projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Multiple typo fixes.
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef 183 CONTROL_AUTH_UNADVERTISED,
3c8b3577 184#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
3c8b3577 186#endif
ed7f7860 187 CONTROL_DEBUG,
3c8b3577 188#ifndef DISABLE_DKIM
f7572e5a 189 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 190#endif
191#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
3c8b3577 194#endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 206#ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 208#endif
c46782ef
PH		 209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
3c8b3577
JH		 211#ifdef EXPERIMENTAL_INTERNATIONAL
212 CONTROL_UTF8_DOWNCONVERT,
213#endif
cf8b11a5 214 CONTROL_NO_MULTILINE,
047bdd8c 215 CONTROL_NO_PIPELINING,
4c590bd1
PH		 216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
c46782ef 218};
9a26b6b2 219
8800895a
PH		 220/* ACL control names; keep in step with the table above! This list is used for
221turning ids into names. The actual list of recognized names is in the variable
222control_def controls_list[] below. The fact that there are two lists is a mess
223and should be tidied up. */
9a26b6b2
PH		 224
225static uschar *controls[] = {
c46782ef 226 US"allow_auth_unadvertised",
3c8b3577 227#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 228 US"bmi_run",
3c8b3577 229#endif
ed7f7860 230 US"debug",
3c8b3577 231#ifndef DISABLE_DKIM
80a47a2c 232 US"dkim_disable_verify",
3c8b3577
JH		 233#endif
234#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
3c8b3577 237#endif
13363eba 238 US"dscp",
c46782ef
PH		 239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
e4bdf652 242 US"cutthrough_delivery",
c46782ef
PH		 243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
3c8b3577 249#ifdef WITH_CONTENT_SCAN
9a26b6b2 250 US"no_mbox_unspool",
3c8b3577 251#endif
cf8b11a5
PH		 252 US"fakedefer",
253 US"fakereject",
3c8b3577
JH		 254#ifdef EXPERIMENTAL_INTERNATIONAL
255 US"utf8_downconvert",
256#endif
aa6dc513 257 US"no_multiline_responses",
cf8b11a5 258 US"no_pipelining",
4c590bd1
PH		 259 US"no_delay_flush",
260 US"no_callout_flush"
c46782ef 261};
059ec3d9 262
047bdd8c 263/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 264at the outer level. In the other cases, expansion already occurs in the
265checking functions. */
266
267static uschar cond_expand_at_top[] = {
7421ecab 268 FALSE, /* acl */
3e536984 269 TRUE, /* add_header */
059ec3d9 270 FALSE, /* authenticated */
8523533c
TK		 271#ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
8e669ac1 273#endif
059ec3d9 274 TRUE, /* condition */
c3611384 275 TRUE, /* continue */
059ec3d9 276 TRUE, /* control */
6a8f9482
TK		 277#ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279#endif
8523533c
TK		 280#ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282#endif
059ec3d9 283 TRUE, /* delay */
8523533c
TK		 284#ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
fb2274d4 286#endif
80a47a2c
TK		 287#ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
4840604e
TL		 290#endif
291#ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
8523533c 293#endif
059ec3d9
PH		 294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
6ea85e9a 301 TRUE, /* log_reject_target */
059ec3d9 302 TRUE, /* logwrite */
8523533c
TK		 303#ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305#endif
059ec3d9 306 TRUE, /* message */
8523533c
TK		 307#ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309#endif
870f6ba8 310 TRUE, /* ratelimit */
059ec3d9 311 FALSE, /* recipients */
8523533c
TK		 312#ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314#endif
e7568d51 315 TRUE, /* remove_header */
059ec3d9
PH		 316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
8523533c
TK		 319#ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321#endif
322#ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
65a7d8c3 324 TRUE, /* spf_guess */
8523533c 325#endif
b0019c78 326 TRUE, /* udpsend */
059ec3d9
PH		 327 TRUE /* verify */
328};
329
330/* Flags to identify the modifiers */
331
332static uschar cond_modifiers[] = {
333 FALSE, /* acl */
3e536984 334 TRUE, /* add_header */
059ec3d9 335 FALSE, /* authenticated */
8523533c
TK		 336#ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
8e669ac1 338#endif
059ec3d9 339 FALSE, /* condition */
c3611384 340 TRUE, /* continue */
059ec3d9 341 TRUE, /* control */
6a8f9482
TK		 342#ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344#endif
8523533c
TK		 345#ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347#endif
059ec3d9 348 TRUE, /* delay */
8523533c
TK		 349#ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
fb2274d4 351#endif
80a47a2c
TK		 352#ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
4840604e
TL		 355#endif
356#ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
8523533c 358#endif
059ec3d9
PH		 359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
6ea85e9a 366 TRUE, /* log_reject_target */
8523533c
TK		 367 TRUE, /* logwrite */
368#ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370#endif
059ec3d9 371 TRUE, /* message */
8523533c
TK		 372#ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374#endif
870f6ba8 375 FALSE, /* ratelimit */
059ec3d9 376 FALSE, /* recipients */
8523533c
TK		 377#ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379#endif
e7568d51 380 TRUE, /* remove_header */
059ec3d9
PH		 381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
8523533c
TK		 384#ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386#endif
387#ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
65a7d8c3 389 FALSE, /* spf_guess */
8523533c 390#endif
b0019c78 391 TRUE, /* udpsend */
059ec3d9
PH		 392 FALSE /* verify */
393};
394
c3611384 395/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 396times. For each condition and modifier, there's a bitmap of dis-allowed times.
397For some, it is easier to specify the negation of a small number of allowed
398times. */
059ec3d9
PH		 399
400static unsigned int cond_forbids[] = {
401 0, /* acl */
8e669ac1 402
71fafd95 403 (unsigned int)
45b91596 404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 406 #ifndef DISABLE_PRDR
fd98a5c6
JH		 407 (1<<ACL_WHERE_PRDR)|
408 #endif
45b91596 409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 410 (1<<ACL_WHERE_DKIM)|
45b91596 411 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 412
45b91596
PH		 413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 416
71fafd95 417 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 421 #ifndef DISABLE_PRDR
fd98a5c6
JH		 422 (1<<ACL_WHERE_PRDR)|
423 #endif
8e669ac1 424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 429 #endif
8e669ac1 430
059ec3d9 431 0, /* condition */
8e669ac1 432
c3611384
PH		 433 0, /* continue */
434
059ec3d9 435 /* Certain types of control are always allowed, so we let it through
2f079f46 436 always and check in the control processing itself. */
8e669ac1 437
059ec3d9 438 0, /* control */
8e669ac1 439
6a8f9482
TK		 440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
fd98a5c6 442 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 443 #ifndef DISABLE_PRDR
fd98a5c6 444 (1<<ACL_WHERE_PRDR)|
8ccd00b1 445 #endif
fd98a5c6 446 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 447 #endif
448
71fafd95 449 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 452 #endif
8523533c 453
8f128379 454 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 455
71fafd95 456 #ifdef WITH_OLD_DEMIME
2f079f46 457 (unsigned int)
fd98a5c6 458 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 459 #ifndef DISABLE_PRDR
fd98a5c6 460 (1<<ACL_WHERE_PRDR)|
8ccd00b1 461 #endif
fd98a5c6 462 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 463 #endif
8e669ac1 464
80a47a2c
TK		 465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 468
80a47a2c
TK		 469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 471 #endif
fb2274d4 472
4840604e
TL		 473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
45b91596
PH		 478 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
479 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 480
2f079f46 481 (unsigned int)
fd98a5c6 482 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 483 #ifndef DISABLE_PRDR
fd98a5c6
JH		 484 |(1<<ACL_WHERE_PRDR)
485 #endif
486 ),
059ec3d9 487
45b91596
PH		 488 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
489 (1<<ACL_WHERE_CONNECT)|
490 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 491 (1<<ACL_WHERE_HELO),
8e669ac1 492
059ec3d9 493 0, /* endpass */
8e669ac1 494
45b91596
PH		 495 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
496 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 497
2f079f46 498 (unsigned int)
fd98a5c6 499 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 500 #ifndef DISABLE_PRDR
fd98a5c6
JH		 501 |(1<<ACL_WHERE_PRDR)
502 #endif
503 ),
059ec3d9
PH		 504
505 0, /* log_message */
8e669ac1 506
6ea85e9a
PH		 507 0, /* log_reject_target */
508
059ec3d9 509 0, /* logwrite */
8e669ac1 510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46 512 (unsigned int)
fd98a5c6 513 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 514 #ifndef DISABLE_PRDR
fd98a5c6 515 (1<<ACL_WHERE_PRDR)|
8ccd00b1 516 #endif
fd98a5c6 517 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 518 #endif
8523533c 519
059ec3d9
PH		 520 0, /* message */
521
71fafd95 522 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 525 #endif
8523533c 526
870f6ba8
TF		 527 0, /* ratelimit */
528
2f079f46
PH		 529 (unsigned int)
530 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 531
71fafd95 532 #ifdef WITH_CONTENT_SCAN
2f079f46 533 (unsigned int)
fd98a5c6 534 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 535 #ifndef DISABLE_PRDR
fd98a5c6 536 (1<<ACL_WHERE_PRDR)|
8ccd00b1 537 #endif
fd98a5c6 538 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 539 (1<<ACL_WHERE_MIME)),
71fafd95 540 #endif
8523533c 541
e7568d51
TL		 542 (unsigned int)
543 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
544 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 545 #ifndef DISABLE_PRDR
fd98a5c6
JH		 546 (1<<ACL_WHERE_PRDR)|
547 #endif
e7568d51
TL		 548 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
549 (1<<ACL_WHERE_NOTSMTP_START)),
550
059ec3d9
PH		 551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
558 (1<<ACL_WHERE_HELO)|
559 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
560 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
561 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
562
563 0, /* set */
564
71fafd95 565 #ifdef WITH_CONTENT_SCAN
2f079f46 566 (unsigned int)
fd98a5c6 567 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 568 #ifndef DISABLE_PRDR
fd98a5c6 569 (1<<ACL_WHERE_PRDR)|
8ccd00b1 570 #endif
fd98a5c6 571 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 572 #endif
8523533c 573
71fafd95 574 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 575 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
576 (1<<ACL_WHERE_HELO)|
577 (1<<ACL_WHERE_MAILAUTH)|
578 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 579 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
580 (1<<ACL_WHERE_NOTSMTP)|
581 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 582
583 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
584 (1<<ACL_WHERE_HELO)|
585 (1<<ACL_WHERE_MAILAUTH)|
586 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
587 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
588 (1<<ACL_WHERE_NOTSMTP)|
589 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 590 #endif
8523533c 591
b0019c78
TF		 592 0, /* udpsend */
593
059ec3d9
PH		 594 /* Certain types of verify are always allowed, so we let it through
595 always and check in the verify function itself */
596
597 0 /* verify */
059ec3d9
PH		 598};
599
600
c5fcb476
PH		 601/* Bit map vector of which controls are not allowed at certain times. For
602each control, there's a bitmap of dis-allowed times. For some, it is easier to
603specify the negation of a small number of allowed times. */
604
605static unsigned int control_forbids[] = {
c46782ef
PH		 606 (unsigned int)
607 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
608
3c8b3577 609#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 610 0, /* bmi_run */
3c8b3577 611#endif
c46782ef 612
ed7f7860
PP		 613 0, /* debug */
614
3c8b3577 615#ifndef DISABLE_DKIM
80a47a2c 616 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 617# ifndef DISABLE_PRDR
fd98a5c6 618 (1<<ACL_WHERE_PRDR)|
3c8b3577 619# endif
f7572e5a 620 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 621#endif
f7572e5a 622
3c8b3577 623#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 624 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
625 (1<<ACL_WHERE_NOTSMTP_START),
626 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
627 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 628#endif
4840604e 629
13363eba
PP		 630 (1<<ACL_WHERE_NOTSMTP)|
631 (1<<ACL_WHERE_NOTSMTP_START)|
632 (1<<ACL_WHERE_NOTQUIT), /* dscp */
633
c5fcb476 634 0, /* error */
8e669ac1
PH		 635
636 (unsigned int)
c5fcb476 637 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 638
639 (unsigned int)
c5fcb476 640 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 641
e4bdf652
JH		 642 (unsigned int)
643 0, /* cutthrough_delivery */
644
45b91596
PH		 645 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
646 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 647
45b91596
PH		 648 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
649 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476
PH		 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
659 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 660 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 661 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 662
663 (unsigned int)
c5fcb476 664 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 665 (1<<ACL_WHERE_PREDATA)),
8523533c 666
8800895a
PH		 667 (unsigned int)
668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 669 (1<<ACL_WHERE_PREDATA)|
670 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 671
3c8b3577 672#ifdef WITH_CONTENT_SCAN
8e669ac1 673 (unsigned int)
14d57970 674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 675 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 676 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 677 (1<<ACL_WHERE_MIME)),
3c8b3577 678#endif
a6c4ab60 679
29aba418
TF		 680 (unsigned int)
681 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
682 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 683#ifndef DISABLE_PRDR
fd98a5c6 684 (1<<ACL_WHERE_PRDR)|
3c8b3577 685#endif
29aba418
TF		 686 (1<<ACL_WHERE_MIME)),
687
8e669ac1 688 (unsigned int)
a6c4ab60 689 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 690 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 691#ifndef DISABLE_PRDR
fd98a5c6 692 (1<<ACL_WHERE_PRDR)|
3c8b3577 693#endif
e715ad22 694 (1<<ACL_WHERE_MIME)),
8523533c 695
3c8b3577
JH		 696#ifdef EXPERIMENTAL_INTERNATIONAL
697 0, /* utf8_downconvert */
698#endif
699
45b91596 700 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 701 (1<<ACL_WHERE_NOTSMTP_START),
702
703 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 704 (1<<ACL_WHERE_NOTSMTP_START),
705
706 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 707 (1<<ACL_WHERE_NOTSMTP_START),
708
709 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 710 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 711};
712
713/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 714
715typedef struct control_def {
716 uschar *name;
717 int value; /* CONTROL_xxx value */
059ec3d9
PH		 718 BOOL has_option; /* Has /option(s) following */
719} control_def;
720
721static control_def controls_list[] = {
3c8b3577 722 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 723#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 724 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 725#endif
3c8b3577 726 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 727#ifndef DISABLE_DKIM
3c8b3577 728 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 729#endif
730#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 731 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
732 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 733#endif
3c8b3577
JH		 734 { US"dscp", CONTROL_DSCP, TRUE },
735 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
736 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
737 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
738 { US"freeze", CONTROL_FREEZE, TRUE },
739 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
740 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
741 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
742 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
743 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
744 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 745#ifdef WITH_CONTENT_SCAN
3c8b3577 746 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 747#endif
3c8b3577
JH		 748 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
749 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
750 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 751 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577
JH		 752 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
753#ifdef EXPERIMENTAL_INTERNATIONAL
754 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
755#endif
059ec3d9
PH		 756 };
757
e5a9dba6
PH		 758/* Support data structures for Client SMTP Authorization. acl_verify_csa()
759caches its result in a tree to avoid repeated DNS queries. The result is an
760integer code which is used as an index into the following tables of
761explanatory strings and verification return codes. */
762
763static tree_node *csa_cache = NULL;
764
765enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
766 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
767
768/* The acl_verify_csa() return code is translated into an acl_verify() return
769code using the following table. It is OK unless the client is definitely not
770authorized. This is because CSA is supposed to be optional for sending sites,
771so recipients should not be too strict about checking it - especially because
772DNS problems are quite likely to occur. It's possible to use $csa_status in
773further ACL conditions to distinguish ok, unknown, and defer if required, but
774the aim is to make the usual configuration simple. */
775
776static int csa_return_code[] = {
777 OK, OK, OK, OK,
778 FAIL, FAIL, FAIL, FAIL
779};
780
781static uschar *csa_status_string[] = {
782 US"unknown", US"ok", US"defer", US"defer",
783 US"fail", US"fail", US"fail", US"fail"
784};
785
786static uschar *csa_reason_string[] = {
787 US"unknown",
788 US"ok",
789 US"deferred (SRV lookup failed)",
790 US"deferred (target address lookup failed)",
791 US"failed (explicit authorization required)",
792 US"failed (host name not authorized)",
793 US"failed (no authorized addresses)",
794 US"failed (client address mismatch)"
795};
796
c99ce5c9
TF		 797/* Options for the ratelimit condition. Note that there are two variants of
798the per_rcpt option, depending on the ACL that is used to measure the rate.
