF
317 TRUE, /* spf */
65a7d8c3 318 TRUE, /* spf_guess */
8523533c 319#endif
b0019c78 320 TRUE, /* udpsend */
059ec3d9
PH		 321 TRUE /* verify */
322};
323
324/* Flags to identify the modifiers */
325
326static uschar cond_modifiers[] = {
327 FALSE, /* acl */
3e536984 328 TRUE, /* add_header */
059ec3d9 329 FALSE, /* authenticated */
8523533c
TK		 330#ifdef EXPERIMENTAL_BRIGHTMAIL
331 TRUE, /* bmi_optin */
8e669ac1 332#endif
059ec3d9 333 FALSE, /* condition */
c3611384 334 TRUE, /* continue */
059ec3d9 335 TRUE, /* control */
6a8f9482
TK		 336#ifdef EXPERIMENTAL_DCC
337 FALSE, /* dcc */
338#endif
8523533c
TK		 339#ifdef WITH_CONTENT_SCAN
340 FALSE, /* decode */
341#endif
059ec3d9 342 TRUE, /* delay */
8523533c
TK		 343#ifdef WITH_OLD_DEMIME
344 FALSE, /* demime */
fb2274d4 345#endif
80a47a2c
TK		 346#ifndef DISABLE_DKIM
347 FALSE, /* dkim_signers */
348 FALSE, /* dkim_status */
4840604e
TL		 349#endif
350#ifdef EXPERIMENTAL_DMARC
351 FALSE, /* dmarc_status */
8523533c 352#endif
059ec3d9
PH		 353 FALSE, /* dnslists */
354 FALSE, /* domains */
355 FALSE, /* encrypted */
356 TRUE, /* endpass */
357 FALSE, /* hosts */
358 FALSE, /* local_parts */
359 TRUE, /* log_message */
6ea85e9a 360 TRUE, /* log_reject_target */
8523533c
TK		 361 TRUE, /* logwrite */
362#ifdef WITH_CONTENT_SCAN
363 FALSE, /* malware */
364#endif
059ec3d9 365 TRUE, /* message */
8523533c
TK		 366#ifdef WITH_CONTENT_SCAN
367 FALSE, /* mime_regex */
368#endif
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
71fafd95 450 #ifdef WITH_OLD_DEMIME
2f079f46 451 (unsigned int)
fd98a5c6 452 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 453 #ifndef DISABLE_PRDR
fd98a5c6 454 (1<<ACL_WHERE_PRDR)|
8ccd00b1 455 #endif
fd98a5c6 456 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 457 #endif
8e669ac1 458
80a47a2c
TK		 459 #ifndef DISABLE_DKIM
460 (unsigned int)
461 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 462
80a47a2c
TK		 463 (unsigned int)
464 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 465 #endif
fb2274d4 466
4840604e
TL		 467 #ifdef EXPERIMENTAL_DMARC
468 (unsigned int)
469 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
470 #endif
471
45b91596
PH		 472 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
473 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 474
2f079f46 475 (unsigned int)
fd98a5c6 476 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 477 #ifndef DISABLE_PRDR
fd98a5c6
JH		 478 |(1<<ACL_WHERE_PRDR)
479 #endif
480 ),
059ec3d9 481
45b91596
PH		 482 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
483 (1<<ACL_WHERE_CONNECT)|
484 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 485 (1<<ACL_WHERE_HELO),
8e669ac1 486
059ec3d9 487 0, /* endpass */
8e669ac1 488
45b91596
PH		 489 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
490 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 491
2f079f46 492 (unsigned int)
fd98a5c6 493 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 494 #ifndef DISABLE_PRDR
fd98a5c6
JH		 495 |(1<<ACL_WHERE_PRDR)
496 #endif
497 ),
059ec3d9
PH		 498
499 0, /* log_message */
8e669ac1 500
6ea85e9a
PH		 501 0, /* log_reject_target */
502
059ec3d9 503 0, /* logwrite */
8e669ac1 504
71fafd95 505 #ifdef WITH_CONTENT_SCAN
2f079f46 506 (unsigned int)
fd98a5c6 507 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 508 #ifndef DISABLE_PRDR
fd98a5c6 509 (1<<ACL_WHERE_PRDR)|
8ccd00b1 510 #endif
fd98a5c6 511 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 512 #endif
8523533c 513
059ec3d9
PH		 514 0, /* message */
515
71fafd95 516 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 517 (unsigned int)
518 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 519 #endif
8523533c 520
870f6ba8
TF		 521 0, /* ratelimit */
522
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46 527 (unsigned int)
fd98a5c6 528 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 529 #ifndef DISABLE_PRDR
fd98a5c6 530 (1<<ACL_WHERE_PRDR)|
8ccd00b1 531 #endif
fd98a5c6 532 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 533 (1<<ACL_WHERE_MIME)),
71fafd95 534 #endif
8523533c 535
e7568d51
TL		 536 (unsigned int)
537 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
538 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6
JH		 540 (1<<ACL_WHERE_PRDR)|
541 #endif
e7568d51
TL		 542 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
543 (1<<ACL_WHERE_NOTSMTP_START)),
544
059ec3d9
PH		 545 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
546 (1<<ACL_WHERE_HELO)|
547 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
548 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
549 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 0, /* set */
558
71fafd95 559 #ifdef WITH_CONTENT_SCAN
2f079f46 560 (unsigned int)
fd98a5c6 561 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 562 #ifndef DISABLE_PRDR
fd98a5c6 563 (1<<ACL_WHERE_PRDR)|
8ccd00b1 564 #endif
fd98a5c6 565 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 566 #endif
8523533c 567
71fafd95 568 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 569 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
570 (1<<ACL_WHERE_HELO)|
571 (1<<ACL_WHERE_MAILAUTH)|
572 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 573 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
574 (1<<ACL_WHERE_NOTSMTP)|
575 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 576
577 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
578 (1<<ACL_WHERE_HELO)|
579 (1<<ACL_WHERE_MAILAUTH)|
580 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
581 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
582 (1<<ACL_WHERE_NOTSMTP)|
583 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 584 #endif
8523533c 585
b0019c78
TF		 586 0, /* udpsend */
587
059ec3d9
PH		 588 /* Certain types of verify are always allowed, so we let it through
589 always and check in the verify function itself */
590
591 0 /* verify */
059ec3d9
PH		 592};
593
594
c5fcb476
PH		 595/* Bit map vector of which controls are not allowed at certain times. For
596each control, there's a bitmap of dis-allowed times. For some, it is easier to
597specify the negation of a small number of allowed times. */
598
599static unsigned int control_forbids[] = {
c46782ef
PH		 600 (unsigned int)
601 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
602
603 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 604 0, /* bmi_run */
c46782ef
PH		 605 #endif
606
ed7f7860
PP		 607 0, /* debug */
608
80a47a2c
TK		 609 #ifndef DISABLE_DKIM
610 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
8ccd00b1 611 #ifndef DISABLE_PRDR
fd98a5c6 612 (1<<ACL_WHERE_PRDR)|
8ccd00b1 613 #endif
f7572e5a
TK		 614 (1<<ACL_WHERE_NOTSMTP_START),
615 #endif
616
4840604e
TL		 617 #ifdef EXPERIMENTAL_DMARC
618 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
619 (1<<ACL_WHERE_NOTSMTP_START),
620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
621 (1<<ACL_WHERE_NOTSMTP_START),
622 #endif
623
13363eba
PP		 624 (1<<ACL_WHERE_NOTSMTP)|
625 (1<<ACL_WHERE_NOTSMTP_START)|
626 (1<<ACL_WHERE_NOTQUIT), /* dscp */
627
c5fcb476 628 0, /* error */
8e669ac1
PH		 629
630 (unsigned int)
c5fcb476 631 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 632
633 (unsigned int)
c5fcb476 634 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 635
e4bdf652
JH		 636 (unsigned int)
637 0, /* cutthrough_delivery */
638
45b91596
PH		 639 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
640 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 641
45b91596
PH		 642 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
643 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 644
645 (unsigned int)
c5fcb476
PH		 646 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
647 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 648 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 649 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 659 (1<<ACL_WHERE_PREDATA)),
8523533c 660
8800895a
PH		 661 (unsigned int)
662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 663 (1<<ACL_WHERE_PREDATA)|
664 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 665
c46782ef 666 #ifdef WITH_CONTENT_SCAN
8e669ac1 667 (unsigned int)
14d57970 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 669 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 670 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 671 (1<<ACL_WHERE_MIME)),
c46782ef 672 #endif
a6c4ab60 673
29aba418
TF		 674 (unsigned int)
675 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
676 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 677 #ifndef DISABLE_PRDR
fd98a5c6 678 (1<<ACL_WHERE_PRDR)|
8ccd00b1 679 #endif
29aba418
TF		 680 (1<<ACL_WHERE_MIME)),
681
8e669ac1 682 (unsigned int)
a6c4ab60 683 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 684 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 685 #ifndef DISABLE_PRDR
fd98a5c6 686 (1<<ACL_WHERE_PRDR)|
8ccd00b1 687 #endif
e715ad22 688 (1<<ACL_WHERE_MIME)),
8523533c 689
45b91596 690 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 691 (1<<ACL_WHERE_NOTSMTP_START),
692
693 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 694 (1<<ACL_WHERE_NOTSMTP_START),
695
696 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 697 (1<<ACL_WHERE_NOTSMTP_START),
698
699 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 700 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 701};
702
703/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 704
705typedef struct control_def {
706 uschar *name;
707 int value; /* CONTROL_xxx value */
059ec3d9
PH		 708 BOOL has_option; /* Has /option(s) following */
709} control_def;
710
711static control_def controls_list[] = {
c46782ef 712 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 713#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 714 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 715#endif
ed7f7860 716 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK		 717#ifndef DISABLE_DKIM
718 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 719#endif
720#ifdef EXPERIMENTAL_DMARC
721 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
722 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 723#endif
13363eba 724 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH		 725 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
726 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
727 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
728 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 729 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 730 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH		 731 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
732 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 733 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 734 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 735#ifdef WITH_CONTENT_SCAN
c46782ef 736 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 737#endif
c46782ef
PH		 738 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
739 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
740 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH		 741 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
742 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH		 743 };
744
e5a9dba6
PH		 745/* Support data structures for Client SMTP Authorization. acl_verify_csa()
746caches its result in a tree to avoid repeated DNS queries. The result is an
747integer code which is used as an index into the following tables of
748explanatory strings and verification return codes. */
749
750static tree_node *csa_cache = NULL;
751
752enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
753 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
754
755/* The acl_verify_csa() return code is translated into an acl_verify() return
756code using the following table. It is OK unless the client is definitely not
757authorized. This is because CSA is supposed to be optional for sending sites,
758so recipients should not be too strict about checking it - especially because
759DNS problems are quite likely to occur. It's possible to use $csa_status in
760further ACL conditions to distinguish ok, unknown, and defer if required, but
761the aim is to make the usual configuration simple. */
762
763static int csa_return_code[] = {
764 OK, OK, OK, OK,
765 FAIL, FAIL, FAIL, FAIL
766};
767
768static uschar *csa_status_string[] = {
769 US"unknown", US"ok", US"defer", US"defer",
770 US"fail", US"fail", US"fail", US"fail"
771};
772
773static uschar *csa_reason_string[] = {
774 US"unknown",
775 US"ok",
776 US"deferred (SRV lookup failed)",
777 US"deferred (target address lookup failed)",
778 US"failed (explicit authorization required)",
779 US"failed (host name not authorized)",
780 US"failed (no authorized addresses)",
781 US"failed (client address mismatch)"
782};
783
c99ce5c9
TF		 784/* Options for the ratelimit condition. Note that there are two variants of
785the per_rcpt option, depending on the ACL that is used to measure the rate.
786However any ACL must be able to look up per_rcpt rates in /noupdate mode,
787so the two variants must have the same internal representation as well as
788the same configuration string. */
789
790enum {
791 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
792 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
793};
794
795#define RATE_SET(var,new) \
796 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
797
798static uschar *ratelimit_option_string[] = {
799 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
800 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
801};
802
059ec3d9
PH		 803/* Enable recursion between acl_check_internal() and acl_check_condition() */
804
55414b25 805static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 806 uschar **);
059ec3d9
PH		 807
808
809/*************************************************
810* Pick out name from list *
811*************************************************/
812
813/* Use a binary chop method
814
815Arguments:
816 name name to find
817 list list of names
818 end size of list
819
820Returns: offset in list, or -1 if not found
821*/
822
823static int
824acl_checkname(uschar *name, uschar **list, int end)
825{
826int start = 0;
827
828while (start < end)
829 {
830 int mid = (start + end)/2;
831 int c = Ustrcmp(name, list[mid]);
832 if (c == 0) return mid;
833 if (c < 0) end = mid; else start = mid + 1;
834 }
835
836return -1;
837}
838
839
840/*************************************************
841* Read and parse one ACL *
842*************************************************/
843
844/* This function is called both from readconf in order to parse the ACLs in the
845configuration file, and also when an ACL is encountered dynamically (e.g. as
846the result of an expansion). It is given a function to call in order to
847retrieve the lines of the ACL. This function handles skipping comments and
848blank lines (where relevant).
849
850Arguments:
851 func function to get next line of ACL
852 error where to put an error message
853
854Returns: pointer to ACL, or NULL
855 NULL can be legal (empty ACL); in this case error will be NULL
856*/
857
858acl_block *
859acl_read(uschar *(*func)(void), uschar **error)
860{
861acl_block *yield = NULL;
862acl_block **lastp = &yield;
863acl_block *this = NULL;
864acl_condition_block *cond;
865acl_condition_block **condp = NULL;
866uschar *s;
867
868*error = NULL;
869
870while ((s = (*func)()) != NULL)
871 {
872 int v, c;
873 BOOL negated = FALSE;
874 uschar *saveline = s;
875 uschar name[64];
876
877 /* Conditions (but not verbs) are allowed to be negated by an initial
878 exclamation mark. */
879
880 while (isspace(*s)) s++;
881 if (*s == '!')
882 {
883 negated = TRUE;
884 s++;
885 }
886
cf00dad6
PH		 887 /* Read the name of a verb or a condition, or the start of a new ACL, which
888 can be started by a name, or by a macro definition. */
059ec3d9
PH		 889
890 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 891 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 892
893 /* If a verb is unrecognized, it may be another condition or modifier that
894 continues the previous verb. */
895
896 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
897 if (v < 0)
898 {
899 if (this == NULL)
900 {
4e167a8c
PH		 901 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
902 saveline);
059ec3d9
PH		 903 return NULL;
904 }
905 }
906
907 /* New verb */
908
909 else
910 {
911 if (negated)
912 {
913 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
914 return NULL;
915 }
916 this = store_get(sizeof(acl_block));
917 *lastp = this;
918 lastp = &(this->next);
919 this->next = NULL;
920 this->verb = v;
921 this->condition = NULL;
922 condp = &(this->condition);
923 if (*s == 0) continue; /* No condition on this line */
924 if (*s == '!')
