projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
ACL: bsearch for controls
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
80a47a2c
TK		 68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
4840604e
TL		 71#endif
72#ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
8e669ac1 74#endif
71fafd95
PH		 75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
6ea85e9a 82 ACLC_LOG_REJECT_TARGET,
71fafd95 83 ACLC_LOGWRITE,
8523533c
TK		 84#ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86#endif
87 ACLC_MESSAGE,
88#ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90#endif
b0b9dbb1 91 ACLC_QUEUE,
870f6ba8 92 ACLC_RATELIMIT,
8523533c
TK		 93 ACLC_RECIPIENTS,
94#ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96#endif
e7568d51 97 ACLC_REMOVE_HEADER,
71fafd95
PH		 98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
8523533c 101#ifdef WITH_CONTENT_SCAN
8e669ac1 102 ACLC_SPAM,
8523533c
TK		 103#endif
104#ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
65a7d8c3 106 ACLC_SPF_GUESS,
8523533c 107#endif
b0019c78 108 ACLC_UDPSEND,
8523533c 109 ACLC_VERIFY };
059ec3d9 110
c3611384 111/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 112"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH		 113modifiers that look like conditions but always return TRUE. They are used for
114their side effects. */
059ec3d9 115
9a26b6b2
PH		 116static uschar *conditions[] = {
117 US"acl",
71fafd95 118 US"add_header",
9a26b6b2 119 US"authenticated",
8523533c
TK		 120#ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122#endif
123 US"condition",
c3611384 124 US"continue",
8e669ac1 125 US"control",
6a8f9482
TK		 126#ifdef EXPERIMENTAL_DCC
127 US"dcc",
128#endif
8523533c
TK		 129#ifdef WITH_CONTENT_SCAN
130 US"decode",
131#endif
132 US"delay",
80a47a2c
TK		 133#ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
4840604e
TL		 136#endif
137#ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
8523533c 139#endif
6ea85e9a
PH		 140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
8523533c
TK		 149#ifdef WITH_CONTENT_SCAN
150 US"malware",
151#endif
152 US"message",
153#ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155#endif
b0b9dbb1 156 US"queue",
870f6ba8 157 US"ratelimit",
8523533c
TK		 158 US"recipients",
159#ifdef WITH_CONTENT_SCAN
160 US"regex",
161#endif
e7568d51 162 US"remove_header",
b0b9dbb1
JH		 163 US"sender_domains",
164 US"senders",
165 US"set",
8523533c
TK		 166#ifdef WITH_CONTENT_SCAN
167 US"spam",
168#endif
169#ifdef EXPERIMENTAL_SPF
170 US"spf",
65a7d8c3 171 US"spf_guess",
8523533c 172#endif
b0019c78 173 US"udpsend",
059ec3d9 174 US"verify" };
8e669ac1 175
c5fcb476 176
047bdd8c 177/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 178at the outer level. In the other cases, expansion already occurs in the
179checking functions. */
180
181static uschar cond_expand_at_top[] = {
7421ecab 182 FALSE, /* acl */
3e536984 183 TRUE, /* add_header */
059ec3d9 184 FALSE, /* authenticated */
8523533c
TK		 185#ifdef EXPERIMENTAL_BRIGHTMAIL
186 TRUE, /* bmi_optin */
8e669ac1 187#endif
059ec3d9 188 TRUE, /* condition */
c3611384 189 TRUE, /* continue */
059ec3d9 190 TRUE, /* control */
6a8f9482
TK		 191#ifdef EXPERIMENTAL_DCC
192 TRUE, /* dcc */
193#endif
8523533c
TK		 194#ifdef WITH_CONTENT_SCAN
195 TRUE, /* decode */
196#endif
059ec3d9 197 TRUE, /* delay */
80a47a2c
TK		 198#ifndef DISABLE_DKIM
199 TRUE, /* dkim_signers */
200 TRUE, /* dkim_status */
4840604e
TL		 201#endif
202#ifdef EXPERIMENTAL_DMARC
203 TRUE, /* dmarc_status */
8523533c 204#endif
059ec3d9
PH		 205 TRUE, /* dnslists */
206 FALSE, /* domains */
207 FALSE, /* encrypted */
208 TRUE, /* endpass */
209 FALSE, /* hosts */
210 FALSE, /* local_parts */
211 TRUE, /* log_message */
6ea85e9a 212 TRUE, /* log_reject_target */
059ec3d9 213 TRUE, /* logwrite */
8523533c
TK		 214#ifdef WITH_CONTENT_SCAN
215 TRUE, /* malware */
216#endif
059ec3d9 217 TRUE, /* message */
8523533c
TK		 218#ifdef WITH_CONTENT_SCAN
219 TRUE, /* mime_regex */
220#endif
b0b9dbb1 221 TRUE, /* queue */
870f6ba8 222 TRUE, /* ratelimit */
059ec3d9 223 FALSE, /* recipients */
8523533c
TK		 224#ifdef WITH_CONTENT_SCAN
225 TRUE, /* regex */
226#endif
e7568d51 227 TRUE, /* remove_header */
059ec3d9
PH		 228 FALSE, /* sender_domains */
229 FALSE, /* senders */
230 TRUE, /* set */
8523533c
TK		 231#ifdef WITH_CONTENT_SCAN
232 TRUE, /* spam */
233#endif
234#ifdef EXPERIMENTAL_SPF
235 TRUE, /* spf */
65a7d8c3 236 TRUE, /* spf_guess */
8523533c 237#endif
b0019c78 238 TRUE, /* udpsend */
059ec3d9
PH		 239 TRUE /* verify */
240};
241
242/* Flags to identify the modifiers */
243
244static uschar cond_modifiers[] = {
245 FALSE, /* acl */
3e536984 246 TRUE, /* add_header */
059ec3d9 247 FALSE, /* authenticated */
8523533c
TK		 248#ifdef EXPERIMENTAL_BRIGHTMAIL
249 TRUE, /* bmi_optin */
8e669ac1 250#endif
059ec3d9 251 FALSE, /* condition */
c3611384 252 TRUE, /* continue */
059ec3d9 253 TRUE, /* control */
6a8f9482
TK		 254#ifdef EXPERIMENTAL_DCC
255 FALSE, /* dcc */
256#endif
8523533c
TK		 257#ifdef WITH_CONTENT_SCAN
258 FALSE, /* decode */
259#endif
059ec3d9 260 TRUE, /* delay */
80a47a2c
TK		 261#ifndef DISABLE_DKIM
262 FALSE, /* dkim_signers */
263 FALSE, /* dkim_status */
4840604e
TL		 264#endif
265#ifdef EXPERIMENTAL_DMARC
266 FALSE, /* dmarc_status */
8523533c 267#endif
059ec3d9
PH		 268 FALSE, /* dnslists */
269 FALSE, /* domains */
270 FALSE, /* encrypted */
271 TRUE, /* endpass */
272 FALSE, /* hosts */
273 FALSE, /* local_parts */
274 TRUE, /* log_message */
6ea85e9a 275 TRUE, /* log_reject_target */
8523533c
TK		 276 TRUE, /* logwrite */
277#ifdef WITH_CONTENT_SCAN
278 FALSE, /* malware */
279#endif
059ec3d9 280 TRUE, /* message */
8523533c
TK		 281#ifdef WITH_CONTENT_SCAN
282 FALSE, /* mime_regex */
283#endif
b0b9dbb1 284 TRUE, /* queue */
870f6ba8 285 FALSE, /* ratelimit */
059ec3d9 286 FALSE, /* recipients */
8523533c
TK		 287#ifdef WITH_CONTENT_SCAN
288 FALSE, /* regex */
289#endif
e7568d51 290 TRUE, /* remove_header */
059ec3d9
PH		 291 FALSE, /* sender_domains */
292 FALSE, /* senders */
293 TRUE, /* set */
8523533c
TK		 294#ifdef WITH_CONTENT_SCAN
295 FALSE, /* spam */
296#endif
297#ifdef EXPERIMENTAL_SPF
298 FALSE, /* spf */
65a7d8c3 299 FALSE, /* spf_guess */
8523533c 300#endif
b0019c78 301 TRUE, /* udpsend */
059ec3d9
PH		 302 FALSE /* verify */
303};
304
c3611384 305/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 306times. For each condition and modifier, there's a bitmap of dis-allowed times.
307For some, it is easier to specify the negation of a small number of allowed
308times. */
059ec3d9
PH		 309
310static unsigned int cond_forbids[] = {
311 0, /* acl */
8e669ac1 312
71fafd95 313 (unsigned int)
45b91596 314 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 315 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 316 #ifndef DISABLE_PRDR
fd98a5c6
JH		 317 (1<<ACL_WHERE_PRDR)|
318 #endif
45b91596 319 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 320 (1<<ACL_WHERE_DKIM)|
45b91596 321 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 322
45b91596
PH		 323 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
324 (1<<ACL_WHERE_NOTSMTP_START)|
325 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 326
71fafd95 327 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 328 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 329 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
330 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 331 #ifndef DISABLE_PRDR
fd98a5c6
JH		 332 (1<<ACL_WHERE_PRDR)|
333 #endif
8e669ac1 334 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 335 (1<<ACL_WHERE_MAILAUTH)|
336 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 337 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
338 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 339 #endif
8e669ac1 340
059ec3d9 341 0, /* condition */
8e669ac1 342
c3611384
PH		 343 0, /* continue */
344
059ec3d9 345 /* Certain types of control are always allowed, so we let it through
2f079f46 346 always and check in the control processing itself. */
8e669ac1 347
059ec3d9 348 0, /* control */
8e669ac1 349
6a8f9482
TK		 350 #ifdef EXPERIMENTAL_DCC
351 (unsigned int)
fd98a5c6 352 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 353 #ifndef DISABLE_PRDR
fd98a5c6 354 (1<<ACL_WHERE_PRDR)|
8ccd00b1 355 #endif
fd98a5c6 356 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 357 #endif
358
71fafd95 359 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 360 (unsigned int)
361 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 362 #endif
8523533c 363
8f128379 364 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 365
80a47a2c
TK		 366 #ifndef DISABLE_DKIM
367 (unsigned int)
368 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 369
80a47a2c
TK		 370 (unsigned int)
371 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 372 #endif
fb2274d4 373
4840604e
TL		 374 #ifdef EXPERIMENTAL_DMARC
375 (unsigned int)
376 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
377 #endif
378
379ba7d0
JH		 379 /* Explicit key lookups can be made in non-smtp ACLs so pass
380 always and check in the verify processing itself. */
381
382 0, /* dnslists */
059ec3d9 383
2f079f46 384 (unsigned int)
fd98a5c6 385 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 386 |(1<<ACL_WHERE_VRFY)
8ccd00b1 387 #ifndef DISABLE_PRDR
fd98a5c6
JH		 388 |(1<<ACL_WHERE_PRDR)
389 #endif
390 ),
059ec3d9 391
45b91596
PH		 392 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
393 (1<<ACL_WHERE_CONNECT)|
394 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 395 (1<<ACL_WHERE_HELO),
8e669ac1 396
059ec3d9 397 0, /* endpass */
8e669ac1 398
45b91596
PH		 399 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
400 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 401
2f079f46 402 (unsigned int)
fd98a5c6 403 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 404 |(1<<ACL_WHERE_VRFY)
2e6afa4f 405 #ifndef DISABLE_PRDR
fd98a5c6
JH		 406 |(1<<ACL_WHERE_PRDR)
407 #endif
408 ),
059ec3d9
PH		 409
410 0, /* log_message */
8e669ac1 411
6ea85e9a
PH		 412 0, /* log_reject_target */
413
059ec3d9 414 0, /* logwrite */
8e669ac1 415
71fafd95 416 #ifdef WITH_CONTENT_SCAN
2f079f46 417 (unsigned int)
fd98a5c6 418 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 419 #ifndef DISABLE_PRDR
fd98a5c6 420 (1<<ACL_WHERE_PRDR)|
8ccd00b1 421 #endif
fd98a5c6 422 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 423 #endif
8523533c 424
059ec3d9
PH		 425 0, /* message */
426
71fafd95 427 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 428 (unsigned int)
429 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 430 #endif
8523533c 431
ecc5f51a
JH		 432 (1<<ACL_WHERE_NOTSMTP)| /* queue */
433 #ifndef DISABLE_PRDR
434 (1<<ACL_WHERE_PRDR)|
435 #endif
436 (1<<ACL_WHERE_DATA),
437
870f6ba8
TF		 438 0, /* ratelimit */
439
2f079f46
PH		 440 (unsigned int)
441 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46 444 (unsigned int)
fd98a5c6 445 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 446 #ifndef DISABLE_PRDR
fd98a5c6 447 (1<<ACL_WHERE_PRDR)|
8ccd00b1 448 #endif
fd98a5c6 449 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 450 (1<<ACL_WHERE_MIME)),
71fafd95 451 #endif
8523533c 452
e7568d51
TL		 453 (unsigned int)
454 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
455 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 456 #ifndef DISABLE_PRDR
fd98a5c6
JH		 457 (1<<ACL_WHERE_PRDR)|
458 #endif
e7568d51
TL		 459 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
460 (1<<ACL_WHERE_NOTSMTP_START)),
461
059ec3d9
PH		 462 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
463 (1<<ACL_WHERE_HELO)|
464 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
465 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
466 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
467
468 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
469 (1<<ACL_WHERE_HELO)|
470 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
471 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
472 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
473
474 0, /* set */
475
71fafd95 476 #ifdef WITH_CONTENT_SCAN
2f079f46 477 (unsigned int)
fd98a5c6 478 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 479 #ifndef DISABLE_PRDR
fd98a5c6 480 (1<<ACL_WHERE_PRDR)|
8ccd00b1 481 #endif
fd98a5c6 482 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 483 #endif
8523533c 484
71fafd95 485 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 486 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
487 (1<<ACL_WHERE_HELO)|
488 (1<<ACL_WHERE_MAILAUTH)|
489 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 490 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
491 (1<<ACL_WHERE_NOTSMTP)|
492 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 493
494 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
495 (1<<ACL_WHERE_HELO)|
496 (1<<ACL_WHERE_MAILAUTH)|
497 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
498 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
499 (1<<ACL_WHERE_NOTSMTP)|
500 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 501 #endif
8523533c 502
b0019c78
TF		 503 0, /* udpsend */
504
059ec3d9
PH		 505 /* Certain types of verify are always allowed, so we let it through
506 always and check in the verify function itself */
507
508 0 /* verify */
059ec3d9
PH		 509};
510
511
d7bed771
JH		 512/* Return values from decode_control(); used as index so keep in step
513with the controls_list table that follows! */
c46782ef 514
d7bed771
JH		 515enum {
516 CONTROL_AUTH_UNADVERTISED,
3c8b3577 517#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 518 CONTROL_BMI_RUN,
3c8b3577 519#endif
d7bed771
JH		 520 CONTROL_CASEFUL_LOCAL_PART,
521 CONTROL_CASELOWER_LOCAL_PART,
522 CONTROL_CUTTHROUGH_DELIVERY,
523 CONTROL_DEBUG,
3c8b3577 524#ifndef DISABLE_DKIM
d7bed771 525 CONTROL_DKIM_VERIFY,
3c8b3577 526#endif
3c8b3577 527#ifdef EXPERIMENTAL_DMARC
d7bed771
JH		 528 CONTROL_DMARC_VERIFY,
529 CONTROL_DMARC_FORENSIC,
3c8b3577 530#endif
d7bed771
JH		 531 CONTROL_DSCP,
532 CONTROL_ENFORCE_SYNC,
533 CONTROL_ERROR, /* pseudo-value for decode errors */
534 CONTROL_FAKEDEFER,
535 CONTROL_FAKEREJECT,
536 CONTROL_FREEZE,
4840604e 537
d7bed771
JH		 538 CONTROL_NO_CALLOUT_FLUSH,
539 CONTROL_NO_DELAY_FLUSH,
540 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 541#ifdef WITH_CONTENT_SCAN
d7bed771 542 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 543#endif
d7bed771
JH		 544 CONTROL_NO_MULTILINE,
545 CONTROL_NO_PIPELINING,
8523533c 546
d7bed771
JH		 547 CONTROL_QUEUE_ONLY,
548 CONTROL_SUBMISSION,
549 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 550#ifdef SUPPORT_I18N
d7bed771 551 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 552#endif
d7bed771 553};
3c8b3577 554
4c590bd1 555
c5fcb476 556
d7bed771
JH		 557/* Structure listing various control arguments, with their characteristics.
