projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
tidying: coverity issues
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef 183 CONTROL_AUTH_UNADVERTISED,
3c8b3577 184#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
3c8b3577 186#endif
ed7f7860 187 CONTROL_DEBUG,
3c8b3577 188#ifndef DISABLE_DKIM
f7572e5a 189 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 190#endif
191#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
3c8b3577 194#endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 206#ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 208#endif
c46782ef
PH		 209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
8c5d388a 211#ifdef SUPPORT_I18N
3c8b3577
JH		 212 CONTROL_UTF8_DOWNCONVERT,
213#endif
cf8b11a5 214 CONTROL_NO_MULTILINE,
047bdd8c 215 CONTROL_NO_PIPELINING,
4c590bd1
PH		 216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
c46782ef 218};
9a26b6b2 219
8800895a
PH		 220/* ACL control names; keep in step with the table above! This list is used for
221turning ids into names. The actual list of recognized names is in the variable
222control_def controls_list[] below. The fact that there are two lists is a mess
223and should be tidied up. */
9a26b6b2
PH		 224
225static uschar *controls[] = {
c46782ef 226 US"allow_auth_unadvertised",
3c8b3577 227#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 228 US"bmi_run",
3c8b3577 229#endif
ed7f7860 230 US"debug",
3c8b3577 231#ifndef DISABLE_DKIM
80a47a2c 232 US"dkim_disable_verify",
3c8b3577
JH		 233#endif
234#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
3c8b3577 237#endif
13363eba 238 US"dscp",
c46782ef
PH		 239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
e4bdf652 242 US"cutthrough_delivery",
c46782ef
PH		 243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
3c8b3577 249#ifdef WITH_CONTENT_SCAN
9a26b6b2 250 US"no_mbox_unspool",
3c8b3577 251#endif
cf8b11a5
PH		 252 US"fakedefer",
253 US"fakereject",
8c5d388a 254#ifdef SUPPORT_I18N
3c8b3577
JH		 255 US"utf8_downconvert",
256#endif
aa6dc513 257 US"no_multiline_responses",
cf8b11a5 258 US"no_pipelining",
4c590bd1
PH		 259 US"no_delay_flush",
260 US"no_callout_flush"
c46782ef 261};
059ec3d9 262
047bdd8c 263/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 264at the outer level. In the other cases, expansion already occurs in the
265checking functions. */
266
267static uschar cond_expand_at_top[] = {
7421ecab 268 FALSE, /* acl */
3e536984 269 TRUE, /* add_header */
059ec3d9 270 FALSE, /* authenticated */
8523533c
TK		 271#ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
8e669ac1 273#endif
059ec3d9 274 TRUE, /* condition */
c3611384 275 TRUE, /* continue */
059ec3d9 276 TRUE, /* control */
6a8f9482
TK		 277#ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279#endif
8523533c
TK		 280#ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282#endif
059ec3d9 283 TRUE, /* delay */
8523533c
TK		 284#ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
fb2274d4 286#endif
80a47a2c
TK		 287#ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
4840604e
TL		 290#endif
291#ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
8523533c 293#endif
059ec3d9
PH		 294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
6ea85e9a 301 TRUE, /* log_reject_target */
059ec3d9 302 TRUE, /* logwrite */
8523533c
TK		 303#ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305#endif
059ec3d9 306 TRUE, /* message */
8523533c
TK		 307#ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309#endif
870f6ba8 310 TRUE, /* ratelimit */
059ec3d9 311 FALSE, /* recipients */
8523533c
TK		 312#ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314#endif
e7568d51 315 TRUE, /* remove_header */
059ec3d9
PH		 316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
8523533c
TK		 319#ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321#endif
322#ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
65a7d8c3 324 TRUE, /* spf_guess */
8523533c 325#endif
b0019c78 326 TRUE, /* udpsend */
059ec3d9
PH		 327 TRUE /* verify */
328};
329
330/* Flags to identify the modifiers */
331
332static uschar cond_modifiers[] = {
333 FALSE, /* acl */
3e536984 334 TRUE, /* add_header */
059ec3d9 335 FALSE, /* authenticated */
8523533c
TK		 336#ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
8e669ac1 338#endif
059ec3d9 339 FALSE, /* condition */
c3611384 340 TRUE, /* continue */
059ec3d9 341 TRUE, /* control */
6a8f9482
TK		 342#ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344#endif
8523533c
TK		 345#ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347#endif
059ec3d9 348 TRUE, /* delay */
8523533c
TK		 349#ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
fb2274d4 351#endif
80a47a2c
TK		 352#ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
4840604e
TL		 355#endif
356#ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
8523533c 358#endif
059ec3d9
PH		 359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
6ea85e9a 366 TRUE, /* log_reject_target */
8523533c
TK		 367 TRUE, /* logwrite */
368#ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370#endif
059ec3d9 371 TRUE, /* message */
8523533c
TK		 372#ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374#endif
870f6ba8 375 FALSE, /* ratelimit */
059ec3d9 376 FALSE, /* recipients */
8523533c
TK		 377#ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379#endif
e7568d51 380 TRUE, /* remove_header */
059ec3d9
PH		 381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
8523533c
TK		 384#ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386#endif
387#ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
65a7d8c3 389 FALSE, /* spf_guess */
8523533c 390#endif
b0019c78 391 TRUE, /* udpsend */
059ec3d9
PH		 392 FALSE /* verify */
393};
394
c3611384 395/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 396times. For each condition and modifier, there's a bitmap of dis-allowed times.
397For some, it is easier to specify the negation of a small number of allowed
398times. */
059ec3d9
PH		 399
400static unsigned int cond_forbids[] = {
401 0, /* acl */
8e669ac1 402
71fafd95 403 (unsigned int)
45b91596 404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 406 #ifndef DISABLE_PRDR
fd98a5c6
JH		 407 (1<<ACL_WHERE_PRDR)|
408 #endif
45b91596 409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 410 (1<<ACL_WHERE_DKIM)|
45b91596 411 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 412
45b91596
PH		 413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 416
71fafd95 417 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 421 #ifndef DISABLE_PRDR
fd98a5c6
JH		 422 (1<<ACL_WHERE_PRDR)|
423 #endif
8e669ac1 424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 429 #endif
8e669ac1 430
059ec3d9 431 0, /* condition */
8e669ac1 432
c3611384
PH		 433 0, /* continue */
434
059ec3d9 435 /* Certain types of control are always allowed, so we let it through
2f079f46 436 always and check in the control processing itself. */
8e669ac1 437
059ec3d9 438 0, /* control */
8e669ac1 439
6a8f9482
TK		 440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
fd98a5c6 442 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 443 #ifndef DISABLE_PRDR
fd98a5c6 444 (1<<ACL_WHERE_PRDR)|
8ccd00b1 445 #endif
fd98a5c6 446 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 447 #endif
448
71fafd95 449 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 452 #endif
8523533c 453
8f128379 454 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 455
71fafd95 456 #ifdef WITH_OLD_DEMIME
2f079f46 457 (unsigned int)
fd98a5c6 458 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 459 #ifndef DISABLE_PRDR
fd98a5c6 460 (1<<ACL_WHERE_PRDR)|
8ccd00b1 461 #endif
fd98a5c6 462 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 463 #endif
8e669ac1 464
80a47a2c
TK		 465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 468
80a47a2c
TK		 469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 471 #endif
fb2274d4 472
4840604e
TL		 473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
379ba7d0
JH		 478 /* Explicit key lookups can be made in non-smtp ACLs so pass
479 always and check in the verify processing itself. */
480
481 0, /* dnslists */
059ec3d9 482
2f079f46 483 (unsigned int)
fd98a5c6 484 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 485 |(1<<ACL_WHERE_VRFY)
8ccd00b1 486 #ifndef DISABLE_PRDR
fd98a5c6
JH		 487 |(1<<ACL_WHERE_PRDR)
488 #endif
489 ),
059ec3d9 490
45b91596
PH		 491 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
492 (1<<ACL_WHERE_CONNECT)|
493 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 494 (1<<ACL_WHERE_HELO),
8e669ac1 495
059ec3d9 496 0, /* endpass */
8e669ac1 497
45b91596
PH		 498 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
499 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 500
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 503 |(1<<ACL_WHERE_VRFY)
2e6afa4f 504 #ifndef DISABLE_PRDR
fd98a5c6
JH		 505 |(1<<ACL_WHERE_PRDR)
506 #endif
507 ),
059ec3d9
PH		 508
509 0, /* log_message */
8e669ac1 510
6ea85e9a
PH		 511 0, /* log_reject_target */
512
059ec3d9 513 0, /* logwrite */
8e669ac1 514
71fafd95 515 #ifdef WITH_CONTENT_SCAN
2f079f46 516 (unsigned int)
fd98a5c6 517 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 518 #ifndef DISABLE_PRDR
fd98a5c6 519 (1<<ACL_WHERE_PRDR)|
8ccd00b1 520 #endif
fd98a5c6 521 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 522 #endif
8523533c 523
059ec3d9
PH		 524 0, /* message */
525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 527 (unsigned int)
528 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 529 #endif
8523533c 530
870f6ba8
TF		 531 0, /* ratelimit */
532
2f079f46
PH		 533 (unsigned int)
534 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 535
71fafd95 536 #ifdef WITH_CONTENT_SCAN
2f079f46 537 (unsigned int)
fd98a5c6 538 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6 540 (1<<ACL_WHERE_PRDR)|
8ccd00b1 541 #endif
fd98a5c6 542 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 543 (1<<ACL_WHERE_MIME)),
71fafd95 544 #endif
8523533c 545
e7568d51
TL		 546 (unsigned int)
547 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
548 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 549 #ifndef DISABLE_PRDR
fd98a5c6
JH		 550 (1<<ACL_WHERE_PRDR)|
551 #endif
e7568d51
TL		 552 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
553 (1<<ACL_WHERE_NOTSMTP_START)),
554
059ec3d9
PH		 555 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
556 (1<<ACL_WHERE_HELO)|
557 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
558 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
559 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
560
561 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
562 (1<<ACL_WHERE_HELO)|
563 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
564 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
565 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
566
567 0, /* set */
568
71fafd95 569 #ifdef WITH_CONTENT_SCAN
2f079f46 570 (unsigned int)
fd98a5c6 571 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 572 #ifndef DISABLE_PRDR
fd98a5c6 573 (1<<ACL_WHERE_PRDR)|
8ccd00b1 574 #endif
fd98a5c6 575 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 576 #endif
8523533c 577
71fafd95 578 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 579 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
580 (1<<ACL_WHERE_HELO)|
581 (1<<ACL_WHERE_MAILAUTH)|
582 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 583 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
584 (1<<ACL_WHERE_NOTSMTP)|
585 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 586
587 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
588 (1<<ACL_WHERE_HELO)|
589 (1<<ACL_WHERE_MAILAUTH)|
590 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
591 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
592 (1<<ACL_WHERE_NOTSMTP)|
593 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 594 #endif
8523533c 595
b0019c78
TF		 596 0, /* udpsend */
597
059ec3d9
PH		 598 /* Certain types of verify are always allowed, so we let it through
599 always and check in the verify function itself */
600
601 0 /* verify */
059ec3d9
PH		 602};
603
604
c5fcb476
PH		 605/* Bit map vector of which controls are not allowed at certain times. For
606each control, there's a bitmap of dis-allowed times. For some, it is easier to
607specify the negation of a small number of allowed times. */
608
609static unsigned int control_forbids[] = {
c46782ef
PH		 610 (unsigned int)
611 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
612
3c8b3577 613#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 614 0, /* bmi_run */
3c8b3577 615#endif
c46782ef 616
ed7f7860
PP		 617 0, /* debug */
618
3c8b3577 619#ifndef DISABLE_DKIM
80a47a2c 620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 621# ifndef DISABLE_PRDR
fd98a5c6 622 (1<<ACL_WHERE_PRDR)|
3c8b3577 623# endif
f7572e5a 624 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 625#endif
f7572e5a 626
3c8b3577 627#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 628 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
629 (1<<ACL_WHERE_NOTSMTP_START),
630 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
631 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 632#endif
4840604e 633
13363eba
PP		 634 (1<<ACL_WHERE_NOTSMTP)|
635 (1<<ACL_WHERE_NOTSMTP_START)|
636 (1<<ACL_WHERE_NOTQUIT), /* dscp */
637
c5fcb476 638 0, /* error */
8e669ac1
PH		 639
640 (unsigned int)
c5fcb476 641 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 642
643 (unsigned int)
c5fcb476 644 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 645
e4bdf652
JH		 646 (unsigned int)
647 0, /* cutthrough_delivery */
648
45b91596
PH		 649 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
650 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 651
45b91596
PH		 652 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
653 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 654
655 (unsigned int)
c5fcb476
PH		 656 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
657 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 658 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 659 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 660
661 (unsigned int)
c5fcb476
PH		 662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
663 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 664 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 665 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 666
667 (unsigned int)
c5fcb476 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 669 (1<<ACL_WHERE_PREDATA)),
8523533c 670
8800895a
PH		 671 (unsigned int)
672 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 673 (1<<ACL_WHERE_PREDATA)|
674 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 675
3c8b3577 676#ifdef WITH_CONTENT_SCAN
8e669ac1 677 (unsigned int)
14d57970 678 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 679 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 680 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 681 (1<<ACL_WHERE_MIME)),
3c8b3577 682#endif
a6c4ab60 683
29aba418
TF		 684 (unsigned int)
685 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
686 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 687#ifndef DISABLE_PRDR
fd98a5c6 688 (1<<ACL_WHERE_PRDR)|
3c8b3577 689#endif
29aba418
TF		 690 (1<<ACL_WHERE_MIME)),
691
8e669ac1 692 (unsigned int)
a6c4ab60 693 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 694 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 695#ifndef DISABLE_PRDR
fd98a5c6 696 (1<<ACL_WHERE_PRDR)|
3c8b3577 697#endif
e715ad22 698 (1<<ACL_WHERE_MIME)),
8523533c 699
8c5d388a 700#ifdef SUPPORT_I18N
3c8b3577
JH		 701 0, /* utf8_downconvert */
702#endif
703
45b91596 704 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 705 (1<<ACL_WHERE_NOTSMTP_START),
706
707 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 708 (1<<ACL_WHERE_NOTSMTP_START),
709
710 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 711 (1<<ACL_WHERE_NOTSMTP_START),
712
713 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 714 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 715};
716
717/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 718
719typedef struct control_def {
720 uschar *name;
721 int value; /* CONTROL_xxx value */
059ec3d9
PH		 722 BOOL has_option; /* Has /option(s) following */
723} control_def;
724
725static control_def controls_list[] = {
3c8b3577 726 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 727#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 728 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 729#endif
3c8b3577 730 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 731#ifndef DISABLE_DKIM
3c8b3577 732 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 733#endif
734#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 735 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
736 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 737#endif
3c8b3577
JH		 738 { US"dscp", CONTROL_DSCP, TRUE },
739 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
740 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
741 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
742 { US"freeze", CONTROL_FREEZE, TRUE },
743 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
744 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
745 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
746 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
747 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
748 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 749#ifdef WITH_CONTENT_SCAN
3c8b3577 750 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 751#endif
3c8b3577
JH		 752 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
753 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
754 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 755 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577 756 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
8c5d388a 757#ifdef SUPPORT_I18N
3c8b3577
JH		 758 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
759#endif
059ec3d9
PH		 760 };
761
e5a9dba6
PH		 762/* Support data structures for Client SMTP Authorization. acl_verify_csa()
763caches its result in a tree to avoid repeated DNS queries. The result is an
764integer code which is used as an index into the following tables of
765explanatory strings and verification return codes. */
766
767static tree_node *csa_cache = NULL;
768
769enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
770 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
771
772/* The acl_verify_csa() return code is translated into an acl_verify() return
773code using the following table. It is OK unless the client is definitely not
774authorized. This is because CSA is supposed to be optional for sending sites,
775so recipients should not be too strict about checking it - especially because
776DNS problems are quite likely to occur. It's possible to use $csa_status in
777further ACL conditions to distinguish ok, unknown, and defer if required, but
778the aim is to make the usual configuration simple. */
779
780static int csa_return_code[] = {
781 OK, OK, OK, OK,
782 FAIL, FAIL, FAIL, FAIL
783};
784
785static uschar *csa_status_string[] = {
786 US"unknown", US"ok", US"defer", US"defer",
787 US"fail", US"fail", US"fail", US"fail"
788};
789
790static uschar *csa_reason_string[] = {
791 US"unknown",
792 US"ok",
793 US"deferred (SRV lookup failed)",
794 US"deferred (target address lookup failed)",
795 US"failed (explicit authorization required)",
796 US"failed (host name not authorized)",
797 US"failed (no authorized addresses)",
798 US"failed (client address mismatch)"
799};
800
c99ce5c9
TF		 801/* Options for the ratelimit condition. Note that there are two variants of
802the per_rcpt option, depending on the ACL that is used to measure the rate.