925 {
926 negated = TRUE;
927 s++;
928 }
929 s = readconf_readname(name, sizeof(name), s); /* Condition name */
930 }
931
932 /* Handle a condition or modifier. */
933
934 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
935 if (c < 0)
936 {
937 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
938 saveline);
939 return NULL;
940 }
941
942 /* The modifiers may not be negated */
943
944 if (negated && cond_modifiers[c])
945 {
946 *error = string_sprintf("ACL error: negation is not allowed with "
947 "\"%s\"", conditions[c]);
948 return NULL;
949 }
950
951 /* ENDPASS may occur only with ACCEPT or DISCARD. */
952
953 if (c == ACLC_ENDPASS &&
954 this->verb != ACL_ACCEPT &&
955 this->verb != ACL_DISCARD)
956 {
957 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
958 conditions[c], verbs[this->verb]);
959 return NULL;
960 }
961
962 cond = store_get(sizeof(acl_condition_block));
963 cond->next = NULL;
964 cond->type = c;
965 cond->u.negated = negated;
966
967 *condp = cond;
968 condp = &(cond->next);
969
970 /* The "set" modifier is different in that its argument is "name=value"
971 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 972 gives us a variable name to insert into the data block. The original ACL
973 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
974 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 975 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
976 After that, we allow alphanumerics and underscores, but the first character
977 after c or m must be a digit or an underscore. This retains backwards
978 compatibility. */
059ec3d9
PH		 979
980 if (c == ACLC_SET)
981 {
47ca6d6c
PH		 982 uschar *endptr;
983
38a0a95f
PH		 984 if (Ustrncmp(s, "acl_c", 5) != 0 &&
985 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 986 {
38a0a95f
PH		 987 *error = string_sprintf("invalid variable name after \"set\" in ACL "
988 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
989 return NULL;
47ca6d6c 990 }
38a0a95f
PH		 991
992 endptr = s + 5;
641cb756
PH		 993 if (!isdigit(*endptr) && *endptr != '_')
994 {
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
997 s);
998 return NULL;
999 }
1000
38a0a95f 1001 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1002 {
38a0a95f
PH		 1003 if (!isalnum(*endptr) && *endptr != '_')
1004 {
1005 *error = string_sprintf("invalid character \"%c\" in variable name "
1006 "in ACL modifier \"set %s\"", *endptr, s);
1007 return NULL;
1008 }
1009 endptr++;
47ca6d6c 1010 }
47ca6d6c 1011
38a0a95f 1012 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1013 s = endptr;
059ec3d9
PH		 1014 while (isspace(*s)) s++;
1015 }
1016
1017 /* For "set", we are now positioned for the data. For the others, only
1018 "endpass" has no data */
1019
1020 if (c != ACLC_ENDPASS)
1021 {
1022 if (*s++ != '=')
1023 {
1024 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1025 cond_modifiers[c]? US"modifier" : US"condition");
1026 return NULL;
1027 }
1028 while (isspace(*s)) s++;
1029 cond->arg = string_copy(s);
1030 }
1031 }
1032
1033return yield;
1034}
1035
1036
1037
71fafd95
PH		 1038/*************************************************
1039* Set up added header line(s) *
1040*************************************************/
1041
1042/* This function is called by the add_header modifier, and also from acl_warn()
1043to implement the now-deprecated way of adding header lines using "message" on a
1044"warn" verb. The argument is treated as a sequence of header lines which are
1045added to a chain, provided there isn't an identical one already there.
1046
1047Argument: string of header lines
1048Returns: nothing
1049*/
1050
1051static void
55414b25 1052setup_header(const uschar *hstring)
71fafd95 1053{
55414b25 1054const uschar *p, *q;
71fafd95
PH		 1055int hlen = Ustrlen(hstring);
1056
b1b05573
JH		 1057/* Ignore any leading newlines */
1058while (*hstring == '\n') hstring++, hlen--;
71fafd95 1059
b1b05573 1060/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1061if (hlen <= 0) return;
55414b25
JH		 1062if (hstring[--hlen] != '\n')
1063 q = string_sprintf("%s\n", hstring);
1064else if (hstring[hlen-1] == '\n')
1065 {
1066 uschar * s = string_copy(hstring);
1067 while(s[--hlen] == '\n')
1068 s[hlen+1] = '\0';
1069 q = s;
1070 }
1071else
1072 q = hstring;
71fafd95
PH		 1073
1074/* Loop for multiple header lines, taking care about continuations */
1075
55414b25 1076for (p = q; *p != 0; )
71fafd95 1077 {
55414b25
JH		 1078 const uschar *s;
1079 uschar * hdr;
71fafd95
PH		 1080 int newtype = htype_add_bot;
1081 header_line **hptr = &acl_added_headers;
1082
1083 /* Find next header line within the string */
1084
1085 for (;;)
1086 {
1087 q = Ustrchr(q, '\n');
1088 if (*(++q) != ' ' && *q != '\t') break;
1089 }
1090
1091 /* If the line starts with a colon, interpret the instruction for where to
1092 add it. This temporarily sets up a new type. */
1093
1094 if (*p == ':')
1095 {
1096 if (strncmpic(p, US":after_received:", 16) == 0)
1097 {
1098 newtype = htype_add_rec;
1099 p += 16;
1100 }
1101 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1102 {
1103 newtype = htype_add_rfc;
1104 p += 14;
1105 }
1106 else if (strncmpic(p, US":at_start:", 10) == 0)
1107 {
1108 newtype = htype_add_top;
1109 p += 10;
1110 }
1111 else if (strncmpic(p, US":at_end:", 8) == 0)
1112 {
1113 newtype = htype_add_bot;
1114 p += 8;
1115 }
1116 while (*p == ' ' || *p == '\t') p++;
1117 }
1118
1119 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1120 to the front of it. */
1121
1122 for (s = p; s < q - 1; s++)
1123 {
1124 if (*s == ':' || !isgraph(*s)) break;
1125 }
1126
55414b25
JH		 1127 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1128 hlen = Ustrlen(hdr);
71fafd95
PH		 1129
1130 /* See if this line has already been added */
1131
1132 while (*hptr != NULL)
1133 {
55414b25 1134 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1135 hptr = &((*hptr)->next);
1136 }
1137
1138 /* Add if not previously present */
1139
1140 if (*hptr == NULL)
1141 {
1142 header_line *h = store_get(sizeof(header_line));
55414b25 1143 h->text = hdr;
71fafd95
PH		 1144 h->next = NULL;
1145 h->type = newtype;
1146 h->slen = hlen;
1147 *hptr = h;
1148 hptr = &(h->next);
1149 }
1150
1151 /* Advance for next header line within the string */
1152
1153 p = q;
1154 }
1155}
1156
1157
1158
362145b5
JH		 1159/*************************************************
1160* List the added header lines *
1161*************************************************/
1162uschar *
1163fn_hdrs_added(void)
1164{
1165uschar * ret = NULL;
1166header_line * h = acl_added_headers;
1167uschar * s;
1168uschar * cp;
1169int size = 0;
1170int ptr = 0;
1171
1172if (!h) return NULL;
1173
1174do
1175 {
1176 s = h->text;
1177 while ((cp = Ustrchr(s, '\n')) != NULL)
1178 {
1179 if (cp[1] == '\0') break;
1180
1181 /* contains embedded newline; needs doubling */
1182 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1183 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1184 s = cp+1;
1185 }
1186 /* last bit of header */
1187
1188 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1189 }
6d9cfc47 1190while((h = h->next));
362145b5
JH		 1191
1192ret[ptr-1] = '\0'; /* overwrite last newline */
1193return ret;
1194}
1195
1196
e7568d51
TL		 1197/*************************************************
1198* Set up removed header line(s) *
1199*************************************************/
1200
1201/* This function is called by the remove_header modifier. The argument is
1202treated as a sequence of header names which are added to a colon separated
1203list, provided there isn't an identical one already there.
1204
1205Argument: string of header names
1206Returns: nothing
1207*/
1208
1209static void
55414b25 1210setup_remove_header(const uschar *hnames)
e7568d51
TL		 1211{
1212if (*hnames != 0)
55414b25
JH		 1213 acl_removed_headers = acl_removed_headers
1214 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1215 : string_copy(hnames);
e7568d51
TL		 1216}
1217
1218
71fafd95 1219
059ec3d9
PH		 1220/*************************************************
1221* Handle warnings *
1222*************************************************/
1223
1224/* This function is called when a WARN verb's conditions are true. It adds to
1225the message's headers, and/or writes information to the log. In each case, this
1226only happens once (per message for headers, per connection for log).
1227
71fafd95
PH		 1228** NOTE: The header adding action using the "message" setting is historic, and
1229its use is now deprecated. The new add_header modifier should be used instead.
1230
059ec3d9
PH		 1231Arguments:
1232 where ACL_WHERE_xxxx indicating which ACL this is
1233 user_message message for adding to headers
1234 log_message message for logging, if different
1235
1236Returns: nothing
1237*/
1238
1239static void
1240acl_warn(int where, uschar *user_message, uschar *log_message)
1241{
059ec3d9
PH		 1242if (log_message != NULL && log_message != user_message)
1243 {
1244 uschar *text;
1245 string_item *logged;
1246
1247 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1248 string_printing(log_message));
1249
1250 /* If a sender verification has failed, and the log message is "sender verify
1251 failed", add the failure message. */
1252
1253 if (sender_verified_failed != NULL &&
1254 sender_verified_failed->message != NULL &&
1255 strcmpic(log_message, US"sender verify failed") == 0)
1256 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1257
9c7a242c
PH		 1258 /* Search previously logged warnings. They are kept in malloc
1259 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1260
1261 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1262 if (Ustrcmp(logged->text, text) == 0) break;
1263
1264 if (logged == NULL)
1265 {
1266 int length = Ustrlen(text) + 1;
1267 log_write(0, LOG_MAIN, "%s", text);
1268 logged = store_malloc(sizeof(string_item) + length);
1269 logged->text = (uschar *)logged + sizeof(string_item);
1270 memcpy(logged->text, text, length);
1271 logged->next = acl_warn_logged;
1272 acl_warn_logged = logged;
1273 }
1274 }
1275
1276/* If there's no user message, we are done. */
1277
1278if (user_message == NULL) return;
1279
1280/* If this isn't a message ACL, we can't do anything with a user message.
1281Log an error. */
1282
1283if (where > ACL_WHERE_NOTSMTP)
1284 {
1285 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1286 "found in a non-message (%s) ACL: cannot specify header lines here: "
1287 "message ignored", acl_wherenames[where]);
1288 return;
1289 }
1290
71fafd95
PH		 1291/* The code for setting up header lines is now abstracted into a separate
1292function so that it can be used for the add_header modifier as well. */
059ec3d9 1293
71fafd95 1294setup_header(user_message);
059ec3d9
PH		 1295}
1296
1297
1298
1299/*************************************************
1300* Verify and check reverse DNS *
1301*************************************************/
1302
1303/* Called from acl_verify() below. We look up the host name(s) of the client IP
1304address if this has not yet been done. The host_name_lookup() function checks
1305that one of these names resolves to an address list that contains the client IP
1306address, so we don't actually have to do the check here.
1307
1308Arguments:
1309 user_msgptr pointer for user message
1310 log_msgptr pointer for log message
1311
1312Returns: OK verification condition succeeded
1313 FAIL verification failed
1314 DEFER there was a problem verifying
1315*/
1316
1317static int
1318acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1319{
1320int rc;
1321
1322user_msgptr = user_msgptr; /* stop compiler warning */
1323
1324/* Previous success */
1325
1326if (sender_host_name != NULL) return OK;
1327
1328/* Previous failure */
1329
1330if (host_lookup_failed)
1331 {
1332 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1333 return FAIL;
1334 }
1335
1336/* Need to do a lookup */
1337
1338HDEBUG(D_acl)
1339 debug_printf("looking up host name to force name/address consistency check\n");
1340
1341if ((rc = host_name_lookup()) != OK)
1342 {
1343 *log_msgptr = (rc == DEFER)?
1344 US"host lookup deferred for reverse lookup check"
1345 :
1346 string_sprintf("host lookup failed for reverse lookup check%s",
1347 host_lookup_msg);
1348 return rc; /* DEFER or FAIL */
1349 }
1350
1351host_build_sender_fullhost();
1352return OK;
1353}
1354
1355
1356
e5a9dba6
PH		 1357/*************************************************
1358* Check client IP address matches CSA target *
1359*************************************************/
1360
1361/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1362response for address records belonging to the CSA target hostname. The section
1363is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1364If one of the addresses matches the client's IP address, then the client is
1365authorized by CSA. If there are target IP addresses but none of them match
1366then the client is using an unauthorized IP address. If there are no target IP
1367addresses then the client cannot be using an authorized IP address. (This is
1368an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1369
1370Arguments:
1371 dnsa the DNS answer block
1372 dnss a DNS scan block for us to use
1373 reset option specifing what portion to scan, as described above
1374 target the target hostname to use for matching RR names
1375
1376Returns: CSA_OK successfully authorized
1377 CSA_FAIL_MISMATCH addresses found but none matched
1378 CSA_FAIL_NOADDR no target addresses found
1379*/
1380
1381static int
1382acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1383 uschar *target)
1384{
1385dns_record *rr;
1386dns_address *da;
1387
1388BOOL target_found = FALSE;
1389
1390for (rr = dns_next_rr(dnsa, dnss, reset);
1391 rr != NULL;
1392 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1393 {
1394 /* Check this is an address RR for the target hostname. */
1395
1396 if (rr->type != T_A
1397 #if HAVE_IPV6
1398 && rr->type != T_AAAA
e5a9dba6
PH		 1399 #endif
1400 ) continue;
1401
1402 if (strcmpic(target, rr->name) != 0) continue;
1403
1404 target_found = TRUE;
1405
1406 /* Turn the target address RR into a list of textual IP addresses and scan
1407 the list. There may be more than one if it is an A6 RR. */
1408
1409 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1410 {
1411 /* If the client IP address matches the target IP address, it's good! */
1412
1413 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1414
1415 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1416 }
1417 }
1418
1419/* If we found some target addresses but none of them matched, the client is
1420using an unauthorized IP address, otherwise the target has no authorized IP
1421addresses. */
1422
1423if (target_found) return CSA_FAIL_MISMATCH;
1424else return CSA_FAIL_NOADDR;
1425}
1426
1427
1428
1429/*************************************************
1430* Verify Client SMTP Authorization *
1431*************************************************/
1432
1433/* Called from acl_verify() below. This routine calls dns_lookup_special()
1434to find the CSA SRV record corresponding to the domain argument, or
1435$sender_helo_name if no argument is provided. It then checks that the
1436client is authorized, and that its IP address corresponds to the SRV
1437target's address by calling acl_verify_csa_address() above. The address
1438should have been returned in the DNS response's ADDITIONAL section, but if
1439not we perform another DNS lookup to get it.
