projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Revert "DKIM: reduce memory usage"
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
80a47a2c
TK		 68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
4840604e
TL		 71#endif
72#ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
8e669ac1 74#endif
71fafd95
PH		 75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
6ea85e9a 82 ACLC_LOG_REJECT_TARGET,
71fafd95 83 ACLC_LOGWRITE,
8523533c
TK		 84#ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86#endif
87 ACLC_MESSAGE,
88#ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90#endif
b0b9dbb1 91 ACLC_QUEUE,
870f6ba8 92 ACLC_RATELIMIT,
8523533c
TK		 93 ACLC_RECIPIENTS,
94#ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96#endif
e7568d51 97 ACLC_REMOVE_HEADER,
71fafd95
PH		 98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
8523533c 101#ifdef WITH_CONTENT_SCAN
8e669ac1 102 ACLC_SPAM,
8523533c
TK		 103#endif
104#ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
65a7d8c3 106 ACLC_SPF_GUESS,
8523533c 107#endif
b0019c78 108 ACLC_UDPSEND,
8523533c 109 ACLC_VERIFY };
059ec3d9 110
c3611384 111/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 112"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH		 113modifiers that look like conditions but always return TRUE. They are used for
114their side effects. */
059ec3d9 115
9a26b6b2
PH		 116static uschar *conditions[] = {
117 US"acl",
71fafd95 118 US"add_header",
9a26b6b2 119 US"authenticated",
8523533c
TK		 120#ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122#endif
123 US"condition",
c3611384 124 US"continue",
8e669ac1 125 US"control",
6a8f9482
TK		 126#ifdef EXPERIMENTAL_DCC
127 US"dcc",
128#endif
8523533c
TK		 129#ifdef WITH_CONTENT_SCAN
130 US"decode",
131#endif
132 US"delay",
80a47a2c
TK		 133#ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
4840604e
TL		 136#endif
137#ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
8523533c 139#endif
6ea85e9a
PH		 140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
8523533c
TK		 149#ifdef WITH_CONTENT_SCAN
150 US"malware",
151#endif
152 US"message",
153#ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155#endif
b0b9dbb1 156 US"queue",
870f6ba8 157 US"ratelimit",
8523533c
TK		 158 US"recipients",
159#ifdef WITH_CONTENT_SCAN
160 US"regex",
161#endif
e7568d51 162 US"remove_header",
b0b9dbb1
JH		 163 US"sender_domains",
164 US"senders",
165 US"set",
8523533c
TK		 166#ifdef WITH_CONTENT_SCAN
167 US"spam",
168#endif
169#ifdef EXPERIMENTAL_SPF
170 US"spf",
65a7d8c3 171 US"spf_guess",
8523533c 172#endif
b0019c78 173 US"udpsend",
059ec3d9 174 US"verify" };
8e669ac1 175
c5fcb476 176
9a26b6b2
PH		 177/* Return values from decode_control(); keep in step with the table of names
178that follows! */
179
180enum {
c46782ef 181 CONTROL_AUTH_UNADVERTISED,
3c8b3577 182#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 183 CONTROL_BMI_RUN,
3c8b3577 184#endif
ed7f7860 185 CONTROL_DEBUG,
3c8b3577 186#ifndef DISABLE_DKIM
f7572e5a 187 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 188#endif
189#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 190 CONTROL_DMARC_VERIFY,
191 CONTROL_DMARC_FORENSIC,
3c8b3577 192#endif
13363eba 193 CONTROL_DSCP,
c46782ef
PH		 194 CONTROL_ERROR,
195 CONTROL_CASEFUL_LOCAL_PART,
196 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 197 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 198 CONTROL_ENFORCE_SYNC,
199 CONTROL_NO_ENFORCE_SYNC,
200 CONTROL_FREEZE,
201 CONTROL_QUEUE_ONLY,
202 CONTROL_SUBMISSION,
203 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 204#ifdef WITH_CONTENT_SCAN
9a26b6b2 205 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 206#endif
c46782ef
PH		 207 CONTROL_FAKEDEFER,
208 CONTROL_FAKEREJECT,
8c5d388a 209#ifdef SUPPORT_I18N
3c8b3577
JH		 210 CONTROL_UTF8_DOWNCONVERT,
211#endif
cf8b11a5 212 CONTROL_NO_MULTILINE,
047bdd8c 213 CONTROL_NO_PIPELINING,
4c590bd1
PH		 214 CONTROL_NO_DELAY_FLUSH,
215 CONTROL_NO_CALLOUT_FLUSH
c46782ef 216};
9a26b6b2 217
8800895a
PH		 218/* ACL control names; keep in step with the table above! This list is used for
219turning ids into names. The actual list of recognized names is in the variable
220control_def controls_list[] below. The fact that there are two lists is a mess
221and should be tidied up. */
9a26b6b2
PH		 222
223static uschar *controls[] = {
c46782ef 224 US"allow_auth_unadvertised",
3c8b3577 225#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 226 US"bmi_run",
3c8b3577 227#endif
ed7f7860 228 US"debug",
3c8b3577 229#ifndef DISABLE_DKIM
80a47a2c 230 US"dkim_disable_verify",
3c8b3577
JH		 231#endif
232#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 233 US"dmarc_disable_verify",
234 US"dmarc_enable_forensic",
3c8b3577 235#endif
13363eba 236 US"dscp",
c46782ef
PH		 237 US"error",
238 US"caseful_local_part",
239 US"caselower_local_part",
e4bdf652 240 US"cutthrough_delivery",
c46782ef
PH		 241 US"enforce_sync",
242 US"no_enforce_sync",
243 US"freeze",
244 US"queue_only",
245 US"submission",
246 US"suppress_local_fixups",
3c8b3577 247#ifdef WITH_CONTENT_SCAN
9a26b6b2 248 US"no_mbox_unspool",
3c8b3577 249#endif
cf8b11a5
PH		 250 US"fakedefer",
251 US"fakereject",
8c5d388a 252#ifdef SUPPORT_I18N
3c8b3577
JH		 253 US"utf8_downconvert",
254#endif
aa6dc513 255 US"no_multiline_responses",
cf8b11a5 256 US"no_pipelining",
4c590bd1
PH		 257 US"no_delay_flush",
258 US"no_callout_flush"
c46782ef 259};
059ec3d9 260
047bdd8c 261/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 262at the outer level. In the other cases, expansion already occurs in the
263checking functions. */
264
265static uschar cond_expand_at_top[] = {
7421ecab 266 FALSE, /* acl */
3e536984 267 TRUE, /* add_header */
059ec3d9 268 FALSE, /* authenticated */
8523533c
TK		 269#ifdef EXPERIMENTAL_BRIGHTMAIL
270 TRUE, /* bmi_optin */
8e669ac1 271#endif
059ec3d9 272 TRUE, /* condition */
c3611384 273 TRUE, /* continue */
059ec3d9 274 TRUE, /* control */
6a8f9482
TK		 275#ifdef EXPERIMENTAL_DCC
276 TRUE, /* dcc */
277#endif
8523533c
TK		 278#ifdef WITH_CONTENT_SCAN
279 TRUE, /* decode */
280#endif
059ec3d9 281 TRUE, /* delay */
80a47a2c
TK		 282#ifndef DISABLE_DKIM
283 TRUE, /* dkim_signers */
284 TRUE, /* dkim_status */
4840604e
TL		 285#endif
286#ifdef EXPERIMENTAL_DMARC
287 TRUE, /* dmarc_status */
8523533c 288#endif
059ec3d9
PH		 289 TRUE, /* dnslists */
290 FALSE, /* domains */
291 FALSE, /* encrypted */
292 TRUE, /* endpass */
293 FALSE, /* hosts */
294 FALSE, /* local_parts */
295 TRUE, /* log_message */
6ea85e9a 296 TRUE, /* log_reject_target */
059ec3d9 297 TRUE, /* logwrite */
8523533c
TK		 298#ifdef WITH_CONTENT_SCAN
299 TRUE, /* malware */
300#endif
059ec3d9 301 TRUE, /* message */
8523533c
TK		 302#ifdef WITH_CONTENT_SCAN
303 TRUE, /* mime_regex */
304#endif
b0b9dbb1 305 TRUE, /* queue */
870f6ba8 306 TRUE, /* ratelimit */
059ec3d9 307 FALSE, /* recipients */
8523533c
TK		 308#ifdef WITH_CONTENT_SCAN
309 TRUE, /* regex */
310#endif
e7568d51 311 TRUE, /* remove_header */
059ec3d9
PH		 312 FALSE, /* sender_domains */
313 FALSE, /* senders */
314 TRUE, /* set */
8523533c
TK		 315#ifdef WITH_CONTENT_SCAN
316 TRUE, /* spam */
317#endif
318#ifdef EXPERIMENTAL_SPF
319 TRUE, /* spf */
65a7d8c3 320 TRUE, /* spf_guess */
8523533c 321#endif
b0019c78 322 TRUE, /* udpsend */
059ec3d9
PH		 323 TRUE /* verify */
324};
325
326/* Flags to identify the modifiers */
327
328static uschar cond_modifiers[] = {
329 FALSE, /* acl */
3e536984 330 TRUE, /* add_header */
059ec3d9 331 FALSE, /* authenticated */
8523533c
TK		 332#ifdef EXPERIMENTAL_BRIGHTMAIL
333 TRUE, /* bmi_optin */
8e669ac1 334#endif
059ec3d9 335 FALSE, /* condition */
c3611384 336 TRUE, /* continue */
059ec3d9 337 TRUE, /* control */
6a8f9482
TK		 338#ifdef EXPERIMENTAL_DCC
339 FALSE, /* dcc */
340#endif
8523533c
TK		 341#ifdef WITH_CONTENT_SCAN
342 FALSE, /* decode */
343#endif
059ec3d9 344 TRUE, /* delay */
80a47a2c
TK		 345#ifndef DISABLE_DKIM
346 FALSE, /* dkim_signers */
347 FALSE, /* dkim_status */
4840604e
TL		 348#endif
349#ifdef EXPERIMENTAL_DMARC
350 FALSE, /* dmarc_status */
8523533c 351#endif
059ec3d9
PH		 352 FALSE, /* dnslists */
353 FALSE, /* domains */
354 FALSE, /* encrypted */
355 TRUE, /* endpass */
356 FALSE, /* hosts */
357 FALSE, /* local_parts */
358 TRUE, /* log_message */
6ea85e9a 359 TRUE, /* log_reject_target */
8523533c
TK		 360 TRUE, /* logwrite */
361#ifdef WITH_CONTENT_SCAN
362 FALSE, /* malware */
363#endif
059ec3d9 364 TRUE, /* message */
8523533c
TK		 365#ifdef WITH_CONTENT_SCAN
366 FALSE, /* mime_regex */
367#endif
b0b9dbb1 368 TRUE, /* queue */
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
80a47a2c
TK		 450 #ifndef DISABLE_DKIM
451 (unsigned int)
452 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 453
80a47a2c
TK		 454 (unsigned int)
455 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 456 #endif
fb2274d4 457
4840604e
TL		 458 #ifdef EXPERIMENTAL_DMARC
459 (unsigned int)
460 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
461 #endif
462
379ba7d0
JH		 463 /* Explicit key lookups can be made in non-smtp ACLs so pass
464 always and check in the verify processing itself. */
465
466 0, /* dnslists */
059ec3d9 467
2f079f46 468 (unsigned int)
fd98a5c6 469 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 470 |(1<<ACL_WHERE_VRFY)
8ccd00b1 471 #ifndef DISABLE_PRDR
fd98a5c6
JH		 472 |(1<<ACL_WHERE_PRDR)
473 #endif
474 ),
059ec3d9 475
45b91596
PH		 476 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
477 (1<<ACL_WHERE_CONNECT)|
478 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 479 (1<<ACL_WHERE_HELO),
8e669ac1 480
059ec3d9 481 0, /* endpass */
8e669ac1 482
45b91596
PH		 483 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
484 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 485
2f079f46 486 (unsigned int)
fd98a5c6 487 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 488 |(1<<ACL_WHERE_VRFY)
2e6afa4f 489 #ifndef DISABLE_PRDR
fd98a5c6
JH		 490 |(1<<ACL_WHERE_PRDR)
491 #endif
492 ),
059ec3d9
PH		 493
494 0, /* log_message */
8e669ac1 495
6ea85e9a
PH		 496 0, /* log_reject_target */
497
059ec3d9 498 0, /* logwrite */
8e669ac1 499
71fafd95 500 #ifdef WITH_CONTENT_SCAN
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 503 #ifndef DISABLE_PRDR
fd98a5c6 504 (1<<ACL_WHERE_PRDR)|
8ccd00b1 505 #endif
fd98a5c6 506 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 507 #endif
8523533c 508
059ec3d9
PH		 509 0, /* message */
510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 512 (unsigned int)
513 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 514 #endif
8523533c 515
ecc5f51a
JH		 516 (1<<ACL_WHERE_NOTSMTP)| /* queue */
517 #ifndef DISABLE_PRDR
518 (1<<ACL_WHERE_PRDR)|
519 #endif
520 (1<<ACL_WHERE_DATA),
521
870f6ba8
TF		 522 0, /* ratelimit */
523
2f079f46
PH		 524 (unsigned int)
525 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 526
71fafd95 527 #ifdef WITH_CONTENT_SCAN
2f079f46 528 (unsigned int)
fd98a5c6 529 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 530 #ifndef DISABLE_PRDR
fd98a5c6 531 (1<<ACL_WHERE_PRDR)|
8ccd00b1 532 #endif
fd98a5c6 533 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 534 (1<<ACL_WHERE_MIME)),
71fafd95 535 #endif
8523533c 536
e7568d51
TL		 537 (unsigned int)
538 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
539 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 540 #ifndef DISABLE_PRDR
fd98a5c6
JH		 541 (1<<ACL_WHERE_PRDR)|
542 #endif
e7568d51
TL		 543 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
544 (1<<ACL_WHERE_NOTSMTP_START)),
545
059ec3d9
PH		 546 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
547 (1<<ACL_WHERE_HELO)|
548 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
549 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
550 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
551
552 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
553 (1<<ACL_WHERE_HELO)|
554 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
555 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
556 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
557
558 0, /* set */
559
71fafd95 560 #ifdef WITH_CONTENT_SCAN
2f079f46 561 (unsigned int)
fd98a5c6 562 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 563 #ifndef DISABLE_PRDR
fd98a5c6 564 (1<<ACL_WHERE_PRDR)|
8ccd00b1 565 #endif
fd98a5c6 566 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 567 #endif
8523533c 568
71fafd95 569 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 570 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
571 (1<<ACL_WHERE_HELO)|
572 (1<<ACL_WHERE_MAILAUTH)|
573 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 574 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
575 (1<<ACL_WHERE_NOTSMTP)|
576 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 577
578 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
579 (1<<ACL_WHERE_HELO)|
580 (1<<ACL_WHERE_MAILAUTH)|
581 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
582 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
583 (1<<ACL_WHERE_NOTSMTP)|
584 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 585 #endif
8523533c 586
b0019c78
TF		 587 0, /* udpsend */
588
059ec3d9
PH		 589 /* Certain types of verify are always allowed, so we let it through
590 always and check in the verify function itself */
591
592 0 /* verify */
059ec3d9
PH		 593};
594
595
c5fcb476
PH		 596/* Bit map vector of which controls are not allowed at certain times. For
597each control, there's a bitmap of dis-allowed times. For some, it is easier to
598specify the negation of a small number of allowed times. */
599
600static unsigned int control_forbids[] = {
c46782ef
PH		 601 (unsigned int)
602 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
603
3c8b3577 604#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 605 0, /* bmi_run */
3c8b3577 606#endif
c46782ef 607
ed7f7860
PP		 608 0, /* debug */
609
3c8b3577 610#ifndef DISABLE_DKIM
80a47a2c 611 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 612# ifndef DISABLE_PRDR
fd98a5c6 613 (1<<ACL_WHERE_PRDR)|
3c8b3577 614# endif
f7572e5a 615 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 616#endif
f7572e5a 617
3c8b3577 618#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 619 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
620 (1<<ACL_WHERE_NOTSMTP_START),
621 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
622 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 623#endif
4840604e 624
13363eba
PP		 625 (1<<ACL_WHERE_NOTSMTP)|
626 (1<<ACL_WHERE_NOTSMTP_START)|
627 (1<<ACL_WHERE_NOTQUIT), /* dscp */
628
c5fcb476 629 0, /* error */
8e669ac1
PH		 630
631 (unsigned int)
c5fcb476 632 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 633
634 (unsigned int)
c5fcb476 635 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 636
e4bdf652
JH		 637 (unsigned int)
638 0, /* cutthrough_delivery */
639
45b91596
PH		 640 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
641 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 642
45b91596
PH		 643 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
644 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 645
646 (unsigned int)
c5fcb476
PH		 647 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
648 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 649 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 650 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 651
652 (unsigned int)
c5fcb476
PH		 653 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
654 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 655 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 656 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 657
658 (unsigned int)
c5fcb476 659 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 660 (1<<ACL_WHERE_PREDATA)),
8523533c 661
8800895a
PH		 662 (unsigned int)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 664 (1<<ACL_WHERE_PREDATA)|
665 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 666
3c8b3577 667#ifdef WITH_CONTENT_SCAN
8e669ac1 668 (unsigned int)
14d57970 669 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 670 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 671 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 672 (1<<ACL_WHERE_MIME)),
3c8b3577 673#endif
a6c4ab60 674
29aba418
TF		 675 (unsigned int)
676 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
677 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 678#ifndef DISABLE_PRDR
fd98a5c6 679 (1<<ACL_WHERE_PRDR)|
3c8b3577 680#endif
29aba418
TF		 681 (1<<ACL_WHERE_MIME)),
682
8e669ac1 683 (unsigned int)
a6c4ab60 684 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 685 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 686#ifndef DISABLE_PRDR
fd98a5c6 687 (1<<ACL_WHERE_PRDR)|
3c8b3577 688#endif
e715ad22 689 (1<<ACL_WHERE_MIME)),
8523533c 690
8c5d388a 691#ifdef SUPPORT_I18N
3c8b3577
JH		 692 0, /* utf8_downconvert */
693#endif
694
45b91596 695 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 696 (1<<ACL_WHERE_NOTSMTP_START),
697
698 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 699 (1<<ACL_WHERE_NOTSMTP_START),
700
701 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 702 (1<<ACL_WHERE_NOTSMTP_START),
703
704 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 705 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 706};
707
708/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 709
710typedef struct control_def {
711 uschar *name;
712 int value; /* CONTROL_xxx value */
059ec3d9
PH		 713 BOOL has_option; /* Has /option(s) following */
714} control_def;
715
716static control_def controls_list[] = {
3c8b3577 717 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 718#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 719 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 720#endif
3c8b3577 721 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 722#ifndef DISABLE_DKIM
3c8b3577 723 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 724#endif
725#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 726 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
727 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 728#endif
3c8b3577
JH		 729 { US"dscp", CONTROL_DSCP, TRUE },
730 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
731 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
732 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
733 { US"freeze", CONTROL_FREEZE, TRUE },
734 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
735 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
736 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
737 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
738 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
739 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 740#ifdef WITH_CONTENT_SCAN
3c8b3577 741 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 742#endif
3c8b3577
JH		 743 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
744 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
745 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 746 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577 747 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
8c5d388a 748#ifdef SUPPORT_I18N
3c8b3577
JH		 749 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
750#endif
059ec3d9
PH		 751 };
752
e5a9dba6
PH		 753/* Support data structures for Client SMTP Authorization. acl_verify_csa()
754caches its result in a tree to avoid repeated DNS queries. The result is an
755integer code which is used as an index into the following tables of
756explanatory strings and verification return codes. */
757
758static tree_node *csa_cache = NULL;
759
760enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
761 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
762
763/* The acl_verify_csa() return code is translated into an acl_verify() return
764code using the following table. It is OK unless the client is definitely not
765authorized. This is because CSA is supposed to be optional for sending sites,
766so recipients should not be too strict about checking it - especially because
767DNS problems are quite likely to occur. It's possible to use $csa_status in
768further ACL conditions to distinguish ok, unknown, and defer if required, but
769the aim is to make the usual configuration simple. */
770
771static int csa_return_code[] = {
772 OK, OK, OK, OK,
773 FAIL, FAIL, FAIL, FAIL
774};
775
776static uschar *csa_status_string[] = {
777 US"unknown", US"ok", US"defer", US"defer",
778 US"fail", US"fail", US"fail", US"fail"
779};
780
781static uschar *csa_reason_string[] = {
782 US"unknown",
783 US"ok",
784 US"deferred (SRV lookup failed)",
785 US"deferred (target address lookup failed)",
786 US"failed (explicit authorization required)",
787 US"failed (host name not authorized)",
788 US"failed (no authorized addresses)",
789 US"failed (client address mismatch)"
790};
791
c99ce5c9
TF		 792/* Options for the ratelimit condition. Note that there are two variants of
793the per_rcpt option, depending on the ACL that is used to measure the rate.
