projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
constification
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08 24static uschar *verbs[] = {
f2ed27cf
JH		 25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32};
059ec3d9 33
4e88a19f
PH		 34/* For each verb, the conditions for which "message" or "log_message" are used
35are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36"accept", the FAIL case is used only after "endpass", but that is selected in
37the code. */
38
39static int msgcond[] = {
e3a69b62
JH		 40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
4e88a19f 47 };
059ec3d9
PH		 48
49/* ACL condition and modifier codes - keep in step with the table that
2d009132 50follows.
71fafd95 51down. */
059ec3d9 52
71fafd95
PH		 53enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
8523533c
TK		 56#ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58#endif
71fafd95 59 ACLC_CONDITION,
c3611384 60 ACLC_CONTINUE,
71fafd95 61 ACLC_CONTROL,
6a8f9482
TK		 62#ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64#endif
8523533c
TK		 65#ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67#endif
68 ACLC_DELAY,
80a47a2c
TK		 69#ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
4840604e
TL		 72#endif
73#ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
8e669ac1 75#endif
71fafd95
PH		 76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
6ea85e9a 83 ACLC_LOG_REJECT_TARGET,
71fafd95 84 ACLC_LOGWRITE,
8523533c
TK		 85#ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87#endif
88 ACLC_MESSAGE,
89#ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91#endif
b0b9dbb1 92 ACLC_QUEUE,
870f6ba8 93 ACLC_RATELIMIT,
8523533c
TK		 94 ACLC_RECIPIENTS,
95#ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97#endif
e7568d51 98 ACLC_REMOVE_HEADER,
71fafd95
PH		 99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
8523533c 102#ifdef WITH_CONTENT_SCAN
8e669ac1 103 ACLC_SPAM,
8523533c 104#endif
7952eef9 105#ifdef SUPPORT_SPF
8523533c 106 ACLC_SPF,
65a7d8c3 107 ACLC_SPF_GUESS,
8523533c 108#endif
b0019c78 109 ACLC_UDPSEND,
8523533c 110 ACLC_VERIFY };
059ec3d9 111
c3611384 112/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 113"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH		 114modifiers that look like conditions but always return TRUE. They are used for
115their side effects. */
059ec3d9 116
2d009132
JH		 117typedef struct condition_def {
118 uschar *name;
c5fcb476 119
2d009132 120/* Flag to indicate the condition/modifier has a string expansion done
059ec3d9
PH		 121at the outer level. In the other cases, expansion already occurs in the
122checking functions. */
2d009132 123 BOOL expand_at_top:1;
059ec3d9 124
2d009132 125 BOOL is_modifier:1;
059ec3d9 126
2d009132
JH		 127/* Bit map vector of which conditions and modifiers are not allowed at certain
128times. For each condition and modifier, there's a bitmap of dis-allowed times.
129For some, it is easier to specify the negation of a small number of allowed
130times. */
131 unsigned forbids;
132
133} condition_def;
134
135static condition_def conditions[] = {
f2ed27cf 136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
2d009132 137
f2ed27cf
JH		 138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
e3a69b62
JH		 140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 142#ifndef DISABLE_PRDR
e3a69b62 143 ACL_BIT_PRDR |
2d009132 144#endif
e3a69b62
JH		 145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
2d009132 148 },
059ec3d9 149
f2ed27cf 150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
e3a69b62
JH		 151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
2d009132 153 },
8523533c 154#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf 155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
e3a69b62
JH		 156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
2d009132 159# ifndef DISABLE_PRDR
e3a69b62 160 ACL_BIT_PRDR |
2d009132 161# endif
e3a69b62
JH		 162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
2d009132 167 },
8e669ac1 168#endif
f2ed27cf
JH		 169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
2d009132
JH		 171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
f2ed27cf 174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
2d009132 175
6a8f9482 176#ifdef EXPERIMENTAL_DCC
f2ed27cf
JH		 177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
e3a69b62 179 ~(ACL_BIT_DATA |
2d009132 180# ifndef DISABLE_PRDR
e3a69b62 181 ACL_BIT_PRDR |
2d009132 182# endif
e3a69b62 183 ACL_BIT_NOTSMTP),
2d009132 184 },
6a8f9482 185#endif
8523533c 186#ifdef WITH_CONTENT_SCAN
e3a69b62 187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 188
8523533c 189#endif
e3a69b62 190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
80a47a2c 191#ifndef DISABLE_DKIM
e3a69b62
JH		 192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
4840604e
TL		 194#endif
195#ifdef EXPERIMENTAL_DMARC
e3a69b62 196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
8523533c 197#endif
059ec3d9 198
2d009132
JH		 199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
f2ed27cf 201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
c3611384 202
f2ed27cf
JH		 203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
e3a69b62 205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
2d009132 206#ifndef DISABLE_PRDR
e3a69b62 207 |ACL_BIT_PRDR
2d009132
JH		 208#endif
209 ),
210 },
f2ed27cf 211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
e3a69b62
JH		 212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
2d009132 214 },
8e669ac1 215
f2ed27cf 216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
8e669ac1 217
f2ed27cf 218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
e3a69b62 219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 220 },
f2ed27cf
JH		 221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
e3a69b62 223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
f2ed27cf 224#ifndef DISABLE_PRDR
e3a69b62 225 | ACL_BIT_PRDR
f2ed27cf 226#endif
2d009132
JH		 227 ),
228 },
6a8f9482 229
f2ed27cf 230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
e3a69b62 231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
f2ed27cf 232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
8523533c 233
2d009132 234#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH		 235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
e3a69b62 237 ~(ACL_BIT_DATA |
2d009132 238# ifndef DISABLE_PRDR
e3a69b62 239 ACL_BIT_PRDR |
2d009132 240# endif
e3a69b62 241 ACL_BIT_NOTSMTP),
2d009132
JH		 242 },
243#endif
8e669ac1 244
f2ed27cf 245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
2d009132 246#ifdef WITH_CONTENT_SCAN
e3a69b62 247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 248#endif
84330b7b 249
f2ed27cf 250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
e3a69b62 251 ACL_BIT_NOTSMTP |
2d009132 252#ifndef DISABLE_PRDR
e3a69b62 253 ACL_BIT_PRDR |
2d009132 254#endif
e3a69b62 255 ACL_BIT_DATA,
2d009132 256 },
fb2274d4 257
f2ed27cf 258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
e3a69b62 259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
4840604e 260
2d009132 261#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH		 262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
e3a69b62 264 ~(ACL_BIT_DATA |
2d009132 265# ifndef DISABLE_PRDR
e3a69b62 266 ACL_BIT_PRDR |
2d009132 267# endif
e3a69b62
JH		 268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
2d009132 270 },
379ba7d0 271
2d009132 272#endif
f2ed27cf
JH		 273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
e3a69b62
JH		 275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 277#ifndef DISABLE_PRDR
e3a69b62 278 ACL_BIT_PRDR |
2d009132 279#endif
e3a69b62
JH		 280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
2d009132 282 },
f2ed27cf 283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
e3a69b62
JH		 284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 289 },
f2ed27cf 290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
e3a69b62
JH		 291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 296 },
65a7d8c3 297
f2ed27cf 298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
8523533c 299
2d009132 300#ifdef WITH_CONTENT_SCAN
f2ed27cf 301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
e3a69b62 302 (unsigned int) ~(ACL_BIT_DATA |
2d009132 303# ifndef DISABLE_PRDR
e3a69b62 304 ACL_BIT_PRDR |
2d009132 305# endif
e3a69b62 306 ACL_BIT_NOTSMTP),
2d009132
JH		 307 },
308#endif
7952eef9 309#ifdef SUPPORT_SPF
f2ed27cf 310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
e3a69b62
JH		 311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 316 },
6e1a8743 317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
e3a69b62
JH		 318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132
JH		 323 },
324#endif
f2ed27cf 325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
b0019c78 326
059ec3d9
PH		 327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
f2ed27cf 329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
059ec3d9
PH		 330};
331
332
2d009132 333
d7bed771
JH		 334/* Return values from decode_control(); used as index so keep in step
335with the controls_list table that follows! */
c46782ef 336
d7bed771
JH		 337enum {
338 CONTROL_AUTH_UNADVERTISED,
3c8b3577 339#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 340 CONTROL_BMI_RUN,
3c8b3577 341#endif
d7bed771
JH		 342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
3c8b3577 346#ifndef DISABLE_DKIM
d7bed771 347 CONTROL_DKIM_VERIFY,
3c8b3577 348#endif
3c8b3577 349#ifdef EXPERIMENTAL_DMARC
d7bed771
JH		 350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
3c8b3577 352#endif
d7bed771
JH		 353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
4840604e 359
d7bed771
JH		 360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 363#ifdef WITH_CONTENT_SCAN
d7bed771 364 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 365#endif
d7bed771
JH		 366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
8523533c 368
d7bed771 369 CONTROL_QUEUE_ONLY,
8ac90765
JH		 370#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
371 CONTROL_REQUIRETLS,
372#endif
d7bed771
JH		 373 CONTROL_SUBMISSION,
374 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 375#ifdef SUPPORT_I18N
d7bed771 376 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 377#endif
d7bed771 378};
3c8b3577 379
4c590bd1 380
c5fcb476 381
d7bed771
JH		 382/* Structure listing various control arguments, with their characteristics.
383For each control, there's a bitmap of dis-allowed times. For some, it is easier
384to specify the negation of a small number of allowed times. */
059ec3d9
PH		 385
386typedef struct control_def {
d7bed771
JH		 387 uschar *name;
388 BOOL has_option; /* Has /option(s) following */
389 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH		 390} control_def;
391
392static control_def controls_list[] = {
f2ed27cf
JH		 393 /* name has_option forbids */
394[CONTROL_AUTH_UNADVERTISED] =
d7bed771 395 { US"allow_auth_unadvertised", FALSE,
f2ed27cf 396 (unsigned)
e3a69b62 397 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
d7bed771 398 },
8523533c 399#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH		 400[CONTROL_BMI_RUN] =
401 { US"bmi_run", FALSE, 0 },
fb2274d4 402#endif
f2ed27cf 403[CONTROL_CASEFUL_LOCAL_PART] =
e3a69b62 404 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf 405[CONTROL_CASELOWER_LOCAL_PART] =
e3a69b62 406 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf
JH		 407[CONTROL_CUTTHROUGH_DELIVERY] =
408 { US"cutthrough_delivery", TRUE, 0 },
409[CONTROL_DEBUG] =
410 { US"debug", TRUE, 0 },
d7bed771 411
80a47a2c 412#ifndef DISABLE_DKIM
f2ed27cf 413[CONTROL_DKIM_VERIFY] =
d7bed771 414 { US"dkim_disable_verify", FALSE,
e3a69b62 415 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
d7bed771 416# ifndef DISABLE_PRDR
e3a69b62 417 ACL_BIT_PRDR |
d7bed771 418# endif
e3a69b62 419 ACL_BIT_NOTSMTP_START
d7bed771 420 },
4840604e 421#endif
d7bed771 422
4840604e 423#ifdef EXPERIMENTAL_DMARC
9904d08c 424[CONTROL_DMARC_VERIFY] =
d7bed771 425 { US"dmarc_disable_verify", FALSE,
e3a69b62 426 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 427 },
9904d08c 428[CONTROL_DMARC_FORENSIC] =
d7bed771 429 { US"dmarc_enable_forensic", FALSE,
e3a69b62 430 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH		 431 },
432#endif
433
f2ed27cf 434[CONTROL_DSCP] =
d7bed771 435 { US"dscp", TRUE,
e3a69b62 436 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
d7bed771 437 },
f2ed27cf 438[CONTROL_ENFORCE_SYNC] =
d7bed771 439 { US"enforce_sync", FALSE,
e3a69b62 440 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH		 441 },
442
443 /* Pseudo-value for decode errors */
f2ed27cf 444[CONTROL_ERROR] =
d7bed771
JH		 445 { US"error", FALSE, 0 },
446
f2ed27cf 447[CONTROL_FAKEDEFER] =
d7bed771 448 { US"fakedefer", TRUE,
f2ed27cf 449 (unsigned)
e3a69b62
JH		 450 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
451 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 452#ifndef DISABLE_PRDR
e3a69b62 453 ACL_BIT_PRDR |
d7bed771 454#endif
e3a69b62 455 ACL_BIT_MIME)
d7bed771 456 },
f2ed27cf 457[CONTROL_FAKEREJECT] =
d7bed771 458 { US"fakereject", TRUE,
f2ed27cf 459 (unsigned)
e3a69b62
JH		 460 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
461 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 462#ifndef DISABLE_PRDR
e3a69b62 463 ACL_BIT_PRDR |
d7bed771 464#endif
e3a69b62 465 ACL_BIT_MIME)
d7bed771 466 },
f2ed27cf 467[CONTROL_FREEZE] =
d7bed771 468 { US"freeze", TRUE,
f2ed27cf 469 (unsigned)
e3a69b62
JH		 470 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
471 ACL_BIT_PREDATA | ACL_BIT_DATA |
472 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
473 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771
JH		 474 },
475
f2ed27cf 476[CONTROL_NO_CALLOUT_FLUSH] =
d7bed771 477 { US"no_callout_flush", FALSE,
e3a69b62 478 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 479 },
f2ed27cf 480[CONTROL_NO_DELAY_FLUSH] =
d7bed771 481 { US"no_delay_flush", FALSE,
e3a69b62 482 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH		 483 },
484
f2ed27cf 485[CONTROL_NO_ENFORCE_SYNC] =
d7bed771 486 { US"no_enforce_sync", FALSE,
e3a69b62 487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 488 },
8523533c 489#ifdef WITH_CONTENT_SCAN
f2ed27cf 490[CONTROL_NO_MBOX_UNSPOOL] =
d7bed771 491 { US"no_mbox_unspool", FALSE,
f2ed27cf 492 (unsigned)
e3a69b62
JH		 493 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
494 ACL_BIT_PREDATA | ACL_BIT_DATA |
495 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 ACL_BIT_MIME)
d7bed771
JH		 497 },
498#endif
f2ed27cf 499[CONTROL_NO_MULTILINE] =
d7bed771 500 { US"no_multiline_responses", FALSE,
e3a69b62 501 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 502 },
f2ed27cf 503[CONTROL_NO_PIPELINING] =
d7bed771 504 { US"no_pipelining", FALSE,
e3a69b62 505 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH		 506 },
507
f2ed27cf 508[CONTROL_QUEUE_ONLY] =
d7bed771 509 { US"queue_only", FALSE,
f2ed27cf 510 (unsigned)
e3a69b62
JH		 511 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
512 ACL_BIT_PREDATA | ACL_BIT_DATA |
513 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
514 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771 515 },
8ac90765
JH		 516
517
518#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
519[CONTROL_REQUIRETLS] =
520 { US"requiretls", FALSE,
521 (unsigned)
522 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
523 ACL_BIT_DATA | ACL_BIT_MIME |
524 ACL_BIT_NOTSMTP)
525 },
526#endif
527
f2ed27cf 528[CONTROL_SUBMISSION] =
d7bed771 529 { US"submission", TRUE,
f2ed27cf 530 (unsigned)
e3a69b62 531 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
d7bed771 532 },
f2ed27cf 533[CONTROL_SUPPRESS_LOCAL_FIXUPS] =
d7bed771
JH		 534 { US"suppress_local_fixups", FALSE,
535 (unsigned)
e3a69b62
JH		 536 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
537 ACL_BIT_NOTSMTP_START)
d7bed771 538 },
8c5d388a 539#ifdef SUPPORT_I18N
f2ed27cf 540[CONTROL_UTF8_DOWNCONVERT] =
6741531c
JH		 541 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
542 }
3c8b3577 543#endif
d7bed771 544};
059ec3d9 545
e5a9dba6
PH		 546/* Support data structures for Client SMTP Authorization. acl_verify_csa()
547caches its result in a tree to avoid repeated DNS queries. The result is an
548integer code which is used as an index into the following tables of
549explanatory strings and verification return codes. */
550
551static tree_node *csa_cache = NULL;
552
553enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
554 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
555
556/* The acl_verify_csa() return code is translated into an acl_verify() return
557code using the following table. It is OK unless the client is definitely not
558authorized. This is because CSA is supposed to be optional for sending sites,
559so recipients should not be too strict about checking it - especially because
560DNS problems are quite likely to occur. It's possible to use $csa_status in
561further ACL conditions to distinguish ok, unknown, and defer if required, but
562the aim is to make the usual configuration simple. */
563
564static int csa_return_code[] = {
f2ed27cf
JH		 565 [CSA_UNKNOWN] = OK,
566 [CSA_OK] = OK,
567 [CSA_DEFER_SRV] = OK,
568 [CSA_DEFER_ADDR] = OK,
569 [CSA_FAIL_EXPLICIT] = FAIL,
570 [CSA_FAIL_DOMAIN] = FAIL,
571 [CSA_FAIL_NOADDR] = FAIL,
572 [CSA_FAIL_MISMATCH] = FAIL
e5a9dba6
PH		 573};
574
575static uschar *csa_status_string[] = {
f2ed27cf
JH		 576 [CSA_UNKNOWN] = US"unknown",
577 [CSA_OK] = US"ok",
578 [CSA_DEFER_SRV] = US"defer",
579 [CSA_DEFER_ADDR] = US"defer",
580 [CSA_FAIL_EXPLICIT] = US"fail",
581 [CSA_FAIL_DOMAIN] = US"fail",
582 [CSA_FAIL_NOADDR] = US"fail",
583 [CSA_FAIL_MISMATCH] = US"fail"
e5a9dba6
PH		 584};
585
586static uschar *csa_reason_string[] = {
f2ed27cf
JH		 587 [CSA_UNKNOWN] = US"unknown",
588 [CSA_OK] = US"ok",
589 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
590 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
591 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
592 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
593 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
594 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
e5a9dba6
PH		 595};
596
c99ce5c9
TF		 597/* Options for the ratelimit condition. Note that there are two variants of
598the per_rcpt option, depending on the ACL that is used to measure the rate.