803However any ACL must be able to look up per_rcpt rates in /noupdate mode,
804so the two variants must have the same internal representation as well as
805the same configuration string. */
806
807enum {
808 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
809 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
810};
811
812#define RATE_SET(var,new) \
813 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
814
815static uschar *ratelimit_option_string[] = {
816 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
817 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
818};
819
059ec3d9
PH		 820/* Enable recursion between acl_check_internal() and acl_check_condition() */
821
55414b25 822static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 823 uschar **);
059ec3d9
PH		 824
825
826/*************************************************
827* Pick out name from list *
828*************************************************/
829
830/* Use a binary chop method
831
832Arguments:
833 name name to find
834 list list of names
835 end size of list
836
837Returns: offset in list, or -1 if not found
838*/
839
840static int
841acl_checkname(uschar *name, uschar **list, int end)
842{
843int start = 0;
844
845while (start < end)
846 {
847 int mid = (start + end)/2;
848 int c = Ustrcmp(name, list[mid]);
849 if (c == 0) return mid;
850 if (c < 0) end = mid; else start = mid + 1;
851 }
852
853return -1;
854}
855
856
857/*************************************************
858* Read and parse one ACL *
859*************************************************/
860
861/* This function is called both from readconf in order to parse the ACLs in the
862configuration file, and also when an ACL is encountered dynamically (e.g. as
863the result of an expansion). It is given a function to call in order to
864retrieve the lines of the ACL. This function handles skipping comments and
865blank lines (where relevant).
866
867Arguments:
868 func function to get next line of ACL
869 error where to put an error message
870
871Returns: pointer to ACL, or NULL
872 NULL can be legal (empty ACL); in this case error will be NULL
873*/
874
875acl_block *
876acl_read(uschar *(*func)(void), uschar **error)
877{
878acl_block *yield = NULL;
879acl_block **lastp = &yield;
880acl_block *this = NULL;
881acl_condition_block *cond;
882acl_condition_block **condp = NULL;
883uschar *s;
884
885*error = NULL;
886
887while ((s = (*func)()) != NULL)
888 {
889 int v, c;
890 BOOL negated = FALSE;
891 uschar *saveline = s;
892 uschar name[64];
893
894 /* Conditions (but not verbs) are allowed to be negated by an initial
895 exclamation mark. */
896
897 while (isspace(*s)) s++;
898 if (*s == '!')
899 {
900 negated = TRUE;
901 s++;
902 }
903
cf00dad6
PH		 904 /* Read the name of a verb or a condition, or the start of a new ACL, which
905 can be started by a name, or by a macro definition. */
059ec3d9
PH		 906
907 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 908 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 909
910 /* If a verb is unrecognized, it may be another condition or modifier that
911 continues the previous verb. */
912
913 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
914 if (v < 0)
915 {
916 if (this == NULL)
917 {
4e167a8c
PH		 918 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
919 saveline);
059ec3d9
PH		 920 return NULL;
921 }
922 }
923
924 /* New verb */
925
926 else
927 {
928 if (negated)
929 {
930 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
931 return NULL;
932 }
933 this = store_get(sizeof(acl_block));
934 *lastp = this;
935 lastp = &(this->next);
936 this->next = NULL;
937 this->verb = v;
938 this->condition = NULL;
939 condp = &(this->condition);
940 if (*s == 0) continue; /* No condition on this line */
941 if (*s == '!')
942 {
943 negated = TRUE;
944 s++;
945 }
946 s = readconf_readname(name, sizeof(name), s); /* Condition name */
947 }
948
949 /* Handle a condition or modifier. */
950
951 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
952 if (c < 0)
953 {
954 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
955 saveline);
956 return NULL;
957 }
958
959 /* The modifiers may not be negated */
960
961 if (negated && cond_modifiers[c])
962 {
963 *error = string_sprintf("ACL error: negation is not allowed with "
964 "\"%s\"", conditions[c]);
965 return NULL;
966 }
967
968 /* ENDPASS may occur only with ACCEPT or DISCARD. */
969
970 if (c == ACLC_ENDPASS &&
971 this->verb != ACL_ACCEPT &&
972 this->verb != ACL_DISCARD)
973 {
974 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
975 conditions[c], verbs[this->verb]);
976 return NULL;
977 }
978
979 cond = store_get(sizeof(acl_condition_block));
980 cond->next = NULL;
981 cond->type = c;
982 cond->u.negated = negated;
983
984 *condp = cond;
985 condp = &(cond->next);
986
987 /* The "set" modifier is different in that its argument is "name=value"
988 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 989 gives us a variable name to insert into the data block. The original ACL
990 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
991 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 992 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
993 After that, we allow alphanumerics and underscores, but the first character
994 after c or m must be a digit or an underscore. This retains backwards
995 compatibility. */
059ec3d9
PH		 996
997 if (c == ACLC_SET)
998 {
47ca6d6c
PH		 999 uschar *endptr;
1000
38a0a95f
PH		 1001 if (Ustrncmp(s, "acl_c", 5) != 0 &&
1002 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 1003 {
38a0a95f
PH		 1004 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1005 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1006 return NULL;
47ca6d6c 1007 }
38a0a95f
PH		 1008
1009 endptr = s + 5;
641cb756
PH		 1010 if (!isdigit(*endptr) && *endptr != '_')
1011 {
1012 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1013 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1014 s);
1015 return NULL;
1016 }
1017
38a0a95f 1018 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1019 {
38a0a95f
PH		 1020 if (!isalnum(*endptr) && *endptr != '_')
1021 {
1022 *error = string_sprintf("invalid character \"%c\" in variable name "
1023 "in ACL modifier \"set %s\"", *endptr, s);
1024 return NULL;
1025 }
1026 endptr++;
47ca6d6c 1027 }
47ca6d6c 1028
38a0a95f 1029 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1030 s = endptr;
059ec3d9
PH		 1031 while (isspace(*s)) s++;
1032 }
1033
1034 /* For "set", we are now positioned for the data. For the others, only
1035 "endpass" has no data */
1036
1037 if (c != ACLC_ENDPASS)
1038 {
1039 if (*s++ != '=')
1040 {
1041 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1042 cond_modifiers[c]? US"modifier" : US"condition");
1043 return NULL;
1044 }
1045 while (isspace(*s)) s++;
1046 cond->arg = string_copy(s);
1047 }
1048 }
1049
1050return yield;
1051}
1052
1053
1054
71fafd95
PH		 1055/*************************************************
1056* Set up added header line(s) *
1057*************************************************/
1058
1059/* This function is called by the add_header modifier, and also from acl_warn()
1060to implement the now-deprecated way of adding header lines using "message" on a
1061"warn" verb. The argument is treated as a sequence of header lines which are
1062added to a chain, provided there isn't an identical one already there.
1063
1064Argument: string of header lines
1065Returns: nothing
1066*/
1067
1068static void
55414b25 1069setup_header(const uschar *hstring)
71fafd95 1070{
55414b25 1071const uschar *p, *q;
71fafd95
PH		 1072int hlen = Ustrlen(hstring);
1073
b1b05573
JH		 1074/* Ignore any leading newlines */
1075while (*hstring == '\n') hstring++, hlen--;
71fafd95 1076
b1b05573 1077/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1078if (hlen <= 0) return;
96f5fe4c 1079if (hstring[--hlen] != '\n') /* no newline */
55414b25 1080 q = string_sprintf("%s\n", hstring);
96f5fe4c 1081else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 1082 {
1083 uschar * s = string_copy(hstring);
1084 while(s[--hlen] == '\n')
1085 s[hlen+1] = '\0';
1086 q = s;
1087 }
1088else
1089 q = hstring;
71fafd95
PH		 1090
1091/* Loop for multiple header lines, taking care about continuations */
1092
55414b25 1093for (p = q; *p != 0; )
71fafd95 1094 {
55414b25
JH		 1095 const uschar *s;
1096 uschar * hdr;
71fafd95
PH		 1097 int newtype = htype_add_bot;
1098 header_line **hptr = &acl_added_headers;
1099
1100 /* Find next header line within the string */
1101
1102 for (;;)
1103 {
96f5fe4c 1104 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH		 1105 if (*(++q) != ' ' && *q != '\t') break;
1106 }
1107
1108 /* If the line starts with a colon, interpret the instruction for where to
1109 add it. This temporarily sets up a new type. */
1110
1111 if (*p == ':')
1112 {
1113 if (strncmpic(p, US":after_received:", 16) == 0)
1114 {
1115 newtype = htype_add_rec;
1116 p += 16;
1117 }
1118 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1119 {
1120 newtype = htype_add_rfc;
1121 p += 14;
1122 }
1123 else if (strncmpic(p, US":at_start:", 10) == 0)
1124 {
1125 newtype = htype_add_top;
1126 p += 10;
1127 }
1128 else if (strncmpic(p, US":at_end:", 8) == 0)
1129 {
1130 newtype = htype_add_bot;
1131 p += 8;
1132 }
1133 while (*p == ' ' || *p == '\t') p++;
1134 }
1135
1136 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1137 to the front of it. */
1138
1139 for (s = p; s < q - 1; s++)
1140 {
1141 if (*s == ':' || !isgraph(*s)) break;
1142 }
1143
55414b25
JH		 1144 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1145 hlen = Ustrlen(hdr);
71fafd95
PH		 1146
1147 /* See if this line has already been added */
1148
1149 while (*hptr != NULL)
1150 {
55414b25 1151 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1152 hptr = &((*hptr)->next);
1153 }
1154
1155 /* Add if not previously present */
1156
1157 if (*hptr == NULL)
1158 {
1159 header_line *h = store_get(sizeof(header_line));
55414b25 1160 h->text = hdr;
71fafd95
PH		 1161 h->next = NULL;
1162 h->type = newtype;
1163 h->slen = hlen;
1164 *hptr = h;
1165 hptr = &(h->next);
1166 }
1167
1168 /* Advance for next header line within the string */
1169
1170 p = q;
1171 }
1172}
1173
1174
1175
362145b5
JH		 1176/*************************************************
1177* List the added header lines *
1178*************************************************/
1179uschar *
1180fn_hdrs_added(void)
1181{
1182uschar * ret = NULL;
1183header_line * h = acl_added_headers;
1184uschar * s;
1185uschar * cp;
1186int size = 0;
1187int ptr = 0;
1188
1189if (!h) return NULL;
1190
1191do
1192 {
1193 s = h->text;
1194 while ((cp = Ustrchr(s, '\n')) != NULL)
1195 {
1196 if (cp[1] == '\0') break;
1197
1198 /* contains embedded newline; needs doubling */
1199 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1200 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1201 s = cp+1;
1202 }
1203 /* last bit of header */
1204
1205 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1206 }
6d9cfc47 1207while((h = h->next));
362145b5
JH		 1208
1209ret[ptr-1] = '\0'; /* overwrite last newline */
1210return ret;
1211}
1212
1213
e7568d51
TL		 1214/*************************************************
1215* Set up removed header line(s) *
1216*************************************************/
1217
1218/* This function is called by the remove_header modifier. The argument is
1219treated as a sequence of header names which are added to a colon separated
1220list, provided there isn't an identical one already there.
1221
1222Argument: string of header names
1223Returns: nothing
1224*/
1225
1226static void
55414b25 1227setup_remove_header(const uschar *hnames)
e7568d51
TL		 1228{
1229if (*hnames != 0)
55414b25
JH		 1230 acl_removed_headers = acl_removed_headers
1231 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1232 : string_copy(hnames);
e7568d51
TL		 1233}
1234
1235
71fafd95 1236
059ec3d9
PH		 1237/*************************************************
1238* Handle warnings *
1239*************************************************/
1240
1241/* This function is called when a WARN verb's conditions are true. It adds to
1242the message's headers, and/or writes information to the log. In each case, this
1243only happens once (per message for headers, per connection for log).
1244
71fafd95
PH		 1245** NOTE: The header adding action using the "message" setting is historic, and
1246its use is now deprecated. The new add_header modifier should be used instead.
1247
059ec3d9
PH		 1248Arguments:
1249 where ACL_WHERE_xxxx indicating which ACL this is
1250 user_message message for adding to headers
1251 log_message message for logging, if different
1252
1253Returns: nothing
1254*/
1255
1256static void
1257acl_warn(int where, uschar *user_message, uschar *log_message)
1258{
059ec3d9
PH		 1259if (log_message != NULL && log_message != user_message)
1260 {
1261 uschar *text;
1262 string_item *logged;
1263
1264 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1265 string_printing(log_message));
1266
1267 /* If a sender verification has failed, and the log message is "sender verify
1268 failed", add the failure message. */
1269
1270 if (sender_verified_failed != NULL &&
1271 sender_verified_failed->message != NULL &&
1272 strcmpic(log_message, US"sender verify failed") == 0)
1273 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1274
9c7a242c
PH		 1275 /* Search previously logged warnings. They are kept in malloc
1276 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1277
1278 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1279 if (Ustrcmp(logged->text, text) == 0) break;
1280
1281 if (logged == NULL)
1282 {
1283 int length = Ustrlen(text) + 1;
1284 log_write(0, LOG_MAIN, "%s", text);
1285 logged = store_malloc(sizeof(string_item) + length);
1286 logged->text = (uschar *)logged + sizeof(string_item);
1287 memcpy(logged->text, text, length);
1288 logged->next = acl_warn_logged;
1289 acl_warn_logged = logged;
1290 }
1291 }
1292
1293/* If there's no user message, we are done. */
1294
1295if (user_message == NULL) return;
1296
1297/* If this isn't a message ACL, we can't do anything with a user message.
1298Log an error. */
1299
1300if (where > ACL_WHERE_NOTSMTP)
1301 {
1302 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1303 "found in a non-message (%s) ACL: cannot specify header lines here: "
1304 "message ignored", acl_wherenames[where]);
1305 return;
1306 }
1307
71fafd95
PH		 1308/* The code for setting up header lines is now abstracted into a separate
1309function so that it can be used for the add_header modifier as well. */
059ec3d9 1310
71fafd95 1311setup_header(user_message);
059ec3d9
PH		 1312}
1313
1314
1315
1316/*************************************************
1317* Verify and check reverse DNS *
1318*************************************************/
1319
1320/* Called from acl_verify() below. We look up the host name(s) of the client IP
1321address if this has not yet been done. The host_name_lookup() function checks
1322that one of these names resolves to an address list that contains the client IP
1323address, so we don't actually have to do the check here.
1324
1325Arguments:
1326 user_msgptr pointer for user message
1327 log_msgptr pointer for log message
1328
1329Returns: OK verification condition succeeded
1330 FAIL verification failed
1331 DEFER there was a problem verifying
1332*/
1333
1334static int
1335acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1336{
1337int rc;
1338
1339user_msgptr = user_msgptr; /* stop compiler warning */
1340
1341/* Previous success */
1342
1343if (sender_host_name != NULL) return OK;
1344
1345/* Previous failure */
1346
1347if (host_lookup_failed)
1348 {
1349 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1350 return FAIL;
1351 }
1352
1353/* Need to do a lookup */
1354
1355HDEBUG(D_acl)
1356 debug_printf("looking up host name to force name/address consistency check\n");
1357
1358if ((rc = host_name_lookup()) != OK)
1359 {
1360 *log_msgptr = (rc == DEFER)?