794However any ACL must be able to look up per_rcpt rates in /noupdate mode,
795so the two variants must have the same internal representation as well as
796the same configuration string. */
797
798enum {
799 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
800 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
801};
802
803#define RATE_SET(var,new) \
804 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
805
806static uschar *ratelimit_option_string[] = {
807 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
808 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
809};
810
059ec3d9
PH		 811/* Enable recursion between acl_check_internal() and acl_check_condition() */
812
55414b25 813static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 814 uschar **);
059ec3d9
PH		 815
816
817/*************************************************
818* Pick out name from list *
819*************************************************/
820
821/* Use a binary chop method
822
823Arguments:
824 name name to find
825 list list of names
826 end size of list
827
828Returns: offset in list, or -1 if not found
829*/
830
831static int
832acl_checkname(uschar *name, uschar **list, int end)
833{
834int start = 0;
835
836while (start < end)
837 {
838 int mid = (start + end)/2;
839 int c = Ustrcmp(name, list[mid]);
840 if (c == 0) return mid;
841 if (c < 0) end = mid; else start = mid + 1;
842 }
843
844return -1;
845}
846
847
848/*************************************************
849* Read and parse one ACL *
850*************************************************/
851
852/* This function is called both from readconf in order to parse the ACLs in the
853configuration file, and also when an ACL is encountered dynamically (e.g. as
854the result of an expansion). It is given a function to call in order to
855retrieve the lines of the ACL. This function handles skipping comments and
856blank lines (where relevant).
857
858Arguments:
859 func function to get next line of ACL
860 error where to put an error message
861
862Returns: pointer to ACL, or NULL
863 NULL can be legal (empty ACL); in this case error will be NULL
864*/
865
866acl_block *
867acl_read(uschar *(*func)(void), uschar **error)
868{
869acl_block *yield = NULL;
870acl_block **lastp = &yield;
871acl_block *this = NULL;
872acl_condition_block *cond;
873acl_condition_block **condp = NULL;
874uschar *s;
875
876*error = NULL;
877
878while ((s = (*func)()) != NULL)
879 {
880 int v, c;
881 BOOL negated = FALSE;
882 uschar *saveline = s;
883 uschar name[64];
884
885 /* Conditions (but not verbs) are allowed to be negated by an initial
886 exclamation mark. */
887
888 while (isspace(*s)) s++;
889 if (*s == '!')
890 {
891 negated = TRUE;
892 s++;
893 }
894
cf00dad6
PH		 895 /* Read the name of a verb or a condition, or the start of a new ACL, which
896 can be started by a name, or by a macro definition. */
059ec3d9
PH		 897
898 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 899 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 900
901 /* If a verb is unrecognized, it may be another condition or modifier that
902 continues the previous verb. */
903
904 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
905 if (v < 0)
906 {
907 if (this == NULL)
908 {
4e167a8c
PH		 909 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
910 saveline);
059ec3d9
PH		 911 return NULL;
912 }
913 }
914
915 /* New verb */
916
917 else
918 {
919 if (negated)
920 {
921 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
922 return NULL;
923 }
924 this = store_get(sizeof(acl_block));
925 *lastp = this;
926 lastp = &(this->next);
927 this->next = NULL;
928 this->verb = v;
929 this->condition = NULL;
930 condp = &(this->condition);
931 if (*s == 0) continue; /* No condition on this line */
932 if (*s == '!')
933 {
934 negated = TRUE;
935 s++;
936 }
937 s = readconf_readname(name, sizeof(name), s); /* Condition name */
938 }
939
940 /* Handle a condition or modifier. */
941
942 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
943 if (c < 0)
944 {
945 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
946 saveline);
947 return NULL;
948 }
949
950 /* The modifiers may not be negated */
951
952 if (negated && cond_modifiers[c])
953 {
954 *error = string_sprintf("ACL error: negation is not allowed with "
955 "\"%s\"", conditions[c]);
956 return NULL;
957 }
958
959 /* ENDPASS may occur only with ACCEPT or DISCARD. */
960
961 if (c == ACLC_ENDPASS &&
962 this->verb != ACL_ACCEPT &&
963 this->verb != ACL_DISCARD)
964 {
965 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
966 conditions[c], verbs[this->verb]);
967 return NULL;
968 }
969
970 cond = store_get(sizeof(acl_condition_block));
971 cond->next = NULL;
972 cond->type = c;
973 cond->u.negated = negated;
974
975 *condp = cond;
976 condp = &(cond->next);
977
978 /* The "set" modifier is different in that its argument is "name=value"
979 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 980 gives us a variable name to insert into the data block. The original ACL
981 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
982 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 983 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
984 After that, we allow alphanumerics and underscores, but the first character
985 after c or m must be a digit or an underscore. This retains backwards
986 compatibility. */
059ec3d9
PH		 987
988 if (c == ACLC_SET)
989 {
47ca6d6c
PH		 990 uschar *endptr;
991
38a0a95f
PH		 992 if (Ustrncmp(s, "acl_c", 5) != 0 &&
993 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 994 {
38a0a95f
PH		 995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
997 return NULL;
47ca6d6c 998 }
38a0a95f
PH		 999
1000 endptr = s + 5;
641cb756
PH		 1001 if (!isdigit(*endptr) && *endptr != '_')
1002 {
1003 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1004 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1005 s);
1006 return NULL;
1007 }
1008
38a0a95f 1009 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1010 {
38a0a95f
PH		 1011 if (!isalnum(*endptr) && *endptr != '_')
1012 {
1013 *error = string_sprintf("invalid character \"%c\" in variable name "
1014 "in ACL modifier \"set %s\"", *endptr, s);
1015 return NULL;
1016 }
1017 endptr++;
47ca6d6c 1018 }
47ca6d6c 1019
38a0a95f 1020 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1021 s = endptr;
059ec3d9
PH		 1022 while (isspace(*s)) s++;
1023 }
1024
1025 /* For "set", we are now positioned for the data. For the others, only
1026 "endpass" has no data */
1027
1028 if (c != ACLC_ENDPASS)
1029 {
1030 if (*s++ != '=')
1031 {
1032 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1033 cond_modifiers[c]? US"modifier" : US"condition");
1034 return NULL;
1035 }
1036 while (isspace(*s)) s++;
1037 cond->arg = string_copy(s);
1038 }
1039 }
1040
1041return yield;
1042}
1043
1044
1045
71fafd95
PH		 1046/*************************************************
1047* Set up added header line(s) *
1048*************************************************/
1049
1050/* This function is called by the add_header modifier, and also from acl_warn()
1051to implement the now-deprecated way of adding header lines using "message" on a
1052"warn" verb. The argument is treated as a sequence of header lines which are
1053added to a chain, provided there isn't an identical one already there.
1054
1055Argument: string of header lines
1056Returns: nothing
1057*/
1058
1059static void
55414b25 1060setup_header(const uschar *hstring)
71fafd95 1061{
55414b25 1062const uschar *p, *q;
71fafd95
PH		 1063int hlen = Ustrlen(hstring);
1064
b1b05573
JH		 1065/* Ignore any leading newlines */
1066while (*hstring == '\n') hstring++, hlen--;
71fafd95 1067
b1b05573 1068/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1069if (hlen <= 0) return;
96f5fe4c 1070if (hstring[--hlen] != '\n') /* no newline */
55414b25 1071 q = string_sprintf("%s\n", hstring);
96f5fe4c 1072else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 1073 {
1074 uschar * s = string_copy(hstring);
1075 while(s[--hlen] == '\n')
1076 s[hlen+1] = '\0';
1077 q = s;
1078 }
1079else
1080 q = hstring;
71fafd95
PH		 1081
1082/* Loop for multiple header lines, taking care about continuations */
1083
55414b25 1084for (p = q; *p != 0; )
71fafd95 1085 {
55414b25
JH		 1086 const uschar *s;
1087 uschar * hdr;
71fafd95
PH		 1088 int newtype = htype_add_bot;
1089 header_line **hptr = &acl_added_headers;
1090
1091 /* Find next header line within the string */
1092
1093 for (;;)
1094 {
96f5fe4c 1095 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH		 1096 if (*(++q) != ' ' && *q != '\t') break;
1097 }
1098
1099 /* If the line starts with a colon, interpret the instruction for where to
1100 add it. This temporarily sets up a new type. */
1101
1102 if (*p == ':')
1103 {
1104 if (strncmpic(p, US":after_received:", 16) == 0)
1105 {
1106 newtype = htype_add_rec;
1107 p += 16;
1108 }
1109 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1110 {
1111 newtype = htype_add_rfc;
1112 p += 14;
1113 }
1114 else if (strncmpic(p, US":at_start:", 10) == 0)
1115 {
1116 newtype = htype_add_top;
1117 p += 10;
1118 }
1119 else if (strncmpic(p, US":at_end:", 8) == 0)
1120 {
1121 newtype = htype_add_bot;
1122 p += 8;
1123 }
1124 while (*p == ' ' || *p == '\t') p++;
1125 }
1126
1127 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1128 to the front of it. */
1129
1130 for (s = p; s < q - 1; s++)
1131 {
1132 if (*s == ':' || !isgraph(*s)) break;
1133 }
1134
55414b25
JH		 1135 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1136 hlen = Ustrlen(hdr);
71fafd95
PH		 1137
1138 /* See if this line has already been added */
1139
1140 while (*hptr != NULL)
1141 {
55414b25 1142 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1143 hptr = &((*hptr)->next);
1144 }
1145
1146 /* Add if not previously present */
1147
1148 if (*hptr == NULL)
1149 {
1150 header_line *h = store_get(sizeof(header_line));
55414b25 1151 h->text = hdr;
71fafd95
PH		 1152 h->next = NULL;
1153 h->type = newtype;
1154 h->slen = hlen;
1155 *hptr = h;
1156 hptr = &(h->next);
1157 }
1158
1159 /* Advance for next header line within the string */
1160
1161 p = q;
1162 }
1163}
1164
1165
1166
362145b5
JH		 1167/*************************************************
1168* List the added header lines *
1169*************************************************/
1170uschar *
1171fn_hdrs_added(void)
1172{
1173uschar * ret = NULL;
5f5be492
JH		 1174int size = 0;
1175int ptr = 0;
362145b5
JH		 1176header_line * h = acl_added_headers;
1177uschar * s;
1178uschar * cp;
362145b5
JH		 1179
1180if (!h) return NULL;
1181
1182do
1183 {
1184 s = h->text;
1185 while ((cp = Ustrchr(s, '\n')) != NULL)
1186 {
1187 if (cp[1] == '\0') break;
1188
1189 /* contains embedded newline; needs doubling */
c2f669a4
JH		 1190 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1191 ret = string_catn(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1192 s = cp+1;
1193 }
1194 /* last bit of header */
1195
c2f669a4 1196 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
362145b5 1197 }
6d9cfc47 1198while((h = h->next));
362145b5
JH		 1199
1200ret[ptr-1] = '\0'; /* overwrite last newline */
1201return ret;
1202}
1203
1204
e7568d51
TL		 1205/*************************************************
1206* Set up removed header line(s) *
1207*************************************************/
1208
1209/* This function is called by the remove_header modifier. The argument is
1210treated as a sequence of header names which are added to a colon separated
1211list, provided there isn't an identical one already there.
1212
1213Argument: string of header names
1214Returns: nothing
1215*/
1216
1217static void
55414b25 1218setup_remove_header(const uschar *hnames)
e7568d51
TL		 1219{
1220if (*hnames != 0)
55414b25
JH		 1221 acl_removed_headers = acl_removed_headers
1222 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1223 : string_copy(hnames);
e7568d51
TL		 1224}
1225
1226
71fafd95 1227
059ec3d9
PH		 1228/*************************************************
1229* Handle warnings *
1230*************************************************/
1231
1232/* This function is called when a WARN verb's conditions are true. It adds to
1233the message's headers, and/or writes information to the log. In each case, this
1234only happens once (per message for headers, per connection for log).