799However any ACL must be able to look up per_rcpt rates in /noupdate mode,
800so the two variants must have the same internal representation as well as
801the same configuration string. */
802
803enum {
804 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
805 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
806};
807
808#define RATE_SET(var,new) \
809 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
810
811static uschar *ratelimit_option_string[] = {
812 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
813 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
814};
815
059ec3d9
PH		 816/* Enable recursion between acl_check_internal() and acl_check_condition() */
817
55414b25 818static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 819 uschar **);
059ec3d9
PH		 820
821
822/*************************************************
823* Pick out name from list *
824*************************************************/
825
826/* Use a binary chop method
827
828Arguments:
829 name name to find
830 list list of names
831 end size of list
832
833Returns: offset in list, or -1 if not found
834*/
835
836static int
837acl_checkname(uschar *name, uschar **list, int end)
838{
839int start = 0;
840
841while (start < end)
842 {
843 int mid = (start + end)/2;
844 int c = Ustrcmp(name, list[mid]);
845 if (c == 0) return mid;
846 if (c < 0) end = mid; else start = mid + 1;
847 }
848
849return -1;
850}
851
852
853/*************************************************
854* Read and parse one ACL *
855*************************************************/
856
857/* This function is called both from readconf in order to parse the ACLs in the
858configuration file, and also when an ACL is encountered dynamically (e.g. as
859the result of an expansion). It is given a function to call in order to
860retrieve the lines of the ACL. This function handles skipping comments and
861blank lines (where relevant).
862
863Arguments:
864 func function to get next line of ACL
865 error where to put an error message
866
867Returns: pointer to ACL, or NULL
868 NULL can be legal (empty ACL); in this case error will be NULL
869*/
870
871acl_block *
872acl_read(uschar *(*func)(void), uschar **error)
873{
874acl_block *yield = NULL;
875acl_block **lastp = &yield;
876acl_block *this = NULL;
877acl_condition_block *cond;
878acl_condition_block **condp = NULL;
879uschar *s;
880
881*error = NULL;
882
883while ((s = (*func)()) != NULL)
884 {
885 int v, c;
886 BOOL negated = FALSE;
887 uschar *saveline = s;
888 uschar name[64];
889
890 /* Conditions (but not verbs) are allowed to be negated by an initial
891 exclamation mark. */
892
893 while (isspace(*s)) s++;
894 if (*s == '!')
895 {
896 negated = TRUE;
897 s++;
898 }
899
cf00dad6
PH		 900 /* Read the name of a verb or a condition, or the start of a new ACL, which
901 can be started by a name, or by a macro definition. */
059ec3d9
PH		 902
903 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 904 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 905
906 /* If a verb is unrecognized, it may be another condition or modifier that
907 continues the previous verb. */
908
909 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
910 if (v < 0)
911 {
912 if (this == NULL)
913 {
4e167a8c
PH		 914 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
915 saveline);
059ec3d9
PH		 916 return NULL;
917 }
918 }
919
920 /* New verb */
921
922 else
923 {
924 if (negated)
925 {
926 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
927 return NULL;
928 }
929 this = store_get(sizeof(acl_block));
930 *lastp = this;
931 lastp = &(this->next);
932 this->next = NULL;
933 this->verb = v;
934 this->condition = NULL;
935 condp = &(this->condition);
936 if (*s == 0) continue; /* No condition on this line */
937 if (*s == '!')
938 {
939 negated = TRUE;
940 s++;
941 }
942 s = readconf_readname(name, sizeof(name), s); /* Condition name */
943 }
944
945 /* Handle a condition or modifier. */
946
947 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
948 if (c < 0)
949 {
950 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
951 saveline);
952 return NULL;
953 }
954
955 /* The modifiers may not be negated */
956
957 if (negated && cond_modifiers[c])
958 {
959 *error = string_sprintf("ACL error: negation is not allowed with "
960 "\"%s\"", conditions[c]);
961 return NULL;
962 }
963
964 /* ENDPASS may occur only with ACCEPT or DISCARD. */
965
966 if (c == ACLC_ENDPASS &&
967 this->verb != ACL_ACCEPT &&
968 this->verb != ACL_DISCARD)
969 {
970 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
971 conditions[c], verbs[this->verb]);
972 return NULL;
973 }
974
975 cond = store_get(sizeof(acl_condition_block));
976 cond->next = NULL;
977 cond->type = c;
978 cond->u.negated = negated;
979
980 *condp = cond;
981 condp = &(cond->next);
982
983 /* The "set" modifier is different in that its argument is "name=value"
984 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 985 gives us a variable name to insert into the data block. The original ACL
986 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
987 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 988 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
989 After that, we allow alphanumerics and underscores, but the first character
990 after c or m must be a digit or an underscore. This retains backwards
991 compatibility. */
059ec3d9
PH		 992
993 if (c == ACLC_SET)
994 {
47ca6d6c
PH		 995 uschar *endptr;
996
38a0a95f
PH		 997 if (Ustrncmp(s, "acl_c", 5) != 0 &&
998 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 999 {
38a0a95f
PH		 1000 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1001 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1002 return NULL;
47ca6d6c 1003 }
38a0a95f
PH		 1004
1005 endptr = s + 5;
641cb756
PH		 1006 if (!isdigit(*endptr) && *endptr != '_')
1007 {
1008 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1009 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1010 s);
1011 return NULL;
1012 }
1013
38a0a95f 1014 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1015 {
38a0a95f
PH		 1016 if (!isalnum(*endptr) && *endptr != '_')
1017 {
1018 *error = string_sprintf("invalid character \"%c\" in variable name "
1019 "in ACL modifier \"set %s\"", *endptr, s);
1020 return NULL;
1021 }
1022 endptr++;
47ca6d6c 1023 }
47ca6d6c 1024
38a0a95f 1025 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1026 s = endptr;
059ec3d9
PH		 1027 while (isspace(*s)) s++;
1028 }
1029
1030 /* For "set", we are now positioned for the data. For the others, only
1031 "endpass" has no data */
1032
1033 if (c != ACLC_ENDPASS)
1034 {
1035 if (*s++ != '=')
1036 {
1037 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1038 cond_modifiers[c]? US"modifier" : US"condition");
1039 return NULL;
1040 }
1041 while (isspace(*s)) s++;
1042 cond->arg = string_copy(s);
1043 }
1044 }
1045
1046return yield;
1047}
1048
1049
1050
71fafd95
PH		 1051/*************************************************
1052* Set up added header line(s) *
1053*************************************************/
1054
1055/* This function is called by the add_header modifier, and also from acl_warn()
1056to implement the now-deprecated way of adding header lines using "message" on a
1057"warn" verb. The argument is treated as a sequence of header lines which are
1058added to a chain, provided there isn't an identical one already there.
1059
1060Argument: string of header lines
1061Returns: nothing
1062*/
1063
1064static void
55414b25 1065setup_header(const uschar *hstring)
71fafd95 1066{
55414b25 1067const uschar *p, *q;
71fafd95
PH		 1068int hlen = Ustrlen(hstring);
1069
b1b05573
JH		 1070/* Ignore any leading newlines */
1071while (*hstring == '\n') hstring++, hlen--;
71fafd95 1072
b1b05573 1073/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1074if (hlen <= 0) return;
55414b25
JH		 1075if (hstring[--hlen] != '\n')
1076 q = string_sprintf("%s\n", hstring);
1077else if (hstring[hlen-1] == '\n')
1078 {
1079 uschar * s = string_copy(hstring);
1080 while(s[--hlen] == '\n')
1081 s[hlen+1] = '\0';
1082 q = s;
1083 }
1084else
1085 q = hstring;
71fafd95
PH		 1086
1087/* Loop for multiple header lines, taking care about continuations */
1088
55414b25 1089for (p = q; *p != 0; )
71fafd95 1090 {
55414b25
JH		 1091 const uschar *s;
1092 uschar * hdr;
71fafd95
PH		 1093 int newtype = htype_add_bot;
1094 header_line **hptr = &acl_added_headers;
1095
1096 /* Find next header line within the string */
1097
1098 for (;;)
1099 {
1100 q = Ustrchr(q, '\n');
1101 if (*(++q) != ' ' && *q != '\t') break;
1102 }
1103
1104 /* If the line starts with a colon, interpret the instruction for where to
1105 add it. This temporarily sets up a new type. */
1106
1107 if (*p == ':')
1108 {
1109 if (strncmpic(p, US":after_received:", 16) == 0)
1110 {
1111 newtype = htype_add_rec;
1112 p += 16;
1113 }
1114 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1115 {
1116 newtype = htype_add_rfc;
1117 p += 14;
1118 }
1119 else if (strncmpic(p, US":at_start:", 10) == 0)
1120 {
1121 newtype = htype_add_top;
1122 p += 10;
1123 }
1124 else if (strncmpic(p, US":at_end:", 8) == 0)
1125 {
1126 newtype = htype_add_bot;
1127 p += 8;
1128 }
1129 while (*p == ' ' || *p == '\t') p++;
1130 }
1131
1132 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1133 to the front of it. */
1134
1135 for (s = p; s < q - 1; s++)
1136 {
1137 if (*s == ':' || !isgraph(*s)) break;
1138 }
1139
55414b25
JH		 1140 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1141 hlen = Ustrlen(hdr);
71fafd95
PH		 1142
1143 /* See if this line has already been added */
1144
1145 while (*hptr != NULL)
1146 {
55414b25 1147 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1148 hptr = &((*hptr)->next);
1149 }
1150
1151 /* Add if not previously present */
1152
1153 if (*hptr == NULL)
1154 {
1155 header_line *h = store_get(sizeof(header_line));
55414b25 1156 h->text = hdr;
71fafd95
PH		 1157 h->next = NULL;
1158 h->type = newtype;
1159 h->slen = hlen;
1160 *hptr = h;
1161 hptr = &(h->next);
1162 }
1163
1164 /* Advance for next header line within the string */
1165
1166 p = q;
1167 }
1168}
1169
1170
1171
362145b5
JH		 1172/*************************************************
1173* List the added header lines *
1174*************************************************/
1175uschar *
1176fn_hdrs_added(void)
1177{
1178uschar * ret = NULL;
1179header_line * h = acl_added_headers;
1180uschar * s;
1181uschar * cp;
1182int size = 0;
1183int ptr = 0;
1184
1185if (!h) return NULL;
1186
1187do
1188 {
1189 s = h->text;
1190 while ((cp = Ustrchr(s, '\n')) != NULL)
1191 {
1192 if (cp[1] == '\0') break;
1193
1194 /* contains embedded newline; needs doubling */
1195 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1196 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1197 s = cp+1;
1198 }
1199 /* last bit of header */
1200
1201 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1202 }
6d9cfc47 1203while((h = h->next));
362145b5
JH		 1204
1205ret[ptr-1] = '\0'; /* overwrite last newline */
1206return ret;
1207}
1208
1209
e7568d51
TL		 1210/*************************************************
1211* Set up removed header line(s) *
1212*************************************************/
1213
1214/* This function is called by the remove_header modifier. The argument is
1215treated as a sequence of header names which are added to a colon separated
1216list, provided there isn't an identical one already there.
1217
1218Argument: string of header names
1219Returns: nothing
1220*/
1221
1222static void
55414b25 1223setup_remove_header(const uschar *hnames)
e7568d51
TL		 1224{
1225if (*hnames != 0)
55414b25
JH		 1226 acl_removed_headers = acl_removed_headers
1227 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1228 : string_copy(hnames);
e7568d51
TL		 1229}
1230
1231
71fafd95 1232
059ec3d9
PH		 1233/*************************************************
1234* Handle warnings *
1235*************************************************/
1236
1237/* This function is called when a WARN verb's conditions are true. It adds to
1238the message's headers, and/or writes information to the log. In each case, this
1239only happens once (per message for headers, per connection for log).
1240
71fafd95
PH		 1241** NOTE: The header adding action using the "message" setting is historic, and
1242its use is now deprecated. The new add_header modifier should be used instead.
1243
059ec3d9
PH		 1244Arguments:
1245 where ACL_WHERE_xxxx indicating which ACL this is
1246 user_message message for adding to headers
1247 log_message message for logging, if different
1248
1249Returns: nothing
1250*/
1251
1252static void
1253acl_warn(int where, uschar *user_message, uschar *log_message)
1254{
059ec3d9
PH		 1255if (log_message != NULL && log_message != user_message)
1256 {
1257 uschar *text;
1258 string_item *logged;
1259
1260 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1261 string_printing(log_message));
1262
1263 /* If a sender verification has failed, and the log message is "sender verify
1264 failed", add the failure message. */
1265
1266 if (sender_verified_failed != NULL &&
1267 sender_verified_failed->message != NULL &&
1268 strcmpic(log_message, US"sender verify failed") == 0)
1269 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1270
9c7a242c
PH		 1271 /* Search previously logged warnings. They are kept in malloc
1272 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1273
1274 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1275 if (Ustrcmp(logged->text, text) == 0) break;
1276
1277 if (logged == NULL)
1278 {
1279 int length = Ustrlen(text) + 1;
1280 log_write(0, LOG_MAIN, "%s", text);
1281 logged = store_malloc(sizeof(string_item) + length);
1282 logged->text = (uschar *)logged + sizeof(string_item);
1283 memcpy(logged->text, text, length);
1284 logged->next = acl_warn_logged;
1285 acl_warn_logged = logged;
1286 }
1287 }
1288
1289/* If there's no user message, we are done. */
1290
1291if (user_message == NULL) return;
1292
1293/* If this isn't a message ACL, we can't do anything with a user message.
1294Log an error. */
1295
1296if (where > ACL_WHERE_NOTSMTP)
1297 {
1298 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1299 "found in a non-message (%s) ACL: cannot specify header lines here: "
1300 "message ignored", acl_wherenames[where]);
1301 return;
1302 }
1303
71fafd95
PH		 1304/* The code for setting up header lines is now abstracted into a separate
1305function so that it can be used for the add_header modifier as well. */
059ec3d9 1306
71fafd95 1307setup_header(user_message);
059ec3d9
PH		 1308}
1309
1310
1311
1312/*************************************************
1313* Verify and check reverse DNS *
1314*************************************************/
1315
1316/* Called from acl_verify() below. We look up the host name(s) of the client IP
1317address if this has not yet been done. The host_name_lookup() function checks
1318that one of these names resolves to an address list that contains the client IP
1319address, so we don't actually have to do the check here.
1320
1321Arguments:
1322 user_msgptr pointer for user message
1323 log_msgptr pointer for log message
1324
1325Returns: OK verification condition succeeded
1326 FAIL verification failed
1327 DEFER there was a problem verifying
1328*/
1329
1330static int
1331acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1332{
1333int rc;
1334
1335user_msgptr = user_msgptr; /* stop compiler warning */
1336
1337/* Previous success */
1338
1339if (sender_host_name != NULL) return OK;
1340
1341/* Previous failure */
1342
1343if (host_lookup_failed)
1344 {
1345 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1346 return FAIL;
1347 }
1348
1349/* Need to do a lookup */
1350
1351HDEBUG(D_acl)
1352 debug_printf("looking up host name to force name/address consistency check\n");
1353
1354if ((rc = host_name_lookup()) != OK)
1355 {
1356 *log_msgptr = (rc == DEFER)?