558For each control, there's a bitmap of dis-allowed times. For some, it is easier
559to specify the negation of a small number of allowed times. */
059ec3d9
PH		 560
561typedef struct control_def {
d7bed771
JH		 562 uschar *name;
563 BOOL has_option; /* Has /option(s) following */
564 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH		 565} control_def;
566
567static control_def controls_list[] = {
d7bed771
JH		 568 { US"allow_auth_unadvertised", FALSE,
569 (unsigned)
570 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
571 },
8523533c 572#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 573 { US"bmi_run", FALSE, 0 },
fb2274d4 574#endif
d7bed771
JH		 575 { US"caseful_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
576 { US"caselower_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
577 { US"cutthrough_delivery", TRUE, 0 },
578 { US"debug", TRUE, 0 },
579
80a47a2c 580#ifndef DISABLE_DKIM
d7bed771
JH		 581 { US"dkim_disable_verify", FALSE,
582 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
583# ifndef DISABLE_PRDR
584 (1<<ACL_WHERE_PRDR)|
585# endif
586 (1<<ACL_WHERE_NOTSMTP_START)
587 },
4840604e 588#endif
d7bed771 589
4840604e 590#ifdef EXPERIMENTAL_DMARC
d7bed771
JH		 591 { US"dmarc_disable_verify", FALSE,
592 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
593 },
594 { US"dmarc_enable_forensic", FALSE,
595 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
596 },
597#endif
598
599 { US"dscp", TRUE,
600 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
601 },
602 { US"enforce_sync", FALSE,
603 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
604 },
605
606 /* Pseudo-value for decode errors */
607 { US"error", FALSE, 0 },
608
609 { US"fakedefer", TRUE,
610 (unsigned)
611 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
612 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
613#ifndef DISABLE_PRDR
614 (1<<ACL_WHERE_PRDR)|
615#endif
616 (1<<ACL_WHERE_MIME))
617 },
618 { US"fakereject", TRUE,
619 (unsigned)
620 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
621 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
622#ifndef DISABLE_PRDR
623 (1<<ACL_WHERE_PRDR)|
624#endif
625 (1<<ACL_WHERE_MIME))
626 },
627 { US"freeze", TRUE,
628 (unsigned)
629 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
630 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
631 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
632 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
633 },
634
635 { US"no_callout_flush", FALSE,
636 (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
637 },
638 { US"no_delay_flush", FALSE,
639 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
640 },
641
642 { US"no_enforce_sync", FALSE,
643 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
644 },
8523533c 645#ifdef WITH_CONTENT_SCAN
d7bed771
JH		 646 { US"no_mbox_unspool", FALSE,
647 (unsigned)
648 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
649 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
650 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
651 (1<<ACL_WHERE_MIME))
652 },
653#endif
654 { US"no_multiline_responses", FALSE,
655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
656 },
657 { US"no_pipelining", FALSE,
658 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
659 },
660
661 { US"queue_only", FALSE,
662 (unsigned)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
664 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
665 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
666 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
667 },
668 { US"submission", TRUE,
669 (unsigned)
670 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
671 },
672 { US"suppress_local_fixups", FALSE,
673 (unsigned)
674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
675 (1<<ACL_WHERE_NOTSMTP_START))
676 },
8c5d388a 677#ifdef SUPPORT_I18N
d7bed771 678 { US"utf8_downconvert", TRUE, 0 }
3c8b3577 679#endif
d7bed771 680};
059ec3d9 681
e5a9dba6
PH		 682/* Support data structures for Client SMTP Authorization. acl_verify_csa()
683caches its result in a tree to avoid repeated DNS queries. The result is an
684integer code which is used as an index into the following tables of
685explanatory strings and verification return codes. */
686
687static tree_node *csa_cache = NULL;
688
689enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
690 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
691
692/* The acl_verify_csa() return code is translated into an acl_verify() return
693code using the following table. It is OK unless the client is definitely not
694authorized. This is because CSA is supposed to be optional for sending sites,
695so recipients should not be too strict about checking it - especially because
696DNS problems are quite likely to occur. It's possible to use $csa_status in
697further ACL conditions to distinguish ok, unknown, and defer if required, but
698the aim is to make the usual configuration simple. */
699
700static int csa_return_code[] = {
701 OK, OK, OK, OK,
702 FAIL, FAIL, FAIL, FAIL
703};
704
705static uschar *csa_status_string[] = {
706 US"unknown", US"ok", US"defer", US"defer",
707 US"fail", US"fail", US"fail", US"fail"
708};
709
710static uschar *csa_reason_string[] = {
711 US"unknown",
712 US"ok",
713 US"deferred (SRV lookup failed)",
714 US"deferred (target address lookup failed)",
715 US"failed (explicit authorization required)",
716 US"failed (host name not authorized)",
717 US"failed (no authorized addresses)",
718 US"failed (client address mismatch)"
719};
720
c99ce5c9
TF		 721/* Options for the ratelimit condition. Note that there are two variants of
722the per_rcpt option, depending on the ACL that is used to measure the rate.
723However any ACL must be able to look up per_rcpt rates in /noupdate mode,
724so the two variants must have the same internal representation as well as
725the same configuration string. */
726
727enum {
728 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
729 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
730};
731
732#define RATE_SET(var,new) \
733 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
734
735static uschar *ratelimit_option_string[] = {
736 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
737 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
738};
739
059ec3d9
PH		 740/* Enable recursion between acl_check_internal() and acl_check_condition() */
741
55414b25 742static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 743 uschar **);
059ec3d9
PH		 744
745
d7bed771
JH		 746/*************************************************
747* Find control in list *
748*************************************************/
749
750/* The lists are always in order, so binary chop can be used.
751
752Arguments:
753 name the control name to search for
754 ol the first entry in the control list
755 last one more than the offset of the last entry in the control list
756
757Returns: index of a control entry, or -1 if not found
758*/
759
760static int
761find_control(const uschar * name, control_def * ol, int last)
762{
763int first = 0;
764while (last > first)
765 {
766 int middle = (first + last)/2;
767 uschar * s = ol[middle].name;
768 int c = Ustrncmp(name, s, Ustrlen(s));
769 if (c == 0) return middle;
770 else if (c > 0) first = middle + 1;
771 else last = middle;
772 }
773return -1;
774}
775
776
777
059ec3d9
PH		 778/*************************************************
779* Pick out name from list *
780*************************************************/
781
782/* Use a binary chop method
783
784Arguments:
785 name name to find
786 list list of names
787 end size of list
788
789Returns: offset in list, or -1 if not found
790*/
791
792static int
793acl_checkname(uschar *name, uschar **list, int end)
794{
795int start = 0;
796
797while (start < end)
798 {
799 int mid = (start + end)/2;
800 int c = Ustrcmp(name, list[mid]);
801 if (c == 0) return mid;
802 if (c < 0) end = mid; else start = mid + 1;
803 }
804
805return -1;
806}
807
808
809/*************************************************
810* Read and parse one ACL *
811*************************************************/
812
813/* This function is called both from readconf in order to parse the ACLs in the
814configuration file, and also when an ACL is encountered dynamically (e.g. as
815the result of an expansion). It is given a function to call in order to
816retrieve the lines of the ACL. This function handles skipping comments and
817blank lines (where relevant).
818
819Arguments:
820 func function to get next line of ACL
821 error where to put an error message
822
823Returns: pointer to ACL, or NULL
824 NULL can be legal (empty ACL); in this case error will be NULL
825*/
826
827acl_block *
828acl_read(uschar *(*func)(void), uschar **error)
829{
830acl_block *yield = NULL;
831acl_block **lastp = &yield;
832acl_block *this = NULL;
833acl_condition_block *cond;
834acl_condition_block **condp = NULL;
835uschar *s;
836
837*error = NULL;
838
839while ((s = (*func)()) != NULL)
840 {
841 int v, c;
842 BOOL negated = FALSE;
843 uschar *saveline = s;
844 uschar name[64];
845
846 /* Conditions (but not verbs) are allowed to be negated by an initial
847 exclamation mark. */
848
849 while (isspace(*s)) s++;
850 if (*s == '!')
851 {
852 negated = TRUE;
853 s++;
854 }
855
cf00dad6
PH		 856 /* Read the name of a verb or a condition, or the start of a new ACL, which
857 can be started by a name, or by a macro definition. */
059ec3d9
PH		 858
859 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 860 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 861
862 /* If a verb is unrecognized, it may be another condition or modifier that
863 continues the previous verb. */
864
865 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
866 if (v < 0)
867 {
868 if (this == NULL)
869 {
4e167a8c
PH		 870 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
871 saveline);
059ec3d9
PH		 872 return NULL;
873 }
874 }
875
876 /* New verb */
877
878 else
879 {
880 if (negated)
881 {
882 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
883 return NULL;
884 }
885 this = store_get(sizeof(acl_block));
886 *lastp = this;
887 lastp = &(this->next);
888 this->next = NULL;
889 this->verb = v;
890 this->condition = NULL;
891 condp = &(this->condition);
892 if (*s == 0) continue; /* No condition on this line */
893 if (*s == '!')
894 {
895 negated = TRUE;
896 s++;
897 }
898 s = readconf_readname(name, sizeof(name), s); /* Condition name */
899 }
900
901 /* Handle a condition or modifier. */
902
903 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
904 if (c < 0)
905 {
906 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
907 saveline);
908 return NULL;
909 }
910
911 /* The modifiers may not be negated */
912
913 if (negated && cond_modifiers[c])
914 {
915 *error = string_sprintf("ACL error: negation is not allowed with "
916 "\"%s\"", conditions[c]);
917 return NULL;
918 }
919
920 /* ENDPASS may occur only with ACCEPT or DISCARD. */
921
922 if (c == ACLC_ENDPASS &&
923 this->verb != ACL_ACCEPT &&
924 this->verb != ACL_DISCARD)
925 {
926 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
927 conditions[c], verbs[this->verb]);
928 return NULL;
929 }
930
931 cond = store_get(sizeof(acl_condition_block));
932 cond->next = NULL;
933 cond->type = c;
934 cond->u.negated = negated;
935
936 *condp = cond;
937 condp = &(cond->next);
938
939 /* The "set" modifier is different in that its argument is "name=value"
940 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 941 gives us a variable name to insert into the data block. The original ACL
942 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
943 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 944 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
945 After that, we allow alphanumerics and underscores, but the first character
946 after c or m must be a digit or an underscore. This retains backwards
947 compatibility. */
059ec3d9
PH		 948
949 if (c == ACLC_SET)
950 {
47ca6d6c
PH		 951 uschar *endptr;
952
38a0a95f
PH		 953 if (Ustrncmp(s, "acl_c", 5) != 0 &&
954 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 955 {
38a0a95f
PH		 956 *error = string_sprintf("invalid variable name after \"set\" in ACL "
957 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
958 return NULL;
47ca6d6c 959 }
38a0a95f
PH		 960
961 endptr = s + 5;
641cb756
PH		 962 if (!isdigit(*endptr) && *endptr != '_')
963 {
964 *error = string_sprintf("invalid variable name after \"set\" in ACL "
965 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
966 s);
967 return NULL;
968 }
969
38a0a95f 970 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 971 {
38a0a95f
PH		 972 if (!isalnum(*endptr) && *endptr != '_')
973 {
974 *error = string_sprintf("invalid character \"%c\" in variable name "
975 "in ACL modifier \"set %s\"", *endptr, s);
976 return NULL;
977 }
978 endptr++;
47ca6d6c 979 }
47ca6d6c 980
38a0a95f 981 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 982 s = endptr;
059ec3d9
PH		 983 while (isspace(*s)) s++;
984 }
985
986 /* For "set", we are now positioned for the data. For the others, only
987 "endpass" has no data */
988
989 if (c != ACLC_ENDPASS)
990 {
991 if (*s++ != '=')
992 {
993 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
994 cond_modifiers[c]? US"modifier" : US"condition");
995 return NULL;
996 }
997 while (isspace(*s)) s++;
998 cond->arg = string_copy(s);
999 }
1000 }
1001
1002return yield;
1003}
1004
1005
1006
71fafd95
PH		 1007/*************************************************
1008* Set up added header line(s) *
1009*************************************************/
1010
1011/* This function is called by the add_header modifier, and also from acl_warn()
1012to implement the now-deprecated way of adding header lines using "message" on a
1013"warn" verb. The argument is treated as a sequence of header lines which are
1014added to a chain, provided there isn't an identical one already there.
1015
1016Argument: string of header lines
1017Returns: nothing
1018*/
1019
1020static void
55414b25 1021setup_header(const uschar *hstring)
71fafd95 1022{
55414b25 1023const uschar *p, *q;
71fafd95
PH		 1024int hlen = Ustrlen(hstring);
1025
b1b05573
JH		 1026/* Ignore any leading newlines */
1027while (*hstring == '\n') hstring++, hlen--;
71fafd95 1028
b1b05573 1029/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1030if (hlen <= 0) return;
96f5fe4c 1031if (hstring[--hlen] != '\n') /* no newline */
55414b25 1032 q = string_sprintf("%s\n", hstring);
96f5fe4c 1033else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 1034 {
1035 uschar * s = string_copy(hstring);
1036 while(s[--hlen] == '\n')
1037 s[hlen+1] = '\0';
1038 q = s;
1039 }
1040else
1041 q = hstring;
71fafd95
PH		 1042
1043/* Loop for multiple header lines, taking care about continuations */
1044
55414b25 1045for (p = q; *p != 0; )
71fafd95 1046 {
55414b25
JH		 1047 const uschar *s;
1048 uschar * hdr;
71fafd95
PH		 1049 int newtype = htype_add_bot;
1050 header_line **hptr = &acl_added_headers;
1051
1052 /* Find next header line within the string */
1053
1054 for (;;)
1055 {
96f5fe4c 1056 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH		 1057 if (*(++q) != ' ' && *q != '\t') break;
1058 }
1059
1060 /* If the line starts with a colon, interpret the instruction for where to
1061 add it. This temporarily sets up a new type. */
1062
1063 if (*p == ':')
1064 {
1065 if (strncmpic(p, US":after_received:", 16) == 0)
1066 {
1067 newtype = htype_add_rec;
1068 p += 16;
1069 }
1070 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1071 {
1072 newtype = htype_add_rfc;
1073 p += 14;
1074 }
1075 else if (strncmpic(p, US":at_start:", 10) == 0)
1076 {
1077 newtype = htype_add_top;
1078 p += 10;
1079 }
1080 else if (strncmpic(p, US":at_end:", 8) == 0)
1081 {
1082 newtype = htype_add_bot;
1083 p += 8;
1084 }
1085 while (*p == ' ' || *p == '\t') p++;
1086 }
1087
1088 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1089 to the front of it. */
1090
1091 for (s = p; s < q - 1; s++)
1092 {
1093 if (*s == ':' || !isgraph(*s)) break;
1094 }
1095
55414b25
JH		 1096 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1097 hlen = Ustrlen(hdr);
71fafd95
PH		 1098
1099 /* See if this line has already been added */
1100
1101 while (*hptr != NULL)
1102 {
55414b25 1103 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1104 hptr = &((*hptr)->next);
1105 }
1106
1107 /* Add if not previously present */
1108
1109 if (*hptr == NULL)
1110 {
1111 header_line *h = store_get(sizeof(header_line));
55414b25 1112 h->text = hdr;
71fafd95
PH		 1113 h->next = NULL;
1114 h->type = newtype;
1115 h->slen = hlen;
1116 *hptr = h;
1117 hptr = &(h->next);
1118 }
1119
1120 /* Advance for next header line within the string */
1121
1122 p = q;
1123 }
1124}
1125
1126
1127
362145b5
JH		 1128/*************************************************
1129* List the added header lines *
1130*************************************************/
1131uschar *
1132fn_hdrs_added(void)
1133{
1134uschar * ret = NULL;
5f5be492
JH		 1135int size = 0;
1136int ptr = 0;
362145b5
JH		 1137header_line * h = acl_added_headers;
1138uschar * s;
1139uschar * cp;
362145b5
JH		 1140
1141if (!h) return NULL;
1142
1143do
1144 {
1145 s = h->text;
1146 while ((cp = Ustrchr(s, '\n')) != NULL)
1147 {
1148 if (cp[1] == '\0') break;
1149
1150 /* contains embedded newline; needs doubling */
c2f669a4
JH		 1151 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1152 ret = string_catn(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1153 s = cp+1;
1154 }
1155 /* last bit of header */
1156
c2f669a4 1157 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
362145b5 1158 }
6d9cfc47 1159while((h = h->next));
362145b5
JH		 1160
1161ret[ptr-1] = '\0'; /* overwrite last newline */
1162return ret;
1163}
1164
1165
e7568d51
TL		 1166/*************************************************
1167* Set up removed header line(s) *
1168*************************************************/
1169
1170/* This function is called by the remove_header modifier. The argument is
1171treated as a sequence of header names which are added to a colon separated
1172list, provided there isn't an identical one already there.
1173
1174Argument: string of header names
1175Returns: nothing
1176*/
1177
1178static void
55414b25 1179setup_remove_header(const uschar *hnames)
e7568d51
TL		 1180{
1181if (*hnames != 0)
55414b25
JH		 1182 acl_removed_headers = acl_removed_headers
1183 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1184 : string_copy(hnames);
e7568d51
TL		 1185}
1186
1187
71fafd95 1188
059ec3d9
PH		 1189/*************************************************
1190* Handle warnings *
1191*************************************************/
1192
1193/* This function is called when a WARN verb's conditions are true. It adds to
1194the message's headers, and/or writes information to the log. In each case, this
1195only happens once (per message for headers, per connection for log).
1196
71fafd95
PH		 1197** NOTE: The header adding action using the "message" setting is historic, and
1198its use is now deprecated. The new add_header modifier should be used instead.