1235
71fafd95
PH		 1236** NOTE: The header adding action using the "message" setting is historic, and
1237its use is now deprecated. The new add_header modifier should be used instead.
1238
059ec3d9
PH		 1239Arguments:
1240 where ACL_WHERE_xxxx indicating which ACL this is
1241 user_message message for adding to headers
1242 log_message message for logging, if different
1243
1244Returns: nothing
1245*/
1246
1247static void
1248acl_warn(int where, uschar *user_message, uschar *log_message)
1249{
059ec3d9
PH		 1250if (log_message != NULL && log_message != user_message)
1251 {
1252 uschar *text;
1253 string_item *logged;
1254
1255 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1256 string_printing(log_message));
1257
1258 /* If a sender verification has failed, and the log message is "sender verify
1259 failed", add the failure message. */
1260
1261 if (sender_verified_failed != NULL &&
1262 sender_verified_failed->message != NULL &&
1263 strcmpic(log_message, US"sender verify failed") == 0)
1264 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1265
9c7a242c
PH		 1266 /* Search previously logged warnings. They are kept in malloc
1267 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1268
1269 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1270 if (Ustrcmp(logged->text, text) == 0) break;
1271
1272 if (logged == NULL)
1273 {
1274 int length = Ustrlen(text) + 1;
1275 log_write(0, LOG_MAIN, "%s", text);
1276 logged = store_malloc(sizeof(string_item) + length);
1277 logged->text = (uschar *)logged + sizeof(string_item);
1278 memcpy(logged->text, text, length);
1279 logged->next = acl_warn_logged;
1280 acl_warn_logged = logged;
1281 }
1282 }
1283
1284/* If there's no user message, we are done. */
1285
1286if (user_message == NULL) return;
1287
1288/* If this isn't a message ACL, we can't do anything with a user message.
1289Log an error. */
1290
1291if (where > ACL_WHERE_NOTSMTP)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1294 "found in a non-message (%s) ACL: cannot specify header lines here: "
1295 "message ignored", acl_wherenames[where]);
1296 return;
1297 }
1298
71fafd95
PH		 1299/* The code for setting up header lines is now abstracted into a separate
1300function so that it can be used for the add_header modifier as well. */
059ec3d9 1301
71fafd95 1302setup_header(user_message);
059ec3d9
PH		 1303}
1304
1305
1306
1307/*************************************************
1308* Verify and check reverse DNS *
1309*************************************************/
1310
1311/* Called from acl_verify() below. We look up the host name(s) of the client IP
1312address if this has not yet been done. The host_name_lookup() function checks
1313that one of these names resolves to an address list that contains the client IP
1314address, so we don't actually have to do the check here.
1315
1316Arguments:
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319
1320Returns: OK verification condition succeeded
1321 FAIL verification failed
1322 DEFER there was a problem verifying
1323*/
1324
1325static int
1326acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1327{
1328int rc;
1329
1330user_msgptr = user_msgptr; /* stop compiler warning */
1331
1332/* Previous success */
1333
1334if (sender_host_name != NULL) return OK;
1335
1336/* Previous failure */
1337
1338if (host_lookup_failed)
1339 {
1340 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1341 return FAIL;
1342 }
1343
1344/* Need to do a lookup */
1345
1346HDEBUG(D_acl)
1347 debug_printf("looking up host name to force name/address consistency check\n");
1348
1349if ((rc = host_name_lookup()) != OK)
1350 {
1351 *log_msgptr = (rc == DEFER)?
1352 US"host lookup deferred for reverse lookup check"
1353 :
1354 string_sprintf("host lookup failed for reverse lookup check%s",
1355 host_lookup_msg);
1356 return rc; /* DEFER or FAIL */
1357 }
1358
1359host_build_sender_fullhost();
1360return OK;
1361}
1362
1363
1364
e5a9dba6
PH		 1365/*************************************************
1366* Check client IP address matches CSA target *
1367*************************************************/
1368
1369/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1370response for address records belonging to the CSA target hostname. The section
1371is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1372If one of the addresses matches the client's IP address, then the client is
1373authorized by CSA. If there are target IP addresses but none of them match
1374then the client is using an unauthorized IP address. If there are no target IP
1375addresses then the client cannot be using an authorized IP address. (This is
1376an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1377
1378Arguments:
1379 dnsa the DNS answer block
1380 dnss a DNS scan block for us to use
1381 reset option specifing what portion to scan, as described above
1382 target the target hostname to use for matching RR names
1383
1384Returns: CSA_OK successfully authorized
1385 CSA_FAIL_MISMATCH addresses found but none matched
1386 CSA_FAIL_NOADDR no target addresses found
1387*/
1388
1389static int
1390acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1391 uschar *target)
1392{
1393dns_record *rr;
1394dns_address *da;
1395
1396BOOL target_found = FALSE;
1397
1398for (rr = dns_next_rr(dnsa, dnss, reset);
1399 rr != NULL;
1400 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1401 {
1402 /* Check this is an address RR for the target hostname. */
1403
1404 if (rr->type != T_A
1405 #if HAVE_IPV6
1406 && rr->type != T_AAAA
e5a9dba6
PH		 1407 #endif
1408 ) continue;
1409
1410 if (strcmpic(target, rr->name) != 0) continue;
1411
1412 target_found = TRUE;
1413
1414 /* Turn the target address RR into a list of textual IP addresses and scan
1415 the list. There may be more than one if it is an A6 RR. */
1416
1417 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1418 {
1419 /* If the client IP address matches the target IP address, it's good! */
1420
1421 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1422
1423 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1424 }
1425 }
1426
1427/* If we found some target addresses but none of them matched, the client is
1428using an unauthorized IP address, otherwise the target has no authorized IP
1429addresses. */
1430
1431if (target_found) return CSA_FAIL_MISMATCH;
1432else return CSA_FAIL_NOADDR;
1433}
1434
1435
1436
1437/*************************************************
1438* Verify Client SMTP Authorization *
1439*************************************************/
1440
1441/* Called from acl_verify() below. This routine calls dns_lookup_special()
1442to find the CSA SRV record corresponding to the domain argument, or
1443$sender_helo_name if no argument is provided. It then checks that the
1444client is authorized, and that its IP address corresponds to the SRV
1445target's address by calling acl_verify_csa_address() above. The address
1446should have been returned in the DNS response's ADDITIONAL section, but if
1447not we perform another DNS lookup to get it.
1448
1449Arguments:
1450 domain pointer to optional parameter following verify = csa
1451
1452Returns: CSA_UNKNOWN no valid CSA record found
1453 CSA_OK successfully authorized
1454 CSA_FAIL_* client is definitely not authorized
1455 CSA_DEFER_* there was a DNS problem
1456*/
1457
1458static int
55414b25 1459acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1460{
1461tree_node *t;
55414b25
JH		 1462const uschar *found;
1463uschar *p;
e5a9dba6
PH		 1464int priority, weight, port;
1465dns_answer dnsa;
1466dns_scan dnss;
1467dns_record *rr;
1468int rc, type;
1469uschar target[256];
1470
1471/* Work out the domain we are using for the CSA lookup. The default is the
1472client's HELO domain. If the client has not said HELO, use its IP address
1473instead. If it's a local client (exim -bs), CSA isn't applicable. */
1474
1475while (isspace(*domain) && *domain != '\0') ++domain;
1476if (*domain == '\0') domain = sender_helo_name;
1477if (domain == NULL) domain = sender_host_address;
1478if (sender_host_address == NULL) return CSA_UNKNOWN;
1479
1480/* If we have an address literal, strip off the framing ready for turning it
1481into a domain. The framing consists of matched square brackets possibly
1482containing a keyword and a colon before the actual IP address. */
1483
1484if (domain[0] == '[')
1485 {
55414b25 1486 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1487 if (start == NULL) start = domain;
1488 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1489 }
1490
1491/* Turn domains that look like bare IP addresses into domains in the reverse
1492DNS. This code also deals with address literals and $sender_host_address. It's
1493not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1494address literals, but it's probably the most friendly thing to do. This is an
1495extension to CSA, so we allow it to be turned off for proper conformance. */
1496
7e66e54d 1497if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1498 {
1499 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1500 dns_build_reverse(domain, target);
1501 domain = target;
1502 }
1503
1504/* Find out if we've already done the CSA check for this domain. If we have,
1505return the same result again. Otherwise build a new cached result structure
1506for this domain. The name is filled in now, and the value is filled in when
1507we return from this function. */
1508
1509t = tree_search(csa_cache, domain);
1510if (t != NULL) return t->data.val;
1511
1512t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1513Ustrcpy(t->name, domain);
1514(void)tree_insertnode(&csa_cache, t);
1515
1516/* Now we are ready to do the actual DNS lookup(s). */
1517
28e6ef29 1518found = domain;
e5a9dba6
PH		 1519switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1520 {
1521 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1522
1523 default:
1524 return t->data.val = CSA_DEFER_SRV;
1525
1526 /* If we found nothing, the client's authorization is unknown. */
1527
1528 case DNS_NOMATCH:
1529 case DNS_NODATA:
1530 return t->data.val = CSA_UNKNOWN;
1531
1532 /* We got something! Go on to look at the reply in more detail. */
1533
1534 case DNS_SUCCEED:
1535 break;
1536 }
1537
1538/* Scan the reply for well-formed CSA SRV records. */
1539
1540for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1541 rr != NULL;
1542 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1543 {
1544 if (rr->type != T_SRV) continue;
1545
1546 /* Extract the numerical SRV fields (p is incremented) */
1547
1548 p = rr->data;
1549 GETSHORT(priority, p);
1550 GETSHORT(weight, p);
1551 GETSHORT(port, p);
1552
1553 DEBUG(D_acl)
1554 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1555
1556 /* Check the CSA version number */
1557
1558 if (priority != 1) continue;
1559
1560 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1561 found by dns_special_lookup() is a parent of the one we asked for), we check
1562 the subdomain assertions in the port field. At the moment there's only one
1563 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1564 SRV records of their own. */
1565
1dc92d5a 1566 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1567 {
1568 if (port & 1)
1569 return t->data.val = CSA_FAIL_EXPLICIT;
1570 else
1571 return t->data.val = CSA_UNKNOWN;
1572 }
1573
1574 /* This CSA SRV record refers directly to our domain, so we check the value
1575 in the weight field to work out the domain's authorization. 0 and 1 are
1576 unauthorized; 3 means the client is authorized but we can't check the IP
1577 address in order to authenticate it, so we treat it as unknown; values
1578 greater than 3 are undefined. */
1579
1580 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1581
1582 if (weight > 2) continue;
1583
1584 /* Weight == 2, which means the domain is authorized. We must check that the
1585 client's IP address is listed as one of the SRV target addresses. Save the
1586 target hostname then break to scan the additional data for its addresses. */
1587
1588 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1589 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1590
1591 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1592
1593 break;
1594 }
1595
1596/* If we didn't break the loop then no appropriate records were found. */
1597
1598if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1599
1600/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1601A target of "." indicates there are no valid addresses, so the client cannot
1602be authorized. (This is an odd configuration because weight=2 target=. is
1603equivalent to weight=1, but we check for it in order to keep load off the
1604root name servers.) Note that dn_expand() turns "." into "". */
1605
1606if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1607
1608/* Scan the additional section of the CSA SRV reply for addresses belonging
1609to the target. If the name server didn't return any additional data (e.g.
1610because it does not fully support SRV records), we need to do another lookup
1611to obtain the target addresses; otherwise we have a definitive result. */
1612
1613rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1614if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1615
1616/* The DNS lookup type corresponds to the IP version used by the client. */
1617
1618#if HAVE_IPV6
1619if (Ustrchr(sender_host_address, ':') != NULL)
1620 type = T_AAAA;
1621else
1622#endif /* HAVE_IPV6 */
1623 type = T_A;
1624
1625
4e0983dc 1626lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1627switch (dns_lookup(&dnsa, target, type, NULL))
1628 {
1629 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1630
1631 default:
cc00f4af 1632 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1633
1634 /* If the query succeeded, scan the addresses and return the result. */
1635
1636 case DNS_SUCCEED:
cc00f4af
JH		 1637 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1638 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1639 /* else fall through */
e5a9dba6
PH		 1640
1641 /* If the target has no IP addresses, the client cannot have an authorized
1642 IP address. However, if the target site uses A6 records (not AAAA records)
1643 we have to do yet another lookup in order to check them. */
1644
1645 case DNS_NOMATCH:
1646 case DNS_NODATA:
cc00f4af 1647 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1648 }
1649}
1650
1651
1652
059ec3d9
PH		 1653/*************************************************
1654* Handle verification (address & other) *
1655*************************************************/
1656
89583014 1657enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1658 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1659 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1660 };
1661typedef struct {
1662 uschar * name;
1663 int value;
1664 unsigned where_allowed; /* bitmap */
1665 BOOL no_options; /* Never has /option(s) following */
1666 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1667 } verify_type_t;
1668static verify_type_t verify_type_list[] = {
7e8360e6 1669 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1670 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1671 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1672 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1673 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1674 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1675 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1676 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1677 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1678 FALSE, 6 },
770747fd
MFM		 1679 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1680 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1681 };
1682
1683
1684enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1685 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1686 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1687 CALLOUT_TIME
1688 };
1689typedef struct {
1690 uschar * name;
1691 int value;
1692 int flag;
1693 BOOL has_option; /* Has =option(s) following */
1694 BOOL timeval; /* Has a time value */
1695 } callout_opt_t;
1696static callout_opt_t callout_opt_list[] = {
1697 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1698 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1699 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1700 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1701 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1702 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1703 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1704 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1705 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1706 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1707 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1708 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1709 };
1710
1711
1712
059ec3d9
PH		 1713/* This function implements the "verify" condition. It is called when
1714encountered in any ACL, because some tests are almost always permitted. Some
1715just don't make sense, and always fail (for example, an attempt to test a host
1716lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1717
1718Arguments:
1719 where where called from
1720 addr the recipient address that the ACL is handling, or NULL
1721 arg the argument of "verify"
1722 user_msgptr pointer for user message
1723 log_msgptr pointer for log message
1724 basic_errno where to put verify errno
1725
1726Returns: OK verification condition succeeded
1727 FAIL verification failed
1728 DEFER there was a problem verifying
1729 ERROR syntax error
1730*/
1731
1732static int
55414b25 1733acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1734 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1735{
1736int sep = '/';
1737int callout = -1;
1738int callout_overall = -1;
4deaf07d 1739int callout_connect = -1;
059ec3d9
PH		 1740int verify_options = 0;
1741int rc;
1742BOOL verify_header_sender = FALSE;
1743BOOL defer_ok = FALSE;
1744BOOL callout_defer_ok = FALSE;
1745BOOL no_details = FALSE;
eafd343b 1746BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1747address_item *sender_vaddr = NULL;
1748uschar *verify_sender_address = NULL;
1749uschar *pm_mailfrom = NULL;
1750uschar *se_mailfrom = NULL;
596875b3
PH		 1751
1752/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1753an error if options are given for items that don't expect them.