1357 US"host lookup deferred for reverse lookup check"
1358 :
1359 string_sprintf("host lookup failed for reverse lookup check%s",
1360 host_lookup_msg);
1361 return rc; /* DEFER or FAIL */
1362 }
1363
1364host_build_sender_fullhost();
1365return OK;
1366}
1367
1368
1369
e5a9dba6
PH		 1370/*************************************************
1371* Check client IP address matches CSA target *
1372*************************************************/
1373
1374/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1375response for address records belonging to the CSA target hostname. The section
1376is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1377If one of the addresses matches the client's IP address, then the client is
1378authorized by CSA. If there are target IP addresses but none of them match
1379then the client is using an unauthorized IP address. If there are no target IP
1380addresses then the client cannot be using an authorized IP address. (This is
1381an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1382
1383Arguments:
1384 dnsa the DNS answer block
1385 dnss a DNS scan block for us to use
1386 reset option specifing what portion to scan, as described above
1387 target the target hostname to use for matching RR names
1388
1389Returns: CSA_OK successfully authorized
1390 CSA_FAIL_MISMATCH addresses found but none matched
1391 CSA_FAIL_NOADDR no target addresses found
1392*/
1393
1394static int
1395acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1396 uschar *target)
1397{
1398dns_record *rr;
1399dns_address *da;
1400
1401BOOL target_found = FALSE;
1402
1403for (rr = dns_next_rr(dnsa, dnss, reset);
1404 rr != NULL;
1405 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1406 {
1407 /* Check this is an address RR for the target hostname. */
1408
1409 if (rr->type != T_A
1410 #if HAVE_IPV6
1411 && rr->type != T_AAAA
e5a9dba6
PH		 1412 #endif
1413 ) continue;
1414
1415 if (strcmpic(target, rr->name) != 0) continue;
1416
1417 target_found = TRUE;
1418
1419 /* Turn the target address RR into a list of textual IP addresses and scan
1420 the list. There may be more than one if it is an A6 RR. */
1421
1422 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1423 {
1424 /* If the client IP address matches the target IP address, it's good! */
1425
1426 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1427
1428 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1429 }
1430 }
1431
1432/* If we found some target addresses but none of them matched, the client is
1433using an unauthorized IP address, otherwise the target has no authorized IP
1434addresses. */
1435
1436if (target_found) return CSA_FAIL_MISMATCH;
1437else return CSA_FAIL_NOADDR;
1438}
1439
1440
1441
1442/*************************************************
1443* Verify Client SMTP Authorization *
1444*************************************************/
1445
1446/* Called from acl_verify() below. This routine calls dns_lookup_special()
1447to find the CSA SRV record corresponding to the domain argument, or
1448$sender_helo_name if no argument is provided. It then checks that the
1449client is authorized, and that its IP address corresponds to the SRV
1450target's address by calling acl_verify_csa_address() above. The address
1451should have been returned in the DNS response's ADDITIONAL section, but if
1452not we perform another DNS lookup to get it.
1453
1454Arguments:
1455 domain pointer to optional parameter following verify = csa
1456
1457Returns: CSA_UNKNOWN no valid CSA record found
1458 CSA_OK successfully authorized
1459 CSA_FAIL_* client is definitely not authorized
1460 CSA_DEFER_* there was a DNS problem
1461*/
1462
1463static int
55414b25 1464acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1465{
1466tree_node *t;
55414b25
JH		 1467const uschar *found;
1468uschar *p;
e5a9dba6
PH		 1469int priority, weight, port;
1470dns_answer dnsa;
1471dns_scan dnss;
1472dns_record *rr;
1473int rc, type;
1474uschar target[256];
1475
1476/* Work out the domain we are using for the CSA lookup. The default is the
1477client's HELO domain. If the client has not said HELO, use its IP address
1478instead. If it's a local client (exim -bs), CSA isn't applicable. */
1479
1480while (isspace(*domain) && *domain != '\0') ++domain;
1481if (*domain == '\0') domain = sender_helo_name;
1482if (domain == NULL) domain = sender_host_address;
1483if (sender_host_address == NULL) return CSA_UNKNOWN;
1484
1485/* If we have an address literal, strip off the framing ready for turning it
1486into a domain. The framing consists of matched square brackets possibly
1487containing a keyword and a colon before the actual IP address. */
1488
1489if (domain[0] == '[')
1490 {
55414b25 1491 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1492 if (start == NULL) start = domain;
1493 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1494 }
1495
1496/* Turn domains that look like bare IP addresses into domains in the reverse
1497DNS. This code also deals with address literals and $sender_host_address. It's
1498not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1499address literals, but it's probably the most friendly thing to do. This is an
1500extension to CSA, so we allow it to be turned off for proper conformance. */
1501
7e66e54d 1502if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1503 {
1504 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1505 dns_build_reverse(domain, target);
1506 domain = target;
1507 }
1508
1509/* Find out if we've already done the CSA check for this domain. If we have,
1510return the same result again. Otherwise build a new cached result structure
1511for this domain. The name is filled in now, and the value is filled in when
1512we return from this function. */
1513
1514t = tree_search(csa_cache, domain);
1515if (t != NULL) return t->data.val;
1516
1517t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1518Ustrcpy(t->name, domain);
1519(void)tree_insertnode(&csa_cache, t);
1520
1521/* Now we are ready to do the actual DNS lookup(s). */
1522
28e6ef29 1523found = domain;
e5a9dba6
PH		 1524switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1525 {
1526 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1527
1528 default:
1529 return t->data.val = CSA_DEFER_SRV;
1530
1531 /* If we found nothing, the client's authorization is unknown. */
1532
1533 case DNS_NOMATCH:
1534 case DNS_NODATA:
1535 return t->data.val = CSA_UNKNOWN;
1536
1537 /* We got something! Go on to look at the reply in more detail. */
1538
1539 case DNS_SUCCEED:
1540 break;
1541 }
1542
1543/* Scan the reply for well-formed CSA SRV records. */
1544
1545for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1546 rr != NULL;
1547 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1548 {
1549 if (rr->type != T_SRV) continue;
1550
1551 /* Extract the numerical SRV fields (p is incremented) */
1552
1553 p = rr->data;
1554 GETSHORT(priority, p);
1555 GETSHORT(weight, p);
1556 GETSHORT(port, p);
1557
1558 DEBUG(D_acl)
1559 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1560
1561 /* Check the CSA version number */
1562
1563 if (priority != 1) continue;
1564
1565 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1566 found by dns_special_lookup() is a parent of the one we asked for), we check
1567 the subdomain assertions in the port field. At the moment there's only one
1568 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1569 SRV records of their own. */
1570
1dc92d5a 1571 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1572 {
1573 if (port & 1)
1574 return t->data.val = CSA_FAIL_EXPLICIT;
1575 else
1576 return t->data.val = CSA_UNKNOWN;
1577 }
1578
1579 /* This CSA SRV record refers directly to our domain, so we check the value
1580 in the weight field to work out the domain's authorization. 0 and 1 are
1581 unauthorized; 3 means the client is authorized but we can't check the IP
1582 address in order to authenticate it, so we treat it as unknown; values
1583 greater than 3 are undefined. */
1584
1585 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1586
1587 if (weight > 2) continue;
1588
1589 /* Weight == 2, which means the domain is authorized. We must check that the
1590 client's IP address is listed as one of the SRV target addresses. Save the
1591 target hostname then break to scan the additional data for its addresses. */
1592
1593 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1594 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1595
1596 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1597
1598 break;
1599 }
1600
1601/* If we didn't break the loop then no appropriate records were found. */
1602
1603if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1604
1605/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1606A target of "." indicates there are no valid addresses, so the client cannot
1607be authorized. (This is an odd configuration because weight=2 target=. is
1608equivalent to weight=1, but we check for it in order to keep load off the
1609root name servers.) Note that dn_expand() turns "." into "". */
1610
1611if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1612
1613/* Scan the additional section of the CSA SRV reply for addresses belonging
1614to the target. If the name server didn't return any additional data (e.g.
1615because it does not fully support SRV records), we need to do another lookup
1616to obtain the target addresses; otherwise we have a definitive result. */
1617
1618rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1619if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1620
1621/* The DNS lookup type corresponds to the IP version used by the client. */
1622
1623#if HAVE_IPV6
1624if (Ustrchr(sender_host_address, ':') != NULL)
1625 type = T_AAAA;
1626else
1627#endif /* HAVE_IPV6 */
1628 type = T_A;
1629
1630
4e0983dc 1631lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1632switch (dns_lookup(&dnsa, target, type, NULL))
1633 {
1634 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1635
1636 default:
cc00f4af 1637 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1638
1639 /* If the query succeeded, scan the addresses and return the result. */
1640
1641 case DNS_SUCCEED:
cc00f4af
JH		 1642 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1643 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1644 /* else fall through */
e5a9dba6
PH		 1645
1646 /* If the target has no IP addresses, the client cannot have an authorized
1647 IP address. However, if the target site uses A6 records (not AAAA records)
1648 we have to do yet another lookup in order to check them. */
1649
1650 case DNS_NOMATCH:
1651 case DNS_NODATA:
cc00f4af 1652 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1653 }
1654}
1655
1656
1657
059ec3d9
PH		 1658/*************************************************
1659* Handle verification (address & other) *
1660*************************************************/
1661
89583014 1662enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1663 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1664 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1665 };
1666typedef struct {
1667 uschar * name;
1668 int value;
1669 unsigned where_allowed; /* bitmap */
1670 BOOL no_options; /* Never has /option(s) following */
1671 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1672 } verify_type_t;
1673static verify_type_t verify_type_list[] = {
7e8360e6 1674 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1675 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1676 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1677 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1678 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1679 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1680 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1681 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1682 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1683 FALSE, 6 },
770747fd
MFM		 1684 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1685 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1686 };
1687
1688
1689enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1690 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1691 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1692 CALLOUT_TIME
1693 };
1694typedef struct {
1695 uschar * name;
1696 int value;
1697 int flag;
1698 BOOL has_option; /* Has =option(s) following */
1699 BOOL timeval; /* Has a time value */
1700 } callout_opt_t;
1701static callout_opt_t callout_opt_list[] = {
1702 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1703 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1704 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1705 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1706 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1707 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1708 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1709 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1710 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1711 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1712 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1713 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1714 };
1715
1716
1717
059ec3d9
PH		 1718/* This function implements the "verify" condition. It is called when
1719encountered in any ACL, because some tests are almost always permitted. Some
1720just don't make sense, and always fail (for example, an attempt to test a host
1721lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1722
1723Arguments:
1724 where where called from
1725 addr the recipient address that the ACL is handling, or NULL
1726 arg the argument of "verify"
1727 user_msgptr pointer for user message
1728 log_msgptr pointer for log message
1729 basic_errno where to put verify errno
1730
1731Returns: OK verification condition succeeded
1732 FAIL verification failed
1733 DEFER there was a problem verifying
1734 ERROR syntax error
1735*/
1736
1737static int
55414b25 1738acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1739 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1740{
1741int sep = '/';
1742int callout = -1;
1743int callout_overall = -1;
4deaf07d 1744int callout_connect = -1;
059ec3d9
PH		 1745int verify_options = 0;
1746int rc;
1747BOOL verify_header_sender = FALSE;
1748BOOL defer_ok = FALSE;
1749BOOL callout_defer_ok = FALSE;
1750BOOL no_details = FALSE;
eafd343b 1751BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1752address_item *sender_vaddr = NULL;
1753uschar *verify_sender_address = NULL;
1754uschar *pm_mailfrom = NULL;
1755uschar *se_mailfrom = NULL;
596875b3
PH		 1756
1757/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1758an error if options are given for items that don't expect them.
596875b3
PH		 1759*/
1760
1761uschar *slash = Ustrchr(arg, '/');
55414b25 1762const uschar *list = arg;
059ec3d9 1763uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1764verify_type_t * vp;
059ec3d9
PH		 1765
1766if (ss == NULL) goto BAD_VERIFY;
1767
1768/* Handle name/address consistency verification in a separate function. */
1769
89583014
JH		 1770for (vp= verify_type_list;
1771 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1772 vp++
1773 )
1774 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1775 : strcmpic (ss, vp->name) == 0)
1776 break;
1777if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1778 goto BAD_VERIFY;
1779
1780if (vp->no_options && slash != NULL)
059ec3d9 1781 {
89583014
JH		 1782 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1783 "(this verify item has no options)", arg);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786if (!(vp->where_allowed & (1<<where)))
059ec3d9 1787 {
89583014
JH		 1788 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1789 return ERROR;
059ec3d9 1790 }
89583014 1791switch(vp->value)
596875b3 1792 {
89583014
JH		 1793 case VERIFY_REV_HOST_LKUP:
1794 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1795 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1796 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1797 if (strcmpic(ss, US"defer_ok") == 0)
1798 return OK;
1799 return rc;
059ec3d9 1800
89583014
JH		 1801 case VERIFY_CERT:
1802 /* TLS certificate verification is done at STARTTLS time; here we just
1803 test whether it was successful or not. (This is for optional verification; for
1804 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1805
817d9f57 1806 if (tls_in.certificate_verified) return OK;
89583014
JH		 1807 *user_msgptr = US"no verified certificate";
1808 return FAIL;
e5a9dba6 1809
89583014
JH		 1810 case VERIFY_HELO:
1811 /* We can test the result of optional HELO verification that might have
1812 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1813
89583014
JH		 1814 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1815 return helo_verified? OK : FAIL;
059ec3d9 1816
89583014
JH		 1817 case VERIFY_CSA:
1818 /* Do Client SMTP Authorization checks in a separate function, and turn the
1819 result code into user-friendly strings. */
1c41c9cc 1820
89583014
JH		 1821 rc = acl_verify_csa(list);
1822 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1823 csa_reason_string[rc]);
1824 csa_status = csa_status_string[rc];
1825 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1826 return csa_return_code[rc];
1827
1828 case VERIFY_HDR_SYNTAX:
1829 /* Check that all relevant header lines have the correct syntax. If there is
1830 a syntax error, we return details of the error to the sender if configured to
1831 send out full details. (But a "message" setting on the ACL can override, as
1832 always). */
1833
1834 rc = verify_check_headers(log_msgptr);
1835 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1836 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1837 return rc;
059ec3d9 1838
770747fd
MFM		 1839 case VERIFY_HDR_NAMES_ASCII:
1840 /* Check that all header names are true 7 bit strings
1841 See RFC 5322, 2.2. and RFC 6532, 3. */
1842
1843 rc = verify_check_header_names_ascii(log_msgptr);
1844 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1845 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1846 return rc;
1847
89583014
JH		 1848 case VERIFY_NOT_BLIND:
1849 /* Check that no recipient of this message is "blind", that is, every envelope
1850 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1851
89583014
JH		 1852 rc = verify_check_notblind();
1853 if (rc != OK)
1854 {
1855 *log_msgptr = string_sprintf("bcc recipient detected");
1856 if (smtp_return_error_details)
1857 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1858 }
1859 return rc;
059ec3d9 1860
89583014
JH		 1861 /* The remaining verification tests check recipient and sender addresses,
1862 either from the envelope or from the header. There are a number of
1863 slash-separated options that are common to all of them. */
059ec3d9 1864
89583014
JH		 1865 case VERIFY_HDR_SNDR:
1866 verify_header_sender = TRUE;
1867 break;
059ec3d9 1868
89583014
JH		 1869 case VERIFY_SNDR:
1870 /* In the case of a sender, this can optionally be followed by an address to use
1871 in place of the actual sender (rare special-case requirement). */
059ec3d9 1872 {
89583014
JH		 1873 uschar *s = ss + 6;
1874 if (*s == 0)
1875 verify_sender_address = sender_address;
1876 else
1877 {
1878 while (isspace(*s)) s++;
1879 if (*s++ != '=') goto BAD_VERIFY;
1880 while (isspace(*s)) s++;
1881 verify_sender_address = string_copy(s);
1882 }
059ec3d9 1883 }
89583014
JH		 1884 break;
1885
1886 case VERIFY_RCPT:
1887 break;
059ec3d9
PH		 1888 }
1889
89583014
JH		 1890
1891
596875b3
PH		 1892/* Remaining items are optional; they apply to sender and recipient
1893verification, including "header sender" verification. */
059ec3d9
PH		 1894
1895while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1896 != NULL)
1897 {
1898 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1899 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1900 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1901
1902 /* These two old options are left for backwards compatibility */
1903
1904 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1905 {
1906 callout_defer_ok = TRUE;
1907 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1908 }
1909
1910 else if (strcmpic(ss, US"check_postmaster") == 0)
1911 {
1912 pm_mailfrom = US"";
1913 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1914 }
1915
1916 /* The callout option has a number of sub-options, comma separated */
1917
1918 else if (strncmpic(ss, US"callout", 7) == 0)
1919 {
1920 callout = CALLOUT_TIMEOUT_DEFAULT;
1921 ss += 7;
1922 if (*ss != 0)
1923 {
1924 while (isspace(*ss)) ss++;
1925 if (*ss++ == '=')
1926 {
55414b25 1927 const uschar * sublist = ss;
059ec3d9
PH		 1928 int optsep = ',';
1929 uschar *opt;
1930 uschar buffer[256];
55414b25 1931 while (isspace(*sublist)) sublist++;
8e669ac1 1932
55414b25 1933 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1934 != NULL)
1935 {
89583014 1936 callout_opt_t * op;
438257ba 1937 double period = 1.0F;
059ec3d9 1938
89583014 1939 for (op= callout_opt_list; op->name; op++)
438257ba 1940 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1941 break;
059ec3d9 1942
89583014
JH		 1943 verify_options |= op->flag;
1944 if (op->has_option)
1945 {
438257ba 1946 opt += Ustrlen(op->name);
4deaf07d
PH		 1947 while (isspace(*opt)) opt++;
1948 if (*opt++ != '=')
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after "
89583014 1951 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1952 return ERROR;
1953 }
1954 while (isspace(*opt)) opt++;
89583014
JH		 1955 }
1956 if (op->timeval)
1957 {
1958 period = readconf_readtime(opt, 0, FALSE);
1959 if (period < 0)
4deaf07d
PH		 1960 {
1961 *log_msgptr = string_sprintf("bad time value in ACL condition "
1962 "\"verify %s\"", arg);
1963 return ERROR;
1964 }
89583014
JH		 1965 }
1966
1967 switch(op->value)
1968 {
1969 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1970 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1971 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1972 case CALLOUT_MAILFROM:
1973 if (!verify_header_sender)
1974 {
1975 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1976 "callout option only for verify=header_sender (detected in ACL "
1977 "condition \"%s\")", arg);
1978 return ERROR;
1979 }
1980 se_mailfrom = string_copy(opt);
1981 break;
1982 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1983 case CALLOUT_MAXWAIT: callout_overall = period; break;
1984 case CALLOUT_CONNECT: callout_connect = period; break;
1985 case CALLOUT_TIME: callout = period; break;
1986 }
059ec3d9
PH		 1987 }
1988 }
1989 else
1990 {
1991 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1992 "ACL condition \"%s\"", arg);
1993 return ERROR;
1994 }
1995 }
1996 }
1997
1998 /* Option not recognized */
1999
2000 else
2001 {
2002 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2003 "condition \"verify %s\"", ss, arg);
2004 return ERROR;
2005 }
2006 }
2007
2008if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2009 (vopt_callout_recipsender|vopt_callout_recippmaster))
2010 {
2011 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2012 "for a recipient callout";
2013 return ERROR;
2014 }
2015
2016/* Handle sender-in-header verification. Default the user message to the log
2017message if giving out verification details. */
2018
2019if (verify_header_sender)
2020 {
8e669ac1 2021 int verrno;
059ec3d9 2022 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2023 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2024 &verrno);
2025 if (rc != OK)
8e669ac1 2026 {
fe5b5d0b
PH		 2027 *basic_errno = verrno;
2028 if (smtp_return_error_details)
2029 {
2030 if (*user_msgptr == NULL && *log_msgptr != NULL)
2031 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2032 if (rc == DEFER) acl_temp_details = TRUE;
2033 }
8e669ac1 2034 }
059ec3d9
PH		 2035 }
2036
2037/* Handle a sender address. The default is to verify *the* sender address, but
2038optionally a different address can be given, for special requirements. If the
2039address is empty, we are dealing with a bounce message that has no sender, so
2040we cannot do any checking. If the real sender address gets rewritten during
2041verification (e.g. DNS widening), set the flag to stop it being rewritten again
2042during message reception.