599However any ACL must be able to look up per_rcpt rates in /noupdate mode,
600so the two variants must have the same internal representation as well as
601the same configuration string. */
602
603enum {
604 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
605 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
606};
607
608#define RATE_SET(var,new) \
609 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
610
611static uschar *ratelimit_option_string[] = {
f2ed27cf
JH		 612 [RATE_PER_WHAT] = US"?",
613 [RATE_PER_CLASH] = US"!",
614 [RATE_PER_ADDR] = US"per_addr",
615 [RATE_PER_BYTE] = US"per_byte",
616 [RATE_PER_CMD] = US"per_cmd",
617 [RATE_PER_CONN] = US"per_conn",
618 [RATE_PER_MAIL] = US"per_mail",
619 [RATE_PER_RCPT] = US"per_rcpt",
620 [RATE_PER_ALLRCPTS] = US"per_rcpt"
c99ce5c9
TF		 621};
622
059ec3d9
PH		 623/* Enable recursion between acl_check_internal() and acl_check_condition() */
624
e1d04f48 625static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
f60d98e8 626 uschar **);
059ec3d9
PH		 627
628
d7bed771
JH		 629/*************************************************
630* Find control in list *
631*************************************************/
632
633/* The lists are always in order, so binary chop can be used.
634
635Arguments:
636 name the control name to search for
637 ol the first entry in the control list
638 last one more than the offset of the last entry in the control list
639
640Returns: index of a control entry, or -1 if not found
641*/
642
643static int
644find_control(const uschar * name, control_def * ol, int last)
645{
d7978c0f 646for (int first = 0; last > first; )
d7bed771
JH		 647 {
648 int middle = (first + last)/2;
649 uschar * s = ol[middle].name;
650 int c = Ustrncmp(name, s, Ustrlen(s));
651 if (c == 0) return middle;
652 else if (c > 0) first = middle + 1;
653 else last = middle;
654 }
655return -1;
656}
657
658
659
2d009132
JH		 660/*************************************************
661* Pick out condition from list *
662*************************************************/
663
664/* Use a binary chop method
665
666Arguments:
667 name name to find
668 list list of conditions
669 end size of list
670
671Returns: offset in list, or -1 if not found
672*/
673
674static int
675acl_checkcondition(uschar * name, condition_def * list, int end)
676{
d7978c0f 677for (int start = 0; start < end; )
2d009132
JH		 678 {
679 int mid = (start + end)/2;
680 int c = Ustrcmp(name, list[mid].name);
681 if (c == 0) return mid;
682 if (c < 0) end = mid;
683 else start = mid + 1;
684 }
685return -1;
686}
687
688
059ec3d9
PH		 689/*************************************************
690* Pick out name from list *
691*************************************************/
692
693/* Use a binary chop method
694
695Arguments:
696 name name to find
697 list list of names
698 end size of list
699
700Returns: offset in list, or -1 if not found
701*/
702
703static int
704acl_checkname(uschar *name, uschar **list, int end)
705{
d7978c0f 706for (int start = 0; start < end; )
059ec3d9
PH		 707 {
708 int mid = (start + end)/2;
709 int c = Ustrcmp(name, list[mid]);
710 if (c == 0) return mid;
711 if (c < 0) end = mid; else start = mid + 1;
712 }
713
714return -1;
715}
716
717
718/*************************************************
719* Read and parse one ACL *
720*************************************************/
721
722/* This function is called both from readconf in order to parse the ACLs in the
723configuration file, and also when an ACL is encountered dynamically (e.g. as
724the result of an expansion). It is given a function to call in order to
725retrieve the lines of the ACL. This function handles skipping comments and
726blank lines (where relevant).
727
728Arguments:
729 func function to get next line of ACL
730 error where to put an error message
731
732Returns: pointer to ACL, or NULL
733 NULL can be legal (empty ACL); in this case error will be NULL
734*/
735
736acl_block *
737acl_read(uschar *(*func)(void), uschar **error)
738{
739acl_block *yield = NULL;
740acl_block **lastp = &yield;
741acl_block *this = NULL;
742acl_condition_block *cond;
743acl_condition_block **condp = NULL;
d7978c0f 744uschar * s;
059ec3d9
PH		 745
746*error = NULL;
747
748while ((s = (*func)()) != NULL)
749 {
750 int v, c;
751 BOOL negated = FALSE;
752 uschar *saveline = s;
753 uschar name[64];
754
755 /* Conditions (but not verbs) are allowed to be negated by an initial
756 exclamation mark. */
757
758 while (isspace(*s)) s++;
759 if (*s == '!')
760 {
761 negated = TRUE;
762 s++;
763 }
764
cf00dad6
PH		 765 /* Read the name of a verb or a condition, or the start of a new ACL, which
766 can be started by a name, or by a macro definition. */
059ec3d9
PH		 767
768 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 769 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 770
771 /* If a verb is unrecognized, it may be another condition or modifier that
772 continues the previous verb. */
773
2d009132 774 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
059ec3d9
PH		 775 {
776 if (this == NULL)
777 {
4e167a8c
PH		 778 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
779 saveline);
059ec3d9
PH		 780 return NULL;
781 }
782 }
783
784 /* New verb */
785
786 else
787 {
788 if (negated)
789 {
790 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
791 return NULL;
792 }
793 this = store_get(sizeof(acl_block));
794 *lastp = this;
795 lastp = &(this->next);
796 this->next = NULL;
797 this->verb = v;
798 this->condition = NULL;
799 condp = &(this->condition);
800 if (*s == 0) continue; /* No condition on this line */
801 if (*s == '!')
802 {
803 negated = TRUE;
804 s++;
805 }
806 s = readconf_readname(name, sizeof(name), s); /* Condition name */
807 }
808
809 /* Handle a condition or modifier. */
810
2d009132 811 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
059ec3d9
PH		 812 {
813 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
814 saveline);
815 return NULL;
816 }
817
818 /* The modifiers may not be negated */
819
2d009132 820 if (negated && conditions[c].is_modifier)
059ec3d9
PH		 821 {
822 *error = string_sprintf("ACL error: negation is not allowed with "
2d009132 823 "\"%s\"", conditions[c].name);
059ec3d9
PH		 824 return NULL;
825 }
826
827 /* ENDPASS may occur only with ACCEPT or DISCARD. */
828
829 if (c == ACLC_ENDPASS &&
830 this->verb != ACL_ACCEPT &&
831 this->verb != ACL_DISCARD)
832 {
833 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
2d009132 834 conditions[c].name, verbs[this->verb]);
059ec3d9
PH		 835 return NULL;
836 }
837
838 cond = store_get(sizeof(acl_condition_block));
839 cond->next = NULL;
840 cond->type = c;
841 cond->u.negated = negated;
842
843 *condp = cond;
844 condp = &(cond->next);
845
846 /* The "set" modifier is different in that its argument is "name=value"
847 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 848 gives us a variable name to insert into the data block. The original ACL
849 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
850 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 851 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
852 After that, we allow alphanumerics and underscores, but the first character
853 after c or m must be a digit or an underscore. This retains backwards
854 compatibility. */
059ec3d9
PH		 855
856 if (c == ACLC_SET)
a79d8834
JH		 857#ifndef DISABLE_DKIM
858 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
859 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
860 {
861 uschar * endptr = s+18;
862
863 if (isalnum(*endptr))
864 {
865 *error = string_sprintf("invalid variable name after \"set\" in ACL "
866 "modifier \"set %s\" "
867 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
868 s);
869 return NULL;
870 }
871 cond->u.varname = string_copyn(s, 18);
872 s = endptr;
873 while (isspace(*s)) s++;
874 }
875 else
876#endif
059ec3d9 877 {
47ca6d6c
PH		 878 uschar *endptr;
879
38a0a95f
PH		 880 if (Ustrncmp(s, "acl_c", 5) != 0 &&
881 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 882 {
38a0a95f
PH		 883 *error = string_sprintf("invalid variable name after \"set\" in ACL "
884 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
885 return NULL;
47ca6d6c 886 }
38a0a95f
PH		 887
888 endptr = s + 5;
641cb756
PH		 889 if (!isdigit(*endptr) && *endptr != '_')
890 {
891 *error = string_sprintf("invalid variable name after \"set\" in ACL "
892 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
893 s);
894 return NULL;
895 }
896
38a0a95f 897 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 898 {
38a0a95f
PH		 899 if (!isalnum(*endptr) && *endptr != '_')
900 {
901 *error = string_sprintf("invalid character \"%c\" in variable name "
902 "in ACL modifier \"set %s\"", *endptr, s);
903 return NULL;
904 }
905 endptr++;
47ca6d6c 906 }
47ca6d6c 907
38a0a95f 908 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 909 s = endptr;
059ec3d9
PH		 910 while (isspace(*s)) s++;
911 }
912
913 /* For "set", we are now positioned for the data. For the others, only
914 "endpass" has no data */
915
916 if (c != ACLC_ENDPASS)
917 {
918 if (*s++ != '=')
919 {
920 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
2d009132 921 conditions[c].is_modifier ? US"modifier" : US"condition");
059ec3d9
PH		 922 return NULL;
923 }
924 while (isspace(*s)) s++;
925 cond->arg = string_copy(s);
926 }
927 }
928
929return yield;
930}
931
932
933
71fafd95
PH		 934/*************************************************
935* Set up added header line(s) *
936*************************************************/
937
938/* This function is called by the add_header modifier, and also from acl_warn()
939to implement the now-deprecated way of adding header lines using "message" on a
940"warn" verb. The argument is treated as a sequence of header lines which are
941added to a chain, provided there isn't an identical one already there.
942
943Argument: string of header lines
944Returns: nothing
945*/
946
947static void
55414b25 948setup_header(const uschar *hstring)
71fafd95 949{
55414b25 950const uschar *p, *q;
71fafd95
PH		 951int hlen = Ustrlen(hstring);
952
b1b05573
JH		 953/* Ignore any leading newlines */
954while (*hstring == '\n') hstring++, hlen--;
71fafd95 955
b1b05573 956/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 957if (hlen <= 0) return;
96f5fe4c 958if (hstring[--hlen] != '\n') /* no newline */
55414b25 959 q = string_sprintf("%s\n", hstring);
96f5fe4c 960else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH		 961 {
962 uschar * s = string_copy(hstring);
963 while(s[--hlen] == '\n')
964 s[hlen+1] = '\0';
965 q = s;
966 }
967else
968 q = hstring;
71fafd95
PH		 969
970/* Loop for multiple header lines, taking care about continuations */
971
617d3932 972for (p = q; *p; p = q)
71fafd95 973 {
55414b25
JH		 974 const uschar *s;
975 uschar * hdr;
71fafd95
PH		 976 int newtype = htype_add_bot;
977 header_line **hptr = &acl_added_headers;
978
979 /* Find next header line within the string */
980
981 for (;;)
982 {
96f5fe4c 983 q = Ustrchr(q, '\n'); /* we know there was a newline */
617d3932 984 if (*++q != ' ' && *q != '\t') break;
71fafd95
PH		 985 }
986
987 /* If the line starts with a colon, interpret the instruction for where to
988 add it. This temporarily sets up a new type. */
989
990 if (*p == ':')
991 {
992 if (strncmpic(p, US":after_received:", 16) == 0)
993 {
994 newtype = htype_add_rec;
995 p += 16;
996 }
997 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
998 {
999 newtype = htype_add_rfc;
1000 p += 14;
1001 }
1002 else if (strncmpic(p, US":at_start:", 10) == 0)
1003 {
1004 newtype = htype_add_top;
1005 p += 10;
1006 }
1007 else if (strncmpic(p, US":at_end:", 8) == 0)
1008 {
1009 newtype = htype_add_bot;
1010 p += 8;
1011 }
1012 while (*p == ' ' || *p == '\t') p++;
1013 }
1014
1015 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1016 to the front of it. */
1017
1018 for (s = p; s < q - 1; s++)
71fafd95 1019 if (*s == ':' || !isgraph(*s)) break;
71fafd95 1020
617d3932 1021 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
55414b25 1022 hlen = Ustrlen(hdr);
71fafd95
PH		 1023
1024 /* See if this line has already been added */
1025
617d3932 1026 while (*hptr)
71fafd95 1027 {
55414b25 1028 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
617d3932 1029 hptr = &(*hptr)->next;
71fafd95
PH		 1030 }
1031
1032 /* Add if not previously present */
1033
617d3932 1034 if (!*hptr)
71fafd95
PH		 1035 {
1036 header_line *h = store_get(sizeof(header_line));
55414b25 1037 h->text = hdr;
71fafd95
PH		 1038 h->next = NULL;
1039 h->type = newtype;
1040 h->slen = hlen;
1041 *hptr = h;
617d3932 1042 hptr = &h->next;
71fafd95 1043 }
71fafd95
PH		 1044 }
1045}
1046
1047
1048
362145b5
JH		 1049/*************************************************
1050* List the added header lines *
1051*************************************************/
1052uschar *
1053fn_hdrs_added(void)
1054{
acec9514 1055gstring * g = NULL;
362145b5 1056
d7978c0f 1057for (header_line * h = acl_added_headers; h; h = h->next)
362145b5 1058 {
bce15b62
JH		 1059 int i = h->slen;
1060 if (h->text[i-1] == '\n') i--;
1061 g = string_append_listele_n(g, '\n', h->text, i);
362145b5 1062 }
362145b5 1063
bce15b62 1064return g ? g->s : NULL;
362145b5
JH		 1065}
1066
1067
e7568d51
TL		 1068/*************************************************
1069* Set up removed header line(s) *
1070*************************************************/
1071
1072/* This function is called by the remove_header modifier. The argument is
1073treated as a sequence of header names which are added to a colon separated
1074list, provided there isn't an identical one already there.
1075
1076Argument: string of header names
1077Returns: nothing
1078*/
1079
1080static void
55414b25 1081setup_remove_header(const uschar *hnames)
e7568d51 1082{
48334568 1083if (*hnames)
55414b25
JH		 1084 acl_removed_headers = acl_removed_headers
1085 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1086 : string_copy(hnames);
e7568d51
TL		 1087}
1088
1089
71fafd95 1090
059ec3d9
PH		 1091/*************************************************
1092* Handle warnings *
1093*************************************************/
1094
1095/* This function is called when a WARN verb's conditions are true. It adds to
1096the message's headers, and/or writes information to the log. In each case, this
1097only happens once (per message for headers, per connection for log).
1098
71fafd95
PH		 1099** NOTE: The header adding action using the "message" setting is historic, and
1100its use is now deprecated. The new add_header modifier should be used instead.
1101
059ec3d9
PH		 1102Arguments:
1103 where ACL_WHERE_xxxx indicating which ACL this is
1104 user_message message for adding to headers
1105 log_message message for logging, if different
1106
1107Returns: nothing
1108*/
1109
1110static void
1111acl_warn(int where, uschar *user_message, uschar *log_message)
1112{
059ec3d9
PH		 1113if (log_message != NULL && log_message != user_message)
1114 {
1115 uschar *text;
1116 string_item *logged;
1117
1118 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1119 string_printing(log_message));
1120
1121 /* If a sender verification has failed, and the log message is "sender verify
1122 failed", add the failure message. */
1123
1124 if (sender_verified_failed != NULL &&
1125 sender_verified_failed->message != NULL &&
1126 strcmpic(log_message, US"sender verify failed") == 0)
1127 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1128
9c7a242c
PH		 1129 /* Search previously logged warnings. They are kept in malloc
1130 store so they can be freed at the start of a new message. */
059ec3d9 1131
d7978c0f 1132 for (logged = acl_warn_logged; logged; logged = logged->next)
059ec3d9
PH		 1133 if (Ustrcmp(logged->text, text) == 0) break;
1134
d7978c0f 1135 if (!logged)
059ec3d9
PH		 1136 {
1137 int length = Ustrlen(text) + 1;
1138 log_write(0, LOG_MAIN, "%s", text);
1139 logged = store_malloc(sizeof(string_item) + length);
5903c6ff 1140 logged->text = US logged + sizeof(string_item);
059ec3d9
PH		 1141 memcpy(logged->text, text, length);
1142 logged->next = acl_warn_logged;
1143 acl_warn_logged = logged;
1144 }
1145 }
1146
1147/* If there's no user message, we are done. */
1148
d7978c0f 1149if (!user_message) return;
059ec3d9
PH		 1150
1151/* If this isn't a message ACL, we can't do anything with a user message.
1152Log an error. */
1153
1154if (where > ACL_WHERE_NOTSMTP)
1155 {
1156 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1157 "found in a non-message (%s) ACL: cannot specify header lines here: "
1158 "message ignored", acl_wherenames[where]);
1159 return;
1160 }
1161
71fafd95
PH		 1162/* The code for setting up header lines is now abstracted into a separate
1163function so that it can be used for the add_header modifier as well. */
059ec3d9 1164
71fafd95 1165setup_header(user_message);
059ec3d9
PH		 1166}
1167
1168
1169
1170/*************************************************
1171* Verify and check reverse DNS *
1172*************************************************/
1173
1174/* Called from acl_verify() below. We look up the host name(s) of the client IP
1175address if this has not yet been done. The host_name_lookup() function checks
1176that one of these names resolves to an address list that contains the client IP
1177address, so we don't actually have to do the check here.