1199
059ec3d9
PH		 1200Arguments:
1201 where ACL_WHERE_xxxx indicating which ACL this is
1202 user_message message for adding to headers
1203 log_message message for logging, if different
1204
1205Returns: nothing
1206*/
1207
1208static void
1209acl_warn(int where, uschar *user_message, uschar *log_message)
1210{
059ec3d9
PH		 1211if (log_message != NULL && log_message != user_message)
1212 {
1213 uschar *text;
1214 string_item *logged;
1215
1216 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1217 string_printing(log_message));
1218
1219 /* If a sender verification has failed, and the log message is "sender verify
1220 failed", add the failure message. */
1221
1222 if (sender_verified_failed != NULL &&
1223 sender_verified_failed->message != NULL &&
1224 strcmpic(log_message, US"sender verify failed") == 0)
1225 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1226
9c7a242c
PH		 1227 /* Search previously logged warnings. They are kept in malloc
1228 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1229
1230 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1231 if (Ustrcmp(logged->text, text) == 0) break;
1232
1233 if (logged == NULL)
1234 {
1235 int length = Ustrlen(text) + 1;
1236 log_write(0, LOG_MAIN, "%s", text);
1237 logged = store_malloc(sizeof(string_item) + length);
1238 logged->text = (uschar *)logged + sizeof(string_item);
1239 memcpy(logged->text, text, length);
1240 logged->next = acl_warn_logged;
1241 acl_warn_logged = logged;
1242 }
1243 }
1244
1245/* If there's no user message, we are done. */
1246
1247if (user_message == NULL) return;
1248
1249/* If this isn't a message ACL, we can't do anything with a user message.
1250Log an error. */
1251
1252if (where > ACL_WHERE_NOTSMTP)
1253 {
1254 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1255 "found in a non-message (%s) ACL: cannot specify header lines here: "
1256 "message ignored", acl_wherenames[where]);
1257 return;
1258 }
1259
71fafd95
PH		 1260/* The code for setting up header lines is now abstracted into a separate
1261function so that it can be used for the add_header modifier as well. */
059ec3d9 1262
71fafd95 1263setup_header(user_message);
059ec3d9
PH		 1264}
1265
1266
1267
1268/*************************************************
1269* Verify and check reverse DNS *
1270*************************************************/
1271
1272/* Called from acl_verify() below. We look up the host name(s) of the client IP
1273address if this has not yet been done. The host_name_lookup() function checks
1274that one of these names resolves to an address list that contains the client IP
1275address, so we don't actually have to do the check here.
1276
1277Arguments:
1278 user_msgptr pointer for user message
1279 log_msgptr pointer for log message
1280
1281Returns: OK verification condition succeeded
1282 FAIL verification failed
1283 DEFER there was a problem verifying
1284*/
1285
1286static int
1287acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1288{
1289int rc;
1290
1291user_msgptr = user_msgptr; /* stop compiler warning */
1292
1293/* Previous success */
1294
1295if (sender_host_name != NULL) return OK;
1296
1297/* Previous failure */
1298
1299if (host_lookup_failed)
1300 {
1301 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1302 return FAIL;
1303 }
1304
1305/* Need to do a lookup */
1306
1307HDEBUG(D_acl)
1308 debug_printf("looking up host name to force name/address consistency check\n");
1309
1310if ((rc = host_name_lookup()) != OK)
1311 {
1312 *log_msgptr = (rc == DEFER)?
1313 US"host lookup deferred for reverse lookup check"
1314 :
1315 string_sprintf("host lookup failed for reverse lookup check%s",
1316 host_lookup_msg);
1317 return rc; /* DEFER or FAIL */
1318 }
1319
1320host_build_sender_fullhost();
1321return OK;
1322}
1323
1324
1325
e5a9dba6
PH		 1326/*************************************************
1327* Check client IP address matches CSA target *
1328*************************************************/
1329
1330/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1331response for address records belonging to the CSA target hostname. The section
1332is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1333If one of the addresses matches the client's IP address, then the client is
1334authorized by CSA. If there are target IP addresses but none of them match
1335then the client is using an unauthorized IP address. If there are no target IP
1336addresses then the client cannot be using an authorized IP address. (This is
1337an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1338
1339Arguments:
1340 dnsa the DNS answer block
1341 dnss a DNS scan block for us to use
1342 reset option specifing what portion to scan, as described above
1343 target the target hostname to use for matching RR names
1344
1345Returns: CSA_OK successfully authorized
1346 CSA_FAIL_MISMATCH addresses found but none matched
1347 CSA_FAIL_NOADDR no target addresses found
1348*/
1349
1350static int
1351acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1352 uschar *target)
1353{
1354dns_record *rr;
1355dns_address *da;
1356
1357BOOL target_found = FALSE;
1358
1359for (rr = dns_next_rr(dnsa, dnss, reset);
1360 rr != NULL;
1361 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1362 {
1363 /* Check this is an address RR for the target hostname. */
1364
1365 if (rr->type != T_A
1366 #if HAVE_IPV6
1367 && rr->type != T_AAAA
e5a9dba6
PH		 1368 #endif
1369 ) continue;
1370
1371 if (strcmpic(target, rr->name) != 0) continue;
1372
1373 target_found = TRUE;
1374
1375 /* Turn the target address RR into a list of textual IP addresses and scan
1376 the list. There may be more than one if it is an A6 RR. */
1377
1378 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1379 {
1380 /* If the client IP address matches the target IP address, it's good! */
1381
1382 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1383
1384 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1385 }
1386 }
1387
1388/* If we found some target addresses but none of them matched, the client is
1389using an unauthorized IP address, otherwise the target has no authorized IP
1390addresses. */
1391
1392if (target_found) return CSA_FAIL_MISMATCH;
1393else return CSA_FAIL_NOADDR;
1394}
1395
1396
1397
1398/*************************************************
1399* Verify Client SMTP Authorization *
1400*************************************************/
1401
1402/* Called from acl_verify() below. This routine calls dns_lookup_special()
1403to find the CSA SRV record corresponding to the domain argument, or
1404$sender_helo_name if no argument is provided. It then checks that the
1405client is authorized, and that its IP address corresponds to the SRV
1406target's address by calling acl_verify_csa_address() above. The address
1407should have been returned in the DNS response's ADDITIONAL section, but if
1408not we perform another DNS lookup to get it.
1409
1410Arguments:
1411 domain pointer to optional parameter following verify = csa
1412
1413Returns: CSA_UNKNOWN no valid CSA record found
1414 CSA_OK successfully authorized
1415 CSA_FAIL_* client is definitely not authorized
1416 CSA_DEFER_* there was a DNS problem
1417*/
1418
1419static int
55414b25 1420acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1421{
1422tree_node *t;
55414b25
JH		 1423const uschar *found;
1424uschar *p;
e5a9dba6
PH		 1425int priority, weight, port;
1426dns_answer dnsa;
1427dns_scan dnss;
1428dns_record *rr;
1429int rc, type;
1430uschar target[256];
1431
1432/* Work out the domain we are using for the CSA lookup. The default is the
1433client's HELO domain. If the client has not said HELO, use its IP address
1434instead. If it's a local client (exim -bs), CSA isn't applicable. */
1435
1436while (isspace(*domain) && *domain != '\0') ++domain;
1437if (*domain == '\0') domain = sender_helo_name;
1438if (domain == NULL) domain = sender_host_address;
1439if (sender_host_address == NULL) return CSA_UNKNOWN;
1440
1441/* If we have an address literal, strip off the framing ready for turning it
1442into a domain. The framing consists of matched square brackets possibly
1443containing a keyword and a colon before the actual IP address. */
1444
1445if (domain[0] == '[')
1446 {
55414b25 1447 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1448 if (start == NULL) start = domain;
1449 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1450 }
1451
1452/* Turn domains that look like bare IP addresses into domains in the reverse
1453DNS. This code also deals with address literals and $sender_host_address. It's
1454not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1455address literals, but it's probably the most friendly thing to do. This is an
1456extension to CSA, so we allow it to be turned off for proper conformance. */
1457
7e66e54d 1458if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1459 {
1460 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1461 dns_build_reverse(domain, target);
1462 domain = target;
1463 }
1464
1465/* Find out if we've already done the CSA check for this domain. If we have,
1466return the same result again. Otherwise build a new cached result structure
1467for this domain. The name is filled in now, and the value is filled in when
1468we return from this function. */
1469
1470t = tree_search(csa_cache, domain);
1471if (t != NULL) return t->data.val;
1472
1473t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1474Ustrcpy(t->name, domain);
1475(void)tree_insertnode(&csa_cache, t);
1476
1477/* Now we are ready to do the actual DNS lookup(s). */
1478
28e6ef29 1479found = domain;
e5a9dba6
PH		 1480switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1481 {
1482 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1483
1484 default:
1485 return t->data.val = CSA_DEFER_SRV;
1486
1487 /* If we found nothing, the client's authorization is unknown. */
1488
1489 case DNS_NOMATCH:
1490 case DNS_NODATA:
1491 return t->data.val = CSA_UNKNOWN;
1492
1493 /* We got something! Go on to look at the reply in more detail. */
1494
1495 case DNS_SUCCEED:
1496 break;
1497 }
1498
1499/* Scan the reply for well-formed CSA SRV records. */
1500
1501for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1502 rr != NULL;
1503 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1504 {
1505 if (rr->type != T_SRV) continue;
1506
1507 /* Extract the numerical SRV fields (p is incremented) */
1508
1509 p = rr->data;
1510 GETSHORT(priority, p);
1511 GETSHORT(weight, p);
1512 GETSHORT(port, p);
1513
1514 DEBUG(D_acl)
1515 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1516
1517 /* Check the CSA version number */
1518
1519 if (priority != 1) continue;
1520
1521 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1522 found by dns_special_lookup() is a parent of the one we asked for), we check
1523 the subdomain assertions in the port field. At the moment there's only one
1524 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1525 SRV records of their own. */
1526
1dc92d5a 1527 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1528 {
1529 if (port & 1)
1530 return t->data.val = CSA_FAIL_EXPLICIT;
1531 else
1532 return t->data.val = CSA_UNKNOWN;
1533 }
1534
1535 /* This CSA SRV record refers directly to our domain, so we check the value
1536 in the weight field to work out the domain's authorization. 0 and 1 are
1537 unauthorized; 3 means the client is authorized but we can't check the IP
1538 address in order to authenticate it, so we treat it as unknown; values
1539 greater than 3 are undefined. */
1540
1541 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1542
1543 if (weight > 2) continue;
1544
1545 /* Weight == 2, which means the domain is authorized. We must check that the
1546 client's IP address is listed as one of the SRV target addresses. Save the
1547 target hostname then break to scan the additional data for its addresses. */
1548
1549 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1550 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1551
1552 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1553
1554 break;
1555 }
1556
1557/* If we didn't break the loop then no appropriate records were found. */
1558
1559if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1560
1561/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1562A target of "." indicates there are no valid addresses, so the client cannot
1563be authorized. (This is an odd configuration because weight=2 target=. is
1564equivalent to weight=1, but we check for it in order to keep load off the
1565root name servers.) Note that dn_expand() turns "." into "". */
1566
1567if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1568
1569/* Scan the additional section of the CSA SRV reply for addresses belonging
1570to the target. If the name server didn't return any additional data (e.g.
1571because it does not fully support SRV records), we need to do another lookup
1572to obtain the target addresses; otherwise we have a definitive result. */
1573
1574rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1575if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1576
1577/* The DNS lookup type corresponds to the IP version used by the client. */
1578
1579#if HAVE_IPV6
1580if (Ustrchr(sender_host_address, ':') != NULL)
1581 type = T_AAAA;
1582else
1583#endif /* HAVE_IPV6 */
1584 type = T_A;
1585
1586
4e0983dc 1587lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1588switch (dns_lookup(&dnsa, target, type, NULL))
1589 {
1590 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1591
1592 default:
cc00f4af 1593 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1594
1595 /* If the query succeeded, scan the addresses and return the result. */
1596
1597 case DNS_SUCCEED:
cc00f4af
JH		 1598 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1599 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1600 /* else fall through */
e5a9dba6
PH		 1601
1602 /* If the target has no IP addresses, the client cannot have an authorized
1603 IP address. However, if the target site uses A6 records (not AAAA records)
1604 we have to do yet another lookup in order to check them. */
1605
1606 case DNS_NOMATCH:
1607 case DNS_NODATA:
cc00f4af 1608 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1609 }
1610}
1611
1612
1613
059ec3d9
PH		 1614/*************************************************
1615* Handle verification (address & other) *
1616*************************************************/
1617
89583014 1618enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1619 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1620 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1621 };
1622typedef struct {
1623 uschar * name;
1624 int value;
1625 unsigned where_allowed; /* bitmap */
1626 BOOL no_options; /* Never has /option(s) following */
1627 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1628 } verify_type_t;
1629static verify_type_t verify_type_list[] = {
7e8360e6 1630 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1631 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1632 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1633 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1634 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1635 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1636 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1637 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1638 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1639 FALSE, 6 },
770747fd
MFM		 1640 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1641 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1642 };
1643
1644
1645enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1646 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1647 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1648 CALLOUT_TIME
1649 };
1650typedef struct {
1651 uschar * name;
1652 int value;
1653 int flag;
1654 BOOL has_option; /* Has =option(s) following */
1655 BOOL timeval; /* Has a time value */
1656 } callout_opt_t;
1657static callout_opt_t callout_opt_list[] = {
1658 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1659 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1660 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1661 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1662 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1663 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1664 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1665 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1666 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1667 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1668 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1669 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1670 };
1671
1672
1673
059ec3d9
PH		 1674/* This function implements the "verify" condition. It is called when
1675encountered in any ACL, because some tests are almost always permitted. Some
1676just don't make sense, and always fail (for example, an attempt to test a host
1677lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1678
1679Arguments:
1680 where where called from
1681 addr the recipient address that the ACL is handling, or NULL
1682 arg the argument of "verify"
1683 user_msgptr pointer for user message
1684 log_msgptr pointer for log message
1685 basic_errno where to put verify errno
1686
1687Returns: OK verification condition succeeded
1688 FAIL verification failed
1689 DEFER there was a problem verifying
1690 ERROR syntax error
1691*/
1692
1693static int
55414b25 1694acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1695 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1696{
1697int sep = '/';
1698int callout = -1;
1699int callout_overall = -1;
4deaf07d 1700int callout_connect = -1;
059ec3d9
PH		 1701int verify_options = 0;
1702int rc;
1703BOOL verify_header_sender = FALSE;
1704BOOL defer_ok = FALSE;
1705BOOL callout_defer_ok = FALSE;
1706BOOL no_details = FALSE;
eafd343b 1707BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1708address_item *sender_vaddr = NULL;
1709uschar *verify_sender_address = NULL;
1710uschar *pm_mailfrom = NULL;
1711uschar *se_mailfrom = NULL;
596875b3
PH		 1712
1713/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1714an error if options are given for items that don't expect them.