2043
2044A list of verified "sender" addresses is kept to try to avoid doing to much
2045work repetitively when there are multiple recipients in a message and they all
2046require sender verification. However, when callouts are involved, it gets too
2047complicated because different recipients may require different callout options.
2048Therefore, we always do a full sender verify when any kind of callout is
2049specified. Caching elsewhere, for instance in the DNS resolver and in the
2050callout handling, should ensure that this is not terribly inefficient. */
2051
2052else if (verify_sender_address != NULL)
2053 {
2054 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2055 != 0)
2056 {
2057 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2058 "sender verify callout";
2059 return ERROR;
2060 }
2061
2062 sender_vaddr = verify_checked_sender(verify_sender_address);
2063 if (sender_vaddr != NULL && /* Previously checked */
2064 callout <= 0) /* No callout needed this time */
2065 {
2066 /* If the "routed" flag is set, it means that routing worked before, so
2067 this check can give OK (the saved return code value, if set, belongs to a
2068 callout that was done previously). If the "routed" flag is not set, routing
2069 must have failed, so we use the saved return code. */
2070
2071 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2072 {
2073 rc = sender_vaddr->special_action;
2074 *basic_errno = sender_vaddr->basic_errno;
2075 }
2076 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2077 }
2078
2079 /* Do a new verification, and cache the result. The cache is used to avoid
2080 verifying the sender multiple times for multiple RCPTs when callouts are not
2081 specified (see comments above).
2082
2083 The cache is also used on failure to give details in response to the first
2084 RCPT that gets bounced for this reason. However, this can be suppressed by
2085 the no_details option, which sets the flag that says "this detail has already
2086 been sent". The cache normally contains just one address, but there may be
2087 more in esoteric circumstances. */
2088
2089 else
2090 {
2091 BOOL routed = TRUE;
2a3eea10 2092 uschar *save_address_data = deliver_address_data;
8e669ac1 2093
059ec3d9 2094 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
f358d5e0 2095#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH		 2096 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2097 {
2098 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2099 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2100 }
f358d5e0 2101#endif
059ec3d9
PH		 2102 if (no_details) setflag(sender_vaddr, af_sverify_told);
2103 if (verify_sender_address[0] != 0)
2104 {
2105 /* If this is the real sender address, save the unrewritten version
2106 for use later in receive. Otherwise, set a flag so that rewriting the
2107 sender in verify_address() does not update sender_address. */
2108
2109 if (verify_sender_address == sender_address)
2110 sender_address_unrewritten = sender_address;
2111 else
2112 verify_options |= vopt_fake_sender;
2113
eafd343b
TK		 2114 if (success_on_redirect)
2115 verify_options |= vopt_success_on_redirect;
2116
059ec3d9
PH		 2117 /* The recipient, qualify, and expn options are never set in
2118 verify_options. */
2119
2120 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2121 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2122
2123 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2124
2125 if (rc == OK)
2126 {
2127 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2128 {
2129 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2130 verify_sender_address, sender_vaddr->address);
2131 }
2132 else
2133 {
2134 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2135 verify_sender_address);
2136 }
2137 }
2138 else *basic_errno = sender_vaddr->basic_errno;
2139 }
2140 else rc = OK; /* Null sender */
2141
2142 /* Cache the result code */
2143
2144 if (routed) setflag(sender_vaddr, af_verify_routed);
2145 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2146 sender_vaddr->special_action = rc;
2147 sender_vaddr->next = sender_verified_list;
2148 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2149
2150 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2151 the sender verification. */
8e669ac1 2152
2a3eea10 2153 deliver_address_data = save_address_data;
059ec3d9 2154 }
8e669ac1 2155
2a3eea10
PH		 2156 /* Put the sender address_data value into $sender_address_data */
2157
d43cbe25 2158 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2159 }
2160
2161/* A recipient address just gets a straightforward verify; again we must handle
2162the DEFER overrides. */
2163
2164else
2165 {
2166 address_item addr2;
2167
eafd343b
TK		 2168 if (success_on_redirect)
2169 verify_options |= vopt_success_on_redirect;
2170
059ec3d9
PH		 2171 /* We must use a copy of the address for verification, because it might
2172 get rewritten. */
2173
2174 addr2 = *addr;
2175 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2176 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2177 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2178
42855d71 2179 *basic_errno = addr2.basic_errno;
059ec3d9 2180 *log_msgptr = addr2.message;
8e669ac1 2181 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2182 addr2.user_message : addr2.message;
42855d71
PH		 2183
2184 /* Allow details for temporary error if the address is so flagged. */
2185 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2186
2187 /* Make $address_data visible */
d43cbe25 2188 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2189 }
2190
2191/* We have a result from the relevant test. Handle defer overrides first. */
2192
2193if (rc == DEFER && (defer_ok ||
2194 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2195 {
2196 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2197 defer_ok? "defer_ok" : "callout_defer_ok");
2198 rc = OK;
2199 }
2200
2201/* If we've failed a sender, set up a recipient message, and point
2202sender_verified_failed to the address item that actually failed. */
2203
2204if (rc != OK && verify_sender_address != NULL)
2205 {
2206 if (rc != DEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2208 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2209 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2210 else
2211 {
2212 *log_msgptr = US"Could not complete sender verify callout";
2213 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2214 *log_msgptr;
2215 }
2216
2217 sender_verified_failed = sender_vaddr;
2218 }
2219
2220/* Verifying an address messes up the values of $domain and $local_part,
2221so reset them before returning if this is a RCPT ACL. */
2222
2223if (addr != NULL)
2224 {
2225 deliver_domain = addr->domain;
2226 deliver_localpart = addr->local_part;
2227 }
2228return rc;
2229
2230/* Syntax errors in the verify argument come here. */
2231
2232BAD_VERIFY:
2233*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2234 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2235 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2236 "\"verify %s\"", arg);
2237return ERROR;
2238}
2239
2240
2241
2242
2243/*************************************************
2244* Check argument for control= modifier *
2245*************************************************/
2246
2247/* Called from acl_check_condition() below
2248
2249Arguments:
2250 arg the argument string for control=
2251 pptr set to point to the terminating character
2252 where which ACL we are in
2253 log_msgptr for error messages
2254
2255Returns: CONTROL_xxx value
2256*/
2257
2258static int
55414b25 2259decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2260{
2261int len;
2262control_def *d;
2263
2264for (d = controls_list;
2265 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2266 d++)
2267 {
2268 len = Ustrlen(d->name);
2269 if (Ustrncmp(d->name, arg, len) == 0) break;
2270 }
2271
2272if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2273 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2274 {
2275 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2276 return CONTROL_ERROR;
2277 }
2278
059ec3d9
PH		 2279*pptr = arg + len;
2280return d->value;
2281}
2282
2283
2284
c99ce5c9
TF		 2285
2286/*************************************************
2287* Return a ratelimit error *
2288*************************************************/
2289
2290/* Called from acl_ratelimit() below
2291
2292Arguments:
2293 log_msgptr for error messages
2294 format format string
2295 ... supplementary arguments
2296 ss ratelimit option name
2297 where ACL_WHERE_xxxx indicating which ACL this is
2298
2299Returns: ERROR
2300*/
2301
2302static int
2303ratelimit_error(uschar **log_msgptr, const char *format, ...)
2304{
2305va_list ap;
2306uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2307va_start(ap, format);
2308if (!string_vformat(buffer, sizeof(buffer), format, ap))
2309 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2310 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2311va_end(ap);
2312*log_msgptr = string_sprintf(
2313 "error in arguments to \"ratelimit\" condition: %s", buffer);
2314return ERROR;
2315}
2316
2317
2318
2319
870f6ba8
TF		 2320/*************************************************
2321* Handle rate limiting *
2322*************************************************/
2323
2324/* Called by acl_check_condition() below to calculate the result
2325of the ACL ratelimit condition.
2326
2327Note that the return value might be slightly unexpected: if the
2328sender's rate is above the limit then the result is OK. This is
2329similar to the dnslists condition, and is so that you can write
2330ACL clauses like: defer ratelimit = 15 / 1h
2331
2332Arguments:
2333 arg the option string for ratelimit=
90fc3069 2334 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2335 log_msgptr for error messages
2336
2337Returns: OK - Sender's rate is above limit
2338 FAIL - Sender's rate is below limit
2339 DEFER - Problem opening ratelimit database
2340 ERROR - Syntax error in options.
2341*/
2342
2343static int
55414b25 2344acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2345{
c99ce5c9 2346double limit, period, count;
8f240103
PH		 2347uschar *ss;
2348uschar *key = NULL;
c99ce5c9 2349uschar *unique = NULL;
870f6ba8 2350int sep = '/';
c99ce5c9
TF		 2351BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2352BOOL noupdate = FALSE, badacl = FALSE;
2353int mode = RATE_PER_WHAT;
870f6ba8
TF		 2354int old_pool, rc;
2355tree_node **anchor, *t;
2356open_db dbblock, *dbm;
c99ce5c9 2357int dbdb_size;
870f6ba8 2358dbdata_ratelimit *dbd;
c99ce5c9 2359dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2360struct timeval tv;
2361
2362/* Parse the first two options and record their values in expansion
2363variables. These variables allow the configuration to have informative
2364error messages based on rate limits obtained from a table lookup. */
2365
c99ce5c9 2366/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2367size, which must be greater than or equal to zero. Zero is useful for
2368rate measurement as opposed to rate limiting. */
2369
2370sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2371if (sender_rate_limit == NULL)
288644dd 2372 {
870f6ba8 2373 limit = -1.0;
288644dd
JH		 2374 ss = NULL; /* compiler quietening */
2375 }
870f6ba8
TF		 2376else
2377 {
2378 limit = Ustrtod(sender_rate_limit, &ss);
2379 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2380 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2381 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2382 }
c99ce5c9
TF		 2383if (limit < 0.0 || *ss != '\0')
2384 return ratelimit_error(log_msgptr,
2385 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2386
c99ce5c9 2387/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2388constant. This must be strictly greater than zero, because zero leads to
2389run-time division errors. */
2390
2391sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2392if (sender_rate_period == NULL) period = -1.0;
2393else period = readconf_readtime(sender_rate_period, 0, FALSE);
2394if (period <= 0.0)
c99ce5c9
TF		 2395 return ratelimit_error(log_msgptr,
2396 "\"%s\" is not a time value", sender_rate_period);
2397
2398/* By default we are counting one of something, but the per_rcpt,
2399per_byte, and count options can change this. */
2400
2401count = 1.0;
870f6ba8 2402
c99ce5c9 2403/* Parse the other options. */
870f6ba8
TF		 2404
2405while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2406 != NULL)
2407 {
2408 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2409 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2410 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2411 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2412 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2413 else if (strcmpic(ss, US"per_conn") == 0)
2414 {
2415 RATE_SET(mode, PER_CONN);
2416 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2417 badacl = TRUE;
2418 }
2419 else if (strcmpic(ss, US"per_mail") == 0)
2420 {
2421 RATE_SET(mode, PER_MAIL);
2422 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2423 }
2424 else if (strcmpic(ss, US"per_rcpt") == 0)
2425 {
2426 /* If we are running in the RCPT ACL, then we'll count the recipients
2427 one by one, but if we are running when we have accumulated the whole
2428 list then we'll add them all in one batch. */
2429 if (where == ACL_WHERE_RCPT)
2430 RATE_SET(mode, PER_RCPT);
2431 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2432 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2433 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2434 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2435 }
2436 else if (strcmpic(ss, US"per_byte") == 0)
2437 {
2438 /* If we have not yet received the message data and there was no SIZE
2439 declaration on the MAIL comand, then it's safe to just use a value of
2440 zero and let the recorded rate decay as if nothing happened. */
2441 RATE_SET(mode, PER_MAIL);
2442 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2443 else count = message_size < 0 ? 0.0 : (double)message_size;
2444 }
2445 else if (strcmpic(ss, US"per_addr") == 0)
2446 {
2447 RATE_SET(mode, PER_RCPT);
438257ba 2448 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2449 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2450 }
2451 else if (strncmpic(ss, US"count=", 6) == 0)
2452 {
2453 uschar *e;
2454 count = Ustrtod(ss+6, &e);
2455 if (count < 0.0 || *e != '\0')
2456 return ratelimit_error(log_msgptr,
2457 "\"%s\" is not a positive number", ss);
2458 }
2459 else if (strncmpic(ss, US"unique=", 7) == 0)
2460 unique = string_copy(ss + 7);
2461 else if (key == NULL)
2462 key = string_copy(ss);
2463 else
2464 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2465 }
2466
c99ce5c9
TF		 2467/* Sanity check. When the badacl flag is set the update mode must either
2468be readonly (which is the default if it is omitted) or, for backwards
2469compatibility, a combination of noupdate and strict or leaky. */
2470
2471if (mode == RATE_PER_CLASH)
2472 return ratelimit_error(log_msgptr, "conflicting per_* options");
2473if (leaky + strict + readonly > 1)
2474 return ratelimit_error(log_msgptr, "conflicting update modes");
2475if (badacl && (leaky || strict) && !noupdate)
2476 return ratelimit_error(log_msgptr,
2477 "\"%s\" must not have /leaky or /strict option in %s ACL",
2478 ratelimit_option_string[mode], acl_wherenames[where]);
2479
2480/* Set the default values of any unset options. In readonly mode we
2481perform the rate computation without any increment so that its value
2482decays to eventually allow over-limit senders through. */
2483
2484if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2485if (badacl) readonly = TRUE;
2486if (readonly) count = 0.0;
2487if (!strict && !readonly) leaky = TRUE;
2488if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2489
8f240103
PH		 2490/* Create the lookup key. If there is no explicit key, use sender_host_address.