596875b3
PH		 1754*/
1755
1756uschar *slash = Ustrchr(arg, '/');
55414b25 1757const uschar *list = arg;
059ec3d9 1758uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1759verify_type_t * vp;
059ec3d9
PH		 1760
1761if (ss == NULL) goto BAD_VERIFY;
1762
1763/* Handle name/address consistency verification in a separate function. */
1764
89583014
JH		 1765for (vp= verify_type_list;
1766 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1767 vp++
1768 )
1769 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1770 : strcmpic (ss, vp->name) == 0)
1771 break;
1772if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1773 goto BAD_VERIFY;
1774
1775if (vp->no_options && slash != NULL)
059ec3d9 1776 {
89583014
JH		 1777 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1778 "(this verify item has no options)", arg);
1779 return ERROR;
059ec3d9 1780 }
89583014 1781if (!(vp->where_allowed & (1<<where)))
059ec3d9 1782 {
89583014
JH		 1783 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786switch(vp->value)
596875b3 1787 {
89583014
JH		 1788 case VERIFY_REV_HOST_LKUP:
1789 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1790 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1791 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1792 if (strcmpic(ss, US"defer_ok") == 0)
1793 return OK;
1794 return rc;
059ec3d9 1795
89583014
JH		 1796 case VERIFY_CERT:
1797 /* TLS certificate verification is done at STARTTLS time; here we just
1798 test whether it was successful or not. (This is for optional verification; for
1799 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1800
3703d818
JH		 1801 if (tls_in.certificate_verified) return OK;
1802 *user_msgptr = US"no verified certificate";
1803 return FAIL;
e5a9dba6 1804
89583014
JH		 1805 case VERIFY_HELO:
1806 /* We can test the result of optional HELO verification that might have
1807 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1808
3703d818
JH		 1809 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1810 return helo_verified? OK : FAIL;
059ec3d9 1811
89583014
JH		 1812 case VERIFY_CSA:
1813 /* Do Client SMTP Authorization checks in a separate function, and turn the
1814 result code into user-friendly strings. */
1c41c9cc 1815
3703d818
JH		 1816 rc = acl_verify_csa(list);
1817 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1818 csa_reason_string[rc]);
3703d818
JH		 1819 csa_status = csa_status_string[rc];
1820 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1821 return csa_return_code[rc];
89583014
JH		 1822
1823 case VERIFY_HDR_SYNTAX:
1824 /* Check that all relevant header lines have the correct syntax. If there is
1825 a syntax error, we return details of the error to the sender if configured to
1826 send out full details. (But a "message" setting on the ACL can override, as
1827 always). */
1828
1829 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1830 if (rc != OK && *log_msgptr)
1831 if (smtp_return_error_details)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 else
1834 acl_verify_message = *log_msgptr;
89583014 1835 return rc;
059ec3d9 1836
770747fd
MFM		 1837 case VERIFY_HDR_NAMES_ASCII:
1838 /* Check that all header names are true 7 bit strings
1839 See RFC 5322, 2.2. and RFC 6532, 3. */
1840
1841 rc = verify_check_header_names_ascii(log_msgptr);
1842 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1843 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1844 return rc;
1845
89583014
JH		 1846 case VERIFY_NOT_BLIND:
1847 /* Check that no recipient of this message is "blind", that is, every envelope
1848 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1849
89583014
JH		 1850 rc = verify_check_notblind();
1851 if (rc != OK)
1852 {
1853 *log_msgptr = string_sprintf("bcc recipient detected");
1854 if (smtp_return_error_details)
1855 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1856 }
1857 return rc;
059ec3d9 1858
89583014
JH		 1859 /* The remaining verification tests check recipient and sender addresses,
1860 either from the envelope or from the header. There are a number of
1861 slash-separated options that are common to all of them. */
059ec3d9 1862
89583014
JH		 1863 case VERIFY_HDR_SNDR:
1864 verify_header_sender = TRUE;
1865 break;
059ec3d9 1866
89583014
JH		 1867 case VERIFY_SNDR:
1868 /* In the case of a sender, this can optionally be followed by an address to use
1869 in place of the actual sender (rare special-case requirement). */
059ec3d9 1870 {
89583014
JH		 1871 uschar *s = ss + 6;
1872 if (*s == 0)
1873 verify_sender_address = sender_address;
1874 else
1875 {
1876 while (isspace(*s)) s++;
1877 if (*s++ != '=') goto BAD_VERIFY;
1878 while (isspace(*s)) s++;
1879 verify_sender_address = string_copy(s);
1880 }
059ec3d9 1881 }
89583014
JH		 1882 break;
1883
1884 case VERIFY_RCPT:
1885 break;
059ec3d9
PH		 1886 }
1887
89583014
JH		 1888
1889
596875b3
PH		 1890/* Remaining items are optional; they apply to sender and recipient
1891verification, including "header sender" verification. */
059ec3d9
PH		 1892
1893while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1894 != NULL)
1895 {
1896 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1897 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1898 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1899
1900 /* These two old options are left for backwards compatibility */
1901
1902 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1903 {
1904 callout_defer_ok = TRUE;
1905 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1906 }
1907
1908 else if (strcmpic(ss, US"check_postmaster") == 0)
1909 {
1910 pm_mailfrom = US"";
1911 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1912 }
1913
1914 /* The callout option has a number of sub-options, comma separated */
1915
1916 else if (strncmpic(ss, US"callout", 7) == 0)
1917 {
1918 callout = CALLOUT_TIMEOUT_DEFAULT;
1919 ss += 7;
1920 if (*ss != 0)
1921 {
1922 while (isspace(*ss)) ss++;
1923 if (*ss++ == '=')
1924 {
55414b25 1925 const uschar * sublist = ss;
059ec3d9
PH		 1926 int optsep = ',';
1927 uschar *opt;
1928 uschar buffer[256];
55414b25 1929 while (isspace(*sublist)) sublist++;
8e669ac1 1930
55414b25 1931 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1932 != NULL)
1933 {
89583014 1934 callout_opt_t * op;
438257ba 1935 double period = 1.0F;
059ec3d9 1936
89583014 1937 for (op= callout_opt_list; op->name; op++)
438257ba 1938 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1939 break;
059ec3d9 1940
89583014
JH		 1941 verify_options |= op->flag;
1942 if (op->has_option)
1943 {
438257ba 1944 opt += Ustrlen(op->name);
4deaf07d
PH		 1945 while (isspace(*opt)) opt++;
1946 if (*opt++ != '=')
1947 {
1948 *log_msgptr = string_sprintf("'=' expected after "
89583014 1949 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1950 return ERROR;
1951 }
1952 while (isspace(*opt)) opt++;
89583014
JH		 1953 }
1954 if (op->timeval)
1955 {
1956 period = readconf_readtime(opt, 0, FALSE);
1957 if (period < 0)
4deaf07d
PH		 1958 {
1959 *log_msgptr = string_sprintf("bad time value in ACL condition "
1960 "\"verify %s\"", arg);
1961 return ERROR;
1962 }
89583014
JH		 1963 }
1964
1965 switch(op->value)
1966 {
1967 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1968 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1969 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1970 case CALLOUT_MAILFROM:
1971 if (!verify_header_sender)
1972 {
1973 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1974 "callout option only for verify=header_sender (detected in ACL "
1975 "condition \"%s\")", arg);
1976 return ERROR;
1977 }
1978 se_mailfrom = string_copy(opt);
1979 break;
1980 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1981 case CALLOUT_MAXWAIT: callout_overall = period; break;
1982 case CALLOUT_CONNECT: callout_connect = period; break;
1983 case CALLOUT_TIME: callout = period; break;
1984 }
059ec3d9
PH		 1985 }
1986 }
1987 else
1988 {
1989 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1990 "ACL condition \"%s\"", arg);
1991 return ERROR;
1992 }
1993 }
1994 }
1995
1996 /* Option not recognized */
1997
1998 else
1999 {
2000 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2001 "condition \"verify %s\"", ss, arg);
2002 return ERROR;
2003 }
2004 }
2005
2006if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2007 (vopt_callout_recipsender|vopt_callout_recippmaster))
2008 {
2009 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2010 "for a recipient callout";
2011 return ERROR;
2012 }
2013
2014/* Handle sender-in-header verification. Default the user message to the log
2015message if giving out verification details. */
2016
2017if (verify_header_sender)
2018 {
8e669ac1 2019 int verrno;
2f682e45
JH		 2020
2021 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 2022 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 2023 &verrno)) != OK)
8e669ac1 2024 {
fe5b5d0b
PH		 2025 *basic_errno = verrno;
2026 if (smtp_return_error_details)
2027 {
2f682e45 2028 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH		 2029 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2030 if (rc == DEFER) acl_temp_details = TRUE;
2031 }
8e669ac1 2032 }
059ec3d9
PH		 2033 }
2034
2035/* Handle a sender address. The default is to verify *the* sender address, but
2036optionally a different address can be given, for special requirements. If the
2037address is empty, we are dealing with a bounce message that has no sender, so
2038we cannot do any checking. If the real sender address gets rewritten during
2039verification (e.g. DNS widening), set the flag to stop it being rewritten again
2040during message reception.
2041
2042A list of verified "sender" addresses is kept to try to avoid doing to much
2043work repetitively when there are multiple recipients in a message and they all
2044require sender verification. However, when callouts are involved, it gets too
2045complicated because different recipients may require different callout options.
2046Therefore, we always do a full sender verify when any kind of callout is
2047specified. Caching elsewhere, for instance in the DNS resolver and in the
2048callout handling, should ensure that this is not terribly inefficient. */
2049
2f682e45 2050else if (verify_sender_address)
059ec3d9 2051 {
2f682e45 2052 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH		 2053 {
2054 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2055 "sender verify callout";
2056 return ERROR;
2057 }
2058
2059 sender_vaddr = verify_checked_sender(verify_sender_address);
2060 if (sender_vaddr != NULL && /* Previously checked */
2061 callout <= 0) /* No callout needed this time */
2062 {
2063 /* If the "routed" flag is set, it means that routing worked before, so
2064 this check can give OK (the saved return code value, if set, belongs to a
2065 callout that was done previously). If the "routed" flag is not set, routing
2066 must have failed, so we use the saved return code. */
2067
2f682e45
JH		 2068 if (testflag(sender_vaddr, af_verify_routed))
2069 rc = OK;
2070 else
059ec3d9
PH		 2071 {
2072 rc = sender_vaddr->special_action;
2073 *basic_errno = sender_vaddr->basic_errno;
2074 }
2075 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2076 }
2077
2078 /* Do a new verification, and cache the result. The cache is used to avoid
2079 verifying the sender multiple times for multiple RCPTs when callouts are not
2080 specified (see comments above).
2081
2082 The cache is also used on failure to give details in response to the first
2083 RCPT that gets bounced for this reason. However, this can be suppressed by
2084 the no_details option, which sets the flag that says "this detail has already
2085 been sent". The cache normally contains just one address, but there may be
2086 more in esoteric circumstances. */
2087
2088 else
2089 {
2090 BOOL routed = TRUE;
2a3eea10 2091 uschar *save_address_data = deliver_address_data;
8e669ac1 2092
059ec3d9 2093 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2094#ifdef SUPPORT_I18N
3c8b3577
JH		 2095 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2096 {
2097 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2098 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2099 }
f358d5e0 2100#endif
059ec3d9
PH		 2101 if (no_details) setflag(sender_vaddr, af_sverify_told);
2102 if (verify_sender_address[0] != 0)
2103 {
2104 /* If this is the real sender address, save the unrewritten version
2105 for use later in receive. Otherwise, set a flag so that rewriting the
2106 sender in verify_address() does not update sender_address. */
2107
2108 if (verify_sender_address == sender_address)
2109 sender_address_unrewritten = sender_address;
2110 else
2111 verify_options |= vopt_fake_sender;
2112
eafd343b
TK		 2113 if (success_on_redirect)
2114 verify_options |= vopt_success_on_redirect;
2115
059ec3d9
PH		 2116 /* The recipient, qualify, and expn options are never set in
2117 verify_options. */
2118
2119 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2120 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2121
2122 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2123
2f682e45
JH		 2124 if (rc != OK)
2125 *basic_errno = sender_vaddr->basic_errno;
2126 else
2127 DEBUG(D_acl)
2128 {
2129 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2130 debug_printf("sender %s verified ok as %s\n",
2131 verify_sender_address, sender_vaddr->address);
2132 else
2133 debug_printf("sender %s verified ok\n",
2134 verify_sender_address);
2135 }
059ec3d9 2136 }
2f682e45
JH		 2137 else
2138 rc = OK; /* Null sender */
059ec3d9
PH		 2139
2140 /* Cache the result code */
2141
2142 if (routed) setflag(sender_vaddr, af_verify_routed);
2143 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2144 sender_vaddr->special_action = rc;
2145 sender_vaddr->next = sender_verified_list;
2146 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2147
2148 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2149 the sender verification. */
8e669ac1 2150
2a3eea10 2151 deliver_address_data = save_address_data;
059ec3d9 2152 }
8e669ac1 2153
2a3eea10
PH		 2154 /* Put the sender address_data value into $sender_address_data */
2155
d43cbe25 2156 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2157 }
2158
2159/* A recipient address just gets a straightforward verify; again we must handle
2160the DEFER overrides. */
2161
2162else
2163 {
2164 address_item addr2;
2165
eafd343b
TK		 2166 if (success_on_redirect)
2167 verify_options |= vopt_success_on_redirect;
2168
059ec3d9
PH		 2169 /* We must use a copy of the address for verification, because it might
2170 get rewritten. */
2171
2172 addr2 = *addr;
2173 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2174 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2175 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2176
42855d71 2177 *basic_errno = addr2.basic_errno;
059ec3d9 2178 *log_msgptr = addr2.message;
8e669ac1 2179 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2180 addr2.user_message : addr2.message;
42855d71
PH		 2181
2182 /* Allow details for temporary error if the address is so flagged. */
2183 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2184
2185 /* Make $address_data visible */
d43cbe25 2186 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2187 }
2188
2189/* We have a result from the relevant test. Handle defer overrides first. */
2190
2191if (rc == DEFER && (defer_ok ||
2192 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2193 {
2194 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2195 defer_ok? "defer_ok" : "callout_defer_ok");
2196 rc = OK;
2197 }
2198
2199/* If we've failed a sender, set up a recipient message, and point
2200sender_verified_failed to the address item that actually failed. */
2201
2202if (rc != OK && verify_sender_address != NULL)
2203 {
2204 if (rc != DEFER)
059ec3d9 2205 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2206 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2208 else
2209 {
2210 *log_msgptr = US"Could not complete sender verify callout";
2211 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2212 *log_msgptr;
2213 }
2214
2215 sender_verified_failed = sender_vaddr;
2216 }
2217
2218/* Verifying an address messes up the values of $domain and $local_part,
2219so reset them before returning if this is a RCPT ACL. */
2220
2221if (addr != NULL)
2222 {
2223 deliver_domain = addr->domain;
2224 deliver_localpart = addr->local_part;
2225 }
2226return rc;
2227
2228/* Syntax errors in the verify argument come here. */
2229
2230BAD_VERIFY:
2231*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2232 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2233 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2234 "\"verify %s\"", arg);
2235return ERROR;
2236}
2237
2238
2239
2240
2241/*************************************************
2242* Check argument for control= modifier *
2243*************************************************/
2244
2245/* Called from acl_check_condition() below
2246
2247Arguments:
2248 arg the argument string for control=
2249 pptr set to point to the terminating character
2250 where which ACL we are in
2251 log_msgptr for error messages
2252
2253Returns: CONTROL_xxx value
2254*/
2255
2256static int
55414b25 2257decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2258{
2259int len;
2260control_def *d;
2261
2262for (d = controls_list;
2263 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2264 d++)
2265 {
2266 len = Ustrlen(d->name);
2267 if (Ustrncmp(d->name, arg, len) == 0) break;
2268 }
2269
2270if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2271 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2272 {
2273 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2274 return CONTROL_ERROR;
2275 }
2276
059ec3d9
PH		 2277*pptr = arg + len;
2278return d->value;
2279}
2280
2281
2282
c99ce5c9
TF		 2283
2284/*************************************************
2285* Return a ratelimit error *
2286*************************************************/
2287
2288/* Called from acl_ratelimit() below
2289
2290Arguments:
2291 log_msgptr for error messages
2292 format format string
2293 ... supplementary arguments
2294 ss ratelimit option name
2295 where ACL_WHERE_xxxx indicating which ACL this is
2296
2297Returns: ERROR
2298*/
2299
2300static int
2301ratelimit_error(uschar **log_msgptr, const char *format, ...)
2302{
2303va_list ap;
2304uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2305va_start(ap, format);
2306if (!string_vformat(buffer, sizeof(buffer), format, ap))
2307 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2308 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2309va_end(ap);
2310*log_msgptr = string_sprintf(
2311 "error in arguments to \"ratelimit\" condition: %s", buffer);
2312return ERROR;
2313}
2314
2315
2316
2317
870f6ba8
TF		 2318/*************************************************
2319* Handle rate limiting *
2320*************************************************/
2321
2322/* Called by acl_check_condition() below to calculate the result
2323of the ACL ratelimit condition.
