projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
sender verify callout
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef
PH		 183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
c46782ef 186 #endif
ed7f7860 187 CONTROL_DEBUG,
80a47a2c 188 #ifndef DISABLE_DKIM
f7572e5a
TK		 189 CONTROL_DKIM_VERIFY,
190 #endif
4840604e
TL		 191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH		 208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
cf8b11a5 211 CONTROL_NO_MULTILINE,
047bdd8c 212 CONTROL_NO_PIPELINING,
4c590bd1
PH		 213 CONTROL_NO_DELAY_FLUSH,
214 CONTROL_NO_CALLOUT_FLUSH
c46782ef 215};
9a26b6b2 216
8800895a
PH		 217/* ACL control names; keep in step with the table above! This list is used for
218turning ids into names. The actual list of recognized names is in the variable
219control_def controls_list[] below. The fact that there are two lists is a mess
220and should be tidied up. */
9a26b6b2
PH		 221
222static uschar *controls[] = {
c46782ef 223 US"allow_auth_unadvertised",
9a26b6b2
PH		 224 #ifdef EXPERIMENTAL_BRIGHTMAIL
225 US"bmi_run",
226 #endif
ed7f7860 227 US"debug",
80a47a2c
TK		 228 #ifndef DISABLE_DKIM
229 US"dkim_disable_verify",
f7572e5a 230 #endif
4840604e
TL		 231 #ifdef EXPERIMENTAL_DMARC
232 US"dmarc_disable_verify",
233 US"dmarc_enable_forensic",
234 #endif
13363eba 235 US"dscp",
c46782ef
PH		 236 US"error",
237 US"caseful_local_part",
238 US"caselower_local_part",
e4bdf652 239 US"cutthrough_delivery",
c46782ef
PH		 240 US"enforce_sync",
241 US"no_enforce_sync",
242 US"freeze",
243 US"queue_only",
244 US"submission",
245 US"suppress_local_fixups",
9a26b6b2
PH		 246 #ifdef WITH_CONTENT_SCAN
247 US"no_mbox_unspool",
248 #endif
cf8b11a5
PH		 249 US"fakedefer",
250 US"fakereject",
aa6dc513 251 US"no_multiline_responses",
cf8b11a5 252 US"no_pipelining",
4c590bd1
PH		 253 US"no_delay_flush",
254 US"no_callout_flush"
c46782ef 255};
059ec3d9 256
047bdd8c 257/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 258at the outer level. In the other cases, expansion already occurs in the
259checking functions. */
260
261static uschar cond_expand_at_top[] = {
7421ecab 262 FALSE, /* acl */
3e536984 263 TRUE, /* add_header */
059ec3d9 264 FALSE, /* authenticated */
8523533c
TK		 265#ifdef EXPERIMENTAL_BRIGHTMAIL
266 TRUE, /* bmi_optin */
8e669ac1 267#endif
059ec3d9 268 TRUE, /* condition */
c3611384 269 TRUE, /* continue */
059ec3d9 270 TRUE, /* control */
6a8f9482
TK		 271#ifdef EXPERIMENTAL_DCC
272 TRUE, /* dcc */
273#endif
8523533c
TK		 274#ifdef WITH_CONTENT_SCAN
275 TRUE, /* decode */
276#endif
059ec3d9 277 TRUE, /* delay */
8523533c
TK		 278#ifdef WITH_OLD_DEMIME
279 TRUE, /* demime */
fb2274d4 280#endif
80a47a2c
TK		 281#ifndef DISABLE_DKIM
282 TRUE, /* dkim_signers */
283 TRUE, /* dkim_status */
4840604e
TL		 284#endif
285#ifdef EXPERIMENTAL_DMARC
286 TRUE, /* dmarc_status */
8523533c 287#endif
059ec3d9
PH		 288 TRUE, /* dnslists */
289 FALSE, /* domains */
290 FALSE, /* encrypted */
291 TRUE, /* endpass */
292 FALSE, /* hosts */
293 FALSE, /* local_parts */
294 TRUE, /* log_message */
6ea85e9a 295 TRUE, /* log_reject_target */
059ec3d9 296 TRUE, /* logwrite */
8523533c
TK		 297#ifdef WITH_CONTENT_SCAN
298 TRUE, /* malware */
299#endif
059ec3d9 300 TRUE, /* message */
8523533c
TK		 301#ifdef WITH_CONTENT_SCAN
302 TRUE, /* mime_regex */
303#endif
870f6ba8 304 TRUE, /* ratelimit */
059ec3d9 305 FALSE, /* recipients */
8523533c
TK		 306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* regex */
308#endif
e7568d51 309 TRUE, /* remove_header */
059ec3d9
PH		 310 FALSE, /* sender_domains */
311 FALSE, /* senders */
312 TRUE, /* set */
8523533c
TK		 313#ifdef WITH_CONTENT_SCAN
314 TRUE, /* spam */
315#endif
316#ifdef EXPERIMENTAL_SPF
317 TRUE, /* spf */
65a7d8c3 318 TRUE, /* spf_guess */
8523533c 319#endif
b0019c78 320 TRUE, /* udpsend */
059ec3d9
PH		 321 TRUE /* verify */
322};
323
324/* Flags to identify the modifiers */
325
326static uschar cond_modifiers[] = {
327 FALSE, /* acl */
3e536984 328 TRUE, /* add_header */
059ec3d9 329 FALSE, /* authenticated */
8523533c
TK		 330#ifdef EXPERIMENTAL_BRIGHTMAIL
331 TRUE, /* bmi_optin */
8e669ac1 332#endif
059ec3d9 333 FALSE, /* condition */
c3611384 334 TRUE, /* continue */
059ec3d9 335 TRUE, /* control */
6a8f9482
TK		 336#ifdef EXPERIMENTAL_DCC
337 FALSE, /* dcc */
338#endif
8523533c
TK		 339#ifdef WITH_CONTENT_SCAN
340 FALSE, /* decode */
341#endif
059ec3d9 342 TRUE, /* delay */
8523533c
TK		 343#ifdef WITH_OLD_DEMIME
344 FALSE, /* demime */
fb2274d4 345#endif
80a47a2c
TK		 346#ifndef DISABLE_DKIM
347 FALSE, /* dkim_signers */
348 FALSE, /* dkim_status */
4840604e
TL		 349#endif
350#ifdef EXPERIMENTAL_DMARC
351 FALSE, /* dmarc_status */
8523533c 352#endif
059ec3d9
PH		 353 FALSE, /* dnslists */
354 FALSE, /* domains */
355 FALSE, /* encrypted */
356 TRUE, /* endpass */
357 FALSE, /* hosts */
358 FALSE, /* local_parts */
359 TRUE, /* log_message */
6ea85e9a 360 TRUE, /* log_reject_target */
8523533c
TK		 361 TRUE, /* logwrite */
362#ifdef WITH_CONTENT_SCAN
363 FALSE, /* malware */
364#endif
059ec3d9 365 TRUE, /* message */
8523533c
TK		 366#ifdef WITH_CONTENT_SCAN
367 FALSE, /* mime_regex */
368#endif
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
71fafd95 450 #ifdef WITH_OLD_DEMIME
2f079f46 451 (unsigned int)
fd98a5c6 452 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 453 #ifndef DISABLE_PRDR
fd98a5c6 454 (1<<ACL_WHERE_PRDR)|
8ccd00b1 455 #endif
fd98a5c6 456 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 457 #endif
8e669ac1 458
80a47a2c
TK		 459 #ifndef DISABLE_DKIM
460 (unsigned int)
461 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 462
80a47a2c
TK		 463 (unsigned int)
464 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 465 #endif
fb2274d4 466
4840604e
TL		 467 #ifdef EXPERIMENTAL_DMARC
468 (unsigned int)
469 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
470 #endif
471
45b91596
PH		 472 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
473 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 474
2f079f46 475 (unsigned int)
fd98a5c6 476 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 477 #ifndef DISABLE_PRDR
fd98a5c6
JH		 478 |(1<<ACL_WHERE_PRDR)
479 #endif
480 ),
059ec3d9 481
45b91596
PH		 482 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
483 (1<<ACL_WHERE_CONNECT)|
484 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 485 (1<<ACL_WHERE_HELO),
8e669ac1 486
059ec3d9 487 0, /* endpass */
8e669ac1 488
45b91596
PH		 489 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
490 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 491
2f079f46 492 (unsigned int)
fd98a5c6 493 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 494 #ifndef DISABLE_PRDR
fd98a5c6
JH		 495 |(1<<ACL_WHERE_PRDR)
496 #endif
497 ),
059ec3d9
PH		 498
499 0, /* log_message */
8e669ac1 500
6ea85e9a
PH		 501 0, /* log_reject_target */
502
059ec3d9 503 0, /* logwrite */
8e669ac1 504
71fafd95 505 #ifdef WITH_CONTENT_SCAN
2f079f46 506 (unsigned int)
fd98a5c6 507 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 508 #ifndef DISABLE_PRDR
fd98a5c6 509 (1<<ACL_WHERE_PRDR)|
8ccd00b1 510 #endif
fd98a5c6 511 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 512 #endif
8523533c 513
059ec3d9
PH		 514 0, /* message */
515
71fafd95 516 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 517 (unsigned int)
518 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 519 #endif
8523533c 520
870f6ba8
TF		 521 0, /* ratelimit */
522
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46 527 (unsigned int)
fd98a5c6 528 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 529 #ifndef DISABLE_PRDR
fd98a5c6 530 (1<<ACL_WHERE_PRDR)|
8ccd00b1 531 #endif
fd98a5c6 532 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 533 (1<<ACL_WHERE_MIME)),
71fafd95 534 #endif
8523533c 535
e7568d51
TL		 536 (unsigned int)
537 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
538 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6
JH		 540 (1<<ACL_WHERE_PRDR)|
541 #endif
e7568d51
TL		 542 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
543 (1<<ACL_WHERE_NOTSMTP_START)),
544
059ec3d9
PH		 545 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
546 (1<<ACL_WHERE_HELO)|
547 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
548 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
549 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 0, /* set */
558
71fafd95 559 #ifdef WITH_CONTENT_SCAN
2f079f46 560 (unsigned int)
fd98a5c6 561 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 562 #ifndef DISABLE_PRDR
fd98a5c6 563 (1<<ACL_WHERE_PRDR)|
8ccd00b1 564 #endif
fd98a5c6 565 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 566 #endif
8523533c 567
71fafd95 568 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 569 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
570 (1<<ACL_WHERE_HELO)|
571 (1<<ACL_WHERE_MAILAUTH)|
572 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 573 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
574 (1<<ACL_WHERE_NOTSMTP)|
575 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 576
577 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
578 (1<<ACL_WHERE_HELO)|
579 (1<<ACL_WHERE_MAILAUTH)|
580 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
581 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
582 (1<<ACL_WHERE_NOTSMTP)|
583 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 584 #endif
8523533c 585
b0019c78
TF		 586 0, /* udpsend */
587
059ec3d9
PH		 588 /* Certain types of verify are always allowed, so we let it through
589 always and check in the verify function itself */
590
591 0 /* verify */
059ec3d9
PH		 592};
593
594
c5fcb476
PH		 595/* Bit map vector of which controls are not allowed at certain times. For
596each control, there's a bitmap of dis-allowed times. For some, it is easier to
597specify the negation of a small number of allowed times. */
598
599static unsigned int control_forbids[] = {
c46782ef
PH		 600 (unsigned int)
601 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
602
603 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 604 0, /* bmi_run */
c46782ef
PH		 605 #endif
606
ed7f7860
PP		 607 0, /* debug */
608
80a47a2c
TK		 609 #ifndef DISABLE_DKIM
610 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
8ccd00b1 611 #ifndef DISABLE_PRDR
fd98a5c6 612 (1<<ACL_WHERE_PRDR)|
8ccd00b1 613 #endif
f7572e5a
TK		 614 (1<<ACL_WHERE_NOTSMTP_START),
615 #endif
616
4840604e
TL		 617 #ifdef EXPERIMENTAL_DMARC
618 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
619 (1<<ACL_WHERE_NOTSMTP_START),
620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
621 (1<<ACL_WHERE_NOTSMTP_START),
622 #endif
623
13363eba
PP		 624 (1<<ACL_WHERE_NOTSMTP)|
625 (1<<ACL_WHERE_NOTSMTP_START)|
626 (1<<ACL_WHERE_NOTQUIT), /* dscp */
627
c5fcb476 628 0, /* error */
8e669ac1
PH		 629
630 (unsigned int)
c5fcb476 631 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 632
633 (unsigned int)
c5fcb476 634 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 635
e4bdf652
JH		 636 (unsigned int)
637 0, /* cutthrough_delivery */
638
45b91596
PH		 639 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
640 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 641
45b91596
PH		 642 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
643 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 644
645 (unsigned int)
c5fcb476
PH		 646 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
647 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 648 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 649 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 659 (1<<ACL_WHERE_PREDATA)),
8523533c 660
8800895a
PH		 661 (unsigned int)
662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 663 (1<<ACL_WHERE_PREDATA)|
664 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 665
c46782ef 666 #ifdef WITH_CONTENT_SCAN
8e669ac1 667 (unsigned int)
14d57970 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 669 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 670 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 671 (1<<ACL_WHERE_MIME)),
c46782ef 672 #endif
a6c4ab60 673
29aba418
TF		 674 (unsigned int)
675 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
676 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 677 #ifndef DISABLE_PRDR
fd98a5c6 678 (1<<ACL_WHERE_PRDR)|
8ccd00b1 679 #endif
29aba418
TF		 680 (1<<ACL_WHERE_MIME)),
681
8e669ac1 682 (unsigned int)
a6c4ab60 683 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 684 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 685 #ifndef DISABLE_PRDR
fd98a5c6 686 (1<<ACL_WHERE_PRDR)|
8ccd00b1 687 #endif
e715ad22 688 (1<<ACL_WHERE_MIME)),
8523533c 689
45b91596 690 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 691 (1<<ACL_WHERE_NOTSMTP_START),
692
693 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 694 (1<<ACL_WHERE_NOTSMTP_START),
695
696 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 697 (1<<ACL_WHERE_NOTSMTP_START),
698
699 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 700 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 701};
702
703/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 704
705typedef struct control_def {
706 uschar *name;
707 int value; /* CONTROL_xxx value */
059ec3d9
PH		 708 BOOL has_option; /* Has /option(s) following */
709} control_def;
710
711static control_def controls_list[] = {
c46782ef 712 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 713#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 714 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 715#endif
ed7f7860 716 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK		 717#ifndef DISABLE_DKIM
718 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 719#endif
720#ifdef EXPERIMENTAL_DMARC
721 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
722 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 723#endif
13363eba 724 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH		 725 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
726 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
727 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
728 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 729 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 730 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH		 731 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
732 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 733 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 734 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 735#ifdef WITH_CONTENT_SCAN
c46782ef 736 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 737#endif
c46782ef
PH		 738 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
739 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
740 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH		 741 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
742 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH		 743 };
744
e5a9dba6
PH		 745/* Support data structures for Client SMTP Authorization. acl_verify_csa()
746caches its result in a tree to avoid repeated DNS queries. The result is an
747integer code which is used as an index into the following tables of
748explanatory strings and verification return codes. */
749
750static tree_node *csa_cache = NULL;
751
752enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
753 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
754
755/* The acl_verify_csa() return code is translated into an acl_verify() return
756code using the following table. It is OK unless the client is definitely not
757authorized. This is because CSA is supposed to be optional for sending sites,
758so recipients should not be too strict about checking it - especially because
759DNS problems are quite likely to occur. It's possible to use $csa_status in
760further ACL conditions to distinguish ok, unknown, and defer if required, but
761the aim is to make the usual configuration simple. */
762
763static int csa_return_code[] = {
764 OK, OK, OK, OK,
765 FAIL, FAIL, FAIL, FAIL
766};
767
768static uschar *csa_status_string[] = {
769 US"unknown", US"ok", US"defer", US"defer",
770 US"fail", US"fail", US"fail", US"fail"
771};
772
773static uschar *csa_reason_string[] = {
774 US"unknown",
775 US"ok",
776 US"deferred (SRV lookup failed)",
777 US"deferred (target address lookup failed)",
778 US"failed (explicit authorization required)",
779 US"failed (host name not authorized)",
780 US"failed (no authorized addresses)",
781 US"failed (client address mismatch)"
782};
783
c99ce5c9
TF		 784/* Options for the ratelimit condition. Note that there are two variants of
785the per_rcpt option, depending on the ACL that is used to measure the rate.