2491If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2492omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2493are added to the key because they alter the meaning of the stored data. */
2494
2495if (key == NULL)
2496 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2497
c99ce5c9 2498key = string_sprintf("%s/%s/%s%s",
8f240103 2499 sender_rate_period,
c99ce5c9
TF		 2500 ratelimit_option_string[mode],
2501 unique == NULL ? "" : "unique/",
8f240103 2502 key);
870f6ba8 2503
c99ce5c9
TF		 2504HDEBUG(D_acl)
2505 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2506
8f240103
PH		 2507/* See if we have already computed the rate by looking in the relevant tree.
2508For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2509pool so that they survive across resets. In readonly mode we only remember the
2510result for the rest of this command in case a later command changes it. After
2511this bit of logic the code is independent of the per_* mode. */
870f6ba8 2512
870f6ba8
TF		 2513old_pool = store_pool;
2514
c99ce5c9
TF		 2515if (readonly)
2516 anchor = &ratelimiters_cmd;
2517else switch(mode) {
2518case RATE_PER_CONN:
870f6ba8
TF		 2519 anchor = &ratelimiters_conn;
2520 store_pool = POOL_PERM;
c99ce5c9
TF		 2521 break;
2522case RATE_PER_BYTE:
2523case RATE_PER_MAIL:
2524case RATE_PER_ALLRCPTS:
870f6ba8 2525 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2526 break;
2527case RATE_PER_ADDR:
2528case RATE_PER_CMD:
2529case RATE_PER_RCPT:
fe0dab11 2530 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2531 break;
2532default:
3399bb60 2533 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2534 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2535 "internal ACL error: unknown ratelimit mode %d", mode);
2536 break;
2537}
870f6ba8 2538
c99ce5c9
TF		 2539t = tree_search(*anchor, key);
2540if (t != NULL)
870f6ba8
TF		 2541 {
2542 dbd = t->data.ptr;
2543 /* The following few lines duplicate some of the code below. */
8f240103 2544 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2545 store_pool = old_pool;
2546 sender_rate = string_sprintf("%.1f", dbd->rate);
2547 HDEBUG(D_acl)
2548 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2549 return rc;
2550 }
2551
c99ce5c9
TF		 2552/* We aren't using a pre-computed rate, so get a previously recorded rate
2553from the database, which will be updated and written back if required. */
870f6ba8
TF		 2554
2555dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2556if (dbm == NULL)
2557 {
2558 store_pool = old_pool;
2559 sender_rate = NULL;
2560 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2561 *log_msgptr = US"ratelimit database not available";
2562 return DEFER;
2563 }
c99ce5c9
TF		 2564dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2565dbd = NULL;
870f6ba8
TF		 2566
2567gettimeofday(&tv, NULL);
2568
c99ce5c9
TF		 2569if (dbdb != NULL)
2570 {
2571 /* Locate the basic ratelimit block inside the DB data. */
2572 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2573 dbd = &dbdb->dbd;
2574
2575 /* Forget the old Bloom filter if it is too old, so that we count each
2576 repeating event once per period. We don't simply clear and re-use the old
2577 filter because we want its size to change if the limit changes. Note that
2578 we keep the dbd pointer for copying the rate into the new data block. */
2579
2580 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2581 {
2582 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2583 dbdb = NULL;
2584 }
2585
2586 /* Sanity check. */
2587
2588 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2589 {
2590 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2591 dbdb = NULL;
2592 }
2593 }
2594
2595/* Allocate a new data block if the database lookup failed
2596or the Bloom filter passed its age limit. */
2597
2598if (dbdb == NULL)
2599 {
2600 if (unique == NULL)
2601 {
2602 /* No Bloom filter. This basic ratelimit block is initialized below. */
2603 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2604 dbdb_size = sizeof(*dbd);
2605 dbdb = store_get(dbdb_size);
2606 }
2607 else
2608 {
2609 int extra;
2610 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2611
2612 /* See the long comment below for an explanation of the magic number 2.
2613 The filter has a minimum size in case the rate limit is very small;
2614 this is determined by the definition of dbdata_ratelimit_unique. */
2615
2616 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2617 if (extra < 0) extra = 0;
2618 dbdb_size = sizeof(*dbdb) + extra;
2619 dbdb = store_get(dbdb_size);
2620 dbdb->bloom_epoch = tv.tv_sec;
2621 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2622 memset(dbdb->bloom, 0, dbdb->bloom_size);
2623
2624 /* Preserve any basic ratelimit data (which is our longer-term memory)
2625 by copying it from the discarded block. */
2626
2627 if (dbd != NULL)
2628 {
2629 dbdb->dbd = *dbd;
2630 dbd = &dbdb->dbd;
2631 }
2632 }
2633 }
2634
2635/* If we are counting unique events, find out if this event is new or not.
2636If the client repeats the event during the current period then it should be
2637counted. We skip this code in readonly mode for efficiency, because any
2638changes to the filter will be discarded and because count is already set to
2639zero. */
2640
2641if (unique != NULL && !readonly)
2642 {
2643 /* We identify unique events using a Bloom filter. (You can find my
2644 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2645 With the per_addr option, an "event" is a recipient address, though the
2646 user can use the unique option to define their own events. We only count
2647 an event if we have not seen it before.
2648
2649 We size the filter according to the rate limit, which (in leaky mode)
2650 is the limit on the population of the filter. We allow 16 bits of space
2651 per entry (see the construction code above) and we set (up to) 8 of them
2652 when inserting an element (see the loop below). The probability of a false
2653 positive (an event we have not seen before but which we fail to count) is
2654
2655 size = limit * 16
2656 numhash = 8
2657 allzero = exp(-numhash * pop / size)
2658 = exp(-0.5 * pop / limit)
2659 fpr = pow(1 - allzero, numhash)
2660
2661 For senders at the limit the fpr is 0.06% or 1 in 1700
2662 and for senders at half the limit it is 0.0006% or 1 in 170000
2663
2664 In strict mode the Bloom filter can fill up beyond the normal limit, in
2665 which case the false positive rate will rise. This means that the
2666 measured rate for very fast senders can bogusly drop off after a while.
2667
2668 At twice the limit, the fpr is 2.5% or 1 in 40
2669 At four times the limit, it is 31% or 1 in 3.2
2670
2671 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2672 decay below the limit, and if this is more than one then the Bloom filter
2673 will be discarded before the decay gets that far. The false positive rate
2674 at this threshold is 9.3% or 1 in 10.7. */
2675
2676 BOOL seen;
2677 unsigned n, hash, hinc;
2678 uschar md5sum[16];
2679 md5 md5info;
2680
2681 /* Instead of using eight independent hash values, we combine two values
2682 using the formula h1 + n * h2. This does not harm the Bloom filter's
2683 performance, and means the amount of hash we need is independent of the
2684 number of bits we set in the filter. */
2685
2686 md5_start(&md5info);
2687 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2688 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2689 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2690
2691 /* Scan the bits corresponding to this event. A zero bit means we have
2692 not seen it before. Ensure all bits are set to record this event. */
2693
2694 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2695
2696 seen = TRUE;
2697 for (n = 0; n < 8; n++, hash += hinc)
2698 {
2699 int bit = 1 << (hash % 8);
2700 int byte = (hash / 8) % dbdb->bloom_size;
2701 if ((dbdb->bloom[byte] & bit) == 0)
2702 {
2703 dbdb->bloom[byte] |= bit;
2704 seen = FALSE;
2705 }
2706 }
2707
2708 /* If this event has occurred before, do not count it. */
2709
2710 if (seen)
2711 {
2712 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2713 count = 0.0;
2714 }
2715 else
2716 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2717 }
2718
2719/* If there was no previous ratelimit data block for this key, initialize
2720the new one, otherwise update the block from the database. The initial rate
2721is what would be computed by the code below for an infinite interval. */
2722
870f6ba8
TF		 2723if (dbd == NULL)
2724 {
c99ce5c9
TF		 2725 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2726 dbd = &dbdb->dbd;
870f6ba8
TF		 2727 dbd->time_stamp = tv.tv_sec;
2728 dbd->time_usec = tv.tv_usec;
c99ce5c9 2729 dbd->rate = count;
870f6ba8
TF		 2730 }
2731else
2732 {
2733 /* The smoothed rate is computed using an exponentially weighted moving
2734 average adjusted for variable sampling intervals. The standard EWMA for
2735 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2736 where f() is the measured value and f'() is the smoothed value.
2737
2738 Old data decays out of the smoothed value exponentially, such that data n
2739 samples old is multiplied by a^n. The exponential decay time constant p
2740 is defined such that data p samples old is multiplied by 1/e, which means
2741 that a = exp(-1/p). We can maintain the same time constant for a variable
2742 sampling interval i by using a = exp(-i/p).
2743
2744 The rate we are measuring is messages per period, suitable for directly
2745 comparing with the limit. The average rate between now and the previous
2746 message is period / interval, which we feed into the EWMA as the sample.
2747
2748 It turns out that the number of messages required for the smoothed rate
2749 to reach the limit when they are sent in a burst is equal to the limit.
2750 This can be seen by analysing the value of the smoothed rate after N
2751 messages sent at even intervals. Let k = (1 - a) * p/i
2752
2753 rate_1 = (1 - a) * p/i + a * rate_0
2754 = k + a * rate_0
2755 rate_2 = k + a * rate_1
2756 = k + a * k + a^2 * rate_0
2757 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2758 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2759 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2760 = rate_0 * a^N + p/i * (1 - a^N)
2761
2762 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2763
2764 rate_N = p/i + (rate_0 - p/i) * a^N
2765 a^N = (rate_N - p/i) / (rate_0 - p/i)
2766 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2767 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2768
2769 Numerical analysis of the above equation, setting the computed rate to
2770 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2771 rates, p/i, the number of messages N = limit. So limit serves as both the
2772 maximum rate measured in messages per period, and the maximum number of
2773 messages that can be sent in a fast burst. */
2774
2775 double this_time = (double)tv.tv_sec
2776 + (double)tv.tv_usec / 1000000.0;
2777 double prev_time = (double)dbd->time_stamp
2778 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2779
2780 /* We must avoid division by zero, and deal gracefully with the clock going
2781 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2782 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2783
e5d5a95f
TF		 2784 double interval = this_time - prev_time <= 0.0 ? 1e-9
2785 : this_time - prev_time;
2786
2787 double i_over_p = interval / period;
2788 double a = exp(-i_over_p);
870f6ba8 2789
c99ce5c9
TF		 2790 /* Combine the instantaneous rate (period / interval) with the previous rate
2791 using the smoothing factor a. In order to measure sized events, multiply the
2792 instantaneous rate by the count of bytes or recipients etc. */
2793
870f6ba8
TF		 2794 dbd->time_stamp = tv.tv_sec;
2795 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2796 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2797
2798 /* When events are very widely spaced the computed rate tends towards zero.
2799 Although this is accurate it turns out not to be useful for our purposes,
2800 especially when the first event after a long silence is the start of a spam
2801 run. A more useful model is that the rate for an isolated event should be the
2802 size of the event per the period size, ignoring the lack of events outside
2803 the current period and regardless of where the event falls in the period. So,
2804 if the interval was so long that the calculated rate is unhelpfully small, we
2805 re-intialize the rate. In the absence of higher-rate bursts, the condition
2806 below is true if the interval is greater than the period. */
2807
2808 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2809 }
2810
c99ce5c9
TF		 2811/* Clients sending at the limit are considered to be over the limit.
2812This matters for edge cases such as a limit of zero, when the client
2813should be completely blocked. */
3348576f 2814
8f240103 2815rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2816
2817/* Update the state if the rate is low or if we are being strict. If we
2818are in leaky mode and the sender's rate is too high, we do not update
2819the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2820rate preventing them from getting any email through. If readonly is set,
2821neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2822
c99ce5c9 2823if ((rc == FAIL && leaky) || strict)
8f240103 2824 {
c99ce5c9 2825 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2826 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2827 }
2828else
2829 {
2830 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2831 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2832 }
2833
870f6ba8
TF		 2834dbfn_close(dbm);
2835
c99ce5c9 2836/* Store the result in the tree for future reference. */
870f6ba8 2837
c99ce5c9
TF		 2838t = store_get(sizeof(tree_node) + Ustrlen(key));
2839t->data.ptr = dbd;
2840Ustrcpy(t->name, key);
2841(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2842
2843/* We create the formatted version of the sender's rate very late in
2844order to ensure that it is done using the correct storage pool. */
2845
2846store_pool = old_pool;
2847sender_rate = string_sprintf("%.1f", dbd->rate);
2848
2849HDEBUG(D_acl)
2850 debug_printf("ratelimit computed rate %s\n", sender_rate);
2851
2852return rc;
2853}
2854
2855
2856
b0019c78
TF		 2857/*************************************************
2858* The udpsend ACL modifier *
2859*************************************************/
2860
2861/* Called by acl_check_condition() below.
2862
2863Arguments:
2864 arg the option string for udpsend=
2865 log_msgptr for error messages
2866
2867Returns: OK - Completed.
2868 DEFER - Problem with DNS lookup.
2869 ERROR - Syntax error in options.
2870*/
2871
2872static int
55414b25 2873acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2874{
2875int sep = 0;
2876uschar *hostname;
2877uschar *portstr;
2878uschar *portend;
2879host_item *h;
2880int portnum;
b0019c78
TF		 2881int len;
2882int r, s;
b1f8e4f8 2883uschar * errstr;
b0019c78
TF		 2884
2885hostname = string_nextinlist(&arg, &sep, NULL, 0);
2886portstr = string_nextinlist(&arg, &sep, NULL, 0);
2887
2888if (hostname == NULL)
2889 {
217b0e56 2890 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2891 return ERROR;
2892 }
2893if (portstr == NULL)
2894 {
217b0e56 2895 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2896 return ERROR;
2897 }
2898if (arg == NULL)
2899 {
217b0e56 2900 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2901 return ERROR;
2902 }
2903portnum = Ustrtol(portstr, &portend, 10);
2904if (*portend != '\0')
2905 {
217b0e56 2906 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2907 return ERROR;
2908 }
2909
2910/* Make a single-item host list. */
2911h = store_get(sizeof(host_item));
2912memset(h, 0, sizeof(host_item));
2913h->name = hostname;
2914h->port = portnum;
2915h->mx = MX_NONE;
2916
2917if (string_is_ip_address(hostname, NULL))
2918 h->address = hostname, r = HOST_FOUND;
2919else
2920 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2921if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2922 {
217b0e56 2923 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2924 return DEFER;
2925 }
2926
2927HDEBUG(D_acl)
2928 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2929
b1f8e4f8
JH		 2930r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2931 1, NULL, &errstr);
b0019c78 2932if (r < 0) goto defer;
27f9999e 2933len = Ustrlen(arg);
9cb1785a 2934r = send(s, arg, len, 0);
b1f8e4f8
JH		 2935if (r < 0)
2936 {
2937 errstr = US strerror(errno);
2938 close(s);
2939 goto defer;
2940 }
2941close(s);
b0019c78
TF		 2942if (r < len)
2943 {
2944 *log_msgptr =
2945 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2946 return DEFER;
2947 }
2948
2949HDEBUG(D_acl)
2950 debug_printf("udpsend %d bytes\n", r);
2951
2952return OK;
2953
2954defer:
b1f8e4f8 2955*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2956return DEFER;
2957}
2958
2959
2960
059ec3d9
PH		 2961/*************************************************
2962* Handle conditions/modifiers on an ACL item *
2963*************************************************/
2964
2965/* Called from acl_check() below.