1440
1441Arguments:
1442 domain pointer to optional parameter following verify = csa
1443
1444Returns: CSA_UNKNOWN no valid CSA record found
1445 CSA_OK successfully authorized
1446 CSA_FAIL_* client is definitely not authorized
1447 CSA_DEFER_* there was a DNS problem
1448*/
1449
1450static int
55414b25 1451acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1452{
1453tree_node *t;
55414b25
JH		 1454const uschar *found;
1455uschar *p;
e5a9dba6
PH		 1456int priority, weight, port;
1457dns_answer dnsa;
1458dns_scan dnss;
1459dns_record *rr;
1460int rc, type;
1461uschar target[256];
1462
1463/* Work out the domain we are using for the CSA lookup. The default is the
1464client's HELO domain. If the client has not said HELO, use its IP address
1465instead. If it's a local client (exim -bs), CSA isn't applicable. */
1466
1467while (isspace(*domain) && *domain != '\0') ++domain;
1468if (*domain == '\0') domain = sender_helo_name;
1469if (domain == NULL) domain = sender_host_address;
1470if (sender_host_address == NULL) return CSA_UNKNOWN;
1471
1472/* If we have an address literal, strip off the framing ready for turning it
1473into a domain. The framing consists of matched square brackets possibly
1474containing a keyword and a colon before the actual IP address. */
1475
1476if (domain[0] == '[')
1477 {
55414b25 1478 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1479 if (start == NULL) start = domain;
1480 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1481 }
1482
1483/* Turn domains that look like bare IP addresses into domains in the reverse
1484DNS. This code also deals with address literals and $sender_host_address. It's
1485not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1486address literals, but it's probably the most friendly thing to do. This is an
1487extension to CSA, so we allow it to be turned off for proper conformance. */
1488
7e66e54d 1489if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1490 {
1491 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1492 dns_build_reverse(domain, target);
1493 domain = target;
1494 }
1495
1496/* Find out if we've already done the CSA check for this domain. If we have,
1497return the same result again. Otherwise build a new cached result structure
1498for this domain. The name is filled in now, and the value is filled in when
1499we return from this function. */
1500
1501t = tree_search(csa_cache, domain);
1502if (t != NULL) return t->data.val;
1503
1504t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1505Ustrcpy(t->name, domain);
1506(void)tree_insertnode(&csa_cache, t);
1507
1508/* Now we are ready to do the actual DNS lookup(s). */
1509
28e6ef29 1510found = domain;
e5a9dba6
PH		 1511switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1512 {
1513 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1514
1515 default:
1516 return t->data.val = CSA_DEFER_SRV;
1517
1518 /* If we found nothing, the client's authorization is unknown. */
1519
1520 case DNS_NOMATCH:
1521 case DNS_NODATA:
1522 return t->data.val = CSA_UNKNOWN;
1523
1524 /* We got something! Go on to look at the reply in more detail. */
1525
1526 case DNS_SUCCEED:
1527 break;
1528 }
1529
1530/* Scan the reply for well-formed CSA SRV records. */
1531
1532for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1533 rr != NULL;
1534 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1535 {
1536 if (rr->type != T_SRV) continue;
1537
1538 /* Extract the numerical SRV fields (p is incremented) */
1539
1540 p = rr->data;
1541 GETSHORT(priority, p);
1542 GETSHORT(weight, p);
1543 GETSHORT(port, p);
1544
1545 DEBUG(D_acl)
1546 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1547
1548 /* Check the CSA version number */
1549
1550 if (priority != 1) continue;
1551
1552 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1553 found by dns_special_lookup() is a parent of the one we asked for), we check
1554 the subdomain assertions in the port field. At the moment there's only one
1555 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1556 SRV records of their own. */
1557
1dc92d5a 1558 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1559 {
1560 if (port & 1)
1561 return t->data.val = CSA_FAIL_EXPLICIT;
1562 else
1563 return t->data.val = CSA_UNKNOWN;
1564 }
1565
1566 /* This CSA SRV record refers directly to our domain, so we check the value
1567 in the weight field to work out the domain's authorization. 0 and 1 are
1568 unauthorized; 3 means the client is authorized but we can't check the IP
1569 address in order to authenticate it, so we treat it as unknown; values
1570 greater than 3 are undefined. */
1571
1572 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1573
1574 if (weight > 2) continue;
1575
1576 /* Weight == 2, which means the domain is authorized. We must check that the
1577 client's IP address is listed as one of the SRV target addresses. Save the
1578 target hostname then break to scan the additional data for its addresses. */
1579
1580 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1581 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1582
1583 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1584
1585 break;
1586 }
1587
1588/* If we didn't break the loop then no appropriate records were found. */
1589
1590if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1591
1592/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1593A target of "." indicates there are no valid addresses, so the client cannot
1594be authorized. (This is an odd configuration because weight=2 target=. is
1595equivalent to weight=1, but we check for it in order to keep load off the
1596root name servers.) Note that dn_expand() turns "." into "". */
1597
1598if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1599
1600/* Scan the additional section of the CSA SRV reply for addresses belonging
1601to the target. If the name server didn't return any additional data (e.g.
1602because it does not fully support SRV records), we need to do another lookup
1603to obtain the target addresses; otherwise we have a definitive result. */
1604
1605rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1606if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1607
1608/* The DNS lookup type corresponds to the IP version used by the client. */
1609
1610#if HAVE_IPV6
1611if (Ustrchr(sender_host_address, ':') != NULL)
1612 type = T_AAAA;
1613else
1614#endif /* HAVE_IPV6 */
1615 type = T_A;
1616
1617
4e0983dc 1618lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1619switch (dns_lookup(&dnsa, target, type, NULL))
1620 {
1621 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1622
1623 default:
cc00f4af 1624 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1625
1626 /* If the query succeeded, scan the addresses and return the result. */
1627
1628 case DNS_SUCCEED:
cc00f4af
JH		 1629 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1630 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1631 /* else fall through */
e5a9dba6
PH		 1632
1633 /* If the target has no IP addresses, the client cannot have an authorized
1634 IP address. However, if the target site uses A6 records (not AAAA records)
1635 we have to do yet another lookup in order to check them. */
1636
1637 case DNS_NOMATCH:
1638 case DNS_NODATA:
cc00f4af 1639 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1640 }
1641}
1642
1643
1644
059ec3d9
PH		 1645/*************************************************
1646* Handle verification (address & other) *
1647*************************************************/
1648
89583014 1649enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1650 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1651 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1652 };
1653typedef struct {
1654 uschar * name;
1655 int value;
1656 unsigned where_allowed; /* bitmap */
1657 BOOL no_options; /* Never has /option(s) following */
1658 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1659 } verify_type_t;
1660static verify_type_t verify_type_list[] = {
7e8360e6 1661 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1662 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1663 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1664 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1665 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1666 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1667 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1668 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1669 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1670 FALSE, 6 },
770747fd
MFM		 1671 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1672 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1673 };
1674
1675
1676enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1677 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1678 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1679 CALLOUT_TIME
1680 };
1681typedef struct {
1682 uschar * name;
1683 int value;
1684 int flag;
1685 BOOL has_option; /* Has =option(s) following */
1686 BOOL timeval; /* Has a time value */
1687 } callout_opt_t;
1688static callout_opt_t callout_opt_list[] = {
1689 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1690 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1691 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1692 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1693 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1694 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1695 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1696 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1697 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1698 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1699 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1700 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1701 };
1702
1703
1704
059ec3d9
PH		 1705/* This function implements the "verify" condition. It is called when
1706encountered in any ACL, because some tests are almost always permitted. Some
1707just don't make sense, and always fail (for example, an attempt to test a host
1708lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1709
1710Arguments:
1711 where where called from
1712 addr the recipient address that the ACL is handling, or NULL
1713 arg the argument of "verify"
1714 user_msgptr pointer for user message
1715 log_msgptr pointer for log message
1716 basic_errno where to put verify errno
1717
1718Returns: OK verification condition succeeded
1719 FAIL verification failed
1720 DEFER there was a problem verifying
1721 ERROR syntax error
1722*/
1723
1724static int
55414b25 1725acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1726 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1727{
1728int sep = '/';
1729int callout = -1;
1730int callout_overall = -1;
4deaf07d 1731int callout_connect = -1;
059ec3d9
PH		 1732int verify_options = 0;
1733int rc;
1734BOOL verify_header_sender = FALSE;
1735BOOL defer_ok = FALSE;
1736BOOL callout_defer_ok = FALSE;
1737BOOL no_details = FALSE;
eafd343b 1738BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1739address_item *sender_vaddr = NULL;
1740uschar *verify_sender_address = NULL;
1741uschar *pm_mailfrom = NULL;
1742uschar *se_mailfrom = NULL;
596875b3
PH		 1743
1744/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1745an error if options are given for items that don't expect them.
596875b3
PH		 1746*/
1747
1748uschar *slash = Ustrchr(arg, '/');
55414b25 1749const uschar *list = arg;
059ec3d9 1750uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1751verify_type_t * vp;
059ec3d9
PH		 1752
1753if (ss == NULL) goto BAD_VERIFY;
1754
1755/* Handle name/address consistency verification in a separate function. */
1756
89583014
JH		 1757for (vp= verify_type_list;
1758 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1759 vp++
1760 )
1761 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1762 : strcmpic (ss, vp->name) == 0)
1763 break;
1764if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1765 goto BAD_VERIFY;
1766
1767if (vp->no_options && slash != NULL)
059ec3d9 1768 {
89583014
JH		 1769 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1770 "(this verify item has no options)", arg);
1771 return ERROR;
059ec3d9 1772 }
89583014 1773if (!(vp->where_allowed & (1<<where)))
059ec3d9 1774 {
89583014
JH		 1775 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1776 return ERROR;
059ec3d9 1777 }
89583014 1778switch(vp->value)
596875b3 1779 {
89583014
JH		 1780 case VERIFY_REV_HOST_LKUP:
1781 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1782 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1783 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1784 if (strcmpic(ss, US"defer_ok") == 0)
1785 return OK;
1786 return rc;
059ec3d9 1787
89583014
JH		 1788 case VERIFY_CERT:
1789 /* TLS certificate verification is done at STARTTLS time; here we just
1790 test whether it was successful or not. (This is for optional verification; for
1791 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1792
817d9f57 1793 if (tls_in.certificate_verified) return OK;
89583014
JH		 1794 *user_msgptr = US"no verified certificate";
1795 return FAIL;
e5a9dba6 1796
89583014
JH		 1797 case VERIFY_HELO:
1798 /* We can test the result of optional HELO verification that might have
1799 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1800
89583014
JH		 1801 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1802 return helo_verified? OK : FAIL;
059ec3d9 1803
89583014
JH		 1804 case VERIFY_CSA:
1805 /* Do Client SMTP Authorization checks in a separate function, and turn the
1806 result code into user-friendly strings. */
1c41c9cc 1807
89583014
JH		 1808 rc = acl_verify_csa(list);
1809 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1810 csa_reason_string[rc]);
1811 csa_status = csa_status_string[rc];
1812 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1813 return csa_return_code[rc];
1814
1815 case VERIFY_HDR_SYNTAX:
1816 /* Check that all relevant header lines have the correct syntax. If there is
1817 a syntax error, we return details of the error to the sender if configured to
1818 send out full details. (But a "message" setting on the ACL can override, as
1819 always). */
1820
1821 rc = verify_check_headers(log_msgptr);
1822 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1823 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1824 return rc;
059ec3d9 1825
770747fd
MFM		 1826 case VERIFY_HDR_NAMES_ASCII:
1827 /* Check that all header names are true 7 bit strings
1828 See RFC 5322, 2.2. and RFC 6532, 3. */
1829
1830 rc = verify_check_header_names_ascii(log_msgptr);
1831 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 return rc;
1834
89583014
JH		 1835 case VERIFY_NOT_BLIND:
1836 /* Check that no recipient of this message is "blind", that is, every envelope
1837 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1838
89583014
JH		 1839 rc = verify_check_notblind();
1840 if (rc != OK)
1841 {
1842 *log_msgptr = string_sprintf("bcc recipient detected");
1843 if (smtp_return_error_details)
1844 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1845 }
1846 return rc;
059ec3d9 1847
89583014
JH		 1848 /* The remaining verification tests check recipient and sender addresses,
1849 either from the envelope or from the header. There are a number of
1850 slash-separated options that are common to all of them. */
059ec3d9 1851
89583014
JH		 1852 case VERIFY_HDR_SNDR:
1853 verify_header_sender = TRUE;
1854 break;
059ec3d9 1855
89583014
JH		 1856 case VERIFY_SNDR:
1857 /* In the case of a sender, this can optionally be followed by an address to use
1858 in place of the actual sender (rare special-case requirement). */
059ec3d9 1859 {
89583014
JH		 1860 uschar *s = ss + 6;
1861 if (*s == 0)
1862 verify_sender_address = sender_address;
1863 else
1864 {
1865 while (isspace(*s)) s++;
1866 if (*s++ != '=') goto BAD_VERIFY;
1867 while (isspace(*s)) s++;
1868 verify_sender_address = string_copy(s);
1869 }
059ec3d9 1870 }
89583014
JH		 1871 break;
1872
1873 case VERIFY_RCPT:
1874 break;
059ec3d9
PH		 1875 }
1876
89583014
JH		 1877
1878
596875b3
PH		 1879/* Remaining items are optional; they apply to sender and recipient
1880verification, including "header sender" verification. */
059ec3d9
PH		 1881
1882while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1883 != NULL)
1884 {
1885 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1886 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1887 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1888
1889 /* These two old options are left for backwards compatibility */
1890
1891 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1892 {
1893 callout_defer_ok = TRUE;
1894 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1895 }
1896
1897 else if (strcmpic(ss, US"check_postmaster") == 0)
1898 {
1899 pm_mailfrom = US"";
1900 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1901 }
1902
1903 /* The callout option has a number of sub-options, comma separated */
1904
1905 else if (strncmpic(ss, US"callout", 7) == 0)
1906 {
1907 callout = CALLOUT_TIMEOUT_DEFAULT;
1908 ss += 7;
1909 if (*ss != 0)
1910 {
1911 while (isspace(*ss)) ss++;
1912 if (*ss++ == '=')
1913 {
55414b25 1914 const uschar * sublist = ss;
059ec3d9
PH		 1915 int optsep = ',';
1916 uschar *opt;
1917 uschar buffer[256];
55414b25 1918 while (isspace(*sublist)) sublist++;
8e669ac1 1919
55414b25 1920 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1921 != NULL)
1922 {
89583014 1923 callout_opt_t * op;
438257ba 1924 double period = 1.0F;
059ec3d9 1925
89583014 1926 for (op= callout_opt_list; op->name; op++)
438257ba 1927 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1928 break;
059ec3d9 1929
89583014
JH		 1930 verify_options |= op->flag;
1931 if (op->has_option)
1932 {
438257ba 1933 opt += Ustrlen(op->name);
4deaf07d
PH		 1934 while (isspace(*opt)) opt++;
1935 if (*opt++ != '=')
1936 {
1937 *log_msgptr = string_sprintf("'=' expected after "
89583014 1938 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1939 return ERROR;
1940 }
1941 while (isspace(*opt)) opt++;
89583014
JH		 1942 }
1943 if (op->timeval)
1944 {
1945 period = readconf_readtime(opt, 0, FALSE);
1946 if (period < 0)
4deaf07d
PH		 1947 {
1948 *log_msgptr = string_sprintf("bad time value in ACL condition "
1949 "\"verify %s\"", arg);
1950 return ERROR;
1951 }
89583014
JH		 1952 }
1953
1954 switch(op->value)
1955 {
1956 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1957 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1958 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1959 case CALLOUT_MAILFROM:
1960 if (!verify_header_sender)
1961 {
1962 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1963 "callout option only for verify=header_sender (detected in ACL "
1964 "condition \"%s\")", arg);
1965 return ERROR;
1966 }
1967 se_mailfrom = string_copy(opt);
1968 break;
1969 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1970 case CALLOUT_MAXWAIT: callout_overall = period; break;
1971 case CALLOUT_CONNECT: callout_connect = period; break;
1972 case CALLOUT_TIME: callout = period; break;
1973 }
059ec3d9
PH		 1974 }
1975 }
1976 else
1977 {
1978 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1979 "ACL condition \"%s\"", arg);
1980 return ERROR;
1981 }
1982 }
1983 }
1984
1985 /* Option not recognized */
1986
1987 else
1988 {
1989 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1990 "condition \"verify %s\"", ss, arg);
1991 return ERROR;
1992 }
1993 }
1994
1995if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1996 (vopt_callout_recipsender|vopt_callout_recippmaster))
1997 {
1998 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1999 "for a recipient callout";
2000 return ERROR;
2001 }
2002
2003/* Handle sender-in-header verification. Default the user message to the log
2004message if giving out verification details. */
2005
2006if (verify_header_sender)
2007 {
8e669ac1 2008 int verrno;
059ec3d9 2009 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2010 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2011 &verrno);
2012 if (rc != OK)
8e669ac1 2013 {
fe5b5d0b
PH		 2014 *basic_errno = verrno;
2015 if (smtp_return_error_details)
2016 {
2017 if (*user_msgptr == NULL && *log_msgptr != NULL)
2018 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2019 if (rc == DEFER) acl_temp_details = TRUE;
2020 }
8e669ac1 2021 }
059ec3d9
PH		 2022 }
2023
2024/* Handle a sender address. The default is to verify *the* sender address, but
2025optionally a different address can be given, for special requirements. If the
2026address is empty, we are dealing with a bounce message that has no sender, so
2027we cannot do any checking. If the real sender address gets rewritten during
2028verification (e.g. DNS widening), set the flag to stop it being rewritten again
2029during message reception.