786However any ACL must be able to look up per_rcpt rates in /noupdate mode,
787so the two variants must have the same internal representation as well as
788the same configuration string. */
789
790enum {
791 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
792 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
793};
794
795#define RATE_SET(var,new) \
796 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
797
798static uschar *ratelimit_option_string[] = {
799 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
800 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
801};
802
059ec3d9
PH		 803/* Enable recursion between acl_check_internal() and acl_check_condition() */
804
55414b25 805static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 806 uschar **);
059ec3d9
PH		 807
808
809/*************************************************
810* Pick out name from list *
811*************************************************/
812
813/* Use a binary chop method
814
815Arguments:
816 name name to find
817 list list of names
818 end size of list
819
820Returns: offset in list, or -1 if not found
821*/
822
823static int
824acl_checkname(uschar *name, uschar **list, int end)
825{
826int start = 0;
827
828while (start < end)
829 {
830 int mid = (start + end)/2;
831 int c = Ustrcmp(name, list[mid]);
832 if (c == 0) return mid;
833 if (c < 0) end = mid; else start = mid + 1;
834 }
835
836return -1;
837}
838
839
840/*************************************************
841* Read and parse one ACL *
842*************************************************/
843
844/* This function is called both from readconf in order to parse the ACLs in the
845configuration file, and also when an ACL is encountered dynamically (e.g. as
846the result of an expansion). It is given a function to call in order to
847retrieve the lines of the ACL. This function handles skipping comments and
848blank lines (where relevant).
849
850Arguments:
851 func function to get next line of ACL
852 error where to put an error message
853
854Returns: pointer to ACL, or NULL
855 NULL can be legal (empty ACL); in this case error will be NULL
856*/
857
858acl_block *
859acl_read(uschar *(*func)(void), uschar **error)
860{
861acl_block *yield = NULL;
862acl_block **lastp = &yield;
863acl_block *this = NULL;
864acl_condition_block *cond;
865acl_condition_block **condp = NULL;
866uschar *s;
867
868*error = NULL;
869
870while ((s = (*func)()) != NULL)
871 {
872 int v, c;
873 BOOL negated = FALSE;
874 uschar *saveline = s;
875 uschar name[64];
876
877 /* Conditions (but not verbs) are allowed to be negated by an initial
878 exclamation mark. */
879
880 while (isspace(*s)) s++;
881 if (*s == '!')
882 {
883 negated = TRUE;
884 s++;
885 }
886
cf00dad6
PH		 887 /* Read the name of a verb or a condition, or the start of a new ACL, which
888 can be started by a name, or by a macro definition. */
059ec3d9
PH		 889
890 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 891 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 892
893 /* If a verb is unrecognized, it may be another condition or modifier that
894 continues the previous verb. */
895
896 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
897 if (v < 0)
898 {
899 if (this == NULL)
900 {
4e167a8c
PH		 901 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
902 saveline);
059ec3d9
PH		 903 return NULL;
904 }
905 }
906
907 /* New verb */
908
909 else
910 {
911 if (negated)
912 {
913 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
914 return NULL;
915 }
916 this = store_get(sizeof(acl_block));
917 *lastp = this;
918 lastp = &(this->next);
919 this->next = NULL;
920 this->verb = v;
921 this->condition = NULL;
922 condp = &(this->condition);
923 if (*s == 0) continue; /* No condition on this line */
924 if (*s == '!')
925 {
926 negated = TRUE;
927 s++;
928 }
929 s = readconf_readname(name, sizeof(name), s); /* Condition name */
930 }
931
932 /* Handle a condition or modifier. */
933
934 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
935 if (c < 0)
936 {
937 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
938 saveline);
939 return NULL;
940 }
941
942 /* The modifiers may not be negated */
943
944 if (negated && cond_modifiers[c])
945 {
946 *error = string_sprintf("ACL error: negation is not allowed with "
947 "\"%s\"", conditions[c]);
948 return NULL;
949 }
950
951 /* ENDPASS may occur only with ACCEPT or DISCARD. */
952
953 if (c == ACLC_ENDPASS &&
954 this->verb != ACL_ACCEPT &&
955 this->verb != ACL_DISCARD)
956 {
957 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
958 conditions[c], verbs[this->verb]);
959 return NULL;
960 }
961
962 cond = store_get(sizeof(acl_condition_block));
963 cond->next = NULL;
964 cond->type = c;
965 cond->u.negated = negated;
966
967 *condp = cond;
968 condp = &(cond->next);
969
970 /* The "set" modifier is different in that its argument is "name=value"
971 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 972 gives us a variable name to insert into the data block. The original ACL
973 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
974 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 975 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
976 After that, we allow alphanumerics and underscores, but the first character
977 after c or m must be a digit or an underscore. This retains backwards
978 compatibility. */
059ec3d9
PH		 979
980 if (c == ACLC_SET)
981 {
47ca6d6c
PH		 982 uschar *endptr;
983
38a0a95f
PH		 984 if (Ustrncmp(s, "acl_c", 5) != 0 &&
985 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 986 {
38a0a95f
PH		 987 *error = string_sprintf("invalid variable name after \"set\" in ACL "
988 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
989 return NULL;
47ca6d6c 990 }
38a0a95f
PH		 991
992 endptr = s + 5;
641cb756
PH		 993 if (!isdigit(*endptr) && *endptr != '_')
994 {
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
997 s);
998 return NULL;
999 }
1000
38a0a95f 1001 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1002 {
38a0a95f
PH		 1003 if (!isalnum(*endptr) && *endptr != '_')
1004 {
1005 *error = string_sprintf("invalid character \"%c\" in variable name "
1006 "in ACL modifier \"set %s\"", *endptr, s);
1007 return NULL;
1008 }
1009 endptr++;
47ca6d6c 1010 }
47ca6d6c 1011
38a0a95f 1012 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1013 s = endptr;
059ec3d9
PH		 1014 while (isspace(*s)) s++;
1015 }
1016
1017 /* For "set", we are now positioned for the data. For the others, only
1018 "endpass" has no data */
1019
1020 if (c != ACLC_ENDPASS)
1021 {
1022 if (*s++ != '=')
1023 {
1024 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1025 cond_modifiers[c]? US"modifier" : US"condition");
1026 return NULL;
1027 }
1028 while (isspace(*s)) s++;
1029 cond->arg = string_copy(s);
1030 }
1031 }
1032
1033return yield;
1034}
1035
1036
1037
71fafd95
PH		 1038/*************************************************
1039* Set up added header line(s) *
1040*************************************************/
1041
1042/* This function is called by the add_header modifier, and also from acl_warn()
1043to implement the now-deprecated way of adding header lines using "message" on a
1044"warn" verb. The argument is treated as a sequence of header lines which are
1045added to a chain, provided there isn't an identical one already there.
1046
1047Argument: string of header lines
1048Returns: nothing
1049*/
1050
1051static void
55414b25 1052setup_header(const uschar *hstring)
71fafd95 1053{
55414b25 1054const uschar *p, *q;
71fafd95
PH		 1055int hlen = Ustrlen(hstring);
1056
b1b05573
JH		 1057/* Ignore any leading newlines */
1058while (*hstring == '\n') hstring++, hlen--;
71fafd95 1059
b1b05573 1060/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1061if (hlen <= 0) return;
55414b25
JH		 1062if (hstring[--hlen] != '\n')
1063 q = string_sprintf("%s\n", hstring);
1064else if (hstring[hlen-1] == '\n')
1065 {
1066 uschar * s = string_copy(hstring);
1067 while(s[--hlen] == '\n')
1068 s[hlen+1] = '\0';
1069 q = s;
1070 }
1071else
1072 q = hstring;
71fafd95
PH		 1073
1074/* Loop for multiple header lines, taking care about continuations */
1075
55414b25 1076for (p = q; *p != 0; )
71fafd95 1077 {
55414b25
JH		 1078 const uschar *s;
1079 uschar * hdr;
71fafd95
PH		 1080 int newtype = htype_add_bot;
1081 header_line **hptr = &acl_added_headers;
1082
1083 /* Find next header line within the string */
1084
1085 for (;;)
1086 {
1087 q = Ustrchr(q, '\n');
1088 if (*(++q) != ' ' && *q != '\t') break;
1089 }
1090
1091 /* If the line starts with a colon, interpret the instruction for where to
1092 add it. This temporarily sets up a new type. */
1093
1094 if (*p == ':')
1095 {
1096 if (strncmpic(p, US":after_received:", 16) == 0)
1097 {
1098 newtype = htype_add_rec;
1099 p += 16;
1100 }
1101 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1102 {
1103 newtype = htype_add_rfc;
1104 p += 14;
1105 }
1106 else if (strncmpic(p, US":at_start:", 10) == 0)
1107 {
1108 newtype = htype_add_top;
1109 p += 10;
1110 }
1111 else if (strncmpic(p, US":at_end:", 8) == 0)
1112 {
1113 newtype = htype_add_bot;
1114 p += 8;
1115 }
1116 while (*p == ' ' || *p == '\t') p++;
1117 }
1118
1119 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1120 to the front of it. */
1121
1122 for (s = p; s < q - 1; s++)
1123 {
1124 if (*s == ':' || !isgraph(*s)) break;
1125 }
1126
55414b25
JH		 1127 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1128 hlen = Ustrlen(hdr);
71fafd95
PH		 1129
1130 /* See if this line has already been added */
1131
1132 while (*hptr != NULL)
1133 {
55414b25 1134 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1135 hptr = &((*hptr)->next);
1136 }
1137
1138 /* Add if not previously present */
1139
1140 if (*hptr == NULL)
1141 {
1142 header_line *h = store_get(sizeof(header_line));
55414b25 1143 h->text = hdr;
71fafd95
PH		 1144 h->next = NULL;
1145 h->type = newtype;
1146 h->slen = hlen;
1147 *hptr = h;
1148 hptr = &(h->next);
1149 }
1150
1151 /* Advance for next header line within the string */
1152
1153 p = q;
1154 }
1155}
1156
1157
1158
362145b5
JH		 1159/*************************************************
1160* List the added header lines *
1161*************************************************/
1162uschar *
1163fn_hdrs_added(void)
1164{
1165uschar * ret = NULL;
1166header_line * h = acl_added_headers;
1167uschar * s;
1168uschar * cp;
1169int size = 0;
1170int ptr = 0;
1171
1172if (!h) return NULL;
1173
1174do
1175 {
1176 s = h->text;
1177 while ((cp = Ustrchr(s, '\n')) != NULL)
1178 {
1179 if (cp[1] == '\0') break;
1180
1181 /* contains embedded newline; needs doubling */
1182 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1183 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1184 s = cp+1;
1185 }
1186 /* last bit of header */
1187
1188 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1189 }
6d9cfc47 1190while((h = h->next));
362145b5
JH		 1191
1192ret[ptr-1] = '\0'; /* overwrite last newline */
1193return ret;
1194}
1195
1196
e7568d51
TL		 1197/*************************************************
1198* Set up removed header line(s) *
1199*************************************************/
1200
1201/* This function is called by the remove_header modifier. The argument is
1202treated as a sequence of header names which are added to a colon separated
1203list, provided there isn't an identical one already there.
1204
1205Argument: string of header names
1206Returns: nothing
1207*/
1208
1209static void
55414b25 1210setup_remove_header(const uschar *hnames)
e7568d51
TL		 1211{
1212if (*hnames != 0)
55414b25
JH		 1213 acl_removed_headers = acl_removed_headers
1214 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1215 : string_copy(hnames);
e7568d51
TL		 1216}
1217
1218
71fafd95 1219
059ec3d9
PH		 1220/*************************************************
1221* Handle warnings *
1222*************************************************/
1223
1224/* This function is called when a WARN verb's conditions are true. It adds to
1225the message's headers, and/or writes information to the log. In each case, this
1226only happens once (per message for headers, per connection for log).
1227
71fafd95
PH		 1228** NOTE: The header adding action using the "message" setting is historic, and
1229its use is now deprecated. The new add_header modifier should be used instead.
1230
059ec3d9
PH		 1231Arguments:
1232 where ACL_WHERE_xxxx indicating which ACL this is
1233 user_message message for adding to headers
1234 log_message message for logging, if different
1235
1236Returns: nothing
1237*/
1238
1239static void
1240acl_warn(int where, uschar *user_message, uschar *log_message)
1241{
059ec3d9
PH		 1242if (log_message != NULL && log_message != user_message)
1243 {
1244 uschar *text;
1245 string_item *logged;
1246
1247 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1248 string_printing(log_message));
1249
1250 /* If a sender verification has failed, and the log message is "sender verify
1251 failed", add the failure message. */
1252
1253 if (sender_verified_failed != NULL &&
1254 sender_verified_failed->message != NULL &&
1255 strcmpic(log_message, US"sender verify failed") == 0)
1256 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1257
9c7a242c
PH		 1258 /* Search previously logged warnings. They are kept in malloc
1259 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1260
1261 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1262 if (Ustrcmp(logged->text, text) == 0) break;
1263
1264 if (logged == NULL)
1265 {
1266 int length = Ustrlen(text) + 1;
1267 log_write(0, LOG_MAIN, "%s", text);
1268 logged = store_malloc(sizeof(string_item) + length);
1269 logged->text = (uschar *)logged + sizeof(string_item);
1270 memcpy(logged->text, text, length);
1271 logged->next = acl_warn_logged;
1272 acl_warn_logged = logged;
1273 }
1274 }
1275
1276/* If there's no user message, we are done. */
1277
1278if (user_message == NULL) return;
1279
1280/* If this isn't a message ACL, we can't do anything with a user message.
1281Log an error. */
1282
1283if (where > ACL_WHERE_NOTSMTP)
1284 {
1285 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1286 "found in a non-message (%s) ACL: cannot specify header lines here: "
1287 "message ignored", acl_wherenames[where]);
1288 return;
1289 }
1290
71fafd95
PH		 1291/* The code for setting up header lines is now abstracted into a separate
1292function so that it can be used for the add_header modifier as well. */
059ec3d9 1293
71fafd95 1294setup_header(user_message);
059ec3d9
PH		 1295}
1296
1297
1298
1299/*************************************************
1300* Verify and check reverse DNS *
1301*************************************************/
1302
1303/* Called from acl_verify() below. We look up the host name(s) of the client IP
1304address if this has not yet been done. The host_name_lookup() function checks
1305that one of these names resolves to an address list that contains the client IP
1306address, so we don't actually have to do the check here.
1307
1308Arguments:
1309 user_msgptr pointer for user message
1310 log_msgptr pointer for log message
1311
1312Returns: OK verification condition succeeded
1313 FAIL verification failed
1314 DEFER there was a problem verifying
1315*/
1316
1317static int
1318acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1319{
1320int rc;
1321
1322user_msgptr = user_msgptr; /* stop compiler warning */
1323
1324/* Previous success */
1325
1326if (sender_host_name != NULL) return OK;
1327
1328/* Previous failure */
1329
1330if (host_lookup_failed)
1331 {
1332 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1333 return FAIL;
1334 }
1335
1336/* Need to do a lookup */
1337
1338HDEBUG(D_acl)
1339 debug_printf("looking up host name to force name/address consistency check\n");
1340
1341if ((rc = host_name_lookup()) != OK)
1342 {
1343 *log_msgptr = (rc == DEFER)?