2966
2967Arguments:
2968 verb ACL verb
2969 cb ACL condition block - if NULL, result is OK
2970 where where called from
2971 addr the address being checked for RCPT, or NULL
2972 level the nesting level
2973 epp pointer to pass back TRUE if "endpass" encountered
2974 (applies only to "accept" and "discard")
2975 user_msgptr user message pointer
2976 log_msgptr log message pointer
2977 basic_errno pointer to where to put verify error
2978
2979Returns: OK - all conditions are met
2980 DISCARD - an "acl" condition returned DISCARD - only allowed
2981 for "accept" or "discard" verbs
2982 FAIL - at least one condition fails
2983 FAIL_DROP - an "acl" condition returned FAIL_DROP
2984 DEFER - can't tell at the moment (typically, lookup defer,
2985 but can be temporary callout problem)
2986 ERROR - ERROR from nested ACL or expansion failure or other
2987 error
2988*/
2989
2990static int
2991acl_check_condition(int verb, acl_condition_block *cb, int where,
2992 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2993 uschar **log_msgptr, int *basic_errno)
2994{
2995uschar *user_message = NULL;
2996uschar *log_message = NULL;
ed7f7860
PP		 2997uschar *debug_tag = NULL;
2998uschar *debug_opts = NULL;
059ec3d9 2999int rc = OK;
8523533c 3000#ifdef WITH_CONTENT_SCAN
0f0c8159 3001int sep = -'/';
8523533c 3002#endif
059ec3d9
PH		 3003
3004for (; cb != NULL; cb = cb->next)
3005 {
55414b25 3006 const uschar *arg;
8e669ac1 3007 int control_type;
059ec3d9
PH		 3008
3009 /* The message and log_message items set up messages to be used in
3010 case of rejection. They are expanded later. */
3011
3012 if (cb->type == ACLC_MESSAGE)
3013 {
187bc588 3014 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3015 user_message = cb->arg;
3016 continue;
3017 }
3018
3019 if (cb->type == ACLC_LOG_MESSAGE)
3020 {
187bc588 3021 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3022 log_message = cb->arg;
3023 continue;
3024 }
3025
3026 /* The endpass "condition" just sets a flag to show it occurred. This is
3027 checked at compile time to be on an "accept" or "discard" item. */
3028
3029 if (cb->type == ACLC_ENDPASS)
3030 {
3031 *epp = TRUE;
3032 continue;
3033 }
3034
3035 /* For other conditions and modifiers, the argument is expanded now for some
3036 of them, but not for all, because expansion happens down in some lower level
3037 checking functions in some cases. */
3038
3039 if (cond_expand_at_top[cb->type])
3040 {
3041 arg = expand_string(cb->arg);
3042 if (arg == NULL)
3043 {
3044 if (expand_string_forcedfail) continue;
3045 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3046 cb->arg, expand_string_message);
3047 return search_find_defer? DEFER : ERROR;
3048 }
3049 }
3050 else arg = cb->arg;
3051
3052 /* Show condition, and expanded condition if it's different */
3053
3054 HDEBUG(D_acl)
3055 {
3056 int lhswidth = 0;
3057 debug_printf("check %s%s %n",
3058 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3059 conditions[cb->type], &lhswidth);
3060
3061 if (cb->type == ACLC_SET)
3062 {
38a0a95f
PH		 3063 debug_printf("acl_%s ", cb->u.varname);
3064 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3065 }
3066
3067 debug_printf("= %s\n", cb->arg);
3068
3069 if (arg != cb->arg)
3070 debug_printf("%.*s= %s\n", lhswidth,
3071 US" ", CS arg);
3072 }
3073
3074 /* Check that this condition makes sense at this time */
3075
3076 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3077 {
3078 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3079 cond_modifiers[cb->type]? "use" : "test",
3080 conditions[cb->type], acl_wherenames[where]);
3081 return ERROR;
3082 }
3083
3084 /* Run the appropriate test for each condition, or take the appropriate
3085 action for the remaining modifiers. */
3086
3087 switch(cb->type)
3088 {
71fafd95
PH		 3089 case ACLC_ADD_HEADER:
3090 setup_header(arg);
3091 break;
3092
059ec3d9
PH		 3093 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3094 "discard" verb. */
71fafd95 3095
059ec3d9 3096 case ACLC_ACL:
f60d98e8 3097 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3098 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3099 {
3100 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3101 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3102 verbs[verb]);
3103 return ERROR;
3104 }
059ec3d9
PH		 3105 break;
3106
3107 case ACLC_AUTHENTICATED:
3108 rc = (sender_host_authenticated == NULL)? FAIL :
3109 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3110 TRUE, NULL);
3111 break;
3112
71fafd95 3113 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3114 case ACLC_BMI_OPTIN:
3115 {
3116 int old_pool = store_pool;
3117 store_pool = POOL_PERM;
3118 bmi_current_optin = string_copy(arg);
3119 store_pool = old_pool;
3120 }
3121 break;
71fafd95 3122 #endif
8523533c 3123
059ec3d9 3124 case ACLC_CONDITION:
f3766eb5
NM		 3125 /* The true/false parsing here should be kept in sync with that used in
3126 expand.c when dealing with ECOND_BOOL so that we don't have too many
3127 different definitions of what can be a boolean. */
51c7471d
JH		 3128 if (*arg == '-'
3129 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3130 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3131 rc = (Uatoi(arg) == 0)? FAIL : OK;
3132 else
3133 rc = (strcmpic(arg, US"no") == 0 ||
3134 strcmpic(arg, US"false") == 0)? FAIL :
3135 (strcmpic(arg, US"yes") == 0 ||
3136 strcmpic(arg, US"true") == 0)? OK : DEFER;
3137 if (rc == DEFER)
3138 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3139 break;
3140
c3611384
PH		 3141 case ACLC_CONTINUE: /* Always succeeds */
3142 break;
3143
059ec3d9 3144 case ACLC_CONTROL:
c5fcb476 3145 {
55414b25
JH		 3146 const uschar *p = NULL;
3147 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3148
55414b25 3149 /* Check if this control makes sense at this time */
f7572e5a 3150
55414b25
JH		 3151 if ((control_forbids[control_type] & (1 << where)) != 0)
3152 {
3153 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3154 controls[control_type], acl_wherenames[where]);
3155 return ERROR;
3156 }
8800895a 3157
55414b25
JH		 3158 switch(control_type)
3159 {
3160 case CONTROL_AUTH_UNADVERTISED:
3161 allow_auth_unadvertised = TRUE;
3162 break;
3163
3164 #ifdef EXPERIMENTAL_BRIGHTMAIL
3165 case CONTROL_BMI_RUN:
3166 bmi_run = 1;
3167 break;
3168 #endif
3169
3170 #ifndef DISABLE_DKIM
3171 case CONTROL_DKIM_VERIFY:
3172 dkim_disable_verify = TRUE;
3173 #ifdef EXPERIMENTAL_DMARC
3174 /* Since DKIM was blocked, skip DMARC too */
3175 dmarc_disable_verify = TRUE;
3176 dmarc_enable_forensic = FALSE;
3177 #endif
3178 break;
3179 #endif
3180
3181 #ifdef EXPERIMENTAL_DMARC
3182 case CONTROL_DMARC_VERIFY:
3183 dmarc_disable_verify = TRUE;
3184 break;
3185
3186 case CONTROL_DMARC_FORENSIC:
3187 dmarc_enable_forensic = TRUE;
3188 break;
3189 #endif
3190
3191 case CONTROL_DSCP:
3192 if (*p == '/')
3193 {
3194 int fd, af, level, optname, value;
3195 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3196 a socket; we can accept that, we'll just debug-log failures anyway. */
3197 fd = fileno(smtp_in);
3198 af = ip_get_address_family(fd);
3199 if (af < 0)
3200 {
3201 HDEBUG(D_acl)
3202 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3203 strerror(errno));
3204 break;
3205 }
3206 if (dscp_lookup(p+1, af, &level, &optname, &value))
3207 {
3208 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3209 {
3210 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3211 p+1, strerror(errno));
3212 }
3213 else
3214 {
3215 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3216 }
3217 }
3218 else
3219 {
3220 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3221 return ERROR;
3222 }
3223 }
3224 else
3225 {
3226 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3227 return ERROR;
3228 }
3229 break;
3230
3231 case CONTROL_ERROR:
3232 return ERROR;
3233
3234 case CONTROL_CASEFUL_LOCAL_PART:
3235 deliver_localpart = addr->cc_local_part;
3236 break;
3237
3238 case CONTROL_CASELOWER_LOCAL_PART:
3239 deliver_localpart = addr->lc_local_part;
3240 break;
3241
3242 case CONTROL_ENFORCE_SYNC:
3243 smtp_enforce_sync = TRUE;
3244 break;
3245
3246 case CONTROL_NO_ENFORCE_SYNC:
3247 smtp_enforce_sync = FALSE;
3248 break;
3249
3250 #ifdef WITH_CONTENT_SCAN
3251 case CONTROL_NO_MBOX_UNSPOOL:
3252 no_mbox_unspool = TRUE;
3253 break;
3254 #endif
3255
3256 case CONTROL_NO_MULTILINE:
3257 no_multiline_responses = TRUE;
3258 break;
3259
3260 case CONTROL_NO_PIPELINING:
3261 pipelining_enable = FALSE;
3262 break;
3263
3264 case CONTROL_NO_DELAY_FLUSH:
3265 disable_delay_flush = TRUE;
3266 break;
3267
3268 case CONTROL_NO_CALLOUT_FLUSH:
3269 disable_callout_flush = TRUE;
3270 break;
3271
3272 case CONTROL_FAKEREJECT:
3273 cancel_cutthrough_connection("fakereject");
3274 case CONTROL_FAKEDEFER:
3275 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3276 if (*p == '/')
3277 {
3278 const uschar *pp = p + 1;
3279 while (*pp != 0) pp++;
3280 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3281 p = pp;
3282 }
3283 else
3284 {
3285 /* Explicitly reset to default string */
3286 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3287 }
3288 break;
ed7f7860 3289
55414b25
JH		 3290 case CONTROL_FREEZE:
3291 deliver_freeze = TRUE;
3292 deliver_frozen_at = time(NULL);
3293 freeze_tell = freeze_tell_config; /* Reset to configured value */
3294 if (Ustrncmp(p, "/no_tell", 8) == 0)
3295 {
3296 p += 8;
3297 freeze_tell = NULL;
3298 }
3299 if (*p != 0)
3300 {
3301 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3302 return ERROR;
3303 }
3304 cancel_cutthrough_connection("item frozen");
3305 break;
3306
3307 case CONTROL_QUEUE_ONLY:
3308 queue_only_policy = TRUE;
3309 cancel_cutthrough_connection("queueing forced");
3310 break;
3311
3312 case CONTROL_SUBMISSION:
3313 originator_name = US"";
3314 submission_mode = TRUE;
3315 while (*p == '/')
3316 {
3317 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3318 {
3319 p += 14;
3320 active_local_sender_retain = TRUE;
3321 active_local_from_check = FALSE;
3322 }
3323 else if (Ustrncmp(p, "/domain=", 8) == 0)
3324 {
3325 const uschar *pp = p + 8;
3326 while (*pp != 0 && *pp != '/') pp++;
3327 submission_domain = string_copyn(p+8, pp-p-8);
3328 p = pp;
3329 }
3330 /* The name= option must be last, because it swallows the rest of
3331 the string. */
3332 else if (Ustrncmp(p, "/name=", 6) == 0)
3333 {
3334 const uschar *pp = p + 6;
3335 while (*pp != 0) pp++;
3336 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3337 big_buffer, big_buffer_size));
3338 p = pp;
3339 }
3340 else break;
3341 }
3342 if (*p != 0)
3343 {
3344 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3345 return ERROR;
3346 }
3347 break;
e4bdf652 3348
55414b25
JH		 3349 case CONTROL_DEBUG:
3350 while (*p == '/')
3351 {
3352 if (Ustrncmp(p, "/tag=", 5) == 0)
3353 {
3354 const uschar *pp = p + 5;
3355 while (*pp != '\0' && *pp != '/') pp++;
3356 debug_tag = string_copyn(p+5, pp-p-5);
3357 p = pp;
3358 }
3359 else if (Ustrncmp(p, "/opts=", 6) == 0)
3360 {
3361 const uschar *pp = p + 6;
3362 while (*pp != '\0' && *pp != '/') pp++;
3363 debug_opts = string_copyn(p+6, pp-p-6);
3364 p = pp;
3365 }
3366 }
3367 debug_logging_activate(debug_tag, debug_opts);
3368 break;
3369
3370 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3371 suppress_local_fixups = TRUE;
3372 break;
3373
3374 case CONTROL_CUTTHROUGH_DELIVERY:
3375 if (prdr_requested)
3376 /* Too hard to think about for now. We might in future cutthrough
3377 the case where both sides handle prdr and this-node prdr acl
3378 is "accept" */
93a6fce2 3379 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3380 else
3381 {
55414b25
JH		 3382 if (deliver_freeze)
3383 *log_msgptr = US"frozen";
3384 else if (queue_only_policy)
3385 *log_msgptr = US"queue-only";
3386 else if (fake_response == FAIL)
3387 *log_msgptr = US"fakereject";
3388 else
3389 {
3390 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3391 break;
3392 }
3393 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3394 arg, *log_msgptr);
5032d1cf 3395 }
55414b25 3396 return ERROR;
3c8b3577
JH		 3397
3398 #ifdef EXPERIMENTAL_INTERNATIONAL
3399 case CONTROL_UTF8_DOWNCONVERT:
3400 if (*p == '/')
3401 {
921dfc11
JH		 3402 if (p[1] == '1')
3403 {
3404 message_utf8_downconvert = 1;
3405 addr->prop.utf8_downcvt = TRUE;
3406 addr->prop.utf8_downcvt_maybe = FALSE;
3407 p += 2;
3408 break;
3409 }
3410 if (p[1] == '0')
3411 {
3412 message_utf8_downconvert = 0;
3413 addr->prop.utf8_downcvt = FALSE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 p += 2;
3416 break;
3417 }
3c8b3577 3418 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3419 {
3420 message_utf8_downconvert = -1;
3421 addr->prop.utf8_downcvt = FALSE;
3422 addr->prop.utf8_downcvt_maybe = TRUE;
3423 p += 3;
3424 break;
3425 }
3c8b3577
JH		 3426 *log_msgptr = US"bad option value for control=utf8_downconvert";
3427 }
3428 else
3429 {
921dfc11
JH		 3430 message_utf8_downconvert = 1;
3431 addr->prop.utf8_downcvt = TRUE;
3432 addr->prop.utf8_downcvt_maybe = FALSE;
3433 break;
3c8b3577
JH		 3434 }
3435 return ERROR;
3436 #endif
3437
9171d434 3438 }
55414b25 3439 break;
059ec3d9 3440 }
059ec3d9 3441
6a8f9482
TK		 3442 #ifdef EXPERIMENTAL_DCC
3443 case ACLC_DCC:
3444 {
3445 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3446 const uschar * list = arg;
3447 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3448 /* Run the dcc backend. */
3449 rc = dcc_process(&ss);
3450 /* Modify return code based upon the existance of options. */
3c8b3577 3451 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3452 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3453 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3454 }
3455 break;
3456 #endif
3457
71fafd95 3458 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3459 case ACLC_DECODE:
3460 rc = mime_decode(&arg);
3461 break;
71fafd95 3462 #endif
8523533c 3463
059ec3d9
PH		 3464 case ACLC_DELAY:
3465 {
3466 int delay = readconf_readtime(arg, 0, FALSE);
3467 if (delay < 0)
3468 {
3469 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3470 "modifier: \"%s\" is not a time value", arg);
3471 return ERROR;
3472 }
3473 else
3474 {
3475 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3476 delay);
3477 if (host_checking)
3478 {
3479 HDEBUG(D_acl)
3480 debug_printf("delay skipped in -bh checking mode\n");
3481 }
010c2d14 3482
ae9d18bc
JH		 3483 /* NOTE 1: Remember that we may be
3484 dealing with stdin/stdout here, in addition to TCP/IP connections.
3485 Also, delays may be specified for non-SMTP input, where smtp_out and
3486 smtp_in will be NULL. Whatever is done must work in all cases.