596875b3
PH		 1715*/
1716
1717uschar *slash = Ustrchr(arg, '/');
55414b25 1718const uschar *list = arg;
059ec3d9 1719uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1720verify_type_t * vp;
059ec3d9
PH		 1721
1722if (ss == NULL) goto BAD_VERIFY;
1723
1724/* Handle name/address consistency verification in a separate function. */
1725
89583014
JH		 1726for (vp= verify_type_list;
1727 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1728 vp++
1729 )
1730 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1731 : strcmpic (ss, vp->name) == 0)
1732 break;
1733if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1734 goto BAD_VERIFY;
1735
1736if (vp->no_options && slash != NULL)
059ec3d9 1737 {
89583014
JH		 1738 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1739 "(this verify item has no options)", arg);
1740 return ERROR;
059ec3d9 1741 }
89583014 1742if (!(vp->where_allowed & (1<<where)))
059ec3d9 1743 {
89583014
JH		 1744 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1745 return ERROR;
059ec3d9 1746 }
89583014 1747switch(vp->value)
596875b3 1748 {
89583014
JH		 1749 case VERIFY_REV_HOST_LKUP:
1750 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1751 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1752 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1753 if (strcmpic(ss, US"defer_ok") == 0)
1754 return OK;
1755 return rc;
059ec3d9 1756
89583014
JH		 1757 case VERIFY_CERT:
1758 /* TLS certificate verification is done at STARTTLS time; here we just
1759 test whether it was successful or not. (This is for optional verification; for
1760 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1761
3703d818
JH		 1762 if (tls_in.certificate_verified) return OK;
1763 *user_msgptr = US"no verified certificate";
1764 return FAIL;
e5a9dba6 1765
89583014
JH		 1766 case VERIFY_HELO:
1767 /* We can test the result of optional HELO verification that might have
1768 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1769
3703d818
JH		 1770 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1771 return helo_verified? OK : FAIL;
059ec3d9 1772
89583014
JH		 1773 case VERIFY_CSA:
1774 /* Do Client SMTP Authorization checks in a separate function, and turn the
1775 result code into user-friendly strings. */
1c41c9cc 1776
3703d818
JH		 1777 rc = acl_verify_csa(list);
1778 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1779 csa_reason_string[rc]);
3703d818
JH		 1780 csa_status = csa_status_string[rc];
1781 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1782 return csa_return_code[rc];
89583014
JH		 1783
1784 case VERIFY_HDR_SYNTAX:
1785 /* Check that all relevant header lines have the correct syntax. If there is
1786 a syntax error, we return details of the error to the sender if configured to
1787 send out full details. (But a "message" setting on the ACL can override, as
1788 always). */
1789
1790 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1791 if (rc != OK && *log_msgptr)
1792 if (smtp_return_error_details)
1793 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1794 else
1795 acl_verify_message = *log_msgptr;
89583014 1796 return rc;
059ec3d9 1797
770747fd
MFM		 1798 case VERIFY_HDR_NAMES_ASCII:
1799 /* Check that all header names are true 7 bit strings
1800 See RFC 5322, 2.2. and RFC 6532, 3. */
1801
1802 rc = verify_check_header_names_ascii(log_msgptr);
1803 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1804 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1805 return rc;
1806
89583014
JH		 1807 case VERIFY_NOT_BLIND:
1808 /* Check that no recipient of this message is "blind", that is, every envelope
1809 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1810
89583014
JH		 1811 rc = verify_check_notblind();
1812 if (rc != OK)
1813 {
1814 *log_msgptr = string_sprintf("bcc recipient detected");
1815 if (smtp_return_error_details)
1816 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1817 }
1818 return rc;
059ec3d9 1819
89583014
JH		 1820 /* The remaining verification tests check recipient and sender addresses,
1821 either from the envelope or from the header. There are a number of
1822 slash-separated options that are common to all of them. */
059ec3d9 1823
89583014
JH		 1824 case VERIFY_HDR_SNDR:
1825 verify_header_sender = TRUE;
1826 break;
059ec3d9 1827
89583014
JH		 1828 case VERIFY_SNDR:
1829 /* In the case of a sender, this can optionally be followed by an address to use
1830 in place of the actual sender (rare special-case requirement). */
059ec3d9 1831 {
89583014
JH		 1832 uschar *s = ss + 6;
1833 if (*s == 0)
1834 verify_sender_address = sender_address;
1835 else
1836 {
1837 while (isspace(*s)) s++;
1838 if (*s++ != '=') goto BAD_VERIFY;
1839 while (isspace(*s)) s++;
1840 verify_sender_address = string_copy(s);
1841 }
059ec3d9 1842 }
89583014
JH		 1843 break;
1844
1845 case VERIFY_RCPT:
1846 break;
059ec3d9
PH		 1847 }
1848
89583014
JH		 1849
1850
596875b3
PH		 1851/* Remaining items are optional; they apply to sender and recipient
1852verification, including "header sender" verification. */
059ec3d9
PH		 1853
1854while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1855 != NULL)
1856 {
1857 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1858 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1859 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1860
1861 /* These two old options are left for backwards compatibility */
1862
1863 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1864 {
1865 callout_defer_ok = TRUE;
1866 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1867 }
1868
1869 else if (strcmpic(ss, US"check_postmaster") == 0)
1870 {
1871 pm_mailfrom = US"";
1872 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1873 }
1874
1875 /* The callout option has a number of sub-options, comma separated */
1876
1877 else if (strncmpic(ss, US"callout", 7) == 0)
1878 {
1879 callout = CALLOUT_TIMEOUT_DEFAULT;
1880 ss += 7;
1881 if (*ss != 0)
1882 {
1883 while (isspace(*ss)) ss++;
1884 if (*ss++ == '=')
1885 {
55414b25 1886 const uschar * sublist = ss;
059ec3d9
PH		 1887 int optsep = ',';
1888 uschar *opt;
1889 uschar buffer[256];
55414b25 1890 while (isspace(*sublist)) sublist++;
8e669ac1 1891
55414b25 1892 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1893 != NULL)
1894 {
89583014 1895 callout_opt_t * op;
438257ba 1896 double period = 1.0F;
059ec3d9 1897
89583014 1898 for (op= callout_opt_list; op->name; op++)
438257ba 1899 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1900 break;
059ec3d9 1901
89583014
JH		 1902 verify_options |= op->flag;
1903 if (op->has_option)
1904 {
438257ba 1905 opt += Ustrlen(op->name);
4deaf07d
PH		 1906 while (isspace(*opt)) opt++;
1907 if (*opt++ != '=')
1908 {
1909 *log_msgptr = string_sprintf("'=' expected after "
89583014 1910 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1911 return ERROR;
1912 }
1913 while (isspace(*opt)) opt++;
89583014
JH		 1914 }
1915 if (op->timeval)
1916 {
1917 period = readconf_readtime(opt, 0, FALSE);
1918 if (period < 0)
4deaf07d
PH		 1919 {
1920 *log_msgptr = string_sprintf("bad time value in ACL condition "
1921 "\"verify %s\"", arg);
1922 return ERROR;
1923 }
89583014
JH		 1924 }
1925
1926 switch(op->value)
1927 {
1928 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1929 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1930 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1931 case CALLOUT_MAILFROM:
1932 if (!verify_header_sender)
1933 {
1934 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1935 "callout option only for verify=header_sender (detected in ACL "
1936 "condition \"%s\")", arg);
1937 return ERROR;
1938 }
1939 se_mailfrom = string_copy(opt);
1940 break;
1941 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1942 case CALLOUT_MAXWAIT: callout_overall = period; break;
1943 case CALLOUT_CONNECT: callout_connect = period; break;
1944 case CALLOUT_TIME: callout = period; break;
1945 }
059ec3d9
PH		 1946 }
1947 }
1948 else
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1951 "ACL condition \"%s\"", arg);
1952 return ERROR;
1953 }
1954 }
1955 }
1956
1957 /* Option not recognized */
1958
1959 else
1960 {
1961 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1962 "condition \"verify %s\"", ss, arg);
1963 return ERROR;
1964 }
1965 }
1966
1967if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1968 (vopt_callout_recipsender|vopt_callout_recippmaster))
1969 {
1970 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1971 "for a recipient callout";
1972 return ERROR;
1973 }
1974
1975/* Handle sender-in-header verification. Default the user message to the log
1976message if giving out verification details. */
1977
1978if (verify_header_sender)
1979 {
8e669ac1 1980 int verrno;
2f682e45
JH		 1981
1982 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1983 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1984 &verrno)) != OK)
8e669ac1 1985 {
fe5b5d0b
PH		 1986 *basic_errno = verrno;
1987 if (smtp_return_error_details)
1988 {
2f682e45 1989 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH		 1990 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1991 if (rc == DEFER) acl_temp_details = TRUE;
1992 }
8e669ac1 1993 }
059ec3d9
PH		 1994 }
1995
1996/* Handle a sender address. The default is to verify *the* sender address, but
1997optionally a different address can be given, for special requirements. If the
1998address is empty, we are dealing with a bounce message that has no sender, so
1999we cannot do any checking. If the real sender address gets rewritten during
2000verification (e.g. DNS widening), set the flag to stop it being rewritten again
2001during message reception.
2002
2003A list of verified "sender" addresses is kept to try to avoid doing to much
2004work repetitively when there are multiple recipients in a message and they all
2005require sender verification. However, when callouts are involved, it gets too
2006complicated because different recipients may require different callout options.
2007Therefore, we always do a full sender verify when any kind of callout is
2008specified. Caching elsewhere, for instance in the DNS resolver and in the
2009callout handling, should ensure that this is not terribly inefficient. */
2010
2f682e45 2011else if (verify_sender_address)
059ec3d9 2012 {
2f682e45 2013 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH		 2014 {
2015 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2016 "sender verify callout";
2017 return ERROR;
2018 }
2019
2020 sender_vaddr = verify_checked_sender(verify_sender_address);
2021 if (sender_vaddr != NULL && /* Previously checked */
2022 callout <= 0) /* No callout needed this time */
2023 {
2024 /* If the "routed" flag is set, it means that routing worked before, so
2025 this check can give OK (the saved return code value, if set, belongs to a
2026 callout that was done previously). If the "routed" flag is not set, routing
2027 must have failed, so we use the saved return code. */
2028
2f682e45
JH		 2029 if (testflag(sender_vaddr, af_verify_routed))
2030 rc = OK;
2031 else
059ec3d9
PH		 2032 {
2033 rc = sender_vaddr->special_action;
2034 *basic_errno = sender_vaddr->basic_errno;
2035 }
2036 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2037 }
2038
2039 /* Do a new verification, and cache the result. The cache is used to avoid
2040 verifying the sender multiple times for multiple RCPTs when callouts are not
2041 specified (see comments above).
2042
2043 The cache is also used on failure to give details in response to the first
2044 RCPT that gets bounced for this reason. However, this can be suppressed by
2045 the no_details option, which sets the flag that says "this detail has already
2046 been sent". The cache normally contains just one address, but there may be
2047 more in esoteric circumstances. */
2048
2049 else
2050 {
2051 BOOL routed = TRUE;
2a3eea10 2052 uschar *save_address_data = deliver_address_data;
8e669ac1 2053
059ec3d9 2054 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2055#ifdef SUPPORT_I18N
3c8b3577
JH		 2056 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2057 {
2058 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2059 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2060 }
f358d5e0 2061#endif
059ec3d9
PH		 2062 if (no_details) setflag(sender_vaddr, af_sverify_told);
2063 if (verify_sender_address[0] != 0)
2064 {
2065 /* If this is the real sender address, save the unrewritten version
2066 for use later in receive. Otherwise, set a flag so that rewriting the
2067 sender in verify_address() does not update sender_address. */
2068
2069 if (verify_sender_address == sender_address)
2070 sender_address_unrewritten = sender_address;
2071 else
2072 verify_options |= vopt_fake_sender;
2073
eafd343b
TK		 2074 if (success_on_redirect)
2075 verify_options |= vopt_success_on_redirect;
2076
059ec3d9
PH		 2077 /* The recipient, qualify, and expn options are never set in
2078 verify_options. */
2079
2080 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2081 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2082
2083 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2084
2f682e45
JH		 2085 if (rc != OK)
2086 *basic_errno = sender_vaddr->basic_errno;
2087 else
2088 DEBUG(D_acl)
2089 {
2090 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2091 debug_printf("sender %s verified ok as %s\n",
2092 verify_sender_address, sender_vaddr->address);
2093 else
2094 debug_printf("sender %s verified ok\n",
2095 verify_sender_address);
2096 }
059ec3d9 2097 }
2f682e45
JH		 2098 else
2099 rc = OK; /* Null sender */
059ec3d9
PH		 2100
2101 /* Cache the result code */
2102
2103 if (routed) setflag(sender_vaddr, af_verify_routed);
2104 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2105 sender_vaddr->special_action = rc;
2106 sender_vaddr->next = sender_verified_list;
2107 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2108
2109 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2110 the sender verification. */
8e669ac1 2111
2a3eea10 2112 deliver_address_data = save_address_data;
059ec3d9 2113 }
8e669ac1 2114
2a3eea10
PH		 2115 /* Put the sender address_data value into $sender_address_data */
2116
d43cbe25 2117 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2118 }
2119
2120/* A recipient address just gets a straightforward verify; again we must handle
2121the DEFER overrides. */
2122
2123else
2124 {
2125 address_item addr2;
2126
eafd343b
TK		 2127 if (success_on_redirect)
2128 verify_options |= vopt_success_on_redirect;
2129
059ec3d9
PH		 2130 /* We must use a copy of the address for verification, because it might
2131 get rewritten. */
2132
2133 addr2 = *addr;
2134 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2135 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2136 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2137
42855d71 2138 *basic_errno = addr2.basic_errno;
059ec3d9 2139 *log_msgptr = addr2.message;
8e669ac1 2140 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2141 addr2.user_message : addr2.message;
42855d71
PH		 2142
2143 /* Allow details for temporary error if the address is so flagged. */
2144 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2145
2146 /* Make $address_data visible */
d43cbe25 2147 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2148 }
2149
2150/* We have a result from the relevant test. Handle defer overrides first. */
2151
2152if (rc == DEFER && (defer_ok ||
2153 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2154 {
2155 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2156 defer_ok? "defer_ok" : "callout_defer_ok");
2157 rc = OK;
2158 }
2159
2160/* If we've failed a sender, set up a recipient message, and point
2161sender_verified_failed to the address item that actually failed. */
2162
2163if (rc != OK && verify_sender_address != NULL)
2164 {
2165 if (rc != DEFER)
059ec3d9 2166 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2167 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2168 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2169 else
2170 {
2171 *log_msgptr = US"Could not complete sender verify callout";
2172 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2173 *log_msgptr;
2174 }
2175
2176 sender_verified_failed = sender_vaddr;
2177 }
2178
2179/* Verifying an address messes up the values of $domain and $local_part,
2180so reset them before returning if this is a RCPT ACL. */
2181
2182if (addr != NULL)
2183 {
2184 deliver_domain = addr->domain;
2185 deliver_localpart = addr->local_part;
2186 }
2187return rc;
2188
2189/* Syntax errors in the verify argument come here. */
2190
2191BAD_VERIFY:
2192*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2193 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2194 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2195 "\"verify %s\"", arg);
2196return ERROR;
2197}
2198
2199
2200
2201
2202/*************************************************
2203* Check argument for control= modifier *
2204*************************************************/
2205
2206/* Called from acl_check_condition() below
2207
2208Arguments:
2209 arg the argument string for control=
2210 pptr set to point to the terminating character
2211 where which ACL we are in
2212 log_msgptr for error messages
2213
2214Returns: CONTROL_xxx value
2215*/
2216
2217static int
55414b25 2218decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2219{
d7bed771
JH		 2220int idx, len;
2221control_def * d;
059ec3d9 2222
d7bed771
JH		 2223if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2224 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2225 && (!d->has_option || arg[len] != '/')
2226 ) )
059ec3d9
PH		 2227 {
2228 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2229 return CONTROL_ERROR;
2230 }
2231
059ec3d9 2232*pptr = arg + len;
d7bed771 2233return idx;
059ec3d9
PH		 2234}
2235
2236
2237
c99ce5c9
TF		 2238
2239/*************************************************
2240* Return a ratelimit error *
2241*************************************************/
2242
2243/* Called from acl_ratelimit() below
2244
2245Arguments:
2246 log_msgptr for error messages
2247 format format string
2248 ... supplementary arguments
2249 ss ratelimit option name
2250 where ACL_WHERE_xxxx indicating which ACL this is
2251
2252Returns: ERROR
2253*/
2254
2255static int
2256ratelimit_error(uschar **log_msgptr, const char *format, ...)
2257{
2258va_list ap;
2259uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2260va_start(ap, format);
2261if (!string_vformat(buffer, sizeof(buffer), format, ap))
2262 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2263 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2264va_end(ap);
2265*log_msgptr = string_sprintf(
2266 "error in arguments to \"ratelimit\" condition: %s", buffer);
2267return ERROR;
2268}
2269
2270
2271
2272
870f6ba8
TF		 2273/*************************************************
2274* Handle rate limiting *
2275*************************************************/
2276
2277/* Called by acl_check_condition() below to calculate the result
2278of the ACL ratelimit condition.
2279
2280Note that the return value might be slightly unexpected: if the
2281sender's rate is above the limit then the result is OK. This is
2282similar to the dnslists condition, and is so that you can write
2283ACL clauses like: defer ratelimit = 15 / 1h
2284
2285Arguments:
2286 arg the option string for ratelimit=
90fc3069 2287 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2288 log_msgptr for error messages
2289
2290Returns: OK - Sender's rate is above limit
2291 FAIL - Sender's rate is below limit
2292 DEFER - Problem opening ratelimit database
2293 ERROR - Syntax error in options.
2294*/
2295
2296static int
55414b25 2297acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2298{
c99ce5c9 2299double limit, period, count;
8f240103
PH		 2300uschar *ss;
2301uschar *key = NULL;
c99ce5c9 2302uschar *unique = NULL;
870f6ba8 2303int sep = '/';
c99ce5c9
TF		 2304BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2305BOOL noupdate = FALSE, badacl = FALSE;
2306int mode = RATE_PER_WHAT;
870f6ba8
TF		 2307int old_pool, rc;
2308tree_node **anchor, *t;
2309open_db dbblock, *dbm;
c99ce5c9 2310int dbdb_size;
870f6ba8 2311dbdata_ratelimit *dbd;
c99ce5c9 2312dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2313struct timeval tv;
2314
2315/* Parse the first two options and record their values in expansion
2316variables. These variables allow the configuration to have informative
2317error messages based on rate limits obtained from a table lookup. */
2318
c99ce5c9 2319/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2320size, which must be greater than or equal to zero. Zero is useful for
2321rate measurement as opposed to rate limiting. */
2322
2323sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2324if (sender_rate_limit == NULL)
96f5fe4c
JH		 2325 return ratelimit_error(log_msgptr, "sender rate limit not set");
2326
2327limit = Ustrtod(sender_rate_limit, &ss);
2328if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2329else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2330else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2331
c99ce5c9
TF		 2332if (limit < 0.0 || *ss != '\0')
2333 return ratelimit_error(log_msgptr,
2334 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2335
c99ce5c9 2336/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2337constant. This must be strictly greater than zero, because zero leads to
2338run-time division errors. */
2339
2340sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2341if (sender_rate_period == NULL) period = -1.0;
2342else period = readconf_readtime(sender_rate_period, 0, FALSE);
2343if (period <= 0.0)
c99ce5c9
TF		 2344 return ratelimit_error(log_msgptr,
2345 "\"%s\" is not a time value", sender_rate_period);
2346
2347/* By default we are counting one of something, but the per_rcpt,
2348per_byte, and count options can change this. */
2349
2350count = 1.0;
870f6ba8 2351
c99ce5c9 2352/* Parse the other options. */
870f6ba8
TF		 2353
2354while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2355 != NULL)
2356 {
2357 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2358 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2359 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2360 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2361 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2362 else if (strcmpic(ss, US"per_conn") == 0)
2363 {
2364 RATE_SET(mode, PER_CONN);
2365 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2366 badacl = TRUE;
2367 }
2368 else if (strcmpic(ss, US"per_mail") == 0)
2369 {
2370 RATE_SET(mode, PER_MAIL);
2371 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2372 }
2373 else if (strcmpic(ss, US"per_rcpt") == 0)
2374 {
2375 /* If we are running in the RCPT ACL, then we'll count the recipients
2376 one by one, but if we are running when we have accumulated the whole
2377 list then we'll add them all in one batch. */
2378 if (where == ACL_WHERE_RCPT)
2379 RATE_SET(mode, PER_RCPT);
2380 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2381 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2382 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2383 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2384 }
2385 else if (strcmpic(ss, US"per_byte") == 0)
2386 {
2387 /* If we have not yet received the message data and there was no SIZE
2388 declaration on the MAIL comand, then it's safe to just use a value of
2389 zero and let the recorded rate decay as if nothing happened. */
2390 RATE_SET(mode, PER_MAIL);
2391 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2392 else count = message_size < 0 ? 0.0 : (double)message_size;
2393 }
2394 else if (strcmpic(ss, US"per_addr") == 0)
2395 {
2396 RATE_SET(mode, PER_RCPT);
438257ba 2397 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2398 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2399 }
2400 else if (strncmpic(ss, US"count=", 6) == 0)
2401 {
2402 uschar *e;
2403 count = Ustrtod(ss+6, &e);
2404 if (count < 0.0 || *e != '\0')
2405 return ratelimit_error(log_msgptr,
2406 "\"%s\" is not a positive number", ss);
2407 }
2408 else if (strncmpic(ss, US"unique=", 7) == 0)
2409 unique = string_copy(ss + 7);
2410 else if (key == NULL)
2411 key = string_copy(ss);
2412 else
2413 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2414 }
2415
c99ce5c9
TF		 2416/* Sanity check. When the badacl flag is set the update mode must either
2417be readonly (which is the default if it is omitted) or, for backwards
2418compatibility, a combination of noupdate and strict or leaky. */
2419
2420if (mode == RATE_PER_CLASH)
2421 return ratelimit_error(log_msgptr, "conflicting per_* options");
2422if (leaky + strict + readonly > 1)
2423 return ratelimit_error(log_msgptr, "conflicting update modes");
2424if (badacl && (leaky || strict) && !noupdate)
2425 return ratelimit_error(log_msgptr,
2426 "\"%s\" must not have /leaky or /strict option in %s ACL",
2427 ratelimit_option_string[mode], acl_wherenames[where]);
2428
2429/* Set the default values of any unset options. In readonly mode we
2430perform the rate computation without any increment so that its value
2431decays to eventually allow over-limit senders through. */
2432
2433if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2434if (badacl) readonly = TRUE;
2435if (readonly) count = 0.0;
2436if (!strict && !readonly) leaky = TRUE;
2437if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2438
8f240103
PH		 2439/* Create the lookup key. If there is no explicit key, use sender_host_address.