2324
2325Note that the return value might be slightly unexpected: if the
2326sender's rate is above the limit then the result is OK. This is
2327similar to the dnslists condition, and is so that you can write
2328ACL clauses like: defer ratelimit = 15 / 1h
2329
2330Arguments:
2331 arg the option string for ratelimit=
90fc3069 2332 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2333 log_msgptr for error messages
2334
2335Returns: OK - Sender's rate is above limit
2336 FAIL - Sender's rate is below limit
2337 DEFER - Problem opening ratelimit database
2338 ERROR - Syntax error in options.
2339*/
2340
2341static int
55414b25 2342acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2343{
c99ce5c9 2344double limit, period, count;
8f240103
PH		 2345uschar *ss;
2346uschar *key = NULL;
c99ce5c9 2347uschar *unique = NULL;
870f6ba8 2348int sep = '/';
c99ce5c9
TF		 2349BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2350BOOL noupdate = FALSE, badacl = FALSE;
2351int mode = RATE_PER_WHAT;
870f6ba8
TF		 2352int old_pool, rc;
2353tree_node **anchor, *t;
2354open_db dbblock, *dbm;
c99ce5c9 2355int dbdb_size;
870f6ba8 2356dbdata_ratelimit *dbd;
c99ce5c9 2357dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2358struct timeval tv;
2359
2360/* Parse the first two options and record their values in expansion
2361variables. These variables allow the configuration to have informative
2362error messages based on rate limits obtained from a table lookup. */
2363
c99ce5c9 2364/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2365size, which must be greater than or equal to zero. Zero is useful for
2366rate measurement as opposed to rate limiting. */
2367
2368sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2369if (sender_rate_limit == NULL)
96f5fe4c
JH		 2370 return ratelimit_error(log_msgptr, "sender rate limit not set");
2371
2372limit = Ustrtod(sender_rate_limit, &ss);
2373if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2374else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2375else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2376
c99ce5c9
TF		 2377if (limit < 0.0 || *ss != '\0')
2378 return ratelimit_error(log_msgptr,
2379 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2380
c99ce5c9 2381/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2382constant. This must be strictly greater than zero, because zero leads to
2383run-time division errors. */
2384
2385sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2386if (sender_rate_period == NULL) period = -1.0;
2387else period = readconf_readtime(sender_rate_period, 0, FALSE);
2388if (period <= 0.0)
c99ce5c9
TF		 2389 return ratelimit_error(log_msgptr,
2390 "\"%s\" is not a time value", sender_rate_period);
2391
2392/* By default we are counting one of something, but the per_rcpt,
2393per_byte, and count options can change this. */
2394
2395count = 1.0;
870f6ba8 2396
c99ce5c9 2397/* Parse the other options. */
870f6ba8
TF		 2398
2399while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2400 != NULL)
2401 {
2402 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2403 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2404 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2405 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2406 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2407 else if (strcmpic(ss, US"per_conn") == 0)
2408 {
2409 RATE_SET(mode, PER_CONN);
2410 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2411 badacl = TRUE;
2412 }
2413 else if (strcmpic(ss, US"per_mail") == 0)
2414 {
2415 RATE_SET(mode, PER_MAIL);
2416 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2417 }
2418 else if (strcmpic(ss, US"per_rcpt") == 0)
2419 {
2420 /* If we are running in the RCPT ACL, then we'll count the recipients
2421 one by one, but if we are running when we have accumulated the whole
2422 list then we'll add them all in one batch. */
2423 if (where == ACL_WHERE_RCPT)
2424 RATE_SET(mode, PER_RCPT);
2425 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2426 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2427 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2429 }
2430 else if (strcmpic(ss, US"per_byte") == 0)
2431 {
2432 /* If we have not yet received the message data and there was no SIZE
2433 declaration on the MAIL comand, then it's safe to just use a value of
2434 zero and let the recorded rate decay as if nothing happened. */
2435 RATE_SET(mode, PER_MAIL);
2436 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2437 else count = message_size < 0 ? 0.0 : (double)message_size;
2438 }
2439 else if (strcmpic(ss, US"per_addr") == 0)
2440 {
2441 RATE_SET(mode, PER_RCPT);
438257ba 2442 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2443 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2444 }
2445 else if (strncmpic(ss, US"count=", 6) == 0)
2446 {
2447 uschar *e;
2448 count = Ustrtod(ss+6, &e);
2449 if (count < 0.0 || *e != '\0')
2450 return ratelimit_error(log_msgptr,
2451 "\"%s\" is not a positive number", ss);
2452 }
2453 else if (strncmpic(ss, US"unique=", 7) == 0)
2454 unique = string_copy(ss + 7);
2455 else if (key == NULL)
2456 key = string_copy(ss);
2457 else
2458 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2459 }
2460
c99ce5c9
TF		 2461/* Sanity check. When the badacl flag is set the update mode must either
2462be readonly (which is the default if it is omitted) or, for backwards
2463compatibility, a combination of noupdate and strict or leaky. */
2464
2465if (mode == RATE_PER_CLASH)
2466 return ratelimit_error(log_msgptr, "conflicting per_* options");
2467if (leaky + strict + readonly > 1)
2468 return ratelimit_error(log_msgptr, "conflicting update modes");
2469if (badacl && (leaky || strict) && !noupdate)
2470 return ratelimit_error(log_msgptr,
2471 "\"%s\" must not have /leaky or /strict option in %s ACL",
2472 ratelimit_option_string[mode], acl_wherenames[where]);
2473
2474/* Set the default values of any unset options. In readonly mode we
2475perform the rate computation without any increment so that its value
2476decays to eventually allow over-limit senders through. */
2477
2478if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2479if (badacl) readonly = TRUE;
2480if (readonly) count = 0.0;
2481if (!strict && !readonly) leaky = TRUE;
2482if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2483
8f240103
PH		 2484/* Create the lookup key. If there is no explicit key, use sender_host_address.
2485If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2486omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2487are added to the key because they alter the meaning of the stored data. */
2488
2489if (key == NULL)
2490 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2491
c99ce5c9 2492key = string_sprintf("%s/%s/%s%s",
8f240103 2493 sender_rate_period,
c99ce5c9
TF		 2494 ratelimit_option_string[mode],
2495 unique == NULL ? "" : "unique/",
8f240103 2496 key);
870f6ba8 2497
c99ce5c9
TF		 2498HDEBUG(D_acl)
2499 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2500
8f240103
PH		 2501/* See if we have already computed the rate by looking in the relevant tree.
2502For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2503pool so that they survive across resets. In readonly mode we only remember the
2504result for the rest of this command in case a later command changes it. After
2505this bit of logic the code is independent of the per_* mode. */
870f6ba8 2506
870f6ba8
TF		 2507old_pool = store_pool;
2508
c99ce5c9
TF		 2509if (readonly)
2510 anchor = &ratelimiters_cmd;
2511else switch(mode) {
2512case RATE_PER_CONN:
870f6ba8
TF		 2513 anchor = &ratelimiters_conn;
2514 store_pool = POOL_PERM;
c99ce5c9
TF		 2515 break;
2516case RATE_PER_BYTE:
2517case RATE_PER_MAIL:
2518case RATE_PER_ALLRCPTS:
870f6ba8 2519 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2520 break;
2521case RATE_PER_ADDR:
2522case RATE_PER_CMD:
2523case RATE_PER_RCPT:
fe0dab11 2524 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2525 break;
2526default:
3399bb60 2527 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2528 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2529 "internal ACL error: unknown ratelimit mode %d", mode);
2530 break;
2531}
870f6ba8 2532
c99ce5c9
TF		 2533t = tree_search(*anchor, key);
2534if (t != NULL)
870f6ba8
TF		 2535 {
2536 dbd = t->data.ptr;
2537 /* The following few lines duplicate some of the code below. */
8f240103 2538 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2539 store_pool = old_pool;
2540 sender_rate = string_sprintf("%.1f", dbd->rate);
2541 HDEBUG(D_acl)
2542 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2543 return rc;
2544 }
2545
c99ce5c9
TF		 2546/* We aren't using a pre-computed rate, so get a previously recorded rate
2547from the database, which will be updated and written back if required. */
870f6ba8
TF		 2548
2549dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2550if (dbm == NULL)
2551 {
2552 store_pool = old_pool;
2553 sender_rate = NULL;
2554 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2556 return DEFER;
2557 }
c99ce5c9
TF		 2558dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2559dbd = NULL;
870f6ba8
TF		 2560
2561gettimeofday(&tv, NULL);
2562
c99ce5c9
TF		 2563if (dbdb != NULL)
2564 {
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2567 dbd = &dbdb->dbd;
2568
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2573
2574 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2575 {
2576 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2577 dbdb = NULL;
2578 }
2579
2580 /* Sanity check. */
2581
2582 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2583 {
2584 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2585 dbdb = NULL;
2586 }
2587 }
2588
2589/* Allocate a new data block if the database lookup failed
2590or the Bloom filter passed its age limit. */
2591
2592if (dbdb == NULL)
2593 {
2594 if (unique == NULL)
2595 {
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size);
2600 }
2601 else
2602 {
2603 int extra;
2604 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2605
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2609
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2617
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2620
2621 if (dbd != NULL)
2622 {
2623 dbdb->dbd = *dbd;
2624 dbd = &dbdb->dbd;
2625 }
2626 }
2627 }
2628
2629/* If we are counting unique events, find out if this event is new or not.
2630If the client repeats the event during the current period then it should be
2631counted. We skip this code in readonly mode for efficiency, because any
2632changes to the filter will be discarded and because count is already set to
2633zero. */
2634
2635if (unique != NULL && !readonly)
2636 {
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2642
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2648
2649 size = limit * 16
2650 numhash = 8
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2654
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2657
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2661
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2664
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2669
2670 BOOL seen;
2671 unsigned n, hash, hinc;
2672 uschar md5sum[16];
2673 md5 md5info;
2674
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2679
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2684
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2687
2688 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2689
2690 seen = TRUE;
2691 for (n = 0; n < 8; n++, hash += hinc)
2692 {
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2696 {
2697 dbdb->bloom[byte] |= bit;
2698 seen = FALSE;
2699 }
2700 }
2701
2702 /* If this event has occurred before, do not count it. */
2703
2704 if (seen)
2705 {
2706 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2707 count = 0.0;
2708 }
2709 else
2710 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2711 }
2712
2713/* If there was no previous ratelimit data block for this key, initialize
2714the new one, otherwise update the block from the database. The initial rate
2715is what would be computed by the code below for an infinite interval. */
2716
870f6ba8
TF		 2717if (dbd == NULL)
2718 {
c99ce5c9
TF		 2719 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2720 dbd = &dbdb->dbd;
870f6ba8
TF		 2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
c99ce5c9 2723 dbd->rate = count;
870f6ba8
TF		 2724 }
2725else
2726 {
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2731
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2737
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2741
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2746
2747 rate_1 = (1 - a) * p/i + a * rate_0
2748 = k + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2755
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2757
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2762
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2768
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2773
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2776 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2777
e5d5a95f
TF		 2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2780
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
870f6ba8 2783
c99ce5c9
TF		 2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2787
870f6ba8
TF		 2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2791
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-intialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2801
2802 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2803 }
2804
c99ce5c9
TF		 2805/* Clients sending at the limit are considered to be over the limit.
2806This matters for edge cases such as a limit of zero, when the client
2807should be completely blocked. */
3348576f 2808
8f240103 2809rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2810
2811/* Update the state if the rate is low or if we are being strict. If we
2812are in leaky mode and the sender's rate is too high, we do not update
2813the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2814rate preventing them from getting any email through. If readonly is set,
2815neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2816
c99ce5c9 2817if ((rc == FAIL && leaky) || strict)
8f240103 2818 {
c99ce5c9 2819 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2820 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2821 }
2822else
2823 {
2824 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2825 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2826 }
2827
870f6ba8
TF		 2828dbfn_close(dbm);
2829
c99ce5c9 2830/* Store the result in the tree for future reference. */
870f6ba8 2831
c99ce5c9
TF		 2832t = store_get(sizeof(tree_node) + Ustrlen(key));
2833t->data.ptr = dbd;
2834Ustrcpy(t->name, key);
2835(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2836
2837/* We create the formatted version of the sender's rate very late in
2838order to ensure that it is done using the correct storage pool. */
2839
2840store_pool = old_pool;
2841sender_rate = string_sprintf("%.1f", dbd->rate);
2842
2843HDEBUG(D_acl)
2844 debug_printf("ratelimit computed rate %s\n", sender_rate);
2845
2846return rc;
2847}
2848
2849
2850
b0019c78
TF		 2851/*************************************************
2852* The udpsend ACL modifier *
2853*************************************************/
2854
2855/* Called by acl_check_condition() below.
2856
2857Arguments:
2858 arg the option string for udpsend=
2859 log_msgptr for error messages
2860
2861Returns: OK - Completed.
2862 DEFER - Problem with DNS lookup.
2863 ERROR - Syntax error in options.
2864*/
2865
2866static int
55414b25 2867acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2868{
2869int sep = 0;
2870uschar *hostname;
2871uschar *portstr;
2872uschar *portend;
2873host_item *h;
2874int portnum;
b0019c78
TF		 2875int len;
2876int r, s;
b1f8e4f8 2877uschar * errstr;
b0019c78
TF		 2878
2879hostname = string_nextinlist(&arg, &sep, NULL, 0);
2880portstr = string_nextinlist(&arg, &sep, NULL, 0);
2881
2882if (hostname == NULL)
2883 {
217b0e56 2884 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2885 return ERROR;
2886 }
2887if (portstr == NULL)
2888 {
217b0e56 2889 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2890 return ERROR;
2891 }
2892if (arg == NULL)
2893 {
217b0e56 2894 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2895 return ERROR;
2896 }
2897portnum = Ustrtol(portstr, &portend, 10);
2898if (*portend != '\0')
2899 {
217b0e56 2900 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2901 return ERROR;
2902 }
2903
2904/* Make a single-item host list. */
2905h = store_get(sizeof(host_item));
2906memset(h, 0, sizeof(host_item));
2907h->name = hostname;
2908h->port = portnum;
2909h->mx = MX_NONE;
2910
2911if (string_is_ip_address(hostname, NULL))
2912 h->address = hostname, r = HOST_FOUND;
2913else
2914 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2915if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2916 {
217b0e56 2917 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2918 return DEFER;
2919 }
2920
2921HDEBUG(D_acl)
2922 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2923
b1f8e4f8
JH		 2924r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2925 1, NULL, &errstr);
b0019c78 2926if (r < 0) goto defer;
27f9999e 2927len = Ustrlen(arg);
9cb1785a 2928r = send(s, arg, len, 0);
b1f8e4f8
JH		 2929if (r < 0)
2930 {
2931 errstr = US strerror(errno);
2932 close(s);
2933 goto defer;
2934 }
2935close(s);
b0019c78
TF		 2936if (r < len)
2937 {
2938 *log_msgptr =
2939 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2940 return DEFER;
2941 }
2942
2943HDEBUG(D_acl)
2944 debug_printf("udpsend %d bytes\n", r);
2945
2946return OK;
2947
2948defer:
b1f8e4f8 2949*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2950return DEFER;
2951}
2952
2953
2954
059ec3d9
PH		 2955/*************************************************
2956* Handle conditions/modifiers on an ACL item *
2957*************************************************/
2958
2959/* Called from acl_check() below.