1344 US"host lookup deferred for reverse lookup check"
1345 :
1346 string_sprintf("host lookup failed for reverse lookup check%s",
1347 host_lookup_msg);
1348 return rc; /* DEFER or FAIL */
1349 }
1350
1351host_build_sender_fullhost();
1352return OK;
1353}
1354
1355
1356
e5a9dba6
PH		 1357/*************************************************
1358* Check client IP address matches CSA target *
1359*************************************************/
1360
1361/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1362response for address records belonging to the CSA target hostname. The section
1363is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1364If one of the addresses matches the client's IP address, then the client is
1365authorized by CSA. If there are target IP addresses but none of them match
1366then the client is using an unauthorized IP address. If there are no target IP
1367addresses then the client cannot be using an authorized IP address. (This is
1368an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1369
1370Arguments:
1371 dnsa the DNS answer block
1372 dnss a DNS scan block for us to use
1373 reset option specifing what portion to scan, as described above
1374 target the target hostname to use for matching RR names
1375
1376Returns: CSA_OK successfully authorized
1377 CSA_FAIL_MISMATCH addresses found but none matched
1378 CSA_FAIL_NOADDR no target addresses found
1379*/
1380
1381static int
1382acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1383 uschar *target)
1384{
1385dns_record *rr;
1386dns_address *da;
1387
1388BOOL target_found = FALSE;
1389
1390for (rr = dns_next_rr(dnsa, dnss, reset);
1391 rr != NULL;
1392 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1393 {
1394 /* Check this is an address RR for the target hostname. */
1395
1396 if (rr->type != T_A
1397 #if HAVE_IPV6
1398 && rr->type != T_AAAA
e5a9dba6
PH		 1399 #endif
1400 ) continue;
1401
1402 if (strcmpic(target, rr->name) != 0) continue;
1403
1404 target_found = TRUE;
1405
1406 /* Turn the target address RR into a list of textual IP addresses and scan
1407 the list. There may be more than one if it is an A6 RR. */
1408
1409 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1410 {
1411 /* If the client IP address matches the target IP address, it's good! */
1412
1413 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1414
1415 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1416 }
1417 }
1418
1419/* If we found some target addresses but none of them matched, the client is
1420using an unauthorized IP address, otherwise the target has no authorized IP
1421addresses. */
1422
1423if (target_found) return CSA_FAIL_MISMATCH;
1424else return CSA_FAIL_NOADDR;
1425}
1426
1427
1428
1429/*************************************************
1430* Verify Client SMTP Authorization *
1431*************************************************/
1432
1433/* Called from acl_verify() below. This routine calls dns_lookup_special()
1434to find the CSA SRV record corresponding to the domain argument, or
1435$sender_helo_name if no argument is provided. It then checks that the
1436client is authorized, and that its IP address corresponds to the SRV
1437target's address by calling acl_verify_csa_address() above. The address
1438should have been returned in the DNS response's ADDITIONAL section, but if
1439not we perform another DNS lookup to get it.
1440
1441Arguments:
1442 domain pointer to optional parameter following verify = csa
1443
1444Returns: CSA_UNKNOWN no valid CSA record found
1445 CSA_OK successfully authorized
1446 CSA_FAIL_* client is definitely not authorized
1447 CSA_DEFER_* there was a DNS problem
1448*/
1449
1450static int
55414b25 1451acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1452{
1453tree_node *t;
55414b25
JH		 1454const uschar *found;
1455uschar *p;
e5a9dba6
PH		 1456int priority, weight, port;
1457dns_answer dnsa;
1458dns_scan dnss;
1459dns_record *rr;
1460int rc, type;
1461uschar target[256];
1462
1463/* Work out the domain we are using for the CSA lookup. The default is the
1464client's HELO domain. If the client has not said HELO, use its IP address
1465instead. If it's a local client (exim -bs), CSA isn't applicable. */
1466
1467while (isspace(*domain) && *domain != '\0') ++domain;
1468if (*domain == '\0') domain = sender_helo_name;
1469if (domain == NULL) domain = sender_host_address;
1470if (sender_host_address == NULL) return CSA_UNKNOWN;
1471
1472/* If we have an address literal, strip off the framing ready for turning it
1473into a domain. The framing consists of matched square brackets possibly
1474containing a keyword and a colon before the actual IP address. */
1475
1476if (domain[0] == '[')
1477 {
55414b25 1478 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1479 if (start == NULL) start = domain;
1480 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1481 }
1482
1483/* Turn domains that look like bare IP addresses into domains in the reverse
1484DNS. This code also deals with address literals and $sender_host_address. It's
1485not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1486address literals, but it's probably the most friendly thing to do. This is an
1487extension to CSA, so we allow it to be turned off for proper conformance. */
1488
7e66e54d 1489if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1490 {
1491 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1492 dns_build_reverse(domain, target);
1493 domain = target;
1494 }
1495
1496/* Find out if we've already done the CSA check for this domain. If we have,
1497return the same result again. Otherwise build a new cached result structure
1498for this domain. The name is filled in now, and the value is filled in when
1499we return from this function. */
1500
1501t = tree_search(csa_cache, domain);
1502if (t != NULL) return t->data.val;
1503
1504t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1505Ustrcpy(t->name, domain);
1506(void)tree_insertnode(&csa_cache, t);
1507
1508/* Now we are ready to do the actual DNS lookup(s). */
1509
28e6ef29 1510found = domain;
e5a9dba6
PH		 1511switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1512 {
1513 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1514
1515 default:
1516 return t->data.val = CSA_DEFER_SRV;
1517
1518 /* If we found nothing, the client's authorization is unknown. */
1519
1520 case DNS_NOMATCH:
1521 case DNS_NODATA:
1522 return t->data.val = CSA_UNKNOWN;
1523
1524 /* We got something! Go on to look at the reply in more detail. */
1525
1526 case DNS_SUCCEED:
1527 break;
1528 }
1529
1530/* Scan the reply for well-formed CSA SRV records. */
1531
1532for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1533 rr != NULL;
1534 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1535 {
1536 if (rr->type != T_SRV) continue;
1537
1538 /* Extract the numerical SRV fields (p is incremented) */
1539
1540 p = rr->data;
1541 GETSHORT(priority, p);
1542 GETSHORT(weight, p);
1543 GETSHORT(port, p);
1544
1545 DEBUG(D_acl)
1546 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1547
1548 /* Check the CSA version number */
1549
1550 if (priority != 1) continue;
1551
1552 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1553 found by dns_special_lookup() is a parent of the one we asked for), we check
1554 the subdomain assertions in the port field. At the moment there's only one
1555 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1556 SRV records of their own. */
1557
1dc92d5a 1558 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1559 {
1560 if (port & 1)
1561 return t->data.val = CSA_FAIL_EXPLICIT;
1562 else
1563 return t->data.val = CSA_UNKNOWN;
1564 }
1565
1566 /* This CSA SRV record refers directly to our domain, so we check the value
1567 in the weight field to work out the domain's authorization. 0 and 1 are
1568 unauthorized; 3 means the client is authorized but we can't check the IP
1569 address in order to authenticate it, so we treat it as unknown; values
1570 greater than 3 are undefined. */
1571
1572 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1573
1574 if (weight > 2) continue;
1575
1576 /* Weight == 2, which means the domain is authorized. We must check that the
1577 client's IP address is listed as one of the SRV target addresses. Save the
1578 target hostname then break to scan the additional data for its addresses. */
1579
1580 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1581 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1582
1583 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1584
1585 break;
1586 }
1587
1588/* If we didn't break the loop then no appropriate records were found. */
1589
1590if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1591
1592/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1593A target of "." indicates there are no valid addresses, so the client cannot
1594be authorized. (This is an odd configuration because weight=2 target=. is
1595equivalent to weight=1, but we check for it in order to keep load off the
1596root name servers.) Note that dn_expand() turns "." into "". */
1597
1598if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1599
1600/* Scan the additional section of the CSA SRV reply for addresses belonging
1601to the target. If the name server didn't return any additional data (e.g.
1602because it does not fully support SRV records), we need to do another lookup
1603to obtain the target addresses; otherwise we have a definitive result. */
1604
1605rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1606if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1607
1608/* The DNS lookup type corresponds to the IP version used by the client. */
1609
1610#if HAVE_IPV6
1611if (Ustrchr(sender_host_address, ':') != NULL)
1612 type = T_AAAA;
1613else
1614#endif /* HAVE_IPV6 */
1615 type = T_A;
1616
1617
4e0983dc 1618lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1619switch (dns_lookup(&dnsa, target, type, NULL))
1620 {
1621 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1622
1623 default:
cc00f4af 1624 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1625
1626 /* If the query succeeded, scan the addresses and return the result. */
1627
1628 case DNS_SUCCEED:
cc00f4af
JH		 1629 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1630 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1631 /* else fall through */
e5a9dba6
PH		 1632
1633 /* If the target has no IP addresses, the client cannot have an authorized
1634 IP address. However, if the target site uses A6 records (not AAAA records)
1635 we have to do yet another lookup in order to check them. */
1636
1637 case DNS_NOMATCH:
1638 case DNS_NODATA:
cc00f4af 1639 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1640 }
1641}
1642
1643
1644
059ec3d9
PH		 1645/*************************************************
1646* Handle verification (address & other) *
1647*************************************************/
1648
89583014 1649enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1650 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1651 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1652 };
1653typedef struct {
1654 uschar * name;
1655 int value;
1656 unsigned where_allowed; /* bitmap */
1657 BOOL no_options; /* Never has /option(s) following */
1658 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1659 } verify_type_t;
1660static verify_type_t verify_type_list[] = {
7e8360e6 1661 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1662 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1663 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1664 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1665 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1666 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1667 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1668 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1669 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1670 FALSE, 6 },
770747fd
MFM		 1671 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1672 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1673 };
1674
1675
1676enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1677 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1678 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1679 CALLOUT_TIME
1680 };
1681typedef struct {
1682 uschar * name;
1683 int value;
1684 int flag;
1685 BOOL has_option; /* Has =option(s) following */
1686 BOOL timeval; /* Has a time value */
1687 } callout_opt_t;
1688static callout_opt_t callout_opt_list[] = {
1689 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1690 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1691 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1692 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1693 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1694 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1695 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1696 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1697 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1698 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1699 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1700 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1701 };
1702
1703
1704
059ec3d9
PH		 1705/* This function implements the "verify" condition. It is called when
1706encountered in any ACL, because some tests are almost always permitted. Some
1707just don't make sense, and always fail (for example, an attempt to test a host
1708lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1709
1710Arguments:
1711 where where called from
1712 addr the recipient address that the ACL is handling, or NULL
1713 arg the argument of "verify"
1714 user_msgptr pointer for user message
1715 log_msgptr pointer for log message
1716 basic_errno where to put verify errno
1717
1718Returns: OK verification condition succeeded
1719 FAIL verification failed
1720 DEFER there was a problem verifying
1721 ERROR syntax error
1722*/
1723
1724static int
55414b25 1725acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1726 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1727{
1728int sep = '/';
1729int callout = -1;
1730int callout_overall = -1;
4deaf07d 1731int callout_connect = -1;
059ec3d9
PH		 1732int verify_options = 0;
1733int rc;
1734BOOL verify_header_sender = FALSE;
1735BOOL defer_ok = FALSE;
1736BOOL callout_defer_ok = FALSE;
1737BOOL no_details = FALSE;
eafd343b 1738BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1739address_item *sender_vaddr = NULL;
1740uschar *verify_sender_address = NULL;
1741uschar *pm_mailfrom = NULL;
1742uschar *se_mailfrom = NULL;
596875b3
PH		 1743
1744/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1745an error if options are given for items that don't expect them.
596875b3
PH		 1746*/
1747
1748uschar *slash = Ustrchr(arg, '/');
55414b25 1749const uschar *list = arg;
059ec3d9 1750uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1751verify_type_t * vp;
059ec3d9
PH		 1752
1753if (ss == NULL) goto BAD_VERIFY;
1754
1755/* Handle name/address consistency verification in a separate function. */
1756
89583014
JH		 1757for (vp= verify_type_list;
1758 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1759 vp++
1760 )
1761 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1762 : strcmpic (ss, vp->name) == 0)
1763 break;
1764if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1765 goto BAD_VERIFY;
1766
1767if (vp->no_options && slash != NULL)
059ec3d9 1768 {
89583014
JH		 1769 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1770 "(this verify item has no options)", arg);
1771 return ERROR;
059ec3d9 1772 }
89583014 1773if (!(vp->where_allowed & (1<<where)))
059ec3d9 1774 {
89583014
JH		 1775 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1776 return ERROR;
059ec3d9 1777 }
89583014 1778switch(vp->value)
596875b3 1779 {
89583014
JH		 1780 case VERIFY_REV_HOST_LKUP:
1781 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1782 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1783 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1784 if (strcmpic(ss, US"defer_ok") == 0)
1785 return OK;
1786 return rc;
059ec3d9 1787
89583014
JH		 1788 case VERIFY_CERT:
1789 /* TLS certificate verification is done at STARTTLS time; here we just
1790 test whether it was successful or not. (This is for optional verification; for
1791 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1792
817d9f57 1793 if (tls_in.certificate_verified) return OK;
89583014
JH		 1794 *user_msgptr = US"no verified certificate";
1795 return FAIL;
e5a9dba6 1796
89583014
JH		 1797 case VERIFY_HELO:
1798 /* We can test the result of optional HELO verification that might have
1799 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1800
89583014
JH		 1801 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1802 return helo_verified? OK : FAIL;
059ec3d9 1803
89583014
JH		 1804 case VERIFY_CSA:
1805 /* Do Client SMTP Authorization checks in a separate function, and turn the
1806 result code into user-friendly strings. */
1c41c9cc 1807
89583014
JH		 1808 rc = acl_verify_csa(list);
1809 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1810 csa_reason_string[rc]);
1811 csa_status = csa_status_string[rc];
1812 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1813 return csa_return_code[rc];
1814
1815 case VERIFY_HDR_SYNTAX:
1816 /* Check that all relevant header lines have the correct syntax. If there is
1817 a syntax error, we return details of the error to the sender if configured to
1818 send out full details. (But a "message" setting on the ACL can override, as
1819 always). */
1820
1821 rc = verify_check_headers(log_msgptr);
1822 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1823 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1824 return rc;
059ec3d9 1825
770747fd
MFM		 1826 case VERIFY_HDR_NAMES_ASCII:
1827 /* Check that all header names are true 7 bit strings
1828 See RFC 5322, 2.2. and RFC 6532, 3. */
1829
1830 rc = verify_check_header_names_ascii(log_msgptr);
1831 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 return rc;
1834
89583014
JH		 1835 case VERIFY_NOT_BLIND:
1836 /* Check that no recipient of this message is "blind", that is, every envelope
1837 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1838
89583014
JH		 1839 rc = verify_check_notblind();
1840 if (rc != OK)
1841 {
1842 *log_msgptr = string_sprintf("bcc recipient detected");
1843 if (smtp_return_error_details)
1844 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1845 }
1846 return rc;
059ec3d9 1847
89583014
JH		 1848 /* The remaining verification tests check recipient and sender addresses,
1849 either from the envelope or from the header. There are a number of
1850 slash-separated options that are common to all of them. */
059ec3d9 1851
89583014
JH		 1852 case VERIFY_HDR_SNDR:
1853 verify_header_sender = TRUE;
1854 break;
059ec3d9 1855
89583014
JH		 1856 case VERIFY_SNDR:
1857 /* In the case of a sender, this can optionally be followed by an address to use
1858 in place of the actual sender (rare special-case requirement). */
059ec3d9 1859 {
89583014
JH		 1860 uschar *s = ss + 6;
1861 if (*s == 0)
1862 verify_sender_address = sender_address;
1863 else
1864 {
1865 while (isspace(*s)) s++;
1866 if (*s++ != '=') goto BAD_VERIFY;
1867 while (isspace(*s)) s++;
1868 verify_sender_address = string_copy(s);
1869 }
059ec3d9 1870 }
89583014
JH		 1871 break;
1872
1873 case VERIFY_RCPT:
1874 break;
059ec3d9
PH		 1875 }
1876
89583014
JH		 1877
1878
596875b3
PH		 1879/* Remaining items are optional; they apply to sender and recipient
1880verification, including "header sender" verification. */
059ec3d9
PH		 1881
1882while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1883 != NULL)
1884 {
1885 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1886 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1887 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1888
1889 /* These two old options are left for backwards compatibility */
1890
1891 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1892 {
1893 callout_defer_ok = TRUE;
1894 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1895 }
1896
1897 else if (strcmpic(ss, US"check_postmaster") == 0)
1898 {
1899 pm_mailfrom = US"";
1900 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1901 }
1902
1903 /* The callout option has a number of sub-options, comma separated */
1904
1905 else if (strncmpic(ss, US"callout", 7) == 0)
1906 {
1907 callout = CALLOUT_TIMEOUT_DEFAULT;
1908 ss += 7;
1909 if (*ss != 0)
1910 {
1911 while (isspace(*ss)) ss++;
1912 if (*ss++ == '=')
1913 {
55414b25 1914 const uschar * sublist = ss;
059ec3d9
PH		 1915 int optsep = ',';
1916 uschar *opt;
1917 uschar buffer[256];
55414b25 1918 while (isspace(*sublist)) sublist++;
8e669ac1 1919
55414b25 1920 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1921 != NULL)
1922 {
89583014 1923 callout_opt_t * op;
438257ba 1924 double period = 1.0F;
059ec3d9 1925
89583014 1926 for (op= callout_opt_list; op->name; op++)
438257ba 1927 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1928 break;
059ec3d9 1929
89583014
JH		 1930 verify_options |= op->flag;
1931 if (op->has_option)
1932 {
438257ba 1933 opt += Ustrlen(op->name);
4deaf07d
PH		 1934 while (isspace(*opt)) opt++;
1935 if (*opt++ != '=')
1936 {
1937 *log_msgptr = string_sprintf("'=' expected after "
89583014 1938 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1939 return ERROR;
1940 }
1941 while (isspace(*opt)) opt++;
89583014
JH		 1942 }
1943 if (op->timeval)
1944 {
1945 period = readconf_readtime(opt, 0, FALSE);
1946 if (period < 0)
4deaf07d
PH		 1947 {
1948 *log_msgptr = string_sprintf("bad time value in ACL condition "
1949 "\"verify %s\"", arg);
1950 return ERROR;
1951 }
89583014
JH		 1952 }
1953
1954 switch(op->value)
1955 {
1956 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1957 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1958 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1959 case CALLOUT_MAILFROM:
1960 if (!verify_header_sender)
1961 {
1962 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1963 "callout option only for verify=header_sender (detected in ACL "
1964 "condition \"%s\")", arg);
1965 return ERROR;
1966 }
1967 se_mailfrom = string_copy(opt);
1968 break;
1969 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1970 case CALLOUT_MAXWAIT: callout_overall = period; break;
1971 case CALLOUT_CONNECT: callout_connect = period; break;
1972 case CALLOUT_TIME: callout = period; break;
1973 }
059ec3d9
PH		 1974 }
1975 }
1976 else
1977 {
1978 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1979 "ACL condition \"%s\"", arg);
1980 return ERROR;
1981 }
1982 }
1983 }
1984
1985 /* Option not recognized */
1986
1987 else
1988 {
1989 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1990 "condition \"verify %s\"", ss, arg);
1991 return ERROR;
1992 }
1993 }
1994
1995if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1996 (vopt_callout_recipsender|vopt_callout_recippmaster))
1997 {
1998 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1999 "for a recipient callout";
2000 return ERROR;
2001 }
2002
2003/* Handle sender-in-header verification. Default the user message to the log
2004message if giving out verification details. */
2005
2006if (verify_header_sender)
2007 {
8e669ac1 2008 int verrno;
059ec3d9 2009 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2010 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2011 &verrno);
2012 if (rc != OK)
8e669ac1 2013 {
fe5b5d0b
PH		 2014 *basic_errno = verrno;
2015 if (smtp_return_error_details)
2016 {
2017 if (*user_msgptr == NULL && *log_msgptr != NULL)
2018 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2019 if (rc == DEFER) acl_temp_details = TRUE;
2020 }
8e669ac1 2021 }
059ec3d9
PH		 2022 }
2023
2024/* Handle a sender address. The default is to verify *the* sender address, but
2025optionally a different address can be given, for special requirements. If the
2026address is empty, we are dealing with a bounce message that has no sender, so
2027we cannot do any checking. If the real sender address gets rewritten during
2028verification (e.g. DNS widening), set the flag to stop it being rewritten again
2029during message reception.