1178
1179Arguments:
1180 user_msgptr pointer for user message
1181 log_msgptr pointer for log message
1182
1183Returns: OK verification condition succeeded
1184 FAIL verification failed
1185 DEFER there was a problem verifying
1186*/
1187
1188static int
1189acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1190{
1191int rc;
1192
1193user_msgptr = user_msgptr; /* stop compiler warning */
1194
1195/* Previous success */
1196
1197if (sender_host_name != NULL) return OK;
1198
1199/* Previous failure */
1200
1201if (host_lookup_failed)
1202 {
1203 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1204 return FAIL;
1205 }
1206
1207/* Need to do a lookup */
1208
1209HDEBUG(D_acl)
e1d04f48 1210 debug_printf_indent("looking up host name to force name/address consistency check\n");
059ec3d9
PH		 1211
1212if ((rc = host_name_lookup()) != OK)
1213 {
d7978c0f
JH		 1214 *log_msgptr = rc == DEFER
1215 ? US"host lookup deferred for reverse lookup check"
1216 : string_sprintf("host lookup failed for reverse lookup check%s",
1217 host_lookup_msg);
059ec3d9
PH		 1218 return rc; /* DEFER or FAIL */
1219 }
1220
1221host_build_sender_fullhost();
1222return OK;
1223}
1224
1225
1226
e5a9dba6
PH		 1227/*************************************************
1228* Check client IP address matches CSA target *
1229*************************************************/
1230
1231/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1232response for address records belonging to the CSA target hostname. The section
1233is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1234If one of the addresses matches the client's IP address, then the client is
1235authorized by CSA. If there are target IP addresses but none of them match
1236then the client is using an unauthorized IP address. If there are no target IP
1237addresses then the client cannot be using an authorized IP address. (This is
1238an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1239
1240Arguments:
1241 dnsa the DNS answer block
1242 dnss a DNS scan block for us to use
4c04137d 1243 reset option specifying what portion to scan, as described above
e5a9dba6
PH		 1244 target the target hostname to use for matching RR names
1245
1246Returns: CSA_OK successfully authorized
1247 CSA_FAIL_MISMATCH addresses found but none matched
1248 CSA_FAIL_NOADDR no target addresses found
1249*/
1250
1251static int
1252acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1253 uschar *target)
1254{
d7978c0f 1255int rc = CSA_FAIL_NOADDR;
e5a9dba6 1256
d7978c0f
JH		 1257for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1258 rr;
e5a9dba6
PH		 1259 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1260 {
1261 /* Check this is an address RR for the target hostname. */
1262
1263 if (rr->type != T_A
1264 #if HAVE_IPV6
1265 && rr->type != T_AAAA
e5a9dba6
PH		 1266 #endif
1267 ) continue;
1268
1269 if (strcmpic(target, rr->name) != 0) continue;
1270
d7978c0f 1271 rc = CSA_FAIL_MISMATCH;
e5a9dba6
PH		 1272
1273 /* Turn the target address RR into a list of textual IP addresses and scan
1274 the list. There may be more than one if it is an A6 RR. */
1275
d7978c0f 1276 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
e5a9dba6
PH		 1277 {
1278 /* If the client IP address matches the target IP address, it's good! */
1279
e1d04f48 1280 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
e5a9dba6
PH		 1281
1282 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1283 }
1284 }
1285
1286/* If we found some target addresses but none of them matched, the client is
1287using an unauthorized IP address, otherwise the target has no authorized IP
1288addresses. */
1289
d7978c0f 1290return rc;
e5a9dba6
PH		 1291}
1292
1293
1294
1295/*************************************************
1296* Verify Client SMTP Authorization *
1297*************************************************/
1298
1299/* Called from acl_verify() below. This routine calls dns_lookup_special()
1300to find the CSA SRV record corresponding to the domain argument, or
1301$sender_helo_name if no argument is provided. It then checks that the
1302client is authorized, and that its IP address corresponds to the SRV
1303target's address by calling acl_verify_csa_address() above. The address
1304should have been returned in the DNS response's ADDITIONAL section, but if
1305not we perform another DNS lookup to get it.
1306
1307Arguments:
1308 domain pointer to optional parameter following verify = csa
1309
1310Returns: CSA_UNKNOWN no valid CSA record found
1311 CSA_OK successfully authorized
1312 CSA_FAIL_* client is definitely not authorized
1313 CSA_DEFER_* there was a DNS problem
1314*/
1315
1316static int
55414b25 1317acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1318{
1319tree_node *t;
55414b25 1320const uschar *found;
e5a9dba6
PH		 1321int priority, weight, port;
1322dns_answer dnsa;
1323dns_scan dnss;
1324dns_record *rr;
1325int rc, type;
1326uschar target[256];
1327
1328/* Work out the domain we are using for the CSA lookup. The default is the
1329client's HELO domain. If the client has not said HELO, use its IP address
1330instead. If it's a local client (exim -bs), CSA isn't applicable. */
1331
1332while (isspace(*domain) && *domain != '\0') ++domain;
1333if (*domain == '\0') domain = sender_helo_name;
1334if (domain == NULL) domain = sender_host_address;
1335if (sender_host_address == NULL) return CSA_UNKNOWN;
1336
1337/* If we have an address literal, strip off the framing ready for turning it
1338into a domain. The framing consists of matched square brackets possibly
1339containing a keyword and a colon before the actual IP address. */
1340
1341if (domain[0] == '[')
1342 {
55414b25 1343 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1344 if (start == NULL) start = domain;
1345 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1346 }
1347
1348/* Turn domains that look like bare IP addresses into domains in the reverse
1349DNS. This code also deals with address literals and $sender_host_address. It's
1350not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1351address literals, but it's probably the most friendly thing to do. This is an
1352extension to CSA, so we allow it to be turned off for proper conformance. */
1353
7e66e54d 1354if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1355 {
1356 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1357 dns_build_reverse(domain, target);
1358 domain = target;
1359 }
1360
1361/* Find out if we've already done the CSA check for this domain. If we have,
1362return the same result again. Otherwise build a new cached result structure
1363for this domain. The name is filled in now, and the value is filled in when
1364we return from this function. */
1365
1366t = tree_search(csa_cache, domain);
1367if (t != NULL) return t->data.val;
1368
1369t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1370Ustrcpy(t->name, domain);
1371(void)tree_insertnode(&csa_cache, t);
1372
1373/* Now we are ready to do the actual DNS lookup(s). */
1374
28e6ef29 1375found = domain;
e5a9dba6
PH		 1376switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1377 {
1378 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1379
1380 default:
1381 return t->data.val = CSA_DEFER_SRV;
1382
1383 /* If we found nothing, the client's authorization is unknown. */
1384
1385 case DNS_NOMATCH:
1386 case DNS_NODATA:
1387 return t->data.val = CSA_UNKNOWN;
1388
1389 /* We got something! Go on to look at the reply in more detail. */
1390
1391 case DNS_SUCCEED:
1392 break;
1393 }
1394
1395/* Scan the reply for well-formed CSA SRV records. */
1396
1397for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
dd708fd7
JH		 1398 rr;
1399 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
e5a9dba6 1400 {
dd708fd7 1401 const uschar * p = rr->data;
e5a9dba6
PH		 1402
1403 /* Extract the numerical SRV fields (p is incremented) */
1404
e5a9dba6
PH		 1405 GETSHORT(priority, p);
1406 GETSHORT(weight, p);
1407 GETSHORT(port, p);
1408
1409 DEBUG(D_acl)
e1d04f48 1410 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
e5a9dba6
PH		 1411
1412 /* Check the CSA version number */
1413
1414 if (priority != 1) continue;
1415
1416 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1417 found by dns_special_lookup() is a parent of the one we asked for), we check
1418 the subdomain assertions in the port field. At the moment there's only one
1419 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1420 SRV records of their own. */
1421
1dc92d5a 1422 if (Ustrcmp(found, domain) != 0)
dd708fd7 1423 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
e5a9dba6
PH		 1424
1425 /* This CSA SRV record refers directly to our domain, so we check the value
1426 in the weight field to work out the domain's authorization. 0 and 1 are
1427 unauthorized; 3 means the client is authorized but we can't check the IP
1428 address in order to authenticate it, so we treat it as unknown; values
1429 greater than 3 are undefined. */
1430
1431 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1432
1433 if (weight > 2) continue;
1434
1435 /* Weight == 2, which means the domain is authorized. We must check that the
1436 client's IP address is listed as one of the SRV target addresses. Save the
1437 target hostname then break to scan the additional data for its addresses. */
1438
1439 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1440 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1441
e1d04f48 1442 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
e5a9dba6
PH		 1443
1444 break;
1445 }
1446
1447/* If we didn't break the loop then no appropriate records were found. */
1448
d7978c0f 1449if (!rr) return t->data.val = CSA_UNKNOWN;
e5a9dba6
PH		 1450
1451/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1452A target of "." indicates there are no valid addresses, so the client cannot
1453be authorized. (This is an odd configuration because weight=2 target=. is
1454equivalent to weight=1, but we check for it in order to keep load off the
1455root name servers.) Note that dn_expand() turns "." into "". */
1456
1457if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1458
1459/* Scan the additional section of the CSA SRV reply for addresses belonging
1460to the target. If the name server didn't return any additional data (e.g.
1461because it does not fully support SRV records), we need to do another lookup
1462to obtain the target addresses; otherwise we have a definitive result. */
1463
1464rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1465if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1466
1467/* The DNS lookup type corresponds to the IP version used by the client. */
1468
1469#if HAVE_IPV6
1470if (Ustrchr(sender_host_address, ':') != NULL)
1471 type = T_AAAA;
1472else
1473#endif /* HAVE_IPV6 */
1474 type = T_A;
1475
1476
4e0983dc 1477lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1478switch (dns_lookup(&dnsa, target, type, NULL))
1479 {
1480 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1481
1482 default:
cc00f4af 1483 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1484
1485 /* If the query succeeded, scan the addresses and return the result. */
1486
1487 case DNS_SUCCEED:
cc00f4af
JH		 1488 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1489 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1490 /* else fall through */
e5a9dba6
PH		 1491
1492 /* If the target has no IP addresses, the client cannot have an authorized
1493 IP address. However, if the target site uses A6 records (not AAAA records)
1494 we have to do yet another lookup in order to check them. */
1495
1496 case DNS_NOMATCH:
1497 case DNS_NODATA:
cc00f4af 1498 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1499 }
1500}
1501
1502
1503
059ec3d9
PH		 1504/*************************************************
1505* Handle verification (address & other) *
1506*************************************************/
1507
89583014 1508enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd 1509 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
e3a69b62 1510 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
89583014
JH		 1511 };
1512typedef struct {
1513 uschar * name;
1514 int value;
1515 unsigned where_allowed; /* bitmap */
1516 BOOL no_options; /* Never has /option(s) following */
1517 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1518 } verify_type_t;
1519static verify_type_t verify_type_list[] = {
f2ed27cf 1520 /* name value where no-opt opt-sep */
7e8360e6 1521 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
e3a69b62
JH		 1522 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1523 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
89583014 1524 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
e3a69b62
JH		 1525 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1526 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1527 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1528 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1529 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
89583014 1530 FALSE, 6 },
e3a69b62
JH		 1531 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1532 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1533#ifdef EXPERIMENTAL_ARC
f48946eb 1534 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
e3a69b62 1535#endif
89583014
JH		 1536 };
1537
1538
1539enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1540 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1541 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
57cc2785 1542 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
89583014
JH		 1543 };
1544typedef struct {
1545 uschar * name;
1546 int value;
1547 int flag;
1548 BOOL has_option; /* Has =option(s) following */
1549 BOOL timeval; /* Has a time value */
1550 } callout_opt_t;
1551static callout_opt_t callout_opt_list[] = {
f2ed27cf 1552 /* name value flag has-opt has-time */
89583014
JH		 1553 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1554 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1555 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1556 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1557 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1558 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1559 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1560 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1561 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1562 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1563 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
57cc2785 1564 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
89583014
JH		 1565 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1566 };
1567
1568
1569
059ec3d9
PH		 1570/* This function implements the "verify" condition. It is called when
1571encountered in any ACL, because some tests are almost always permitted. Some
1572just don't make sense, and always fail (for example, an attempt to test a host
1573lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1574
1575Arguments:
1576 where where called from
1577 addr the recipient address that the ACL is handling, or NULL
1578 arg the argument of "verify"
1579 user_msgptr pointer for user message
1580 log_msgptr pointer for log message
1581 basic_errno where to put verify errno
1582
1583Returns: OK verification condition succeeded
1584 FAIL verification failed
1585 DEFER there was a problem verifying
1586 ERROR syntax error
1587*/
1588
1589static int
55414b25 1590acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1591 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1592{
1593int sep = '/';
1594int callout = -1;
1595int callout_overall = -1;
4deaf07d 1596int callout_connect = -1;
059ec3d9
PH		 1597int verify_options = 0;
1598int rc;
1599BOOL verify_header_sender = FALSE;
1600BOOL defer_ok = FALSE;
1601BOOL callout_defer_ok = FALSE;
1602BOOL no_details = FALSE;
eafd343b 1603BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1604address_item *sender_vaddr = NULL;
1605uschar *verify_sender_address = NULL;
1606uschar *pm_mailfrom = NULL;
1607uschar *se_mailfrom = NULL;
596875b3
PH		 1608
1609/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1610an error if options are given for items that don't expect them.