3487
3488 NOTE 2: The added feature of flushing the output before a delay must
3489 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3490 */
3491
3492 else
3493 {
3494 if (smtp_out != NULL && !disable_delay_flush)
3495 mac_smtp_fflush();
3496
861a7c51 3497#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3498 {
3499 struct pollfd p;
3500 nfds_t n = 0;
3501 if (smtp_out)
3502 {
3503 p.fd = fileno(smtp_out);
3504 p.events = POLLRDHUP;
3505 n = 1;
3506 }
3507 if (poll(&p, n, delay*1000) > 0)
3508 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3509 }
3510#else
010c2d14
PH		 3511 /* It appears to be impossible to detect that a TCP/IP connection has
3512 gone away without reading from it. This means that we cannot shorten
3513 the delay below if the client goes away, because we cannot discover
3514 that the client has closed its end of the connection. (The connection
3515 is actually in a half-closed state, waiting for the server to close its
3516 end.) It would be nice to be able to detect this state, so that the
3517 Exim process is not held up unnecessarily. However, it seems that we
3518 can't. The poll() function does not do the right thing, and in any case
3519 it is not always available.
047bdd8c 3520 */
010c2d14 3521
86b8287f 3522 while (delay > 0) delay = sleep(delay);
ae9d18bc 3523#endif
8e669ac1 3524 }
059ec3d9
PH		 3525 }
3526 }
3527 break;
3528
71fafd95 3529 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3530 case ACLC_DEMIME:
3531 rc = demime(&arg);
3532 break;
71fafd95 3533 #endif
8523533c 3534
80a47a2c
TK		 3535 #ifndef DISABLE_DKIM
3536 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3537 if (dkim_cur_signer != NULL)
3538 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3539 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3540 else
80a47a2c 3541 rc = FAIL;
71fafd95
PH		 3542 break;
3543
80a47a2c
TK		 3544 case ACLC_DKIM_STATUS:
3545 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3546 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3547 break;
3548 #endif
fb2274d4 3549
4840604e
TL		 3550 #ifdef EXPERIMENTAL_DMARC
3551 case ACLC_DMARC_STATUS:
4a8ce2d8 3552 if (!dmarc_has_been_checked)
4840604e 3553 dmarc_process();
4a8ce2d8 3554 dmarc_has_been_checked = TRUE;
4840604e
TL		 3555 /* used long way of dmarc_exim_expand_query() in case we need more
3556 * view into the process in the future. */
3557 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3558 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3559 break;
3560 #endif
3561
059ec3d9
PH		 3562 case ACLC_DNSLISTS:
3563 rc = verify_check_dnsbl(&arg);
3564 break;
3565
3566 case ACLC_DOMAINS:
3567 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3568 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3569 break;
3570
3571 /* The value in tls_cipher is the full cipher name, for example,
3572 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3573 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3574 what may in practice come out of the SSL library - which at the time of
3575 writing is poorly documented. */
3576
3577 case ACLC_ENCRYPTED:
817d9f57 3578 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3579 {
3580 uschar *endcipher = NULL;
817d9f57
JH		 3581 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3582 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3583 {
3584 endcipher = Ustrchr(++cipher, ':');
3585 if (endcipher != NULL) *endcipher = 0;
3586 }
3587 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3588 if (endcipher != NULL) *endcipher = ':';
3589 }
3590 break;
3591
3592 /* Use verify_check_this_host() instead of verify_check_host() so that
3593 we can pass over &host_data to catch any looked up data. Once it has been
3594 set, it retains its value so that it's still there if another ACL verb
3595 comes through here and uses the cache. However, we must put it into
3596 permanent store in case it is also expected to be used in a subsequent
3597 message in the same SMTP connection. */
3598
3599 case ACLC_HOSTS:
3600 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3601 (sender_host_address == NULL)? US"" : sender_host_address,
3602 CUSS &host_data);
4a452c43
JH		 3603 if (rc == DEFER) *log_msgptr = search_error_message;
3604 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3605 break;
3606
3607 case ACLC_LOCAL_PARTS:
3608 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3609 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3610 CUSS &deliver_localpart_data);
059ec3d9
PH		 3611 break;
3612
6ea85e9a
PH		 3613 case ACLC_LOG_REJECT_TARGET:
3614 {
3615 int logbits = 0;
3616 int sep = 0;
55414b25 3617 const uschar *s = arg;
6ea85e9a 3618 uschar *ss;
4a452c43 3619 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3620 {
3621 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3622 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3623 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3624 else
3625 {
3626 logbits |= LOG_MAIN|LOG_REJECT;
3627 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3628 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3629 }
3630 }
3631 log_reject_target = logbits;
3632 }
3633 break;
3634
059ec3d9
PH		 3635 case ACLC_LOGWRITE:
3636 {
3637 int logbits = 0;
55414b25 3638 const uschar *s = arg;
059ec3d9
PH		 3639 if (*s == ':')
3640 {
3641 s++;
3642 while (*s != ':')
3643 {
3644 if (Ustrncmp(s, "main", 4) == 0)
3645 { logbits |= LOG_MAIN; s += 4; }
3646 else if (Ustrncmp(s, "panic", 5) == 0)
3647 { logbits |= LOG_PANIC; s += 5; }
3648 else if (Ustrncmp(s, "reject", 6) == 0)
3649 { logbits |= LOG_REJECT; s += 6; }
3650 else
3651 {
3652 logbits = LOG_MAIN|LOG_PANIC;
3653 s = string_sprintf(":unknown log name in \"%s\" in "
3654 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3655 }
3656 if (*s == ',') s++;
3657 }
3658 s++;
3659 }
3660 while (isspace(*s)) s++;
6ea85e9a
PH		 3661
3662
059ec3d9
PH		 3663 if (logbits == 0) logbits = LOG_MAIN;
3664 log_write(0, logbits, "%s", string_printing(s));
3665 }
3666 break;
8e669ac1 3667
71fafd95 3668 #ifdef WITH_CONTENT_SCAN
0f0c8159 3669 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3670 {
6ea85e9a 3671 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3672 const uschar * list = arg;
3673 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3674 uschar *opt;
3675 BOOL defer_ok = FALSE;
3676 int timeout = 0;
3677
55414b25 3678 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3679 if (strcmpic(opt, US"defer_ok") == 0)
3680 defer_ok = TRUE;
3681 else if ( strncmpic(opt, US"tmo=", 4) == 0
3682 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3683 )
3684 {
3685 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3686 return ERROR;
3687 }
3688
3689 rc = malware(ss, timeout);
3690 if (rc == DEFER && defer_ok)
3691 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3692 }
3693 break;
3694
3695 case ACLC_MIME_REGEX:
71fafd95 3696 rc = mime_regex(&arg);
8523533c 3697 break;
71fafd95 3698 #endif
059ec3d9 3699
870f6ba8 3700 case ACLC_RATELIMIT:
90fc3069 3701 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3702 break;
3703
059ec3d9 3704 case ACLC_RECIPIENTS:
55414b25
JH		 3705 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3706 CUSS &recipient_data);
059ec3d9
PH		 3707 break;
3708
71fafd95
PH		 3709 #ifdef WITH_CONTENT_SCAN
3710 case ACLC_REGEX:
3711 rc = regex(&arg);
8523533c 3712 break;
71fafd95 3713 #endif
8523533c 3714
e7568d51
TL		 3715 case ACLC_REMOVE_HEADER:
3716 setup_remove_header(arg);
3717 break;
3718
059ec3d9
PH		 3719 case ACLC_SENDER_DOMAINS:
3720 {
3721 uschar *sdomain;
3722 sdomain = Ustrrchr(sender_address, '@');
3723 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3724 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3725 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3726 }
3727 break;
3728
3729 case ACLC_SENDERS:
55414b25
JH		 3730 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3731 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3732 break;
3733
3734 /* Connection variables must persist forever */
3735
3736 case ACLC_SET:
3737 {
3738 int old_pool = store_pool;
38a0a95f
PH		 3739 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3740 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3741 store_pool = old_pool;
3742 }
3743 break;
3744
71fafd95 3745 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3746 case ACLC_SPAM:
3747 {
3748 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3749 const uschar * list = arg;
3750 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3751 /* Run the spam backend. */
55414b25 3752 rc = spam(CUSS &ss);
8523533c 3753 /* Modify return code based upon the existance of options. */
55414b25 3754 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3755 != NULL) {
3756 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3757 {
3758 /* FAIL so that the message is passed to the next ACL */
3759 rc = FAIL;
3760 }
3761 }
3762 }
3763 break;
71fafd95 3764 #endif
8523533c 3765
71fafd95 3766 #ifdef EXPERIMENTAL_SPF
8523533c 3767 case ACLC_SPF:
65a7d8c3
NM		 3768 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3769 break;
3770 case ACLC_SPF_GUESS:
3771 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3772 break;
71fafd95 3773 #endif
8523533c 3774
b0019c78
TF		 3775 case ACLC_UDPSEND:
3776 rc = acl_udpsend(arg, log_msgptr);
3777 break;
3778
059ec3d9
PH		 3779 /* If the verb is WARN, discard any user message from verification, because
3780 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3781 only from explicit "message" modifiers. However, put the user message into
3782 $acl_verify_message so it can be used in subsequent conditions or modifiers
3783 (until something changes it). */
059ec3d9
PH		 3784
3785 case ACLC_VERIFY:
3786 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3787 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3788 if (verb == ACL_WARN) *user_msgptr = NULL;
3789 break;
3790
3791 default:
3792 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3793 "condition %d", cb->type);
3794 break;
3795 }
3796
3797 /* If a condition was negated, invert OK/FAIL. */
3798
3799 if (!cond_modifiers[cb->type] && cb->u.negated)
3800 {
3801 if (rc == OK) rc = FAIL;
3802 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3803 }
3804
3805 if (rc != OK) break; /* Conditions loop */
3806 }
3807
3808
3809/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3810handle the values of these modifiers. If there isn't a log message set, we make
3811it the same as the user message.
059ec3d9
PH		 3812
3813"message" is a user message that will be included in an SMTP response. Unless
3814it is empty, it overrides any previously set user message.
3815
3816"log_message" is a non-user message, and it adds to any existing non-user
3817message that is already set.
3818
4e88a19f
PH		 3819Most verbs have but a single return for which the messages are relevant, but
3820for "discard", it's useful to have the log message both when it succeeds and
3821when it fails. For "accept", the message is used in the OK case if there is no
3822"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3823present. */
059ec3d9 3824
4e88a19f
PH		 3825if (*epp && rc == OK) user_message = NULL;
3826
3827if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3828 {
3829 uschar *expmessage;
4e88a19f
PH		 3830 uschar *old_user_msgptr = *user_msgptr;
3831 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3832
3833 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3834 nested ACLs) are always discarded. This also happens for acceptance verbs
3835 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3836 However, the value of an existing message is available in $acl_verify_message
3837 during expansions. */
3838
4e88a19f
PH		 3839 if (verb == ACL_WARN ||
3840 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3841 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3842
3843 if (user_message != NULL)
3844 {
3845 acl_verify_message = old_user_msgptr;
3846 expmessage = expand_string(user_message);
3847 if (expmessage == NULL)
3848 {
3849 if (!expand_string_forcedfail)
3850 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3851 user_message, expand_string_message);
3852 }
3853 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3854 }
3855
3856 if (log_message != NULL)
3857 {
3858 acl_verify_message = old_log_msgptr;
3859 expmessage = expand_string(log_message);
3860 if (expmessage == NULL)
3861 {
3862 if (!expand_string_forcedfail)
3863 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3864 log_message, expand_string_message);
3865 }
3866 else if (expmessage[0] != 0)
3867 {
3868 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3869 string_sprintf("%s: %s", expmessage, *log_msgptr);
3870 }
3871 }
3872
3873 /* If no log message, default it to the user message */
3874
3875 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3876 }
3877
3878acl_verify_message = NULL;
3879return rc;
3880}
3881
3882
3883
3884
3885
3886/*************************************************
3887* Get line from a literal ACL *
3888*************************************************/
3889
3890/* This function is passed to acl_read() in order to extract individual lines
3891of a literal ACL, which we access via static pointers. We can destroy the
3892contents because this is called only once (the compiled ACL is remembered).
3893
3894This code is intended to treat the data in the same way as lines in the main
3895Exim configuration file. That is:
3896
3897 . Leading spaces are ignored.
3898
3899 . A \ at the end of a line is a continuation - trailing spaces after the \
3900 are permitted (this is because I don't believe in making invisible things
3901 significant). Leading spaces on the continued part of a line are ignored.
3902
3903 . Physical lines starting (significantly) with # are totally ignored, and
3904 may appear within a sequence of backslash-continued lines.
3905
3906 . Blank lines are ignored, but will end a sequence of continuations.
3907
3908Arguments: none
3909Returns: a pointer to the next line
3910*/
3911
3912
3913static uschar *acl_text; /* Current pointer in the text */
3914static uschar *acl_text_end; /* Points one past the terminating '0' */
3915
3916
3917static uschar *
3918acl_getline(void)
3919{
3920uschar *yield;
3921
3922/* This loop handles leading blank lines and comments. */
3923
3924for(;;)
3925 {
3926 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3927 if (*acl_text == 0) return NULL; /* No more data */
3928 yield = acl_text; /* Potential data line */
3929
3930 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3931
3932 /* If we hit the end before a newline, we have the whole logical line. If
3933 it's a comment, there's no more data to be given. Otherwise, yield it. */
3934
3935 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3936
3937 /* After reaching a newline, end this loop if the physical line does not
3938 start with '#'. If it does, it's a comment, and the loop continues. */
3939
3940 if (*yield != '#') break;
3941 }
3942
3943/* This loop handles continuations. We know we have some real data, ending in
3944newline. See if there is a continuation marker at the end (ignoring trailing
3945white space). We know that *yield is not white space, so no need to test for
3946cont > yield in the backwards scanning loop. */
3947
3948for(;;)
3949 {
3950 uschar *cont;
3951 for (cont = acl_text - 1; isspace(*cont); cont--);
3952
3953 /* If no continuation follows, we are done. Mark the end of the line and
3954 return it. */
3955
3956 if (*cont != '\\')
3957 {
3958 *acl_text++ = 0;
3959 return yield;
3960 }
3961
3962 /* We have encountered a continuation. Skip over whitespace at the start of
3963 the next line, and indeed the whole of the next line or lines if they are
3964 comment lines. */
3965
3966 for (;;)
3967 {
3968 while (*(++acl_text) == ' ' || *acl_text == '\t');
3969 if (*acl_text != '#') break;
3970 while (*(++acl_text) != 0 && *acl_text != '\n');
3971 }
3972
3973 /* We have the start of a continuation line. Move all the rest of the data
3974 to join onto the previous line, and then find its end. If the end is not a
3975 newline, we are done. Otherwise loop to look for another continuation. */
3976
3977 memmove(cont, acl_text, acl_text_end - acl_text);
3978 acl_text_end -= acl_text - cont;
3979 acl_text = cont;
3980 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3981 if (*acl_text == 0) return yield;
3982 }
3983
3984/* Control does not reach here */
3985}
3986
3987
3988
3989
3990
3991/*************************************************
3992* Check access using an ACL *
3993*************************************************/
3994
3995/* This function is called from address_check. It may recurse via
3996acl_check_condition() - hence the use of a level to stop looping. The ACL is
3997passed as a string which is expanded. A forced failure implies no access check
3998is required. If the result is a single word, it is taken as the name of an ACL
3999which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4000text, complete with newlines, and parsed as such. In both cases, the ACL check
4001is then run. This function uses an auxiliary function for acl_read() to call
4002for reading individual lines of a literal ACL. This is acl_getline(), which
4003appears immediately above.
4004
4005Arguments:
4006 where where called from
4007 addr address item when called from RCPT; otherwise NULL
4008 s the input string; NULL is the same as an empty ACL => DENY
4009 level the nesting level
4010 user_msgptr where to put a user error (for SMTP response)
4011 log_msgptr where to put a logging message (not for SMTP response)
4012
4013Returns: OK access is granted
4014 DISCARD access is apparently granted...
4015 FAIL access is denied
4016 FAIL_DROP access is denied; drop the connection
4017 DEFER can't tell at the moment
4018 ERROR disaster
4019*/
4020
4021static int
4022acl_check_internal(int where, address_item *addr, uschar *s, int level,
4023 uschar **user_msgptr, uschar **log_msgptr)
4024{
4025int fd = -1;
4026acl_block *acl = NULL;
4027uschar *acl_name = US"inline ACL";
4028uschar *ss;
4029
4030/* Catch configuration loops */
4031
4032if (level > 20)
4033 {
4034 *log_msgptr = US"ACL nested too deep: possible loop";
4035 return ERROR;
4036 }
4037
4038if (s == NULL)
4039 {
4040 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4041 return FAIL;
4042 }
4043
4044/* At top level, we expand the incoming string. At lower levels, it has already
4045been expanded as part of condition processing. */
4046
4047if (level == 0)
4048 {
4049 ss = expand_string(s);
4050 if (ss == NULL)
4051 {
4052 if (expand_string_forcedfail) return OK;
4053 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4054 expand_string_message);
4055 return ERROR;
4056 }
4057 }
4058else ss = s;
4059
4060while (isspace(*ss))ss++;
4061
4062/* If we can't find a named ACL, the default is to parse it as an inline one.