2030
2031A list of verified "sender" addresses is kept to try to avoid doing to much
2032work repetitively when there are multiple recipients in a message and they all
2033require sender verification. However, when callouts are involved, it gets too
2034complicated because different recipients may require different callout options.
2035Therefore, we always do a full sender verify when any kind of callout is
2036specified. Caching elsewhere, for instance in the DNS resolver and in the
2037callout handling, should ensure that this is not terribly inefficient. */
2038
2039else if (verify_sender_address != NULL)
2040 {
2041 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2042 != 0)
2043 {
2044 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2045 "sender verify callout";
2046 return ERROR;
2047 }
2048
2049 sender_vaddr = verify_checked_sender(verify_sender_address);
2050 if (sender_vaddr != NULL && /* Previously checked */
2051 callout <= 0) /* No callout needed this time */
2052 {
2053 /* If the "routed" flag is set, it means that routing worked before, so
2054 this check can give OK (the saved return code value, if set, belongs to a
2055 callout that was done previously). If the "routed" flag is not set, routing
2056 must have failed, so we use the saved return code. */
2057
2058 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2059 {
2060 rc = sender_vaddr->special_action;
2061 *basic_errno = sender_vaddr->basic_errno;
2062 }
2063 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2064 }
2065
2066 /* Do a new verification, and cache the result. The cache is used to avoid
2067 verifying the sender multiple times for multiple RCPTs when callouts are not
2068 specified (see comments above).
2069
2070 The cache is also used on failure to give details in response to the first
2071 RCPT that gets bounced for this reason. However, this can be suppressed by
2072 the no_details option, which sets the flag that says "this detail has already
2073 been sent". The cache normally contains just one address, but there may be
2074 more in esoteric circumstances. */
2075
2076 else
2077 {
2078 BOOL routed = TRUE;
2a3eea10 2079 uschar *save_address_data = deliver_address_data;
8e669ac1 2080
059ec3d9
PH		 2081 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2082 if (no_details) setflag(sender_vaddr, af_sverify_told);
2083 if (verify_sender_address[0] != 0)
2084 {
2085 /* If this is the real sender address, save the unrewritten version
2086 for use later in receive. Otherwise, set a flag so that rewriting the
2087 sender in verify_address() does not update sender_address. */
2088
2089 if (verify_sender_address == sender_address)
2090 sender_address_unrewritten = sender_address;
2091 else
2092 verify_options |= vopt_fake_sender;
2093
eafd343b
TK		 2094 if (success_on_redirect)
2095 verify_options |= vopt_success_on_redirect;
2096
059ec3d9
PH		 2097 /* The recipient, qualify, and expn options are never set in
2098 verify_options. */
2099
2100 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2101 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2102
2103 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2104
2105 if (rc == OK)
2106 {
2107 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2108 {
2109 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2110 verify_sender_address, sender_vaddr->address);
2111 }
2112 else
2113 {
2114 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2115 verify_sender_address);
2116 }
2117 }
2118 else *basic_errno = sender_vaddr->basic_errno;
2119 }
2120 else rc = OK; /* Null sender */
2121
2122 /* Cache the result code */
2123
2124 if (routed) setflag(sender_vaddr, af_verify_routed);
2125 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2126 sender_vaddr->special_action = rc;
2127 sender_vaddr->next = sender_verified_list;
2128 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2129
2130 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2131 the sender verification. */
8e669ac1 2132
2a3eea10 2133 deliver_address_data = save_address_data;
059ec3d9 2134 }
8e669ac1 2135
2a3eea10
PH		 2136 /* Put the sender address_data value into $sender_address_data */
2137
8e669ac1 2138 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH		 2139 }
2140
2141/* A recipient address just gets a straightforward verify; again we must handle
2142the DEFER overrides. */
2143
2144else
2145 {
2146 address_item addr2;
2147
eafd343b
TK		 2148 if (success_on_redirect)
2149 verify_options |= vopt_success_on_redirect;
2150
059ec3d9
PH		 2151 /* We must use a copy of the address for verification, because it might
2152 get rewritten. */
2153
2154 addr2 = *addr;
2155 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2156 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2157 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2158
42855d71 2159 *basic_errno = addr2.basic_errno;
059ec3d9 2160 *log_msgptr = addr2.message;
8e669ac1 2161 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2162 addr2.user_message : addr2.message;
42855d71
PH		 2163
2164 /* Allow details for temporary error if the address is so flagged. */
2165 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2166
2167 /* Make $address_data visible */
2168 deliver_address_data = addr2.p.address_data;
2169 }
2170
2171/* We have a result from the relevant test. Handle defer overrides first. */
2172
2173if (rc == DEFER && (defer_ok ||
2174 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2175 {
2176 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2177 defer_ok? "defer_ok" : "callout_defer_ok");
2178 rc = OK;
2179 }
2180
2181/* If we've failed a sender, set up a recipient message, and point
2182sender_verified_failed to the address item that actually failed. */
2183
2184if (rc != OK && verify_sender_address != NULL)
2185 {
2186 if (rc != DEFER)
2187 {
2188 *log_msgptr = *user_msgptr = US"Sender verify failed";
2189 }
2190 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2191 {
2192 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2193 }
2194 else
2195 {
2196 *log_msgptr = US"Could not complete sender verify callout";
2197 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2198 *log_msgptr;
2199 }
2200
2201 sender_verified_failed = sender_vaddr;
2202 }
2203
2204/* Verifying an address messes up the values of $domain and $local_part,
2205so reset them before returning if this is a RCPT ACL. */
2206
2207if (addr != NULL)
2208 {
2209 deliver_domain = addr->domain;
2210 deliver_localpart = addr->local_part;
2211 }
2212return rc;
2213
2214/* Syntax errors in the verify argument come here. */
2215
2216BAD_VERIFY:
2217*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2218 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2219 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2220 "\"verify %s\"", arg);
2221return ERROR;
2222}
2223
2224
2225
2226
2227/*************************************************
2228* Check argument for control= modifier *
2229*************************************************/
2230
2231/* Called from acl_check_condition() below
2232
2233Arguments:
2234 arg the argument string for control=
2235 pptr set to point to the terminating character
2236 where which ACL we are in
2237 log_msgptr for error messages
2238
2239Returns: CONTROL_xxx value
2240*/
2241
2242static int
55414b25 2243decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2244{
2245int len;
2246control_def *d;
2247
2248for (d = controls_list;
2249 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2250 d++)
2251 {
2252 len = Ustrlen(d->name);
2253 if (Ustrncmp(d->name, arg, len) == 0) break;
2254 }
2255
2256if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2257 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2258 {
2259 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2260 return CONTROL_ERROR;
2261 }
2262
059ec3d9
PH		 2263*pptr = arg + len;
2264return d->value;
2265}
2266
2267
2268
c99ce5c9
TF		 2269
2270/*************************************************
2271* Return a ratelimit error *
2272*************************************************/
2273
2274/* Called from acl_ratelimit() below
2275
2276Arguments:
2277 log_msgptr for error messages
2278 format format string
2279 ... supplementary arguments
2280 ss ratelimit option name
2281 where ACL_WHERE_xxxx indicating which ACL this is
2282
2283Returns: ERROR
2284*/
2285
2286static int
2287ratelimit_error(uschar **log_msgptr, const char *format, ...)
2288{
2289va_list ap;
2290uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2291va_start(ap, format);
2292if (!string_vformat(buffer, sizeof(buffer), format, ap))
2293 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2294 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2295va_end(ap);
2296*log_msgptr = string_sprintf(
2297 "error in arguments to \"ratelimit\" condition: %s", buffer);
2298return ERROR;
2299}
2300
2301
2302
2303
870f6ba8
TF		 2304/*************************************************
2305* Handle rate limiting *
2306*************************************************/
2307
2308/* Called by acl_check_condition() below to calculate the result
2309of the ACL ratelimit condition.
2310
2311Note that the return value might be slightly unexpected: if the
2312sender's rate is above the limit then the result is OK. This is
2313similar to the dnslists condition, and is so that you can write
2314ACL clauses like: defer ratelimit = 15 / 1h
2315
2316Arguments:
2317 arg the option string for ratelimit=
90fc3069 2318 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2319 log_msgptr for error messages
2320
2321Returns: OK - Sender's rate is above limit
2322 FAIL - Sender's rate is below limit
2323 DEFER - Problem opening ratelimit database
2324 ERROR - Syntax error in options.
2325*/
2326
2327static int
55414b25 2328acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2329{
c99ce5c9 2330double limit, period, count;
8f240103
PH		 2331uschar *ss;
2332uschar *key = NULL;
c99ce5c9 2333uschar *unique = NULL;
870f6ba8 2334int sep = '/';
c99ce5c9
TF		 2335BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2336BOOL noupdate = FALSE, badacl = FALSE;
2337int mode = RATE_PER_WHAT;
870f6ba8
TF		 2338int old_pool, rc;
2339tree_node **anchor, *t;
2340open_db dbblock, *dbm;
c99ce5c9 2341int dbdb_size;
870f6ba8 2342dbdata_ratelimit *dbd;
c99ce5c9 2343dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2344struct timeval tv;
2345
2346/* Parse the first two options and record their values in expansion
2347variables. These variables allow the configuration to have informative
2348error messages based on rate limits obtained from a table lookup. */
2349
c99ce5c9 2350/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2351size, which must be greater than or equal to zero. Zero is useful for
2352rate measurement as opposed to rate limiting. */
2353
2354sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2355if (sender_rate_limit == NULL)
288644dd 2356 {
870f6ba8 2357 limit = -1.0;
288644dd
JH		 2358 ss = NULL; /* compiler quietening */
2359 }
870f6ba8
TF		 2360else
2361 {
2362 limit = Ustrtod(sender_rate_limit, &ss);
2363 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2364 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2365 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2366 }
c99ce5c9
TF		 2367if (limit < 0.0 || *ss != '\0')
2368 return ratelimit_error(log_msgptr,
2369 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2370
c99ce5c9 2371/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2372constant. This must be strictly greater than zero, because zero leads to
2373run-time division errors. */
2374
2375sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2376if (sender_rate_period == NULL) period = -1.0;
2377else period = readconf_readtime(sender_rate_period, 0, FALSE);
2378if (period <= 0.0)
c99ce5c9
TF		 2379 return ratelimit_error(log_msgptr,
2380 "\"%s\" is not a time value", sender_rate_period);
2381
2382/* By default we are counting one of something, but the per_rcpt,
2383per_byte, and count options can change this. */
2384
2385count = 1.0;
870f6ba8 2386
c99ce5c9 2387/* Parse the other options. */
870f6ba8
TF		 2388
2389while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2390 != NULL)
2391 {
2392 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2393 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2394 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2395 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2396 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2397 else if (strcmpic(ss, US"per_conn") == 0)
2398 {
2399 RATE_SET(mode, PER_CONN);
2400 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2401 badacl = TRUE;
2402 }
2403 else if (strcmpic(ss, US"per_mail") == 0)
2404 {
2405 RATE_SET(mode, PER_MAIL);
2406 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2407 }
2408 else if (strcmpic(ss, US"per_rcpt") == 0)
2409 {
2410 /* If we are running in the RCPT ACL, then we'll count the recipients
2411 one by one, but if we are running when we have accumulated the whole
2412 list then we'll add them all in one batch. */
2413 if (where == ACL_WHERE_RCPT)
2414 RATE_SET(mode, PER_RCPT);
2415 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2416 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2417 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2418 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2419 }
2420 else if (strcmpic(ss, US"per_byte") == 0)
2421 {
2422 /* If we have not yet received the message data and there was no SIZE
2423 declaration on the MAIL comand, then it's safe to just use a value of
2424 zero and let the recorded rate decay as if nothing happened. */
2425 RATE_SET(mode, PER_MAIL);
2426 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2427 else count = message_size < 0 ? 0.0 : (double)message_size;
2428 }
2429 else if (strcmpic(ss, US"per_addr") == 0)
2430 {
2431 RATE_SET(mode, PER_RCPT);
438257ba 2432 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2433 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2434 }
2435 else if (strncmpic(ss, US"count=", 6) == 0)
2436 {
2437 uschar *e;
2438 count = Ustrtod(ss+6, &e);
2439 if (count < 0.0 || *e != '\0')
2440 return ratelimit_error(log_msgptr,
2441 "\"%s\" is not a positive number", ss);
2442 }
2443 else if (strncmpic(ss, US"unique=", 7) == 0)
2444 unique = string_copy(ss + 7);
2445 else if (key == NULL)
2446 key = string_copy(ss);
2447 else
2448 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2449 }
2450
c99ce5c9
TF		 2451/* Sanity check. When the badacl flag is set the update mode must either
2452be readonly (which is the default if it is omitted) or, for backwards
2453compatibility, a combination of noupdate and strict or leaky. */
2454
2455if (mode == RATE_PER_CLASH)
2456 return ratelimit_error(log_msgptr, "conflicting per_* options");
2457if (leaky + strict + readonly > 1)
2458 return ratelimit_error(log_msgptr, "conflicting update modes");
2459if (badacl && (leaky || strict) && !noupdate)
2460 return ratelimit_error(log_msgptr,
2461 "\"%s\" must not have /leaky or /strict option in %s ACL",
2462 ratelimit_option_string[mode], acl_wherenames[where]);
2463
2464/* Set the default values of any unset options. In readonly mode we
2465perform the rate computation without any increment so that its value
2466decays to eventually allow over-limit senders through. */
2467
2468if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2469if (badacl) readonly = TRUE;
2470if (readonly) count = 0.0;
2471if (!strict && !readonly) leaky = TRUE;
2472if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2473
8f240103
PH		 2474/* Create the lookup key. If there is no explicit key, use sender_host_address.
2475If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2476omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2477are added to the key because they alter the meaning of the stored data. */
2478
2479if (key == NULL)
2480 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2481
c99ce5c9 2482key = string_sprintf("%s/%s/%s%s",
8f240103 2483 sender_rate_period,
c99ce5c9
TF		 2484 ratelimit_option_string[mode],
2485 unique == NULL ? "" : "unique/",
8f240103 2486 key);
870f6ba8 2487
c99ce5c9
TF		 2488HDEBUG(D_acl)
2489 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2490
8f240103
PH		 2491/* See if we have already computed the rate by looking in the relevant tree.