2440If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2441omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2442are added to the key because they alter the meaning of the stored data. */
2443
2444if (key == NULL)
2445 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2446
c99ce5c9 2447key = string_sprintf("%s/%s/%s%s",
8f240103 2448 sender_rate_period,
c99ce5c9
TF		 2449 ratelimit_option_string[mode],
2450 unique == NULL ? "" : "unique/",
8f240103 2451 key);
870f6ba8 2452
c99ce5c9
TF		 2453HDEBUG(D_acl)
2454 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2455
8f240103
PH		 2456/* See if we have already computed the rate by looking in the relevant tree.
2457For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2458pool so that they survive across resets. In readonly mode we only remember the
2459result for the rest of this command in case a later command changes it. After
2460this bit of logic the code is independent of the per_* mode. */
870f6ba8 2461
870f6ba8
TF		 2462old_pool = store_pool;
2463
c99ce5c9
TF		 2464if (readonly)
2465 anchor = &ratelimiters_cmd;
2466else switch(mode) {
2467case RATE_PER_CONN:
870f6ba8
TF		 2468 anchor = &ratelimiters_conn;
2469 store_pool = POOL_PERM;
c99ce5c9
TF		 2470 break;
2471case RATE_PER_BYTE:
2472case RATE_PER_MAIL:
2473case RATE_PER_ALLRCPTS:
870f6ba8 2474 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2475 break;
2476case RATE_PER_ADDR:
2477case RATE_PER_CMD:
2478case RATE_PER_RCPT:
fe0dab11 2479 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2480 break;
2481default:
3399bb60 2482 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2483 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2484 "internal ACL error: unknown ratelimit mode %d", mode);
2485 break;
2486}
870f6ba8 2487
c99ce5c9
TF		 2488t = tree_search(*anchor, key);
2489if (t != NULL)
870f6ba8
TF		 2490 {
2491 dbd = t->data.ptr;
2492 /* The following few lines duplicate some of the code below. */
8f240103 2493 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2494 store_pool = old_pool;
2495 sender_rate = string_sprintf("%.1f", dbd->rate);
2496 HDEBUG(D_acl)
2497 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2498 return rc;
2499 }
2500
c99ce5c9
TF		 2501/* We aren't using a pre-computed rate, so get a previously recorded rate
2502from the database, which will be updated and written back if required. */
870f6ba8
TF		 2503
2504dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2505if (dbm == NULL)
2506 {
2507 store_pool = old_pool;
2508 sender_rate = NULL;
2509 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2510 *log_msgptr = US"ratelimit database not available";
2511 return DEFER;
2512 }
c99ce5c9
TF		 2513dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2514dbd = NULL;
870f6ba8
TF		 2515
2516gettimeofday(&tv, NULL);
2517
c99ce5c9
TF		 2518if (dbdb != NULL)
2519 {
2520 /* Locate the basic ratelimit block inside the DB data. */
2521 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2522 dbd = &dbdb->dbd;
2523
2524 /* Forget the old Bloom filter if it is too old, so that we count each
2525 repeating event once per period. We don't simply clear and re-use the old
2526 filter because we want its size to change if the limit changes. Note that
2527 we keep the dbd pointer for copying the rate into the new data block. */
2528
2529 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2530 {
2531 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2532 dbdb = NULL;
2533 }
2534
2535 /* Sanity check. */
2536
2537 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2538 {
2539 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2540 dbdb = NULL;
2541 }
2542 }
2543
2544/* Allocate a new data block if the database lookup failed
2545or the Bloom filter passed its age limit. */
2546
2547if (dbdb == NULL)
2548 {
2549 if (unique == NULL)
2550 {
2551 /* No Bloom filter. This basic ratelimit block is initialized below. */
2552 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2553 dbdb_size = sizeof(*dbd);
2554 dbdb = store_get(dbdb_size);
2555 }
2556 else
2557 {
2558 int extra;
2559 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2560
2561 /* See the long comment below for an explanation of the magic number 2.
2562 The filter has a minimum size in case the rate limit is very small;
2563 this is determined by the definition of dbdata_ratelimit_unique. */
2564
2565 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2566 if (extra < 0) extra = 0;
2567 dbdb_size = sizeof(*dbdb) + extra;
2568 dbdb = store_get(dbdb_size);
2569 dbdb->bloom_epoch = tv.tv_sec;
2570 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2571 memset(dbdb->bloom, 0, dbdb->bloom_size);
2572
2573 /* Preserve any basic ratelimit data (which is our longer-term memory)
2574 by copying it from the discarded block. */
2575
2576 if (dbd != NULL)
2577 {
2578 dbdb->dbd = *dbd;
2579 dbd = &dbdb->dbd;
2580 }
2581 }
2582 }
2583
2584/* If we are counting unique events, find out if this event is new or not.
2585If the client repeats the event during the current period then it should be
2586counted. We skip this code in readonly mode for efficiency, because any
2587changes to the filter will be discarded and because count is already set to
2588zero. */
2589
2590if (unique != NULL && !readonly)
2591 {
2592 /* We identify unique events using a Bloom filter. (You can find my
2593 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2594 With the per_addr option, an "event" is a recipient address, though the
2595 user can use the unique option to define their own events. We only count
2596 an event if we have not seen it before.
2597
2598 We size the filter according to the rate limit, which (in leaky mode)
2599 is the limit on the population of the filter. We allow 16 bits of space
2600 per entry (see the construction code above) and we set (up to) 8 of them
2601 when inserting an element (see the loop below). The probability of a false
2602 positive (an event we have not seen before but which we fail to count) is
2603
2604 size = limit * 16
2605 numhash = 8
2606 allzero = exp(-numhash * pop / size)
2607 = exp(-0.5 * pop / limit)
2608 fpr = pow(1 - allzero, numhash)
2609
2610 For senders at the limit the fpr is 0.06% or 1 in 1700
2611 and for senders at half the limit it is 0.0006% or 1 in 170000
2612
2613 In strict mode the Bloom filter can fill up beyond the normal limit, in
2614 which case the false positive rate will rise. This means that the
2615 measured rate for very fast senders can bogusly drop off after a while.
2616
2617 At twice the limit, the fpr is 2.5% or 1 in 40
2618 At four times the limit, it is 31% or 1 in 3.2
2619
2620 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2621 decay below the limit, and if this is more than one then the Bloom filter
2622 will be discarded before the decay gets that far. The false positive rate
2623 at this threshold is 9.3% or 1 in 10.7. */
2624
2625 BOOL seen;
2626 unsigned n, hash, hinc;
2627 uschar md5sum[16];
2628 md5 md5info;
2629
2630 /* Instead of using eight independent hash values, we combine two values
2631 using the formula h1 + n * h2. This does not harm the Bloom filter's
2632 performance, and means the amount of hash we need is independent of the
2633 number of bits we set in the filter. */
2634
2635 md5_start(&md5info);
2636 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2637 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2638 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2639
2640 /* Scan the bits corresponding to this event. A zero bit means we have
2641 not seen it before. Ensure all bits are set to record this event. */
2642
2643 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2644
2645 seen = TRUE;
2646 for (n = 0; n < 8; n++, hash += hinc)
2647 {
2648 int bit = 1 << (hash % 8);
2649 int byte = (hash / 8) % dbdb->bloom_size;
2650 if ((dbdb->bloom[byte] & bit) == 0)
2651 {
2652 dbdb->bloom[byte] |= bit;
2653 seen = FALSE;
2654 }
2655 }
2656
2657 /* If this event has occurred before, do not count it. */
2658
2659 if (seen)
2660 {
2661 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2662 count = 0.0;
2663 }
2664 else
2665 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2666 }
2667
2668/* If there was no previous ratelimit data block for this key, initialize
2669the new one, otherwise update the block from the database. The initial rate
2670is what would be computed by the code below for an infinite interval. */
2671
870f6ba8
TF		 2672if (dbd == NULL)
2673 {
c99ce5c9
TF		 2674 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2675 dbd = &dbdb->dbd;
870f6ba8
TF		 2676 dbd->time_stamp = tv.tv_sec;
2677 dbd->time_usec = tv.tv_usec;
c99ce5c9 2678 dbd->rate = count;
870f6ba8
TF		 2679 }
2680else
2681 {
2682 /* The smoothed rate is computed using an exponentially weighted moving
2683 average adjusted for variable sampling intervals. The standard EWMA for
2684 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2685 where f() is the measured value and f'() is the smoothed value.
2686
2687 Old data decays out of the smoothed value exponentially, such that data n
2688 samples old is multiplied by a^n. The exponential decay time constant p
2689 is defined such that data p samples old is multiplied by 1/e, which means
2690 that a = exp(-1/p). We can maintain the same time constant for a variable
2691 sampling interval i by using a = exp(-i/p).
2692
2693 The rate we are measuring is messages per period, suitable for directly
2694 comparing with the limit. The average rate between now and the previous
2695 message is period / interval, which we feed into the EWMA as the sample.
2696
2697 It turns out that the number of messages required for the smoothed rate
2698 to reach the limit when they are sent in a burst is equal to the limit.
2699 This can be seen by analysing the value of the smoothed rate after N
2700 messages sent at even intervals. Let k = (1 - a) * p/i
2701
2702 rate_1 = (1 - a) * p/i + a * rate_0
2703 = k + a * rate_0
2704 rate_2 = k + a * rate_1
2705 = k + a * k + a^2 * rate_0
2706 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2707 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2708 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2709 = rate_0 * a^N + p/i * (1 - a^N)
2710
2711 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2712
2713 rate_N = p/i + (rate_0 - p/i) * a^N
2714 a^N = (rate_N - p/i) / (rate_0 - p/i)
2715 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2716 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2717
2718 Numerical analysis of the above equation, setting the computed rate to
2719 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2720 rates, p/i, the number of messages N = limit. So limit serves as both the
2721 maximum rate measured in messages per period, and the maximum number of
2722 messages that can be sent in a fast burst. */
2723
2724 double this_time = (double)tv.tv_sec
2725 + (double)tv.tv_usec / 1000000.0;
2726 double prev_time = (double)dbd->time_stamp
2727 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2728
2729 /* We must avoid division by zero, and deal gracefully with the clock going
2730 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2731 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2732
e5d5a95f
TF		 2733 double interval = this_time - prev_time <= 0.0 ? 1e-9
2734 : this_time - prev_time;
2735
2736 double i_over_p = interval / period;
2737 double a = exp(-i_over_p);
870f6ba8 2738
c99ce5c9
TF		 2739 /* Combine the instantaneous rate (period / interval) with the previous rate
2740 using the smoothing factor a. In order to measure sized events, multiply the
2741 instantaneous rate by the count of bytes or recipients etc. */
2742
870f6ba8
TF		 2743 dbd->time_stamp = tv.tv_sec;
2744 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2745 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2746
2747 /* When events are very widely spaced the computed rate tends towards zero.
2748 Although this is accurate it turns out not to be useful for our purposes,
2749 especially when the first event after a long silence is the start of a spam
2750 run. A more useful model is that the rate for an isolated event should be the
2751 size of the event per the period size, ignoring the lack of events outside
2752 the current period and regardless of where the event falls in the period. So,
2753 if the interval was so long that the calculated rate is unhelpfully small, we
2754 re-intialize the rate. In the absence of higher-rate bursts, the condition
2755 below is true if the interval is greater than the period. */
2756
2757 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2758 }
2759
c99ce5c9
TF		 2760/* Clients sending at the limit are considered to be over the limit.
2761This matters for edge cases such as a limit of zero, when the client
2762should be completely blocked. */
3348576f 2763
8f240103 2764rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2765
2766/* Update the state if the rate is low or if we are being strict. If we
2767are in leaky mode and the sender's rate is too high, we do not update
2768the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2769rate preventing them from getting any email through. If readonly is set,
2770neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2771
c99ce5c9 2772if ((rc == FAIL && leaky) || strict)
8f240103 2773 {
c99ce5c9 2774 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2775 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2776 }
2777else
2778 {
2779 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2780 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2781 }
2782
870f6ba8
TF		 2783dbfn_close(dbm);
2784
c99ce5c9 2785/* Store the result in the tree for future reference. */
870f6ba8 2786
c99ce5c9
TF		 2787t = store_get(sizeof(tree_node) + Ustrlen(key));
2788t->data.ptr = dbd;
2789Ustrcpy(t->name, key);
2790(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2791
2792/* We create the formatted version of the sender's rate very late in
2793order to ensure that it is done using the correct storage pool. */
2794
2795store_pool = old_pool;
2796sender_rate = string_sprintf("%.1f", dbd->rate);
2797
2798HDEBUG(D_acl)
2799 debug_printf("ratelimit computed rate %s\n", sender_rate);
2800
2801return rc;
2802}
2803
2804
2805
b0019c78
TF		 2806/*************************************************
2807* The udpsend ACL modifier *
2808*************************************************/
2809
2810/* Called by acl_check_condition() below.
2811
2812Arguments:
2813 arg the option string for udpsend=
2814 log_msgptr for error messages
2815
2816Returns: OK - Completed.
2817 DEFER - Problem with DNS lookup.
2818 ERROR - Syntax error in options.
2819*/
2820
2821static int
55414b25 2822acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2823{
2824int sep = 0;
2825uschar *hostname;
2826uschar *portstr;
2827uschar *portend;
2828host_item *h;
2829int portnum;
b0019c78
TF		 2830int len;
2831int r, s;
b1f8e4f8 2832uschar * errstr;
b0019c78
TF		 2833
2834hostname = string_nextinlist(&arg, &sep, NULL, 0);
2835portstr = string_nextinlist(&arg, &sep, NULL, 0);
2836
2837if (hostname == NULL)
2838 {
217b0e56 2839 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2840 return ERROR;
2841 }
2842if (portstr == NULL)
2843 {
217b0e56 2844 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2845 return ERROR;
2846 }
2847if (arg == NULL)
2848 {
217b0e56 2849 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2850 return ERROR;
2851 }
2852portnum = Ustrtol(portstr, &portend, 10);
2853if (*portend != '\0')
2854 {
217b0e56 2855 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2856 return ERROR;
2857 }
2858
2859/* Make a single-item host list. */
2860h = store_get(sizeof(host_item));
2861memset(h, 0, sizeof(host_item));
2862h->name = hostname;
2863h->port = portnum;
2864h->mx = MX_NONE;
2865
2866if (string_is_ip_address(hostname, NULL))
2867 h->address = hostname, r = HOST_FOUND;
2868else
2869 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2870if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2871 {
217b0e56 2872 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2873 return DEFER;
2874 }
2875
2876HDEBUG(D_acl)
2877 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2878
b1f8e4f8
JH		 2879r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2880 1, NULL, &errstr);
b0019c78 2881if (r < 0) goto defer;
27f9999e 2882len = Ustrlen(arg);
9cb1785a 2883r = send(s, arg, len, 0);
b1f8e4f8
JH		 2884if (r < 0)
2885 {
2886 errstr = US strerror(errno);
2887 close(s);
2888 goto defer;
2889 }
2890close(s);
b0019c78
TF		 2891if (r < len)
2892 {
2893 *log_msgptr =
2894 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2895 return DEFER;
2896 }
2897
2898HDEBUG(D_acl)
2899 debug_printf("udpsend %d bytes\n", r);
2900
2901return OK;
2902
2903defer:
b1f8e4f8 2904*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2905return DEFER;
2906}
2907
2908
2909
059ec3d9
PH		 2910/*************************************************
2911* Handle conditions/modifiers on an ACL item *
2912*************************************************/
2913
2914/* Called from acl_check() below.