596875b3
PH		 1611*/
1612
1613uschar *slash = Ustrchr(arg, '/');
55414b25 1614const uschar *list = arg;
059ec3d9 1615uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1616verify_type_t * vp;
059ec3d9 1617
e3a69b62 1618if (!ss) goto BAD_VERIFY;
059ec3d9
PH		 1619
1620/* Handle name/address consistency verification in a separate function. */
1621
d7978c0f 1622for (vp = verify_type_list;
5903c6ff 1623 CS vp < CS verify_type_list + sizeof(verify_type_list);
89583014
JH		 1624 vp++
1625 )
1626 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1627 : strcmpic (ss, vp->name) == 0)
1628 break;
5903c6ff 1629if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
89583014
JH		 1630 goto BAD_VERIFY;
1631
e3a69b62 1632if (vp->no_options && slash)
059ec3d9 1633 {
89583014
JH		 1634 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1635 "(this verify item has no options)", arg);
1636 return ERROR;
059ec3d9 1637 }
e3a69b62 1638if (!(vp->where_allowed & BIT(where)))
059ec3d9 1639 {
e3a69b62
JH		 1640 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1641 vp->name, acl_wherenames[where]);
89583014 1642 return ERROR;
059ec3d9 1643 }
89583014 1644switch(vp->value)
596875b3 1645 {
89583014 1646 case VERIFY_REV_HOST_LKUP:
617d3932 1647 if (!sender_host_address) return OK;
7e8360e6 1648 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
617d3932 1649 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
7e8360e6
JH		 1650 if (strcmpic(ss, US"defer_ok") == 0)
1651 return OK;
1652 return rc;
059ec3d9 1653
89583014
JH		 1654 case VERIFY_CERT:
1655 /* TLS certificate verification is done at STARTTLS time; here we just
1656 test whether it was successful or not. (This is for optional verification; for
1657 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1658
3703d818
JH		 1659 if (tls_in.certificate_verified) return OK;
1660 *user_msgptr = US"no verified certificate";
1661 return FAIL;
e5a9dba6 1662
89583014
JH		 1663 case VERIFY_HELO:
1664 /* We can test the result of optional HELO verification that might have
1665 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1666
8768d548
JH		 1667 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1668 return f.helo_verified ? OK : FAIL;
059ec3d9 1669
89583014
JH		 1670 case VERIFY_CSA:
1671 /* Do Client SMTP Authorization checks in a separate function, and turn the
1672 result code into user-friendly strings. */
1c41c9cc 1673
3703d818
JH		 1674 rc = acl_verify_csa(list);
1675 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1676 csa_reason_string[rc]);
3703d818 1677 csa_status = csa_status_string[rc];
e1d04f48 1678 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
3703d818 1679 return csa_return_code[rc];
89583014 1680
617d3932
JH		 1681#ifdef EXPERIMENTAL_ARC
1682 case VERIFY_ARC:
1683 { /* Do Authenticated Received Chain checks in a separate function. */
1684 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1685 int csep = 0;
1686 uschar * cond;
1687
1688 if (!(arc_state = acl_verify_arc())) return DEFER;
93c931f8
JH		 1689 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1690 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
617d3932
JH		 1691
1692 if (!condlist) condlist = US"none:pass";
1693 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1694 if (Ustrcmp(arc_state, cond) == 0) return OK;
1695 return FAIL;
1696 }
1697#endif
1698
89583014 1699 case VERIFY_HDR_SYNTAX:
db57e575 1700 /* Check that all relevant header lines have the correct 5322-syntax. If there is
89583014
JH		 1701 a syntax error, we return details of the error to the sender if configured to
1702 send out full details. (But a "message" setting on the ACL can override, as
1703 always). */
1704
1705 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1706 if (rc != OK && *log_msgptr)
1707 if (smtp_return_error_details)
1708 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1709 else
1710 acl_verify_message = *log_msgptr;
89583014 1711 return rc;
059ec3d9 1712
770747fd
MFM		 1713 case VERIFY_HDR_NAMES_ASCII:
1714 /* Check that all header names are true 7 bit strings
1715 See RFC 5322, 2.2. and RFC 6532, 3. */
1716
1717 rc = verify_check_header_names_ascii(log_msgptr);
617d3932 1718 if (rc != OK && smtp_return_error_details && *log_msgptr)
770747fd
MFM		 1719 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1720 return rc;
1721
89583014
JH		 1722 case VERIFY_NOT_BLIND:
1723 /* Check that no recipient of this message is "blind", that is, every envelope
1724 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1725
617d3932 1726 if ((rc = verify_check_notblind()) != OK)
89583014
JH		 1727 {
1728 *log_msgptr = string_sprintf("bcc recipient detected");
1729 if (smtp_return_error_details)
1730 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1731 }
1732 return rc;
059ec3d9 1733
89583014
JH		 1734 /* The remaining verification tests check recipient and sender addresses,
1735 either from the envelope or from the header. There are a number of
1736 slash-separated options that are common to all of them. */
059ec3d9 1737
89583014
JH		 1738 case VERIFY_HDR_SNDR:
1739 verify_header_sender = TRUE;
1740 break;
059ec3d9 1741
89583014
JH		 1742 case VERIFY_SNDR:
1743 /* In the case of a sender, this can optionally be followed by an address to use
1744 in place of the actual sender (rare special-case requirement). */
059ec3d9 1745 {
89583014
JH		 1746 uschar *s = ss + 6;
1747 if (*s == 0)
1748 verify_sender_address = sender_address;
1749 else
1750 {
1751 while (isspace(*s)) s++;
1752 if (*s++ != '=') goto BAD_VERIFY;
1753 while (isspace(*s)) s++;
1754 verify_sender_address = string_copy(s);
1755 }
059ec3d9 1756 }
89583014
JH		 1757 break;
1758
1759 case VERIFY_RCPT:
1760 break;
059ec3d9
PH		 1761 }
1762
89583014
JH		 1763
1764
596875b3
PH		 1765/* Remaining items are optional; they apply to sender and recipient
1766verification, including "header sender" verification. */
059ec3d9 1767
d7978c0f 1768while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
059ec3d9
PH		 1769 {
1770 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1771 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1772 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1773
1774 /* These two old options are left for backwards compatibility */
1775
1776 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1777 {
1778 callout_defer_ok = TRUE;
1779 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1780 }
1781
1782 else if (strcmpic(ss, US"check_postmaster") == 0)
1783 {
1784 pm_mailfrom = US"";
1785 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1786 }
1787
1788 /* The callout option has a number of sub-options, comma separated */
1789
1790 else if (strncmpic(ss, US"callout", 7) == 0)
1791 {
1792 callout = CALLOUT_TIMEOUT_DEFAULT;
1793 ss += 7;
1794 if (*ss != 0)
1795 {
1796 while (isspace(*ss)) ss++;
1797 if (*ss++ == '=')
1798 {
55414b25 1799 const uschar * sublist = ss;
059ec3d9 1800 int optsep = ',';
059ec3d9 1801 uschar buffer[256];
d7978c0f 1802 uschar * opt;
8e669ac1 1803
d7978c0f 1804 while (isspace(*sublist)) sublist++;
57cc2785 1805 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
059ec3d9 1806 {
89583014 1807 callout_opt_t * op;
438257ba 1808 double period = 1.0F;
059ec3d9 1809
89583014 1810 for (op= callout_opt_list; op->name; op++)
438257ba 1811 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1812 break;
059ec3d9 1813
89583014
JH		 1814 verify_options |= op->flag;
1815 if (op->has_option)
1816 {
438257ba 1817 opt += Ustrlen(op->name);
4deaf07d
PH		 1818 while (isspace(*opt)) opt++;
1819 if (*opt++ != '=')
1820 {
1821 *log_msgptr = string_sprintf("'=' expected after "
89583014 1822 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1823 return ERROR;
1824 }
1825 while (isspace(*opt)) opt++;
89583014 1826 }
57cc2785 1827 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
89583014 1828 {
57cc2785
JH		 1829 *log_msgptr = string_sprintf("bad time value in ACL condition "
1830 "\"verify %s\"", arg);
1831 return ERROR;
89583014
JH		 1832 }
1833
1834 switch(op->value)
1835 {
1836 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1837 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1838 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1839 case CALLOUT_MAILFROM:
1840 if (!verify_header_sender)
1841 {
1842 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1843 "callout option only for verify=header_sender (detected in ACL "
1844 "condition \"%s\")", arg);
1845 return ERROR;
1846 }
1847 se_mailfrom = string_copy(opt);
1848 break;
1849 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1850 case CALLOUT_MAXWAIT: callout_overall = period; break;
1851 case CALLOUT_CONNECT: callout_connect = period; break;
1852 case CALLOUT_TIME: callout = period; break;
1853 }
059ec3d9
PH		 1854 }
1855 }
1856 else
1857 {
1858 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1859 "ACL condition \"%s\"", arg);
1860 return ERROR;
1861 }
1862 }
1863 }
1864
1865 /* Option not recognized */
1866
1867 else
1868 {
1869 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1870 "condition \"verify %s\"", ss, arg);
1871 return ERROR;
1872 }
1873 }
1874
1875if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1876 (vopt_callout_recipsender|vopt_callout_recippmaster))
1877 {
1878 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1879 "for a recipient callout";
1880 return ERROR;
1881 }
1882
1883/* Handle sender-in-header verification. Default the user message to the log
1884message if giving out verification details. */
1885
1886if (verify_header_sender)
1887 {
8e669ac1 1888 int verrno;
2f682e45
JH		 1889
1890 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1891 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1892 &verrno)) != OK)
8e669ac1 1893 {
fe5b5d0b
PH		 1894 *basic_errno = verrno;
1895 if (smtp_return_error_details)
1896 {
2f682e45 1897 if (!*user_msgptr && *log_msgptr)
fe5b5d0b 1898 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
8768d548 1899 if (rc == DEFER) f.acl_temp_details = TRUE;
fe5b5d0b 1900 }
8e669ac1 1901 }
059ec3d9
PH		 1902 }
1903
1904/* Handle a sender address. The default is to verify *the* sender address, but
1905optionally a different address can be given, for special requirements. If the
1906address is empty, we are dealing with a bounce message that has no sender, so
1907we cannot do any checking. If the real sender address gets rewritten during
1908verification (e.g. DNS widening), set the flag to stop it being rewritten again
1909during message reception.
1910
1911A list of verified "sender" addresses is kept to try to avoid doing to much
1912work repetitively when there are multiple recipients in a message and they all
1913require sender verification. However, when callouts are involved, it gets too
1914complicated because different recipients may require different callout options.
1915Therefore, we always do a full sender verify when any kind of callout is
1916specified. Caching elsewhere, for instance in the DNS resolver and in the
1917callout handling, should ensure that this is not terribly inefficient. */
1918
2f682e45 1919else if (verify_sender_address)
059ec3d9 1920 {
2f682e45 1921 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH		 1922 {
1923 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1924 "sender verify callout";
1925 return ERROR;
1926 }
1927
1928 sender_vaddr = verify_checked_sender(verify_sender_address);
1929 if (sender_vaddr != NULL && /* Previously checked */
1930 callout <= 0) /* No callout needed this time */
1931 {
1932 /* If the "routed" flag is set, it means that routing worked before, so
1933 this check can give OK (the saved return code value, if set, belongs to a
1934 callout that was done previously). If the "routed" flag is not set, routing
1935 must have failed, so we use the saved return code. */
1936
2f682e45
JH		 1937 if (testflag(sender_vaddr, af_verify_routed))
1938 rc = OK;
1939 else
059ec3d9
PH		 1940 {
1941 rc = sender_vaddr->special_action;
1942 *basic_errno = sender_vaddr->basic_errno;
1943 }
e1d04f48 1944 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
059ec3d9
PH		 1945 }
1946
1947 /* Do a new verification, and cache the result. The cache is used to avoid
1948 verifying the sender multiple times for multiple RCPTs when callouts are not
1949 specified (see comments above).
1950
1951 The cache is also used on failure to give details in response to the first
1952 RCPT that gets bounced for this reason. However, this can be suppressed by
1953 the no_details option, which sets the flag that says "this detail has already
1954 been sent". The cache normally contains just one address, but there may be
1955 more in esoteric circumstances. */
1956
1957 else
1958 {
1959 BOOL routed = TRUE;
2a3eea10 1960 uschar *save_address_data = deliver_address_data;
8e669ac1 1961
059ec3d9 1962 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 1963#ifdef SUPPORT_I18N
3c8b3577
JH		 1964 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1965 {
1966 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1967 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1968 }
f358d5e0 1969#endif
059ec3d9
PH		 1970 if (no_details) setflag(sender_vaddr, af_sverify_told);
1971 if (verify_sender_address[0] != 0)
1972 {
1973 /* If this is the real sender address, save the unrewritten version
1974 for use later in receive. Otherwise, set a flag so that rewriting the
1975 sender in verify_address() does not update sender_address. */
1976
1977 if (verify_sender_address == sender_address)
1978 sender_address_unrewritten = sender_address;
1979 else
1980 verify_options |= vopt_fake_sender;
1981
eafd343b
TK		 1982 if (success_on_redirect)
1983 verify_options |= vopt_success_on_redirect;
1984
059ec3d9
PH		 1985 /* The recipient, qualify, and expn options are never set in
1986 verify_options. */
1987
1988 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1989 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9 1990
e1d04f48 1991 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
059ec3d9 1992
2f682e45
JH		 1993 if (rc != OK)
1994 *basic_errno = sender_vaddr->basic_errno;
1995 else
1996 DEBUG(D_acl)
1997 {
1998 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
e1d04f48 1999 debug_printf_indent("sender %s verified ok as %s\n",
2f682e45
JH		 2000 verify_sender_address, sender_vaddr->address);
2001 else
e1d04f48 2002 debug_printf_indent("sender %s verified ok\n",
2f682e45
JH		 2003 verify_sender_address);
2004 }
059ec3d9 2005 }
2f682e45
JH		 2006 else
2007 rc = OK; /* Null sender */
059ec3d9
PH		 2008
2009 /* Cache the result code */
2010
2011 if (routed) setflag(sender_vaddr, af_verify_routed);
2012 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2013 sender_vaddr->special_action = rc;
2014 sender_vaddr->next = sender_verified_list;
2015 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2016
2017 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2018 the sender verification. */
8e669ac1 2019
2a3eea10 2020 deliver_address_data = save_address_data;
059ec3d9 2021 }
8e669ac1 2022
2a3eea10
PH		 2023 /* Put the sender address_data value into $sender_address_data */
2024
d43cbe25 2025 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2026 }
2027
2028/* A recipient address just gets a straightforward verify; again we must handle
2029the DEFER overrides. */
2030
2031else
2032 {
2033 address_item addr2;
2034
eafd343b
TK		 2035 if (success_on_redirect)
2036 verify_options |= vopt_success_on_redirect;
2037
059ec3d9
PH		 2038 /* We must use a copy of the address for verification, because it might
2039 get rewritten. */
2040
2041 addr2 = *addr;
2042 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2043 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
e1d04f48 2044 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
8e669ac1 2045
42855d71 2046 *basic_errno = addr2.basic_errno;
059ec3d9 2047 *log_msgptr = addr2.message;
8e669ac1 2048 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2049 addr2.user_message : addr2.message;
42855d71
PH		 2050
2051 /* Allow details for temporary error if the address is so flagged. */
8768d548 2052 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
059ec3d9
PH		 2053
2054 /* Make $address_data visible */
d43cbe25 2055 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2056 }
2057
2058/* We have a result from the relevant test. Handle defer overrides first. */
2059
2060if (rc == DEFER && (defer_ok ||
2061 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2062 {
e1d04f48 2063 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
059ec3d9
PH		 2064 defer_ok? "defer_ok" : "callout_defer_ok");
2065 rc = OK;
2066 }
2067
2068/* If we've failed a sender, set up a recipient message, and point
2069sender_verified_failed to the address item that actually failed. */
2070
2071if (rc != OK && verify_sender_address != NULL)
2072 {
2073 if (rc != DEFER)
059ec3d9 2074 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2075 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2076 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2077 else
2078 {
2079 *log_msgptr = US"Could not complete sender verify callout";
2080 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2081 *log_msgptr;
2082 }
2083
2084 sender_verified_failed = sender_vaddr;
2085 }
2086
2087/* Verifying an address messes up the values of $domain and $local_part,
2088so reset them before returning if this is a RCPT ACL. */
2089
2090if (addr != NULL)
2091 {
2092 deliver_domain = addr->domain;
2093 deliver_localpart = addr->local_part;
2094 }
2095return rc;
2096
2097/* Syntax errors in the verify argument come here. */
2098
2099BAD_VERIFY:
2100*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2101 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2102 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2103 "\"verify %s\"", arg);
2104return ERROR;
2105}
2106
2107
2108
2109
2110/*************************************************
2111* Check argument for control= modifier *
2112*************************************************/
2113
2114/* Called from acl_check_condition() below
2115
2116Arguments:
2117 arg the argument string for control=
2118 pptr set to point to the terminating character
2119 where which ACL we are in
2120 log_msgptr for error messages
2121
2122Returns: CONTROL_xxx value
2123*/
2124
2125static int
55414b25 2126decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2127{
d7bed771
JH		 2128int idx, len;
2129control_def * d;
059ec3d9 2130
d7bed771
JH		 2131if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2132 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2133 && (!d->has_option || arg[len] != '/')
2134 ) )
059ec3d9
PH		 2135 {
2136 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2137 return CONTROL_ERROR;
2138 }
2139
059ec3d9 2140*pptr = arg + len;
d7bed771 2141return idx;
059ec3d9
PH		 2142}
2143
2144
2145
c99ce5c9
TF		 2146
2147/*************************************************
2148* Return a ratelimit error *
2149*************************************************/
2150
2151/* Called from acl_ratelimit() below
2152
2153Arguments:
2154 log_msgptr for error messages
2155 format format string
2156 ... supplementary arguments
c99ce5c9
TF		 2157
2158Returns: ERROR
2159*/
2160
2161static int
2162ratelimit_error(uschar **log_msgptr, const char *format, ...)
2163{
2164va_list ap;
d12746bc
JH		 2165gstring * g =
2166 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2167
c99ce5c9 2168va_start(ap, format);
d12746bc 2169g = string_vformat(g, TRUE, format, ap);
c99ce5c9 2170va_end(ap);
d12746bc
JH		 2171
2172gstring_reset_unused(g);
2173*log_msgptr = string_from_gstring(g);
c99ce5c9
TF		 2174return ERROR;
2175}
2176
2177
2178
2179
870f6ba8
TF		 2180/*************************************************
2181* Handle rate limiting *
2182*************************************************/
2183
2184/* Called by acl_check_condition() below to calculate the result
2185of the ACL ratelimit condition.
2186
2187Note that the return value might be slightly unexpected: if the
2188sender's rate is above the limit then the result is OK. This is
2189similar to the dnslists condition, and is so that you can write
2190ACL clauses like: defer ratelimit = 15 / 1h
2191
2192Arguments:
2193 arg the option string for ratelimit=
90fc3069 2194 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2195 log_msgptr for error messages
2196
2197Returns: OK - Sender's rate is above limit
2198 FAIL - Sender's rate is below limit
2199 DEFER - Problem opening ratelimit database
2200 ERROR - Syntax error in options.
2201*/
2202
2203static int
55414b25 2204acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2205{
c99ce5c9 2206double limit, period, count;
8f240103
PH		 2207uschar *ss;
2208uschar *key = NULL;
c99ce5c9 2209uschar *unique = NULL;
870f6ba8 2210int sep = '/';
c99ce5c9
TF		 2211BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2212BOOL noupdate = FALSE, badacl = FALSE;
2213int mode = RATE_PER_WHAT;
870f6ba8
TF		 2214int old_pool, rc;
2215tree_node **anchor, *t;
2216open_db dbblock, *dbm;
c99ce5c9 2217int dbdb_size;
870f6ba8 2218dbdata_ratelimit *dbd;
c99ce5c9 2219dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2220struct timeval tv;
2221
2222/* Parse the first two options and record their values in expansion
2223variables. These variables allow the configuration to have informative
2224error messages based on rate limits obtained from a table lookup. */
2225
c99ce5c9 2226/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2227size, which must be greater than or equal to zero. Zero is useful for
2228rate measurement as opposed to rate limiting. */
2229
65a32f85 2230if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
96f5fe4c
JH		 2231 return ratelimit_error(log_msgptr, "sender rate limit not set");
2232
2233limit = Ustrtod(sender_rate_limit, &ss);
2234if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2235else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2236else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2237
c99ce5c9
TF		 2238if (limit < 0.0 || *ss != '\0')
2239 return ratelimit_error(log_msgptr,
2240 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2241
c99ce5c9 2242/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2243constant. This must be strictly greater than zero, because zero leads to
2244run-time division errors. */
2245
65a32f85
JH		 2246period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2247 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
870f6ba8 2248if (period <= 0.0)
c99ce5c9
TF		 2249 return ratelimit_error(log_msgptr,
2250 "\"%s\" is not a time value", sender_rate_period);
2251
2252/* By default we are counting one of something, but the per_rcpt,
2253per_byte, and count options can change this. */
2254
2255count = 1.0;
870f6ba8 2256
c99ce5c9 2257/* Parse the other options. */
870f6ba8 2258
65a32f85 2259while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
870f6ba8
TF		 2260 {
2261 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2262 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2263 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2264 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2265 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2266 else if (strcmpic(ss, US"per_conn") == 0)
2267 {
2268 RATE_SET(mode, PER_CONN);
2269 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2270 badacl = TRUE;
2271 }
2272 else if (strcmpic(ss, US"per_mail") == 0)
2273 {
2274 RATE_SET(mode, PER_MAIL);
2275 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2276 }
2277 else if (strcmpic(ss, US"per_rcpt") == 0)
2278 {
2279 /* If we are running in the RCPT ACL, then we'll count the recipients
2280 one by one, but if we are running when we have accumulated the whole
2281 list then we'll add them all in one batch. */
2282 if (where == ACL_WHERE_RCPT)
2283 RATE_SET(mode, PER_RCPT);
2284 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2285 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2286 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2287 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2288 }
2289 else if (strcmpic(ss, US"per_byte") == 0)
2290 {
2291 /* If we have not yet received the message data and there was no SIZE
4c04137d 2292 declaration on the MAIL command, then it's safe to just use a value of
c99ce5c9
TF		 2293 zero and let the recorded rate decay as if nothing happened. */
2294 RATE_SET(mode, PER_MAIL);
2295 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
65a32f85 2296 else count = message_size < 0 ? 0.0 : (double)message_size;
c99ce5c9
TF		 2297 }
2298 else if (strcmpic(ss, US"per_addr") == 0)
2299 {
2300 RATE_SET(mode, PER_RCPT);
438257ba 2301 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
65a32f85 2302 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
c99ce5c9
TF		 2303 }
2304 else if (strncmpic(ss, US"count=", 6) == 0)
2305 {
2306 uschar *e;
2307 count = Ustrtod(ss+6, &e);
2308 if (count < 0.0 || *e != '\0')
65a32f85 2309 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
c99ce5c9
TF		 2310 }
2311 else if (strncmpic(ss, US"unique=", 7) == 0)
2312 unique = string_copy(ss + 7);
65a32f85 2313 else if (!key)
c99ce5c9
TF		 2314 key = string_copy(ss);
2315 else
2316 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2317 }
2318
c99ce5c9
TF		 2319/* Sanity check. When the badacl flag is set the update mode must either
2320be readonly (which is the default if it is omitted) or, for backwards
2321compatibility, a combination of noupdate and strict or leaky. */
2322
2323if (mode == RATE_PER_CLASH)
2324 return ratelimit_error(log_msgptr, "conflicting per_* options");
2325if (leaky + strict + readonly > 1)
2326 return ratelimit_error(log_msgptr, "conflicting update modes");
2327if (badacl && (leaky || strict) && !noupdate)
2328 return ratelimit_error(log_msgptr,
bfe6da19 2329 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
c99ce5c9
TF		 2330 ratelimit_option_string[mode], acl_wherenames[where]);
2331
2332/* Set the default values of any unset options. In readonly mode we
2333perform the rate computation without any increment so that its value
2334decays to eventually allow over-limit senders through. */
2335
2336if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2337if (badacl) readonly = TRUE;
2338if (readonly) count = 0.0;
2339if (!strict && !readonly) leaky = TRUE;
2340if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2341
8f240103
PH		 2342/* Create the lookup key. If there is no explicit key, use sender_host_address.