2030
2031A list of verified "sender" addresses is kept to try to avoid doing to much
2032work repetitively when there are multiple recipients in a message and they all
2033require sender verification. However, when callouts are involved, it gets too
2034complicated because different recipients may require different callout options.
2035Therefore, we always do a full sender verify when any kind of callout is
2036specified. Caching elsewhere, for instance in the DNS resolver and in the
2037callout handling, should ensure that this is not terribly inefficient. */
2038
2039else if (verify_sender_address != NULL)
2040 {
2041 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2042 != 0)
2043 {
2044 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2045 "sender verify callout";
2046 return ERROR;
2047 }
2048
2049 sender_vaddr = verify_checked_sender(verify_sender_address);
2050 if (sender_vaddr != NULL && /* Previously checked */
2051 callout <= 0) /* No callout needed this time */
2052 {
2053 /* If the "routed" flag is set, it means that routing worked before, so
2054 this check can give OK (the saved return code value, if set, belongs to a
2055 callout that was done previously). If the "routed" flag is not set, routing
2056 must have failed, so we use the saved return code. */
2057
2058 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2059 {
2060 rc = sender_vaddr->special_action;
2061 *basic_errno = sender_vaddr->basic_errno;
2062 }
2063 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2064 }
2065
2066 /* Do a new verification, and cache the result. The cache is used to avoid
2067 verifying the sender multiple times for multiple RCPTs when callouts are not
2068 specified (see comments above).
2069
2070 The cache is also used on failure to give details in response to the first
2071 RCPT that gets bounced for this reason. However, this can be suppressed by
2072 the no_details option, which sets the flag that says "this detail has already
2073 been sent". The cache normally contains just one address, but there may be
2074 more in esoteric circumstances. */
2075
2076 else
2077 {
2078 BOOL routed = TRUE;
2a3eea10 2079 uschar *save_address_data = deliver_address_data;
8e669ac1 2080
059ec3d9 2081 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
f358d5e0
JH		 2082#ifdef EXPERIMENTAL_INTERNATIONAL
2083 sender_vaddr->p.utf8 = message_smtputf8;
2084#endif
059ec3d9
PH		 2085 if (no_details) setflag(sender_vaddr, af_sverify_told);
2086 if (verify_sender_address[0] != 0)
2087 {
2088 /* If this is the real sender address, save the unrewritten version
2089 for use later in receive. Otherwise, set a flag so that rewriting the
2090 sender in verify_address() does not update sender_address. */
2091
2092 if (verify_sender_address == sender_address)
2093 sender_address_unrewritten = sender_address;
2094 else
2095 verify_options |= vopt_fake_sender;
2096
eafd343b
TK		 2097 if (success_on_redirect)
2098 verify_options |= vopt_success_on_redirect;
2099
059ec3d9
PH		 2100 /* The recipient, qualify, and expn options are never set in
2101 verify_options. */
2102
2103 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2104 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2105
2106 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2107
2108 if (rc == OK)
2109 {
2110 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2111 {
2112 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2113 verify_sender_address, sender_vaddr->address);
2114 }
2115 else
2116 {
2117 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2118 verify_sender_address);
2119 }
2120 }
2121 else *basic_errno = sender_vaddr->basic_errno;
2122 }
2123 else rc = OK; /* Null sender */
2124
2125 /* Cache the result code */
2126
2127 if (routed) setflag(sender_vaddr, af_verify_routed);
2128 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2129 sender_vaddr->special_action = rc;
2130 sender_vaddr->next = sender_verified_list;
2131 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2132
2133 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2134 the sender verification. */
8e669ac1 2135
2a3eea10 2136 deliver_address_data = save_address_data;
059ec3d9 2137 }
8e669ac1 2138
2a3eea10
PH		 2139 /* Put the sender address_data value into $sender_address_data */
2140
8e669ac1 2141 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH		 2142 }
2143
2144/* A recipient address just gets a straightforward verify; again we must handle
2145the DEFER overrides. */
2146
2147else
2148 {
2149 address_item addr2;
2150
eafd343b
TK		 2151 if (success_on_redirect)
2152 verify_options |= vopt_success_on_redirect;
2153
059ec3d9
PH		 2154 /* We must use a copy of the address for verification, because it might
2155 get rewritten. */
2156
2157 addr2 = *addr;
2158 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2159 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2160 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2161
42855d71 2162 *basic_errno = addr2.basic_errno;
059ec3d9 2163 *log_msgptr = addr2.message;
8e669ac1 2164 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2165 addr2.user_message : addr2.message;
42855d71
PH		 2166
2167 /* Allow details for temporary error if the address is so flagged. */
2168 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2169
2170 /* Make $address_data visible */
2171 deliver_address_data = addr2.p.address_data;
2172 }
2173
2174/* We have a result from the relevant test. Handle defer overrides first. */
2175
2176if (rc == DEFER && (defer_ok ||
2177 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2178 {
2179 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2180 defer_ok? "defer_ok" : "callout_defer_ok");
2181 rc = OK;
2182 }
2183
2184/* If we've failed a sender, set up a recipient message, and point
2185sender_verified_failed to the address item that actually failed. */
2186
2187if (rc != OK && verify_sender_address != NULL)
2188 {
2189 if (rc != DEFER)
2190 {
2191 *log_msgptr = *user_msgptr = US"Sender verify failed";
2192 }
2193 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2194 {
2195 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2196 }
2197 else
2198 {
2199 *log_msgptr = US"Could not complete sender verify callout";
2200 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2201 *log_msgptr;
2202 }
2203
2204 sender_verified_failed = sender_vaddr;
2205 }
2206
2207/* Verifying an address messes up the values of $domain and $local_part,
2208so reset them before returning if this is a RCPT ACL. */
2209
2210if (addr != NULL)
2211 {
2212 deliver_domain = addr->domain;
2213 deliver_localpart = addr->local_part;
2214 }
2215return rc;
2216
2217/* Syntax errors in the verify argument come here. */
2218
2219BAD_VERIFY:
2220*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2221 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2222 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2223 "\"verify %s\"", arg);
2224return ERROR;
2225}
2226
2227
2228
2229
2230/*************************************************
2231* Check argument for control= modifier *
2232*************************************************/
2233
2234/* Called from acl_check_condition() below
2235
2236Arguments:
2237 arg the argument string for control=
2238 pptr set to point to the terminating character
2239 where which ACL we are in
2240 log_msgptr for error messages
2241
2242Returns: CONTROL_xxx value
2243*/
2244
2245static int
55414b25 2246decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2247{
2248int len;
2249control_def *d;
2250
2251for (d = controls_list;
2252 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2253 d++)
2254 {
2255 len = Ustrlen(d->name);
2256 if (Ustrncmp(d->name, arg, len) == 0) break;
2257 }
2258
2259if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2260 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2261 {
2262 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2263 return CONTROL_ERROR;
2264 }
2265
059ec3d9
PH		 2266*pptr = arg + len;
2267return d->value;
2268}
2269
2270
2271
c99ce5c9
TF		 2272
2273/*************************************************
2274* Return a ratelimit error *
2275*************************************************/
2276
2277/* Called from acl_ratelimit() below
2278
2279Arguments:
2280 log_msgptr for error messages
2281 format format string
2282 ... supplementary arguments
2283 ss ratelimit option name
2284 where ACL_WHERE_xxxx indicating which ACL this is
2285
2286Returns: ERROR
2287*/
2288
2289static int
2290ratelimit_error(uschar **log_msgptr, const char *format, ...)
2291{
2292va_list ap;
2293uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2294va_start(ap, format);
2295if (!string_vformat(buffer, sizeof(buffer), format, ap))
2296 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2297 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2298va_end(ap);
2299*log_msgptr = string_sprintf(
2300 "error in arguments to \"ratelimit\" condition: %s", buffer);
2301return ERROR;
2302}
2303
2304
2305
2306
870f6ba8
TF		 2307/*************************************************
2308* Handle rate limiting *
2309*************************************************/
2310
2311/* Called by acl_check_condition() below to calculate the result
2312of the ACL ratelimit condition.
2313
2314Note that the return value might be slightly unexpected: if the
2315sender's rate is above the limit then the result is OK. This is
2316similar to the dnslists condition, and is so that you can write
2317ACL clauses like: defer ratelimit = 15 / 1h
2318
2319Arguments:
2320 arg the option string for ratelimit=
90fc3069 2321 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2322 log_msgptr for error messages
2323
2324Returns: OK - Sender's rate is above limit
2325 FAIL - Sender's rate is below limit
2326 DEFER - Problem opening ratelimit database
2327 ERROR - Syntax error in options.
2328*/
2329
2330static int
55414b25 2331acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2332{
c99ce5c9 2333double limit, period, count;
8f240103
PH		 2334uschar *ss;
2335uschar *key = NULL;
c99ce5c9 2336uschar *unique = NULL;
870f6ba8 2337int sep = '/';
c99ce5c9
TF		 2338BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2339BOOL noupdate = FALSE, badacl = FALSE;
2340int mode = RATE_PER_WHAT;
870f6ba8
TF		 2341int old_pool, rc;
2342tree_node **anchor, *t;
2343open_db dbblock, *dbm;
c99ce5c9 2344int dbdb_size;
870f6ba8 2345dbdata_ratelimit *dbd;
c99ce5c9 2346dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2347struct timeval tv;
2348
2349/* Parse the first two options and record their values in expansion
2350variables. These variables allow the configuration to have informative
2351error messages based on rate limits obtained from a table lookup. */
2352
c99ce5c9 2353/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2354size, which must be greater than or equal to zero. Zero is useful for
2355rate measurement as opposed to rate limiting. */
2356
2357sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2358if (sender_rate_limit == NULL)
288644dd 2359 {
870f6ba8 2360 limit = -1.0;
288644dd
JH		 2361 ss = NULL; /* compiler quietening */
2362 }
870f6ba8
TF		 2363else
2364 {
2365 limit = Ustrtod(sender_rate_limit, &ss);
2366 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2367 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2368 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2369 }
c99ce5c9
TF		 2370if (limit < 0.0 || *ss != '\0')
2371 return ratelimit_error(log_msgptr,
2372 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2373
c99ce5c9 2374/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2375constant. This must be strictly greater than zero, because zero leads to
2376run-time division errors. */
2377
2378sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2379if (sender_rate_period == NULL) period = -1.0;
2380else period = readconf_readtime(sender_rate_period, 0, FALSE);
2381if (period <= 0.0)
c99ce5c9
TF		 2382 return ratelimit_error(log_msgptr,
2383 "\"%s\" is not a time value", sender_rate_period);
2384
2385/* By default we are counting one of something, but the per_rcpt,
2386per_byte, and count options can change this. */
2387
2388count = 1.0;
870f6ba8 2389
c99ce5c9 2390/* Parse the other options. */
870f6ba8
TF		 2391
2392while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2393 != NULL)
2394 {
2395 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2396 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2397 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2398 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2399 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2400 else if (strcmpic(ss, US"per_conn") == 0)
2401 {
2402 RATE_SET(mode, PER_CONN);
2403 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2404 badacl = TRUE;
2405 }
2406 else if (strcmpic(ss, US"per_mail") == 0)
2407 {
2408 RATE_SET(mode, PER_MAIL);
2409 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2410 }
2411 else if (strcmpic(ss, US"per_rcpt") == 0)
2412 {
2413 /* If we are running in the RCPT ACL, then we'll count the recipients
2414 one by one, but if we are running when we have accumulated the whole
2415 list then we'll add them all in one batch. */
2416 if (where == ACL_WHERE_RCPT)
2417 RATE_SET(mode, PER_RCPT);
2418 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2419 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2420 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2421 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2422 }
2423 else if (strcmpic(ss, US"per_byte") == 0)
2424 {
2425 /* If we have not yet received the message data and there was no SIZE
2426 declaration on the MAIL comand, then it's safe to just use a value of
2427 zero and let the recorded rate decay as if nothing happened. */
2428 RATE_SET(mode, PER_MAIL);
2429 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2430 else count = message_size < 0 ? 0.0 : (double)message_size;
2431 }
2432 else if (strcmpic(ss, US"per_addr") == 0)
2433 {
2434 RATE_SET(mode, PER_RCPT);
438257ba 2435 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2436 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2437 }
2438 else if (strncmpic(ss, US"count=", 6) == 0)
2439 {
2440 uschar *e;
2441 count = Ustrtod(ss+6, &e);
2442 if (count < 0.0 || *e != '\0')
2443 return ratelimit_error(log_msgptr,
2444 "\"%s\" is not a positive number", ss);
2445 }
2446 else if (strncmpic(ss, US"unique=", 7) == 0)
2447 unique = string_copy(ss + 7);
2448 else if (key == NULL)
2449 key = string_copy(ss);
2450 else
2451 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2452 }
2453
c99ce5c9
TF		 2454/* Sanity check. When the badacl flag is set the update mode must either
2455be readonly (which is the default if it is omitted) or, for backwards
2456compatibility, a combination of noupdate and strict or leaky. */
2457
2458if (mode == RATE_PER_CLASH)
2459 return ratelimit_error(log_msgptr, "conflicting per_* options");
2460if (leaky + strict + readonly > 1)
2461 return ratelimit_error(log_msgptr, "conflicting update modes");
2462if (badacl && (leaky || strict) && !noupdate)
2463 return ratelimit_error(log_msgptr,
2464 "\"%s\" must not have /leaky or /strict option in %s ACL",
2465 ratelimit_option_string[mode], acl_wherenames[where]);
2466
2467/* Set the default values of any unset options. In readonly mode we
2468perform the rate computation without any increment so that its value
2469decays to eventually allow over-limit senders through. */
2470
2471if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2472if (badacl) readonly = TRUE;
2473if (readonly) count = 0.0;
2474if (!strict && !readonly) leaky = TRUE;
2475if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2476
8f240103
PH		 2477/* Create the lookup key. If there is no explicit key, use sender_host_address.