2960
2961Arguments:
2962 verb ACL verb
2963 cb ACL condition block - if NULL, result is OK
2964 where where called from
2965 addr the address being checked for RCPT, or NULL
2966 level the nesting level
2967 epp pointer to pass back TRUE if "endpass" encountered
2968 (applies only to "accept" and "discard")
2969 user_msgptr user message pointer
2970 log_msgptr log message pointer
2971 basic_errno pointer to where to put verify error
2972
2973Returns: OK - all conditions are met
2974 DISCARD - an "acl" condition returned DISCARD - only allowed
2975 for "accept" or "discard" verbs
2976 FAIL - at least one condition fails
2977 FAIL_DROP - an "acl" condition returned FAIL_DROP
2978 DEFER - can't tell at the moment (typically, lookup defer,
2979 but can be temporary callout problem)
2980 ERROR - ERROR from nested ACL or expansion failure or other
2981 error
2982*/
2983
2984static int
2985acl_check_condition(int verb, acl_condition_block *cb, int where,
2986 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2987 uschar **log_msgptr, int *basic_errno)
2988{
2989uschar *user_message = NULL;
2990uschar *log_message = NULL;
059ec3d9 2991int rc = OK;
8523533c 2992#ifdef WITH_CONTENT_SCAN
0f0c8159 2993int sep = -'/';
8523533c 2994#endif
059ec3d9
PH		 2995
2996for (; cb != NULL; cb = cb->next)
2997 {
55414b25 2998 const uschar *arg;
8e669ac1 2999 int control_type;
059ec3d9
PH		 3000
3001 /* The message and log_message items set up messages to be used in
3002 case of rejection. They are expanded later. */
3003
3004 if (cb->type == ACLC_MESSAGE)
3005 {
187bc588 3006 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3007 user_message = cb->arg;
3008 continue;
3009 }
3010
3011 if (cb->type == ACLC_LOG_MESSAGE)
3012 {
187bc588 3013 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3014 log_message = cb->arg;
3015 continue;
3016 }
3017
3018 /* The endpass "condition" just sets a flag to show it occurred. This is
3019 checked at compile time to be on an "accept" or "discard" item. */
3020
3021 if (cb->type == ACLC_ENDPASS)
3022 {
3023 *epp = TRUE;
3024 continue;
3025 }
3026
3027 /* For other conditions and modifiers, the argument is expanded now for some
3028 of them, but not for all, because expansion happens down in some lower level
3029 checking functions in some cases. */
3030
3031 if (cond_expand_at_top[cb->type])
3032 {
3033 arg = expand_string(cb->arg);
3034 if (arg == NULL)
3035 {
3036 if (expand_string_forcedfail) continue;
3037 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3038 cb->arg, expand_string_message);
3039 return search_find_defer? DEFER : ERROR;
3040 }
3041 }
3042 else arg = cb->arg;
3043
3044 /* Show condition, and expanded condition if it's different */
3045
3046 HDEBUG(D_acl)
3047 {
3048 int lhswidth = 0;
3049 debug_printf("check %s%s %n",
3050 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3051 conditions[cb->type], &lhswidth);
3052
3053 if (cb->type == ACLC_SET)
3054 {
38a0a95f
PH		 3055 debug_printf("acl_%s ", cb->u.varname);
3056 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3057 }
3058
3059 debug_printf("= %s\n", cb->arg);
3060
3061 if (arg != cb->arg)
3062 debug_printf("%.*s= %s\n", lhswidth,
3063 US" ", CS arg);
3064 }
3065
3066 /* Check that this condition makes sense at this time */
3067
3068 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3069 {
3070 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3071 cond_modifiers[cb->type]? "use" : "test",
3072 conditions[cb->type], acl_wherenames[where]);
3073 return ERROR;
3074 }
3075
3076 /* Run the appropriate test for each condition, or take the appropriate
3077 action for the remaining modifiers. */
3078
3079 switch(cb->type)
3080 {
71fafd95
PH		 3081 case ACLC_ADD_HEADER:
3082 setup_header(arg);
3083 break;
3084
059ec3d9
PH		 3085 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3086 "discard" verb. */
71fafd95 3087
059ec3d9 3088 case ACLC_ACL:
f60d98e8 3089 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3090 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3091 {
3092 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3093 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3094 verbs[verb]);
3095 return ERROR;
3096 }
059ec3d9
PH		 3097 break;
3098
3099 case ACLC_AUTHENTICATED:
3100 rc = (sender_host_authenticated == NULL)? FAIL :
3101 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3102 TRUE, NULL);
3103 break;
3104
71fafd95 3105 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3106 case ACLC_BMI_OPTIN:
3107 {
3108 int old_pool = store_pool;
3109 store_pool = POOL_PERM;
3110 bmi_current_optin = string_copy(arg);
3111 store_pool = old_pool;
3112 }
3113 break;
71fafd95 3114 #endif
8523533c 3115
059ec3d9 3116 case ACLC_CONDITION:
f3766eb5
NM		 3117 /* The true/false parsing here should be kept in sync with that used in
3118 expand.c when dealing with ECOND_BOOL so that we don't have too many
3119 different definitions of what can be a boolean. */
51c7471d
JH		 3120 if (*arg == '-'
3121 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3122 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3123 rc = (Uatoi(arg) == 0)? FAIL : OK;
3124 else
3125 rc = (strcmpic(arg, US"no") == 0 ||
3126 strcmpic(arg, US"false") == 0)? FAIL :
3127 (strcmpic(arg, US"yes") == 0 ||
3128 strcmpic(arg, US"true") == 0)? OK : DEFER;
3129 if (rc == DEFER)
3130 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3131 break;
3132
c3611384
PH		 3133 case ACLC_CONTINUE: /* Always succeeds */
3134 break;
3135
059ec3d9 3136 case ACLC_CONTROL:
c5fcb476 3137 {
55414b25
JH		 3138 const uschar *p = NULL;
3139 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3140
55414b25 3141 /* Check if this control makes sense at this time */
f7572e5a 3142
55414b25
JH		 3143 if ((control_forbids[control_type] & (1 << where)) != 0)
3144 {
3145 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3146 controls[control_type], acl_wherenames[where]);
3147 return ERROR;
3148 }
8800895a 3149
55414b25
JH		 3150 switch(control_type)
3151 {
3152 case CONTROL_AUTH_UNADVERTISED:
3153 allow_auth_unadvertised = TRUE;
3154 break;
3155
3156 #ifdef EXPERIMENTAL_BRIGHTMAIL
3157 case CONTROL_BMI_RUN:
3158 bmi_run = 1;
3159 break;
3160 #endif
3161
3162 #ifndef DISABLE_DKIM
3163 case CONTROL_DKIM_VERIFY:
3164 dkim_disable_verify = TRUE;
3165 #ifdef EXPERIMENTAL_DMARC
3166 /* Since DKIM was blocked, skip DMARC too */
3167 dmarc_disable_verify = TRUE;
3168 dmarc_enable_forensic = FALSE;
3169 #endif
3170 break;
3171 #endif
3172
3173 #ifdef EXPERIMENTAL_DMARC
3174 case CONTROL_DMARC_VERIFY:
3175 dmarc_disable_verify = TRUE;
3176 break;
3177
3178 case CONTROL_DMARC_FORENSIC:
3179 dmarc_enable_forensic = TRUE;
3180 break;
3181 #endif
3182
3183 case CONTROL_DSCP:
3184 if (*p == '/')
3185 {
3186 int fd, af, level, optname, value;
3187 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3188 a socket; we can accept that, we'll just debug-log failures anyway. */
3189 fd = fileno(smtp_in);
3190 af = ip_get_address_family(fd);
3191 if (af < 0)
3192 {
3193 HDEBUG(D_acl)
3194 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3195 strerror(errno));
3196 break;
3197 }
3198 if (dscp_lookup(p+1, af, &level, &optname, &value))
3199 {
3200 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3201 {
3202 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3203 p+1, strerror(errno));
3204 }
3205 else
3206 {
3207 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3208 }
3209 }
3210 else
3211 {
3212 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3213 return ERROR;
3214 }
3215 }
3216 else
3217 {
3218 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3219 return ERROR;
3220 }
3221 break;
3222
3223 case CONTROL_ERROR:
3224 return ERROR;
3225
3226 case CONTROL_CASEFUL_LOCAL_PART:
3227 deliver_localpart = addr->cc_local_part;
3228 break;
3229
3230 case CONTROL_CASELOWER_LOCAL_PART:
3231 deliver_localpart = addr->lc_local_part;
3232 break;
3233
3234 case CONTROL_ENFORCE_SYNC:
3235 smtp_enforce_sync = TRUE;
3236 break;
3237
3238 case CONTROL_NO_ENFORCE_SYNC:
3239 smtp_enforce_sync = FALSE;
3240 break;
3241
3242 #ifdef WITH_CONTENT_SCAN
3243 case CONTROL_NO_MBOX_UNSPOOL:
3244 no_mbox_unspool = TRUE;
3245 break;
3246 #endif
3247
3248 case CONTROL_NO_MULTILINE:
3249 no_multiline_responses = TRUE;
3250 break;
3251
3252 case CONTROL_NO_PIPELINING:
3253 pipelining_enable = FALSE;
3254 break;
3255
3256 case CONTROL_NO_DELAY_FLUSH:
3257 disable_delay_flush = TRUE;
3258 break;
3259
3260 case CONTROL_NO_CALLOUT_FLUSH:
3261 disable_callout_flush = TRUE;
3262 break;
3263
3264 case CONTROL_FAKEREJECT:
3265 cancel_cutthrough_connection("fakereject");
3266 case CONTROL_FAKEDEFER:
3267 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3268 if (*p == '/')
3269 {
3270 const uschar *pp = p + 1;
3271 while (*pp != 0) pp++;
3272 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3273 p = pp;
3274 }
3275 else
3276 {
3277 /* Explicitly reset to default string */
3278 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3279 }
3280 break;
ed7f7860 3281
55414b25
JH		 3282 case CONTROL_FREEZE:
3283 deliver_freeze = TRUE;
3284 deliver_frozen_at = time(NULL);
3285 freeze_tell = freeze_tell_config; /* Reset to configured value */
3286 if (Ustrncmp(p, "/no_tell", 8) == 0)
3287 {
3288 p += 8;
3289 freeze_tell = NULL;
3290 }
3291 if (*p != 0)
3292 {
3293 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3294 return ERROR;
3295 }
3296 cancel_cutthrough_connection("item frozen");
3297 break;
3298
3299 case CONTROL_QUEUE_ONLY:
3300 queue_only_policy = TRUE;
3301 cancel_cutthrough_connection("queueing forced");
3302 break;
3303
3304 case CONTROL_SUBMISSION:
3305 originator_name = US"";
3306 submission_mode = TRUE;
3307 while (*p == '/')
3308 {
3309 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3310 {
3311 p += 14;
3312 active_local_sender_retain = TRUE;
3313 active_local_from_check = FALSE;
3314 }
3315 else if (Ustrncmp(p, "/domain=", 8) == 0)
3316 {
3317 const uschar *pp = p + 8;
3318 while (*pp != 0 && *pp != '/') pp++;
3319 submission_domain = string_copyn(p+8, pp-p-8);
3320 p = pp;
3321 }
3322 /* The name= option must be last, because it swallows the rest of
3323 the string. */
3324 else if (Ustrncmp(p, "/name=", 6) == 0)
3325 {
3326 const uschar *pp = p + 6;
3327 while (*pp != 0) pp++;
3328 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3329 big_buffer, big_buffer_size));
3330 p = pp;
3331 }
3332 else break;
3333 }
3334 if (*p != 0)
3335 {
3336 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3337 return ERROR;
3338 }
3339 break;
e4bdf652 3340
55414b25 3341 case CONTROL_DEBUG:
55414b25 3342 {
b0d68adc
JH		 3343 uschar * debug_tag = NULL;
3344 uschar * debug_opts = NULL;
3345 BOOL kill = FALSE;
3346
3347 while (*p == '/')
55414b25 3348 {
b0d68adc
JH		 3349 const uschar * pp = p+1;
3350 if (Ustrncmp(pp, "tag=", 4) == 0)
3351 {
3352 for (pp += 4; *pp && *pp != '/';) pp++;
3353 debug_tag = string_copyn(p+5, pp-p-5);
3354 }
3355 else if (Ustrncmp(pp, "opts=", 5) == 0)
3356 {
3357 for (pp += 5; *pp && *pp != '/';) pp++;
3358 debug_opts = string_copyn(p+6, pp-p-6);
3359 }
3360 else if (Ustrncmp(pp, "kill", 4) == 0)
3361 {
3362 for (pp += 4; *pp && *pp != '/';) pp++;
3363 kill = TRUE;
3364 }
3365 else
3366 while (*pp && *pp != '/') pp++;
55414b25
JH		 3367 p = pp;
3368 }
b0d68adc
JH		 3369
3370 if (kill)
3371 debug_logging_stop();
3372 else
3373 debug_logging_activate(debug_tag, debug_opts);
55414b25 3374 }
55414b25
JH		 3375 break;
3376
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 suppress_local_fixups = TRUE;
3379 break;
3380
3381 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3382#ifndef DISABLE_PRDR
55414b25 3383 if (prdr_requested)
a2b89db1
PP		 3384#else
3385 if (0)
3386#endif
55414b25
JH		 3387 /* Too hard to think about for now. We might in future cutthrough
3388 the case where both sides handle prdr and this-node prdr acl
3389 is "accept" */
93a6fce2 3390 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3391 else
3392 {
55414b25
JH		 3393 if (deliver_freeze)
3394 *log_msgptr = US"frozen";
3395 else if (queue_only_policy)
3396 *log_msgptr = US"queue-only";
3397 else if (fake_response == FAIL)
3398 *log_msgptr = US"fakereject";
3399 else
3400 {
3401 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3402 break;
3403 }
3404 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3405 arg, *log_msgptr);
5032d1cf 3406 }
55414b25 3407 return ERROR;
3c8b3577 3408
8c5d388a 3409#ifdef SUPPORT_I18N
3c8b3577
JH		 3410 case CONTROL_UTF8_DOWNCONVERT:
3411 if (*p == '/')
3412 {
921dfc11
JH		 3413 if (p[1] == '1')
3414 {
3415 message_utf8_downconvert = 1;
3416 addr->prop.utf8_downcvt = TRUE;
3417 addr->prop.utf8_downcvt_maybe = FALSE;
3418 p += 2;
3419 break;
3420 }
3421 if (p[1] == '0')
3422 {
3423 message_utf8_downconvert = 0;
3424 addr->prop.utf8_downcvt = FALSE;
3425 addr->prop.utf8_downcvt_maybe = FALSE;
3426 p += 2;
3427 break;
3428 }
3c8b3577 3429 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3430 {
3431 message_utf8_downconvert = -1;
3432 addr->prop.utf8_downcvt = FALSE;
3433 addr->prop.utf8_downcvt_maybe = TRUE;
3434 p += 3;
3435 break;
3436 }
3c8b3577
JH		 3437 *log_msgptr = US"bad option value for control=utf8_downconvert";
3438 }
3439 else
3440 {
921dfc11
JH		 3441 message_utf8_downconvert = 1;
3442 addr->prop.utf8_downcvt = TRUE;
3443 addr->prop.utf8_downcvt_maybe = FALSE;
3444 break;
3c8b3577
JH		 3445 }
3446 return ERROR;
8c5d388a 3447#endif
3c8b3577 3448
9171d434 3449 }
55414b25 3450 break;
059ec3d9 3451 }
059ec3d9 3452
6a8f9482
TK		 3453 #ifdef EXPERIMENTAL_DCC
3454 case ACLC_DCC:
3455 {
3456 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3457 const uschar * list = arg;
3458 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3459 /* Run the dcc backend. */
3460 rc = dcc_process(&ss);
3461 /* Modify return code based upon the existance of options. */
3c8b3577 3462 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3463 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3464 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3465 }
3466 break;
3467 #endif
3468
71fafd95 3469 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3470 case ACLC_DECODE:
3471 rc = mime_decode(&arg);
3472 break;
71fafd95 3473 #endif
8523533c 3474
059ec3d9
PH		 3475 case ACLC_DELAY:
3476 {
3477 int delay = readconf_readtime(arg, 0, FALSE);
3478 if (delay < 0)
3479 {
3480 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3481 "modifier: \"%s\" is not a time value", arg);
3482 return ERROR;
3483 }
3484 else
3485 {
3486 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3487 delay);
3488 if (host_checking)
3489 {
3490 HDEBUG(D_acl)
3491 debug_printf("delay skipped in -bh checking mode\n");
3492 }
010c2d14 3493
ae9d18bc
JH		 3494 /* NOTE 1: Remember that we may be
3495 dealing with stdin/stdout here, in addition to TCP/IP connections.
3496 Also, delays may be specified for non-SMTP input, where smtp_out and
3497 smtp_in will be NULL. Whatever is done must work in all cases.
3498
3499 NOTE 2: The added feature of flushing the output before a delay must
3500 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3501 */
3502
3503 else
3504 {
3505 if (smtp_out != NULL && !disable_delay_flush)
3506 mac_smtp_fflush();
3507
861a7c51 3508#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3509 {
3510 struct pollfd p;
3511 nfds_t n = 0;
3512 if (smtp_out)
3513 {
3514 p.fd = fileno(smtp_out);
3515 p.events = POLLRDHUP;
3516 n = 1;
3517 }
3518 if (poll(&p, n, delay*1000) > 0)
3519 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3520 }
3521#else
010c2d14
PH		 3522 /* It appears to be impossible to detect that a TCP/IP connection has
3523 gone away without reading from it. This means that we cannot shorten
3524 the delay below if the client goes away, because we cannot discover
3525 that the client has closed its end of the connection. (The connection
3526 is actually in a half-closed state, waiting for the server to close its
3527 end.) It would be nice to be able to detect this state, so that the
3528 Exim process is not held up unnecessarily. However, it seems that we
3529 can't. The poll() function does not do the right thing, and in any case
3530 it is not always available.