2343If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2344omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2345are added to the key because they alter the meaning of the stored data. */
2346
65a32f85
JH		 2347if (!key)
2348 key = !sender_host_address ? US"" : sender_host_address;
870f6ba8 2349
c99ce5c9 2350key = string_sprintf("%s/%s/%s%s",
8f240103 2351 sender_rate_period,
c99ce5c9
TF		 2352 ratelimit_option_string[mode],
2353 unique == NULL ? "" : "unique/",
8f240103 2354 key);
870f6ba8 2355
c99ce5c9 2356HDEBUG(D_acl)
e1d04f48 2357 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2358
8f240103
PH		 2359/* See if we have already computed the rate by looking in the relevant tree.
2360For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2361pool so that they survive across resets. In readonly mode we only remember the
2362result for the rest of this command in case a later command changes it. After
2363this bit of logic the code is independent of the per_* mode. */
870f6ba8 2364
870f6ba8
TF		 2365old_pool = store_pool;
2366
c99ce5c9
TF		 2367if (readonly)
2368 anchor = &ratelimiters_cmd;
65a32f85
JH		 2369else switch(mode)
2370 {
2371 case RATE_PER_CONN:
2372 anchor = &ratelimiters_conn;
2373 store_pool = POOL_PERM;
2374 break;
2375 case RATE_PER_BYTE:
2376 case RATE_PER_MAIL:
2377 case RATE_PER_ALLRCPTS:
2378 anchor = &ratelimiters_mail;
2379 break;
2380 case RATE_PER_ADDR:
2381 case RATE_PER_CMD:
2382 case RATE_PER_RCPT:
2383 anchor = &ratelimiters_cmd;
2384 break;
2385 default:
2386 anchor = NULL; /* silence an "unused" complaint */
2387 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2388 "internal ACL error: unknown ratelimit mode %d", mode);
2389 break;
2390 }
870f6ba8 2391
65a32f85 2392if ((t = tree_search(*anchor, key)))
870f6ba8
TF		 2393 {
2394 dbd = t->data.ptr;
2395 /* The following few lines duplicate some of the code below. */
8f240103 2396 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2397 store_pool = old_pool;
2398 sender_rate = string_sprintf("%.1f", dbd->rate);
2399 HDEBUG(D_acl)
e1d04f48 2400 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
870f6ba8
TF		 2401 return rc;
2402 }
2403
c99ce5c9
TF		 2404/* We aren't using a pre-computed rate, so get a previously recorded rate
2405from the database, which will be updated and written back if required. */
870f6ba8 2406
0a6c178c 2407if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
870f6ba8
TF		 2408 {
2409 store_pool = old_pool;
2410 sender_rate = NULL;
e1d04f48 2411 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
870f6ba8
TF		 2412 *log_msgptr = US"ratelimit database not available";
2413 return DEFER;
2414 }
c99ce5c9
TF		 2415dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2416dbd = NULL;
870f6ba8
TF		 2417
2418gettimeofday(&tv, NULL);
2419
65a32f85 2420if (dbdb)
c99ce5c9
TF		 2421 {
2422 /* Locate the basic ratelimit block inside the DB data. */
e1d04f48 2423 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
c99ce5c9
TF		 2424 dbd = &dbdb->dbd;
2425
2426 /* Forget the old Bloom filter if it is too old, so that we count each
2427 repeating event once per period. We don't simply clear and re-use the old
2428 filter because we want its size to change if the limit changes. Note that
2429 we keep the dbd pointer for copying the rate into the new data block. */
2430
65a32f85 2431 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
c99ce5c9 2432 {
e1d04f48 2433 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
c99ce5c9
TF		 2434 dbdb = NULL;
2435 }
2436
2437 /* Sanity check. */
2438
65a32f85 2439 if(unique && dbdb_size < sizeof(*dbdb))
c99ce5c9 2440 {
e1d04f48 2441 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
c99ce5c9
TF		 2442 dbdb = NULL;
2443 }
2444 }
2445
2446/* Allocate a new data block if the database lookup failed
2447or the Bloom filter passed its age limit. */
2448
65a32f85 2449if (!dbdb)
c99ce5c9 2450 {
65a32f85 2451 if (!unique)
c99ce5c9
TF		 2452 {
2453 /* No Bloom filter. This basic ratelimit block is initialized below. */
e1d04f48 2454 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
c99ce5c9
TF		 2455 dbdb_size = sizeof(*dbd);
2456 dbdb = store_get(dbdb_size);
2457 }
2458 else
2459 {
2460 int extra;
e1d04f48 2461 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
c99ce5c9
TF		 2462
2463 /* See the long comment below for an explanation of the magic number 2.
2464 The filter has a minimum size in case the rate limit is very small;
2465 this is determined by the definition of dbdata_ratelimit_unique. */
2466
2467 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2468 if (extra < 0) extra = 0;
2469 dbdb_size = sizeof(*dbdb) + extra;
2470 dbdb = store_get(dbdb_size);
2471 dbdb->bloom_epoch = tv.tv_sec;
2472 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2473 memset(dbdb->bloom, 0, dbdb->bloom_size);
2474
2475 /* Preserve any basic ratelimit data (which is our longer-term memory)
2476 by copying it from the discarded block. */
2477
65a32f85 2478 if (dbd)
c99ce5c9
TF		 2479 {
2480 dbdb->dbd = *dbd;
2481 dbd = &dbdb->dbd;
2482 }
2483 }
2484 }
2485
2486/* If we are counting unique events, find out if this event is new or not.
2487If the client repeats the event during the current period then it should be
2488counted. We skip this code in readonly mode for efficiency, because any
2489changes to the filter will be discarded and because count is already set to
2490zero. */
2491
65a32f85 2492if (unique && !readonly)
c99ce5c9
TF		 2493 {
2494 /* We identify unique events using a Bloom filter. (You can find my
2495 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2496 With the per_addr option, an "event" is a recipient address, though the
2497 user can use the unique option to define their own events. We only count
2498 an event if we have not seen it before.
2499
2500 We size the filter according to the rate limit, which (in leaky mode)
2501 is the limit on the population of the filter. We allow 16 bits of space
2502 per entry (see the construction code above) and we set (up to) 8 of them
2503 when inserting an element (see the loop below). The probability of a false
2504 positive (an event we have not seen before but which we fail to count) is
2505
2506 size = limit * 16
2507 numhash = 8
2508 allzero = exp(-numhash * pop / size)
2509 = exp(-0.5 * pop / limit)
2510 fpr = pow(1 - allzero, numhash)
2511
2512 For senders at the limit the fpr is 0.06% or 1 in 1700
2513 and for senders at half the limit it is 0.0006% or 1 in 170000
2514
2515 In strict mode the Bloom filter can fill up beyond the normal limit, in
2516 which case the false positive rate will rise. This means that the
2517 measured rate for very fast senders can bogusly drop off after a while.
2518
2519 At twice the limit, the fpr is 2.5% or 1 in 40
2520 At four times the limit, it is 31% or 1 in 3.2
2521
2522 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2523 decay below the limit, and if this is more than one then the Bloom filter
2524 will be discarded before the decay gets that far. The false positive rate
2525 at this threshold is 9.3% or 1 in 10.7. */
2526
2527 BOOL seen;
2528 unsigned n, hash, hinc;
2529 uschar md5sum[16];
2530 md5 md5info;
2531
2532 /* Instead of using eight independent hash values, we combine two values
2533 using the formula h1 + n * h2. This does not harm the Bloom filter's
2534 performance, and means the amount of hash we need is independent of the
2535 number of bits we set in the filter. */
2536
2537 md5_start(&md5info);
2538 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2539 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2540 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2541
2542 /* Scan the bits corresponding to this event. A zero bit means we have
2543 not seen it before. Ensure all bits are set to record this event. */
2544
e1d04f48 2545 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
c99ce5c9
TF		 2546
2547 seen = TRUE;
2548 for (n = 0; n < 8; n++, hash += hinc)
2549 {
2550 int bit = 1 << (hash % 8);
2551 int byte = (hash / 8) % dbdb->bloom_size;
2552 if ((dbdb->bloom[byte] & bit) == 0)
2553 {
2554 dbdb->bloom[byte] |= bit;
2555 seen = FALSE;
2556 }
2557 }
2558
2559 /* If this event has occurred before, do not count it. */
2560
2561 if (seen)
2562 {
e1d04f48 2563 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
c99ce5c9
TF		 2564 count = 0.0;
2565 }
2566 else
e1d04f48 2567 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
c99ce5c9
TF		 2568 }
2569
2570/* If there was no previous ratelimit data block for this key, initialize
2571the new one, otherwise update the block from the database. The initial rate
2572is what would be computed by the code below for an infinite interval. */
2573
65a32f85 2574if (!dbd)
870f6ba8 2575 {
e1d04f48 2576 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
c99ce5c9 2577 dbd = &dbdb->dbd;
870f6ba8
TF		 2578 dbd->time_stamp = tv.tv_sec;
2579 dbd->time_usec = tv.tv_usec;
c99ce5c9 2580 dbd->rate = count;
870f6ba8
TF		 2581 }
2582else
2583 {
2584 /* The smoothed rate is computed using an exponentially weighted moving
2585 average adjusted for variable sampling intervals. The standard EWMA for
2586 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2587 where f() is the measured value and f'() is the smoothed value.
2588
2589 Old data decays out of the smoothed value exponentially, such that data n
2590 samples old is multiplied by a^n. The exponential decay time constant p
2591 is defined such that data p samples old is multiplied by 1/e, which means
2592 that a = exp(-1/p). We can maintain the same time constant for a variable
2593 sampling interval i by using a = exp(-i/p).
2594
2595 The rate we are measuring is messages per period, suitable for directly
2596 comparing with the limit. The average rate between now and the previous
2597 message is period / interval, which we feed into the EWMA as the sample.
2598
2599 It turns out that the number of messages required for the smoothed rate
2600 to reach the limit when they are sent in a burst is equal to the limit.
2601 This can be seen by analysing the value of the smoothed rate after N
2602 messages sent at even intervals. Let k = (1 - a) * p/i
2603
2604 rate_1 = (1 - a) * p/i + a * rate_0
2605 = k + a * rate_0
2606 rate_2 = k + a * rate_1
2607 = k + a * k + a^2 * rate_0
2608 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2609 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2610 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2611 = rate_0 * a^N + p/i * (1 - a^N)
2612
2613 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2614
2615 rate_N = p/i + (rate_0 - p/i) * a^N
2616 a^N = (rate_N - p/i) / (rate_0 - p/i)
2617 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2618 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2619
2620 Numerical analysis of the above equation, setting the computed rate to
2621 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2622 rates, p/i, the number of messages N = limit. So limit serves as both the
2623 maximum rate measured in messages per period, and the maximum number of
2624 messages that can be sent in a fast burst. */
2625
2626 double this_time = (double)tv.tv_sec
2627 + (double)tv.tv_usec / 1000000.0;
2628 double prev_time = (double)dbd->time_stamp
2629 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2630
2631 /* We must avoid division by zero, and deal gracefully with the clock going
2632 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2633 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2634
e5d5a95f
TF		 2635 double interval = this_time - prev_time <= 0.0 ? 1e-9
2636 : this_time - prev_time;
2637
2638 double i_over_p = interval / period;
2639 double a = exp(-i_over_p);
870f6ba8 2640
c99ce5c9
TF		 2641 /* Combine the instantaneous rate (period / interval) with the previous rate
2642 using the smoothing factor a. In order to measure sized events, multiply the
2643 instantaneous rate by the count of bytes or recipients etc. */
2644
870f6ba8
TF		 2645 dbd->time_stamp = tv.tv_sec;
2646 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2647 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2648
2649 /* When events are very widely spaced the computed rate tends towards zero.
2650 Although this is accurate it turns out not to be useful for our purposes,
2651 especially when the first event after a long silence is the start of a spam
2652 run. A more useful model is that the rate for an isolated event should be the
2653 size of the event per the period size, ignoring the lack of events outside
2654 the current period and regardless of where the event falls in the period. So,
2655 if the interval was so long that the calculated rate is unhelpfully small, we
4c04137d 2656 re-initialize the rate. In the absence of higher-rate bursts, the condition
c99ce5c9
TF		 2657 below is true if the interval is greater than the period. */
2658
2659 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2660 }
2661
c99ce5c9
TF		 2662/* Clients sending at the limit are considered to be over the limit.
2663This matters for edge cases such as a limit of zero, when the client
2664should be completely blocked. */
3348576f 2665
65a32f85 2666rc = dbd->rate < limit ? FAIL : OK;
870f6ba8
TF		 2667
2668/* Update the state if the rate is low or if we are being strict. If we
2669are in leaky mode and the sender's rate is too high, we do not update
2670the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2671rate preventing them from getting any email through. If readonly is set,
2672neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2673
c99ce5c9 2674if ((rc == FAIL && leaky) || strict)
8f240103 2675 {
c99ce5c9 2676 dbfn_write(dbm, key, dbdb, dbdb_size);
e1d04f48 2677 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
8f240103
PH		 2678 }
2679else
2680 {
e1d04f48 2681 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
c99ce5c9 2682 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2683 }
2684
870f6ba8
TF		 2685dbfn_close(dbm);
2686
c99ce5c9 2687/* Store the result in the tree for future reference. */
870f6ba8 2688
c99ce5c9
TF		 2689t = store_get(sizeof(tree_node) + Ustrlen(key));
2690t->data.ptr = dbd;
2691Ustrcpy(t->name, key);
2692(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2693
2694/* We create the formatted version of the sender's rate very late in
2695order to ensure that it is done using the correct storage pool. */
2696
2697store_pool = old_pool;
2698sender_rate = string_sprintf("%.1f", dbd->rate);
2699
2700HDEBUG(D_acl)
e1d04f48 2701 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
870f6ba8
TF		 2702
2703return rc;
2704}
2705
2706
2707
b0019c78
TF		 2708/*************************************************
2709* The udpsend ACL modifier *
2710*************************************************/
2711
2712/* Called by acl_check_condition() below.
2713
2714Arguments:
2715 arg the option string for udpsend=
2716 log_msgptr for error messages
2717
2718Returns: OK - Completed.
2719 DEFER - Problem with DNS lookup.
2720 ERROR - Syntax error in options.
2721*/
2722
2723static int
55414b25 2724acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2725{
2726int sep = 0;
2727uschar *hostname;
2728uschar *portstr;
2729uschar *portend;
2730host_item *h;
2731int portnum;
b0019c78
TF		 2732int len;
2733int r, s;
b1f8e4f8 2734uschar * errstr;
b0019c78
TF		 2735
2736hostname = string_nextinlist(&arg, &sep, NULL, 0);
2737portstr = string_nextinlist(&arg, &sep, NULL, 0);
2738
f5d25c2b 2739if (!hostname)
b0019c78 2740 {
217b0e56 2741 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2742 return ERROR;
2743 }
f5d25c2b 2744if (!portstr)
b0019c78 2745 {
217b0e56 2746 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2747 return ERROR;
2748 }
f5d25c2b 2749if (!arg)
b0019c78 2750 {
217b0e56 2751 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2752 return ERROR;
2753 }
2754portnum = Ustrtol(portstr, &portend, 10);
2755if (*portend != '\0')
2756 {
217b0e56 2757 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2758 return ERROR;
2759 }
2760
2761/* Make a single-item host list. */
2762h = store_get(sizeof(host_item));
2763memset(h, 0, sizeof(host_item));
2764h->name = hostname;
2765h->port = portnum;
2766h->mx = MX_NONE;
2767
2768if (string_is_ip_address(hostname, NULL))
2769 h->address = hostname, r = HOST_FOUND;
2770else
2771 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2772if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2773 {
217b0e56 2774 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2775 return DEFER;
2776 }
2777
2778HDEBUG(D_acl)
e1d04f48 2779 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
b0019c78 2780
4a5cbaff 2781/*XXX this could better use sendto */
b1f8e4f8 2782r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
4a5cbaff 2783 1, NULL, &errstr, NULL);
b0019c78 2784if (r < 0) goto defer;
27f9999e 2785len = Ustrlen(arg);
9cb1785a 2786r = send(s, arg, len, 0);
b1f8e4f8
JH		 2787if (r < 0)
2788 {
2789 errstr = US strerror(errno);
2790 close(s);
2791 goto defer;
2792 }
2793close(s);
b0019c78
TF		 2794if (r < len)
2795 {
2796 *log_msgptr =
2797 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2798 return DEFER;
2799 }
2800
2801HDEBUG(D_acl)
e1d04f48 2802 debug_printf_indent("udpsend %d bytes\n", r);
b0019c78
TF		 2803
2804return OK;
2805
2806defer:
b1f8e4f8 2807*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2808return DEFER;
2809}
2810
2811
2812
059ec3d9
PH		 2813/*************************************************
2814* Handle conditions/modifiers on an ACL item *
2815*************************************************/
2816
2817/* Called from acl_check() below.