2915
2916Arguments:
2917 verb ACL verb
2918 cb ACL condition block - if NULL, result is OK
2919 where where called from
2920 addr the address being checked for RCPT, or NULL
2921 level the nesting level
2922 epp pointer to pass back TRUE if "endpass" encountered
2923 (applies only to "accept" and "discard")
2924 user_msgptr user message pointer
2925 log_msgptr log message pointer
2926 basic_errno pointer to where to put verify error
2927
2928Returns: OK - all conditions are met
2929 DISCARD - an "acl" condition returned DISCARD - only allowed
2930 for "accept" or "discard" verbs
2931 FAIL - at least one condition fails
2932 FAIL_DROP - an "acl" condition returned FAIL_DROP
2933 DEFER - can't tell at the moment (typically, lookup defer,
2934 but can be temporary callout problem)
2935 ERROR - ERROR from nested ACL or expansion failure or other
2936 error
2937*/
2938
2939static int
2940acl_check_condition(int verb, acl_condition_block *cb, int where,
2941 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2942 uschar **log_msgptr, int *basic_errno)
2943{
2944uschar *user_message = NULL;
2945uschar *log_message = NULL;
059ec3d9 2946int rc = OK;
8523533c 2947#ifdef WITH_CONTENT_SCAN
0f0c8159 2948int sep = -'/';
8523533c 2949#endif
059ec3d9
PH		 2950
2951for (; cb != NULL; cb = cb->next)
2952 {
55414b25 2953 const uschar *arg;
8e669ac1 2954 int control_type;
059ec3d9
PH		 2955
2956 /* The message and log_message items set up messages to be used in
2957 case of rejection. They are expanded later. */
2958
2959 if (cb->type == ACLC_MESSAGE)
2960 {
187bc588 2961 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 2962 user_message = cb->arg;
2963 continue;
2964 }
2965
2966 if (cb->type == ACLC_LOG_MESSAGE)
2967 {
187bc588 2968 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 2969 log_message = cb->arg;
2970 continue;
2971 }
2972
2973 /* The endpass "condition" just sets a flag to show it occurred. This is
2974 checked at compile time to be on an "accept" or "discard" item. */
2975
2976 if (cb->type == ACLC_ENDPASS)
2977 {
2978 *epp = TRUE;
2979 continue;
2980 }
2981
2982 /* For other conditions and modifiers, the argument is expanded now for some
2983 of them, but not for all, because expansion happens down in some lower level
2984 checking functions in some cases. */
2985
2986 if (cond_expand_at_top[cb->type])
2987 {
2988 arg = expand_string(cb->arg);
2989 if (arg == NULL)
2990 {
2991 if (expand_string_forcedfail) continue;
2992 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2993 cb->arg, expand_string_message);
2994 return search_find_defer? DEFER : ERROR;
2995 }
2996 }
2997 else arg = cb->arg;
2998
2999 /* Show condition, and expanded condition if it's different */
3000
3001 HDEBUG(D_acl)
3002 {
3003 int lhswidth = 0;
3004 debug_printf("check %s%s %n",
3005 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3006 conditions[cb->type], &lhswidth);
3007
3008 if (cb->type == ACLC_SET)
3009 {
38a0a95f
PH		 3010 debug_printf("acl_%s ", cb->u.varname);
3011 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3012 }
3013
3014 debug_printf("= %s\n", cb->arg);
3015
3016 if (arg != cb->arg)
3017 debug_printf("%.*s= %s\n", lhswidth,
3018 US" ", CS arg);
3019 }
3020
3021 /* Check that this condition makes sense at this time */
3022
3023 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3024 {
3025 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3026 cond_modifiers[cb->type]? "use" : "test",
3027 conditions[cb->type], acl_wherenames[where]);
3028 return ERROR;
3029 }
3030
3031 /* Run the appropriate test for each condition, or take the appropriate
3032 action for the remaining modifiers. */
3033
3034 switch(cb->type)
3035 {
71fafd95
PH		 3036 case ACLC_ADD_HEADER:
3037 setup_header(arg);
3038 break;
3039
059ec3d9
PH		 3040 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3041 "discard" verb. */
71fafd95 3042
059ec3d9 3043 case ACLC_ACL:
f60d98e8 3044 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3045 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3046 {
3047 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3048 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3049 verbs[verb]);
3050 return ERROR;
3051 }
059ec3d9
PH		 3052 break;
3053
3054 case ACLC_AUTHENTICATED:
3055 rc = (sender_host_authenticated == NULL)? FAIL :
3056 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3057 TRUE, NULL);
3058 break;
3059
71fafd95 3060 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3061 case ACLC_BMI_OPTIN:
3062 {
3063 int old_pool = store_pool;
3064 store_pool = POOL_PERM;
3065 bmi_current_optin = string_copy(arg);
3066 store_pool = old_pool;
3067 }
3068 break;
71fafd95 3069 #endif
8523533c 3070
059ec3d9 3071 case ACLC_CONDITION:
f3766eb5
NM		 3072 /* The true/false parsing here should be kept in sync with that used in
3073 expand.c when dealing with ECOND_BOOL so that we don't have too many
3074 different definitions of what can be a boolean. */
51c7471d
JH		 3075 if (*arg == '-'
3076 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3077 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3078 rc = (Uatoi(arg) == 0)? FAIL : OK;
3079 else
3080 rc = (strcmpic(arg, US"no") == 0 ||
3081 strcmpic(arg, US"false") == 0)? FAIL :
3082 (strcmpic(arg, US"yes") == 0 ||
3083 strcmpic(arg, US"true") == 0)? OK : DEFER;
3084 if (rc == DEFER)
3085 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3086 break;
3087
c3611384
PH		 3088 case ACLC_CONTINUE: /* Always succeeds */
3089 break;
3090
059ec3d9 3091 case ACLC_CONTROL:
c5fcb476 3092 {
55414b25
JH		 3093 const uschar *p = NULL;
3094 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3095
55414b25 3096 /* Check if this control makes sense at this time */
f7572e5a 3097
d7bed771 3098 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH		 3099 {
3100 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3101 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH		 3102 return ERROR;
3103 }
8800895a 3104
55414b25
JH		 3105 switch(control_type)
3106 {
3107 case CONTROL_AUTH_UNADVERTISED:
3108 allow_auth_unadvertised = TRUE;
3109 break;
3110
3111 #ifdef EXPERIMENTAL_BRIGHTMAIL
3112 case CONTROL_BMI_RUN:
3113 bmi_run = 1;
3114 break;
3115 #endif
3116
3117 #ifndef DISABLE_DKIM
3118 case CONTROL_DKIM_VERIFY:
3119 dkim_disable_verify = TRUE;
3120 #ifdef EXPERIMENTAL_DMARC
3121 /* Since DKIM was blocked, skip DMARC too */
3122 dmarc_disable_verify = TRUE;
3123 dmarc_enable_forensic = FALSE;
3124 #endif
3125 break;
3126 #endif
3127
3128 #ifdef EXPERIMENTAL_DMARC
3129 case CONTROL_DMARC_VERIFY:
3130 dmarc_disable_verify = TRUE;
3131 break;
3132
3133 case CONTROL_DMARC_FORENSIC:
3134 dmarc_enable_forensic = TRUE;
3135 break;
3136 #endif
3137
3138 case CONTROL_DSCP:
3139 if (*p == '/')
3140 {
3141 int fd, af, level, optname, value;
3142 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3143 a socket; we can accept that, we'll just debug-log failures anyway. */
3144 fd = fileno(smtp_in);
3145 af = ip_get_address_family(fd);
3146 if (af < 0)
3147 {
3148 HDEBUG(D_acl)
3149 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3150 strerror(errno));
3151 break;
3152 }
3153 if (dscp_lookup(p+1, af, &level, &optname, &value))
3154 {
3155 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3156 {
3157 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3158 p+1, strerror(errno));
3159 }
3160 else
3161 {
3162 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3163 }
3164 }
3165 else
3166 {
3167 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3168 return ERROR;
3169 }
3170 }
3171 else
3172 {
3173 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3174 return ERROR;
3175 }
3176 break;
3177
3178 case CONTROL_ERROR:
3179 return ERROR;
3180
3181 case CONTROL_CASEFUL_LOCAL_PART:
3182 deliver_localpart = addr->cc_local_part;
3183 break;
3184
3185 case CONTROL_CASELOWER_LOCAL_PART:
3186 deliver_localpart = addr->lc_local_part;
3187 break;
3188
3189 case CONTROL_ENFORCE_SYNC:
3190 smtp_enforce_sync = TRUE;
3191 break;
3192
3193 case CONTROL_NO_ENFORCE_SYNC:
3194 smtp_enforce_sync = FALSE;
3195 break;
3196
3197 #ifdef WITH_CONTENT_SCAN
3198 case CONTROL_NO_MBOX_UNSPOOL:
3199 no_mbox_unspool = TRUE;
3200 break;
3201 #endif
3202
3203 case CONTROL_NO_MULTILINE:
3204 no_multiline_responses = TRUE;
3205 break;
3206
3207 case CONTROL_NO_PIPELINING:
3208 pipelining_enable = FALSE;
3209 break;
3210
3211 case CONTROL_NO_DELAY_FLUSH:
3212 disable_delay_flush = TRUE;
3213 break;
3214
3215 case CONTROL_NO_CALLOUT_FLUSH:
3216 disable_callout_flush = TRUE;
3217 break;
3218
3219 case CONTROL_FAKEREJECT:
3220 cancel_cutthrough_connection("fakereject");
3221 case CONTROL_FAKEDEFER:
3222 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3223 if (*p == '/')
3224 {
3225 const uschar *pp = p + 1;
3226 while (*pp != 0) pp++;
3227 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3228 p = pp;
3229 }
3230 else
3231 {
3232 /* Explicitly reset to default string */
3233 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3234 }
3235 break;
ed7f7860 3236
55414b25
JH		 3237 case CONTROL_FREEZE:
3238 deliver_freeze = TRUE;
3239 deliver_frozen_at = time(NULL);
3240 freeze_tell = freeze_tell_config; /* Reset to configured value */
3241 if (Ustrncmp(p, "/no_tell", 8) == 0)
3242 {
3243 p += 8;
3244 freeze_tell = NULL;
3245 }
3246 if (*p != 0)
3247 {
3248 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3249 return ERROR;
3250 }
3251 cancel_cutthrough_connection("item frozen");
3252 break;
3253
3254 case CONTROL_QUEUE_ONLY:
3255 queue_only_policy = TRUE;
3256 cancel_cutthrough_connection("queueing forced");
3257 break;
3258
3259 case CONTROL_SUBMISSION:
3260 originator_name = US"";
3261 submission_mode = TRUE;
3262 while (*p == '/')
3263 {
3264 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3265 {
3266 p += 14;
3267 active_local_sender_retain = TRUE;
3268 active_local_from_check = FALSE;
3269 }
3270 else if (Ustrncmp(p, "/domain=", 8) == 0)
3271 {
3272 const uschar *pp = p + 8;
3273 while (*pp != 0 && *pp != '/') pp++;
3274 submission_domain = string_copyn(p+8, pp-p-8);
3275 p = pp;
3276 }
3277 /* The name= option must be last, because it swallows the rest of
3278 the string. */
3279 else if (Ustrncmp(p, "/name=", 6) == 0)
3280 {
3281 const uschar *pp = p + 6;
3282 while (*pp != 0) pp++;
3283 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3284 big_buffer, big_buffer_size));
3285 p = pp;
3286 }
3287 else break;
3288 }
3289 if (*p != 0)
3290 {
3291 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3292 return ERROR;
3293 }
3294 break;
e4bdf652 3295
55414b25 3296 case CONTROL_DEBUG:
55414b25 3297 {
b0d68adc
JH		 3298 uschar * debug_tag = NULL;
3299 uschar * debug_opts = NULL;
3300 BOOL kill = FALSE;
3301
3302 while (*p == '/')
55414b25 3303 {
b0d68adc
JH		 3304 const uschar * pp = p+1;
3305 if (Ustrncmp(pp, "tag=", 4) == 0)
3306 {
3307 for (pp += 4; *pp && *pp != '/';) pp++;
3308 debug_tag = string_copyn(p+5, pp-p-5);
3309 }
3310 else if (Ustrncmp(pp, "opts=", 5) == 0)
3311 {
3312 for (pp += 5; *pp && *pp != '/';) pp++;
3313 debug_opts = string_copyn(p+6, pp-p-6);
3314 }
3315 else if (Ustrncmp(pp, "kill", 4) == 0)
3316 {
3317 for (pp += 4; *pp && *pp != '/';) pp++;
3318 kill = TRUE;
3319 }
3320 else
3321 while (*pp && *pp != '/') pp++;
55414b25
JH		 3322 p = pp;
3323 }
b0d68adc
JH		 3324
3325 if (kill)
3326 debug_logging_stop();
3327 else
3328 debug_logging_activate(debug_tag, debug_opts);
55414b25 3329 }
55414b25
JH		 3330 break;
3331
3332 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3333 suppress_local_fixups = TRUE;
3334 break;
3335
3336 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3337#ifndef DISABLE_PRDR
55414b25 3338 if (prdr_requested)
a2b89db1
PP		 3339#else
3340 if (0)
3341#endif
55414b25
JH		 3342 /* Too hard to think about for now. We might in future cutthrough
3343 the case where both sides handle prdr and this-node prdr acl
3344 is "accept" */
93a6fce2 3345 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3346 else
3347 {
55414b25
JH		 3348 if (deliver_freeze)
3349 *log_msgptr = US"frozen";
3350 else if (queue_only_policy)
3351 *log_msgptr = US"queue-only";
3352 else if (fake_response == FAIL)
3353 *log_msgptr = US"fakereject";
3354 else
3355 {
ff5929e3
JH		 3356 if (rcpt_count == 1)
3357 {
3358 cutthrough.delivery = TRUE;
3359 while (*p == '/')
3360 {
3361 const uschar * pp = p+1;
3362 if (Ustrncmp(pp, "defer=", 6) == 0)
3363 {
3364 pp += 6;
3365 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3366 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3367 }
3368 else
3369 while (*pp && *pp != '/') pp++;
3370 p = pp;
3371 }
3372 }
55414b25
JH		 3373 break;
3374 }
3375 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3376 arg, *log_msgptr);
5032d1cf 3377 }
55414b25 3378 return ERROR;
3c8b3577 3379
8c5d388a 3380#ifdef SUPPORT_I18N
3c8b3577
JH		 3381 case CONTROL_UTF8_DOWNCONVERT:
3382 if (*p == '/')
3383 {
921dfc11
JH		 3384 if (p[1] == '1')
3385 {
3386 message_utf8_downconvert = 1;
3387 addr->prop.utf8_downcvt = TRUE;
3388 addr->prop.utf8_downcvt_maybe = FALSE;
3389 p += 2;
3390 break;
3391 }
3392 if (p[1] == '0')
3393 {
3394 message_utf8_downconvert = 0;
3395 addr->prop.utf8_downcvt = FALSE;
3396 addr->prop.utf8_downcvt_maybe = FALSE;
3397 p += 2;
3398 break;
3399 }
3c8b3577 3400 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3401 {
3402 message_utf8_downconvert = -1;
3403 addr->prop.utf8_downcvt = FALSE;
3404 addr->prop.utf8_downcvt_maybe = TRUE;
3405 p += 3;
3406 break;
3407 }
3c8b3577
JH		 3408 *log_msgptr = US"bad option value for control=utf8_downconvert";
3409 }
3410 else
3411 {
921dfc11
JH		 3412 message_utf8_downconvert = 1;
3413 addr->prop.utf8_downcvt = TRUE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 break;
3c8b3577
JH		 3416 }
3417 return ERROR;
8c5d388a 3418#endif
3c8b3577 3419
9171d434 3420 }
55414b25 3421 break;
059ec3d9 3422 }
059ec3d9 3423
6a8f9482
TK		 3424 #ifdef EXPERIMENTAL_DCC
3425 case ACLC_DCC:
3426 {
3427 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3428 const uschar * list = arg;
3429 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3430 /* Run the dcc backend. */
3431 rc = dcc_process(&ss);
3432 /* Modify return code based upon the existance of options. */
3c8b3577 3433 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3434 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3435 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3436 }
3437 break;
3438 #endif
3439
71fafd95 3440 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3441 case ACLC_DECODE:
3442 rc = mime_decode(&arg);
3443 break;
71fafd95 3444 #endif
8523533c 3445
059ec3d9
PH		 3446 case ACLC_DELAY:
3447 {
3448 int delay = readconf_readtime(arg, 0, FALSE);
3449 if (delay < 0)
3450 {
3451 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3452 "modifier: \"%s\" is not a time value", arg);
3453 return ERROR;
3454 }
3455 else
3456 {
3457 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3458 delay);
3459 if (host_checking)
3460 {
3461 HDEBUG(D_acl)
3462 debug_printf("delay skipped in -bh checking mode\n");
3463 }
010c2d14 3464
ae9d18bc
JH		 3465 /* NOTE 1: Remember that we may be
3466 dealing with stdin/stdout here, in addition to TCP/IP connections.