2492For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2493pool so that they survive across resets. In readonly mode we only remember the
2494result for the rest of this command in case a later command changes it. After
2495this bit of logic the code is independent of the per_* mode. */
870f6ba8 2496
870f6ba8
TF		 2497old_pool = store_pool;
2498
c99ce5c9
TF		 2499if (readonly)
2500 anchor = &ratelimiters_cmd;
2501else switch(mode) {
2502case RATE_PER_CONN:
870f6ba8
TF		 2503 anchor = &ratelimiters_conn;
2504 store_pool = POOL_PERM;
c99ce5c9
TF		 2505 break;
2506case RATE_PER_BYTE:
2507case RATE_PER_MAIL:
2508case RATE_PER_ALLRCPTS:
870f6ba8 2509 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2510 break;
2511case RATE_PER_ADDR:
2512case RATE_PER_CMD:
2513case RATE_PER_RCPT:
fe0dab11 2514 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2515 break;
2516default:
3399bb60 2517 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2518 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2519 "internal ACL error: unknown ratelimit mode %d", mode);
2520 break;
2521}
870f6ba8 2522
c99ce5c9
TF		 2523t = tree_search(*anchor, key);
2524if (t != NULL)
870f6ba8
TF		 2525 {
2526 dbd = t->data.ptr;
2527 /* The following few lines duplicate some of the code below. */
8f240103 2528 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2529 store_pool = old_pool;
2530 sender_rate = string_sprintf("%.1f", dbd->rate);
2531 HDEBUG(D_acl)
2532 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2533 return rc;
2534 }
2535
c99ce5c9
TF		 2536/* We aren't using a pre-computed rate, so get a previously recorded rate
2537from the database, which will be updated and written back if required. */
870f6ba8
TF		 2538
2539dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2540if (dbm == NULL)
2541 {
2542 store_pool = old_pool;
2543 sender_rate = NULL;
2544 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2545 *log_msgptr = US"ratelimit database not available";
2546 return DEFER;
2547 }
c99ce5c9
TF		 2548dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2549dbd = NULL;
870f6ba8
TF		 2550
2551gettimeofday(&tv, NULL);
2552
c99ce5c9
TF		 2553if (dbdb != NULL)
2554 {
2555 /* Locate the basic ratelimit block inside the DB data. */
2556 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2557 dbd = &dbdb->dbd;
2558
2559 /* Forget the old Bloom filter if it is too old, so that we count each
2560 repeating event once per period. We don't simply clear and re-use the old
2561 filter because we want its size to change if the limit changes. Note that
2562 we keep the dbd pointer for copying the rate into the new data block. */
2563
2564 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2565 {
2566 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2567 dbdb = NULL;
2568 }
2569
2570 /* Sanity check. */
2571
2572 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2573 {
2574 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2575 dbdb = NULL;
2576 }
2577 }
2578
2579/* Allocate a new data block if the database lookup failed
2580or the Bloom filter passed its age limit. */
2581
2582if (dbdb == NULL)
2583 {
2584 if (unique == NULL)
2585 {
2586 /* No Bloom filter. This basic ratelimit block is initialized below. */
2587 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2588 dbdb_size = sizeof(*dbd);
2589 dbdb = store_get(dbdb_size);
2590 }
2591 else
2592 {
2593 int extra;
2594 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2595
2596 /* See the long comment below for an explanation of the magic number 2.
2597 The filter has a minimum size in case the rate limit is very small;
2598 this is determined by the definition of dbdata_ratelimit_unique. */
2599
2600 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2601 if (extra < 0) extra = 0;
2602 dbdb_size = sizeof(*dbdb) + extra;
2603 dbdb = store_get(dbdb_size);
2604 dbdb->bloom_epoch = tv.tv_sec;
2605 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2606 memset(dbdb->bloom, 0, dbdb->bloom_size);
2607
2608 /* Preserve any basic ratelimit data (which is our longer-term memory)
2609 by copying it from the discarded block. */
2610
2611 if (dbd != NULL)
2612 {
2613 dbdb->dbd = *dbd;
2614 dbd = &dbdb->dbd;
2615 }
2616 }
2617 }
2618
2619/* If we are counting unique events, find out if this event is new or not.
2620If the client repeats the event during the current period then it should be
2621counted. We skip this code in readonly mode for efficiency, because any
2622changes to the filter will be discarded and because count is already set to
2623zero. */
2624
2625if (unique != NULL && !readonly)
2626 {
2627 /* We identify unique events using a Bloom filter. (You can find my
2628 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2629 With the per_addr option, an "event" is a recipient address, though the
2630 user can use the unique option to define their own events. We only count
2631 an event if we have not seen it before.
2632
2633 We size the filter according to the rate limit, which (in leaky mode)
2634 is the limit on the population of the filter. We allow 16 bits of space
2635 per entry (see the construction code above) and we set (up to) 8 of them
2636 when inserting an element (see the loop below). The probability of a false
2637 positive (an event we have not seen before but which we fail to count) is
2638
2639 size = limit * 16
2640 numhash = 8
2641 allzero = exp(-numhash * pop / size)
2642 = exp(-0.5 * pop / limit)
2643 fpr = pow(1 - allzero, numhash)
2644
2645 For senders at the limit the fpr is 0.06% or 1 in 1700
2646 and for senders at half the limit it is 0.0006% or 1 in 170000
2647
2648 In strict mode the Bloom filter can fill up beyond the normal limit, in
2649 which case the false positive rate will rise. This means that the
2650 measured rate for very fast senders can bogusly drop off after a while.
2651
2652 At twice the limit, the fpr is 2.5% or 1 in 40
2653 At four times the limit, it is 31% or 1 in 3.2
2654
2655 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2656 decay below the limit, and if this is more than one then the Bloom filter
2657 will be discarded before the decay gets that far. The false positive rate
2658 at this threshold is 9.3% or 1 in 10.7. */
2659
2660 BOOL seen;
2661 unsigned n, hash, hinc;
2662 uschar md5sum[16];
2663 md5 md5info;
2664
2665 /* Instead of using eight independent hash values, we combine two values
2666 using the formula h1 + n * h2. This does not harm the Bloom filter's
2667 performance, and means the amount of hash we need is independent of the
2668 number of bits we set in the filter. */
2669
2670 md5_start(&md5info);
2671 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2672 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2673 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2674
2675 /* Scan the bits corresponding to this event. A zero bit means we have
2676 not seen it before. Ensure all bits are set to record this event. */
2677
2678 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2679
2680 seen = TRUE;
2681 for (n = 0; n < 8; n++, hash += hinc)
2682 {
2683 int bit = 1 << (hash % 8);
2684 int byte = (hash / 8) % dbdb->bloom_size;
2685 if ((dbdb->bloom[byte] & bit) == 0)
2686 {
2687 dbdb->bloom[byte] |= bit;
2688 seen = FALSE;
2689 }
2690 }
2691
2692 /* If this event has occurred before, do not count it. */
2693
2694 if (seen)
2695 {
2696 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2697 count = 0.0;
2698 }
2699 else
2700 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2701 }
2702
2703/* If there was no previous ratelimit data block for this key, initialize
2704the new one, otherwise update the block from the database. The initial rate
2705is what would be computed by the code below for an infinite interval. */
2706
870f6ba8
TF		 2707if (dbd == NULL)
2708 {
c99ce5c9
TF		 2709 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2710 dbd = &dbdb->dbd;
870f6ba8
TF		 2711 dbd->time_stamp = tv.tv_sec;
2712 dbd->time_usec = tv.tv_usec;
c99ce5c9 2713 dbd->rate = count;
870f6ba8
TF		 2714 }
2715else
2716 {
2717 /* The smoothed rate is computed using an exponentially weighted moving
2718 average adjusted for variable sampling intervals. The standard EWMA for
2719 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2720 where f() is the measured value and f'() is the smoothed value.
2721
2722 Old data decays out of the smoothed value exponentially, such that data n
2723 samples old is multiplied by a^n. The exponential decay time constant p
2724 is defined such that data p samples old is multiplied by 1/e, which means
2725 that a = exp(-1/p). We can maintain the same time constant for a variable
2726 sampling interval i by using a = exp(-i/p).
2727
2728 The rate we are measuring is messages per period, suitable for directly
2729 comparing with the limit. The average rate between now and the previous
2730 message is period / interval, which we feed into the EWMA as the sample.
2731
2732 It turns out that the number of messages required for the smoothed rate
2733 to reach the limit when they are sent in a burst is equal to the limit.
2734 This can be seen by analysing the value of the smoothed rate after N
2735 messages sent at even intervals. Let k = (1 - a) * p/i
2736
2737 rate_1 = (1 - a) * p/i + a * rate_0
2738 = k + a * rate_0
2739 rate_2 = k + a * rate_1
2740 = k + a * k + a^2 * rate_0
2741 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2742 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2743 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2744 = rate_0 * a^N + p/i * (1 - a^N)
2745
2746 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2747
2748 rate_N = p/i + (rate_0 - p/i) * a^N
2749 a^N = (rate_N - p/i) / (rate_0 - p/i)
2750 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2751 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2752
2753 Numerical analysis of the above equation, setting the computed rate to
2754 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2755 rates, p/i, the number of messages N = limit. So limit serves as both the
2756 maximum rate measured in messages per period, and the maximum number of
2757 messages that can be sent in a fast burst. */
2758
2759 double this_time = (double)tv.tv_sec
2760 + (double)tv.tv_usec / 1000000.0;
2761 double prev_time = (double)dbd->time_stamp
2762 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2763
2764 /* We must avoid division by zero, and deal gracefully with the clock going
2765 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2766 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2767
e5d5a95f
TF		 2768 double interval = this_time - prev_time <= 0.0 ? 1e-9
2769 : this_time - prev_time;
2770
2771 double i_over_p = interval / period;
2772 double a = exp(-i_over_p);
870f6ba8 2773
c99ce5c9
TF		 2774 /* Combine the instantaneous rate (period / interval) with the previous rate
2775 using the smoothing factor a. In order to measure sized events, multiply the
2776 instantaneous rate by the count of bytes or recipients etc. */
2777
870f6ba8
TF		 2778 dbd->time_stamp = tv.tv_sec;
2779 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2780 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2781
2782 /* When events are very widely spaced the computed rate tends towards zero.
2783 Although this is accurate it turns out not to be useful for our purposes,
2784 especially when the first event after a long silence is the start of a spam
2785 run. A more useful model is that the rate for an isolated event should be the
2786 size of the event per the period size, ignoring the lack of events outside
2787 the current period and regardless of where the event falls in the period. So,
2788 if the interval was so long that the calculated rate is unhelpfully small, we
2789 re-intialize the rate. In the absence of higher-rate bursts, the condition
2790 below is true if the interval is greater than the period. */
2791
2792 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2793 }
2794
c99ce5c9
TF		 2795/* Clients sending at the limit are considered to be over the limit.
2796This matters for edge cases such as a limit of zero, when the client
2797should be completely blocked. */
3348576f 2798
8f240103 2799rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2800
2801/* Update the state if the rate is low or if we are being strict. If we
2802are in leaky mode and the sender's rate is too high, we do not update
2803the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2804rate preventing them from getting any email through. If readonly is set,
2805neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2806
c99ce5c9 2807if ((rc == FAIL && leaky) || strict)
8f240103 2808 {
c99ce5c9 2809 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2810 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2811 }
2812else
2813 {
2814 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2815 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2816 }
2817
870f6ba8
TF		 2818dbfn_close(dbm);
2819
c99ce5c9 2820/* Store the result in the tree for future reference. */
870f6ba8 2821
c99ce5c9
TF		 2822t = store_get(sizeof(tree_node) + Ustrlen(key));
2823t->data.ptr = dbd;
2824Ustrcpy(t->name, key);
2825(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2826
2827/* We create the formatted version of the sender's rate very late in
2828order to ensure that it is done using the correct storage pool. */
2829
2830store_pool = old_pool;
2831sender_rate = string_sprintf("%.1f", dbd->rate);
2832
2833HDEBUG(D_acl)
2834 debug_printf("ratelimit computed rate %s\n", sender_rate);
2835
2836return rc;
2837}
2838
2839
2840
b0019c78
TF		 2841/*************************************************
2842* The udpsend ACL modifier *
2843*************************************************/
2844
2845/* Called by acl_check_condition() below.
2846
2847Arguments:
2848 arg the option string for udpsend=
2849 log_msgptr for error messages
2850
2851Returns: OK - Completed.
2852 DEFER - Problem with DNS lookup.
2853 ERROR - Syntax error in options.
2854*/
2855
2856static int
55414b25 2857acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2858{
2859int sep = 0;
2860uschar *hostname;
2861uschar *portstr;
2862uschar *portend;
2863host_item *h;
2864int portnum;
b0019c78
TF		 2865int len;
2866int r, s;
b1f8e4f8 2867uschar * errstr;
b0019c78
TF		 2868
2869hostname = string_nextinlist(&arg, &sep, NULL, 0);
2870portstr = string_nextinlist(&arg, &sep, NULL, 0);
2871
2872if (hostname == NULL)
2873 {
217b0e56 2874 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2875 return ERROR;
2876 }
2877if (portstr == NULL)
2878 {
217b0e56 2879 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2880 return ERROR;
2881 }
2882if (arg == NULL)
2883 {
217b0e56 2884 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2885 return ERROR;
2886 }
2887portnum = Ustrtol(portstr, &portend, 10);
2888if (*portend != '\0')
2889 {
217b0e56 2890 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2891 return ERROR;
2892 }
2893
2894/* Make a single-item host list. */
2895h = store_get(sizeof(host_item));
2896memset(h, 0, sizeof(host_item));
2897h->name = hostname;
2898h->port = portnum;
2899h->mx = MX_NONE;
2900
2901if (string_is_ip_address(hostname, NULL))
2902 h->address = hostname, r = HOST_FOUND;
2903else
2904 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2905if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2906 {
217b0e56 2907 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2908 return DEFER;
2909 }
2910
2911HDEBUG(D_acl)
2912 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2913
b1f8e4f8
JH		 2914r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2915 1, NULL, &errstr);
b0019c78 2916if (r < 0) goto defer;
27f9999e 2917len = Ustrlen(arg);
9cb1785a 2918r = send(s, arg, len, 0);
b1f8e4f8
JH		 2919if (r < 0)
2920 {
2921 errstr = US strerror(errno);
2922 close(s);
2923 goto defer;
2924 }
2925close(s);
b0019c78
TF		 2926if (r < len)
2927 {
2928 *log_msgptr =
2929 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2930 return DEFER;
2931 }
2932
2933HDEBUG(D_acl)
2934 debug_printf("udpsend %d bytes\n", r);
2935
2936return OK;
2937
2938defer:
b1f8e4f8 2939*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2940return DEFER;
2941}
2942
2943
2944
059ec3d9
PH		 2945/*************************************************
2946* Handle conditions/modifiers on an ACL item *
2947*************************************************/
2948
2949/* Called from acl_check() below.