1361 US"host lookup deferred for reverse lookup check"
1362 :
1363 string_sprintf("host lookup failed for reverse lookup check%s",
1364 host_lookup_msg);
1365 return rc; /* DEFER or FAIL */
1366 }
1367
1368host_build_sender_fullhost();
1369return OK;
1370}
1371
1372
1373
e5a9dba6
PH		 1374/*************************************************
1375* Check client IP address matches CSA target *
1376*************************************************/
1377
1378/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1379response for address records belonging to the CSA target hostname. The section
1380is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1381If one of the addresses matches the client's IP address, then the client is
1382authorized by CSA. If there are target IP addresses but none of them match
1383then the client is using an unauthorized IP address. If there are no target IP
1384addresses then the client cannot be using an authorized IP address. (This is
1385an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1386
1387Arguments:
1388 dnsa the DNS answer block
1389 dnss a DNS scan block for us to use
1390 reset option specifing what portion to scan, as described above
1391 target the target hostname to use for matching RR names
1392
1393Returns: CSA_OK successfully authorized
1394 CSA_FAIL_MISMATCH addresses found but none matched
1395 CSA_FAIL_NOADDR no target addresses found
1396*/
1397
1398static int
1399acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1400 uschar *target)
1401{
1402dns_record *rr;
1403dns_address *da;
1404
1405BOOL target_found = FALSE;
1406
1407for (rr = dns_next_rr(dnsa, dnss, reset);
1408 rr != NULL;
1409 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1410 {
1411 /* Check this is an address RR for the target hostname. */
1412
1413 if (rr->type != T_A
1414 #if HAVE_IPV6
1415 && rr->type != T_AAAA
e5a9dba6
PH		 1416 #endif
1417 ) continue;
1418
1419 if (strcmpic(target, rr->name) != 0) continue;
1420
1421 target_found = TRUE;
1422
1423 /* Turn the target address RR into a list of textual IP addresses and scan
1424 the list. There may be more than one if it is an A6 RR. */
1425
1426 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1427 {
1428 /* If the client IP address matches the target IP address, it's good! */
1429
1430 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1431
1432 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1433 }
1434 }
1435
1436/* If we found some target addresses but none of them matched, the client is
1437using an unauthorized IP address, otherwise the target has no authorized IP
1438addresses. */
1439
1440if (target_found) return CSA_FAIL_MISMATCH;
1441else return CSA_FAIL_NOADDR;
1442}
1443
1444
1445
1446/*************************************************
1447* Verify Client SMTP Authorization *
1448*************************************************/
1449
1450/* Called from acl_verify() below. This routine calls dns_lookup_special()
1451to find the CSA SRV record corresponding to the domain argument, or
1452$sender_helo_name if no argument is provided. It then checks that the
1453client is authorized, and that its IP address corresponds to the SRV
1454target's address by calling acl_verify_csa_address() above. The address
1455should have been returned in the DNS response's ADDITIONAL section, but if
1456not we perform another DNS lookup to get it.
1457
1458Arguments:
1459 domain pointer to optional parameter following verify = csa
1460
1461Returns: CSA_UNKNOWN no valid CSA record found
1462 CSA_OK successfully authorized
1463 CSA_FAIL_* client is definitely not authorized
1464 CSA_DEFER_* there was a DNS problem
1465*/
1466
1467static int
55414b25 1468acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1469{
1470tree_node *t;
55414b25
JH		 1471const uschar *found;
1472uschar *p;
e5a9dba6
PH		 1473int priority, weight, port;
1474dns_answer dnsa;
1475dns_scan dnss;
1476dns_record *rr;
1477int rc, type;
1478uschar target[256];
1479
1480/* Work out the domain we are using for the CSA lookup. The default is the
1481client's HELO domain. If the client has not said HELO, use its IP address
1482instead. If it's a local client (exim -bs), CSA isn't applicable. */
1483
1484while (isspace(*domain) && *domain != '\0') ++domain;
1485if (*domain == '\0') domain = sender_helo_name;
1486if (domain == NULL) domain = sender_host_address;
1487if (sender_host_address == NULL) return CSA_UNKNOWN;
1488
1489/* If we have an address literal, strip off the framing ready for turning it
1490into a domain. The framing consists of matched square brackets possibly
1491containing a keyword and a colon before the actual IP address. */
1492
1493if (domain[0] == '[')
1494 {
55414b25 1495 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1496 if (start == NULL) start = domain;
1497 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1498 }
1499
1500/* Turn domains that look like bare IP addresses into domains in the reverse
1501DNS. This code also deals with address literals and $sender_host_address. It's
1502not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1503address literals, but it's probably the most friendly thing to do. This is an
1504extension to CSA, so we allow it to be turned off for proper conformance. */
1505
7e66e54d 1506if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1507 {
1508 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1509 dns_build_reverse(domain, target);
1510 domain = target;
1511 }
1512
1513/* Find out if we've already done the CSA check for this domain. If we have,
1514return the same result again. Otherwise build a new cached result structure
1515for this domain. The name is filled in now, and the value is filled in when
1516we return from this function. */
1517
1518t = tree_search(csa_cache, domain);
1519if (t != NULL) return t->data.val;
1520
1521t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1522Ustrcpy(t->name, domain);
1523(void)tree_insertnode(&csa_cache, t);
1524
1525/* Now we are ready to do the actual DNS lookup(s). */
1526
28e6ef29 1527found = domain;
e5a9dba6
PH		 1528switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1529 {
1530 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1531
1532 default:
1533 return t->data.val = CSA_DEFER_SRV;
1534
1535 /* If we found nothing, the client's authorization is unknown. */
1536
1537 case DNS_NOMATCH:
1538 case DNS_NODATA:
1539 return t->data.val = CSA_UNKNOWN;
1540
1541 /* We got something! Go on to look at the reply in more detail. */
1542
1543 case DNS_SUCCEED:
1544 break;
1545 }
1546
1547/* Scan the reply for well-formed CSA SRV records. */
1548
1549for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1550 rr != NULL;
1551 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1552 {
1553 if (rr->type != T_SRV) continue;
1554
1555 /* Extract the numerical SRV fields (p is incremented) */
1556
1557 p = rr->data;
1558 GETSHORT(priority, p);
1559 GETSHORT(weight, p);
1560 GETSHORT(port, p);
1561
1562 DEBUG(D_acl)
1563 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1564
1565 /* Check the CSA version number */
1566
1567 if (priority != 1) continue;
1568
1569 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1570 found by dns_special_lookup() is a parent of the one we asked for), we check
1571 the subdomain assertions in the port field. At the moment there's only one
1572 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1573 SRV records of their own. */
1574
1dc92d5a 1575 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1576 {
1577 if (port & 1)
1578 return t->data.val = CSA_FAIL_EXPLICIT;
1579 else
1580 return t->data.val = CSA_UNKNOWN;
1581 }
1582
1583 /* This CSA SRV record refers directly to our domain, so we check the value
1584 in the weight field to work out the domain's authorization. 0 and 1 are
1585 unauthorized; 3 means the client is authorized but we can't check the IP
1586 address in order to authenticate it, so we treat it as unknown; values
1587 greater than 3 are undefined. */
1588
1589 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1590
1591 if (weight > 2) continue;
1592
1593 /* Weight == 2, which means the domain is authorized. We must check that the
1594 client's IP address is listed as one of the SRV target addresses. Save the
1595 target hostname then break to scan the additional data for its addresses. */
1596
1597 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1598 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1599
1600 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1601
1602 break;
1603 }
1604
1605/* If we didn't break the loop then no appropriate records were found. */
1606
1607if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1608
1609/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1610A target of "." indicates there are no valid addresses, so the client cannot
1611be authorized. (This is an odd configuration because weight=2 target=. is
1612equivalent to weight=1, but we check for it in order to keep load off the
1613root name servers.) Note that dn_expand() turns "." into "". */
1614
1615if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1616
1617/* Scan the additional section of the CSA SRV reply for addresses belonging
1618to the target. If the name server didn't return any additional data (e.g.
1619because it does not fully support SRV records), we need to do another lookup
1620to obtain the target addresses; otherwise we have a definitive result. */
1621
1622rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1623if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1624
1625/* The DNS lookup type corresponds to the IP version used by the client. */
1626
1627#if HAVE_IPV6
1628if (Ustrchr(sender_host_address, ':') != NULL)
1629 type = T_AAAA;
1630else
1631#endif /* HAVE_IPV6 */
1632 type = T_A;
1633
1634
4e0983dc 1635lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1636switch (dns_lookup(&dnsa, target, type, NULL))
1637 {
1638 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1639
1640 default:
cc00f4af 1641 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1642
1643 /* If the query succeeded, scan the addresses and return the result. */
1644
1645 case DNS_SUCCEED:
cc00f4af
JH		 1646 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1647 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1648 /* else fall through */
e5a9dba6
PH		 1649
1650 /* If the target has no IP addresses, the client cannot have an authorized
1651 IP address. However, if the target site uses A6 records (not AAAA records)
1652 we have to do yet another lookup in order to check them. */
1653
1654 case DNS_NOMATCH:
1655 case DNS_NODATA:
cc00f4af 1656 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1657 }
1658}
1659
1660
1661
059ec3d9
PH		 1662/*************************************************
1663* Handle verification (address & other) *
1664*************************************************/
1665
89583014 1666enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1667 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1668 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1669 };
1670typedef struct {
1671 uschar * name;
1672 int value;
1673 unsigned where_allowed; /* bitmap */
1674 BOOL no_options; /* Never has /option(s) following */
1675 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1676 } verify_type_t;
1677static verify_type_t verify_type_list[] = {
7e8360e6 1678 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1679 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1680 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1681 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1682 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1683 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1684 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1685 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1686 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1687 FALSE, 6 },
770747fd
MFM		 1688 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1689 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1690 };
1691
1692
1693enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1694 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1695 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1696 CALLOUT_TIME
1697 };
1698typedef struct {
1699 uschar * name;
1700 int value;
1701 int flag;
1702 BOOL has_option; /* Has =option(s) following */
1703 BOOL timeval; /* Has a time value */
1704 } callout_opt_t;
1705static callout_opt_t callout_opt_list[] = {
1706 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1707 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1708 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1709 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1710 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1711 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1712 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1713 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1714 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1715 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1716 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1717 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1718 };
1719
1720
1721
059ec3d9
PH		 1722/* This function implements the "verify" condition. It is called when
1723encountered in any ACL, because some tests are almost always permitted. Some
1724just don't make sense, and always fail (for example, an attempt to test a host
1725lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1726
1727Arguments:
1728 where where called from
1729 addr the recipient address that the ACL is handling, or NULL
1730 arg the argument of "verify"
1731 user_msgptr pointer for user message
1732 log_msgptr pointer for log message
1733 basic_errno where to put verify errno
1734
1735Returns: OK verification condition succeeded
1736 FAIL verification failed
1737 DEFER there was a problem verifying
1738 ERROR syntax error
1739*/
1740
1741static int
55414b25 1742acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1743 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1744{
1745int sep = '/';
1746int callout = -1;
1747int callout_overall = -1;
4deaf07d 1748int callout_connect = -1;
059ec3d9
PH		 1749int verify_options = 0;
1750int rc;
1751BOOL verify_header_sender = FALSE;
1752BOOL defer_ok = FALSE;
1753BOOL callout_defer_ok = FALSE;
1754BOOL no_details = FALSE;
eafd343b 1755BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1756address_item *sender_vaddr = NULL;
1757uschar *verify_sender_address = NULL;
1758uschar *pm_mailfrom = NULL;
1759uschar *se_mailfrom = NULL;
596875b3
PH		 1760
1761/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1762an error if options are given for items that don't expect them.
596875b3
PH		 1763*/
1764
1765uschar *slash = Ustrchr(arg, '/');
55414b25 1766const uschar *list = arg;
059ec3d9 1767uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1768verify_type_t * vp;
059ec3d9
PH		 1769
1770if (ss == NULL) goto BAD_VERIFY;
1771
1772/* Handle name/address consistency verification in a separate function. */
1773
89583014
JH		 1774for (vp= verify_type_list;
1775 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1776 vp++
1777 )
1778 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1779 : strcmpic (ss, vp->name) == 0)
1780 break;
1781if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1782 goto BAD_VERIFY;
1783
1784if (vp->no_options && slash != NULL)
059ec3d9 1785 {
89583014
JH		 1786 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1787 "(this verify item has no options)", arg);
1788 return ERROR;
059ec3d9 1789 }
89583014 1790if (!(vp->where_allowed & (1<<where)))
059ec3d9 1791 {
89583014
JH		 1792 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1793 return ERROR;
059ec3d9 1794 }
89583014 1795switch(vp->value)
596875b3 1796 {
89583014
JH		 1797 case VERIFY_REV_HOST_LKUP:
1798 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1799 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1800 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1801 if (strcmpic(ss, US"defer_ok") == 0)
1802 return OK;
1803 return rc;
059ec3d9 1804
89583014
JH		 1805 case VERIFY_CERT:
1806 /* TLS certificate verification is done at STARTTLS time; here we just
1807 test whether it was successful or not. (This is for optional verification; for
1808 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1809
3703d818
JH		 1810 if (tls_in.certificate_verified) return OK;
1811 *user_msgptr = US"no verified certificate";
1812 return FAIL;
e5a9dba6 1813
89583014
JH		 1814 case VERIFY_HELO:
1815 /* We can test the result of optional HELO verification that might have
1816 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1817
3703d818
JH		 1818 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1819 return helo_verified? OK : FAIL;
059ec3d9 1820
89583014
JH		 1821 case VERIFY_CSA:
1822 /* Do Client SMTP Authorization checks in a separate function, and turn the
1823 result code into user-friendly strings. */
1c41c9cc 1824
3703d818
JH		 1825 rc = acl_verify_csa(list);
1826 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1827 csa_reason_string[rc]);
3703d818
JH		 1828 csa_status = csa_status_string[rc];
1829 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1830 return csa_return_code[rc];
89583014
JH		 1831
1832 case VERIFY_HDR_SYNTAX:
1833 /* Check that all relevant header lines have the correct syntax. If there is
1834 a syntax error, we return details of the error to the sender if configured to
1835 send out full details. (But a "message" setting on the ACL can override, as
1836 always). */
1837
1838 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1839 if (rc != OK && *log_msgptr)
1840 if (smtp_return_error_details)
1841 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1842 else
1843 acl_verify_message = *log_msgptr;
89583014 1844 return rc;
059ec3d9 1845
770747fd
MFM		 1846 case VERIFY_HDR_NAMES_ASCII:
1847 /* Check that all header names are true 7 bit strings
1848 See RFC 5322, 2.2. and RFC 6532, 3. */
1849
1850 rc = verify_check_header_names_ascii(log_msgptr);
1851 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1852 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1853 return rc;
1854
89583014
JH		 1855 case VERIFY_NOT_BLIND:
1856 /* Check that no recipient of this message is "blind", that is, every envelope
1857 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1858
89583014
JH		 1859 rc = verify_check_notblind();
1860 if (rc != OK)
1861 {
1862 *log_msgptr = string_sprintf("bcc recipient detected");
1863 if (smtp_return_error_details)
1864 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1865 }
1866 return rc;
059ec3d9 1867
89583014
JH		 1868 /* The remaining verification tests check recipient and sender addresses,
1869 either from the envelope or from the header. There are a number of
1870 slash-separated options that are common to all of them. */
059ec3d9 1871
89583014
JH		 1872 case VERIFY_HDR_SNDR:
1873 verify_header_sender = TRUE;
1874 break;
059ec3d9 1875
89583014
JH		 1876 case VERIFY_SNDR:
1877 /* In the case of a sender, this can optionally be followed by an address to use
1878 in place of the actual sender (rare special-case requirement). */
059ec3d9 1879 {
89583014
JH		 1880 uschar *s = ss + 6;
1881 if (*s == 0)
1882 verify_sender_address = sender_address;
1883 else
1884 {
1885 while (isspace(*s)) s++;
1886 if (*s++ != '=') goto BAD_VERIFY;
1887 while (isspace(*s)) s++;
1888 verify_sender_address = string_copy(s);
1889 }
059ec3d9 1890 }
89583014
JH		 1891 break;
1892
1893 case VERIFY_RCPT:
1894 break;
059ec3d9
PH		 1895 }
1896
89583014
JH		 1897
1898
596875b3
PH		 1899/* Remaining items are optional; they apply to sender and recipient
1900verification, including "header sender" verification. */
059ec3d9
PH		 1901
1902while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1903 != NULL)
1904 {
1905 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1906 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1907 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1908
1909 /* These two old options are left for backwards compatibility */
1910
1911 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1912 {
1913 callout_defer_ok = TRUE;
1914 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1915 }
1916
1917 else if (strcmpic(ss, US"check_postmaster") == 0)
1918 {
1919 pm_mailfrom = US"";
1920 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1921 }
1922
1923 /* The callout option has a number of sub-options, comma separated */
1924
1925 else if (strncmpic(ss, US"callout", 7) == 0)
1926 {
1927 callout = CALLOUT_TIMEOUT_DEFAULT;
1928 ss += 7;
1929 if (*ss != 0)
1930 {
1931 while (isspace(*ss)) ss++;
1932 if (*ss++ == '=')
1933 {
55414b25 1934 const uschar * sublist = ss;
059ec3d9
PH		 1935 int optsep = ',';
1936 uschar *opt;
1937 uschar buffer[256];
55414b25 1938 while (isspace(*sublist)) sublist++;
8e669ac1 1939
55414b25 1940 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1941 != NULL)
1942 {
89583014 1943 callout_opt_t * op;
438257ba 1944 double period = 1.0F;
059ec3d9 1945
89583014 1946 for (op= callout_opt_list; op->name; op++)
438257ba 1947 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1948 break;
059ec3d9 1949
89583014
JH		 1950 verify_options |= op->flag;
1951 if (op->has_option)
1952 {
438257ba 1953 opt += Ustrlen(op->name);
4deaf07d
PH		 1954 while (isspace(*opt)) opt++;
1955 if (*opt++ != '=')
1956 {
1957 *log_msgptr = string_sprintf("'=' expected after "
89583014 1958 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1959 return ERROR;
1960 }
1961 while (isspace(*opt)) opt++;
89583014
JH		 1962 }
1963 if (op->timeval)
1964 {
1965 period = readconf_readtime(opt, 0, FALSE);
1966 if (period < 0)
4deaf07d
PH		 1967 {
1968 *log_msgptr = string_sprintf("bad time value in ACL condition "
1969 "\"verify %s\"", arg);
1970 return ERROR;
1971 }
89583014
JH		 1972 }
1973
1974 switch(op->value)
1975 {
1976 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1977 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1978 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1979 case CALLOUT_MAILFROM:
1980 if (!verify_header_sender)
1981 {
1982 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1983 "callout option only for verify=header_sender (detected in ACL "
1984 "condition \"%s\")", arg);
1985 return ERROR;
1986 }
1987 se_mailfrom = string_copy(opt);
1988 break;
1989 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1990 case CALLOUT_MAXWAIT: callout_overall = period; break;
1991 case CALLOUT_CONNECT: callout_connect = period; break;
1992 case CALLOUT_TIME: callout = period; break;
1993 }
059ec3d9
PH		 1994 }
1995 }
1996 else
1997 {
1998 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1999 "ACL condition \"%s\"", arg);
2000 return ERROR;
2001 }
2002 }
2003 }
2004
2005 /* Option not recognized */
2006
2007 else
2008 {
2009 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2010 "condition \"verify %s\"", ss, arg);
2011 return ERROR;
2012 }
2013 }
2014
2015if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2016 (vopt_callout_recipsender|vopt_callout_recippmaster))
2017 {
2018 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2019 "for a recipient callout";
2020 return ERROR;
2021 }
2022
2023/* Handle sender-in-header verification. Default the user message to the log
2024message if giving out verification details. */
2025
2026if (verify_header_sender)
2027 {
8e669ac1 2028 int verrno;
059ec3d9 2029 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2030 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2031 &verrno);
2032 if (rc != OK)
8e669ac1 2033 {
fe5b5d0b
PH		 2034 *basic_errno = verrno;
2035 if (smtp_return_error_details)
2036 {
2037 if (*user_msgptr == NULL && *log_msgptr != NULL)
2038 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2039 if (rc == DEFER) acl_temp_details = TRUE;
2040 }
8e669ac1 2041 }
059ec3d9
PH		 2042 }
2043
2044/* Handle a sender address. The default is to verify *the* sender address, but
2045optionally a different address can be given, for special requirements. If the
2046address is empty, we are dealing with a bounce message that has no sender, so
2047we cannot do any checking. If the real sender address gets rewritten during
2048verification (e.g. DNS widening), set the flag to stop it being rewritten again
2049during message reception.