3467 Also, delays may be specified for non-SMTP input, where smtp_out and
3468 smtp_in will be NULL. Whatever is done must work in all cases.
3469
3470 NOTE 2: The added feature of flushing the output before a delay must
3471 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3472 */
3473
3474 else
3475 {
3476 if (smtp_out != NULL && !disable_delay_flush)
3477 mac_smtp_fflush();
3478
861a7c51 3479#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3480 {
3481 struct pollfd p;
3482 nfds_t n = 0;
3483 if (smtp_out)
3484 {
3485 p.fd = fileno(smtp_out);
3486 p.events = POLLRDHUP;
3487 n = 1;
3488 }
3489 if (poll(&p, n, delay*1000) > 0)
3490 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3491 }
3492#else
010c2d14
PH		 3493 /* It appears to be impossible to detect that a TCP/IP connection has
3494 gone away without reading from it. This means that we cannot shorten
3495 the delay below if the client goes away, because we cannot discover
3496 that the client has closed its end of the connection. (The connection
3497 is actually in a half-closed state, waiting for the server to close its
3498 end.) It would be nice to be able to detect this state, so that the
3499 Exim process is not held up unnecessarily. However, it seems that we
3500 can't. The poll() function does not do the right thing, and in any case
3501 it is not always available.
047bdd8c 3502 */
010c2d14 3503
86b8287f 3504 while (delay > 0) delay = sleep(delay);
ae9d18bc 3505#endif
8e669ac1 3506 }
059ec3d9
PH		 3507 }
3508 }
3509 break;
3510
80a47a2c
TK		 3511 #ifndef DISABLE_DKIM
3512 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3513 if (dkim_cur_signer != NULL)
3514 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3515 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3516 else
b0b9dbb1 3517 rc = FAIL;
71fafd95
PH		 3518 break;
3519
80a47a2c
TK		 3520 case ACLC_DKIM_STATUS:
3521 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3522 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3523 break;
3524 #endif
fb2274d4 3525
4840604e
TL		 3526 #ifdef EXPERIMENTAL_DMARC
3527 case ACLC_DMARC_STATUS:
4a8ce2d8 3528 if (!dmarc_has_been_checked)
4840604e 3529 dmarc_process();
4a8ce2d8 3530 dmarc_has_been_checked = TRUE;
4840604e
TL		 3531 /* used long way of dmarc_exim_expand_query() in case we need more
3532 * view into the process in the future. */
3533 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3534 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3535 break;
3536 #endif
3537
059ec3d9 3538 case ACLC_DNSLISTS:
379ba7d0 3539 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3540 break;
3541
3542 case ACLC_DOMAINS:
3543 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3544 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3545 break;
3546
3547 /* The value in tls_cipher is the full cipher name, for example,
3548 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3549 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3550 what may in practice come out of the SSL library - which at the time of
3551 writing is poorly documented. */
3552
3553 case ACLC_ENCRYPTED:
817d9f57 3554 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3555 {
3556 uschar *endcipher = NULL;
817d9f57
JH		 3557 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3558 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3559 {
3560 endcipher = Ustrchr(++cipher, ':');
3561 if (endcipher != NULL) *endcipher = 0;
3562 }
3563 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3564 if (endcipher != NULL) *endcipher = ':';
3565 }
3566 break;
3567
3568 /* Use verify_check_this_host() instead of verify_check_host() so that
3569 we can pass over &host_data to catch any looked up data. Once it has been
3570 set, it retains its value so that it's still there if another ACL verb
3571 comes through here and uses the cache. However, we must put it into
3572 permanent store in case it is also expected to be used in a subsequent
3573 message in the same SMTP connection. */
3574
3575 case ACLC_HOSTS:
3576 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3577 (sender_host_address == NULL)? US"" : sender_host_address,
3578 CUSS &host_data);
4a452c43
JH		 3579 if (rc == DEFER) *log_msgptr = search_error_message;
3580 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3581 break;
3582
3583 case ACLC_LOCAL_PARTS:
3584 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3585 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3586 CUSS &deliver_localpart_data);
059ec3d9
PH		 3587 break;
3588
6ea85e9a
PH		 3589 case ACLC_LOG_REJECT_TARGET:
3590 {
3591 int logbits = 0;
3592 int sep = 0;
55414b25 3593 const uschar *s = arg;
6ea85e9a 3594 uschar *ss;
4a452c43 3595 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3596 {
3597 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3598 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3599 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3600 else
3601 {
3602 logbits |= LOG_MAIN|LOG_REJECT;
3603 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3604 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3605 }
3606 }
3607 log_reject_target = logbits;
3608 }
3609 break;
3610
059ec3d9
PH		 3611 case ACLC_LOGWRITE:
3612 {
3613 int logbits = 0;
55414b25 3614 const uschar *s = arg;
059ec3d9
PH		 3615 if (*s == ':')
3616 {
3617 s++;
3618 while (*s != ':')
3619 {
3620 if (Ustrncmp(s, "main", 4) == 0)
3621 { logbits |= LOG_MAIN; s += 4; }
3622 else if (Ustrncmp(s, "panic", 5) == 0)
3623 { logbits |= LOG_PANIC; s += 5; }
3624 else if (Ustrncmp(s, "reject", 6) == 0)
3625 { logbits |= LOG_REJECT; s += 6; }
3626 else
3627 {
3628 logbits = LOG_MAIN|LOG_PANIC;
3629 s = string_sprintf(":unknown log name in \"%s\" in "
3630 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3631 }
3632 if (*s == ',') s++;
3633 }
3634 s++;
3635 }
3636 while (isspace(*s)) s++;
6ea85e9a
PH		 3637
3638
059ec3d9
PH		 3639 if (logbits == 0) logbits = LOG_MAIN;
3640 log_write(0, logbits, "%s", string_printing(s));
3641 }
3642 break;
8e669ac1 3643
71fafd95 3644 #ifdef WITH_CONTENT_SCAN
0f0c8159 3645 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3646 {
6ea85e9a 3647 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3648 const uschar * list = arg;
3649 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3650 uschar *opt;
3651 BOOL defer_ok = FALSE;
3652 int timeout = 0;
3653
55414b25 3654 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3655 if (strcmpic(opt, US"defer_ok") == 0)
3656 defer_ok = TRUE;
3657 else if ( strncmpic(opt, US"tmo=", 4) == 0
3658 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3659 )
3660 {
3661 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3662 return ERROR;
3663 }
3664
3665 rc = malware(ss, timeout);
3666 if (rc == DEFER && defer_ok)
3667 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3668 }
3669 break;
3670
3671 case ACLC_MIME_REGEX:
71fafd95 3672 rc = mime_regex(&arg);
8523533c 3673 break;
71fafd95 3674 #endif
059ec3d9 3675
b0b9dbb1
JH		 3676 case ACLC_QUEUE:
3677 queue_name = string_copy_malloc(arg);
3678 break;
3679
870f6ba8 3680 case ACLC_RATELIMIT:
90fc3069 3681 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3682 break;
3683
059ec3d9 3684 case ACLC_RECIPIENTS:
55414b25
JH		 3685 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3686 CUSS &recipient_data);
059ec3d9
PH		 3687 break;
3688
71fafd95
PH		 3689 #ifdef WITH_CONTENT_SCAN
3690 case ACLC_REGEX:
3691 rc = regex(&arg);
8523533c 3692 break;
71fafd95 3693 #endif
8523533c 3694
e7568d51
TL		 3695 case ACLC_REMOVE_HEADER:
3696 setup_remove_header(arg);
3697 break;
3698
059ec3d9
PH		 3699 case ACLC_SENDER_DOMAINS:
3700 {
3701 uschar *sdomain;
3702 sdomain = Ustrrchr(sender_address, '@');
3703 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3704 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3705 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3706 }
3707 break;
3708
3709 case ACLC_SENDERS:
55414b25
JH		 3710 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3711 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3712 break;
3713
3714 /* Connection variables must persist forever */
3715
3716 case ACLC_SET:
3717 {
3718 int old_pool = store_pool;
5ef5dd52 3719 if ( cb->u.varname[0] == 'c'
0cbf2b82 3720#ifndef DISABLE_EVENT
5ef5dd52
JB		 3721 || event_name /* An event is being delivered */
3722#endif
3723 )
3724 store_pool = POOL_PERM;
38a0a95f 3725 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3726 store_pool = old_pool;
3727 }
3728 break;
3729
71fafd95 3730 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3731 case ACLC_SPAM:
3732 {
3733 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3734 const uschar * list = arg;
3735 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3736 /* Run the spam backend. */
55414b25 3737 rc = spam(CUSS &ss);
8523533c 3738 /* Modify return code based upon the existance of options. */
55414b25 3739 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3740 != NULL) {
3741 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3742 {
3743 /* FAIL so that the message is passed to the next ACL */
3744 rc = FAIL;
3745 }
3746 }
3747 }
3748 break;
71fafd95 3749 #endif
8523533c 3750
71fafd95 3751 #ifdef EXPERIMENTAL_SPF
8523533c 3752 case ACLC_SPF:
65a7d8c3
NM		 3753 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3754 break;
3755 case ACLC_SPF_GUESS:
3756 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3757 break;
71fafd95 3758 #endif
8523533c 3759
b0019c78
TF		 3760 case ACLC_UDPSEND:
3761 rc = acl_udpsend(arg, log_msgptr);
3762 break;
3763
059ec3d9
PH		 3764 /* If the verb is WARN, discard any user message from verification, because
3765 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3766 only from explicit "message" modifiers. However, put the user message into
3767 $acl_verify_message so it can be used in subsequent conditions or modifiers
3768 (until something changes it). */
059ec3d9
PH		 3769
3770 case ACLC_VERIFY:
3771 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3772 if (*user_msgptr)
3773 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3774 if (verb == ACL_WARN) *user_msgptr = NULL;
3775 break;
3776
3777 default:
3778 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3779 "condition %d", cb->type);
3780 break;
3781 }
3782
3783 /* If a condition was negated, invert OK/FAIL. */
3784
3785 if (!cond_modifiers[cb->type] && cb->u.negated)
3786 {
3787 if (rc == OK) rc = FAIL;
3788 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3789 }
3790
3791 if (rc != OK) break; /* Conditions loop */
3792 }
3793
3794
3795/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3796handle the values of these modifiers. If there isn't a log message set, we make
3797it the same as the user message.
059ec3d9
PH		 3798
3799"message" is a user message that will be included in an SMTP response. Unless
3800it is empty, it overrides any previously set user message.
3801
3802"log_message" is a non-user message, and it adds to any existing non-user
3803message that is already set.
3804
4e88a19f
PH		 3805Most verbs have but a single return for which the messages are relevant, but
3806for "discard", it's useful to have the log message both when it succeeds and
3807when it fails. For "accept", the message is used in the OK case if there is no
3808"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3809present. */
059ec3d9 3810
4e88a19f
PH		 3811if (*epp && rc == OK) user_message = NULL;
3812
3813if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3814 {
3815 uschar *expmessage;
4e88a19f
PH		 3816 uschar *old_user_msgptr = *user_msgptr;
3817 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3818
3819 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3820 nested ACLs) are always discarded. This also happens for acceptance verbs
3821 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3822 However, the value of an existing message is available in $acl_verify_message
3823 during expansions. */
3824
4e88a19f
PH		 3825 if (verb == ACL_WARN ||
3826 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3827 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3828
3829 if (user_message != NULL)
3830 {
3831 acl_verify_message = old_user_msgptr;
3832 expmessage = expand_string(user_message);
3833 if (expmessage == NULL)
3834 {
3835 if (!expand_string_forcedfail)
3836 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3837 user_message, expand_string_message);
3838 }
3839 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3840 }
3841
3842 if (log_message != NULL)
3843 {
3844 acl_verify_message = old_log_msgptr;
3845 expmessage = expand_string(log_message);
3846 if (expmessage == NULL)
3847 {
3848 if (!expand_string_forcedfail)
3849 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3850 log_message, expand_string_message);
3851 }
3852 else if (expmessage[0] != 0)
3853 {
3854 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3855 string_sprintf("%s: %s", expmessage, *log_msgptr);
3856 }
3857 }
3858
3859 /* If no log message, default it to the user message */
3860
3861 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3862 }
3863
3864acl_verify_message = NULL;
3865return rc;
3866}
3867
3868
3869
3870
3871
3872/*************************************************
3873* Get line from a literal ACL *
3874*************************************************/
3875
3876/* This function is passed to acl_read() in order to extract individual lines
3877of a literal ACL, which we access via static pointers. We can destroy the
3878contents because this is called only once (the compiled ACL is remembered).
3879
3880This code is intended to treat the data in the same way as lines in the main
3881Exim configuration file. That is:
3882
3883 . Leading spaces are ignored.
3884
3885 . A \ at the end of a line is a continuation - trailing spaces after the \
3886 are permitted (this is because I don't believe in making invisible things
3887 significant). Leading spaces on the continued part of a line are ignored.
3888
3889 . Physical lines starting (significantly) with # are totally ignored, and
3890 may appear within a sequence of backslash-continued lines.
3891
3892 . Blank lines are ignored, but will end a sequence of continuations.
3893
3894Arguments: none
3895Returns: a pointer to the next line
3896*/
3897
3898
3899static uschar *acl_text; /* Current pointer in the text */
3900static uschar *acl_text_end; /* Points one past the terminating '0' */
3901
3902
3903static uschar *
3904acl_getline(void)
3905{
3906uschar *yield;
3907
3908/* This loop handles leading blank lines and comments. */
3909
3910for(;;)
3911 {
3912 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3913 if (*acl_text == 0) return NULL; /* No more data */
3914 yield = acl_text; /* Potential data line */
3915
3916 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3917
3918 /* If we hit the end before a newline, we have the whole logical line. If
3919 it's a comment, there's no more data to be given. Otherwise, yield it. */
3920
3921 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3922
3923 /* After reaching a newline, end this loop if the physical line does not
3924 start with '#'. If it does, it's a comment, and the loop continues. */
3925
3926 if (*yield != '#') break;
3927 }
3928
3929/* This loop handles continuations. We know we have some real data, ending in
3930newline. See if there is a continuation marker at the end (ignoring trailing
3931white space). We know that *yield is not white space, so no need to test for
3932cont > yield in the backwards scanning loop. */
3933
3934for(;;)
3935 {
3936 uschar *cont;
3937 for (cont = acl_text - 1; isspace(*cont); cont--);
3938
3939 /* If no continuation follows, we are done. Mark the end of the line and
3940 return it. */
3941
3942 if (*cont != '\\')
3943 {
3944 *acl_text++ = 0;
3945 return yield;
3946 }
3947
3948 /* We have encountered a continuation. Skip over whitespace at the start of
3949 the next line, and indeed the whole of the next line or lines if they are
3950 comment lines. */
3951
3952 for (;;)
3953 {
3954 while (*(++acl_text) == ' ' || *acl_text == '\t');
3955 if (*acl_text != '#') break;
3956 while (*(++acl_text) != 0 && *acl_text != '\n');
3957 }
3958
3959 /* We have the start of a continuation line. Move all the rest of the data
3960 to join onto the previous line, and then find its end. If the end is not a
3961 newline, we are done. Otherwise loop to look for another continuation. */
3962
3963 memmove(cont, acl_text, acl_text_end - acl_text);
3964 acl_text_end -= acl_text - cont;
3965 acl_text = cont;
3966 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3967 if (*acl_text == 0) return yield;
3968 }
3969
3970/* Control does not reach here */
3971}
3972
3973
3974
3975
3976
3977/*************************************************
3978* Check access using an ACL *
3979*************************************************/
3980
3981/* This function is called from address_check. It may recurse via
3982acl_check_condition() - hence the use of a level to stop looping. The ACL is
3983passed as a string which is expanded. A forced failure implies no access check
3984is required. If the result is a single word, it is taken as the name of an ACL
3985which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3986text, complete with newlines, and parsed as such. In both cases, the ACL check
3987is then run. This function uses an auxiliary function for acl_read() to call
3988for reading individual lines of a literal ACL. This is acl_getline(), which
3989appears immediately above.
3990
3991Arguments:
3992 where where called from
3993 addr address item when called from RCPT; otherwise NULL
3994 s the input string; NULL is the same as an empty ACL => DENY
3995 level the nesting level
3996 user_msgptr where to put a user error (for SMTP response)
3997 log_msgptr where to put a logging message (not for SMTP response)
3998
3999Returns: OK access is granted
4000 DISCARD access is apparently granted...
4001 FAIL access is denied
4002 FAIL_DROP access is denied; drop the connection
4003 DEFER can't tell at the moment
4004 ERROR disaster
4005*/
4006
4007static int
4008acl_check_internal(int where, address_item *addr, uschar *s, int level,
4009 uschar **user_msgptr, uschar **log_msgptr)
4010{
4011int fd = -1;
4012acl_block *acl = NULL;
4013uschar *acl_name = US"inline ACL";
4014uschar *ss;
4015
4016/* Catch configuration loops */
4017
4018if (level > 20)
4019 {
4020 *log_msgptr = US"ACL nested too deep: possible loop";
4021 return ERROR;
4022 }
4023
4024if (s == NULL)
4025 {
4026 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4027 return FAIL;
4028 }
4029
4030/* At top level, we expand the incoming string. At lower levels, it has already
4031been expanded as part of condition processing. */
4032
4033if (level == 0)
4034 {
4035 ss = expand_string(s);
4036 if (ss == NULL)
4037 {
4038 if (expand_string_forcedfail) return OK;
4039 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4040 expand_string_message);
4041 return ERROR;
4042 }
4043 }
4044else ss = s;
4045
4046while (isspace(*ss))ss++;
4047
4048/* If we can't find a named ACL, the default is to parse it as an inline one.