047bdd8c 3531 */
010c2d14 3532
86b8287f 3533 while (delay > 0) delay = sleep(delay);
ae9d18bc 3534#endif
8e669ac1 3535 }
059ec3d9
PH		 3536 }
3537 }
3538 break;
3539
80a47a2c
TK		 3540 #ifndef DISABLE_DKIM
3541 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3542 if (dkim_cur_signer != NULL)
3543 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3544 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3545 else
b0b9dbb1 3546 rc = FAIL;
71fafd95
PH		 3547 break;
3548
80a47a2c
TK		 3549 case ACLC_DKIM_STATUS:
3550 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3551 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3552 break;
3553 #endif
fb2274d4 3554
4840604e
TL		 3555 #ifdef EXPERIMENTAL_DMARC
3556 case ACLC_DMARC_STATUS:
4a8ce2d8 3557 if (!dmarc_has_been_checked)
4840604e 3558 dmarc_process();
4a8ce2d8 3559 dmarc_has_been_checked = TRUE;
4840604e
TL		 3560 /* used long way of dmarc_exim_expand_query() in case we need more
3561 * view into the process in the future. */
3562 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3563 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3564 break;
3565 #endif
3566
059ec3d9 3567 case ACLC_DNSLISTS:
379ba7d0 3568 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3569 break;
3570
3571 case ACLC_DOMAINS:
3572 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3573 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3574 break;
3575
3576 /* The value in tls_cipher is the full cipher name, for example,
3577 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3578 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3579 what may in practice come out of the SSL library - which at the time of
3580 writing is poorly documented. */
3581
3582 case ACLC_ENCRYPTED:
817d9f57 3583 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3584 {
3585 uschar *endcipher = NULL;
817d9f57
JH		 3586 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3587 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3588 {
3589 endcipher = Ustrchr(++cipher, ':');
3590 if (endcipher != NULL) *endcipher = 0;
3591 }
3592 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3593 if (endcipher != NULL) *endcipher = ':';
3594 }
3595 break;
3596
3597 /* Use verify_check_this_host() instead of verify_check_host() so that
3598 we can pass over &host_data to catch any looked up data. Once it has been
3599 set, it retains its value so that it's still there if another ACL verb
3600 comes through here and uses the cache. However, we must put it into
3601 permanent store in case it is also expected to be used in a subsequent
3602 message in the same SMTP connection. */
3603
3604 case ACLC_HOSTS:
3605 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3606 (sender_host_address == NULL)? US"" : sender_host_address,
3607 CUSS &host_data);
4a452c43
JH		 3608 if (rc == DEFER) *log_msgptr = search_error_message;
3609 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3610 break;
3611
3612 case ACLC_LOCAL_PARTS:
3613 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3614 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3615 CUSS &deliver_localpart_data);
059ec3d9
PH		 3616 break;
3617
6ea85e9a
PH		 3618 case ACLC_LOG_REJECT_TARGET:
3619 {
3620 int logbits = 0;
3621 int sep = 0;
55414b25 3622 const uschar *s = arg;
6ea85e9a 3623 uschar *ss;
4a452c43 3624 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3625 {
3626 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3627 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3628 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3629 else
3630 {
3631 logbits |= LOG_MAIN|LOG_REJECT;
3632 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3633 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3634 }
3635 }
3636 log_reject_target = logbits;
3637 }
3638 break;
3639
059ec3d9
PH		 3640 case ACLC_LOGWRITE:
3641 {
3642 int logbits = 0;
55414b25 3643 const uschar *s = arg;
059ec3d9
PH		 3644 if (*s == ':')
3645 {
3646 s++;
3647 while (*s != ':')
3648 {
3649 if (Ustrncmp(s, "main", 4) == 0)
3650 { logbits |= LOG_MAIN; s += 4; }
3651 else if (Ustrncmp(s, "panic", 5) == 0)
3652 { logbits |= LOG_PANIC; s += 5; }
3653 else if (Ustrncmp(s, "reject", 6) == 0)
3654 { logbits |= LOG_REJECT; s += 6; }
3655 else
3656 {
3657 logbits = LOG_MAIN|LOG_PANIC;
3658 s = string_sprintf(":unknown log name in \"%s\" in "
3659 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3660 }
3661 if (*s == ',') s++;
3662 }
3663 s++;
3664 }
3665 while (isspace(*s)) s++;
6ea85e9a
PH		 3666
3667
059ec3d9
PH		 3668 if (logbits == 0) logbits = LOG_MAIN;
3669 log_write(0, logbits, "%s", string_printing(s));
3670 }
3671 break;
8e669ac1 3672
71fafd95 3673 #ifdef WITH_CONTENT_SCAN
0f0c8159 3674 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3675 {
6ea85e9a 3676 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3677 const uschar * list = arg;
3678 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3679 uschar *opt;
3680 BOOL defer_ok = FALSE;
3681 int timeout = 0;
3682
55414b25 3683 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3684 if (strcmpic(opt, US"defer_ok") == 0)
3685 defer_ok = TRUE;
3686 else if ( strncmpic(opt, US"tmo=", 4) == 0
3687 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3688 )
3689 {
3690 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3691 return ERROR;
3692 }
3693
3694 rc = malware(ss, timeout);
3695 if (rc == DEFER && defer_ok)
3696 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3697 }
3698 break;
3699
3700 case ACLC_MIME_REGEX:
71fafd95 3701 rc = mime_regex(&arg);
8523533c 3702 break;
71fafd95 3703 #endif
059ec3d9 3704
b0b9dbb1
JH		 3705 case ACLC_QUEUE:
3706 queue_name = string_copy_malloc(arg);
3707 break;
3708
870f6ba8 3709 case ACLC_RATELIMIT:
90fc3069 3710 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3711 break;
3712
059ec3d9 3713 case ACLC_RECIPIENTS:
55414b25
JH		 3714 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3715 CUSS &recipient_data);
059ec3d9
PH		 3716 break;
3717
71fafd95
PH		 3718 #ifdef WITH_CONTENT_SCAN
3719 case ACLC_REGEX:
3720 rc = regex(&arg);
8523533c 3721 break;
71fafd95 3722 #endif
8523533c 3723
e7568d51
TL		 3724 case ACLC_REMOVE_HEADER:
3725 setup_remove_header(arg);
3726 break;
3727
059ec3d9
PH		 3728 case ACLC_SENDER_DOMAINS:
3729 {
3730 uschar *sdomain;
3731 sdomain = Ustrrchr(sender_address, '@');
3732 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3733 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3734 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3735 }
3736 break;
3737
3738 case ACLC_SENDERS:
55414b25
JH		 3739 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3740 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3741 break;
3742
3743 /* Connection variables must persist forever */
3744
3745 case ACLC_SET:
3746 {
3747 int old_pool = store_pool;
5ef5dd52 3748 if ( cb->u.varname[0] == 'c'
0cbf2b82 3749#ifndef DISABLE_EVENT
5ef5dd52
JB		 3750 || event_name /* An event is being delivered */
3751#endif
3752 )
3753 store_pool = POOL_PERM;
38a0a95f 3754 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3755 store_pool = old_pool;
3756 }
3757 break;
3758
71fafd95 3759 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3760 case ACLC_SPAM:
3761 {
3762 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3763 const uschar * list = arg;
3764 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3765 /* Run the spam backend. */
55414b25 3766 rc = spam(CUSS &ss);
8523533c 3767 /* Modify return code based upon the existance of options. */
55414b25 3768 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3769 != NULL) {
3770 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3771 {
3772 /* FAIL so that the message is passed to the next ACL */
3773 rc = FAIL;
3774 }
3775 }
3776 }
3777 break;
71fafd95 3778 #endif
8523533c 3779
71fafd95 3780 #ifdef EXPERIMENTAL_SPF
8523533c 3781 case ACLC_SPF:
65a7d8c3
NM		 3782 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3783 break;
3784 case ACLC_SPF_GUESS:
3785 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3786 break;
71fafd95 3787 #endif
8523533c 3788
b0019c78
TF		 3789 case ACLC_UDPSEND:
3790 rc = acl_udpsend(arg, log_msgptr);
3791 break;
3792
059ec3d9
PH		 3793 /* If the verb is WARN, discard any user message from verification, because
3794 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3795 only from explicit "message" modifiers. However, put the user message into
3796 $acl_verify_message so it can be used in subsequent conditions or modifiers
3797 (until something changes it). */
059ec3d9
PH		 3798
3799 case ACLC_VERIFY:
3800 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3801 if (*user_msgptr)
3802 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3803 if (verb == ACL_WARN) *user_msgptr = NULL;
3804 break;
3805
3806 default:
3807 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3808 "condition %d", cb->type);
3809 break;
3810 }
3811
3812 /* If a condition was negated, invert OK/FAIL. */
3813
3814 if (!cond_modifiers[cb->type] && cb->u.negated)
3815 {
3816 if (rc == OK) rc = FAIL;
3817 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3818 }
3819
3820 if (rc != OK) break; /* Conditions loop */
3821 }
3822
3823
3824/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3825handle the values of these modifiers. If there isn't a log message set, we make
3826it the same as the user message.
059ec3d9
PH		 3827
3828"message" is a user message that will be included in an SMTP response. Unless
3829it is empty, it overrides any previously set user message.
3830
3831"log_message" is a non-user message, and it adds to any existing non-user
3832message that is already set.
3833
4e88a19f
PH		 3834Most verbs have but a single return for which the messages are relevant, but
3835for "discard", it's useful to have the log message both when it succeeds and
3836when it fails. For "accept", the message is used in the OK case if there is no
3837"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3838present. */
059ec3d9 3839
4e88a19f
PH		 3840if (*epp && rc == OK) user_message = NULL;
3841
3842if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3843 {
3844 uschar *expmessage;
4e88a19f
PH		 3845 uschar *old_user_msgptr = *user_msgptr;
3846 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3847
3848 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3849 nested ACLs) are always discarded. This also happens for acceptance verbs
3850 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3851 However, the value of an existing message is available in $acl_verify_message
3852 during expansions. */
3853
4e88a19f
PH		 3854 if (verb == ACL_WARN ||
3855 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3856 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3857
3858 if (user_message != NULL)
3859 {
3860 acl_verify_message = old_user_msgptr;
3861 expmessage = expand_string(user_message);
3862 if (expmessage == NULL)
3863 {
3864 if (!expand_string_forcedfail)
3865 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3866 user_message, expand_string_message);
3867 }
3868 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3869 }
3870
3871 if (log_message != NULL)
3872 {
3873 acl_verify_message = old_log_msgptr;
3874 expmessage = expand_string(log_message);
3875 if (expmessage == NULL)
3876 {
3877 if (!expand_string_forcedfail)
3878 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3879 log_message, expand_string_message);
3880 }
3881 else if (expmessage[0] != 0)
3882 {
3883 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3884 string_sprintf("%s: %s", expmessage, *log_msgptr);
3885 }
3886 }
3887
3888 /* If no log message, default it to the user message */
3889
3890 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3891 }
3892
3893acl_verify_message = NULL;
3894return rc;
3895}
3896
3897
3898
3899
3900
3901/*************************************************
3902* Get line from a literal ACL *
3903*************************************************/
3904
3905/* This function is passed to acl_read() in order to extract individual lines
3906of a literal ACL, which we access via static pointers. We can destroy the
3907contents because this is called only once (the compiled ACL is remembered).
3908
3909This code is intended to treat the data in the same way as lines in the main
3910Exim configuration file. That is:
3911
3912 . Leading spaces are ignored.
3913
3914 . A \ at the end of a line is a continuation - trailing spaces after the \
3915 are permitted (this is because I don't believe in making invisible things
3916 significant). Leading spaces on the continued part of a line are ignored.
3917
3918 . Physical lines starting (significantly) with # are totally ignored, and
3919 may appear within a sequence of backslash-continued lines.
3920
3921 . Blank lines are ignored, but will end a sequence of continuations.
3922
3923Arguments: none
3924Returns: a pointer to the next line
3925*/
3926
3927
3928static uschar *acl_text; /* Current pointer in the text */
3929static uschar *acl_text_end; /* Points one past the terminating '0' */
3930
3931
3932static uschar *
3933acl_getline(void)
3934{
3935uschar *yield;
3936
3937/* This loop handles leading blank lines and comments. */
3938
3939for(;;)
3940 {
3941 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3942 if (*acl_text == 0) return NULL; /* No more data */
3943 yield = acl_text; /* Potential data line */
3944
3945 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3946
3947 /* If we hit the end before a newline, we have the whole logical line. If
3948 it's a comment, there's no more data to be given. Otherwise, yield it. */
3949
3950 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3951
3952 /* After reaching a newline, end this loop if the physical line does not
3953 start with '#'. If it does, it's a comment, and the loop continues. */
3954
3955 if (*yield != '#') break;
3956 }
3957
3958/* This loop handles continuations. We know we have some real data, ending in
3959newline. See if there is a continuation marker at the end (ignoring trailing
3960white space). We know that *yield is not white space, so no need to test for
3961cont > yield in the backwards scanning loop. */
3962
3963for(;;)
3964 {
3965 uschar *cont;
3966 for (cont = acl_text - 1; isspace(*cont); cont--);
3967
3968 /* If no continuation follows, we are done. Mark the end of the line and
3969 return it. */
3970
3971 if (*cont != '\\')
3972 {
3973 *acl_text++ = 0;
3974 return yield;
3975 }
3976
3977 /* We have encountered a continuation. Skip over whitespace at the start of
3978 the next line, and indeed the whole of the next line or lines if they are
3979 comment lines. */
3980
3981 for (;;)
3982 {
3983 while (*(++acl_text) == ' ' || *acl_text == '\t');
3984 if (*acl_text != '#') break;
3985 while (*(++acl_text) != 0 && *acl_text != '\n');
3986 }
3987
3988 /* We have the start of a continuation line. Move all the rest of the data
3989 to join onto the previous line, and then find its end. If the end is not a
3990 newline, we are done. Otherwise loop to look for another continuation. */
3991
3992 memmove(cont, acl_text, acl_text_end - acl_text);
3993 acl_text_end -= acl_text - cont;
3994 acl_text = cont;
3995 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3996 if (*acl_text == 0) return yield;
3997 }
3998
3999/* Control does not reach here */
4000}
4001
4002
4003
4004
4005
4006/*************************************************
4007* Check access using an ACL *
4008*************************************************/
4009
4010/* This function is called from address_check. It may recurse via
4011acl_check_condition() - hence the use of a level to stop looping. The ACL is
4012passed as a string which is expanded. A forced failure implies no access check
4013is required. If the result is a single word, it is taken as the name of an ACL
4014which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4015text, complete with newlines, and parsed as such. In both cases, the ACL check
4016is then run. This function uses an auxiliary function for acl_read() to call
4017for reading individual lines of a literal ACL. This is acl_getline(), which
4018appears immediately above.
4019
4020Arguments:
4021 where where called from
4022 addr address item when called from RCPT; otherwise NULL
4023 s the input string; NULL is the same as an empty ACL => DENY
4024 level the nesting level
4025 user_msgptr where to put a user error (for SMTP response)
4026 log_msgptr where to put a logging message (not for SMTP response)
4027
4028Returns: OK access is granted
4029 DISCARD access is apparently granted...
4030 FAIL access is denied
4031 FAIL_DROP access is denied; drop the connection
4032 DEFER can't tell at the moment
4033 ERROR disaster
4034*/
4035
4036static int
4037acl_check_internal(int where, address_item *addr, uschar *s, int level,
4038 uschar **user_msgptr, uschar **log_msgptr)
4039{
4040int fd = -1;
4041acl_block *acl = NULL;
4042uschar *acl_name = US"inline ACL";
4043uschar *ss;
4044
4045/* Catch configuration loops */
4046
4047if (level > 20)
4048 {
4049 *log_msgptr = US"ACL nested too deep: possible loop";
4050 return ERROR;
4051 }
4052
4053if (s == NULL)
4054 {
4055 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4056 return FAIL;
4057 }
4058
4059/* At top level, we expand the incoming string. At lower levels, it has already
4060been expanded as part of condition processing. */
4061
4062if (level == 0)
4063 {
4064 ss = expand_string(s);
4065 if (ss == NULL)
4066 {
4067 if (expand_string_forcedfail) return OK;
4068 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4069 expand_string_message);
4070 return ERROR;
4071 }
4072 }
4073else ss = s;
4074
4075while (isspace(*ss))ss++;
4076
4077/* If we can't find a named ACL, the default is to parse it as an inline one.