2050
2051A list of verified "sender" addresses is kept to try to avoid doing to much
2052work repetitively when there are multiple recipients in a message and they all
2053require sender verification. However, when callouts are involved, it gets too
2054complicated because different recipients may require different callout options.
2055Therefore, we always do a full sender verify when any kind of callout is
2056specified. Caching elsewhere, for instance in the DNS resolver and in the
2057callout handling, should ensure that this is not terribly inefficient. */
2058
2059else if (verify_sender_address != NULL)
2060 {
2061 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2062 != 0)
2063 {
2064 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2065 "sender verify callout";
2066 return ERROR;
2067 }
2068
2069 sender_vaddr = verify_checked_sender(verify_sender_address);
2070 if (sender_vaddr != NULL && /* Previously checked */
2071 callout <= 0) /* No callout needed this time */
2072 {
2073 /* If the "routed" flag is set, it means that routing worked before, so
2074 this check can give OK (the saved return code value, if set, belongs to a
2075 callout that was done previously). If the "routed" flag is not set, routing
2076 must have failed, so we use the saved return code. */
2077
2078 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2079 {
2080 rc = sender_vaddr->special_action;
2081 *basic_errno = sender_vaddr->basic_errno;
2082 }
2083 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2084 }
2085
2086 /* Do a new verification, and cache the result. The cache is used to avoid
2087 verifying the sender multiple times for multiple RCPTs when callouts are not
2088 specified (see comments above).
2089
2090 The cache is also used on failure to give details in response to the first
2091 RCPT that gets bounced for this reason. However, this can be suppressed by
2092 the no_details option, which sets the flag that says "this detail has already
2093 been sent". The cache normally contains just one address, but there may be
2094 more in esoteric circumstances. */
2095
2096 else
2097 {
2098 BOOL routed = TRUE;
2a3eea10 2099 uschar *save_address_data = deliver_address_data;
8e669ac1 2100
059ec3d9 2101 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2102#ifdef SUPPORT_I18N
3c8b3577
JH		 2103 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2104 {
2105 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2106 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2107 }
f358d5e0 2108#endif
059ec3d9
PH		 2109 if (no_details) setflag(sender_vaddr, af_sverify_told);
2110 if (verify_sender_address[0] != 0)
2111 {
2112 /* If this is the real sender address, save the unrewritten version
2113 for use later in receive. Otherwise, set a flag so that rewriting the
2114 sender in verify_address() does not update sender_address. */
2115
2116 if (verify_sender_address == sender_address)
2117 sender_address_unrewritten = sender_address;
2118 else
2119 verify_options |= vopt_fake_sender;
2120
eafd343b
TK		 2121 if (success_on_redirect)
2122 verify_options |= vopt_success_on_redirect;
2123
059ec3d9
PH		 2124 /* The recipient, qualify, and expn options are never set in
2125 verify_options. */
2126
2127 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2128 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2129
2130 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2131
2132 if (rc == OK)
2133 {
2134 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2135 {
2136 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2137 verify_sender_address, sender_vaddr->address);
2138 }
2139 else
2140 {
2141 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2142 verify_sender_address);
2143 }
2144 }
2145 else *basic_errno = sender_vaddr->basic_errno;
2146 }
2147 else rc = OK; /* Null sender */
2148
2149 /* Cache the result code */
2150
2151 if (routed) setflag(sender_vaddr, af_verify_routed);
2152 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2153 sender_vaddr->special_action = rc;
2154 sender_vaddr->next = sender_verified_list;
2155 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2156
2157 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2158 the sender verification. */
8e669ac1 2159
2a3eea10 2160 deliver_address_data = save_address_data;
059ec3d9 2161 }
8e669ac1 2162
2a3eea10
PH		 2163 /* Put the sender address_data value into $sender_address_data */
2164
d43cbe25 2165 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2166 }
2167
2168/* A recipient address just gets a straightforward verify; again we must handle
2169the DEFER overrides. */
2170
2171else
2172 {
2173 address_item addr2;
2174
eafd343b
TK		 2175 if (success_on_redirect)
2176 verify_options |= vopt_success_on_redirect;
2177
059ec3d9
PH		 2178 /* We must use a copy of the address for verification, because it might
2179 get rewritten. */
2180
2181 addr2 = *addr;
2182 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2183 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2184 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2185
42855d71 2186 *basic_errno = addr2.basic_errno;
059ec3d9 2187 *log_msgptr = addr2.message;
8e669ac1 2188 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2189 addr2.user_message : addr2.message;
42855d71
PH		 2190
2191 /* Allow details for temporary error if the address is so flagged. */
2192 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2193
2194 /* Make $address_data visible */
d43cbe25 2195 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2196 }
2197
2198/* We have a result from the relevant test. Handle defer overrides first. */
2199
2200if (rc == DEFER && (defer_ok ||
2201 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2202 {
2203 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2204 defer_ok? "defer_ok" : "callout_defer_ok");
2205 rc = OK;
2206 }
2207
2208/* If we've failed a sender, set up a recipient message, and point
2209sender_verified_failed to the address item that actually failed. */
2210
2211if (rc != OK && verify_sender_address != NULL)
2212 {
2213 if (rc != DEFER)
059ec3d9 2214 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2215 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2216 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2217 else
2218 {
2219 *log_msgptr = US"Could not complete sender verify callout";
2220 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2221 *log_msgptr;
2222 }
2223
2224 sender_verified_failed = sender_vaddr;
2225 }
2226
2227/* Verifying an address messes up the values of $domain and $local_part,
2228so reset them before returning if this is a RCPT ACL. */
2229
2230if (addr != NULL)
2231 {
2232 deliver_domain = addr->domain;
2233 deliver_localpart = addr->local_part;
2234 }
2235return rc;
2236
2237/* Syntax errors in the verify argument come here. */
2238
2239BAD_VERIFY:
2240*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2241 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2242 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2243 "\"verify %s\"", arg);
2244return ERROR;
2245}
2246
2247
2248
2249
2250/*************************************************
2251* Check argument for control= modifier *
2252*************************************************/
2253
2254/* Called from acl_check_condition() below
2255
2256Arguments:
2257 arg the argument string for control=
2258 pptr set to point to the terminating character
2259 where which ACL we are in
2260 log_msgptr for error messages
2261
2262Returns: CONTROL_xxx value
2263*/
2264
2265static int
55414b25 2266decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2267{
2268int len;
2269control_def *d;
2270
2271for (d = controls_list;
2272 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2273 d++)
2274 {
2275 len = Ustrlen(d->name);
2276 if (Ustrncmp(d->name, arg, len) == 0) break;
2277 }
2278
2279if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2280 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2281 {
2282 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2283 return CONTROL_ERROR;
2284 }
2285
059ec3d9
PH		 2286*pptr = arg + len;
2287return d->value;
2288}
2289
2290
2291
c99ce5c9
TF		 2292
2293/*************************************************
2294* Return a ratelimit error *
2295*************************************************/
2296
2297/* Called from acl_ratelimit() below
2298
2299Arguments:
2300 log_msgptr for error messages
2301 format format string
2302 ... supplementary arguments
2303 ss ratelimit option name
2304 where ACL_WHERE_xxxx indicating which ACL this is
2305
2306Returns: ERROR
2307*/
2308
2309static int
2310ratelimit_error(uschar **log_msgptr, const char *format, ...)
2311{
2312va_list ap;
2313uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2314va_start(ap, format);
2315if (!string_vformat(buffer, sizeof(buffer), format, ap))
2316 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2317 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2318va_end(ap);
2319*log_msgptr = string_sprintf(
2320 "error in arguments to \"ratelimit\" condition: %s", buffer);
2321return ERROR;
2322}
2323
2324
2325
2326
870f6ba8
TF		 2327/*************************************************
2328* Handle rate limiting *
2329*************************************************/
2330
2331/* Called by acl_check_condition() below to calculate the result
2332of the ACL ratelimit condition.
2333
2334Note that the return value might be slightly unexpected: if the
2335sender's rate is above the limit then the result is OK. This is
2336similar to the dnslists condition, and is so that you can write
2337ACL clauses like: defer ratelimit = 15 / 1h
2338
2339Arguments:
2340 arg the option string for ratelimit=
90fc3069 2341 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2342 log_msgptr for error messages
2343
2344Returns: OK - Sender's rate is above limit
2345 FAIL - Sender's rate is below limit
2346 DEFER - Problem opening ratelimit database
2347 ERROR - Syntax error in options.
2348*/
2349
2350static int
55414b25 2351acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2352{
c99ce5c9 2353double limit, period, count;
8f240103
PH		 2354uschar *ss;
2355uschar *key = NULL;
c99ce5c9 2356uschar *unique = NULL;
870f6ba8 2357int sep = '/';
c99ce5c9
TF		 2358BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2359BOOL noupdate = FALSE, badacl = FALSE;
2360int mode = RATE_PER_WHAT;
870f6ba8
TF		 2361int old_pool, rc;
2362tree_node **anchor, *t;
2363open_db dbblock, *dbm;
c99ce5c9 2364int dbdb_size;
870f6ba8 2365dbdata_ratelimit *dbd;
c99ce5c9 2366dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2367struct timeval tv;
2368
2369/* Parse the first two options and record their values in expansion
2370variables. These variables allow the configuration to have informative
2371error messages based on rate limits obtained from a table lookup. */
2372
c99ce5c9 2373/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2374size, which must be greater than or equal to zero. Zero is useful for
2375rate measurement as opposed to rate limiting. */
2376
2377sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2378if (sender_rate_limit == NULL)
96f5fe4c
JH		 2379 return ratelimit_error(log_msgptr, "sender rate limit not set");
2380
2381limit = Ustrtod(sender_rate_limit, &ss);
2382if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2383else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2384else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2385
c99ce5c9
TF		 2386if (limit < 0.0 || *ss != '\0')
2387 return ratelimit_error(log_msgptr,
2388 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2389
c99ce5c9 2390/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2391constant. This must be strictly greater than zero, because zero leads to
2392run-time division errors. */
2393
2394sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2395if (sender_rate_period == NULL) period = -1.0;
2396else period = readconf_readtime(sender_rate_period, 0, FALSE);
2397if (period <= 0.0)
c99ce5c9
TF		 2398 return ratelimit_error(log_msgptr,
2399 "\"%s\" is not a time value", sender_rate_period);
2400
2401/* By default we are counting one of something, but the per_rcpt,
2402per_byte, and count options can change this. */
2403
2404count = 1.0;
870f6ba8 2405
c99ce5c9 2406/* Parse the other options. */
870f6ba8
TF		 2407
2408while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2409 != NULL)
2410 {
2411 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2412 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2413 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2414 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2415 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2416 else if (strcmpic(ss, US"per_conn") == 0)
2417 {
2418 RATE_SET(mode, PER_CONN);
2419 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2420 badacl = TRUE;
2421 }
2422 else if (strcmpic(ss, US"per_mail") == 0)
2423 {
2424 RATE_SET(mode, PER_MAIL);
2425 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2426 }
2427 else if (strcmpic(ss, US"per_rcpt") == 0)
2428 {
2429 /* If we are running in the RCPT ACL, then we'll count the recipients
2430 one by one, but if we are running when we have accumulated the whole
2431 list then we'll add them all in one batch. */
2432 if (where == ACL_WHERE_RCPT)
2433 RATE_SET(mode, PER_RCPT);
2434 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2435 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2436 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2437 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2438 }
2439 else if (strcmpic(ss, US"per_byte") == 0)
2440 {
2441 /* If we have not yet received the message data and there was no SIZE
2442 declaration on the MAIL comand, then it's safe to just use a value of
2443 zero and let the recorded rate decay as if nothing happened. */
2444 RATE_SET(mode, PER_MAIL);
2445 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2446 else count = message_size < 0 ? 0.0 : (double)message_size;
2447 }
2448 else if (strcmpic(ss, US"per_addr") == 0)
2449 {
2450 RATE_SET(mode, PER_RCPT);
438257ba 2451 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2452 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2453 }
2454 else if (strncmpic(ss, US"count=", 6) == 0)
2455 {
2456 uschar *e;
2457 count = Ustrtod(ss+6, &e);
2458 if (count < 0.0 || *e != '\0')
2459 return ratelimit_error(log_msgptr,
2460 "\"%s\" is not a positive number", ss);
2461 }
2462 else if (strncmpic(ss, US"unique=", 7) == 0)
2463 unique = string_copy(ss + 7);
2464 else if (key == NULL)
2465 key = string_copy(ss);
2466 else
2467 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2468 }
2469
c99ce5c9
TF		 2470/* Sanity check. When the badacl flag is set the update mode must either
2471be readonly (which is the default if it is omitted) or, for backwards
2472compatibility, a combination of noupdate and strict or leaky. */
2473
2474if (mode == RATE_PER_CLASH)
2475 return ratelimit_error(log_msgptr, "conflicting per_* options");
2476if (leaky + strict + readonly > 1)
2477 return ratelimit_error(log_msgptr, "conflicting update modes");
2478if (badacl && (leaky || strict) && !noupdate)
2479 return ratelimit_error(log_msgptr,
2480 "\"%s\" must not have /leaky or /strict option in %s ACL",
2481 ratelimit_option_string[mode], acl_wherenames[where]);
2482
2483/* Set the default values of any unset options. In readonly mode we
2484perform the rate computation without any increment so that its value
2485decays to eventually allow over-limit senders through. */
2486
2487if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2488if (badacl) readonly = TRUE;
2489if (readonly) count = 0.0;
2490if (!strict && !readonly) leaky = TRUE;
2491if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2492
8f240103
PH		 2493/* Create the lookup key. If there is no explicit key, use sender_host_address.