2818
2819Arguments:
2820 verb ACL verb
2821 cb ACL condition block - if NULL, result is OK
2822 where where called from
2823 addr the address being checked for RCPT, or NULL
2824 level the nesting level
2825 epp pointer to pass back TRUE if "endpass" encountered
2826 (applies only to "accept" and "discard")
2827 user_msgptr user message pointer
2828 log_msgptr log message pointer
2829 basic_errno pointer to where to put verify error
2830
2831Returns: OK - all conditions are met
2832 DISCARD - an "acl" condition returned DISCARD - only allowed
2833 for "accept" or "discard" verbs
2834 FAIL - at least one condition fails
2835 FAIL_DROP - an "acl" condition returned FAIL_DROP
2836 DEFER - can't tell at the moment (typically, lookup defer,
2837 but can be temporary callout problem)
2838 ERROR - ERROR from nested ACL or expansion failure or other
2839 error
2840*/
2841
2842static int
2843acl_check_condition(int verb, acl_condition_block *cb, int where,
2844 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2845 uschar **log_msgptr, int *basic_errno)
2846{
2847uschar *user_message = NULL;
2848uschar *log_message = NULL;
059ec3d9 2849int rc = OK;
8523533c 2850#ifdef WITH_CONTENT_SCAN
0f0c8159 2851int sep = -'/';
8523533c 2852#endif
059ec3d9 2853
bce15b62 2854for (; cb; cb = cb->next)
059ec3d9 2855 {
55414b25 2856 const uschar *arg;
8e669ac1 2857 int control_type;
059ec3d9
PH		 2858
2859 /* The message and log_message items set up messages to be used in
2860 case of rejection. They are expanded later. */
2861
2862 if (cb->type == ACLC_MESSAGE)
2863 {
e1d04f48 2864 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
059ec3d9
PH		 2865 user_message = cb->arg;
2866 continue;
2867 }
2868
2869 if (cb->type == ACLC_LOG_MESSAGE)
2870 {
e1d04f48 2871 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
059ec3d9
PH		 2872 log_message = cb->arg;
2873 continue;
2874 }
2875
2876 /* The endpass "condition" just sets a flag to show it occurred. This is
2877 checked at compile time to be on an "accept" or "discard" item. */
2878
2879 if (cb->type == ACLC_ENDPASS)
2880 {
2881 *epp = TRUE;
2882 continue;
2883 }
2884
2885 /* For other conditions and modifiers, the argument is expanded now for some
2886 of them, but not for all, because expansion happens down in some lower level
2887 checking functions in some cases. */
2888
560e71cc
JH		 2889 if (!conditions[cb->type].expand_at_top)
2890 arg = cb->arg;
2891 else if (!(arg = expand_string(cb->arg)))
059ec3d9 2892 {
8768d548 2893 if (f.expand_string_forcedfail) continue;
560e71cc
JH		 2894 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2895 cb->arg, expand_string_message);
8768d548 2896 return f.search_find_defer ? DEFER : ERROR;
059ec3d9 2897 }
059ec3d9
PH		 2898
2899 /* Show condition, and expanded condition if it's different */
2900
2901 HDEBUG(D_acl)
2902 {
2903 int lhswidth = 0;
e1d04f48 2904 debug_printf_indent("check %s%s %n",
2d009132
JH		 2905 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2906 conditions[cb->type].name, &lhswidth);
059ec3d9
PH		 2907
2908 if (cb->type == ACLC_SET)
2909 {
a79d8834
JH		 2910#ifndef DISABLE_DKIM
2911 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2912 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2913 {
2914 debug_printf("%s ", cb->u.varname);
2915 lhswidth += 19;
2916 }
2917 else
2918#endif
2919 {
2920 debug_printf("acl_%s ", cb->u.varname);
2921 lhswidth += 5 + Ustrlen(cb->u.varname);
2922 }
059ec3d9
PH		 2923 }
2924
2925 debug_printf("= %s\n", cb->arg);
2926
2927 if (arg != cb->arg)
2928 debug_printf("%.*s= %s\n", lhswidth,
2929 US" ", CS arg);
2930 }
2931
2932 /* Check that this condition makes sense at this time */
2933
2d009132 2934 if ((conditions[cb->type].forbids & (1 << where)) != 0)
059ec3d9
PH		 2935 {
2936 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2d009132
JH		 2937 conditions[cb->type].is_modifier ? "use" : "test",
2938 conditions[cb->type].name, acl_wherenames[where]);
059ec3d9
PH		 2939 return ERROR;
2940 }
2941
2942 /* Run the appropriate test for each condition, or take the appropriate
2943 action for the remaining modifiers. */
2944
2945 switch(cb->type)
2946 {
71fafd95
PH		 2947 case ACLC_ADD_HEADER:
2948 setup_header(arg);
2949 break;
2950
059ec3d9
PH		 2951 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2952 "discard" verb. */
71fafd95 2953
059ec3d9 2954 case ACLC_ACL:
e1d04f48 2955 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
7421ecab
JH		 2956 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2957 {
2958 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2959 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2960 verbs[verb]);
2961 return ERROR;
2962 }
059ec3d9
PH		 2963 break;
2964
2965 case ACLC_AUTHENTICATED:
c44ff8be
JH		 2966 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2967 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
059ec3d9
PH		 2968 break;
2969
71fafd95 2970 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 2971 case ACLC_BMI_OPTIN:
2972 {
2973 int old_pool = store_pool;
2974 store_pool = POOL_PERM;
2975 bmi_current_optin = string_copy(arg);
2976 store_pool = old_pool;
2977 }
2978 break;
71fafd95 2979 #endif
8523533c 2980
059ec3d9 2981 case ACLC_CONDITION:
f3766eb5
NM		 2982 /* The true/false parsing here should be kept in sync with that used in
2983 expand.c when dealing with ECOND_BOOL so that we don't have too many
2984 different definitions of what can be a boolean. */
51c7471d
JH		 2985 if (*arg == '-'
2986 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2987 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 2988 rc = (Uatoi(arg) == 0)? FAIL : OK;
2989 else
2990 rc = (strcmpic(arg, US"no") == 0 ||
2991 strcmpic(arg, US"false") == 0)? FAIL :
2992 (strcmpic(arg, US"yes") == 0 ||
2993 strcmpic(arg, US"true") == 0)? OK : DEFER;
2994 if (rc == DEFER)
2995 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2996 break;
2997
c3611384
PH		 2998 case ACLC_CONTINUE: /* Always succeeds */
2999 break;
3000
059ec3d9 3001 case ACLC_CONTROL:
c5fcb476 3002 {
55414b25
JH		 3003 const uschar *p = NULL;
3004 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3005
55414b25 3006 /* Check if this control makes sense at this time */
f7572e5a 3007
d7bed771 3008 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH		 3009 {
3010 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3011 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH		 3012 return ERROR;
3013 }
8800895a 3014
55414b25
JH		 3015 switch(control_type)
3016 {
3017 case CONTROL_AUTH_UNADVERTISED:
8768d548 3018 f.allow_auth_unadvertised = TRUE;
55414b25
JH		 3019 break;
3020
3021 #ifdef EXPERIMENTAL_BRIGHTMAIL
3022 case CONTROL_BMI_RUN:
3023 bmi_run = 1;
3024 break;
3025 #endif
3026
3027 #ifndef DISABLE_DKIM
3028 case CONTROL_DKIM_VERIFY:
8768d548 3029 f.dkim_disable_verify = TRUE;
55414b25
JH		 3030 #ifdef EXPERIMENTAL_DMARC
3031 /* Since DKIM was blocked, skip DMARC too */
8768d548
JH		 3032 f.dmarc_disable_verify = TRUE;
3033 f.dmarc_enable_forensic = FALSE;
55414b25
JH		 3034 #endif
3035 break;
3036 #endif
3037
3038 #ifdef EXPERIMENTAL_DMARC
3039 case CONTROL_DMARC_VERIFY:
8768d548 3040 f.dmarc_disable_verify = TRUE;
55414b25
JH		 3041 break;
3042
3043 case CONTROL_DMARC_FORENSIC:
8768d548 3044 f.dmarc_enable_forensic = TRUE;
55414b25
JH		 3045 break;
3046 #endif
3047
3048 case CONTROL_DSCP:
3049 if (*p == '/')
3050 {
3051 int fd, af, level, optname, value;
3052 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3053 a socket; we can accept that, we'll just debug-log failures anyway. */
3054 fd = fileno(smtp_in);
3055 af = ip_get_address_family(fd);
3056 if (af < 0)
3057 {
3058 HDEBUG(D_acl)
e1d04f48 3059 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
55414b25
JH		 3060 strerror(errno));
3061 break;
3062 }
3063 if (dscp_lookup(p+1, af, &level, &optname, &value))
3064 {
3065 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3066 {
e1d04f48 3067 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
55414b25
JH		 3068 p+1, strerror(errno));
3069 }
3070 else
3071 {
e1d04f48 3072 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
55414b25
JH		 3073 }
3074 }
3075 else
3076 {
3077 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3078 return ERROR;
3079 }
3080 }
3081 else
3082 {
3083 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3084 return ERROR;
3085 }
3086 break;
3087
3088 case CONTROL_ERROR:
3089 return ERROR;
3090
3091 case CONTROL_CASEFUL_LOCAL_PART:
3092 deliver_localpart = addr->cc_local_part;
3093 break;
3094
3095 case CONTROL_CASELOWER_LOCAL_PART:
3096 deliver_localpart = addr->lc_local_part;
3097 break;
3098
3099 case CONTROL_ENFORCE_SYNC:
3100 smtp_enforce_sync = TRUE;
3101 break;
3102
3103 case CONTROL_NO_ENFORCE_SYNC:
3104 smtp_enforce_sync = FALSE;
3105 break;
3106
3107 #ifdef WITH_CONTENT_SCAN
3108 case CONTROL_NO_MBOX_UNSPOOL:
8768d548 3109 f.no_mbox_unspool = TRUE;
55414b25
JH		 3110 break;
3111 #endif
3112
3113 case CONTROL_NO_MULTILINE:
8768d548 3114 f.no_multiline_responses = TRUE;
55414b25
JH		 3115 break;
3116
3117 case CONTROL_NO_PIPELINING:
8768d548 3118 f.pipelining_enable = FALSE;
55414b25
JH		 3119 break;
3120
3121 case CONTROL_NO_DELAY_FLUSH:
8768d548 3122 f.disable_delay_flush = TRUE;
55414b25
JH		 3123 break;
3124
3125 case CONTROL_NO_CALLOUT_FLUSH:
8768d548 3126 f.disable_callout_flush = TRUE;
55414b25
JH		 3127 break;
3128
3129 case CONTROL_FAKEREJECT:
57cc2785 3130 cancel_cutthrough_connection(TRUE, US"fakereject");
55414b25
JH		 3131 case CONTROL_FAKEDEFER:
3132 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3133 if (*p == '/')
3134 {
3135 const uschar *pp = p + 1;
d7978c0f 3136 while (*pp) pp++;
55414b25
JH		 3137 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3138 p = pp;
3139 }
3140 else
3141 {
3142 /* Explicitly reset to default string */
3143 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3144 }
3145 break;
ed7f7860 3146
55414b25 3147 case CONTROL_FREEZE:
8768d548 3148 f.deliver_freeze = TRUE;
55414b25
JH		 3149 deliver_frozen_at = time(NULL);
3150 freeze_tell = freeze_tell_config; /* Reset to configured value */
3151 if (Ustrncmp(p, "/no_tell", 8) == 0)
3152 {
3153 p += 8;
3154 freeze_tell = NULL;
3155 }
3156 if (*p != 0)
3157 {
3158 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3159 return ERROR;
3160 }
57cc2785 3161 cancel_cutthrough_connection(TRUE, US"item frozen");
55414b25
JH		 3162 break;
3163
3164 case CONTROL_QUEUE_ONLY:
8768d548 3165 f.queue_only_policy = TRUE;
57cc2785 3166 cancel_cutthrough_connection(TRUE, US"queueing forced");
55414b25
JH		 3167 break;
3168
8ac90765
JH		 3169#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
3170 case CONTROL_REQUIRETLS:
3171 tls_requiretls |= REQUIRETLS_MSG;
3172 break;
3173#endif
55414b25
JH		 3174 case CONTROL_SUBMISSION:
3175 originator_name = US"";
8768d548 3176 f.submission_mode = TRUE;
55414b25
JH		 3177 while (*p == '/')
3178 {
3179 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3180 {
3181 p += 14;
8768d548
JH		 3182 f.active_local_sender_retain = TRUE;
3183 f.active_local_from_check = FALSE;
55414b25
JH		 3184 }
3185 else if (Ustrncmp(p, "/domain=", 8) == 0)
3186 {
3187 const uschar *pp = p + 8;
d7978c0f 3188 while (*pp && *pp != '/') pp++;
55414b25
JH		 3189 submission_domain = string_copyn(p+8, pp-p-8);
3190 p = pp;
3191 }
3192 /* The name= option must be last, because it swallows the rest of
3193 the string. */
3194 else if (Ustrncmp(p, "/name=", 6) == 0)
3195 {
3196 const uschar *pp = p + 6;
d7978c0f 3197 while (*pp) pp++;
55414b25
JH		 3198 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3199 big_buffer, big_buffer_size));
3200 p = pp;
3201 }
3202 else break;
3203 }
3204 if (*p != 0)
3205 {
3206 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3207 return ERROR;
3208 }
3209 break;
e4bdf652 3210
55414b25 3211 case CONTROL_DEBUG:
55414b25 3212 {
b0d68adc
JH		 3213 uschar * debug_tag = NULL;
3214 uschar * debug_opts = NULL;
3215 BOOL kill = FALSE;
3216
3217 while (*p == '/')
55414b25 3218 {
b0d68adc
JH		 3219 const uschar * pp = p+1;
3220 if (Ustrncmp(pp, "tag=", 4) == 0)
3221 {
3222 for (pp += 4; *pp && *pp != '/';) pp++;
3223 debug_tag = string_copyn(p+5, pp-p-5);
3224 }
3225 else if (Ustrncmp(pp, "opts=", 5) == 0)
3226 {
3227 for (pp += 5; *pp && *pp != '/';) pp++;
3228 debug_opts = string_copyn(p+6, pp-p-6);
3229 }
3230 else if (Ustrncmp(pp, "kill", 4) == 0)
3231 {
3232 for (pp += 4; *pp && *pp != '/';) pp++;
3233 kill = TRUE;
3234 }
3235 else
3236 while (*pp && *pp != '/') pp++;
55414b25
JH		 3237 p = pp;
3238 }
b0d68adc
JH		 3239
3240 if (kill)
3241 debug_logging_stop();
3242 else
3243 debug_logging_activate(debug_tag, debug_opts);
55414b25 3244 }
55414b25
JH		 3245 break;
3246
3247 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
8768d548 3248 f.suppress_local_fixups = TRUE;
55414b25
JH		 3249 break;
3250
3251 case CONTROL_CUTTHROUGH_DELIVERY:
051d5efa
JH		 3252 {
3253 uschar * ignored = NULL;
a2b89db1 3254#ifndef DISABLE_PRDR
55414b25 3255 if (prdr_requested)
a2b89db1
PP		 3256#else
3257 if (0)
3258#endif
55414b25
JH		 3259 /* Too hard to think about for now. We might in future cutthrough
3260 the case where both sides handle prdr and this-node prdr acl
3261 is "accept" */
051d5efa 3262 ignored = US"PRDR active";
5032d1cf
JH		 3263 else
3264 {
8768d548 3265 if (f.deliver_freeze)
051d5efa 3266 ignored = US"frozen";
8768d548 3267 else if (f.queue_only_policy)
051d5efa 3268 ignored = US"queue-only";
55414b25 3269 else if (fake_response == FAIL)
051d5efa 3270 ignored = US"fakereject";
55414b25
JH		 3271 else
3272 {
ff5929e3
JH		 3273 if (rcpt_count == 1)
3274 {
051d5efa 3275 cutthrough.delivery = TRUE; /* control accepted */
ff5929e3
JH		 3276 while (*p == '/')
3277 {
3278 const uschar * pp = p+1;
3279 if (Ustrncmp(pp, "defer=", 6) == 0)
3280 {
3281 pp += 6;
3282 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3283 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3284 }
3285 else
3286 while (*pp && *pp != '/') pp++;
3287 p = pp;
3288 }
3289 }
06fdb9f7 3290 else
051d5efa 3291 ignored = US"nonfirst rcpt";
55414b25 3292 }
5032d1cf 3293 }
051d5efa
JH		 3294 DEBUG(D_acl) if (ignored)
3295 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3296 }
3297 break;
3c8b3577 3298
8c5d388a 3299#ifdef SUPPORT_I18N
3c8b3577
JH		 3300 case CONTROL_UTF8_DOWNCONVERT:
3301 if (*p == '/')
3302 {
921dfc11
JH		 3303 if (p[1] == '1')
3304 {
3305 message_utf8_downconvert = 1;
3306 addr->prop.utf8_downcvt = TRUE;
3307 addr->prop.utf8_downcvt_maybe = FALSE;
3308 p += 2;
3309 break;
3310 }
3311 if (p[1] == '0')
3312 {
3313 message_utf8_downconvert = 0;
3314 addr->prop.utf8_downcvt = FALSE;
3315 addr->prop.utf8_downcvt_maybe = FALSE;
3316 p += 2;
3317 break;
3318 }
3c8b3577 3319 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3320 {
3321 message_utf8_downconvert = -1;
3322 addr->prop.utf8_downcvt = FALSE;
3323 addr->prop.utf8_downcvt_maybe = TRUE;
3324 p += 3;
3325 break;
3326 }
3c8b3577
JH		 3327 *log_msgptr = US"bad option value for control=utf8_downconvert";
3328 }
3329 else
3330 {
921dfc11
JH		 3331 message_utf8_downconvert = 1;
3332 addr->prop.utf8_downcvt = TRUE;
3333 addr->prop.utf8_downcvt_maybe = FALSE;
3334 break;
3c8b3577
JH		 3335 }
3336 return ERROR;
8c5d388a 3337#endif
3c8b3577 3338
9171d434 3339 }
55414b25 3340 break;
059ec3d9 3341 }
059ec3d9 3342
6a8f9482
TK		 3343 #ifdef EXPERIMENTAL_DCC
3344 case ACLC_DCC:
3345 {
4c04137d 3346 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3347 const uschar * list = arg;
3348 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3349 /* Run the dcc backend. */
3350 rc = dcc_process(&ss);
4c04137d 3351 /* Modify return code based upon the existence of options. */
3c8b3577 3352 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3353 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3354 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3355 }
3356 break;
3357 #endif
3358
71fafd95 3359 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3360 case ACLC_DECODE:
3361 rc = mime_decode(&arg);
3362 break;
71fafd95 3363 #endif
8523533c 3364
059ec3d9
PH		 3365 case ACLC_DELAY:
3366 {
3367 int delay = readconf_readtime(arg, 0, FALSE);
3368 if (delay < 0)
3369 {
3370 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3371 "modifier: \"%s\" is not a time value", arg);
3372 return ERROR;
3373 }
3374 else
3375 {
e1d04f48 3376 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
059ec3d9
PH		 3377 delay);
3378 if (host_checking)
3379 {
3380 HDEBUG(D_acl)
e1d04f48 3381 debug_printf_indent("delay skipped in -bh checking mode\n");
059ec3d9 3382 }
010c2d14 3383
ae9d18bc
JH		 3384 /* NOTE 1: Remember that we may be
3385 dealing with stdin/stdout here, in addition to TCP/IP connections.