2950
2951Arguments:
2952 verb ACL verb
2953 cb ACL condition block - if NULL, result is OK
2954 where where called from
2955 addr the address being checked for RCPT, or NULL
2956 level the nesting level
2957 epp pointer to pass back TRUE if "endpass" encountered
2958 (applies only to "accept" and "discard")
2959 user_msgptr user message pointer
2960 log_msgptr log message pointer
2961 basic_errno pointer to where to put verify error
2962
2963Returns: OK - all conditions are met
2964 DISCARD - an "acl" condition returned DISCARD - only allowed
2965 for "accept" or "discard" verbs
2966 FAIL - at least one condition fails
2967 FAIL_DROP - an "acl" condition returned FAIL_DROP
2968 DEFER - can't tell at the moment (typically, lookup defer,
2969 but can be temporary callout problem)
2970 ERROR - ERROR from nested ACL or expansion failure or other
2971 error
2972*/
2973
2974static int
2975acl_check_condition(int verb, acl_condition_block *cb, int where,
2976 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2977 uschar **log_msgptr, int *basic_errno)
2978{
2979uschar *user_message = NULL;
2980uschar *log_message = NULL;
ed7f7860
PP		 2981uschar *debug_tag = NULL;
2982uschar *debug_opts = NULL;
059ec3d9 2983int rc = OK;
8523533c 2984#ifdef WITH_CONTENT_SCAN
0f0c8159 2985int sep = -'/';
8523533c 2986#endif
059ec3d9
PH		 2987
2988for (; cb != NULL; cb = cb->next)
2989 {
55414b25 2990 const uschar *arg;
8e669ac1 2991 int control_type;
059ec3d9
PH		 2992
2993 /* The message and log_message items set up messages to be used in
2994 case of rejection. They are expanded later. */
2995
2996 if (cb->type == ACLC_MESSAGE)
2997 {
187bc588 2998 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 2999 user_message = cb->arg;
3000 continue;
3001 }
3002
3003 if (cb->type == ACLC_LOG_MESSAGE)
3004 {
187bc588 3005 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3006 log_message = cb->arg;
3007 continue;
3008 }
3009
3010 /* The endpass "condition" just sets a flag to show it occurred. This is
3011 checked at compile time to be on an "accept" or "discard" item. */
3012
3013 if (cb->type == ACLC_ENDPASS)
3014 {
3015 *epp = TRUE;
3016 continue;
3017 }
3018
3019 /* For other conditions and modifiers, the argument is expanded now for some
3020 of them, but not for all, because expansion happens down in some lower level
3021 checking functions in some cases. */
3022
3023 if (cond_expand_at_top[cb->type])
3024 {
3025 arg = expand_string(cb->arg);
3026 if (arg == NULL)
3027 {
3028 if (expand_string_forcedfail) continue;
3029 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3030 cb->arg, expand_string_message);
3031 return search_find_defer? DEFER : ERROR;
3032 }
3033 }
3034 else arg = cb->arg;
3035
3036 /* Show condition, and expanded condition if it's different */
3037
3038 HDEBUG(D_acl)
3039 {
3040 int lhswidth = 0;
3041 debug_printf("check %s%s %n",
3042 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3043 conditions[cb->type], &lhswidth);
3044
3045 if (cb->type == ACLC_SET)
3046 {
38a0a95f
PH		 3047 debug_printf("acl_%s ", cb->u.varname);
3048 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3049 }
3050
3051 debug_printf("= %s\n", cb->arg);
3052
3053 if (arg != cb->arg)
3054 debug_printf("%.*s= %s\n", lhswidth,
3055 US" ", CS arg);
3056 }
3057
3058 /* Check that this condition makes sense at this time */
3059
3060 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3061 {
3062 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3063 cond_modifiers[cb->type]? "use" : "test",
3064 conditions[cb->type], acl_wherenames[where]);
3065 return ERROR;
3066 }
3067
3068 /* Run the appropriate test for each condition, or take the appropriate
3069 action for the remaining modifiers. */
3070
3071 switch(cb->type)
3072 {
71fafd95
PH		 3073 case ACLC_ADD_HEADER:
3074 setup_header(arg);
3075 break;
3076
059ec3d9
PH		 3077 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3078 "discard" verb. */
71fafd95 3079
059ec3d9 3080 case ACLC_ACL:
f60d98e8 3081 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3082 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3083 {
3084 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3085 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3086 verbs[verb]);
3087 return ERROR;
3088 }
059ec3d9
PH		 3089 break;
3090
3091 case ACLC_AUTHENTICATED:
3092 rc = (sender_host_authenticated == NULL)? FAIL :
3093 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3094 TRUE, NULL);
3095 break;
3096
71fafd95 3097 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3098 case ACLC_BMI_OPTIN:
3099 {
3100 int old_pool = store_pool;
3101 store_pool = POOL_PERM;
3102 bmi_current_optin = string_copy(arg);
3103 store_pool = old_pool;
3104 }
3105 break;
71fafd95 3106 #endif
8523533c 3107
059ec3d9 3108 case ACLC_CONDITION:
f3766eb5
NM		 3109 /* The true/false parsing here should be kept in sync with that used in
3110 expand.c when dealing with ECOND_BOOL so that we don't have too many
3111 different definitions of what can be a boolean. */
51c7471d
JH		 3112 if (*arg == '-'
3113 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3114 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3115 rc = (Uatoi(arg) == 0)? FAIL : OK;
3116 else
3117 rc = (strcmpic(arg, US"no") == 0 ||
3118 strcmpic(arg, US"false") == 0)? FAIL :
3119 (strcmpic(arg, US"yes") == 0 ||
3120 strcmpic(arg, US"true") == 0)? OK : DEFER;
3121 if (rc == DEFER)
3122 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3123 break;
3124
c3611384
PH		 3125 case ACLC_CONTINUE: /* Always succeeds */
3126 break;
3127
059ec3d9 3128 case ACLC_CONTROL:
c5fcb476 3129 {
55414b25
JH		 3130 const uschar *p = NULL;
3131 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3132
55414b25 3133 /* Check if this control makes sense at this time */
f7572e5a 3134
55414b25
JH		 3135 if ((control_forbids[control_type] & (1 << where)) != 0)
3136 {
3137 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3138 controls[control_type], acl_wherenames[where]);
3139 return ERROR;
3140 }
8800895a 3141
55414b25
JH		 3142 switch(control_type)
3143 {
3144 case CONTROL_AUTH_UNADVERTISED:
3145 allow_auth_unadvertised = TRUE;
3146 break;
3147
3148 #ifdef EXPERIMENTAL_BRIGHTMAIL
3149 case CONTROL_BMI_RUN:
3150 bmi_run = 1;
3151 break;
3152 #endif
3153
3154 #ifndef DISABLE_DKIM
3155 case CONTROL_DKIM_VERIFY:
3156 dkim_disable_verify = TRUE;
3157 #ifdef EXPERIMENTAL_DMARC
3158 /* Since DKIM was blocked, skip DMARC too */
3159 dmarc_disable_verify = TRUE;
3160 dmarc_enable_forensic = FALSE;
3161 #endif
3162 break;
3163 #endif
3164
3165 #ifdef EXPERIMENTAL_DMARC
3166 case CONTROL_DMARC_VERIFY:
3167 dmarc_disable_verify = TRUE;
3168 break;
3169
3170 case CONTROL_DMARC_FORENSIC:
3171 dmarc_enable_forensic = TRUE;
3172 break;
3173 #endif
3174
3175 case CONTROL_DSCP:
3176 if (*p == '/')
3177 {
3178 int fd, af, level, optname, value;
3179 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3180 a socket; we can accept that, we'll just debug-log failures anyway. */
3181 fd = fileno(smtp_in);
3182 af = ip_get_address_family(fd);
3183 if (af < 0)
3184 {
3185 HDEBUG(D_acl)
3186 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3187 strerror(errno));
3188 break;
3189 }
3190 if (dscp_lookup(p+1, af, &level, &optname, &value))
3191 {
3192 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3193 {
3194 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3195 p+1, strerror(errno));
3196 }
3197 else
3198 {
3199 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3200 }
3201 }
3202 else
3203 {
3204 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3205 return ERROR;
3206 }
3207 }
3208 else
3209 {
3210 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3211 return ERROR;
3212 }
3213 break;
3214
3215 case CONTROL_ERROR:
3216 return ERROR;
3217
3218 case CONTROL_CASEFUL_LOCAL_PART:
3219 deliver_localpart = addr->cc_local_part;
3220 break;
3221
3222 case CONTROL_CASELOWER_LOCAL_PART:
3223 deliver_localpart = addr->lc_local_part;
3224 break;
3225
3226 case CONTROL_ENFORCE_SYNC:
3227 smtp_enforce_sync = TRUE;
3228 break;
3229
3230 case CONTROL_NO_ENFORCE_SYNC:
3231 smtp_enforce_sync = FALSE;
3232 break;
3233
3234 #ifdef WITH_CONTENT_SCAN
3235 case CONTROL_NO_MBOX_UNSPOOL:
3236 no_mbox_unspool = TRUE;
3237 break;
3238 #endif
3239
3240 case CONTROL_NO_MULTILINE:
3241 no_multiline_responses = TRUE;
3242 break;
3243
3244 case CONTROL_NO_PIPELINING:
3245 pipelining_enable = FALSE;
3246 break;
3247
3248 case CONTROL_NO_DELAY_FLUSH:
3249 disable_delay_flush = TRUE;
3250 break;
3251
3252 case CONTROL_NO_CALLOUT_FLUSH:
3253 disable_callout_flush = TRUE;
3254 break;
3255
3256 case CONTROL_FAKEREJECT:
3257 cancel_cutthrough_connection("fakereject");
3258 case CONTROL_FAKEDEFER:
3259 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3260 if (*p == '/')
3261 {
3262 const uschar *pp = p + 1;
3263 while (*pp != 0) pp++;
3264 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3265 p = pp;
3266 }
3267 else
3268 {
3269 /* Explicitly reset to default string */
3270 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3271 }
3272 break;
ed7f7860 3273
55414b25
JH		 3274 case CONTROL_FREEZE:
3275 deliver_freeze = TRUE;
3276 deliver_frozen_at = time(NULL);
3277 freeze_tell = freeze_tell_config; /* Reset to configured value */
3278 if (Ustrncmp(p, "/no_tell", 8) == 0)
3279 {
3280 p += 8;
3281 freeze_tell = NULL;
3282 }
3283 if (*p != 0)
3284 {
3285 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3286 return ERROR;
3287 }
3288 cancel_cutthrough_connection("item frozen");
3289 break;
3290
3291 case CONTROL_QUEUE_ONLY:
3292 queue_only_policy = TRUE;
3293 cancel_cutthrough_connection("queueing forced");
3294 break;
3295
3296 case CONTROL_SUBMISSION:
3297 originator_name = US"";
3298 submission_mode = TRUE;
3299 while (*p == '/')
3300 {
3301 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3302 {
3303 p += 14;
3304 active_local_sender_retain = TRUE;
3305 active_local_from_check = FALSE;
3306 }
3307 else if (Ustrncmp(p, "/domain=", 8) == 0)
3308 {
3309 const uschar *pp = p + 8;
3310 while (*pp != 0 && *pp != '/') pp++;
3311 submission_domain = string_copyn(p+8, pp-p-8);
3312 p = pp;
3313 }
3314 /* The name= option must be last, because it swallows the rest of
3315 the string. */
3316 else if (Ustrncmp(p, "/name=", 6) == 0)
3317 {
3318 const uschar *pp = p + 6;
3319 while (*pp != 0) pp++;
3320 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3321 big_buffer, big_buffer_size));
3322 p = pp;
3323 }
3324 else break;
3325 }
3326 if (*p != 0)
3327 {
3328 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3329 return ERROR;
3330 }
3331 break;
e4bdf652 3332
55414b25
JH		 3333 case CONTROL_DEBUG:
3334 while (*p == '/')
3335 {
3336 if (Ustrncmp(p, "/tag=", 5) == 0)
3337 {
3338 const uschar *pp = p + 5;
3339 while (*pp != '\0' && *pp != '/') pp++;
3340 debug_tag = string_copyn(p+5, pp-p-5);
3341 p = pp;
3342 }
3343 else if (Ustrncmp(p, "/opts=", 6) == 0)
3344 {
3345 const uschar *pp = p + 6;
3346 while (*pp != '\0' && *pp != '/') pp++;
3347 debug_opts = string_copyn(p+6, pp-p-6);
3348 p = pp;
3349 }
3350 }
3351 debug_logging_activate(debug_tag, debug_opts);
3352 break;
3353
3354 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3355 suppress_local_fixups = TRUE;
3356 break;
3357
3358 case CONTROL_CUTTHROUGH_DELIVERY:
3359 if (prdr_requested)
3360 /* Too hard to think about for now. We might in future cutthrough
3361 the case where both sides handle prdr and this-node prdr acl
3362 is "accept" */
93a6fce2 3363 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3364 else
3365 {
55414b25
JH		 3366 if (deliver_freeze)
3367 *log_msgptr = US"frozen";
3368 else if (queue_only_policy)
3369 *log_msgptr = US"queue-only";
3370 else if (fake_response == FAIL)
3371 *log_msgptr = US"fakereject";
3372 else
3373 {
3374 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3375 break;
3376 }
3377 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3378 arg, *log_msgptr);
5032d1cf 3379 }
55414b25 3380 return ERROR;
9171d434 3381 }
55414b25 3382 break;
059ec3d9 3383 }
059ec3d9 3384
6a8f9482
TK		 3385 #ifdef EXPERIMENTAL_DCC
3386 case ACLC_DCC:
3387 {
3388 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3389 const uschar * list = arg;
3390 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3391 /* Run the dcc backend. */
3392 rc = dcc_process(&ss);
3393 /* Modify return code based upon the existance of options. */
55414b25 3394 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
6a8f9482
TK		 3395 != NULL) {
3396 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3397 {
3398 /* FAIL so that the message is passed to the next ACL */
3399 rc = FAIL;
3400 }
3401 }
3402 }
3403 break;
3404 #endif
3405
71fafd95 3406 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3407 case ACLC_DECODE:
3408 rc = mime_decode(&arg);
3409 break;
71fafd95 3410 #endif
8523533c 3411
059ec3d9
PH		 3412 case ACLC_DELAY:
3413 {
3414 int delay = readconf_readtime(arg, 0, FALSE);
3415 if (delay < 0)
3416 {
3417 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3418 "modifier: \"%s\" is not a time value", arg);
3419 return ERROR;
3420 }
3421 else
3422 {
3423 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3424 delay);
3425 if (host_checking)
3426 {
3427 HDEBUG(D_acl)
3428 debug_printf("delay skipped in -bh checking mode\n");
3429 }
010c2d14
PH		 3430
3431 /* It appears to be impossible to detect that a TCP/IP connection has
3432 gone away without reading from it. This means that we cannot shorten
3433 the delay below if the client goes away, because we cannot discover
3434 that the client has closed its end of the connection. (The connection
3435 is actually in a half-closed state, waiting for the server to close its
3436 end.) It would be nice to be able to detect this state, so that the
3437 Exim process is not held up unnecessarily. However, it seems that we
3438 can't. The poll() function does not do the right thing, and in any case
3439 it is not always available.
3440
047bdd8c 3441 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3442 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3443 Also, delays may be specified for non-SMTP input, where smtp_out and
3444 smtp_in will be NULL. Whatever is done must work in all cases.