2494If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2495omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2496are added to the key because they alter the meaning of the stored data. */
2497
2498if (key == NULL)
2499 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2500
c99ce5c9 2501key = string_sprintf("%s/%s/%s%s",
8f240103 2502 sender_rate_period,
c99ce5c9
TF		 2503 ratelimit_option_string[mode],
2504 unique == NULL ? "" : "unique/",
8f240103 2505 key);
870f6ba8 2506
c99ce5c9
TF		 2507HDEBUG(D_acl)
2508 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2509
8f240103
PH		 2510/* See if we have already computed the rate by looking in the relevant tree.
2511For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2512pool so that they survive across resets. In readonly mode we only remember the
2513result for the rest of this command in case a later command changes it. After
2514this bit of logic the code is independent of the per_* mode. */
870f6ba8 2515
870f6ba8
TF		 2516old_pool = store_pool;
2517
c99ce5c9
TF		 2518if (readonly)
2519 anchor = &ratelimiters_cmd;
2520else switch(mode) {
2521case RATE_PER_CONN:
870f6ba8
TF		 2522 anchor = &ratelimiters_conn;
2523 store_pool = POOL_PERM;
c99ce5c9
TF		 2524 break;
2525case RATE_PER_BYTE:
2526case RATE_PER_MAIL:
2527case RATE_PER_ALLRCPTS:
870f6ba8 2528 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2529 break;
2530case RATE_PER_ADDR:
2531case RATE_PER_CMD:
2532case RATE_PER_RCPT:
fe0dab11 2533 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2534 break;
2535default:
3399bb60 2536 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2537 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2538 "internal ACL error: unknown ratelimit mode %d", mode);
2539 break;
2540}
870f6ba8 2541
c99ce5c9
TF		 2542t = tree_search(*anchor, key);
2543if (t != NULL)
870f6ba8
TF		 2544 {
2545 dbd = t->data.ptr;
2546 /* The following few lines duplicate some of the code below. */
8f240103 2547 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2548 store_pool = old_pool;
2549 sender_rate = string_sprintf("%.1f", dbd->rate);
2550 HDEBUG(D_acl)
2551 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2552 return rc;
2553 }
2554
c99ce5c9
TF		 2555/* We aren't using a pre-computed rate, so get a previously recorded rate
2556from the database, which will be updated and written back if required. */
870f6ba8
TF		 2557
2558dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2559if (dbm == NULL)
2560 {
2561 store_pool = old_pool;
2562 sender_rate = NULL;
2563 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2564 *log_msgptr = US"ratelimit database not available";
2565 return DEFER;
2566 }
c99ce5c9
TF		 2567dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2568dbd = NULL;
870f6ba8
TF		 2569
2570gettimeofday(&tv, NULL);
2571
c99ce5c9
TF		 2572if (dbdb != NULL)
2573 {
2574 /* Locate the basic ratelimit block inside the DB data. */
2575 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2576 dbd = &dbdb->dbd;
2577
2578 /* Forget the old Bloom filter if it is too old, so that we count each
2579 repeating event once per period. We don't simply clear and re-use the old
2580 filter because we want its size to change if the limit changes. Note that
2581 we keep the dbd pointer for copying the rate into the new data block. */
2582
2583 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2584 {
2585 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2586 dbdb = NULL;
2587 }
2588
2589 /* Sanity check. */
2590
2591 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2592 {
2593 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2594 dbdb = NULL;
2595 }
2596 }
2597
2598/* Allocate a new data block if the database lookup failed
2599or the Bloom filter passed its age limit. */
2600
2601if (dbdb == NULL)
2602 {
2603 if (unique == NULL)
2604 {
2605 /* No Bloom filter. This basic ratelimit block is initialized below. */
2606 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2607 dbdb_size = sizeof(*dbd);
2608 dbdb = store_get(dbdb_size);
2609 }
2610 else
2611 {
2612 int extra;
2613 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2614
2615 /* See the long comment below for an explanation of the magic number 2.
2616 The filter has a minimum size in case the rate limit is very small;
2617 this is determined by the definition of dbdata_ratelimit_unique. */
2618
2619 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2620 if (extra < 0) extra = 0;
2621 dbdb_size = sizeof(*dbdb) + extra;
2622 dbdb = store_get(dbdb_size);
2623 dbdb->bloom_epoch = tv.tv_sec;
2624 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2625 memset(dbdb->bloom, 0, dbdb->bloom_size);
2626
2627 /* Preserve any basic ratelimit data (which is our longer-term memory)
2628 by copying it from the discarded block. */
2629
2630 if (dbd != NULL)
2631 {
2632 dbdb->dbd = *dbd;
2633 dbd = &dbdb->dbd;
2634 }
2635 }
2636 }
2637
2638/* If we are counting unique events, find out if this event is new or not.
2639If the client repeats the event during the current period then it should be
2640counted. We skip this code in readonly mode for efficiency, because any
2641changes to the filter will be discarded and because count is already set to
2642zero. */
2643
2644if (unique != NULL && !readonly)
2645 {
2646 /* We identify unique events using a Bloom filter. (You can find my
2647 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2648 With the per_addr option, an "event" is a recipient address, though the
2649 user can use the unique option to define their own events. We only count
2650 an event if we have not seen it before.
2651
2652 We size the filter according to the rate limit, which (in leaky mode)
2653 is the limit on the population of the filter. We allow 16 bits of space
2654 per entry (see the construction code above) and we set (up to) 8 of them
2655 when inserting an element (see the loop below). The probability of a false
2656 positive (an event we have not seen before but which we fail to count) is
2657
2658 size = limit * 16
2659 numhash = 8
2660 allzero = exp(-numhash * pop / size)
2661 = exp(-0.5 * pop / limit)
2662 fpr = pow(1 - allzero, numhash)
2663
2664 For senders at the limit the fpr is 0.06% or 1 in 1700
2665 and for senders at half the limit it is 0.0006% or 1 in 170000
2666
2667 In strict mode the Bloom filter can fill up beyond the normal limit, in
2668 which case the false positive rate will rise. This means that the
2669 measured rate for very fast senders can bogusly drop off after a while.
2670
2671 At twice the limit, the fpr is 2.5% or 1 in 40
2672 At four times the limit, it is 31% or 1 in 3.2
2673
2674 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2675 decay below the limit, and if this is more than one then the Bloom filter
2676 will be discarded before the decay gets that far. The false positive rate
2677 at this threshold is 9.3% or 1 in 10.7. */
2678
2679 BOOL seen;
2680 unsigned n, hash, hinc;
2681 uschar md5sum[16];
2682 md5 md5info;
2683
2684 /* Instead of using eight independent hash values, we combine two values
2685 using the formula h1 + n * h2. This does not harm the Bloom filter's
2686 performance, and means the amount of hash we need is independent of the
2687 number of bits we set in the filter. */
2688
2689 md5_start(&md5info);
2690 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2691 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2692 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2693
2694 /* Scan the bits corresponding to this event. A zero bit means we have
2695 not seen it before. Ensure all bits are set to record this event. */
2696
2697 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2698
2699 seen = TRUE;
2700 for (n = 0; n < 8; n++, hash += hinc)
2701 {
2702 int bit = 1 << (hash % 8);
2703 int byte = (hash / 8) % dbdb->bloom_size;
2704 if ((dbdb->bloom[byte] & bit) == 0)
2705 {
2706 dbdb->bloom[byte] |= bit;
2707 seen = FALSE;
2708 }
2709 }
2710
2711 /* If this event has occurred before, do not count it. */
2712
2713 if (seen)
2714 {
2715 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2716 count = 0.0;
2717 }
2718 else
2719 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2720 }
2721
2722/* If there was no previous ratelimit data block for this key, initialize
2723the new one, otherwise update the block from the database. The initial rate
2724is what would be computed by the code below for an infinite interval. */
2725
870f6ba8
TF		 2726if (dbd == NULL)
2727 {
c99ce5c9
TF		 2728 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2729 dbd = &dbdb->dbd;
870f6ba8
TF		 2730 dbd->time_stamp = tv.tv_sec;
2731 dbd->time_usec = tv.tv_usec;
c99ce5c9 2732 dbd->rate = count;
870f6ba8
TF		 2733 }
2734else
2735 {
2736 /* The smoothed rate is computed using an exponentially weighted moving
2737 average adjusted for variable sampling intervals. The standard EWMA for
2738 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2739 where f() is the measured value and f'() is the smoothed value.
2740
2741 Old data decays out of the smoothed value exponentially, such that data n
2742 samples old is multiplied by a^n. The exponential decay time constant p
2743 is defined such that data p samples old is multiplied by 1/e, which means
2744 that a = exp(-1/p). We can maintain the same time constant for a variable
2745 sampling interval i by using a = exp(-i/p).
2746
2747 The rate we are measuring is messages per period, suitable for directly
2748 comparing with the limit. The average rate between now and the previous
2749 message is period / interval, which we feed into the EWMA as the sample.
2750
2751 It turns out that the number of messages required for the smoothed rate
2752 to reach the limit when they are sent in a burst is equal to the limit.
2753 This can be seen by analysing the value of the smoothed rate after N
2754 messages sent at even intervals. Let k = (1 - a) * p/i
2755
2756 rate_1 = (1 - a) * p/i + a * rate_0
2757 = k + a * rate_0
2758 rate_2 = k + a * rate_1
2759 = k + a * k + a^2 * rate_0
2760 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2761 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2762 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2763 = rate_0 * a^N + p/i * (1 - a^N)
2764
2765 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2766
2767 rate_N = p/i + (rate_0 - p/i) * a^N
2768 a^N = (rate_N - p/i) / (rate_0 - p/i)
2769 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2770 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2771
2772 Numerical analysis of the above equation, setting the computed rate to
2773 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2774 rates, p/i, the number of messages N = limit. So limit serves as both the
2775 maximum rate measured in messages per period, and the maximum number of
2776 messages that can be sent in a fast burst. */
2777
2778 double this_time = (double)tv.tv_sec
2779 + (double)tv.tv_usec / 1000000.0;
2780 double prev_time = (double)dbd->time_stamp
2781 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2782
2783 /* We must avoid division by zero, and deal gracefully with the clock going
2784 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2785 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2786
e5d5a95f
TF		 2787 double interval = this_time - prev_time <= 0.0 ? 1e-9
2788 : this_time - prev_time;
2789
2790 double i_over_p = interval / period;
2791 double a = exp(-i_over_p);
870f6ba8 2792
c99ce5c9
TF		 2793 /* Combine the instantaneous rate (period / interval) with the previous rate
2794 using the smoothing factor a. In order to measure sized events, multiply the
2795 instantaneous rate by the count of bytes or recipients etc. */
2796
870f6ba8
TF		 2797 dbd->time_stamp = tv.tv_sec;
2798 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2799 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2800
2801 /* When events are very widely spaced the computed rate tends towards zero.
2802 Although this is accurate it turns out not to be useful for our purposes,
2803 especially when the first event after a long silence is the start of a spam
2804 run. A more useful model is that the rate for an isolated event should be the
2805 size of the event per the period size, ignoring the lack of events outside
2806 the current period and regardless of where the event falls in the period. So,
2807 if the interval was so long that the calculated rate is unhelpfully small, we
2808 re-intialize the rate. In the absence of higher-rate bursts, the condition
2809 below is true if the interval is greater than the period. */
2810
2811 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2812 }
2813
c99ce5c9
TF		 2814/* Clients sending at the limit are considered to be over the limit.
2815This matters for edge cases such as a limit of zero, when the client
2816should be completely blocked. */
3348576f 2817
8f240103 2818rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2819
2820/* Update the state if the rate is low or if we are being strict. If we
2821are in leaky mode and the sender's rate is too high, we do not update
2822the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2823rate preventing them from getting any email through. If readonly is set,
2824neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2825
c99ce5c9 2826if ((rc == FAIL && leaky) || strict)
8f240103 2827 {
c99ce5c9 2828 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2829 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2830 }
2831else
2832 {
2833 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2834 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2835 }
2836
870f6ba8
TF		 2837dbfn_close(dbm);
2838
c99ce5c9 2839/* Store the result in the tree for future reference. */
870f6ba8 2840
c99ce5c9
TF		 2841t = store_get(sizeof(tree_node) + Ustrlen(key));
2842t->data.ptr = dbd;
2843Ustrcpy(t->name, key);
2844(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2845
2846/* We create the formatted version of the sender's rate very late in
2847order to ensure that it is done using the correct storage pool. */
2848
2849store_pool = old_pool;
2850sender_rate = string_sprintf("%.1f", dbd->rate);
2851
2852HDEBUG(D_acl)
2853 debug_printf("ratelimit computed rate %s\n", sender_rate);
2854
2855return rc;
2856}
2857
2858
2859
b0019c78
TF		 2860/*************************************************
2861* The udpsend ACL modifier *
2862*************************************************/
2863
2864/* Called by acl_check_condition() below.
2865
2866Arguments:
2867 arg the option string for udpsend=
2868 log_msgptr for error messages
2869
2870Returns: OK - Completed.
2871 DEFER - Problem with DNS lookup.
2872 ERROR - Syntax error in options.
2873*/
2874
2875static int
55414b25 2876acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2877{
2878int sep = 0;
2879uschar *hostname;
2880uschar *portstr;
2881uschar *portend;
2882host_item *h;
2883int portnum;
b0019c78
TF		 2884int len;
2885int r, s;
b1f8e4f8 2886uschar * errstr;
b0019c78
TF		 2887
2888hostname = string_nextinlist(&arg, &sep, NULL, 0);
2889portstr = string_nextinlist(&arg, &sep, NULL, 0);
2890
2891if (hostname == NULL)
2892 {
217b0e56 2893 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2894 return ERROR;
2895 }
2896if (portstr == NULL)
2897 {
217b0e56 2898 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2899 return ERROR;
2900 }
2901if (arg == NULL)
2902 {
217b0e56 2903 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2904 return ERROR;
2905 }
2906portnum = Ustrtol(portstr, &portend, 10);
2907if (*portend != '\0')
2908 {
217b0e56 2909 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2910 return ERROR;
2911 }
2912
2913/* Make a single-item host list. */
2914h = store_get(sizeof(host_item));
2915memset(h, 0, sizeof(host_item));
2916h->name = hostname;
2917h->port = portnum;
2918h->mx = MX_NONE;
2919
2920if (string_is_ip_address(hostname, NULL))
2921 h->address = hostname, r = HOST_FOUND;
2922else
2923 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2924if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2925 {
217b0e56 2926 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2927 return DEFER;
2928 }
2929
2930HDEBUG(D_acl)
2931 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2932
b1f8e4f8
JH		 2933r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2934 1, NULL, &errstr);
b0019c78 2935if (r < 0) goto defer;
27f9999e 2936len = Ustrlen(arg);
9cb1785a 2937r = send(s, arg, len, 0);
b1f8e4f8
JH		 2938if (r < 0)
2939 {
2940 errstr = US strerror(errno);
2941 close(s);
2942 goto defer;
2943 }
2944close(s);
b0019c78
TF		 2945if (r < len)
2946 {
2947 *log_msgptr =
2948 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2949 return DEFER;
2950 }
2951
2952HDEBUG(D_acl)
2953 debug_printf("udpsend %d bytes\n", r);
2954
2955return OK;
2956
2957defer:
b1f8e4f8 2958*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2959return DEFER;
2960}
2961
2962
2963
059ec3d9
PH		 2964/*************************************************
2965* Handle conditions/modifiers on an ACL item *
2966*************************************************/
2967
2968/* Called from acl_check() below.