2478If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2479omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2480are added to the key because they alter the meaning of the stored data. */
2481
2482if (key == NULL)
2483 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2484
c99ce5c9 2485key = string_sprintf("%s/%s/%s%s",
8f240103 2486 sender_rate_period,
c99ce5c9
TF		 2487 ratelimit_option_string[mode],
2488 unique == NULL ? "" : "unique/",
8f240103 2489 key);
870f6ba8 2490
c99ce5c9
TF		 2491HDEBUG(D_acl)
2492 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2493
8f240103
PH		 2494/* See if we have already computed the rate by looking in the relevant tree.
2495For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2496pool so that they survive across resets. In readonly mode we only remember the
2497result for the rest of this command in case a later command changes it. After
2498this bit of logic the code is independent of the per_* mode. */
870f6ba8 2499
870f6ba8
TF		 2500old_pool = store_pool;
2501
c99ce5c9
TF		 2502if (readonly)
2503 anchor = &ratelimiters_cmd;
2504else switch(mode) {
2505case RATE_PER_CONN:
870f6ba8
TF		 2506 anchor = &ratelimiters_conn;
2507 store_pool = POOL_PERM;
c99ce5c9
TF		 2508 break;
2509case RATE_PER_BYTE:
2510case RATE_PER_MAIL:
2511case RATE_PER_ALLRCPTS:
870f6ba8 2512 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2513 break;
2514case RATE_PER_ADDR:
2515case RATE_PER_CMD:
2516case RATE_PER_RCPT:
fe0dab11 2517 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2518 break;
2519default:
3399bb60 2520 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2521 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2522 "internal ACL error: unknown ratelimit mode %d", mode);
2523 break;
2524}
870f6ba8 2525
c99ce5c9
TF		 2526t = tree_search(*anchor, key);
2527if (t != NULL)
870f6ba8
TF		 2528 {
2529 dbd = t->data.ptr;
2530 /* The following few lines duplicate some of the code below. */
8f240103 2531 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2532 store_pool = old_pool;
2533 sender_rate = string_sprintf("%.1f", dbd->rate);
2534 HDEBUG(D_acl)
2535 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2536 return rc;
2537 }
2538
c99ce5c9
TF		 2539/* We aren't using a pre-computed rate, so get a previously recorded rate
2540from the database, which will be updated and written back if required. */
870f6ba8
TF		 2541
2542dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2543if (dbm == NULL)
2544 {
2545 store_pool = old_pool;
2546 sender_rate = NULL;
2547 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2548 *log_msgptr = US"ratelimit database not available";
2549 return DEFER;
2550 }
c99ce5c9
TF		 2551dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2552dbd = NULL;
870f6ba8
TF		 2553
2554gettimeofday(&tv, NULL);
2555
c99ce5c9
TF		 2556if (dbdb != NULL)
2557 {
2558 /* Locate the basic ratelimit block inside the DB data. */
2559 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2560 dbd = &dbdb->dbd;
2561
2562 /* Forget the old Bloom filter if it is too old, so that we count each
2563 repeating event once per period. We don't simply clear and re-use the old
2564 filter because we want its size to change if the limit changes. Note that
2565 we keep the dbd pointer for copying the rate into the new data block. */
2566
2567 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2568 {
2569 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2570 dbdb = NULL;
2571 }
2572
2573 /* Sanity check. */
2574
2575 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2576 {
2577 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2578 dbdb = NULL;
2579 }
2580 }
2581
2582/* Allocate a new data block if the database lookup failed
2583or the Bloom filter passed its age limit. */
2584
2585if (dbdb == NULL)
2586 {
2587 if (unique == NULL)
2588 {
2589 /* No Bloom filter. This basic ratelimit block is initialized below. */
2590 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2591 dbdb_size = sizeof(*dbd);
2592 dbdb = store_get(dbdb_size);
2593 }
2594 else
2595 {
2596 int extra;
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2598
2599 /* See the long comment below for an explanation of the magic number 2.
2600 The filter has a minimum size in case the rate limit is very small;
2601 this is determined by the definition of dbdata_ratelimit_unique. */
2602
2603 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2604 if (extra < 0) extra = 0;
2605 dbdb_size = sizeof(*dbdb) + extra;
2606 dbdb = store_get(dbdb_size);
2607 dbdb->bloom_epoch = tv.tv_sec;
2608 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2609 memset(dbdb->bloom, 0, dbdb->bloom_size);
2610
2611 /* Preserve any basic ratelimit data (which is our longer-term memory)
2612 by copying it from the discarded block. */
2613
2614 if (dbd != NULL)
2615 {
2616 dbdb->dbd = *dbd;
2617 dbd = &dbdb->dbd;
2618 }
2619 }
2620 }
2621
2622/* If we are counting unique events, find out if this event is new or not.
2623If the client repeats the event during the current period then it should be
2624counted. We skip this code in readonly mode for efficiency, because any
2625changes to the filter will be discarded and because count is already set to
2626zero. */
2627
2628if (unique != NULL && !readonly)
2629 {
2630 /* We identify unique events using a Bloom filter. (You can find my
2631 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2632 With the per_addr option, an "event" is a recipient address, though the
2633 user can use the unique option to define their own events. We only count
2634 an event if we have not seen it before.
2635
2636 We size the filter according to the rate limit, which (in leaky mode)
2637 is the limit on the population of the filter. We allow 16 bits of space
2638 per entry (see the construction code above) and we set (up to) 8 of them
2639 when inserting an element (see the loop below). The probability of a false
2640 positive (an event we have not seen before but which we fail to count) is
2641
2642 size = limit * 16
2643 numhash = 8
2644 allzero = exp(-numhash * pop / size)
2645 = exp(-0.5 * pop / limit)
2646 fpr = pow(1 - allzero, numhash)
2647
2648 For senders at the limit the fpr is 0.06% or 1 in 1700
2649 and for senders at half the limit it is 0.0006% or 1 in 170000
2650
2651 In strict mode the Bloom filter can fill up beyond the normal limit, in
2652 which case the false positive rate will rise. This means that the
2653 measured rate for very fast senders can bogusly drop off after a while.
2654
2655 At twice the limit, the fpr is 2.5% or 1 in 40
2656 At four times the limit, it is 31% or 1 in 3.2
2657
2658 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2659 decay below the limit, and if this is more than one then the Bloom filter
2660 will be discarded before the decay gets that far. The false positive rate
2661 at this threshold is 9.3% or 1 in 10.7. */
2662
2663 BOOL seen;
2664 unsigned n, hash, hinc;
2665 uschar md5sum[16];
2666 md5 md5info;
2667
2668 /* Instead of using eight independent hash values, we combine two values
2669 using the formula h1 + n * h2. This does not harm the Bloom filter's
2670 performance, and means the amount of hash we need is independent of the
2671 number of bits we set in the filter. */
2672
2673 md5_start(&md5info);
2674 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2675 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2676 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2677
2678 /* Scan the bits corresponding to this event. A zero bit means we have
2679 not seen it before. Ensure all bits are set to record this event. */
2680
2681 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2682
2683 seen = TRUE;
2684 for (n = 0; n < 8; n++, hash += hinc)
2685 {
2686 int bit = 1 << (hash % 8);
2687 int byte = (hash / 8) % dbdb->bloom_size;
2688 if ((dbdb->bloom[byte] & bit) == 0)
2689 {
2690 dbdb->bloom[byte] |= bit;
2691 seen = FALSE;
2692 }
2693 }
2694
2695 /* If this event has occurred before, do not count it. */
2696
2697 if (seen)
2698 {
2699 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2700 count = 0.0;
2701 }
2702 else
2703 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2704 }
2705
2706/* If there was no previous ratelimit data block for this key, initialize
2707the new one, otherwise update the block from the database. The initial rate
2708is what would be computed by the code below for an infinite interval. */
2709
870f6ba8
TF		 2710if (dbd == NULL)
2711 {
c99ce5c9
TF		 2712 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2713 dbd = &dbdb->dbd;
870f6ba8
TF		 2714 dbd->time_stamp = tv.tv_sec;
2715 dbd->time_usec = tv.tv_usec;
c99ce5c9 2716 dbd->rate = count;
870f6ba8
TF		 2717 }
2718else
2719 {
2720 /* The smoothed rate is computed using an exponentially weighted moving
2721 average adjusted for variable sampling intervals. The standard EWMA for
2722 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2723 where f() is the measured value and f'() is the smoothed value.
2724
2725 Old data decays out of the smoothed value exponentially, such that data n
2726 samples old is multiplied by a^n. The exponential decay time constant p
2727 is defined such that data p samples old is multiplied by 1/e, which means
2728 that a = exp(-1/p). We can maintain the same time constant for a variable
2729 sampling interval i by using a = exp(-i/p).
2730
2731 The rate we are measuring is messages per period, suitable for directly
2732 comparing with the limit. The average rate between now and the previous
2733 message is period / interval, which we feed into the EWMA as the sample.
2734
2735 It turns out that the number of messages required for the smoothed rate
2736 to reach the limit when they are sent in a burst is equal to the limit.
2737 This can be seen by analysing the value of the smoothed rate after N
2738 messages sent at even intervals. Let k = (1 - a) * p/i
2739
2740 rate_1 = (1 - a) * p/i + a * rate_0
2741 = k + a * rate_0
2742 rate_2 = k + a * rate_1
2743 = k + a * k + a^2 * rate_0
2744 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2745 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2746 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2747 = rate_0 * a^N + p/i * (1 - a^N)
2748
2749 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2750
2751 rate_N = p/i + (rate_0 - p/i) * a^N
2752 a^N = (rate_N - p/i) / (rate_0 - p/i)
2753 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2754 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2755
2756 Numerical analysis of the above equation, setting the computed rate to
2757 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2758 rates, p/i, the number of messages N = limit. So limit serves as both the
2759 maximum rate measured in messages per period, and the maximum number of
2760 messages that can be sent in a fast burst. */
2761
2762 double this_time = (double)tv.tv_sec
2763 + (double)tv.tv_usec / 1000000.0;
2764 double prev_time = (double)dbd->time_stamp
2765 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2766
2767 /* We must avoid division by zero, and deal gracefully with the clock going
2768 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2769 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2770
e5d5a95f
TF		 2771 double interval = this_time - prev_time <= 0.0 ? 1e-9
2772 : this_time - prev_time;
2773
2774 double i_over_p = interval / period;
2775 double a = exp(-i_over_p);
870f6ba8 2776
c99ce5c9
TF		 2777 /* Combine the instantaneous rate (period / interval) with the previous rate
2778 using the smoothing factor a. In order to measure sized events, multiply the
2779 instantaneous rate by the count of bytes or recipients etc. */
2780
870f6ba8
TF		 2781 dbd->time_stamp = tv.tv_sec;
2782 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2783 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2784
2785 /* When events are very widely spaced the computed rate tends towards zero.
2786 Although this is accurate it turns out not to be useful for our purposes,
2787 especially when the first event after a long silence is the start of a spam
2788 run. A more useful model is that the rate for an isolated event should be the
2789 size of the event per the period size, ignoring the lack of events outside
2790 the current period and regardless of where the event falls in the period. So,
2791 if the interval was so long that the calculated rate is unhelpfully small, we
2792 re-intialize the rate. In the absence of higher-rate bursts, the condition
2793 below is true if the interval is greater than the period. */
2794
2795 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2796 }
2797
c99ce5c9
TF		 2798/* Clients sending at the limit are considered to be over the limit.
2799This matters for edge cases such as a limit of zero, when the client
2800should be completely blocked. */
3348576f 2801
8f240103 2802rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2803
2804/* Update the state if the rate is low or if we are being strict. If we
2805are in leaky mode and the sender's rate is too high, we do not update
2806the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2807rate preventing them from getting any email through. If readonly is set,
2808neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2809
c99ce5c9 2810if ((rc == FAIL && leaky) || strict)
8f240103 2811 {
c99ce5c9 2812 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2813 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2814 }
2815else
2816 {
2817 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2818 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2819 }
2820
870f6ba8
TF		 2821dbfn_close(dbm);
2822
c99ce5c9 2823/* Store the result in the tree for future reference. */
870f6ba8 2824
c99ce5c9
TF		 2825t = store_get(sizeof(tree_node) + Ustrlen(key));
2826t->data.ptr = dbd;
2827Ustrcpy(t->name, key);
2828(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2829
2830/* We create the formatted version of the sender's rate very late in
2831order to ensure that it is done using the correct storage pool. */
2832
2833store_pool = old_pool;
2834sender_rate = string_sprintf("%.1f", dbd->rate);
2835
2836HDEBUG(D_acl)
2837 debug_printf("ratelimit computed rate %s\n", sender_rate);
2838
2839return rc;
2840}
2841
2842
2843
b0019c78
TF		 2844/*************************************************
2845* The udpsend ACL modifier *
2846*************************************************/
2847
2848/* Called by acl_check_condition() below.
2849
2850Arguments:
2851 arg the option string for udpsend=
2852 log_msgptr for error messages
2853
2854Returns: OK - Completed.
2855 DEFER - Problem with DNS lookup.
2856 ERROR - Syntax error in options.
2857*/
2858
2859static int
55414b25 2860acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2861{
2862int sep = 0;
2863uschar *hostname;
2864uschar *portstr;
2865uschar *portend;
2866host_item *h;
2867int portnum;
b0019c78
TF		 2868int len;
2869int r, s;
b1f8e4f8 2870uschar * errstr;
b0019c78
TF		 2871
2872hostname = string_nextinlist(&arg, &sep, NULL, 0);
2873portstr = string_nextinlist(&arg, &sep, NULL, 0);
2874
2875if (hostname == NULL)
2876 {
217b0e56 2877 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2878 return ERROR;
2879 }
2880if (portstr == NULL)
2881 {
217b0e56 2882 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2883 return ERROR;
2884 }
2885if (arg == NULL)
2886 {
217b0e56 2887 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2888 return ERROR;
2889 }
2890portnum = Ustrtol(portstr, &portend, 10);
2891if (*portend != '\0')
2892 {
217b0e56 2893 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2894 return ERROR;
2895 }
2896
2897/* Make a single-item host list. */
2898h = store_get(sizeof(host_item));
2899memset(h, 0, sizeof(host_item));
2900h->name = hostname;
2901h->port = portnum;
2902h->mx = MX_NONE;
2903
2904if (string_is_ip_address(hostname, NULL))
2905 h->address = hostname, r = HOST_FOUND;
2906else
2907 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2908if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2909 {
217b0e56 2910 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2911 return DEFER;
2912 }
2913
2914HDEBUG(D_acl)
2915 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2916
b1f8e4f8
JH		 2917r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2918 1, NULL, &errstr);
b0019c78 2919if (r < 0) goto defer;
27f9999e 2920len = Ustrlen(arg);
9cb1785a 2921r = send(s, arg, len, 0);
b1f8e4f8
JH		 2922if (r < 0)
2923 {
2924 errstr = US strerror(errno);
2925 close(s);
2926 goto defer;
2927 }
2928close(s);
b0019c78
TF		 2929if (r < len)
2930 {
2931 *log_msgptr =
2932 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2933 return DEFER;
2934 }
2935
2936HDEBUG(D_acl)
2937 debug_printf("udpsend %d bytes\n", r);
2938
2939return OK;
2940
2941defer:
b1f8e4f8 2942*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2943return DEFER;
2944}
2945
2946
2947
059ec3d9
PH		 2948/*************************************************
2949* Handle conditions/modifiers on an ACL item *
2950*************************************************/
2951
2952/* Called from acl_check() below.