4049(Unless it begins with a slash; non-existent files give rise to an error.) */
4050
4051acl_text = ss;
4052
4053/* Handle the case of a string that does not contain any spaces. Look for a
4054named ACL among those read from the configuration, or a previously read file.
4055It is possible that the pointer to the ACL is NULL if the configuration
4056contains a name with no data. If not found, and the text begins with '/',
4057read an ACL from a file, and save it so it can be re-used. */
4058
4059if (Ustrchr(ss, ' ') == NULL)
4060 {
4061 tree_node *t = tree_search(acl_anchor, ss);
4062 if (t != NULL)
4063 {
4064 acl = (acl_block *)(t->data.ptr);
4065 if (acl == NULL)
4066 {
4067 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4068 return FAIL;
4069 }
4070 acl_name = string_sprintf("ACL \"%s\"", ss);
4071 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4072 }
4073
4074 else if (*ss == '/')
4075 {
4076 struct stat statbuf;
4077 fd = Uopen(ss, O_RDONLY, 0);
4078 if (fd < 0)
4079 {
4080 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4081 strerror(errno));
4082 return ERROR;
4083 }
4084
4085 if (fstat(fd, &statbuf) != 0)
4086 {
4087 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4088 strerror(errno));
4089 return ERROR;
4090 }
4091
4092 acl_text = store_get(statbuf.st_size + 1);
4093 acl_text_end = acl_text + statbuf.st_size + 1;
4094
4095 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4096 {
4097 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4098 ss, strerror(errno));
4099 return ERROR;
4100 }
4101 acl_text[statbuf.st_size] = 0;
f1e894f3 4102 (void)close(fd);
059ec3d9
PH		 4103
4104 acl_name = string_sprintf("ACL \"%s\"", ss);
4105 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4106 }
4107 }
4108
4109/* Parse an ACL that is still in text form. If it came from a file, remember it
4110in the ACL tree, having read it into the POOL_PERM store pool so that it
4111persists between multiple messages. */
4112
4113if (acl == NULL)
4114 {
4115 int old_pool = store_pool;
4116 if (fd >= 0) store_pool = POOL_PERM;
4117 acl = acl_read(acl_getline, log_msgptr);
4118 store_pool = old_pool;
4119 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4120 if (fd >= 0)
4121 {
4122 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4123 Ustrcpy(t->name, ss);
4124 t->data.ptr = acl;
4125 (void)tree_insertnode(&acl_anchor, t);
4126 }
4127 }
4128
4129/* Now we have an ACL to use. It's possible it may be NULL. */
4130
4131while (acl != NULL)
4132 {
4133 int cond;
4134 int basic_errno = 0;
4135 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4136 BOOL acl_quit_check = level == 0
4137 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4138
4139 *log_msgptr = *user_msgptr = NULL;
4140 acl_temp_details = FALSE;
4141
059ec3d9
PH		 4142 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4143
4144 /* Clear out any search error message from a previous check before testing
4145 this condition. */
4146
4147 search_error_message = NULL;
4148 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4149 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4150
4151 /* Handle special returns: DEFER causes a return except on a WARN verb;
4152 ERROR always causes a return. */
4153
4154 switch (cond)
4155 {
4156 case DEFER:
6968512f 4157 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4158 if (basic_errno != ERRNO_CALLOUTDEFER)
4159 {
4160 if (search_error_message != NULL && *search_error_message != 0)
4161 *log_msgptr = search_error_message;
4162 if (smtp_return_error_details) acl_temp_details = TRUE;
4163 }
4164 else
4165 {
4166 acl_temp_details = TRUE;
4167 }
4168 if (acl->verb != ACL_WARN) return DEFER;
4169 break;
4170
4171 default: /* Paranoia */
4172 case ERROR:
6968512f 4173 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4174 return ERROR;
4175
4176 case OK:
6968512f
JH		 4177 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4178 verbs[acl->verb], acl_name);
059ec3d9
PH		 4179 break;
4180
4181 case FAIL:
6968512f 4182 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4183 break;
4184
4185 /* DISCARD and DROP can happen only from a nested ACL condition, and
4186 DISCARD can happen only for an "accept" or "discard" verb. */
4187
4188 case DISCARD:
6968512f
JH		 4189 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4190 verbs[acl->verb], acl_name);
059ec3d9
PH		 4191 break;
4192
4193 case FAIL_DROP:
6968512f
JH		 4194 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4195 verbs[acl->verb], acl_name);
059ec3d9
PH		 4196 break;
4197 }
4198
4199 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4200 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4201 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4202
4203 switch(acl->verb)
4204 {
4205 case ACL_ACCEPT:
a7538db1
JH		 4206 if (cond == OK || cond == DISCARD)
4207 {
4208 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4209 return cond;
4210 }
059ec3d9
PH		 4211 if (endpass_seen)
4212 {
4213 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4214 return cond;
4215 }
4216 break;
4217
4218 case ACL_DEFER:
4219 if (cond == OK)
4220 {
a7538db1 4221 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4222 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4223 acl_temp_details = TRUE;
4224 return DEFER;
4225 }
4226 break;
4227
4228 case ACL_DENY:
a7538db1
JH		 4229 if (cond == OK)
4230 {
4231 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4232 if (acl_quit_check) goto badquit;
a7538db1
JH		 4233 return FAIL;
4234 }
059ec3d9
PH		 4235 break;
4236
4237 case ACL_DISCARD:
a7538db1
JH		 4238 if (cond == OK || cond == DISCARD)
4239 {
4240 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4241 if (acl_quit_check) goto badquit;
a7538db1
JH		 4242 return DISCARD;
4243 }
059ec3d9
PH		 4244 if (endpass_seen)
4245 {
4246 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4247 return cond;
4248 }
4249 break;
4250
4251 case ACL_DROP:
a7538db1
JH		 4252 if (cond == OK)
4253 {
4254 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4255 if (acl_quit_check) goto badquit;
a7538db1
JH		 4256 return FAIL_DROP;
4257 }
059ec3d9
PH		 4258 break;
4259
4260 case ACL_REQUIRE:
a7538db1
JH		 4261 if (cond != OK)
4262 {
4263 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4264 if (acl_quit_check) goto badquit;
a7538db1
JH		 4265 return cond;
4266 }
059ec3d9
PH		 4267 break;
4268
4269 case ACL_WARN:
4270 if (cond == OK)
4271 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4272 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4273 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4274 "condition test deferred%s%s", host_and_ident(TRUE),
4275 (*log_msgptr == NULL)? US"" : US": ",
4276 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4277 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4278 break;
4279
4280 default:
4281 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4282 acl->verb);
4283 break;
4284 }
4285
4286 /* Pass to the next ACL item */
4287
4288 acl = acl->next;
4289 }
4290
4291/* We have reached the end of the ACL. This is an implicit DENY. */
4292
4293HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4294return FAIL;
82c0c8ea
JH		 4295
4296badquit:
4297 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4298 "('%s' verb used incorrectly)", verbs[acl->verb]);
4299 return ERROR;
059ec3d9
PH		 4300}
4301
4302
333eea9c
JH		 4303
4304
4305/* Same args as acl_check_internal() above, but the string s is
4306the name of an ACL followed optionally by up to 9 space-separated arguments.
4307The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4308static int
55414b25 4309acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4310 uschar **user_msgptr, uschar **log_msgptr)
4311{
4312uschar * tmp;
bef3ea7f 4313uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4314uschar * sav_arg[9]; /* must match acl_arg[] */
4315int sav_narg;
333eea9c 4316uschar * name;
bef3ea7f 4317int i;
ef21c07d 4318int ret;
333eea9c
JH		 4319
4320if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4321 goto bad;
4322
bef3ea7f 4323for (i = 0; i < 9; i++)
333eea9c
JH		 4324 {
4325 while (*s && isspace(*s)) s++;
4326 if (!*s) break;
bef3ea7f 4327 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4328 {
4329 tmp = name;
4330 goto bad;
4331 }
4332 }
ef21c07d
JH		 4333
4334sav_narg = acl_narg;
bef3ea7f 4335acl_narg = i;
ef21c07d
JH		 4336for (i = 0; i < acl_narg; i++)
4337 {
4338 sav_arg[i] = acl_arg[i];
4339 acl_arg[i] = tmp_arg[i];
4340 }
4341while (i < 9)
4342 {
4343 sav_arg[i] = acl_arg[i];
4344 acl_arg[i++] = NULL;
4345 }
4346
4347ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4348
ef21c07d
JH		 4349acl_narg = sav_narg;
4350for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4351return ret;
333eea9c
JH		 4352
4353bad:
4354if (expand_string_forcedfail) return ERROR;
4355*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4356 tmp, expand_string_message);
4357return search_find_defer?DEFER:ERROR;
4358}
4359
4360
4361
059ec3d9
PH		 4362/*************************************************
4363* Check access using an ACL *
4364*************************************************/
4365
faa05a93
JH		 4366/* Alternate interface for ACL, used by expansions */
4367int
05caaeaa 4368acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4369{
faa05a93
JH		 4370address_item adb;
4371address_item *addr = NULL;
4372
4373*user_msgptr = *log_msgptr = NULL;
4374sender_verified_failed = NULL;
4375ratelimiters_cmd = NULL;
4376log_reject_target = LOG_MAIN|LOG_REJECT;
4377
4378if (where == ACL_WHERE_RCPT)
4379 {
4380 adb = address_defaults;
4381 addr = &adb;
05caaeaa
JH		 4382 addr->address = expand_string(US"$local_part@$domain");
4383 addr->domain = deliver_domain;
4384 addr->local_part = deliver_localpart;
4385 addr->cc_local_part = deliver_localpart;
4386 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4387 }
4388
4389return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4390}
4391
4392
4393
059ec3d9
PH		 4394/* This is the external interface for ACL checks. It sets up an address and the
4395expansions for $domain and $local_part when called after RCPT, then calls
4396acl_check_internal() to do the actual work.
4397
4398Arguments:
4399 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4400 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4401 s the input string; NULL is the same as an empty ACL => DENY
4402 user_msgptr where to put a user error (for SMTP response)
4403 log_msgptr where to put a logging message (not for SMTP response)
4404
4405Returns: OK access is granted by an ACCEPT verb
4406 DISCARD access is granted by a DISCARD verb
4407 FAIL access is denied
4408 FAIL_DROP access is denied; drop the connection
4409 DEFER can't tell at the moment
4410 ERROR disaster
4411*/
faa05a93 4412int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4413
4414int
64ffc24f 4415acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4416 uschar **log_msgptr)
4417{
4418int rc;
4419address_item adb;
64ffc24f 4420address_item *addr = NULL;
059ec3d9
PH		 4421
4422*user_msgptr = *log_msgptr = NULL;
4423sender_verified_failed = NULL;
fe0dab11 4424ratelimiters_cmd = NULL;
6ea85e9a 4425log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4426
8ccd00b1 4427#ifndef DISABLE_PRDR
4f6ae5c3 4428if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4429#else
4f6ae5c3 4430if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4431#endif
059ec3d9
PH		 4432 {
4433 adb = address_defaults;
4434 addr = &adb;
64ffc24f 4435 addr->address = recipient;
059ec3d9
PH		 4436 if (deliver_split_address(addr) == DEFER)
4437 {
4438 *log_msgptr = US"defer in percent_hack_domains check";
4439 return DEFER;
4440 }
8c5d388a 4441#ifdef SUPPORT_I18N
3c8b3577
JH		 4442 if ((addr->prop.utf8_msg = message_smtputf8))
4443 {
4444 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4445 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4446 }
9bfc60eb 4447#endif
059ec3d9
PH		 4448 deliver_domain = addr->domain;
4449 deliver_localpart = addr->local_part;
4450 }
059ec3d9 4451
faa05a93 4452acl_where = where;
059ec3d9 4453rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4454acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4455
817d9f57
JH		 4456/* Cutthrough - if requested,
4457and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4458and rcpt acl returned accept,
4459and first recipient (cancel on any subsequents)
e4bdf652 4460open one now and run it up to RCPT acceptance.
f9334a28
JH		 4461A failed verify should cancel cutthrough request,
4462and will pass the fail to the originator.
817d9f57 4463Initial implementation: dual-write to spool.
e4bdf652
JH		 4464Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4465
4466Cease cutthrough copy on rxd final dot; do not send one.
4467
4468On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4469
4470On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4471perm-rejected, reflect that to the original sender - and dump the spooled copy.
4472If temp-reject, close the conn (and keep the spooled copy).
4473If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4474*/
4475switch (where)
ff5929e3
JH		 4476 {
4477 case ACL_WHERE_RCPT:
8ccd00b1 4478#ifndef DISABLE_PRDR
ff5929e3 4479 case ACL_WHERE_PRDR:
fd98a5c6 4480#endif
ff5929e3
JH		 4481 if (host_checking_callout) /* -bhc mode */
4482 cancel_cutthrough_connection("host-checking mode");
4483
4484 else if ( rc == OK
4485 && cutthrough.delivery
4486 && rcpt_count > cutthrough.nrcpt
4487 && (rc = open_cutthrough_connection(addr)) == DEFER
4488 )
4489 if (cutthrough.defer_pass)
4490 {
4491 uschar * s = addr->message;
4492 /* Horrid kludge to recover target's SMTP message */
4493 while (*s) s++;
4494 do --s; while (!isdigit(*s));
4495 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4496 acl_temp_details = TRUE;
4497 }
4498 else
4499 {
4500 HDEBUG(D_acl) debug_printf("cutthrough defer; will spool\n");
4501 rc = OK;
4502 }
4503 break;
e4bdf652 4504
ff5929e3
JH		 4505 case ACL_WHERE_PREDATA:
4506 if (rc == OK)
4507 cutthrough_predata();
4508 else
4509 cancel_cutthrough_connection("predata acl not ok");
4510 break;
e4bdf652 4511
ff5929e3
JH		 4512 case ACL_WHERE_QUIT:
4513 case ACL_WHERE_NOTQUIT:
4514 cancel_cutthrough_connection("quit or notquit");
4515 break;
e4bdf652 4516
ff5929e3
JH		 4517 default:
4518 break;
4519 }
e4bdf652 4520
64ffc24f
PH		 4521deliver_domain = deliver_localpart = deliver_address_data =
4522 sender_address_data = NULL;
059ec3d9
PH		 4523
4524/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4525ACL, which is really in the middle of an SMTP command. */
4526
4527if (rc == DISCARD)
4528 {
4529 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4530 {
4531 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4532 "ACL", acl_wherenames[where]);
4533 return ERROR;
4534 }
4535 return DISCARD;
4536 }
4537
4538/* A DROP response is not permitted from MAILAUTH */
4539
4540if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4541 {
4542 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4543 "ACL", acl_wherenames[where]);
4544 return ERROR;
4545 }
4546
4e88a19f
PH		 4547/* Before giving a response, take a look at the length of any user message, and
4548split it up into multiple lines if possible. */
059ec3d9 4549
e28326d8
PH		 4550*user_msgptr = string_split_message(*user_msgptr);
4551if (fake_response != OK)
4552 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4553
4554return rc;
4555}
4556
38a0a95f 4557
38a0a95f
PH		 4558/*************************************************
4559* Create ACL variable *
4560*************************************************/
4561
4562/* Create an ACL variable or reuse an existing one. ACL variables are in a
4563binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4564
4565Argument:
4566 name pointer to the variable's name, starting with c or m
4567
4568Returns the pointer to variable's tree node
4569*/
4570
4571tree_node *
4572acl_var_create(uschar *name)
4573{
4574tree_node *node, **root;
4575root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4576node = tree_search(*root, name);
4577if (node == NULL)
4578 {
4579 node = store_get(sizeof(tree_node) + Ustrlen(name));
4580 Ustrcpy(node->name, name);
4581 (void)tree_insertnode(root, node);
4582 }
4583node->data.ptr = NULL;
4584return node;
4585}
4586
4587
4588
4589/*************************************************
4590* Write an ACL variable in spool format *
4591*************************************************/
4592
4593/* This function is used as a callback for tree_walk when writing variables to
4594the spool file. To retain spool file compatibility, what is written is -aclc or
4595-aclm followed by the rest of the name and the data length, space separated,
4596then the value itself, starting on a new line, and terminated by an additional
4597newline. When we had only numbered ACL variables, the first line might look
4598like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4599acl_cfoo.
4600
4601Arguments:
4602 name of the variable
4603 value of the variable
4604 ctx FILE pointer (as a void pointer)
4605
4606Returns: nothing
4607*/
4608
4609void
4610acl_var_write(uschar *name, uschar *value, void *ctx)
4611{
4612FILE *f = (FILE *)ctx;
4613fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4614}
4615
9171d434
JH		 4616/* vi: aw ai sw=2
4617*/
059ec3d9 4618/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.