2969
2970Arguments:
2971 verb ACL verb
2972 cb ACL condition block - if NULL, result is OK
2973 where where called from
2974 addr the address being checked for RCPT, or NULL
2975 level the nesting level
2976 epp pointer to pass back TRUE if "endpass" encountered
2977 (applies only to "accept" and "discard")
2978 user_msgptr user message pointer
2979 log_msgptr log message pointer
2980 basic_errno pointer to where to put verify error
2981
2982Returns: OK - all conditions are met
2983 DISCARD - an "acl" condition returned DISCARD - only allowed
2984 for "accept" or "discard" verbs
2985 FAIL - at least one condition fails
2986 FAIL_DROP - an "acl" condition returned FAIL_DROP
2987 DEFER - can't tell at the moment (typically, lookup defer,
2988 but can be temporary callout problem)
2989 ERROR - ERROR from nested ACL or expansion failure or other
2990 error
2991*/
2992
2993static int
2994acl_check_condition(int verb, acl_condition_block *cb, int where,
2995 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2996 uschar **log_msgptr, int *basic_errno)
2997{
2998uschar *user_message = NULL;
2999uschar *log_message = NULL;
ed7f7860
PP		 3000uschar *debug_tag = NULL;
3001uschar *debug_opts = NULL;
059ec3d9 3002int rc = OK;
8523533c 3003#ifdef WITH_CONTENT_SCAN
0f0c8159 3004int sep = -'/';
8523533c 3005#endif
059ec3d9
PH		 3006
3007for (; cb != NULL; cb = cb->next)
3008 {
55414b25 3009 const uschar *arg;
8e669ac1 3010 int control_type;
059ec3d9
PH		 3011
3012 /* The message and log_message items set up messages to be used in
3013 case of rejection. They are expanded later. */
3014
3015 if (cb->type == ACLC_MESSAGE)
3016 {
187bc588 3017 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3018 user_message = cb->arg;
3019 continue;
3020 }
3021
3022 if (cb->type == ACLC_LOG_MESSAGE)
3023 {
187bc588 3024 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3025 log_message = cb->arg;
3026 continue;
3027 }
3028
3029 /* The endpass "condition" just sets a flag to show it occurred. This is
3030 checked at compile time to be on an "accept" or "discard" item. */
3031
3032 if (cb->type == ACLC_ENDPASS)
3033 {
3034 *epp = TRUE;
3035 continue;
3036 }
3037
3038 /* For other conditions and modifiers, the argument is expanded now for some
3039 of them, but not for all, because expansion happens down in some lower level
3040 checking functions in some cases. */
3041
3042 if (cond_expand_at_top[cb->type])
3043 {
3044 arg = expand_string(cb->arg);
3045 if (arg == NULL)
3046 {
3047 if (expand_string_forcedfail) continue;
3048 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3049 cb->arg, expand_string_message);
3050 return search_find_defer? DEFER : ERROR;
3051 }
3052 }
3053 else arg = cb->arg;
3054
3055 /* Show condition, and expanded condition if it's different */
3056
3057 HDEBUG(D_acl)
3058 {
3059 int lhswidth = 0;
3060 debug_printf("check %s%s %n",
3061 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3062 conditions[cb->type], &lhswidth);
3063
3064 if (cb->type == ACLC_SET)
3065 {
38a0a95f
PH		 3066 debug_printf("acl_%s ", cb->u.varname);
3067 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3068 }
3069
3070 debug_printf("= %s\n", cb->arg);
3071
3072 if (arg != cb->arg)
3073 debug_printf("%.*s= %s\n", lhswidth,
3074 US" ", CS arg);
3075 }
3076
3077 /* Check that this condition makes sense at this time */
3078
3079 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3080 {
3081 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3082 cond_modifiers[cb->type]? "use" : "test",
3083 conditions[cb->type], acl_wherenames[where]);
3084 return ERROR;
3085 }
3086
3087 /* Run the appropriate test for each condition, or take the appropriate
3088 action for the remaining modifiers. */
3089
3090 switch(cb->type)
3091 {
71fafd95
PH		 3092 case ACLC_ADD_HEADER:
3093 setup_header(arg);
3094 break;
3095
059ec3d9
PH		 3096 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3097 "discard" verb. */
71fafd95 3098
059ec3d9 3099 case ACLC_ACL:
f60d98e8 3100 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3101 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3102 {
3103 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3104 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3105 verbs[verb]);
3106 return ERROR;
3107 }
059ec3d9
PH		 3108 break;
3109
3110 case ACLC_AUTHENTICATED:
3111 rc = (sender_host_authenticated == NULL)? FAIL :
3112 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3113 TRUE, NULL);
3114 break;
3115
71fafd95 3116 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3117 case ACLC_BMI_OPTIN:
3118 {
3119 int old_pool = store_pool;
3120 store_pool = POOL_PERM;
3121 bmi_current_optin = string_copy(arg);
3122 store_pool = old_pool;
3123 }
3124 break;
71fafd95 3125 #endif
8523533c 3126
059ec3d9 3127 case ACLC_CONDITION:
f3766eb5
NM		 3128 /* The true/false parsing here should be kept in sync with that used in
3129 expand.c when dealing with ECOND_BOOL so that we don't have too many
3130 different definitions of what can be a boolean. */
51c7471d
JH		 3131 if (*arg == '-'
3132 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3133 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3134 rc = (Uatoi(arg) == 0)? FAIL : OK;
3135 else
3136 rc = (strcmpic(arg, US"no") == 0 ||
3137 strcmpic(arg, US"false") == 0)? FAIL :
3138 (strcmpic(arg, US"yes") == 0 ||
3139 strcmpic(arg, US"true") == 0)? OK : DEFER;
3140 if (rc == DEFER)
3141 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3142 break;
3143
c3611384
PH		 3144 case ACLC_CONTINUE: /* Always succeeds */
3145 break;
3146
059ec3d9 3147 case ACLC_CONTROL:
c5fcb476 3148 {
55414b25
JH		 3149 const uschar *p = NULL;
3150 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3151
55414b25 3152 /* Check if this control makes sense at this time */
f7572e5a 3153
55414b25
JH		 3154 if ((control_forbids[control_type] & (1 << where)) != 0)
3155 {
3156 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3157 controls[control_type], acl_wherenames[where]);
3158 return ERROR;
3159 }
8800895a 3160
55414b25
JH		 3161 switch(control_type)
3162 {
3163 case CONTROL_AUTH_UNADVERTISED:
3164 allow_auth_unadvertised = TRUE;
3165 break;
3166
3167 #ifdef EXPERIMENTAL_BRIGHTMAIL
3168 case CONTROL_BMI_RUN:
3169 bmi_run = 1;
3170 break;
3171 #endif
3172
3173 #ifndef DISABLE_DKIM
3174 case CONTROL_DKIM_VERIFY:
3175 dkim_disable_verify = TRUE;
3176 #ifdef EXPERIMENTAL_DMARC
3177 /* Since DKIM was blocked, skip DMARC too */
3178 dmarc_disable_verify = TRUE;
3179 dmarc_enable_forensic = FALSE;
3180 #endif
3181 break;
3182 #endif
3183
3184 #ifdef EXPERIMENTAL_DMARC
3185 case CONTROL_DMARC_VERIFY:
3186 dmarc_disable_verify = TRUE;
3187 break;
3188
3189 case CONTROL_DMARC_FORENSIC:
3190 dmarc_enable_forensic = TRUE;
3191 break;
3192 #endif
3193
3194 case CONTROL_DSCP:
3195 if (*p == '/')
3196 {
3197 int fd, af, level, optname, value;
3198 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3199 a socket; we can accept that, we'll just debug-log failures anyway. */
3200 fd = fileno(smtp_in);
3201 af = ip_get_address_family(fd);
3202 if (af < 0)
3203 {
3204 HDEBUG(D_acl)
3205 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3206 strerror(errno));
3207 break;
3208 }
3209 if (dscp_lookup(p+1, af, &level, &optname, &value))
3210 {
3211 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3212 {
3213 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3214 p+1, strerror(errno));
3215 }
3216 else
3217 {
3218 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3219 }
3220 }
3221 else
3222 {
3223 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3224 return ERROR;
3225 }
3226 }
3227 else
3228 {
3229 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3230 return ERROR;
3231 }
3232 break;
3233
3234 case CONTROL_ERROR:
3235 return ERROR;
3236
3237 case CONTROL_CASEFUL_LOCAL_PART:
3238 deliver_localpart = addr->cc_local_part;
3239 break;
3240
3241 case CONTROL_CASELOWER_LOCAL_PART:
3242 deliver_localpart = addr->lc_local_part;
3243 break;
3244
3245 case CONTROL_ENFORCE_SYNC:
3246 smtp_enforce_sync = TRUE;
3247 break;
3248
3249 case CONTROL_NO_ENFORCE_SYNC:
3250 smtp_enforce_sync = FALSE;
3251 break;
3252
3253 #ifdef WITH_CONTENT_SCAN
3254 case CONTROL_NO_MBOX_UNSPOOL:
3255 no_mbox_unspool = TRUE;
3256 break;
3257 #endif
3258
3259 case CONTROL_NO_MULTILINE:
3260 no_multiline_responses = TRUE;
3261 break;
3262
3263 case CONTROL_NO_PIPELINING:
3264 pipelining_enable = FALSE;
3265 break;
3266
3267 case CONTROL_NO_DELAY_FLUSH:
3268 disable_delay_flush = TRUE;
3269 break;
3270
3271 case CONTROL_NO_CALLOUT_FLUSH:
3272 disable_callout_flush = TRUE;
3273 break;
3274
3275 case CONTROL_FAKEREJECT:
3276 cancel_cutthrough_connection("fakereject");
3277 case CONTROL_FAKEDEFER:
3278 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3279 if (*p == '/')
3280 {
3281 const uschar *pp = p + 1;
3282 while (*pp != 0) pp++;
3283 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3284 p = pp;
3285 }
3286 else
3287 {
3288 /* Explicitly reset to default string */
3289 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3290 }
3291 break;
ed7f7860 3292
55414b25
JH		 3293 case CONTROL_FREEZE:
3294 deliver_freeze = TRUE;
3295 deliver_frozen_at = time(NULL);
3296 freeze_tell = freeze_tell_config; /* Reset to configured value */
3297 if (Ustrncmp(p, "/no_tell", 8) == 0)
3298 {
3299 p += 8;
3300 freeze_tell = NULL;
3301 }
3302 if (*p != 0)
3303 {
3304 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3305 return ERROR;
3306 }
3307 cancel_cutthrough_connection("item frozen");
3308 break;
3309
3310 case CONTROL_QUEUE_ONLY:
3311 queue_only_policy = TRUE;
3312 cancel_cutthrough_connection("queueing forced");
3313 break;
3314
3315 case CONTROL_SUBMISSION:
3316 originator_name = US"";
3317 submission_mode = TRUE;
3318 while (*p == '/')
3319 {
3320 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3321 {
3322 p += 14;
3323 active_local_sender_retain = TRUE;
3324 active_local_from_check = FALSE;
3325 }
3326 else if (Ustrncmp(p, "/domain=", 8) == 0)
3327 {
3328 const uschar *pp = p + 8;
3329 while (*pp != 0 && *pp != '/') pp++;
3330 submission_domain = string_copyn(p+8, pp-p-8);
3331 p = pp;
3332 }
3333 /* The name= option must be last, because it swallows the rest of
3334 the string. */
3335 else if (Ustrncmp(p, "/name=", 6) == 0)
3336 {
3337 const uschar *pp = p + 6;
3338 while (*pp != 0) pp++;
3339 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3340 big_buffer, big_buffer_size));
3341 p = pp;
3342 }
3343 else break;
3344 }
3345 if (*p != 0)
3346 {
3347 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3348 return ERROR;
3349 }
3350 break;
e4bdf652 3351
55414b25
JH		 3352 case CONTROL_DEBUG:
3353 while (*p == '/')
3354 {
3355 if (Ustrncmp(p, "/tag=", 5) == 0)
3356 {
3357 const uschar *pp = p + 5;
3358 while (*pp != '\0' && *pp != '/') pp++;
3359 debug_tag = string_copyn(p+5, pp-p-5);
3360 p = pp;
3361 }
3362 else if (Ustrncmp(p, "/opts=", 6) == 0)
3363 {
3364 const uschar *pp = p + 6;
3365 while (*pp != '\0' && *pp != '/') pp++;
3366 debug_opts = string_copyn(p+6, pp-p-6);
3367 p = pp;
3368 }
3369 }
3370 debug_logging_activate(debug_tag, debug_opts);
3371 break;
3372
3373 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3374 suppress_local_fixups = TRUE;
3375 break;
3376
3377 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3378#ifndef DISABLE_PRDR
55414b25 3379 if (prdr_requested)
a2b89db1
PP		 3380#else
3381 if (0)
3382#endif
55414b25
JH		 3383 /* Too hard to think about for now. We might in future cutthrough
3384 the case where both sides handle prdr and this-node prdr acl
3385 is "accept" */
93a6fce2 3386 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3387 else
3388 {
55414b25
JH		 3389 if (deliver_freeze)
3390 *log_msgptr = US"frozen";
3391 else if (queue_only_policy)
3392 *log_msgptr = US"queue-only";
3393 else if (fake_response == FAIL)
3394 *log_msgptr = US"fakereject";
3395 else
3396 {
3397 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3398 break;
3399 }
3400 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3401 arg, *log_msgptr);
5032d1cf 3402 }
55414b25 3403 return ERROR;
3c8b3577 3404
8c5d388a 3405#ifdef SUPPORT_I18N
3c8b3577
JH		 3406 case CONTROL_UTF8_DOWNCONVERT:
3407 if (*p == '/')
3408 {
921dfc11
JH		 3409 if (p[1] == '1')
3410 {
3411 message_utf8_downconvert = 1;
3412 addr->prop.utf8_downcvt = TRUE;
3413 addr->prop.utf8_downcvt_maybe = FALSE;
3414 p += 2;
3415 break;
3416 }
3417 if (p[1] == '0')
3418 {
3419 message_utf8_downconvert = 0;
3420 addr->prop.utf8_downcvt = FALSE;
3421 addr->prop.utf8_downcvt_maybe = FALSE;
3422 p += 2;
3423 break;
3424 }
3c8b3577 3425 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3426 {
3427 message_utf8_downconvert = -1;
3428 addr->prop.utf8_downcvt = FALSE;
3429 addr->prop.utf8_downcvt_maybe = TRUE;
3430 p += 3;
3431 break;
3432 }
3c8b3577
JH		 3433 *log_msgptr = US"bad option value for control=utf8_downconvert";
3434 }
3435 else
3436 {
921dfc11
JH		 3437 message_utf8_downconvert = 1;
3438 addr->prop.utf8_downcvt = TRUE;
3439 addr->prop.utf8_downcvt_maybe = FALSE;
3440 break;
3c8b3577
JH		 3441 }
3442 return ERROR;
8c5d388a 3443#endif
3c8b3577 3444
9171d434 3445 }
55414b25 3446 break;
059ec3d9 3447 }
059ec3d9 3448
6a8f9482
TK		 3449 #ifdef EXPERIMENTAL_DCC
3450 case ACLC_DCC:
3451 {
3452 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3453 const uschar * list = arg;
3454 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3455 /* Run the dcc backend. */
3456 rc = dcc_process(&ss);
3457 /* Modify return code based upon the existance of options. */
3c8b3577 3458 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3459 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3460 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3461 }
3462 break;
3463 #endif
3464
71fafd95 3465 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3466 case ACLC_DECODE:
3467 rc = mime_decode(&arg);
3468 break;
71fafd95 3469 #endif
8523533c 3470
059ec3d9
PH		 3471 case ACLC_DELAY:
3472 {
3473 int delay = readconf_readtime(arg, 0, FALSE);
3474 if (delay < 0)
3475 {
3476 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3477 "modifier: \"%s\" is not a time value", arg);
3478 return ERROR;
3479 }
3480 else
3481 {
3482 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3483 delay);
3484 if (host_checking)
3485 {
3486 HDEBUG(D_acl)
3487 debug_printf("delay skipped in -bh checking mode\n");
3488 }
010c2d14 3489
ae9d18bc
JH		 3490 /* NOTE 1: Remember that we may be
3491 dealing with stdin/stdout here, in addition to TCP/IP connections.
3492 Also, delays may be specified for non-SMTP input, where smtp_out and
3493 smtp_in will be NULL. Whatever is done must work in all cases.
3494
3495 NOTE 2: The added feature of flushing the output before a delay must
3496 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3497 */
3498
3499 else
3500 {
3501 if (smtp_out != NULL && !disable_delay_flush)
3502 mac_smtp_fflush();
3503
861a7c51 3504#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3505 {
3506 struct pollfd p;
3507 nfds_t n = 0;
3508 if (smtp_out)
3509 {
3510 p.fd = fileno(smtp_out);
3511 p.events = POLLRDHUP;
3512 n = 1;
3513 }
3514 if (poll(&p, n, delay*1000) > 0)
3515 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3516 }
3517#else
010c2d14
PH		 3518 /* It appears to be impossible to detect that a TCP/IP connection has
3519 gone away without reading from it. This means that we cannot shorten
3520 the delay below if the client goes away, because we cannot discover
3521 that the client has closed its end of the connection. (The connection
3522 is actually in a half-closed state, waiting for the server to close its
3523 end.) It would be nice to be able to detect this state, so that the
3524 Exim process is not held up unnecessarily. However, it seems that we
3525 can't. The poll() function does not do the right thing, and in any case
3526 it is not always available.