2953
2954Arguments:
2955 verb ACL verb
2956 cb ACL condition block - if NULL, result is OK
2957 where where called from
2958 addr the address being checked for RCPT, or NULL
2959 level the nesting level
2960 epp pointer to pass back TRUE if "endpass" encountered
2961 (applies only to "accept" and "discard")
2962 user_msgptr user message pointer
2963 log_msgptr log message pointer
2964 basic_errno pointer to where to put verify error
2965
2966Returns: OK - all conditions are met
2967 DISCARD - an "acl" condition returned DISCARD - only allowed
2968 for "accept" or "discard" verbs
2969 FAIL - at least one condition fails
2970 FAIL_DROP - an "acl" condition returned FAIL_DROP
2971 DEFER - can't tell at the moment (typically, lookup defer,
2972 but can be temporary callout problem)
2973 ERROR - ERROR from nested ACL or expansion failure or other
2974 error
2975*/
2976
2977static int
2978acl_check_condition(int verb, acl_condition_block *cb, int where,
2979 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2980 uschar **log_msgptr, int *basic_errno)
2981{
2982uschar *user_message = NULL;
2983uschar *log_message = NULL;
ed7f7860
PP		 2984uschar *debug_tag = NULL;
2985uschar *debug_opts = NULL;
059ec3d9 2986int rc = OK;
8523533c 2987#ifdef WITH_CONTENT_SCAN
0f0c8159 2988int sep = -'/';
8523533c 2989#endif
059ec3d9
PH		 2990
2991for (; cb != NULL; cb = cb->next)
2992 {
55414b25 2993 const uschar *arg;
8e669ac1 2994 int control_type;
059ec3d9
PH		 2995
2996 /* The message and log_message items set up messages to be used in
2997 case of rejection. They are expanded later. */
2998
2999 if (cb->type == ACLC_MESSAGE)
3000 {
187bc588 3001 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3002 user_message = cb->arg;
3003 continue;
3004 }
3005
3006 if (cb->type == ACLC_LOG_MESSAGE)
3007 {
187bc588 3008 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3009 log_message = cb->arg;
3010 continue;
3011 }
3012
3013 /* The endpass "condition" just sets a flag to show it occurred. This is
3014 checked at compile time to be on an "accept" or "discard" item. */
3015
3016 if (cb->type == ACLC_ENDPASS)
3017 {
3018 *epp = TRUE;
3019 continue;
3020 }
3021
3022 /* For other conditions and modifiers, the argument is expanded now for some
3023 of them, but not for all, because expansion happens down in some lower level
3024 checking functions in some cases. */
3025
3026 if (cond_expand_at_top[cb->type])
3027 {
3028 arg = expand_string(cb->arg);
3029 if (arg == NULL)
3030 {
3031 if (expand_string_forcedfail) continue;
3032 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3033 cb->arg, expand_string_message);
3034 return search_find_defer? DEFER : ERROR;
3035 }
3036 }
3037 else arg = cb->arg;
3038
3039 /* Show condition, and expanded condition if it's different */
3040
3041 HDEBUG(D_acl)
3042 {
3043 int lhswidth = 0;
3044 debug_printf("check %s%s %n",
3045 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3046 conditions[cb->type], &lhswidth);
3047
3048 if (cb->type == ACLC_SET)
3049 {
38a0a95f
PH		 3050 debug_printf("acl_%s ", cb->u.varname);
3051 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3052 }
3053
3054 debug_printf("= %s\n", cb->arg);
3055
3056 if (arg != cb->arg)
3057 debug_printf("%.*s= %s\n", lhswidth,
3058 US" ", CS arg);
3059 }
3060
3061 /* Check that this condition makes sense at this time */
3062
3063 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3064 {
3065 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3066 cond_modifiers[cb->type]? "use" : "test",
3067 conditions[cb->type], acl_wherenames[where]);
3068 return ERROR;
3069 }
3070
3071 /* Run the appropriate test for each condition, or take the appropriate
3072 action for the remaining modifiers. */
3073
3074 switch(cb->type)
3075 {
71fafd95
PH		 3076 case ACLC_ADD_HEADER:
3077 setup_header(arg);
3078 break;
3079
059ec3d9
PH		 3080 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3081 "discard" verb. */
71fafd95 3082
059ec3d9 3083 case ACLC_ACL:
f60d98e8 3084 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3085 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3086 {
3087 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3088 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3089 verbs[verb]);
3090 return ERROR;
3091 }
059ec3d9
PH		 3092 break;
3093
3094 case ACLC_AUTHENTICATED:
3095 rc = (sender_host_authenticated == NULL)? FAIL :
3096 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3097 TRUE, NULL);
3098 break;
3099
71fafd95 3100 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3101 case ACLC_BMI_OPTIN:
3102 {
3103 int old_pool = store_pool;
3104 store_pool = POOL_PERM;
3105 bmi_current_optin = string_copy(arg);
3106 store_pool = old_pool;
3107 }
3108 break;
71fafd95 3109 #endif
8523533c 3110
059ec3d9 3111 case ACLC_CONDITION:
f3766eb5
NM		 3112 /* The true/false parsing here should be kept in sync with that used in
3113 expand.c when dealing with ECOND_BOOL so that we don't have too many
3114 different definitions of what can be a boolean. */
51c7471d
JH		 3115 if (*arg == '-'
3116 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3117 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3118 rc = (Uatoi(arg) == 0)? FAIL : OK;
3119 else
3120 rc = (strcmpic(arg, US"no") == 0 ||
3121 strcmpic(arg, US"false") == 0)? FAIL :
3122 (strcmpic(arg, US"yes") == 0 ||
3123 strcmpic(arg, US"true") == 0)? OK : DEFER;
3124 if (rc == DEFER)
3125 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3126 break;
3127
c3611384
PH		 3128 case ACLC_CONTINUE: /* Always succeeds */
3129 break;
3130
059ec3d9 3131 case ACLC_CONTROL:
c5fcb476 3132 {
55414b25
JH		 3133 const uschar *p = NULL;
3134 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3135
55414b25 3136 /* Check if this control makes sense at this time */
f7572e5a 3137
55414b25
JH		 3138 if ((control_forbids[control_type] & (1 << where)) != 0)
3139 {
3140 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3141 controls[control_type], acl_wherenames[where]);
3142 return ERROR;
3143 }
8800895a 3144
55414b25
JH		 3145 switch(control_type)
3146 {
3147 case CONTROL_AUTH_UNADVERTISED:
3148 allow_auth_unadvertised = TRUE;
3149 break;
3150
3151 #ifdef EXPERIMENTAL_BRIGHTMAIL
3152 case CONTROL_BMI_RUN:
3153 bmi_run = 1;
3154 break;
3155 #endif
3156
3157 #ifndef DISABLE_DKIM
3158 case CONTROL_DKIM_VERIFY:
3159 dkim_disable_verify = TRUE;
3160 #ifdef EXPERIMENTAL_DMARC
3161 /* Since DKIM was blocked, skip DMARC too */
3162 dmarc_disable_verify = TRUE;
3163 dmarc_enable_forensic = FALSE;
3164 #endif
3165 break;
3166 #endif
3167
3168 #ifdef EXPERIMENTAL_DMARC
3169 case CONTROL_DMARC_VERIFY:
3170 dmarc_disable_verify = TRUE;
3171 break;
3172
3173 case CONTROL_DMARC_FORENSIC:
3174 dmarc_enable_forensic = TRUE;
3175 break;
3176 #endif
3177
3178 case CONTROL_DSCP:
3179 if (*p == '/')
3180 {
3181 int fd, af, level, optname, value;
3182 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3183 a socket; we can accept that, we'll just debug-log failures anyway. */
3184 fd = fileno(smtp_in);
3185 af = ip_get_address_family(fd);
3186 if (af < 0)
3187 {
3188 HDEBUG(D_acl)
3189 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3190 strerror(errno));
3191 break;
3192 }
3193 if (dscp_lookup(p+1, af, &level, &optname, &value))
3194 {
3195 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3196 {
3197 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3198 p+1, strerror(errno));
3199 }
3200 else
3201 {
3202 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3203 }
3204 }
3205 else
3206 {
3207 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3208 return ERROR;
3209 }
3210 }
3211 else
3212 {
3213 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3214 return ERROR;
3215 }
3216 break;
3217
3218 case CONTROL_ERROR:
3219 return ERROR;
3220
3221 case CONTROL_CASEFUL_LOCAL_PART:
3222 deliver_localpart = addr->cc_local_part;
3223 break;
3224
3225 case CONTROL_CASELOWER_LOCAL_PART:
3226 deliver_localpart = addr->lc_local_part;
3227 break;
3228
3229 case CONTROL_ENFORCE_SYNC:
3230 smtp_enforce_sync = TRUE;
3231 break;
3232
3233 case CONTROL_NO_ENFORCE_SYNC:
3234 smtp_enforce_sync = FALSE;
3235 break;
3236
3237 #ifdef WITH_CONTENT_SCAN
3238 case CONTROL_NO_MBOX_UNSPOOL:
3239 no_mbox_unspool = TRUE;
3240 break;
3241 #endif
3242
3243 case CONTROL_NO_MULTILINE:
3244 no_multiline_responses = TRUE;
3245 break;
3246
3247 case CONTROL_NO_PIPELINING:
3248 pipelining_enable = FALSE;
3249 break;
3250
3251 case CONTROL_NO_DELAY_FLUSH:
3252 disable_delay_flush = TRUE;
3253 break;
3254
3255 case CONTROL_NO_CALLOUT_FLUSH:
3256 disable_callout_flush = TRUE;
3257 break;
3258
3259 case CONTROL_FAKEREJECT:
3260 cancel_cutthrough_connection("fakereject");
3261 case CONTROL_FAKEDEFER:
3262 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3263 if (*p == '/')
3264 {
3265 const uschar *pp = p + 1;
3266 while (*pp != 0) pp++;
3267 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3268 p = pp;
3269 }
3270 else
3271 {
3272 /* Explicitly reset to default string */
3273 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3274 }
3275 break;
ed7f7860 3276
55414b25
JH		 3277 case CONTROL_FREEZE:
3278 deliver_freeze = TRUE;
3279 deliver_frozen_at = time(NULL);
3280 freeze_tell = freeze_tell_config; /* Reset to configured value */
3281 if (Ustrncmp(p, "/no_tell", 8) == 0)
3282 {
3283 p += 8;
3284 freeze_tell = NULL;
3285 }
3286 if (*p != 0)
3287 {
3288 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3289 return ERROR;
3290 }
3291 cancel_cutthrough_connection("item frozen");
3292 break;
3293
3294 case CONTROL_QUEUE_ONLY:
3295 queue_only_policy = TRUE;
3296 cancel_cutthrough_connection("queueing forced");
3297 break;
3298
3299 case CONTROL_SUBMISSION:
3300 originator_name = US"";
3301 submission_mode = TRUE;
3302 while (*p == '/')
3303 {
3304 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3305 {
3306 p += 14;
3307 active_local_sender_retain = TRUE;
3308 active_local_from_check = FALSE;
3309 }
3310 else if (Ustrncmp(p, "/domain=", 8) == 0)
3311 {
3312 const uschar *pp = p + 8;
3313 while (*pp != 0 && *pp != '/') pp++;
3314 submission_domain = string_copyn(p+8, pp-p-8);
3315 p = pp;
3316 }
3317 /* The name= option must be last, because it swallows the rest of
3318 the string. */
3319 else if (Ustrncmp(p, "/name=", 6) == 0)
3320 {
3321 const uschar *pp = p + 6;
3322 while (*pp != 0) pp++;
3323 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3324 big_buffer, big_buffer_size));
3325 p = pp;
3326 }
3327 else break;
3328 }
3329 if (*p != 0)
3330 {
3331 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3332 return ERROR;
3333 }
3334 break;
e4bdf652 3335
55414b25
JH		 3336 case CONTROL_DEBUG:
3337 while (*p == '/')
3338 {
3339 if (Ustrncmp(p, "/tag=", 5) == 0)
3340 {
3341 const uschar *pp = p + 5;
3342 while (*pp != '\0' && *pp != '/') pp++;
3343 debug_tag = string_copyn(p+5, pp-p-5);
3344 p = pp;
3345 }
3346 else if (Ustrncmp(p, "/opts=", 6) == 0)
3347 {
3348 const uschar *pp = p + 6;
3349 while (*pp != '\0' && *pp != '/') pp++;
3350 debug_opts = string_copyn(p+6, pp-p-6);
3351 p = pp;
3352 }
3353 }
3354 debug_logging_activate(debug_tag, debug_opts);
3355 break;
3356
3357 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3358 suppress_local_fixups = TRUE;
3359 break;
3360
3361 case CONTROL_CUTTHROUGH_DELIVERY:
3362 if (prdr_requested)
3363 /* Too hard to think about for now. We might in future cutthrough
3364 the case where both sides handle prdr and this-node prdr acl
3365 is "accept" */
93a6fce2 3366 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3367 else
3368 {
55414b25
JH		 3369 if (deliver_freeze)
3370 *log_msgptr = US"frozen";
3371 else if (queue_only_policy)
3372 *log_msgptr = US"queue-only";
3373 else if (fake_response == FAIL)
3374 *log_msgptr = US"fakereject";
3375 else
3376 {
3377 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3378 break;
3379 }
3380 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3381 arg, *log_msgptr);
5032d1cf 3382 }
55414b25 3383 return ERROR;
9171d434 3384 }
55414b25 3385 break;
059ec3d9 3386 }
059ec3d9 3387
6a8f9482
TK		 3388 #ifdef EXPERIMENTAL_DCC
3389 case ACLC_DCC:
3390 {
3391 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3392 const uschar * list = arg;
3393 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3394 /* Run the dcc backend. */
3395 rc = dcc_process(&ss);
3396 /* Modify return code based upon the existance of options. */
55414b25 3397 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
6a8f9482
TK		 3398 != NULL) {
3399 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3400 {
3401 /* FAIL so that the message is passed to the next ACL */
3402 rc = FAIL;
3403 }
3404 }
3405 }
3406 break;
3407 #endif
3408
71fafd95 3409 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3410 case ACLC_DECODE:
3411 rc = mime_decode(&arg);
3412 break;
71fafd95 3413 #endif
8523533c 3414
059ec3d9
PH		 3415 case ACLC_DELAY:
3416 {
3417 int delay = readconf_readtime(arg, 0, FALSE);
3418 if (delay < 0)
3419 {
3420 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3421 "modifier: \"%s\" is not a time value", arg);
3422 return ERROR;
3423 }
3424 else
3425 {
3426 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3427 delay);
3428 if (host_checking)
3429 {
3430 HDEBUG(D_acl)
3431 debug_printf("delay skipped in -bh checking mode\n");
3432 }
010c2d14
PH		 3433
3434 /* It appears to be impossible to detect that a TCP/IP connection has
3435 gone away without reading from it. This means that we cannot shorten
3436 the delay below if the client goes away, because we cannot discover
3437 that the client has closed its end of the connection. (The connection
3438 is actually in a half-closed state, waiting for the server to close its
3439 end.) It would be nice to be able to detect this state, so that the
3440 Exim process is not held up unnecessarily. However, it seems that we
3441 can't. The poll() function does not do the right thing, and in any case
3442 it is not always available.