3386 Also, delays may be specified for non-SMTP input, where smtp_out and
3387 smtp_in will be NULL. Whatever is done must work in all cases.
3388
3389 NOTE 2: The added feature of flushing the output before a delay must
3390 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3391 */
3392
3393 else
3394 {
02c30a32 3395 if (smtp_out && !f.disable_delay_flush)
ae9d18bc
JH		 3396 mac_smtp_fflush();
3397
861a7c51 3398#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3399 {
3400 struct pollfd p;
3401 nfds_t n = 0;
3402 if (smtp_out)
3403 {
3404 p.fd = fileno(smtp_out);
3405 p.events = POLLRDHUP;
3406 n = 1;
3407 }
3408 if (poll(&p, n, delay*1000) > 0)
e1d04f48 3409 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
ae9d18bc
JH		 3410 }
3411#else
02c30a32
JH		 3412 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3413 TCP/IP connection has gone away without reading from it. This means
3414 that we cannot shorten the delay below if the client goes away,
3415 because we cannot discover that the client has closed its end of the
3416 connection. (The connection is actually in a half-closed state,
3417 waiting for the server to close its end.) It would be nice to be able
3418 to detect this state, so that the Exim process is not held up
3419 unnecessarily. However, it seems that we can't. The poll() function
3420 does not do the right thing, and in any case it is not always
3421 available. */
010c2d14 3422
86b8287f 3423 while (delay > 0) delay = sleep(delay);
ae9d18bc 3424#endif
8e669ac1 3425 }
059ec3d9
PH		 3426 }
3427 }
3428 break;
3429
80a47a2c
TK		 3430 #ifndef DISABLE_DKIM
3431 case ACLC_DKIM_SIGNER:
a79d8834 3432 if (dkim_cur_signer)
9e5d6b55 3433 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3434 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3435 else
b0b9dbb1 3436 rc = FAIL;
71fafd95
PH		 3437 break;
3438
80a47a2c 3439 case ACLC_DKIM_STATUS:
a79d8834 3440 rc = match_isinlist(dkim_verify_status,
80a47a2c 3441 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3442 break;
3443 #endif
fb2274d4 3444
4840604e
TL		 3445 #ifdef EXPERIMENTAL_DMARC
3446 case ACLC_DMARC_STATUS:
8768d548 3447 if (!f.dmarc_has_been_checked)
4840604e 3448 dmarc_process();
8768d548 3449 f.dmarc_has_been_checked = TRUE;
4840604e
TL		 3450 /* used long way of dmarc_exim_expand_query() in case we need more
3451 * view into the process in the future. */
3452 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3453 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3454 break;
3455 #endif
3456
059ec3d9 3457 case ACLC_DNSLISTS:
379ba7d0 3458 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3459 break;
3460
3461 case ACLC_DOMAINS:
3462 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3463 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3464 break;
3465
3466 /* The value in tls_cipher is the full cipher name, for example,
3467 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3468 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3469 what may in practice come out of the SSL library - which at the time of
3470 writing is poorly documented. */
3471
3472 case ACLC_ENCRYPTED:
817d9f57 3473 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3474 {
3475 uschar *endcipher = NULL;
817d9f57
JH		 3476 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3477 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3478 {
3479 endcipher = Ustrchr(++cipher, ':');
3480 if (endcipher != NULL) *endcipher = 0;
3481 }
3482 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3483 if (endcipher != NULL) *endcipher = ':';
3484 }
3485 break;
3486
3487 /* Use verify_check_this_host() instead of verify_check_host() so that
3488 we can pass over &host_data to catch any looked up data. Once it has been
3489 set, it retains its value so that it's still there if another ACL verb
3490 comes through here and uses the cache. However, we must put it into
3491 permanent store in case it is also expected to be used in a subsequent
3492 message in the same SMTP connection. */
3493
3494 case ACLC_HOSTS:
3495 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3496 (sender_host_address == NULL)? US"" : sender_host_address,
3497 CUSS &host_data);
4a452c43
JH		 3498 if (rc == DEFER) *log_msgptr = search_error_message;
3499 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3500 break;
3501
3502 case ACLC_LOCAL_PARTS:
3503 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3504 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3505 CUSS &deliver_localpart_data);
059ec3d9
PH		 3506 break;
3507
6ea85e9a
PH		 3508 case ACLC_LOG_REJECT_TARGET:
3509 {
3510 int logbits = 0;
3511 int sep = 0;
55414b25 3512 const uschar *s = arg;
d7978c0f 3513 uschar * ss;
4a452c43 3514 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3515 {
3516 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3517 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3518 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3519 else
3520 {
3521 logbits |= LOG_MAIN|LOG_REJECT;
3522 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3523 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3524 }
3525 }
3526 log_reject_target = logbits;
3527 }
3528 break;
3529
059ec3d9
PH		 3530 case ACLC_LOGWRITE:
3531 {
3532 int logbits = 0;
55414b25 3533 const uschar *s = arg;
059ec3d9
PH		 3534 if (*s == ':')
3535 {
3536 s++;
3537 while (*s != ':')
3538 {
3539 if (Ustrncmp(s, "main", 4) == 0)
3540 { logbits |= LOG_MAIN; s += 4; }
3541 else if (Ustrncmp(s, "panic", 5) == 0)
3542 { logbits |= LOG_PANIC; s += 5; }
3543 else if (Ustrncmp(s, "reject", 6) == 0)
3544 { logbits |= LOG_REJECT; s += 6; }
3545 else
3546 {
3547 logbits = LOG_MAIN|LOG_PANIC;
3548 s = string_sprintf(":unknown log name in \"%s\" in "
3549 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3550 }
3551 if (*s == ',') s++;
3552 }
3553 s++;
3554 }
3555 while (isspace(*s)) s++;
6ea85e9a 3556
059ec3d9
PH		 3557 if (logbits == 0) logbits = LOG_MAIN;
3558 log_write(0, logbits, "%s", string_printing(s));
3559 }
3560 break;
8e669ac1 3561
71fafd95 3562 #ifdef WITH_CONTENT_SCAN
0f0c8159 3563 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3564 {
6ea85e9a 3565 /* Separate the regular expression and any optional parameters. */
55414b25 3566 const uschar * list = arg;
d7978c0f
JH		 3567 uschar * ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3568 uschar * opt;
0f0c8159
JH		 3569 BOOL defer_ok = FALSE;
3570 int timeout = 0;
3571
55414b25 3572 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3573 if (strcmpic(opt, US"defer_ok") == 0)
3574 defer_ok = TRUE;
3575 else if ( strncmpic(opt, US"tmo=", 4) == 0
3576 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3577 )
3578 {
3579 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3580 return ERROR;
3581 }
3582
3583 rc = malware(ss, timeout);
3584 if (rc == DEFER && defer_ok)
3585 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3586 }
3587 break;
3588
3589 case ACLC_MIME_REGEX:
71fafd95 3590 rc = mime_regex(&arg);
8523533c 3591 break;
71fafd95 3592 #endif
059ec3d9 3593
b0b9dbb1 3594 case ACLC_QUEUE:
944e8b37
JH		 3595 if (Ustrchr(arg, '/'))
3596 {
3597 *log_msgptr = string_sprintf(
3598 "Directory separator not permitted in queue name: '%s'", arg);
3599 return ERROR;
3600 }
b0b9dbb1
JH		 3601 queue_name = string_copy_malloc(arg);
3602 break;
3603
870f6ba8 3604 case ACLC_RATELIMIT:
90fc3069 3605 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3606 break;
3607
059ec3d9 3608 case ACLC_RECIPIENTS:
36d295f1 3609 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
55414b25 3610 CUSS &recipient_data);
059ec3d9
PH		 3611 break;
3612
71fafd95
PH		 3613 #ifdef WITH_CONTENT_SCAN
3614 case ACLC_REGEX:
3615 rc = regex(&arg);
8523533c 3616 break;
71fafd95 3617 #endif
8523533c 3618
e7568d51
TL		 3619 case ACLC_REMOVE_HEADER:
3620 setup_remove_header(arg);
3621 break;
3622
059ec3d9
PH		 3623 case ACLC_SENDER_DOMAINS:
3624 {
3625 uschar *sdomain;
3626 sdomain = Ustrrchr(sender_address, '@');
f7ae7462 3627 sdomain = sdomain ? sdomain + 1 : US"";
059ec3d9
PH		 3628 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3629 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3630 }
3631 break;
3632
3633 case ACLC_SENDERS:
36d295f1 3634 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
55414b25 3635 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3636 break;
3637
3638 /* Connection variables must persist forever */
3639
3640 case ACLC_SET:
3641 {
3642 int old_pool = store_pool;
5ef5dd52 3643 if ( cb->u.varname[0] == 'c'
a79d8834
JH		 3644#ifndef DISABLE_DKIM
3645 || cb->u.varname[0] == 'd'
3646#endif
0cbf2b82 3647#ifndef DISABLE_EVENT
5ef5dd52
JB		 3648 || event_name /* An event is being delivered */
3649#endif
3650 )
3651 store_pool = POOL_PERM;
a79d8834
JH		 3652#ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3653 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3654 dkim_verify_status = string_copy(arg);
3655 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3656 dkim_verify_reason = string_copy(arg);
3657 else
3658#endif
3659 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3660 store_pool = old_pool;
3661 }
3662 break;
3663
eb52e2cb 3664#ifdef WITH_CONTENT_SCAN
8523533c
TK		 3665 case ACLC_SPAM:
3666 {
4c04137d 3667 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3668 const uschar * list = arg;
3669 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
eb52e2cb 3670
55414b25 3671 rc = spam(CUSS &ss);
4c04137d 3672 /* Modify return code based upon the existence of options. */
eb52e2cb 3673 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
8523533c 3674 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
eb52e2cb 3675 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3676 }
3677 break;
eb52e2cb 3678#endif
8523533c 3679
7952eef9 3680#ifdef SUPPORT_SPF
8523533c 3681 case ACLC_SPF:
65a7d8c3
NM		 3682 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3683 break;
3684 case ACLC_SPF_GUESS:
3685 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3686 break;
eb52e2cb 3687#endif
8523533c 3688
b0019c78
TF		 3689 case ACLC_UDPSEND:
3690 rc = acl_udpsend(arg, log_msgptr);
3691 break;
3692
059ec3d9
PH		 3693 /* If the verb is WARN, discard any user message from verification, because
3694 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3695 only from explicit "message" modifiers. However, put the user message into
3696 $acl_verify_message so it can be used in subsequent conditions or modifiers
3697 (until something changes it). */
059ec3d9
PH		 3698
3699 case ACLC_VERIFY:
3700 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3701 if (*user_msgptr)
3702 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3703 if (verb == ACL_WARN) *user_msgptr = NULL;
3704 break;
3705
3706 default:
3707 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3708 "condition %d", cb->type);
3709 break;
3710 }
3711
3712 /* If a condition was negated, invert OK/FAIL. */
3713
2d009132 3714 if (!conditions[cb->type].is_modifier && cb->u.negated)
059ec3d9 3715 if (rc == OK) rc = FAIL;
2d009132 3716 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
059ec3d9
PH		 3717
3718 if (rc != OK) break; /* Conditions loop */
3719 }
3720
3721
3722/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3723handle the values of these modifiers. If there isn't a log message set, we make
3724it the same as the user message.
059ec3d9
PH		 3725
3726"message" is a user message that will be included in an SMTP response. Unless
3727it is empty, it overrides any previously set user message.
3728
3729"log_message" is a non-user message, and it adds to any existing non-user
3730message that is already set.
3731
4e88a19f
PH		 3732Most verbs have but a single return for which the messages are relevant, but
3733for "discard", it's useful to have the log message both when it succeeds and
3734when it fails. For "accept", the message is used in the OK case if there is no
3735"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3736present. */
059ec3d9 3737
4e88a19f
PH		 3738if (*epp && rc == OK) user_message = NULL;
3739
e3a69b62 3740if ((BIT(rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3741 {
3742 uschar *expmessage;
4e88a19f
PH		 3743 uschar *old_user_msgptr = *user_msgptr;
3744 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3745
3746 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3747 nested ACLs) are always discarded. This also happens for acceptance verbs
3748 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3749 However, the value of an existing message is available in $acl_verify_message
3750 during expansions. */
3751
4e88a19f
PH		 3752 if (verb == ACL_WARN ||
3753 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3754 *log_msgptr = *user_msgptr = NULL;
059ec3d9 3755
e3a69b62 3756 if (user_message)
059ec3d9
PH		 3757 {
3758 acl_verify_message = old_user_msgptr;
3759 expmessage = expand_string(user_message);
e3a69b62 3760 if (!expmessage)
059ec3d9 3761 {
8768d548 3762 if (!f.expand_string_forcedfail)
059ec3d9
PH		 3763 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3764 user_message, expand_string_message);
3765 }
3766 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3767 }
3768
e3a69b62 3769 if (log_message)
059ec3d9
PH		 3770 {
3771 acl_verify_message = old_log_msgptr;
3772 expmessage = expand_string(log_message);
e3a69b62 3773 if (!expmessage)
059ec3d9 3774 {
8768d548 3775 if (!f.expand_string_forcedfail)
059ec3d9
PH		 3776 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3777 log_message, expand_string_message);
3778 }
3779 else if (expmessage[0] != 0)
3780 {
3781 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3782 string_sprintf("%s: %s", expmessage, *log_msgptr);
3783 }
3784 }
3785
3786 /* If no log message, default it to the user message */
3787
e3a69b62 3788 if (!*log_msgptr) *log_msgptr = *user_msgptr;
059ec3d9
PH		 3789 }
3790
3791acl_verify_message = NULL;
3792return rc;
3793}
3794
3795
3796
3797
3798
3799/*************************************************
3800* Get line from a literal ACL *
3801*************************************************/
3802
3803/* This function is passed to acl_read() in order to extract individual lines
3804of a literal ACL, which we access via static pointers. We can destroy the
3805contents because this is called only once (the compiled ACL is remembered).
3806
3807This code is intended to treat the data in the same way as lines in the main
3808Exim configuration file. That is:
3809
3810 . Leading spaces are ignored.
3811
3812 . A \ at the end of a line is a continuation - trailing spaces after the \
3813 are permitted (this is because I don't believe in making invisible things
3814 significant). Leading spaces on the continued part of a line are ignored.
3815
3816 . Physical lines starting (significantly) with # are totally ignored, and
3817 may appear within a sequence of backslash-continued lines.
3818
3819 . Blank lines are ignored, but will end a sequence of continuations.