047bdd8c 3527 */
010c2d14 3528
86b8287f 3529 while (delay > 0) delay = sleep(delay);
ae9d18bc 3530#endif
8e669ac1 3531 }
059ec3d9
PH		 3532 }
3533 }
3534 break;
3535
71fafd95 3536 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3537 case ACLC_DEMIME:
3538 rc = demime(&arg);
3539 break;
71fafd95 3540 #endif
8523533c 3541
80a47a2c
TK		 3542 #ifndef DISABLE_DKIM
3543 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3544 if (dkim_cur_signer != NULL)
3545 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3546 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3547 else
80a47a2c 3548 rc = FAIL;
71fafd95
PH		 3549 break;
3550
80a47a2c
TK		 3551 case ACLC_DKIM_STATUS:
3552 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3553 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3554 break;
3555 #endif
fb2274d4 3556
4840604e
TL		 3557 #ifdef EXPERIMENTAL_DMARC
3558 case ACLC_DMARC_STATUS:
4a8ce2d8 3559 if (!dmarc_has_been_checked)
4840604e 3560 dmarc_process();
4a8ce2d8 3561 dmarc_has_been_checked = TRUE;
4840604e
TL		 3562 /* used long way of dmarc_exim_expand_query() in case we need more
3563 * view into the process in the future. */
3564 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3565 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3566 break;
3567 #endif
3568
059ec3d9 3569 case ACLC_DNSLISTS:
379ba7d0 3570 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3571 break;
3572
3573 case ACLC_DOMAINS:
3574 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3575 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3576 break;
3577
3578 /* The value in tls_cipher is the full cipher name, for example,
3579 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3580 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3581 what may in practice come out of the SSL library - which at the time of
3582 writing is poorly documented. */
3583
3584 case ACLC_ENCRYPTED:
817d9f57 3585 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3586 {
3587 uschar *endcipher = NULL;
817d9f57
JH		 3588 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3589 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3590 {
3591 endcipher = Ustrchr(++cipher, ':');
3592 if (endcipher != NULL) *endcipher = 0;
3593 }
3594 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3595 if (endcipher != NULL) *endcipher = ':';
3596 }
3597 break;
3598
3599 /* Use verify_check_this_host() instead of verify_check_host() so that
3600 we can pass over &host_data to catch any looked up data. Once it has been
3601 set, it retains its value so that it's still there if another ACL verb
3602 comes through here and uses the cache. However, we must put it into
3603 permanent store in case it is also expected to be used in a subsequent
3604 message in the same SMTP connection. */
3605
3606 case ACLC_HOSTS:
3607 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3608 (sender_host_address == NULL)? US"" : sender_host_address,
3609 CUSS &host_data);
4a452c43
JH		 3610 if (rc == DEFER) *log_msgptr = search_error_message;
3611 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3612 break;
3613
3614 case ACLC_LOCAL_PARTS:
3615 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3616 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3617 CUSS &deliver_localpart_data);
059ec3d9
PH		 3618 break;
3619
6ea85e9a
PH		 3620 case ACLC_LOG_REJECT_TARGET:
3621 {
3622 int logbits = 0;
3623 int sep = 0;
55414b25 3624 const uschar *s = arg;
6ea85e9a 3625 uschar *ss;
4a452c43 3626 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3627 {
3628 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3629 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3630 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3631 else
3632 {
3633 logbits |= LOG_MAIN|LOG_REJECT;
3634 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3635 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3636 }
3637 }
3638 log_reject_target = logbits;
3639 }
3640 break;
3641
059ec3d9
PH		 3642 case ACLC_LOGWRITE:
3643 {
3644 int logbits = 0;
55414b25 3645 const uschar *s = arg;
059ec3d9
PH		 3646 if (*s == ':')
3647 {
3648 s++;
3649 while (*s != ':')
3650 {
3651 if (Ustrncmp(s, "main", 4) == 0)
3652 { logbits |= LOG_MAIN; s += 4; }
3653 else if (Ustrncmp(s, "panic", 5) == 0)
3654 { logbits |= LOG_PANIC; s += 5; }
3655 else if (Ustrncmp(s, "reject", 6) == 0)
3656 { logbits |= LOG_REJECT; s += 6; }
3657 else
3658 {
3659 logbits = LOG_MAIN|LOG_PANIC;
3660 s = string_sprintf(":unknown log name in \"%s\" in "
3661 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3662 }
3663 if (*s == ',') s++;
3664 }
3665 s++;
3666 }
3667 while (isspace(*s)) s++;
6ea85e9a
PH		 3668
3669
059ec3d9
PH		 3670 if (logbits == 0) logbits = LOG_MAIN;
3671 log_write(0, logbits, "%s", string_printing(s));
3672 }
3673 break;
8e669ac1 3674
71fafd95 3675 #ifdef WITH_CONTENT_SCAN
0f0c8159 3676 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3677 {
6ea85e9a 3678 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3679 const uschar * list = arg;
3680 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3681 uschar *opt;
3682 BOOL defer_ok = FALSE;
3683 int timeout = 0;
3684
55414b25 3685 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3686 if (strcmpic(opt, US"defer_ok") == 0)
3687 defer_ok = TRUE;
3688 else if ( strncmpic(opt, US"tmo=", 4) == 0
3689 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3690 )
3691 {
3692 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3693 return ERROR;
3694 }
3695
3696 rc = malware(ss, timeout);
3697 if (rc == DEFER && defer_ok)
3698 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3699 }
3700 break;
3701
3702 case ACLC_MIME_REGEX:
71fafd95 3703 rc = mime_regex(&arg);
8523533c 3704 break;
71fafd95 3705 #endif
059ec3d9 3706
870f6ba8 3707 case ACLC_RATELIMIT:
90fc3069 3708 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3709 break;
3710
059ec3d9 3711 case ACLC_RECIPIENTS:
55414b25
JH		 3712 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3713 CUSS &recipient_data);
059ec3d9
PH		 3714 break;
3715
71fafd95
PH		 3716 #ifdef WITH_CONTENT_SCAN
3717 case ACLC_REGEX:
3718 rc = regex(&arg);
8523533c 3719 break;
71fafd95 3720 #endif
8523533c 3721
e7568d51
TL		 3722 case ACLC_REMOVE_HEADER:
3723 setup_remove_header(arg);
3724 break;
3725
059ec3d9
PH		 3726 case ACLC_SENDER_DOMAINS:
3727 {
3728 uschar *sdomain;
3729 sdomain = Ustrrchr(sender_address, '@');
3730 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3731 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3732 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3733 }
3734 break;
3735
3736 case ACLC_SENDERS:
55414b25
JH		 3737 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3738 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3739 break;
3740
3741 /* Connection variables must persist forever */
3742
3743 case ACLC_SET:
3744 {
3745 int old_pool = store_pool;
5ef5dd52 3746 if ( cb->u.varname[0] == 'c'
0cbf2b82 3747#ifndef DISABLE_EVENT
5ef5dd52
JB		 3748 || event_name /* An event is being delivered */
3749#endif
3750 )
3751 store_pool = POOL_PERM;
38a0a95f 3752 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3753 store_pool = old_pool;
3754 }
3755 break;
3756
71fafd95 3757 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3758 case ACLC_SPAM:
3759 {
3760 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3761 const uschar * list = arg;
3762 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3763 /* Run the spam backend. */
55414b25 3764 rc = spam(CUSS &ss);
8523533c 3765 /* Modify return code based upon the existance of options. */
55414b25 3766 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3767 != NULL) {
3768 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3769 {
3770 /* FAIL so that the message is passed to the next ACL */
3771 rc = FAIL;
3772 }
3773 }
3774 }
3775 break;
71fafd95 3776 #endif
8523533c 3777
71fafd95 3778 #ifdef EXPERIMENTAL_SPF
8523533c 3779 case ACLC_SPF:
65a7d8c3
NM		 3780 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3781 break;
3782 case ACLC_SPF_GUESS:
3783 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3784 break;
71fafd95 3785 #endif
8523533c 3786
b0019c78
TF		 3787 case ACLC_UDPSEND:
3788 rc = acl_udpsend(arg, log_msgptr);
3789 break;
3790
059ec3d9
PH		 3791 /* If the verb is WARN, discard any user message from verification, because
3792 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3793 only from explicit "message" modifiers. However, put the user message into
3794 $acl_verify_message so it can be used in subsequent conditions or modifiers
3795 (until something changes it). */
059ec3d9
PH		 3796
3797 case ACLC_VERIFY:
3798 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3799 if (*user_msgptr)
3800 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3801 if (verb == ACL_WARN) *user_msgptr = NULL;
3802 break;
3803
3804 default:
3805 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3806 "condition %d", cb->type);
3807 break;
3808 }
3809
3810 /* If a condition was negated, invert OK/FAIL. */
3811
3812 if (!cond_modifiers[cb->type] && cb->u.negated)
3813 {
3814 if (rc == OK) rc = FAIL;
3815 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3816 }
3817
3818 if (rc != OK) break; /* Conditions loop */
3819 }
3820
3821
3822/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3823handle the values of these modifiers. If there isn't a log message set, we make
3824it the same as the user message.
059ec3d9
PH		 3825
3826"message" is a user message that will be included in an SMTP response. Unless
3827it is empty, it overrides any previously set user message.
3828
3829"log_message" is a non-user message, and it adds to any existing non-user
3830message that is already set.
3831
4e88a19f
PH		 3832Most verbs have but a single return for which the messages are relevant, but
3833for "discard", it's useful to have the log message both when it succeeds and
3834when it fails. For "accept", the message is used in the OK case if there is no
3835"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3836present. */
059ec3d9 3837
4e88a19f
PH		 3838if (*epp && rc == OK) user_message = NULL;
3839
3840if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3841 {
3842 uschar *expmessage;
4e88a19f
PH		 3843 uschar *old_user_msgptr = *user_msgptr;
3844 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3845
3846 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3847 nested ACLs) are always discarded. This also happens for acceptance verbs
3848 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3849 However, the value of an existing message is available in $acl_verify_message
3850 during expansions. */
3851
4e88a19f
PH		 3852 if (verb == ACL_WARN ||
3853 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3854 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3855
3856 if (user_message != NULL)
3857 {
3858 acl_verify_message = old_user_msgptr;
3859 expmessage = expand_string(user_message);
3860 if (expmessage == NULL)
3861 {
3862 if (!expand_string_forcedfail)
3863 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3864 user_message, expand_string_message);
3865 }
3866 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3867 }
3868
3869 if (log_message != NULL)
3870 {
3871 acl_verify_message = old_log_msgptr;
3872 expmessage = expand_string(log_message);
3873 if (expmessage == NULL)
3874 {
3875 if (!expand_string_forcedfail)
3876 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3877 log_message, expand_string_message);
3878 }
3879 else if (expmessage[0] != 0)
3880 {
3881 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3882 string_sprintf("%s: %s", expmessage, *log_msgptr);
3883 }
3884 }
3885
3886 /* If no log message, default it to the user message */
3887
3888 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3889 }
3890
3891acl_verify_message = NULL;
3892return rc;
3893}
3894
3895
3896
3897
3898
3899/*************************************************
3900* Get line from a literal ACL *
3901*************************************************/
3902
3903/* This function is passed to acl_read() in order to extract individual lines
3904of a literal ACL, which we access via static pointers. We can destroy the
3905contents because this is called only once (the compiled ACL is remembered).
3906
3907This code is intended to treat the data in the same way as lines in the main
3908Exim configuration file. That is:
3909
3910 . Leading spaces are ignored.
3911
3912 . A \ at the end of a line is a continuation - trailing spaces after the \
3913 are permitted (this is because I don't believe in making invisible things
3914 significant). Leading spaces on the continued part of a line are ignored.
3915
3916 . Physical lines starting (significantly) with # are totally ignored, and
3917 may appear within a sequence of backslash-continued lines.
3918
3919 . Blank lines are ignored, but will end a sequence of continuations.
3920
3921Arguments: none
3922Returns: a pointer to the next line
3923*/
3924
3925
3926static uschar *acl_text; /* Current pointer in the text */
3927static uschar *acl_text_end; /* Points one past the terminating '0' */
3928
3929
3930static uschar *
3931acl_getline(void)
3932{
3933uschar *yield;
3934
3935/* This loop handles leading blank lines and comments. */
3936
3937for(;;)
3938 {
3939 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3940 if (*acl_text == 0) return NULL; /* No more data */
3941 yield = acl_text; /* Potential data line */
3942
3943 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3944
3945 /* If we hit the end before a newline, we have the whole logical line. If
3946 it's a comment, there's no more data to be given. Otherwise, yield it. */
3947
3948 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3949
3950 /* After reaching a newline, end this loop if the physical line does not
3951 start with '#'. If it does, it's a comment, and the loop continues. */
3952
3953 if (*yield != '#') break;
3954 }
3955
3956/* This loop handles continuations. We know we have some real data, ending in
3957newline. See if there is a continuation marker at the end (ignoring trailing
3958white space). We know that *yield is not white space, so no need to test for
3959cont > yield in the backwards scanning loop. */
3960
3961for(;;)
3962 {
3963 uschar *cont;
3964 for (cont = acl_text - 1; isspace(*cont); cont--);
3965
3966 /* If no continuation follows, we are done. Mark the end of the line and
3967 return it. */
3968
3969 if (*cont != '\\')
3970 {
3971 *acl_text++ = 0;
3972 return yield;
3973 }
3974
3975 /* We have encountered a continuation. Skip over whitespace at the start of
3976 the next line, and indeed the whole of the next line or lines if they are
3977 comment lines. */
3978
3979 for (;;)
3980 {
3981 while (*(++acl_text) == ' ' || *acl_text == '\t');
3982 if (*acl_text != '#') break;
3983 while (*(++acl_text) != 0 && *acl_text != '\n');
3984 }
3985
3986 /* We have the start of a continuation line. Move all the rest of the data
3987 to join onto the previous line, and then find its end. If the end is not a
3988 newline, we are done. Otherwise loop to look for another continuation. */
3989
3990 memmove(cont, acl_text, acl_text_end - acl_text);
3991 acl_text_end -= acl_text - cont;
3992 acl_text = cont;
3993 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3994 if (*acl_text == 0) return yield;
3995 }
3996
3997/* Control does not reach here */
3998}
3999
4000
4001
4002
4003
4004/*************************************************
4005* Check access using an ACL *
4006*************************************************/
4007
4008/* This function is called from address_check. It may recurse via
4009acl_check_condition() - hence the use of a level to stop looping. The ACL is
4010passed as a string which is expanded. A forced failure implies no access check
4011is required. If the result is a single word, it is taken as the name of an ACL
4012which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4013text, complete with newlines, and parsed as such. In both cases, the ACL check
4014is then run. This function uses an auxiliary function for acl_read() to call
4015for reading individual lines of a literal ACL. This is acl_getline(), which
4016appears immediately above.
4017
4018Arguments:
4019 where where called from
4020 addr address item when called from RCPT; otherwise NULL
4021 s the input string; NULL is the same as an empty ACL => DENY
4022 level the nesting level
4023 user_msgptr where to put a user error (for SMTP response)
4024 log_msgptr where to put a logging message (not for SMTP response)
4025
4026Returns: OK access is granted
4027 DISCARD access is apparently granted...
4028 FAIL access is denied
4029 FAIL_DROP access is denied; drop the connection
4030 DEFER can't tell at the moment
4031 ERROR disaster
4032*/
4033
4034static int
4035acl_check_internal(int where, address_item *addr, uschar *s, int level,
4036 uschar **user_msgptr, uschar **log_msgptr)
4037{
4038int fd = -1;
4039acl_block *acl = NULL;
4040uschar *acl_name = US"inline ACL";
4041uschar *ss;
4042
4043/* Catch configuration loops */
4044
4045if (level > 20)
4046 {
4047 *log_msgptr = US"ACL nested too deep: possible loop";
4048 return ERROR;
4049 }
4050
4051if (s == NULL)
4052 {
4053 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4054 return FAIL;
4055 }
4056
4057/* At top level, we expand the incoming string. At lower levels, it has already
4058been expanded as part of condition processing. */
4059
4060if (level == 0)
4061 {
4062 ss = expand_string(s);
4063 if (ss == NULL)
4064 {
4065 if (expand_string_forcedfail) return OK;
4066 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4067 expand_string_message);
4068 return ERROR;
4069 }
4070 }
4071else ss = s;
4072
4073while (isspace(*ss))ss++;
4074
4075/* If we can't find a named ACL, the default is to parse it as an inline one.