3445
3446 NOTE 2: The added feature of flushing the output before a delay must
3447 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3448 */
010c2d14 3449
8e669ac1 3450 else
86b8287f 3451 {
14f4a80d 3452 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3453 while (delay > 0) delay = sleep(delay);
8e669ac1 3454 }
059ec3d9
PH		 3455 }
3456 }
3457 break;
3458
71fafd95 3459 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3460 case ACLC_DEMIME:
3461 rc = demime(&arg);
3462 break;
71fafd95 3463 #endif
8523533c 3464
80a47a2c
TK		 3465 #ifndef DISABLE_DKIM
3466 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3467 if (dkim_cur_signer != NULL)
3468 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3469 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3470 else
80a47a2c 3471 rc = FAIL;
71fafd95
PH		 3472 break;
3473
80a47a2c
TK		 3474 case ACLC_DKIM_STATUS:
3475 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3476 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3477 break;
3478 #endif
fb2274d4 3479
4840604e
TL		 3480 #ifdef EXPERIMENTAL_DMARC
3481 case ACLC_DMARC_STATUS:
4a8ce2d8 3482 if (!dmarc_has_been_checked)
4840604e 3483 dmarc_process();
4a8ce2d8 3484 dmarc_has_been_checked = TRUE;
4840604e
TL		 3485 /* used long way of dmarc_exim_expand_query() in case we need more
3486 * view into the process in the future. */
3487 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3488 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3489 break;
3490 #endif
3491
059ec3d9
PH		 3492 case ACLC_DNSLISTS:
3493 rc = verify_check_dnsbl(&arg);
3494 break;
3495
3496 case ACLC_DOMAINS:
3497 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3498 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3499 break;
3500
3501 /* The value in tls_cipher is the full cipher name, for example,
3502 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3503 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3504 what may in practice come out of the SSL library - which at the time of
3505 writing is poorly documented. */
3506
3507 case ACLC_ENCRYPTED:
817d9f57 3508 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3509 {
3510 uschar *endcipher = NULL;
817d9f57
JH		 3511 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3512 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3513 {
3514 endcipher = Ustrchr(++cipher, ':');
3515 if (endcipher != NULL) *endcipher = 0;
3516 }
3517 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3518 if (endcipher != NULL) *endcipher = ':';
3519 }
3520 break;
3521
3522 /* Use verify_check_this_host() instead of verify_check_host() so that
3523 we can pass over &host_data to catch any looked up data. Once it has been
3524 set, it retains its value so that it's still there if another ACL verb
3525 comes through here and uses the cache. However, we must put it into
3526 permanent store in case it is also expected to be used in a subsequent
3527 message in the same SMTP connection. */
3528
3529 case ACLC_HOSTS:
3530 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3531 (sender_host_address == NULL)? US"" : sender_host_address,
3532 CUSS &host_data);
059ec3d9
PH		 3533 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3534 break;
3535
3536 case ACLC_LOCAL_PARTS:
3537 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3538 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3539 CUSS &deliver_localpart_data);
059ec3d9
PH		 3540 break;
3541
6ea85e9a
PH		 3542 case ACLC_LOG_REJECT_TARGET:
3543 {
3544 int logbits = 0;
3545 int sep = 0;
55414b25 3546 const uschar *s = arg;
6ea85e9a
PH		 3547 uschar *ss;
3548 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3549 != NULL)
3550 {
3551 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3552 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3553 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3554 else
3555 {
3556 logbits |= LOG_MAIN|LOG_REJECT;
3557 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3558 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3559 }
3560 }
3561 log_reject_target = logbits;
3562 }
3563 break;
3564
059ec3d9
PH		 3565 case ACLC_LOGWRITE:
3566 {
3567 int logbits = 0;
55414b25 3568 const uschar *s = arg;
059ec3d9
PH		 3569 if (*s == ':')
3570 {
3571 s++;
3572 while (*s != ':')
3573 {
3574 if (Ustrncmp(s, "main", 4) == 0)
3575 { logbits |= LOG_MAIN; s += 4; }
3576 else if (Ustrncmp(s, "panic", 5) == 0)
3577 { logbits |= LOG_PANIC; s += 5; }
3578 else if (Ustrncmp(s, "reject", 6) == 0)
3579 { logbits |= LOG_REJECT; s += 6; }
3580 else
3581 {
3582 logbits = LOG_MAIN|LOG_PANIC;
3583 s = string_sprintf(":unknown log name in \"%s\" in "
3584 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3585 }
3586 if (*s == ',') s++;
3587 }
3588 s++;
3589 }
3590 while (isspace(*s)) s++;
6ea85e9a
PH		 3591
3592
059ec3d9
PH		 3593 if (logbits == 0) logbits = LOG_MAIN;
3594 log_write(0, logbits, "%s", string_printing(s));
3595 }
3596 break;
8e669ac1 3597
71fafd95 3598 #ifdef WITH_CONTENT_SCAN
0f0c8159 3599 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3600 {
6ea85e9a 3601 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3602 const uschar * list = arg;
3603 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3604 uschar *opt;
3605 BOOL defer_ok = FALSE;
3606 int timeout = 0;
3607
55414b25 3608 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3609 if (strcmpic(opt, US"defer_ok") == 0)
3610 defer_ok = TRUE;
3611 else if ( strncmpic(opt, US"tmo=", 4) == 0
3612 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3613 )
3614 {
3615 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3616 return ERROR;
3617 }
3618
3619 rc = malware(ss, timeout);
3620 if (rc == DEFER && defer_ok)
3621 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3622 }
3623 break;
3624
3625 case ACLC_MIME_REGEX:
71fafd95 3626 rc = mime_regex(&arg);
8523533c 3627 break;
71fafd95 3628 #endif
059ec3d9 3629
870f6ba8 3630 case ACLC_RATELIMIT:
90fc3069 3631 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3632 break;
3633
059ec3d9 3634 case ACLC_RECIPIENTS:
55414b25
JH		 3635 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3636 CUSS &recipient_data);
059ec3d9
PH		 3637 break;
3638
71fafd95
PH		 3639 #ifdef WITH_CONTENT_SCAN
3640 case ACLC_REGEX:
3641 rc = regex(&arg);
8523533c 3642 break;
71fafd95 3643 #endif
8523533c 3644
e7568d51
TL		 3645 case ACLC_REMOVE_HEADER:
3646 setup_remove_header(arg);
3647 break;
3648
059ec3d9
PH		 3649 case ACLC_SENDER_DOMAINS:
3650 {
3651 uschar *sdomain;
3652 sdomain = Ustrrchr(sender_address, '@');
3653 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3654 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3655 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3656 }
3657 break;
3658
3659 case ACLC_SENDERS:
55414b25
JH		 3660 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3661 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3662 break;
3663
3664 /* Connection variables must persist forever */
3665
3666 case ACLC_SET:
3667 {
3668 int old_pool = store_pool;
38a0a95f
PH		 3669 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3670 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3671 store_pool = old_pool;
3672 }
3673 break;
3674
71fafd95 3675 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3676 case ACLC_SPAM:
3677 {
3678 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3679 const uschar * list = arg;
3680 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3681 /* Run the spam backend. */
55414b25 3682 rc = spam(CUSS &ss);
8523533c 3683 /* Modify return code based upon the existance of options. */
55414b25 3684 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3685 != NULL) {
3686 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3687 {
3688 /* FAIL so that the message is passed to the next ACL */
3689 rc = FAIL;
3690 }
3691 }
3692 }
3693 break;
71fafd95 3694 #endif
8523533c 3695
71fafd95 3696 #ifdef EXPERIMENTAL_SPF
8523533c 3697 case ACLC_SPF:
65a7d8c3
NM		 3698 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3699 break;
3700 case ACLC_SPF_GUESS:
3701 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3702 break;
71fafd95 3703 #endif
8523533c 3704
b0019c78
TF		 3705 case ACLC_UDPSEND:
3706 rc = acl_udpsend(arg, log_msgptr);
3707 break;
3708
059ec3d9
PH		 3709 /* If the verb is WARN, discard any user message from verification, because
3710 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3711 only from explicit "message" modifiers. However, put the user message into
3712 $acl_verify_message so it can be used in subsequent conditions or modifiers
3713 (until something changes it). */
059ec3d9
PH		 3714
3715 case ACLC_VERIFY:
3716 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3717 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3718 if (verb == ACL_WARN) *user_msgptr = NULL;
3719 break;
3720
3721 default:
3722 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3723 "condition %d", cb->type);
3724 break;
3725 }
3726
3727 /* If a condition was negated, invert OK/FAIL. */
3728
3729 if (!cond_modifiers[cb->type] && cb->u.negated)
3730 {
3731 if (rc == OK) rc = FAIL;
3732 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3733 }
3734
3735 if (rc != OK) break; /* Conditions loop */
3736 }
3737
3738
3739/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3740handle the values of these modifiers. If there isn't a log message set, we make
3741it the same as the user message.
059ec3d9
PH		 3742
3743"message" is a user message that will be included in an SMTP response. Unless
3744it is empty, it overrides any previously set user message.
3745
3746"log_message" is a non-user message, and it adds to any existing non-user
3747message that is already set.
3748
4e88a19f
PH		 3749Most verbs have but a single return for which the messages are relevant, but
3750for "discard", it's useful to have the log message both when it succeeds and
3751when it fails. For "accept", the message is used in the OK case if there is no
3752"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3753present. */
059ec3d9 3754
4e88a19f
PH		 3755if (*epp && rc == OK) user_message = NULL;
3756
3757if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3758 {
3759 uschar *expmessage;
4e88a19f
PH		 3760 uschar *old_user_msgptr = *user_msgptr;
3761 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3762
3763 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3764 nested ACLs) are always discarded. This also happens for acceptance verbs
3765 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3766 However, the value of an existing message is available in $acl_verify_message
3767 during expansions. */
3768
4e88a19f
PH		 3769 if (verb == ACL_WARN ||
3770 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3771 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3772
3773 if (user_message != NULL)
3774 {
3775 acl_verify_message = old_user_msgptr;
3776 expmessage = expand_string(user_message);
3777 if (expmessage == NULL)
3778 {
3779 if (!expand_string_forcedfail)
3780 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3781 user_message, expand_string_message);
3782 }
3783 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3784 }
3785
3786 if (log_message != NULL)
3787 {
3788 acl_verify_message = old_log_msgptr;
3789 expmessage = expand_string(log_message);
3790 if (expmessage == NULL)
3791 {
3792 if (!expand_string_forcedfail)
3793 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3794 log_message, expand_string_message);
3795 }
3796 else if (expmessage[0] != 0)
3797 {
3798 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3799 string_sprintf("%s: %s", expmessage, *log_msgptr);
3800 }
3801 }
3802
3803 /* If no log message, default it to the user message */
3804
3805 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3806 }
3807
3808acl_verify_message = NULL;
3809return rc;
3810}
3811
3812
3813
3814
3815
3816/*************************************************
3817* Get line from a literal ACL *
3818*************************************************/
3819
3820/* This function is passed to acl_read() in order to extract individual lines
3821of a literal ACL, which we access via static pointers. We can destroy the
3822contents because this is called only once (the compiled ACL is remembered).
3823
3824This code is intended to treat the data in the same way as lines in the main
3825Exim configuration file. That is:
3826
3827 . Leading spaces are ignored.
3828
3829 . A \ at the end of a line is a continuation - trailing spaces after the \
3830 are permitted (this is because I don't believe in making invisible things
3831 significant). Leading spaces on the continued part of a line are ignored.
3832
3833 . Physical lines starting (significantly) with # are totally ignored, and
3834 may appear within a sequence of backslash-continued lines.
3835
3836 . Blank lines are ignored, but will end a sequence of continuations.
3837
3838Arguments: none
3839Returns: a pointer to the next line
3840*/
3841
3842
3843static uschar *acl_text; /* Current pointer in the text */
3844static uschar *acl_text_end; /* Points one past the terminating '0' */
3845
3846
3847static uschar *
3848acl_getline(void)
3849{
3850uschar *yield;
3851
3852/* This loop handles leading blank lines and comments. */
3853
3854for(;;)
3855 {
3856 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3857 if (*acl_text == 0) return NULL; /* No more data */
3858 yield = acl_text; /* Potential data line */
3859
3860 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3861
3862 /* If we hit the end before a newline, we have the whole logical line. If
3863 it's a comment, there's no more data to be given. Otherwise, yield it. */
3864
3865 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3866
3867 /* After reaching a newline, end this loop if the physical line does not
3868 start with '#'. If it does, it's a comment, and the loop continues. */
3869
3870 if (*yield != '#') break;
3871 }
3872
3873/* This loop handles continuations. We know we have some real data, ending in
3874newline. See if there is a continuation marker at the end (ignoring trailing
3875white space). We know that *yield is not white space, so no need to test for
3876cont > yield in the backwards scanning loop. */
3877
3878for(;;)
3879 {
3880 uschar *cont;
3881 for (cont = acl_text - 1; isspace(*cont); cont--);
3882
3883 /* If no continuation follows, we are done. Mark the end of the line and
3884 return it. */
3885
3886 if (*cont != '\\')
3887 {
3888 *acl_text++ = 0;
3889 return yield;
3890 }
3891
3892 /* We have encountered a continuation. Skip over whitespace at the start of
3893 the next line, and indeed the whole of the next line or lines if they are
3894 comment lines. */
3895
3896 for (;;)
3897 {
3898 while (*(++acl_text) == ' ' || *acl_text == '\t');
3899 if (*acl_text != '#') break;
3900 while (*(++acl_text) != 0 && *acl_text != '\n');
3901 }
3902
3903 /* We have the start of a continuation line. Move all the rest of the data
3904 to join onto the previous line, and then find its end. If the end is not a
3905 newline, we are done. Otherwise loop to look for another continuation. */
3906
3907 memmove(cont, acl_text, acl_text_end - acl_text);
3908 acl_text_end -= acl_text - cont;
3909 acl_text = cont;
3910 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3911 if (*acl_text == 0) return yield;
3912 }
3913
3914/* Control does not reach here */
3915}
3916
3917
3918
3919
3920
3921/*************************************************
3922* Check access using an ACL *
3923*************************************************/
3924
3925/* This function is called from address_check. It may recurse via
3926acl_check_condition() - hence the use of a level to stop looping. The ACL is
3927passed as a string which is expanded. A forced failure implies no access check
3928is required. If the result is a single word, it is taken as the name of an ACL
3929which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3930text, complete with newlines, and parsed as such. In both cases, the ACL check
3931is then run. This function uses an auxiliary function for acl_read() to call
3932for reading individual lines of a literal ACL. This is acl_getline(), which
3933appears immediately above.
3934
3935Arguments:
3936 where where called from
3937 addr address item when called from RCPT; otherwise NULL
3938 s the input string; NULL is the same as an empty ACL => DENY
3939 level the nesting level
3940 user_msgptr where to put a user error (for SMTP response)
3941 log_msgptr where to put a logging message (not for SMTP response)
3942
3943Returns: OK access is granted
3944 DISCARD access is apparently granted...
3945 FAIL access is denied
3946 FAIL_DROP access is denied; drop the connection
3947 DEFER can't tell at the moment
3948 ERROR disaster
3949*/
3950
3951static int
3952acl_check_internal(int where, address_item *addr, uschar *s, int level,
3953 uschar **user_msgptr, uschar **log_msgptr)
3954{
3955int fd = -1;
3956acl_block *acl = NULL;
3957uschar *acl_name = US"inline ACL";
3958uschar *ss;
3959
3960/* Catch configuration loops */
3961
3962if (level > 20)
3963 {
3964 *log_msgptr = US"ACL nested too deep: possible loop";
3965 return ERROR;
3966 }
3967
3968if (s == NULL)
3969 {
3970 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3971 return FAIL;
3972 }
3973
3974/* At top level, we expand the incoming string. At lower levels, it has already
3975been expanded as part of condition processing. */
3976
3977if (level == 0)
3978 {
3979 ss = expand_string(s);
3980 if (ss == NULL)
3981 {
3982 if (expand_string_forcedfail) return OK;
3983 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3984 expand_string_message);
3985 return ERROR;
3986 }
3987 }
3988else ss = s;
3989
3990while (isspace(*ss))ss++;
3991
3992/* If we can't find a named ACL, the default is to parse it as an inline one.