3443
047bdd8c 3444 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3445 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3446 Also, delays may be specified for non-SMTP input, where smtp_out and
3447 smtp_in will be NULL. Whatever is done must work in all cases.
3448
3449 NOTE 2: The added feature of flushing the output before a delay must
3450 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3451 */
010c2d14 3452
8e669ac1 3453 else
86b8287f 3454 {
14f4a80d 3455 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3456 while (delay > 0) delay = sleep(delay);
8e669ac1 3457 }
059ec3d9
PH		 3458 }
3459 }
3460 break;
3461
71fafd95 3462 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3463 case ACLC_DEMIME:
3464 rc = demime(&arg);
3465 break;
71fafd95 3466 #endif
8523533c 3467
80a47a2c
TK		 3468 #ifndef DISABLE_DKIM
3469 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3470 if (dkim_cur_signer != NULL)
3471 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3472 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3473 else
80a47a2c 3474 rc = FAIL;
71fafd95
PH		 3475 break;
3476
80a47a2c
TK		 3477 case ACLC_DKIM_STATUS:
3478 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3479 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3480 break;
3481 #endif
fb2274d4 3482
4840604e
TL		 3483 #ifdef EXPERIMENTAL_DMARC
3484 case ACLC_DMARC_STATUS:
4a8ce2d8 3485 if (!dmarc_has_been_checked)
4840604e 3486 dmarc_process();
4a8ce2d8 3487 dmarc_has_been_checked = TRUE;
4840604e
TL		 3488 /* used long way of dmarc_exim_expand_query() in case we need more
3489 * view into the process in the future. */
3490 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3491 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3492 break;
3493 #endif
3494
059ec3d9
PH		 3495 case ACLC_DNSLISTS:
3496 rc = verify_check_dnsbl(&arg);
3497 break;
3498
3499 case ACLC_DOMAINS:
3500 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3501 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3502 break;
3503
3504 /* The value in tls_cipher is the full cipher name, for example,
3505 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3506 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3507 what may in practice come out of the SSL library - which at the time of
3508 writing is poorly documented. */
3509
3510 case ACLC_ENCRYPTED:
817d9f57 3511 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3512 {
3513 uschar *endcipher = NULL;
817d9f57
JH		 3514 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3515 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3516 {
3517 endcipher = Ustrchr(++cipher, ':');
3518 if (endcipher != NULL) *endcipher = 0;
3519 }
3520 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3521 if (endcipher != NULL) *endcipher = ':';
3522 }
3523 break;
3524
3525 /* Use verify_check_this_host() instead of verify_check_host() so that
3526 we can pass over &host_data to catch any looked up data. Once it has been
3527 set, it retains its value so that it's still there if another ACL verb
3528 comes through here and uses the cache. However, we must put it into
3529 permanent store in case it is also expected to be used in a subsequent
3530 message in the same SMTP connection. */
3531
3532 case ACLC_HOSTS:
3533 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3534 (sender_host_address == NULL)? US"" : sender_host_address,
3535 CUSS &host_data);
059ec3d9
PH		 3536 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3537 break;
3538
3539 case ACLC_LOCAL_PARTS:
3540 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3541 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3542 CUSS &deliver_localpart_data);
059ec3d9
PH		 3543 break;
3544
6ea85e9a
PH		 3545 case ACLC_LOG_REJECT_TARGET:
3546 {
3547 int logbits = 0;
3548 int sep = 0;
55414b25 3549 const uschar *s = arg;
6ea85e9a
PH		 3550 uschar *ss;
3551 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3552 != NULL)
3553 {
3554 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3555 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3556 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3557 else
3558 {
3559 logbits |= LOG_MAIN|LOG_REJECT;
3560 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3561 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3562 }
3563 }
3564 log_reject_target = logbits;
3565 }
3566 break;
3567
059ec3d9
PH		 3568 case ACLC_LOGWRITE:
3569 {
3570 int logbits = 0;
55414b25 3571 const uschar *s = arg;
059ec3d9
PH		 3572 if (*s == ':')
3573 {
3574 s++;
3575 while (*s != ':')
3576 {
3577 if (Ustrncmp(s, "main", 4) == 0)
3578 { logbits |= LOG_MAIN; s += 4; }
3579 else if (Ustrncmp(s, "panic", 5) == 0)
3580 { logbits |= LOG_PANIC; s += 5; }
3581 else if (Ustrncmp(s, "reject", 6) == 0)
3582 { logbits |= LOG_REJECT; s += 6; }
3583 else
3584 {
3585 logbits = LOG_MAIN|LOG_PANIC;
3586 s = string_sprintf(":unknown log name in \"%s\" in "
3587 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3588 }
3589 if (*s == ',') s++;
3590 }
3591 s++;
3592 }
3593 while (isspace(*s)) s++;
6ea85e9a
PH		 3594
3595
059ec3d9
PH		 3596 if (logbits == 0) logbits = LOG_MAIN;
3597 log_write(0, logbits, "%s", string_printing(s));
3598 }
3599 break;
8e669ac1 3600
71fafd95 3601 #ifdef WITH_CONTENT_SCAN
0f0c8159 3602 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3603 {
6ea85e9a 3604 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3605 const uschar * list = arg;
3606 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3607 uschar *opt;
3608 BOOL defer_ok = FALSE;
3609 int timeout = 0;
3610
55414b25 3611 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3612 if (strcmpic(opt, US"defer_ok") == 0)
3613 defer_ok = TRUE;
3614 else if ( strncmpic(opt, US"tmo=", 4) == 0
3615 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3616 )
3617 {
3618 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3619 return ERROR;
3620 }
3621
3622 rc = malware(ss, timeout);
3623 if (rc == DEFER && defer_ok)
3624 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3625 }
3626 break;
3627
3628 case ACLC_MIME_REGEX:
71fafd95 3629 rc = mime_regex(&arg);
8523533c 3630 break;
71fafd95 3631 #endif
059ec3d9 3632
870f6ba8 3633 case ACLC_RATELIMIT:
90fc3069 3634 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3635 break;
3636
059ec3d9 3637 case ACLC_RECIPIENTS:
55414b25
JH		 3638 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3639 CUSS &recipient_data);
059ec3d9
PH		 3640 break;
3641
71fafd95
PH		 3642 #ifdef WITH_CONTENT_SCAN
3643 case ACLC_REGEX:
3644 rc = regex(&arg);
8523533c 3645 break;
71fafd95 3646 #endif
8523533c 3647
e7568d51
TL		 3648 case ACLC_REMOVE_HEADER:
3649 setup_remove_header(arg);
3650 break;
3651
059ec3d9
PH		 3652 case ACLC_SENDER_DOMAINS:
3653 {
3654 uschar *sdomain;
3655 sdomain = Ustrrchr(sender_address, '@');
3656 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3657 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3658 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3659 }
3660 break;
3661
3662 case ACLC_SENDERS:
55414b25
JH		 3663 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3664 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3665 break;
3666
3667 /* Connection variables must persist forever */
3668
3669 case ACLC_SET:
3670 {
3671 int old_pool = store_pool;
38a0a95f
PH		 3672 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3673 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3674 store_pool = old_pool;
3675 }
3676 break;
3677
71fafd95 3678 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3679 case ACLC_SPAM:
3680 {
3681 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3682 const uschar * list = arg;
3683 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3684 /* Run the spam backend. */
55414b25 3685 rc = spam(CUSS &ss);
8523533c 3686 /* Modify return code based upon the existance of options. */
55414b25 3687 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3688 != NULL) {
3689 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3690 {
3691 /* FAIL so that the message is passed to the next ACL */
3692 rc = FAIL;
3693 }
3694 }
3695 }
3696 break;
71fafd95 3697 #endif
8523533c 3698
71fafd95 3699 #ifdef EXPERIMENTAL_SPF
8523533c 3700 case ACLC_SPF:
65a7d8c3
NM		 3701 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3702 break;
3703 case ACLC_SPF_GUESS:
3704 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3705 break;
71fafd95 3706 #endif
8523533c 3707
b0019c78
TF		 3708 case ACLC_UDPSEND:
3709 rc = acl_udpsend(arg, log_msgptr);
3710 break;
3711
059ec3d9
PH		 3712 /* If the verb is WARN, discard any user message from verification, because
3713 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3714 only from explicit "message" modifiers. However, put the user message into
3715 $acl_verify_message so it can be used in subsequent conditions or modifiers
3716 (until something changes it). */
059ec3d9
PH		 3717
3718 case ACLC_VERIFY:
3719 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3720 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3721 if (verb == ACL_WARN) *user_msgptr = NULL;
3722 break;
3723
3724 default:
3725 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3726 "condition %d", cb->type);
3727 break;
3728 }
3729
3730 /* If a condition was negated, invert OK/FAIL. */
3731
3732 if (!cond_modifiers[cb->type] && cb->u.negated)
3733 {
3734 if (rc == OK) rc = FAIL;
3735 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3736 }
3737
3738 if (rc != OK) break; /* Conditions loop */
3739 }
3740
3741
3742/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3743handle the values of these modifiers. If there isn't a log message set, we make
3744it the same as the user message.
059ec3d9
PH		 3745
3746"message" is a user message that will be included in an SMTP response. Unless
3747it is empty, it overrides any previously set user message.
3748
3749"log_message" is a non-user message, and it adds to any existing non-user
3750message that is already set.
3751
4e88a19f
PH		 3752Most verbs have but a single return for which the messages are relevant, but
3753for "discard", it's useful to have the log message both when it succeeds and
3754when it fails. For "accept", the message is used in the OK case if there is no
3755"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3756present. */
059ec3d9 3757
4e88a19f
PH		 3758if (*epp && rc == OK) user_message = NULL;
3759
3760if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3761 {
3762 uschar *expmessage;
4e88a19f
PH		 3763 uschar *old_user_msgptr = *user_msgptr;
3764 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3765
3766 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3767 nested ACLs) are always discarded. This also happens for acceptance verbs
3768 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3769 However, the value of an existing message is available in $acl_verify_message
3770 during expansions. */
3771
4e88a19f
PH		 3772 if (verb == ACL_WARN ||
3773 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3774 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3775
3776 if (user_message != NULL)
3777 {
3778 acl_verify_message = old_user_msgptr;
3779 expmessage = expand_string(user_message);
3780 if (expmessage == NULL)
3781 {
3782 if (!expand_string_forcedfail)
3783 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3784 user_message, expand_string_message);
3785 }
3786 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3787 }
3788
3789 if (log_message != NULL)
3790 {
3791 acl_verify_message = old_log_msgptr;
3792 expmessage = expand_string(log_message);
3793 if (expmessage == NULL)
3794 {
3795 if (!expand_string_forcedfail)
3796 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3797 log_message, expand_string_message);
3798 }
3799 else if (expmessage[0] != 0)
3800 {
3801 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3802 string_sprintf("%s: %s", expmessage, *log_msgptr);
3803 }
3804 }
3805
3806 /* If no log message, default it to the user message */
3807
3808 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3809 }
3810
3811acl_verify_message = NULL;
3812return rc;
3813}
3814
3815
3816
3817
3818
3819/*************************************************
3820* Get line from a literal ACL *
3821*************************************************/
3822
3823/* This function is passed to acl_read() in order to extract individual lines
3824of a literal ACL, which we access via static pointers. We can destroy the
3825contents because this is called only once (the compiled ACL is remembered).
3826
3827This code is intended to treat the data in the same way as lines in the main
3828Exim configuration file. That is:
3829
3830 . Leading spaces are ignored.
3831
3832 . A \ at the end of a line is a continuation - trailing spaces after the \
3833 are permitted (this is because I don't believe in making invisible things
3834 significant). Leading spaces on the continued part of a line are ignored.
3835
3836 . Physical lines starting (significantly) with # are totally ignored, and
3837 may appear within a sequence of backslash-continued lines.
3838
3839 . Blank lines are ignored, but will end a sequence of continuations.
3840
3841Arguments: none
3842Returns: a pointer to the next line
3843*/
3844
3845
3846static uschar *acl_text; /* Current pointer in the text */
3847static uschar *acl_text_end; /* Points one past the terminating '0' */
3848
3849
3850static uschar *
3851acl_getline(void)
3852{
3853uschar *yield;
3854
3855/* This loop handles leading blank lines and comments. */
3856
3857for(;;)
3858 {
3859 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3860 if (*acl_text == 0) return NULL; /* No more data */
3861 yield = acl_text; /* Potential data line */
3862
3863 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3864
3865 /* If we hit the end before a newline, we have the whole logical line. If
3866 it's a comment, there's no more data to be given. Otherwise, yield it. */
3867
3868 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3869
3870 /* After reaching a newline, end this loop if the physical line does not
3871 start with '#'. If it does, it's a comment, and the loop continues. */
3872
3873 if (*yield != '#') break;
3874 }
3875
3876/* This loop handles continuations. We know we have some real data, ending in
3877newline. See if there is a continuation marker at the end (ignoring trailing
3878white space). We know that *yield is not white space, so no need to test for
3879cont > yield in the backwards scanning loop. */
3880
3881for(;;)
3882 {
3883 uschar *cont;
3884 for (cont = acl_text - 1; isspace(*cont); cont--);
3885
3886 /* If no continuation follows, we are done. Mark the end of the line and
3887 return it. */
3888
3889 if (*cont != '\\')
3890 {
3891 *acl_text++ = 0;
3892 return yield;
3893 }
3894
3895 /* We have encountered a continuation. Skip over whitespace at the start of
3896 the next line, and indeed the whole of the next line or lines if they are
3897 comment lines. */
3898
3899 for (;;)
3900 {
3901 while (*(++acl_text) == ' ' || *acl_text == '\t');
3902 if (*acl_text != '#') break;
3903 while (*(++acl_text) != 0 && *acl_text != '\n');
3904 }
3905
3906 /* We have the start of a continuation line. Move all the rest of the data
3907 to join onto the previous line, and then find its end. If the end is not a
3908 newline, we are done. Otherwise loop to look for another continuation. */
3909
3910 memmove(cont, acl_text, acl_text_end - acl_text);
3911 acl_text_end -= acl_text - cont;
3912 acl_text = cont;
3913 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3914 if (*acl_text == 0) return yield;
3915 }
3916
3917/* Control does not reach here */
3918}
3919
3920
3921
3922
3923
3924/*************************************************
3925* Check access using an ACL *
3926*************************************************/
3927
3928/* This function is called from address_check. It may recurse via
3929acl_check_condition() - hence the use of a level to stop looping. The ACL is
3930passed as a string which is expanded. A forced failure implies no access check
3931is required. If the result is a single word, it is taken as the name of an ACL
3932which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3933text, complete with newlines, and parsed as such. In both cases, the ACL check
3934is then run. This function uses an auxiliary function for acl_read() to call
3935for reading individual lines of a literal ACL. This is acl_getline(), which
3936appears immediately above.
3937
3938Arguments:
3939 where where called from
3940 addr address item when called from RCPT; otherwise NULL
3941 s the input string; NULL is the same as an empty ACL => DENY
3942 level the nesting level
3943 user_msgptr where to put a user error (for SMTP response)
3944 log_msgptr where to put a logging message (not for SMTP response)
3945
3946Returns: OK access is granted
3947 DISCARD access is apparently granted...
3948 FAIL access is denied
3949 FAIL_DROP access is denied; drop the connection
3950 DEFER can't tell at the moment
3951 ERROR disaster
3952*/
3953
3954static int
3955acl_check_internal(int where, address_item *addr, uschar *s, int level,
3956 uschar **user_msgptr, uschar **log_msgptr)
3957{
3958int fd = -1;
3959acl_block *acl = NULL;
3960uschar *acl_name = US"inline ACL";
3961uschar *ss;
3962
3963/* Catch configuration loops */
3964
3965if (level > 20)
3966 {
3967 *log_msgptr = US"ACL nested too deep: possible loop";
3968 return ERROR;
3969 }
3970
3971if (s == NULL)
3972 {
3973 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3974 return FAIL;
3975 }
3976
3977/* At top level, we expand the incoming string. At lower levels, it has already
3978been expanded as part of condition processing. */
3979
3980if (level == 0)
3981 {
3982 ss = expand_string(s);
3983 if (ss == NULL)
3984 {
3985 if (expand_string_forcedfail) return OK;
3986 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3987 expand_string_message);
3988 return ERROR;
3989 }
3990 }
3991else ss = s;
3992
3993while (isspace(*ss))ss++;
3994
3995/* If we can't find a named ACL, the default is to parse it as an inline one.