4078(Unless it begins with a slash; non-existent files give rise to an error.) */
4079
4080acl_text = ss;
4081
4082/* Handle the case of a string that does not contain any spaces. Look for a
4083named ACL among those read from the configuration, or a previously read file.
4084It is possible that the pointer to the ACL is NULL if the configuration
4085contains a name with no data. If not found, and the text begins with '/',
4086read an ACL from a file, and save it so it can be re-used. */
4087
4088if (Ustrchr(ss, ' ') == NULL)
4089 {
4090 tree_node *t = tree_search(acl_anchor, ss);
4091 if (t != NULL)
4092 {
4093 acl = (acl_block *)(t->data.ptr);
4094 if (acl == NULL)
4095 {
4096 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4097 return FAIL;
4098 }
4099 acl_name = string_sprintf("ACL \"%s\"", ss);
4100 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4101 }
4102
4103 else if (*ss == '/')
4104 {
4105 struct stat statbuf;
4106 fd = Uopen(ss, O_RDONLY, 0);
4107 if (fd < 0)
4108 {
4109 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4110 strerror(errno));
4111 return ERROR;
4112 }
4113
4114 if (fstat(fd, &statbuf) != 0)
4115 {
4116 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4117 strerror(errno));
4118 return ERROR;
4119 }
4120
4121 acl_text = store_get(statbuf.st_size + 1);
4122 acl_text_end = acl_text + statbuf.st_size + 1;
4123
4124 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4125 {
4126 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4127 ss, strerror(errno));
4128 return ERROR;
4129 }
4130 acl_text[statbuf.st_size] = 0;
f1e894f3 4131 (void)close(fd);
059ec3d9
PH		 4132
4133 acl_name = string_sprintf("ACL \"%s\"", ss);
4134 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4135 }
4136 }
4137
4138/* Parse an ACL that is still in text form. If it came from a file, remember it
4139in the ACL tree, having read it into the POOL_PERM store pool so that it
4140persists between multiple messages. */
4141
4142if (acl == NULL)
4143 {
4144 int old_pool = store_pool;
4145 if (fd >= 0) store_pool = POOL_PERM;
4146 acl = acl_read(acl_getline, log_msgptr);
4147 store_pool = old_pool;
4148 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4149 if (fd >= 0)
4150 {
4151 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4152 Ustrcpy(t->name, ss);
4153 t->data.ptr = acl;
4154 (void)tree_insertnode(&acl_anchor, t);
4155 }
4156 }
4157
4158/* Now we have an ACL to use. It's possible it may be NULL. */
4159
4160while (acl != NULL)
4161 {
4162 int cond;
4163 int basic_errno = 0;
4164 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4165 BOOL acl_quit_check = level == 0
4166 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4167
4168 *log_msgptr = *user_msgptr = NULL;
4169 acl_temp_details = FALSE;
4170
059ec3d9
PH		 4171 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4172
4173 /* Clear out any search error message from a previous check before testing
4174 this condition. */
4175
4176 search_error_message = NULL;
4177 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4178 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4179
4180 /* Handle special returns: DEFER causes a return except on a WARN verb;
4181 ERROR always causes a return. */
4182
4183 switch (cond)
4184 {
4185 case DEFER:
6968512f 4186 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4187 if (basic_errno != ERRNO_CALLOUTDEFER)
4188 {
4189 if (search_error_message != NULL && *search_error_message != 0)
4190 *log_msgptr = search_error_message;
4191 if (smtp_return_error_details) acl_temp_details = TRUE;
4192 }
4193 else
4194 {
4195 acl_temp_details = TRUE;
4196 }
4197 if (acl->verb != ACL_WARN) return DEFER;
4198 break;
4199
4200 default: /* Paranoia */
4201 case ERROR:
6968512f 4202 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4203 return ERROR;
4204
4205 case OK:
6968512f
JH		 4206 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4207 verbs[acl->verb], acl_name);
059ec3d9
PH		 4208 break;
4209
4210 case FAIL:
6968512f 4211 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4212 break;
4213
4214 /* DISCARD and DROP can happen only from a nested ACL condition, and
4215 DISCARD can happen only for an "accept" or "discard" verb. */
4216
4217 case DISCARD:
6968512f
JH		 4218 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4219 verbs[acl->verb], acl_name);
059ec3d9
PH		 4220 break;
4221
4222 case FAIL_DROP:
6968512f
JH		 4223 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4224 verbs[acl->verb], acl_name);
059ec3d9
PH		 4225 break;
4226 }
4227
4228 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4229 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4230 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4231
4232 switch(acl->verb)
4233 {
4234 case ACL_ACCEPT:
a7538db1
JH		 4235 if (cond == OK || cond == DISCARD)
4236 {
4237 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4238 return cond;
4239 }
059ec3d9
PH		 4240 if (endpass_seen)
4241 {
4242 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4243 return cond;
4244 }
4245 break;
4246
4247 case ACL_DEFER:
4248 if (cond == OK)
4249 {
a7538db1 4250 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4251 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4252 acl_temp_details = TRUE;
4253 return DEFER;
4254 }
4255 break;
4256
4257 case ACL_DENY:
a7538db1
JH		 4258 if (cond == OK)
4259 {
4260 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4261 if (acl_quit_check) goto badquit;
a7538db1
JH		 4262 return FAIL;
4263 }
059ec3d9
PH		 4264 break;
4265
4266 case ACL_DISCARD:
a7538db1
JH		 4267 if (cond == OK || cond == DISCARD)
4268 {
4269 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4270 if (acl_quit_check) goto badquit;
a7538db1
JH		 4271 return DISCARD;
4272 }
059ec3d9
PH		 4273 if (endpass_seen)
4274 {
4275 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4276 return cond;
4277 }
4278 break;
4279
4280 case ACL_DROP:
a7538db1
JH		 4281 if (cond == OK)
4282 {
4283 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4284 if (acl_quit_check) goto badquit;
a7538db1
JH		 4285 return FAIL_DROP;
4286 }
059ec3d9
PH		 4287 break;
4288
4289 case ACL_REQUIRE:
a7538db1
JH		 4290 if (cond != OK)
4291 {
4292 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4293 if (acl_quit_check) goto badquit;
a7538db1
JH		 4294 return cond;
4295 }
059ec3d9
PH		 4296 break;
4297
4298 case ACL_WARN:
4299 if (cond == OK)
4300 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4301 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4302 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4303 "condition test deferred%s%s", host_and_ident(TRUE),
4304 (*log_msgptr == NULL)? US"" : US": ",
4305 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4306 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4307 break;
4308
4309 default:
4310 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4311 acl->verb);
4312 break;
4313 }
4314
4315 /* Pass to the next ACL item */
4316
4317 acl = acl->next;
4318 }
4319
4320/* We have reached the end of the ACL. This is an implicit DENY. */
4321
4322HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4323return FAIL;
82c0c8ea
JH		 4324
4325badquit:
4326 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4327 "('%s' verb used incorrectly)", verbs[acl->verb]);
4328 return ERROR;
059ec3d9
PH		 4329}
4330
4331
333eea9c
JH		 4332
4333
4334/* Same args as acl_check_internal() above, but the string s is
4335the name of an ACL followed optionally by up to 9 space-separated arguments.
4336The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4337static int
55414b25 4338acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4339 uschar **user_msgptr, uschar **log_msgptr)
4340{
4341uschar * tmp;
bef3ea7f 4342uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4343uschar * sav_arg[9]; /* must match acl_arg[] */
4344int sav_narg;
333eea9c 4345uschar * name;
bef3ea7f 4346int i;
ef21c07d 4347int ret;
333eea9c
JH		 4348
4349if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4350 goto bad;
4351
bef3ea7f 4352for (i = 0; i < 9; i++)
333eea9c
JH		 4353 {
4354 while (*s && isspace(*s)) s++;
4355 if (!*s) break;
bef3ea7f 4356 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4357 {
4358 tmp = name;
4359 goto bad;
4360 }
4361 }
ef21c07d
JH		 4362
4363sav_narg = acl_narg;
bef3ea7f 4364acl_narg = i;
ef21c07d
JH		 4365for (i = 0; i < acl_narg; i++)
4366 {
4367 sav_arg[i] = acl_arg[i];
4368 acl_arg[i] = tmp_arg[i];
4369 }
4370while (i < 9)
4371 {
4372 sav_arg[i] = acl_arg[i];
4373 acl_arg[i++] = NULL;
4374 }
4375
4376ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4377
ef21c07d
JH		 4378acl_narg = sav_narg;
4379for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4380return ret;
333eea9c
JH		 4381
4382bad:
4383if (expand_string_forcedfail) return ERROR;
4384*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4385 tmp, expand_string_message);
4386return search_find_defer?DEFER:ERROR;
4387}
4388
4389
4390
059ec3d9
PH		 4391/*************************************************
4392* Check access using an ACL *
4393*************************************************/
4394
faa05a93
JH		 4395/* Alternate interface for ACL, used by expansions */
4396int
05caaeaa 4397acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4398{
faa05a93
JH		 4399address_item adb;
4400address_item *addr = NULL;
4401
4402*user_msgptr = *log_msgptr = NULL;
4403sender_verified_failed = NULL;
4404ratelimiters_cmd = NULL;
4405log_reject_target = LOG_MAIN|LOG_REJECT;
4406
4407if (where == ACL_WHERE_RCPT)
4408 {
4409 adb = address_defaults;
4410 addr = &adb;
05caaeaa
JH		 4411 addr->address = expand_string(US"$local_part@$domain");
4412 addr->domain = deliver_domain;
4413 addr->local_part = deliver_localpart;
4414 addr->cc_local_part = deliver_localpart;
4415 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4416 }
4417
4418return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4419}
4420
4421
4422
059ec3d9
PH		 4423/* This is the external interface for ACL checks. It sets up an address and the
4424expansions for $domain and $local_part when called after RCPT, then calls
4425acl_check_internal() to do the actual work.
4426
4427Arguments:
4428 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4429 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4430 s the input string; NULL is the same as an empty ACL => DENY
4431 user_msgptr where to put a user error (for SMTP response)
4432 log_msgptr where to put a logging message (not for SMTP response)
4433
4434Returns: OK access is granted by an ACCEPT verb
4435 DISCARD access is granted by a DISCARD verb
4436 FAIL access is denied
4437 FAIL_DROP access is denied; drop the connection
4438 DEFER can't tell at the moment
4439 ERROR disaster
4440*/
faa05a93 4441int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4442
4443int
64ffc24f 4444acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4445 uschar **log_msgptr)
4446{
4447int rc;
4448address_item adb;
64ffc24f 4449address_item *addr = NULL;
059ec3d9
PH		 4450
4451*user_msgptr = *log_msgptr = NULL;
4452sender_verified_failed = NULL;
fe0dab11 4453ratelimiters_cmd = NULL;
6ea85e9a 4454log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4455
8ccd00b1 4456#ifndef DISABLE_PRDR
4f6ae5c3 4457if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4458#else
4f6ae5c3 4459if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4460#endif
059ec3d9
PH		 4461 {
4462 adb = address_defaults;
4463 addr = &adb;
64ffc24f 4464 addr->address = recipient;
059ec3d9
PH		 4465 if (deliver_split_address(addr) == DEFER)
4466 {
4467 *log_msgptr = US"defer in percent_hack_domains check";
4468 return DEFER;
4469 }
8c5d388a 4470#ifdef SUPPORT_I18N
3c8b3577
JH		 4471 if ((addr->prop.utf8_msg = message_smtputf8))
4472 {
4473 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4474 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4475 }
9bfc60eb 4476#endif
059ec3d9
PH		 4477 deliver_domain = addr->domain;
4478 deliver_localpart = addr->local_part;
4479 }
059ec3d9 4480
faa05a93 4481acl_where = where;
059ec3d9 4482rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4483acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4484
817d9f57
JH		 4485/* Cutthrough - if requested,
4486and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4487and rcpt acl returned accept,
4488and first recipient (cancel on any subsequents)
e4bdf652 4489open one now and run it up to RCPT acceptance.
f9334a28
JH		 4490A failed verify should cancel cutthrough request,
4491and will pass the fail to the originator.
817d9f57 4492Initial implementation: dual-write to spool.
e4bdf652
JH		 4493Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4494
4495Cease cutthrough copy on rxd final dot; do not send one.
4496
4497On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4498
4499On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4500perm-rejected, reflect that to the original sender - and dump the spooled copy.
4501If temp-reject, close the conn (and keep the spooled copy).
4502If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4503*/
4504switch (where)
4505{
4506case ACL_WHERE_RCPT:
8ccd00b1 4507#ifndef DISABLE_PRDR
fd98a5c6
JH		 4508case ACL_WHERE_PRDR:
4509#endif
59eaad2b
JH		 4510 if (host_checking_callout) /* -bhc mode */
4511 cancel_cutthrough_connection("host-checking mode");
4512 else if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
f9334a28 4513 rc = open_cutthrough_connection(addr);
e4bdf652
JH		 4514 break;
4515
4516case ACL_WHERE_PREDATA:
59eaad2b 4517 if (rc == OK)
e4bdf652
JH		 4518 cutthrough_predata();
4519 else
2e5b33cd 4520 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4521 break;
4522
4523case ACL_WHERE_QUIT:
4524case ACL_WHERE_NOTQUIT:
2e5b33cd 4525 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4526 break;
4527
4528default:
4529 break;
4530}
4531
64ffc24f
PH		 4532deliver_domain = deliver_localpart = deliver_address_data =
4533 sender_address_data = NULL;
059ec3d9
PH		 4534
4535/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4536ACL, which is really in the middle of an SMTP command. */
4537
4538if (rc == DISCARD)
4539 {
4540 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4541 {
4542 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4543 "ACL", acl_wherenames[where]);
4544 return ERROR;
4545 }
4546 return DISCARD;
4547 }
4548
4549/* A DROP response is not permitted from MAILAUTH */
4550
4551if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4552 {
4553 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4554 "ACL", acl_wherenames[where]);
4555 return ERROR;
4556 }
4557
4e88a19f
PH		 4558/* Before giving a response, take a look at the length of any user message, and
4559split it up into multiple lines if possible. */
059ec3d9 4560
e28326d8
PH		 4561*user_msgptr = string_split_message(*user_msgptr);
4562if (fake_response != OK)
4563 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4564
4565return rc;
4566}
4567
38a0a95f 4568
38a0a95f
PH		 4569/*************************************************
4570* Create ACL variable *
4571*************************************************/
4572
4573/* Create an ACL variable or reuse an existing one. ACL variables are in a
4574binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4575
4576Argument:
4577 name pointer to the variable's name, starting with c or m
4578
4579Returns the pointer to variable's tree node
4580*/
4581
4582tree_node *
4583acl_var_create(uschar *name)
4584{
4585tree_node *node, **root;
4586root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4587node = tree_search(*root, name);
4588if (node == NULL)
4589 {
4590 node = store_get(sizeof(tree_node) + Ustrlen(name));
4591 Ustrcpy(node->name, name);
4592 (void)tree_insertnode(root, node);
4593 }
4594node->data.ptr = NULL;
4595return node;
4596}
4597
4598
4599
4600/*************************************************
4601* Write an ACL variable in spool format *
4602*************************************************/
4603
4604/* This function is used as a callback for tree_walk when writing variables to
4605the spool file. To retain spool file compatibility, what is written is -aclc or
4606-aclm followed by the rest of the name and the data length, space separated,
4607then the value itself, starting on a new line, and terminated by an additional
4608newline. When we had only numbered ACL variables, the first line might look
4609like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4610acl_cfoo.
4611
4612Arguments:
4613 name of the variable
4614 value of the variable
4615 ctx FILE pointer (as a void pointer)
4616
4617Returns: nothing
4618*/
4619
4620void
4621acl_var_write(uschar *name, uschar *value, void *ctx)
4622{
4623FILE *f = (FILE *)ctx;
4624fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4625}
4626
9171d434
JH		 4627/* vi: aw ai sw=2
4628*/
059ec3d9 4629/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.