3993(Unless it begins with a slash; non-existent files give rise to an error.) */
3994
3995acl_text = ss;
3996
3997/* Handle the case of a string that does not contain any spaces. Look for a
3998named ACL among those read from the configuration, or a previously read file.
3999It is possible that the pointer to the ACL is NULL if the configuration
4000contains a name with no data. If not found, and the text begins with '/',
4001read an ACL from a file, and save it so it can be re-used. */
4002
4003if (Ustrchr(ss, ' ') == NULL)
4004 {
4005 tree_node *t = tree_search(acl_anchor, ss);
4006 if (t != NULL)
4007 {
4008 acl = (acl_block *)(t->data.ptr);
4009 if (acl == NULL)
4010 {
4011 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4012 return FAIL;
4013 }
4014 acl_name = string_sprintf("ACL \"%s\"", ss);
4015 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4016 }
4017
4018 else if (*ss == '/')
4019 {
4020 struct stat statbuf;
4021 fd = Uopen(ss, O_RDONLY, 0);
4022 if (fd < 0)
4023 {
4024 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4025 strerror(errno));
4026 return ERROR;
4027 }
4028
4029 if (fstat(fd, &statbuf) != 0)
4030 {
4031 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4032 strerror(errno));
4033 return ERROR;
4034 }
4035
4036 acl_text = store_get(statbuf.st_size + 1);
4037 acl_text_end = acl_text + statbuf.st_size + 1;
4038
4039 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4040 {
4041 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4042 ss, strerror(errno));
4043 return ERROR;
4044 }
4045 acl_text[statbuf.st_size] = 0;
f1e894f3 4046 (void)close(fd);
059ec3d9
PH		 4047
4048 acl_name = string_sprintf("ACL \"%s\"", ss);
4049 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4050 }
4051 }
4052
4053/* Parse an ACL that is still in text form. If it came from a file, remember it
4054in the ACL tree, having read it into the POOL_PERM store pool so that it
4055persists between multiple messages. */
4056
4057if (acl == NULL)
4058 {
4059 int old_pool = store_pool;
4060 if (fd >= 0) store_pool = POOL_PERM;
4061 acl = acl_read(acl_getline, log_msgptr);
4062 store_pool = old_pool;
4063 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4064 if (fd >= 0)
4065 {
4066 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4067 Ustrcpy(t->name, ss);
4068 t->data.ptr = acl;
4069 (void)tree_insertnode(&acl_anchor, t);
4070 }
4071 }
4072
4073/* Now we have an ACL to use. It's possible it may be NULL. */
4074
4075while (acl != NULL)
4076 {
4077 int cond;
4078 int basic_errno = 0;
4079 BOOL endpass_seen = FALSE;
4080
4081 *log_msgptr = *user_msgptr = NULL;
4082 acl_temp_details = FALSE;
4083
7353285c 4084 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
059ec3d9
PH		 4085 acl->verb != ACL_ACCEPT &&
4086 acl->verb != ACL_WARN)
4087 {
7353285c 4088 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
059ec3d9
PH		 4089 verbs[acl->verb]);
4090 return ERROR;
4091 }
4092
4093 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4094
4095 /* Clear out any search error message from a previous check before testing
4096 this condition. */
4097
4098 search_error_message = NULL;
4099 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4100 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4101
4102 /* Handle special returns: DEFER causes a return except on a WARN verb;
4103 ERROR always causes a return. */
4104
4105 switch (cond)
4106 {
4107 case DEFER:
6968512f 4108 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4109 if (basic_errno != ERRNO_CALLOUTDEFER)
4110 {
4111 if (search_error_message != NULL && *search_error_message != 0)
4112 *log_msgptr = search_error_message;
4113 if (smtp_return_error_details) acl_temp_details = TRUE;
4114 }
4115 else
4116 {
4117 acl_temp_details = TRUE;
4118 }
4119 if (acl->verb != ACL_WARN) return DEFER;
4120 break;
4121
4122 default: /* Paranoia */
4123 case ERROR:
6968512f 4124 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4125 return ERROR;
4126
4127 case OK:
6968512f
JH		 4128 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4129 verbs[acl->verb], acl_name);
059ec3d9
PH		 4130 break;
4131
4132 case FAIL:
6968512f 4133 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4134 break;
4135
4136 /* DISCARD and DROP can happen only from a nested ACL condition, and
4137 DISCARD can happen only for an "accept" or "discard" verb. */
4138
4139 case DISCARD:
6968512f
JH		 4140 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4141 verbs[acl->verb], acl_name);
059ec3d9
PH		 4142 break;
4143
4144 case FAIL_DROP:
6968512f
JH		 4145 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4146 verbs[acl->verb], acl_name);
059ec3d9
PH		 4147 break;
4148 }
4149
4150 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4151 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4152 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4153
4154 switch(acl->verb)
4155 {
4156 case ACL_ACCEPT:
a7538db1
JH		 4157 if (cond == OK || cond == DISCARD)
4158 {
4159 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4160 return cond;
4161 }
059ec3d9
PH		 4162 if (endpass_seen)
4163 {
4164 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4165 return cond;
4166 }
4167 break;
4168
4169 case ACL_DEFER:
4170 if (cond == OK)
4171 {
a7538db1 4172 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
059ec3d9
PH		 4173 acl_temp_details = TRUE;
4174 return DEFER;
4175 }
4176 break;
4177
4178 case ACL_DENY:
a7538db1
JH		 4179 if (cond == OK)
4180 {
4181 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
4182 return FAIL;
4183 }
059ec3d9
PH		 4184 break;
4185
4186 case ACL_DISCARD:
a7538db1
JH		 4187 if (cond == OK || cond == DISCARD)
4188 {
4189 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
4190 return DISCARD;
4191 }
059ec3d9
PH		 4192 if (endpass_seen)
4193 {
4194 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4195 return cond;
4196 }
4197 break;
4198
4199 case ACL_DROP:
a7538db1
JH		 4200 if (cond == OK)
4201 {
4202 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
4203 return FAIL_DROP;
4204 }
059ec3d9
PH		 4205 break;
4206
4207 case ACL_REQUIRE:
a7538db1
JH		 4208 if (cond != OK)
4209 {
4210 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
4211 return cond;
4212 }
059ec3d9
PH		 4213 break;
4214
4215 case ACL_WARN:
4216 if (cond == OK)
4217 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4218 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4219 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4220 "condition test deferred%s%s", host_and_ident(TRUE),
4221 (*log_msgptr == NULL)? US"" : US": ",
4222 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4223 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4224 break;
4225
4226 default:
4227 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4228 acl->verb);
4229 break;
4230 }
4231
4232 /* Pass to the next ACL item */
4233
4234 acl = acl->next;
4235 }
4236
4237/* We have reached the end of the ACL. This is an implicit DENY. */
4238
4239HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4240return FAIL;
4241}
4242
4243
333eea9c
JH		 4244
4245
4246/* Same args as acl_check_internal() above, but the string s is
4247the name of an ACL followed optionally by up to 9 space-separated arguments.
4248The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4249static int
55414b25 4250acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4251 uschar **user_msgptr, uschar **log_msgptr)
4252{
4253uschar * tmp;
bef3ea7f 4254uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4255uschar * sav_arg[9]; /* must match acl_arg[] */
4256int sav_narg;
333eea9c 4257uschar * name;
bef3ea7f 4258int i;
ef21c07d 4259int ret;
333eea9c
JH		 4260
4261if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4262 goto bad;
4263
bef3ea7f 4264for (i = 0; i < 9; i++)
333eea9c
JH		 4265 {
4266 while (*s && isspace(*s)) s++;
4267 if (!*s) break;
bef3ea7f 4268 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4269 {
4270 tmp = name;
4271 goto bad;
4272 }
4273 }
ef21c07d
JH		 4274
4275sav_narg = acl_narg;
bef3ea7f 4276acl_narg = i;
ef21c07d
JH		 4277for (i = 0; i < acl_narg; i++)
4278 {
4279 sav_arg[i] = acl_arg[i];
4280 acl_arg[i] = tmp_arg[i];
4281 }
4282while (i < 9)
4283 {
4284 sav_arg[i] = acl_arg[i];
4285 acl_arg[i++] = NULL;
4286 }
4287
4288ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4289
ef21c07d
JH		 4290acl_narg = sav_narg;
4291for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4292return ret;
333eea9c
JH		 4293
4294bad:
4295if (expand_string_forcedfail) return ERROR;
4296*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4297 tmp, expand_string_message);
4298return search_find_defer?DEFER:ERROR;
4299}
4300
4301
4302
059ec3d9
PH		 4303/*************************************************
4304* Check access using an ACL *
4305*************************************************/
4306
faa05a93
JH		 4307/* Alternate interface for ACL, used by expansions */
4308int
05caaeaa 4309acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4310{
faa05a93
JH		 4311address_item adb;
4312address_item *addr = NULL;
4313
4314*user_msgptr = *log_msgptr = NULL;
4315sender_verified_failed = NULL;
4316ratelimiters_cmd = NULL;
4317log_reject_target = LOG_MAIN|LOG_REJECT;
4318
4319if (where == ACL_WHERE_RCPT)
4320 {
4321 adb = address_defaults;
4322 addr = &adb;
05caaeaa
JH		 4323 addr->address = expand_string(US"$local_part@$domain");
4324 addr->domain = deliver_domain;
4325 addr->local_part = deliver_localpart;
4326 addr->cc_local_part = deliver_localpart;
4327 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4328 }
4329
4330return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4331}
4332
4333
4334
059ec3d9
PH		 4335/* This is the external interface for ACL checks. It sets up an address and the
4336expansions for $domain and $local_part when called after RCPT, then calls
4337acl_check_internal() to do the actual work.
4338
4339Arguments:
4340 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4341 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4342 s the input string; NULL is the same as an empty ACL => DENY
4343 user_msgptr where to put a user error (for SMTP response)
4344 log_msgptr where to put a logging message (not for SMTP response)
4345
4346Returns: OK access is granted by an ACCEPT verb
4347 DISCARD access is granted by a DISCARD verb
4348 FAIL access is denied
4349 FAIL_DROP access is denied; drop the connection
4350 DEFER can't tell at the moment
4351 ERROR disaster
4352*/
faa05a93 4353int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4354
4355int
64ffc24f 4356acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4357 uschar **log_msgptr)
4358{
4359int rc;
4360address_item adb;
64ffc24f 4361address_item *addr = NULL;
059ec3d9
PH		 4362
4363*user_msgptr = *log_msgptr = NULL;
4364sender_verified_failed = NULL;
fe0dab11 4365ratelimiters_cmd = NULL;
6ea85e9a 4366log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4367
8ccd00b1 4368#ifndef DISABLE_PRDR
5032d1cf 4369if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR)
fd98a5c6 4370#else
5032d1cf 4371if (where == ACL_WHERE_RCPT)
fd98a5c6 4372#endif
059ec3d9
PH		 4373 {
4374 adb = address_defaults;
4375 addr = &adb;
64ffc24f 4376 addr->address = recipient;
059ec3d9
PH		 4377 if (deliver_split_address(addr) == DEFER)
4378 {
4379 *log_msgptr = US"defer in percent_hack_domains check";
4380 return DEFER;
4381 }
4382 deliver_domain = addr->domain;
4383 deliver_localpart = addr->local_part;
4384 }
059ec3d9 4385
faa05a93 4386acl_where = where;
059ec3d9 4387rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4388acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4389
817d9f57
JH		 4390/* Cutthrough - if requested,
4391and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4392and rcpt acl returned accept,
4393and first recipient (cancel on any subsequents)
e4bdf652 4394open one now and run it up to RCPT acceptance.
e4bdf652 4395A failed verify should cancel cutthrough request.
e4bdf652 4396
817d9f57 4397Initial implementation: dual-write to spool.
e4bdf652
JH		 4398Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4399
4400Cease cutthrough copy on rxd final dot; do not send one.
4401
4402On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4403
4404On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4405perm-rejected, reflect that to the original sender - and dump the spooled copy.
4406If temp-reject, close the conn (and keep the spooled copy).
4407If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4408*/
4409switch (where)
4410{
4411case ACL_WHERE_RCPT:
8ccd00b1 4412#ifndef DISABLE_PRDR
fd98a5c6
JH		 4413case ACL_WHERE_PRDR:
4414#endif
5032d1cf 4415 if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
e4bdf652
JH		 4416 open_cutthrough_connection(addr);
4417 break;
4418
4419case ACL_WHERE_PREDATA:
4420 if( rc == OK )
4421 cutthrough_predata();
4422 else
2e5b33cd 4423 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4424 break;
4425
4426case ACL_WHERE_QUIT:
4427case ACL_WHERE_NOTQUIT:
2e5b33cd 4428 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4429 break;
4430
4431default:
4432 break;
4433}
4434
64ffc24f
PH		 4435deliver_domain = deliver_localpart = deliver_address_data =
4436 sender_address_data = NULL;
059ec3d9
PH		 4437
4438/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4439ACL, which is really in the middle of an SMTP command. */
4440
4441if (rc == DISCARD)
4442 {
4443 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4444 {
4445 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4446 "ACL", acl_wherenames[where]);
4447 return ERROR;
4448 }
4449 return DISCARD;
4450 }
4451
4452/* A DROP response is not permitted from MAILAUTH */
4453
4454if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4455 {
4456 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4457 "ACL", acl_wherenames[where]);
4458 return ERROR;
4459 }
4460
4e88a19f
PH		 4461/* Before giving a response, take a look at the length of any user message, and
4462split it up into multiple lines if possible. */
059ec3d9 4463
e28326d8
PH		 4464*user_msgptr = string_split_message(*user_msgptr);
4465if (fake_response != OK)
4466 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4467
4468return rc;
4469}
4470
38a0a95f 4471
38a0a95f
PH		 4472/*************************************************
4473* Create ACL variable *
4474*************************************************/
4475
4476/* Create an ACL variable or reuse an existing one. ACL variables are in a
4477binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4478
4479Argument:
4480 name pointer to the variable's name, starting with c or m
4481
4482Returns the pointer to variable's tree node
4483*/
4484
4485tree_node *
4486acl_var_create(uschar *name)
4487{
4488tree_node *node, **root;
4489root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4490node = tree_search(*root, name);
4491if (node == NULL)
4492 {
4493 node = store_get(sizeof(tree_node) + Ustrlen(name));
4494 Ustrcpy(node->name, name);
4495 (void)tree_insertnode(root, node);
4496 }
4497node->data.ptr = NULL;
4498return node;
4499}
4500
4501
4502
4503/*************************************************
4504* Write an ACL variable in spool format *
4505*************************************************/
4506
4507/* This function is used as a callback for tree_walk when writing variables to
4508the spool file. To retain spool file compatibility, what is written is -aclc or
4509-aclm followed by the rest of the name and the data length, space separated,
4510then the value itself, starting on a new line, and terminated by an additional
4511newline. When we had only numbered ACL variables, the first line might look
4512like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4513acl_cfoo.
4514
4515Arguments:
4516 name of the variable
4517 value of the variable
4518 ctx FILE pointer (as a void pointer)
4519
4520Returns: nothing
4521*/
4522
4523void
4524acl_var_write(uschar *name, uschar *value, void *ctx)
4525{
4526FILE *f = (FILE *)ctx;
4527fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4528}
4529
9171d434
JH		 4530/* vi: aw ai sw=2
4531*/
059ec3d9 4532/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.