3996(Unless it begins with a slash; non-existent files give rise to an error.) */
3997
3998acl_text = ss;
3999
4000/* Handle the case of a string that does not contain any spaces. Look for a
4001named ACL among those read from the configuration, or a previously read file.
4002It is possible that the pointer to the ACL is NULL if the configuration
4003contains a name with no data. If not found, and the text begins with '/',
4004read an ACL from a file, and save it so it can be re-used. */
4005
4006if (Ustrchr(ss, ' ') == NULL)
4007 {
4008 tree_node *t = tree_search(acl_anchor, ss);
4009 if (t != NULL)
4010 {
4011 acl = (acl_block *)(t->data.ptr);
4012 if (acl == NULL)
4013 {
4014 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4015 return FAIL;
4016 }
4017 acl_name = string_sprintf("ACL \"%s\"", ss);
4018 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4019 }
4020
4021 else if (*ss == '/')
4022 {
4023 struct stat statbuf;
4024 fd = Uopen(ss, O_RDONLY, 0);
4025 if (fd < 0)
4026 {
4027 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4028 strerror(errno));
4029 return ERROR;
4030 }
4031
4032 if (fstat(fd, &statbuf) != 0)
4033 {
4034 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4035 strerror(errno));
4036 return ERROR;
4037 }
4038
4039 acl_text = store_get(statbuf.st_size + 1);
4040 acl_text_end = acl_text + statbuf.st_size + 1;
4041
4042 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4043 {
4044 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4045 ss, strerror(errno));
4046 return ERROR;
4047 }
4048 acl_text[statbuf.st_size] = 0;
f1e894f3 4049 (void)close(fd);
059ec3d9
PH		 4050
4051 acl_name = string_sprintf("ACL \"%s\"", ss);
4052 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4053 }
4054 }
4055
4056/* Parse an ACL that is still in text form. If it came from a file, remember it
4057in the ACL tree, having read it into the POOL_PERM store pool so that it
4058persists between multiple messages. */
4059
4060if (acl == NULL)
4061 {
4062 int old_pool = store_pool;
4063 if (fd >= 0) store_pool = POOL_PERM;
4064 acl = acl_read(acl_getline, log_msgptr);
4065 store_pool = old_pool;
4066 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4067 if (fd >= 0)
4068 {
4069 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4070 Ustrcpy(t->name, ss);
4071 t->data.ptr = acl;
4072 (void)tree_insertnode(&acl_anchor, t);
4073 }
4074 }
4075
4076/* Now we have an ACL to use. It's possible it may be NULL. */
4077
4078while (acl != NULL)
4079 {
4080 int cond;
4081 int basic_errno = 0;
4082 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4083 BOOL acl_quit_check = level == 0
4084 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4085
4086 *log_msgptr = *user_msgptr = NULL;
4087 acl_temp_details = FALSE;
4088
059ec3d9
PH		 4089 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4090
4091 /* Clear out any search error message from a previous check before testing
4092 this condition. */
4093
4094 search_error_message = NULL;
4095 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4096 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4097
4098 /* Handle special returns: DEFER causes a return except on a WARN verb;
4099 ERROR always causes a return. */
4100
4101 switch (cond)
4102 {
4103 case DEFER:
6968512f 4104 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4105 if (basic_errno != ERRNO_CALLOUTDEFER)
4106 {
4107 if (search_error_message != NULL && *search_error_message != 0)
4108 *log_msgptr = search_error_message;
4109 if (smtp_return_error_details) acl_temp_details = TRUE;
4110 }
4111 else
4112 {
4113 acl_temp_details = TRUE;
4114 }
4115 if (acl->verb != ACL_WARN) return DEFER;
4116 break;
4117
4118 default: /* Paranoia */
4119 case ERROR:
6968512f 4120 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4121 return ERROR;
4122
4123 case OK:
6968512f
JH		 4124 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4125 verbs[acl->verb], acl_name);
059ec3d9
PH		 4126 break;
4127
4128 case FAIL:
6968512f 4129 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4130 break;
4131
4132 /* DISCARD and DROP can happen only from a nested ACL condition, and
4133 DISCARD can happen only for an "accept" or "discard" verb. */
4134
4135 case DISCARD:
6968512f
JH		 4136 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4137 verbs[acl->verb], acl_name);
059ec3d9
PH		 4138 break;
4139
4140 case FAIL_DROP:
6968512f
JH		 4141 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4142 verbs[acl->verb], acl_name);
059ec3d9
PH		 4143 break;
4144 }
4145
4146 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4147 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4148 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4149
4150 switch(acl->verb)
4151 {
4152 case ACL_ACCEPT:
a7538db1
JH		 4153 if (cond == OK || cond == DISCARD)
4154 {
4155 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4156 return cond;
4157 }
059ec3d9
PH		 4158 if (endpass_seen)
4159 {
4160 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4161 return cond;
4162 }
4163 break;
4164
4165 case ACL_DEFER:
4166 if (cond == OK)
4167 {
a7538db1 4168 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4169 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4170 acl_temp_details = TRUE;
4171 return DEFER;
4172 }
4173 break;
4174
4175 case ACL_DENY:
a7538db1
JH		 4176 if (cond == OK)
4177 {
4178 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4179 if (acl_quit_check) goto badquit;
a7538db1
JH		 4180 return FAIL;
4181 }
059ec3d9
PH		 4182 break;
4183
4184 case ACL_DISCARD:
a7538db1
JH		 4185 if (cond == OK || cond == DISCARD)
4186 {
4187 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4188 if (acl_quit_check) goto badquit;
a7538db1
JH		 4189 return DISCARD;
4190 }
059ec3d9
PH		 4191 if (endpass_seen)
4192 {
4193 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4194 return cond;
4195 }
4196 break;
4197
4198 case ACL_DROP:
a7538db1
JH		 4199 if (cond == OK)
4200 {
4201 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4202 if (acl_quit_check) goto badquit;
a7538db1
JH		 4203 return FAIL_DROP;
4204 }
059ec3d9
PH		 4205 break;
4206
4207 case ACL_REQUIRE:
a7538db1
JH		 4208 if (cond != OK)
4209 {
4210 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4211 if (acl_quit_check) goto badquit;
a7538db1
JH		 4212 return cond;
4213 }
059ec3d9
PH		 4214 break;
4215
4216 case ACL_WARN:
4217 if (cond == OK)
4218 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4219 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4220 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4221 "condition test deferred%s%s", host_and_ident(TRUE),
4222 (*log_msgptr == NULL)? US"" : US": ",
4223 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4224 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4225 break;
4226
4227 default:
4228 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4229 acl->verb);
4230 break;
4231 }
4232
4233 /* Pass to the next ACL item */
4234
4235 acl = acl->next;
4236 }
4237
4238/* We have reached the end of the ACL. This is an implicit DENY. */
4239
4240HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4241return FAIL;
82c0c8ea
JH		 4242
4243badquit:
4244 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4245 "('%s' verb used incorrectly)", verbs[acl->verb]);
4246 return ERROR;
059ec3d9
PH		 4247}
4248
4249
333eea9c
JH		 4250
4251
4252/* Same args as acl_check_internal() above, but the string s is
4253the name of an ACL followed optionally by up to 9 space-separated arguments.
4254The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4255static int
55414b25 4256acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4257 uschar **user_msgptr, uschar **log_msgptr)
4258{
4259uschar * tmp;
bef3ea7f 4260uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4261uschar * sav_arg[9]; /* must match acl_arg[] */
4262int sav_narg;
333eea9c 4263uschar * name;
bef3ea7f 4264int i;
ef21c07d 4265int ret;
333eea9c
JH		 4266
4267if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4268 goto bad;
4269
bef3ea7f 4270for (i = 0; i < 9; i++)
333eea9c
JH		 4271 {
4272 while (*s && isspace(*s)) s++;
4273 if (!*s) break;
bef3ea7f 4274 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4275 {
4276 tmp = name;
4277 goto bad;
4278 }
4279 }
ef21c07d
JH		 4280
4281sav_narg = acl_narg;
bef3ea7f 4282acl_narg = i;
ef21c07d
JH		 4283for (i = 0; i < acl_narg; i++)
4284 {
4285 sav_arg[i] = acl_arg[i];
4286 acl_arg[i] = tmp_arg[i];
4287 }
4288while (i < 9)
4289 {
4290 sav_arg[i] = acl_arg[i];
4291 acl_arg[i++] = NULL;
4292 }
4293
4294ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4295
ef21c07d
JH		 4296acl_narg = sav_narg;
4297for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4298return ret;
333eea9c
JH		 4299
4300bad:
4301if (expand_string_forcedfail) return ERROR;
4302*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4303 tmp, expand_string_message);
4304return search_find_defer?DEFER:ERROR;
4305}
4306
4307
4308
059ec3d9
PH		 4309/*************************************************
4310* Check access using an ACL *
4311*************************************************/
4312
faa05a93
JH		 4313/* Alternate interface for ACL, used by expansions */
4314int
05caaeaa 4315acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4316{
faa05a93
JH		 4317address_item adb;
4318address_item *addr = NULL;
4319
4320*user_msgptr = *log_msgptr = NULL;
4321sender_verified_failed = NULL;
4322ratelimiters_cmd = NULL;
4323log_reject_target = LOG_MAIN|LOG_REJECT;
4324
4325if (where == ACL_WHERE_RCPT)
4326 {
4327 adb = address_defaults;
4328 addr = &adb;
05caaeaa
JH		 4329 addr->address = expand_string(US"$local_part@$domain");
4330 addr->domain = deliver_domain;
4331 addr->local_part = deliver_localpart;
4332 addr->cc_local_part = deliver_localpart;
4333 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4334 }
4335
4336return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4337}
4338
4339
4340
059ec3d9
PH		 4341/* This is the external interface for ACL checks. It sets up an address and the
4342expansions for $domain and $local_part when called after RCPT, then calls
4343acl_check_internal() to do the actual work.
4344
4345Arguments:
4346 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4347 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4348 s the input string; NULL is the same as an empty ACL => DENY
4349 user_msgptr where to put a user error (for SMTP response)
4350 log_msgptr where to put a logging message (not for SMTP response)
4351
4352Returns: OK access is granted by an ACCEPT verb
4353 DISCARD access is granted by a DISCARD verb
4354 FAIL access is denied
4355 FAIL_DROP access is denied; drop the connection
4356 DEFER can't tell at the moment
4357 ERROR disaster
4358*/
faa05a93 4359int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4360
4361int
64ffc24f 4362acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4363 uschar **log_msgptr)
4364{
4365int rc;
4366address_item adb;
64ffc24f 4367address_item *addr = NULL;
059ec3d9
PH		 4368
4369*user_msgptr = *log_msgptr = NULL;
4370sender_verified_failed = NULL;
fe0dab11 4371ratelimiters_cmd = NULL;
6ea85e9a 4372log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4373
8ccd00b1 4374#ifndef DISABLE_PRDR
5032d1cf 4375if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR)
fd98a5c6 4376#else
5032d1cf 4377if (where == ACL_WHERE_RCPT)
fd98a5c6 4378#endif
059ec3d9
PH		 4379 {
4380 adb = address_defaults;
4381 addr = &adb;
64ffc24f 4382 addr->address = recipient;
059ec3d9
PH		 4383 if (deliver_split_address(addr) == DEFER)
4384 {
4385 *log_msgptr = US"defer in percent_hack_domains check";
4386 return DEFER;
4387 }
9bfc60eb
JH		 4388#ifdef EXPERIMENTAL_INTERNATIONAL
4389 addr->p.utf8 = message_smtputf8;
4390#endif
059ec3d9
PH		 4391 deliver_domain = addr->domain;
4392 deliver_localpart = addr->local_part;
4393 }
059ec3d9 4394
faa05a93 4395acl_where = where;
059ec3d9 4396rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4397acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4398
817d9f57
JH		 4399/* Cutthrough - if requested,
4400and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4401and rcpt acl returned accept,
4402and first recipient (cancel on any subsequents)
e4bdf652 4403open one now and run it up to RCPT acceptance.
e4bdf652 4404A failed verify should cancel cutthrough request.
e4bdf652 4405
817d9f57 4406Initial implementation: dual-write to spool.
e4bdf652
JH		 4407Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4408
4409Cease cutthrough copy on rxd final dot; do not send one.
4410
4411On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4412
4413On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4414perm-rejected, reflect that to the original sender - and dump the spooled copy.
4415If temp-reject, close the conn (and keep the spooled copy).
4416If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4417*/
4418switch (where)
4419{
4420case ACL_WHERE_RCPT:
8ccd00b1 4421#ifndef DISABLE_PRDR
fd98a5c6
JH		 4422case ACL_WHERE_PRDR:
4423#endif
5032d1cf 4424 if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
e4bdf652
JH		 4425 open_cutthrough_connection(addr);
4426 break;
4427
4428case ACL_WHERE_PREDATA:
4429 if( rc == OK )
4430 cutthrough_predata();
4431 else
2e5b33cd 4432 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4433 break;
4434
4435case ACL_WHERE_QUIT:
4436case ACL_WHERE_NOTQUIT:
2e5b33cd 4437 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4438 break;
4439
4440default:
4441 break;
4442}
4443
64ffc24f
PH		 4444deliver_domain = deliver_localpart = deliver_address_data =
4445 sender_address_data = NULL;
059ec3d9
PH		 4446
4447/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4448ACL, which is really in the middle of an SMTP command. */
4449
4450if (rc == DISCARD)
4451 {
4452 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4453 {
4454 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4455 "ACL", acl_wherenames[where]);
4456 return ERROR;
4457 }
4458 return DISCARD;
4459 }
4460
4461/* A DROP response is not permitted from MAILAUTH */
4462
4463if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4464 {
4465 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4466 "ACL", acl_wherenames[where]);
4467 return ERROR;
4468 }
4469
4e88a19f
PH		 4470/* Before giving a response, take a look at the length of any user message, and
4471split it up into multiple lines if possible. */
059ec3d9 4472
e28326d8
PH		 4473*user_msgptr = string_split_message(*user_msgptr);
4474if (fake_response != OK)
4475 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4476
4477return rc;
4478}
4479
38a0a95f 4480
38a0a95f
PH		 4481/*************************************************
4482* Create ACL variable *
4483*************************************************/
4484
4485/* Create an ACL variable or reuse an existing one. ACL variables are in a
4486binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4487
4488Argument:
4489 name pointer to the variable's name, starting with c or m
4490
4491Returns the pointer to variable's tree node
4492*/
4493
4494tree_node *
4495acl_var_create(uschar *name)
4496{
4497tree_node *node, **root;
4498root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4499node = tree_search(*root, name);
4500if (node == NULL)
4501 {
4502 node = store_get(sizeof(tree_node) + Ustrlen(name));
4503 Ustrcpy(node->name, name);
4504 (void)tree_insertnode(root, node);
4505 }
4506node->data.ptr = NULL;
4507return node;
4508}
4509
4510
4511
4512/*************************************************
4513* Write an ACL variable in spool format *
4514*************************************************/
4515
4516/* This function is used as a callback for tree_walk when writing variables to
4517the spool file. To retain spool file compatibility, what is written is -aclc or
4518-aclm followed by the rest of the name and the data length, space separated,
4519then the value itself, starting on a new line, and terminated by an additional
4520newline. When we had only numbered ACL variables, the first line might look
4521like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4522acl_cfoo.
4523
4524Arguments:
4525 name of the variable
4526 value of the variable
4527 ctx FILE pointer (as a void pointer)
4528
4529Returns: nothing
4530*/
4531
4532void
4533acl_var_write(uschar *name, uschar *value, void *ctx)
4534{
4535FILE *f = (FILE *)ctx;
4536fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4537}
4538
9171d434
JH		 4539/* vi: aw ai sw=2
4540*/
059ec3d9 4541/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.