4076(Unless it begins with a slash; non-existent files give rise to an error.) */
4077
4078acl_text = ss;
4079
4080/* Handle the case of a string that does not contain any spaces. Look for a
4081named ACL among those read from the configuration, or a previously read file.
4082It is possible that the pointer to the ACL is NULL if the configuration
4083contains a name with no data. If not found, and the text begins with '/',
4084read an ACL from a file, and save it so it can be re-used. */
4085
4086if (Ustrchr(ss, ' ') == NULL)
4087 {
4088 tree_node *t = tree_search(acl_anchor, ss);
4089 if (t != NULL)
4090 {
4091 acl = (acl_block *)(t->data.ptr);
4092 if (acl == NULL)
4093 {
4094 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4095 return FAIL;
4096 }
4097 acl_name = string_sprintf("ACL \"%s\"", ss);
4098 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4099 }
4100
4101 else if (*ss == '/')
4102 {
4103 struct stat statbuf;
4104 fd = Uopen(ss, O_RDONLY, 0);
4105 if (fd < 0)
4106 {
4107 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4108 strerror(errno));
4109 return ERROR;
4110 }
4111
4112 if (fstat(fd, &statbuf) != 0)
4113 {
4114 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4115 strerror(errno));
4116 return ERROR;
4117 }
4118
4119 acl_text = store_get(statbuf.st_size + 1);
4120 acl_text_end = acl_text + statbuf.st_size + 1;
4121
4122 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4123 {
4124 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4125 ss, strerror(errno));
4126 return ERROR;
4127 }
4128 acl_text[statbuf.st_size] = 0;
f1e894f3 4129 (void)close(fd);
059ec3d9
PH		 4130
4131 acl_name = string_sprintf("ACL \"%s\"", ss);
4132 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4133 }
4134 }
4135
4136/* Parse an ACL that is still in text form. If it came from a file, remember it
4137in the ACL tree, having read it into the POOL_PERM store pool so that it
4138persists between multiple messages. */
4139
4140if (acl == NULL)
4141 {
4142 int old_pool = store_pool;
4143 if (fd >= 0) store_pool = POOL_PERM;
4144 acl = acl_read(acl_getline, log_msgptr);
4145 store_pool = old_pool;
4146 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4147 if (fd >= 0)
4148 {
4149 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4150 Ustrcpy(t->name, ss);
4151 t->data.ptr = acl;
4152 (void)tree_insertnode(&acl_anchor, t);
4153 }
4154 }
4155
4156/* Now we have an ACL to use. It's possible it may be NULL. */
4157
4158while (acl != NULL)
4159 {
4160 int cond;
4161 int basic_errno = 0;
4162 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4163 BOOL acl_quit_check = level == 0
4164 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4165
4166 *log_msgptr = *user_msgptr = NULL;
4167 acl_temp_details = FALSE;
4168
059ec3d9
PH		 4169 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4170
4171 /* Clear out any search error message from a previous check before testing
4172 this condition. */
4173
4174 search_error_message = NULL;
4175 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4176 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4177
4178 /* Handle special returns: DEFER causes a return except on a WARN verb;
4179 ERROR always causes a return. */
4180
4181 switch (cond)
4182 {
4183 case DEFER:
6968512f 4184 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4185 if (basic_errno != ERRNO_CALLOUTDEFER)
4186 {
4187 if (search_error_message != NULL && *search_error_message != 0)
4188 *log_msgptr = search_error_message;
4189 if (smtp_return_error_details) acl_temp_details = TRUE;
4190 }
4191 else
4192 {
4193 acl_temp_details = TRUE;
4194 }
4195 if (acl->verb != ACL_WARN) return DEFER;
4196 break;
4197
4198 default: /* Paranoia */
4199 case ERROR:
6968512f 4200 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4201 return ERROR;
4202
4203 case OK:
6968512f
JH		 4204 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4205 verbs[acl->verb], acl_name);
059ec3d9
PH		 4206 break;
4207
4208 case FAIL:
6968512f 4209 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4210 break;
4211
4212 /* DISCARD and DROP can happen only from a nested ACL condition, and
4213 DISCARD can happen only for an "accept" or "discard" verb. */
4214
4215 case DISCARD:
6968512f
JH		 4216 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4217 verbs[acl->verb], acl_name);
059ec3d9
PH		 4218 break;
4219
4220 case FAIL_DROP:
6968512f
JH		 4221 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4222 verbs[acl->verb], acl_name);
059ec3d9
PH		 4223 break;
4224 }
4225
4226 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4227 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4228 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4229
4230 switch(acl->verb)
4231 {
4232 case ACL_ACCEPT:
a7538db1
JH		 4233 if (cond == OK || cond == DISCARD)
4234 {
4235 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4236 return cond;
4237 }
059ec3d9
PH		 4238 if (endpass_seen)
4239 {
4240 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4241 return cond;
4242 }
4243 break;
4244
4245 case ACL_DEFER:
4246 if (cond == OK)
4247 {
a7538db1 4248 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4249 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4250 acl_temp_details = TRUE;
4251 return DEFER;
4252 }
4253 break;
4254
4255 case ACL_DENY:
a7538db1
JH		 4256 if (cond == OK)
4257 {
4258 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4259 if (acl_quit_check) goto badquit;
a7538db1
JH		 4260 return FAIL;
4261 }
059ec3d9
PH		 4262 break;
4263
4264 case ACL_DISCARD:
a7538db1
JH		 4265 if (cond == OK || cond == DISCARD)
4266 {
4267 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4268 if (acl_quit_check) goto badquit;
a7538db1
JH		 4269 return DISCARD;
4270 }
059ec3d9
PH		 4271 if (endpass_seen)
4272 {
4273 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4274 return cond;
4275 }
4276 break;
4277
4278 case ACL_DROP:
a7538db1
JH		 4279 if (cond == OK)
4280 {
4281 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4282 if (acl_quit_check) goto badquit;
a7538db1
JH		 4283 return FAIL_DROP;
4284 }
059ec3d9
PH		 4285 break;
4286
4287 case ACL_REQUIRE:
a7538db1
JH		 4288 if (cond != OK)
4289 {
4290 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4291 if (acl_quit_check) goto badquit;
a7538db1
JH		 4292 return cond;
4293 }
059ec3d9
PH		 4294 break;
4295
4296 case ACL_WARN:
4297 if (cond == OK)
4298 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4299 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4300 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4301 "condition test deferred%s%s", host_and_ident(TRUE),
4302 (*log_msgptr == NULL)? US"" : US": ",
4303 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4304 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4305 break;
4306
4307 default:
4308 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4309 acl->verb);
4310 break;
4311 }
4312
4313 /* Pass to the next ACL item */
4314
4315 acl = acl->next;
4316 }
4317
4318/* We have reached the end of the ACL. This is an implicit DENY. */
4319
4320HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4321return FAIL;
82c0c8ea
JH		 4322
4323badquit:
4324 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4325 "('%s' verb used incorrectly)", verbs[acl->verb]);
4326 return ERROR;
059ec3d9
PH		 4327}
4328
4329
333eea9c
JH		 4330
4331
4332/* Same args as acl_check_internal() above, but the string s is
4333the name of an ACL followed optionally by up to 9 space-separated arguments.
4334The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4335static int
55414b25 4336acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4337 uschar **user_msgptr, uschar **log_msgptr)
4338{
4339uschar * tmp;
bef3ea7f 4340uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4341uschar * sav_arg[9]; /* must match acl_arg[] */
4342int sav_narg;
333eea9c 4343uschar * name;
bef3ea7f 4344int i;
ef21c07d 4345int ret;
333eea9c
JH		 4346
4347if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4348 goto bad;
4349
bef3ea7f 4350for (i = 0; i < 9; i++)
333eea9c
JH		 4351 {
4352 while (*s && isspace(*s)) s++;
4353 if (!*s) break;
bef3ea7f 4354 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4355 {
4356 tmp = name;
4357 goto bad;
4358 }
4359 }
ef21c07d
JH		 4360
4361sav_narg = acl_narg;
bef3ea7f 4362acl_narg = i;
ef21c07d
JH		 4363for (i = 0; i < acl_narg; i++)
4364 {
4365 sav_arg[i] = acl_arg[i];
4366 acl_arg[i] = tmp_arg[i];
4367 }
4368while (i < 9)
4369 {
4370 sav_arg[i] = acl_arg[i];
4371 acl_arg[i++] = NULL;
4372 }
4373
4374ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4375
ef21c07d
JH		 4376acl_narg = sav_narg;
4377for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4378return ret;
333eea9c
JH		 4379
4380bad:
4381if (expand_string_forcedfail) return ERROR;
4382*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4383 tmp, expand_string_message);
4384return search_find_defer?DEFER:ERROR;
4385}
4386
4387
4388
059ec3d9
PH		 4389/*************************************************
4390* Check access using an ACL *
4391*************************************************/
4392
faa05a93
JH		 4393/* Alternate interface for ACL, used by expansions */
4394int
05caaeaa 4395acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4396{
faa05a93
JH		 4397address_item adb;
4398address_item *addr = NULL;
4399
4400*user_msgptr = *log_msgptr = NULL;
4401sender_verified_failed = NULL;
4402ratelimiters_cmd = NULL;
4403log_reject_target = LOG_MAIN|LOG_REJECT;
4404
4405if (where == ACL_WHERE_RCPT)
4406 {
4407 adb = address_defaults;
4408 addr = &adb;
05caaeaa
JH		 4409 addr->address = expand_string(US"$local_part@$domain");
4410 addr->domain = deliver_domain;
4411 addr->local_part = deliver_localpart;
4412 addr->cc_local_part = deliver_localpart;
4413 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4414 }
4415
4416return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4417}
4418
4419
4420
059ec3d9
PH		 4421/* This is the external interface for ACL checks. It sets up an address and the
4422expansions for $domain and $local_part when called after RCPT, then calls
4423acl_check_internal() to do the actual work.
4424
4425Arguments:
4426 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4427 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4428 s the input string; NULL is the same as an empty ACL => DENY
4429 user_msgptr where to put a user error (for SMTP response)
4430 log_msgptr where to put a logging message (not for SMTP response)
4431
4432Returns: OK access is granted by an ACCEPT verb
4433 DISCARD access is granted by a DISCARD verb
4434 FAIL access is denied
4435 FAIL_DROP access is denied; drop the connection
4436 DEFER can't tell at the moment
4437 ERROR disaster
4438*/
faa05a93 4439int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4440
4441int
64ffc24f 4442acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4443 uschar **log_msgptr)
4444{
4445int rc;
4446address_item adb;
64ffc24f 4447address_item *addr = NULL;
059ec3d9
PH		 4448
4449*user_msgptr = *log_msgptr = NULL;
4450sender_verified_failed = NULL;
fe0dab11 4451ratelimiters_cmd = NULL;
6ea85e9a 4452log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4453
8ccd00b1 4454#ifndef DISABLE_PRDR
4f6ae5c3 4455if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4456#else
4f6ae5c3 4457if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4458#endif
059ec3d9
PH		 4459 {
4460 adb = address_defaults;
4461 addr = &adb;
64ffc24f 4462 addr->address = recipient;
059ec3d9
PH		 4463 if (deliver_split_address(addr) == DEFER)
4464 {
4465 *log_msgptr = US"defer in percent_hack_domains check";
4466 return DEFER;
4467 }
8c5d388a 4468#ifdef SUPPORT_I18N
3c8b3577
JH		 4469 if ((addr->prop.utf8_msg = message_smtputf8))
4470 {
4471 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4472 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4473 }
9bfc60eb 4474#endif
059ec3d9
PH		 4475 deliver_domain = addr->domain;
4476 deliver_localpart = addr->local_part;
4477 }
059ec3d9 4478
faa05a93 4479acl_where = where;
059ec3d9 4480rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4481acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4482
817d9f57
JH		 4483/* Cutthrough - if requested,
4484and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4485and rcpt acl returned accept,
4486and first recipient (cancel on any subsequents)
e4bdf652 4487open one now and run it up to RCPT acceptance.
f9334a28
JH		 4488A failed verify should cancel cutthrough request,
4489and will pass the fail to the originator.
817d9f57 4490Initial implementation: dual-write to spool.
e4bdf652
JH		 4491Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4492
4493Cease cutthrough copy on rxd final dot; do not send one.
4494
4495On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4496
4497On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4498perm-rejected, reflect that to the original sender - and dump the spooled copy.
4499If temp-reject, close the conn (and keep the spooled copy).
4500If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4501*/
4502switch (where)
4503{
4504case ACL_WHERE_RCPT:
8ccd00b1 4505#ifndef DISABLE_PRDR
fd98a5c6
JH		 4506case ACL_WHERE_PRDR:
4507#endif
59eaad2b
JH		 4508 if (host_checking_callout) /* -bhc mode */
4509 cancel_cutthrough_connection("host-checking mode");
4510 else if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
f9334a28 4511 rc = open_cutthrough_connection(addr);
e4bdf652
JH		 4512 break;
4513
4514case ACL_WHERE_PREDATA:
59eaad2b 4515 if (rc == OK)
e4bdf652
JH		 4516 cutthrough_predata();
4517 else
2e5b33cd 4518 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4519 break;
4520
4521case ACL_WHERE_QUIT:
4522case ACL_WHERE_NOTQUIT:
2e5b33cd 4523 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4524 break;
4525
4526default:
4527 break;
4528}
4529
64ffc24f
PH		 4530deliver_domain = deliver_localpart = deliver_address_data =
4531 sender_address_data = NULL;
059ec3d9
PH		 4532
4533/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4534ACL, which is really in the middle of an SMTP command. */
4535
4536if (rc == DISCARD)
4537 {
4538 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4539 {
4540 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4541 "ACL", acl_wherenames[where]);
4542 return ERROR;
4543 }
4544 return DISCARD;
4545 }
4546
4547/* A DROP response is not permitted from MAILAUTH */
4548
4549if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4550 {
4551 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4552 "ACL", acl_wherenames[where]);
4553 return ERROR;
4554 }
4555
4e88a19f
PH		 4556/* Before giving a response, take a look at the length of any user message, and
4557split it up into multiple lines if possible. */
059ec3d9 4558
e28326d8
PH		 4559*user_msgptr = string_split_message(*user_msgptr);
4560if (fake_response != OK)
4561 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4562
4563return rc;
4564}
4565
38a0a95f 4566
38a0a95f
PH		 4567/*************************************************
4568* Create ACL variable *
4569*************************************************/
4570
4571/* Create an ACL variable or reuse an existing one. ACL variables are in a
4572binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4573
4574Argument:
4575 name pointer to the variable's name, starting with c or m
4576
4577Returns the pointer to variable's tree node
4578*/
4579
4580tree_node *
4581acl_var_create(uschar *name)
4582{
4583tree_node *node, **root;
4584root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4585node = tree_search(*root, name);
4586if (node == NULL)
4587 {
4588 node = store_get(sizeof(tree_node) + Ustrlen(name));
4589 Ustrcpy(node->name, name);
4590 (void)tree_insertnode(root, node);
4591 }
4592node->data.ptr = NULL;
4593return node;
4594}
4595
4596
4597
4598/*************************************************
4599* Write an ACL variable in spool format *
4600*************************************************/
4601
4602/* This function is used as a callback for tree_walk when writing variables to
4603the spool file. To retain spool file compatibility, what is written is -aclc or
4604-aclm followed by the rest of the name and the data length, space separated,
4605then the value itself, starting on a new line, and terminated by an additional
4606newline. When we had only numbered ACL variables, the first line might look
4607like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4608acl_cfoo.
4609
4610Arguments:
4611 name of the variable
4612 value of the variable
4613 ctx FILE pointer (as a void pointer)
4614
4615Returns: nothing
4616*/
4617
4618void
4619acl_var_write(uschar *name, uschar *value, void *ctx)
4620{
4621FILE *f = (FILE *)ctx;
4622fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4623}
4624
9171d434
JH		 4625/* vi: aw ai sw=2
4626*/
059ec3d9 4627/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.