4063(Unless it begins with a slash; non-existent files give rise to an error.) */
4064
4065acl_text = ss;
4066
4067/* Handle the case of a string that does not contain any spaces. Look for a
4068named ACL among those read from the configuration, or a previously read file.
4069It is possible that the pointer to the ACL is NULL if the configuration
4070contains a name with no data. If not found, and the text begins with '/',
4071read an ACL from a file, and save it so it can be re-used. */
4072
4073if (Ustrchr(ss, ' ') == NULL)
4074 {
4075 tree_node *t = tree_search(acl_anchor, ss);
4076 if (t != NULL)
4077 {
4078 acl = (acl_block *)(t->data.ptr);
4079 if (acl == NULL)
4080 {
4081 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4082 return FAIL;
4083 }
4084 acl_name = string_sprintf("ACL \"%s\"", ss);
4085 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4086 }
4087
4088 else if (*ss == '/')
4089 {
4090 struct stat statbuf;
4091 fd = Uopen(ss, O_RDONLY, 0);
4092 if (fd < 0)
4093 {
4094 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4095 strerror(errno));
4096 return ERROR;
4097 }
4098
4099 if (fstat(fd, &statbuf) != 0)
4100 {
4101 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4102 strerror(errno));
4103 return ERROR;
4104 }
4105
4106 acl_text = store_get(statbuf.st_size + 1);
4107 acl_text_end = acl_text + statbuf.st_size + 1;
4108
4109 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4110 {
4111 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4112 ss, strerror(errno));
4113 return ERROR;
4114 }
4115 acl_text[statbuf.st_size] = 0;
f1e894f3 4116 (void)close(fd);
059ec3d9
PH		 4117
4118 acl_name = string_sprintf("ACL \"%s\"", ss);
4119 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4120 }
4121 }
4122
4123/* Parse an ACL that is still in text form. If it came from a file, remember it
4124in the ACL tree, having read it into the POOL_PERM store pool so that it
4125persists between multiple messages. */
4126
4127if (acl == NULL)
4128 {
4129 int old_pool = store_pool;
4130 if (fd >= 0) store_pool = POOL_PERM;
4131 acl = acl_read(acl_getline, log_msgptr);
4132 store_pool = old_pool;
4133 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4134 if (fd >= 0)
4135 {
4136 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4137 Ustrcpy(t->name, ss);
4138 t->data.ptr = acl;
4139 (void)tree_insertnode(&acl_anchor, t);
4140 }
4141 }
4142
4143/* Now we have an ACL to use. It's possible it may be NULL. */
4144
4145while (acl != NULL)
4146 {
4147 int cond;
4148 int basic_errno = 0;
4149 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4150 BOOL acl_quit_check = level == 0
4151 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4152
4153 *log_msgptr = *user_msgptr = NULL;
4154 acl_temp_details = FALSE;
4155
059ec3d9
PH		 4156 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4157
4158 /* Clear out any search error message from a previous check before testing
4159 this condition. */
4160
4161 search_error_message = NULL;
4162 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4163 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4164
4165 /* Handle special returns: DEFER causes a return except on a WARN verb;
4166 ERROR always causes a return. */
4167
4168 switch (cond)
4169 {
4170 case DEFER:
6968512f 4171 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4172 if (basic_errno != ERRNO_CALLOUTDEFER)
4173 {
4174 if (search_error_message != NULL && *search_error_message != 0)
4175 *log_msgptr = search_error_message;
4176 if (smtp_return_error_details) acl_temp_details = TRUE;
4177 }
4178 else
4179 {
4180 acl_temp_details = TRUE;
4181 }
4182 if (acl->verb != ACL_WARN) return DEFER;
4183 break;
4184
4185 default: /* Paranoia */
4186 case ERROR:
6968512f 4187 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4188 return ERROR;
4189
4190 case OK:
6968512f
JH		 4191 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4192 verbs[acl->verb], acl_name);
059ec3d9
PH		 4193 break;
4194
4195 case FAIL:
6968512f 4196 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4197 break;
4198
4199 /* DISCARD and DROP can happen only from a nested ACL condition, and
4200 DISCARD can happen only for an "accept" or "discard" verb. */
4201
4202 case DISCARD:
6968512f
JH		 4203 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4204 verbs[acl->verb], acl_name);
059ec3d9
PH		 4205 break;
4206
4207 case FAIL_DROP:
6968512f
JH		 4208 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4209 verbs[acl->verb], acl_name);
059ec3d9
PH		 4210 break;
4211 }
4212
4213 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4214 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4215 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4216
4217 switch(acl->verb)
4218 {
4219 case ACL_ACCEPT:
a7538db1
JH		 4220 if (cond == OK || cond == DISCARD)
4221 {
4222 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4223 return cond;
4224 }
059ec3d9
PH		 4225 if (endpass_seen)
4226 {
4227 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4228 return cond;
4229 }
4230 break;
4231
4232 case ACL_DEFER:
4233 if (cond == OK)
4234 {
a7538db1 4235 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4236 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4237 acl_temp_details = TRUE;
4238 return DEFER;
4239 }
4240 break;
4241
4242 case ACL_DENY:
a7538db1
JH		 4243 if (cond == OK)
4244 {
4245 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4246 if (acl_quit_check) goto badquit;
a7538db1
JH		 4247 return FAIL;
4248 }
059ec3d9
PH		 4249 break;
4250
4251 case ACL_DISCARD:
a7538db1
JH		 4252 if (cond == OK || cond == DISCARD)
4253 {
4254 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4255 if (acl_quit_check) goto badquit;
a7538db1
JH		 4256 return DISCARD;
4257 }
059ec3d9
PH		 4258 if (endpass_seen)
4259 {
4260 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4261 return cond;
4262 }
4263 break;
4264
4265 case ACL_DROP:
a7538db1
JH		 4266 if (cond == OK)
4267 {
4268 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4269 if (acl_quit_check) goto badquit;
a7538db1
JH		 4270 return FAIL_DROP;
4271 }
059ec3d9
PH		 4272 break;
4273
4274 case ACL_REQUIRE:
a7538db1
JH		 4275 if (cond != OK)
4276 {
4277 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4278 if (acl_quit_check) goto badquit;
a7538db1
JH		 4279 return cond;
4280 }
059ec3d9
PH		 4281 break;
4282
4283 case ACL_WARN:
4284 if (cond == OK)
4285 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4286 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4287 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4288 "condition test deferred%s%s", host_and_ident(TRUE),
4289 (*log_msgptr == NULL)? US"" : US": ",
4290 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4291 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4292 break;
4293
4294 default:
4295 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4296 acl->verb);
4297 break;
4298 }
4299
4300 /* Pass to the next ACL item */
4301
4302 acl = acl->next;
4303 }
4304
4305/* We have reached the end of the ACL. This is an implicit DENY. */
4306
4307HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4308return FAIL;
82c0c8ea
JH		 4309
4310badquit:
4311 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4312 "('%s' verb used incorrectly)", verbs[acl->verb]);
4313 return ERROR;
059ec3d9
PH		 4314}
4315
4316
333eea9c
JH		 4317
4318
4319/* Same args as acl_check_internal() above, but the string s is
4320the name of an ACL followed optionally by up to 9 space-separated arguments.
4321The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4322static int
55414b25 4323acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4324 uschar **user_msgptr, uschar **log_msgptr)
4325{
4326uschar * tmp;
bef3ea7f 4327uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4328uschar * sav_arg[9]; /* must match acl_arg[] */
4329int sav_narg;
333eea9c 4330uschar * name;
bef3ea7f 4331int i;
ef21c07d 4332int ret;
333eea9c
JH		 4333
4334if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4335 goto bad;
4336
bef3ea7f 4337for (i = 0; i < 9; i++)
333eea9c
JH		 4338 {
4339 while (*s && isspace(*s)) s++;
4340 if (!*s) break;
bef3ea7f 4341 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4342 {
4343 tmp = name;
4344 goto bad;
4345 }
4346 }
ef21c07d
JH		 4347
4348sav_narg = acl_narg;
bef3ea7f 4349acl_narg = i;
ef21c07d
JH		 4350for (i = 0; i < acl_narg; i++)
4351 {
4352 sav_arg[i] = acl_arg[i];
4353 acl_arg[i] = tmp_arg[i];
4354 }
4355while (i < 9)
4356 {
4357 sav_arg[i] = acl_arg[i];
4358 acl_arg[i++] = NULL;
4359 }
4360
4361ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4362
ef21c07d
JH		 4363acl_narg = sav_narg;
4364for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4365return ret;
333eea9c
JH		 4366
4367bad:
4368if (expand_string_forcedfail) return ERROR;
4369*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4370 tmp, expand_string_message);
4371return search_find_defer?DEFER:ERROR;
4372}
4373
4374
4375
059ec3d9
PH		 4376/*************************************************
4377* Check access using an ACL *
4378*************************************************/
4379
faa05a93
JH		 4380/* Alternate interface for ACL, used by expansions */
4381int
05caaeaa 4382acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4383{
faa05a93
JH		 4384address_item adb;
4385address_item *addr = NULL;
4386
4387*user_msgptr = *log_msgptr = NULL;
4388sender_verified_failed = NULL;
4389ratelimiters_cmd = NULL;
4390log_reject_target = LOG_MAIN|LOG_REJECT;
4391
4392if (where == ACL_WHERE_RCPT)
4393 {
4394 adb = address_defaults;
4395 addr = &adb;
05caaeaa
JH		 4396 addr->address = expand_string(US"$local_part@$domain");
4397 addr->domain = deliver_domain;
4398 addr->local_part = deliver_localpart;
4399 addr->cc_local_part = deliver_localpart;
4400 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4401 }
4402
4403return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4404}
4405
4406
4407
059ec3d9
PH		 4408/* This is the external interface for ACL checks. It sets up an address and the
4409expansions for $domain and $local_part when called after RCPT, then calls
4410acl_check_internal() to do the actual work.
4411
4412Arguments:
4413 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4414 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4415 s the input string; NULL is the same as an empty ACL => DENY
4416 user_msgptr where to put a user error (for SMTP response)
4417 log_msgptr where to put a logging message (not for SMTP response)
4418
4419Returns: OK access is granted by an ACCEPT verb
4420 DISCARD access is granted by a DISCARD verb
4421 FAIL access is denied
4422 FAIL_DROP access is denied; drop the connection
4423 DEFER can't tell at the moment
4424 ERROR disaster
4425*/
faa05a93 4426int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4427
4428int
64ffc24f 4429acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4430 uschar **log_msgptr)
4431{
4432int rc;
4433address_item adb;
64ffc24f 4434address_item *addr = NULL;
059ec3d9
PH		 4435
4436*user_msgptr = *log_msgptr = NULL;
4437sender_verified_failed = NULL;
fe0dab11 4438ratelimiters_cmd = NULL;
6ea85e9a 4439log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4440
8ccd00b1 4441#ifndef DISABLE_PRDR
5032d1cf 4442if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR)
fd98a5c6 4443#else
5032d1cf 4444if (where == ACL_WHERE_RCPT)
fd98a5c6 4445#endif
059ec3d9
PH		 4446 {
4447 adb = address_defaults;
4448 addr = &adb;
64ffc24f 4449 addr->address = recipient;
059ec3d9
PH		 4450 if (deliver_split_address(addr) == DEFER)
4451 {
4452 *log_msgptr = US"defer in percent_hack_domains check";
4453 return DEFER;
4454 }
9bfc60eb 4455#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH		 4456 if ((addr->prop.utf8_msg = message_smtputf8))
4457 {
4458 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4459 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4460 }
9bfc60eb 4461#endif
059ec3d9
PH		 4462 deliver_domain = addr->domain;
4463 deliver_localpart = addr->local_part;
4464 }
059ec3d9 4465
faa05a93 4466acl_where = where;
059ec3d9 4467rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4468acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4469
817d9f57
JH		 4470/* Cutthrough - if requested,
4471and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4472and rcpt acl returned accept,
4473and first recipient (cancel on any subsequents)
e4bdf652 4474open one now and run it up to RCPT acceptance.
e4bdf652 4475A failed verify should cancel cutthrough request.
e4bdf652 4476
817d9f57 4477Initial implementation: dual-write to spool.
e4bdf652
JH		 4478Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4479
4480Cease cutthrough copy on rxd final dot; do not send one.
4481
4482On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4483
4484On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4485perm-rejected, reflect that to the original sender - and dump the spooled copy.
4486If temp-reject, close the conn (and keep the spooled copy).
4487If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4488*/
4489switch (where)
4490{
4491case ACL_WHERE_RCPT:
8ccd00b1 4492#ifndef DISABLE_PRDR
fd98a5c6
JH		 4493case ACL_WHERE_PRDR:
4494#endif
5032d1cf 4495 if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
e4bdf652
JH		 4496 open_cutthrough_connection(addr);
4497 break;
4498
4499case ACL_WHERE_PREDATA:
4500 if( rc == OK )
4501 cutthrough_predata();
4502 else
2e5b33cd 4503 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4504 break;
4505
4506case ACL_WHERE_QUIT:
4507case ACL_WHERE_NOTQUIT:
2e5b33cd 4508 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4509 break;
4510
4511default:
4512 break;
4513}
4514
64ffc24f
PH		 4515deliver_domain = deliver_localpart = deliver_address_data =
4516 sender_address_data = NULL;
059ec3d9
PH		 4517
4518/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4519ACL, which is really in the middle of an SMTP command. */
4520
4521if (rc == DISCARD)
4522 {
4523 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4524 {
4525 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4526 "ACL", acl_wherenames[where]);
4527 return ERROR;
4528 }
4529 return DISCARD;
4530 }
4531
4532/* A DROP response is not permitted from MAILAUTH */
4533
4534if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4535 {
4536 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4537 "ACL", acl_wherenames[where]);
4538 return ERROR;
4539 }
4540
4e88a19f
PH		 4541/* Before giving a response, take a look at the length of any user message, and
4542split it up into multiple lines if possible. */
059ec3d9 4543
e28326d8
PH		 4544*user_msgptr = string_split_message(*user_msgptr);
4545if (fake_response != OK)
4546 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4547
4548return rc;
4549}
4550
38a0a95f 4551
38a0a95f
PH		 4552/*************************************************
4553* Create ACL variable *
4554*************************************************/
4555
4556/* Create an ACL variable or reuse an existing one. ACL variables are in a
4557binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4558
4559Argument:
4560 name pointer to the variable's name, starting with c or m
4561
4562Returns the pointer to variable's tree node
4563*/
4564
4565tree_node *
4566acl_var_create(uschar *name)
4567{
4568tree_node *node, **root;
4569root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4570node = tree_search(*root, name);
4571if (node == NULL)
4572 {
4573 node = store_get(sizeof(tree_node) + Ustrlen(name));
4574 Ustrcpy(node->name, name);
4575 (void)tree_insertnode(root, node);
4576 }
4577node->data.ptr = NULL;
4578return node;
4579}
4580
4581
4582
4583/*************************************************
4584* Write an ACL variable in spool format *
4585*************************************************/
4586
4587/* This function is used as a callback for tree_walk when writing variables to
4588the spool file. To retain spool file compatibility, what is written is -aclc or
4589-aclm followed by the rest of the name and the data length, space separated,
4590then the value itself, starting on a new line, and terminated by an additional
4591newline. When we had only numbered ACL variables, the first line might look
4592like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4593acl_cfoo.
4594
4595Arguments:
4596 name of the variable
4597 value of the variable
4598 ctx FILE pointer (as a void pointer)
4599
4600Returns: nothing
4601*/
4602
4603void
4604acl_var_write(uschar *name, uschar *value, void *ctx)
4605{
4606FILE *f = (FILE *)ctx;
4607fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4608}
4609
9171d434
JH		 4610/* vi: aw ai sw=2
4611*/
059ec3d9 4612/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.