3820
3821Arguments: none
3822Returns: a pointer to the next line
3823*/
3824
3825
3826static uschar *acl_text; /* Current pointer in the text */
3827static uschar *acl_text_end; /* Points one past the terminating '0' */
3828
3829
3830static uschar *
3831acl_getline(void)
3832{
3833uschar *yield;
3834
3835/* This loop handles leading blank lines and comments. */
3836
3837for(;;)
3838 {
3839 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3840 if (*acl_text == 0) return NULL; /* No more data */
3841 yield = acl_text; /* Potential data line */
3842
d7978c0f 3843 while (*acl_text && *acl_text != '\n') acl_text++;
059ec3d9
PH		 3844
3845 /* If we hit the end before a newline, we have the whole logical line. If
3846 it's a comment, there's no more data to be given. Otherwise, yield it. */
3847
3848 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3849
3850 /* After reaching a newline, end this loop if the physical line does not
3851 start with '#'. If it does, it's a comment, and the loop continues. */
3852
3853 if (*yield != '#') break;
3854 }
3855
3856/* This loop handles continuations. We know we have some real data, ending in
3857newline. See if there is a continuation marker at the end (ignoring trailing
3858white space). We know that *yield is not white space, so no need to test for
3859cont > yield in the backwards scanning loop. */
3860
3861for(;;)
3862 {
3863 uschar *cont;
3864 for (cont = acl_text - 1; isspace(*cont); cont--);
3865
3866 /* If no continuation follows, we are done. Mark the end of the line and
3867 return it. */
3868
3869 if (*cont != '\\')
3870 {
3871 *acl_text++ = 0;
3872 return yield;
3873 }
3874
3875 /* We have encountered a continuation. Skip over whitespace at the start of
3876 the next line, and indeed the whole of the next line or lines if they are
3877 comment lines. */
3878
3879 for (;;)
3880 {
3881 while (*(++acl_text) == ' ' || *acl_text == '\t');
3882 if (*acl_text != '#') break;
3883 while (*(++acl_text) != 0 && *acl_text != '\n');
3884 }
3885
3886 /* We have the start of a continuation line. Move all the rest of the data
3887 to join onto the previous line, and then find its end. If the end is not a
3888 newline, we are done. Otherwise loop to look for another continuation. */
3889
3890 memmove(cont, acl_text, acl_text_end - acl_text);
3891 acl_text_end -= acl_text - cont;
3892 acl_text = cont;
3893 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3894 if (*acl_text == 0) return yield;
3895 }
3896
3897/* Control does not reach here */
3898}
3899
3900
3901
3902
3903
3904/*************************************************
3905* Check access using an ACL *
3906*************************************************/
3907
3908/* This function is called from address_check. It may recurse via
3909acl_check_condition() - hence the use of a level to stop looping. The ACL is
3910passed as a string which is expanded. A forced failure implies no access check
3911is required. If the result is a single word, it is taken as the name of an ACL
3912which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3913text, complete with newlines, and parsed as such. In both cases, the ACL check
3914is then run. This function uses an auxiliary function for acl_read() to call
3915for reading individual lines of a literal ACL. This is acl_getline(), which
3916appears immediately above.
3917
3918Arguments:
3919 where where called from
3920 addr address item when called from RCPT; otherwise NULL
3921 s the input string; NULL is the same as an empty ACL => DENY
059ec3d9
PH		 3922 user_msgptr where to put a user error (for SMTP response)
3923 log_msgptr where to put a logging message (not for SMTP response)
3924
3925Returns: OK access is granted
3926 DISCARD access is apparently granted...
3927 FAIL access is denied
3928 FAIL_DROP access is denied; drop the connection
3929 DEFER can't tell at the moment
3930 ERROR disaster
3931*/
3932
3933static int
e1d04f48 3934acl_check_internal(int where, address_item *addr, uschar *s,
059ec3d9
PH		 3935 uschar **user_msgptr, uschar **log_msgptr)
3936{
3937int fd = -1;
3938acl_block *acl = NULL;
3939uschar *acl_name = US"inline ACL";
3940uschar *ss;
3941
3942/* Catch configuration loops */
3943
e1d04f48 3944if (acl_level > 20)
059ec3d9
PH		 3945 {
3946 *log_msgptr = US"ACL nested too deep: possible loop";
3947 return ERROR;
3948 }
3949
e1d04f48 3950if (!s)
059ec3d9 3951 {
e1d04f48 3952 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
059ec3d9
PH		 3953 return FAIL;
3954 }
3955
3956/* At top level, we expand the incoming string. At lower levels, it has already
3957been expanded as part of condition processing. */
3958
e1d04f48 3959if (acl_level == 0)
059ec3d9 3960 {
e1d04f48 3961 if (!(ss = expand_string(s)))
059ec3d9 3962 {
8768d548 3963 if (f.expand_string_forcedfail) return OK;
059ec3d9
PH		 3964 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3965 expand_string_message);
3966 return ERROR;
3967 }
3968 }
3969else ss = s;
3970
bb07bcd3 3971while (isspace(*ss)) ss++;
059ec3d9
PH		 3972
3973/* If we can't find a named ACL, the default is to parse it as an inline one.
3974(Unless it begins with a slash; non-existent files give rise to an error.) */
3975
3976acl_text = ss;
3977
3978/* Handle the case of a string that does not contain any spaces. Look for a
3979named ACL among those read from the configuration, or a previously read file.
3980It is possible that the pointer to the ACL is NULL if the configuration
3981contains a name with no data. If not found, and the text begins with '/',
3982read an ACL from a file, and save it so it can be re-used. */
3983
3984if (Ustrchr(ss, ' ') == NULL)
3985 {
3986 tree_node *t = tree_search(acl_anchor, ss);
3987 if (t != NULL)
3988 {
3989 acl = (acl_block *)(t->data.ptr);
3990 if (acl == NULL)
3991 {
e1d04f48 3992 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
059ec3d9
PH		 3993 return FAIL;
3994 }
3995 acl_name = string_sprintf("ACL \"%s\"", ss);
e1d04f48 3996 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
059ec3d9
PH		 3997 }
3998
3999 else if (*ss == '/')
4000 {
4001 struct stat statbuf;
4002 fd = Uopen(ss, O_RDONLY, 0);
4003 if (fd < 0)
4004 {
4005 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4006 strerror(errno));
4007 return ERROR;
4008 }
4009
4010 if (fstat(fd, &statbuf) != 0)
4011 {
4012 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4013 strerror(errno));
4014 return ERROR;
4015 }
4016
4017 acl_text = store_get(statbuf.st_size + 1);
4018 acl_text_end = acl_text + statbuf.st_size + 1;
4019
4020 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4021 {
4022 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4023 ss, strerror(errno));
4024 return ERROR;
4025 }
4026 acl_text[statbuf.st_size] = 0;
f1e894f3 4027 (void)close(fd);
059ec3d9
PH		 4028
4029 acl_name = string_sprintf("ACL \"%s\"", ss);
e1d04f48 4030 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
059ec3d9
PH		 4031 }
4032 }
4033
4034/* Parse an ACL that is still in text form. If it came from a file, remember it
4035in the ACL tree, having read it into the POOL_PERM store pool so that it
4036persists between multiple messages. */
4037
d7978c0f 4038if (!acl)
059ec3d9
PH		 4039 {
4040 int old_pool = store_pool;
4041 if (fd >= 0) store_pool = POOL_PERM;
4042 acl = acl_read(acl_getline, log_msgptr);
4043 store_pool = old_pool;
d7978c0f 4044 if (!acl && *log_msgptr) return ERROR;
059ec3d9
PH		 4045 if (fd >= 0)
4046 {
4047 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4048 Ustrcpy(t->name, ss);
4049 t->data.ptr = acl;
4050 (void)tree_insertnode(&acl_anchor, t);
4051 }
4052 }
4053
4054/* Now we have an ACL to use. It's possible it may be NULL. */
4055
d7978c0f 4056while (acl)
059ec3d9
PH		 4057 {
4058 int cond;
4059 int basic_errno = 0;
4060 BOOL endpass_seen = FALSE;
e1d04f48 4061 BOOL acl_quit_check = acl_level == 0
82c0c8ea 4062 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4063
4064 *log_msgptr = *user_msgptr = NULL;
8768d548 4065 f.acl_temp_details = FALSE;
059ec3d9 4066
e1d04f48 4067 HDEBUG(D_acl) debug_printf_indent("processing \"%s\"\n", verbs[acl->verb]);
059ec3d9
PH		 4068
4069 /* Clear out any search error message from a previous check before testing
4070 this condition. */
4071
4072 search_error_message = NULL;
e1d04f48 4073 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
059ec3d9
PH		 4074 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4075
4076 /* Handle special returns: DEFER causes a return except on a WARN verb;
4077 ERROR always causes a return. */
4078
4079 switch (cond)
4080 {
4081 case DEFER:
e1d04f48 4082 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4083 if (basic_errno != ERRNO_CALLOUTDEFER)
4084 {
4085 if (search_error_message != NULL && *search_error_message != 0)
4086 *log_msgptr = search_error_message;
8768d548 4087 if (smtp_return_error_details) f.acl_temp_details = TRUE;
059ec3d9
PH		 4088 }
4089 else
8768d548 4090 f.acl_temp_details = TRUE;
059ec3d9
PH		 4091 if (acl->verb != ACL_WARN) return DEFER;
4092 break;
4093
4094 default: /* Paranoia */
4095 case ERROR:
e1d04f48 4096 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4097 return ERROR;
4098
4099 case OK:
e1d04f48 4100 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
6968512f 4101 verbs[acl->verb], acl_name);
059ec3d9
PH		 4102 break;
4103
4104 case FAIL:
e1d04f48 4105 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4106 break;
4107
4108 /* DISCARD and DROP can happen only from a nested ACL condition, and
4109 DISCARD can happen only for an "accept" or "discard" verb. */
4110
4111 case DISCARD:
e1d04f48 4112 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
6968512f 4113 verbs[acl->verb], acl_name);
059ec3d9
PH		 4114 break;
4115
4116 case FAIL_DROP:
e1d04f48 4117 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
6968512f 4118 verbs[acl->verb], acl_name);
059ec3d9
PH		 4119 break;
4120 }
4121
4122 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4123 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4124 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4125
4126 switch(acl->verb)
4127 {
4128 case ACL_ACCEPT:
a7538db1
JH		 4129 if (cond == OK || cond == DISCARD)
4130 {
e1d04f48 4131 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
a7538db1
JH		 4132 return cond;
4133 }
059ec3d9
PH		 4134 if (endpass_seen)
4135 {
e1d04f48 4136 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
059ec3d9
PH		 4137 return cond;
4138 }
4139 break;
4140
4141 case ACL_DEFER:
4142 if (cond == OK)
4143 {
e1d04f48 4144 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
82c0c8ea 4145 if (acl_quit_check) goto badquit;
8768d548 4146 f.acl_temp_details = TRUE;
059ec3d9
PH		 4147 return DEFER;
4148 }
4149 break;
4150
4151 case ACL_DENY:
a7538db1
JH		 4152 if (cond == OK)
4153 {
e1d04f48 4154 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
82c0c8ea 4155 if (acl_quit_check) goto badquit;
a7538db1
JH		 4156 return FAIL;
4157 }
059ec3d9
PH		 4158 break;
4159
4160 case ACL_DISCARD:
a7538db1
JH		 4161 if (cond == OK || cond == DISCARD)
4162 {
e1d04f48 4163 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
82c0c8ea 4164 if (acl_quit_check) goto badquit;
a7538db1
JH		 4165 return DISCARD;
4166 }
059ec3d9
PH		 4167 if (endpass_seen)
4168 {
e1d04f48 4169 HDEBUG(D_acl) debug_printf_indent("discard: endpass encountered - denying access\n");
059ec3d9
PH		 4170 return cond;
4171 }
4172 break;
4173
4174 case ACL_DROP:
a7538db1
JH		 4175 if (cond == OK)
4176 {
e1d04f48 4177 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
82c0c8ea 4178 if (acl_quit_check) goto badquit;
a7538db1
JH		 4179 return FAIL_DROP;
4180 }
059ec3d9
PH		 4181 break;
4182
4183 case ACL_REQUIRE:
a7538db1
JH		 4184 if (cond != OK)
4185 {
e1d04f48 4186 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
82c0c8ea 4187 if (acl_quit_check) goto badquit;
a7538db1
JH		 4188 return cond;
4189 }
059ec3d9
PH		 4190 break;
4191
4192 case ACL_WARN:
4193 if (cond == OK)
4194 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4195 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4196 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4197 "condition test deferred%s%s", host_and_ident(TRUE),
4198 (*log_msgptr == NULL)? US"" : US": ",
4199 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4200 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4201 break;
4202
4203 default:
4204 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4205 acl->verb);
4206 break;
4207 }
4208
4209 /* Pass to the next ACL item */
4210
4211 acl = acl->next;
4212 }
4213
4214/* We have reached the end of the ACL. This is an implicit DENY. */
4215
e1d04f48 4216HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
059ec3d9 4217return FAIL;
82c0c8ea
JH		 4218
4219badquit:
4c04137d 4220 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
82c0c8ea
JH		 4221 "('%s' verb used incorrectly)", verbs[acl->verb]);
4222 return ERROR;
059ec3d9
PH		 4223}
4224
4225
333eea9c
JH		 4226
4227
4228/* Same args as acl_check_internal() above, but the string s is
4229the name of an ACL followed optionally by up to 9 space-separated arguments.
4230The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4231static int
e1d04f48 4232acl_check_wargs(int where, address_item *addr, const uschar *s,
333eea9c
JH		 4233 uschar **user_msgptr, uschar **log_msgptr)
4234{
4235uschar * tmp;
bef3ea7f 4236uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4237uschar * sav_arg[9]; /* must match acl_arg[] */
4238int sav_narg;
333eea9c 4239uschar * name;
bef3ea7f 4240int i;
ef21c07d 4241int ret;
333eea9c
JH		 4242
4243if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4244 goto bad;
4245
bef3ea7f 4246for (i = 0; i < 9; i++)
333eea9c
JH		 4247 {
4248 while (*s && isspace(*s)) s++;
4249 if (!*s) break;
bef3ea7f 4250 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4251 {
4252 tmp = name;
4253 goto bad;
4254 }
4255 }
ef21c07d
JH		 4256
4257sav_narg = acl_narg;
bef3ea7f 4258acl_narg = i;
ef21c07d
JH		 4259for (i = 0; i < acl_narg; i++)
4260 {
4261 sav_arg[i] = acl_arg[i];
4262 acl_arg[i] = tmp_arg[i];
4263 }
4264while (i < 9)
4265 {
4266 sav_arg[i] = acl_arg[i];
4267 acl_arg[i++] = NULL;
4268 }
4269
e1d04f48
JH		 4270acl_level++;
4271ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4272acl_level--;
333eea9c 4273
ef21c07d
JH		 4274acl_narg = sav_narg;
4275for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4276return ret;
333eea9c
JH		 4277
4278bad:
8768d548 4279if (f.expand_string_forcedfail) return ERROR;
333eea9c
JH		 4280*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4281 tmp, expand_string_message);
8768d548 4282return f.search_find_defer ? DEFER : ERROR;
333eea9c
JH		 4283}
4284
4285
4286
059ec3d9
PH		 4287/*************************************************
4288* Check access using an ACL *
4289*************************************************/
4290
faa05a93
JH		 4291/* Alternate interface for ACL, used by expansions */
4292int
05caaeaa 4293acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4294{
faa05a93
JH		 4295address_item adb;
4296address_item *addr = NULL;
e1d04f48 4297int rc;
faa05a93
JH		 4298
4299*user_msgptr = *log_msgptr = NULL;
4300sender_verified_failed = NULL;
4301ratelimiters_cmd = NULL;
4302log_reject_target = LOG_MAIN|LOG_REJECT;
4303
4304if (where == ACL_WHERE_RCPT)
4305 {
4306 adb = address_defaults;
4307 addr = &adb;
05caaeaa
JH		 4308 addr->address = expand_string(US"$local_part@$domain");
4309 addr->domain = deliver_domain;
4310 addr->local_part = deliver_localpart;
4311 addr->cc_local_part = deliver_localpart;
4312 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4313 }
4314
e1d04f48
JH		 4315acl_level++;
4316rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4317acl_level--;
4318return rc;
faa05a93
JH		 4319}
4320
4321
4322
059ec3d9
PH		 4323/* This is the external interface for ACL checks. It sets up an address and the
4324expansions for $domain and $local_part when called after RCPT, then calls
4325acl_check_internal() to do the actual work.
4326
4327Arguments:
4328 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4329 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4330 s the input string; NULL is the same as an empty ACL => DENY
4331 user_msgptr where to put a user error (for SMTP response)
4332 log_msgptr where to put a logging message (not for SMTP response)
4333
4334Returns: OK access is granted by an ACCEPT verb
4335 DISCARD access is granted by a DISCARD verb
4336 FAIL access is denied
4337 FAIL_DROP access is denied; drop the connection
4338 DEFER can't tell at the moment
4339 ERROR disaster
4340*/
faa05a93 4341int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4342
4343int
64ffc24f 4344acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4345 uschar **log_msgptr)
4346{
4347int rc;
4348address_item adb;
64ffc24f 4349address_item *addr = NULL;
059ec3d9
PH		 4350
4351*user_msgptr = *log_msgptr = NULL;
4352sender_verified_failed = NULL;
fe0dab11 4353ratelimiters_cmd = NULL;
6ea85e9a 4354log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4355
8ccd00b1 4356#ifndef DISABLE_PRDR
4f6ae5c3 4357if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4358#else
4f6ae5c3 4359if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4360#endif
059ec3d9
PH		 4361 {
4362 adb = address_defaults;
4363 addr = &adb;
64ffc24f 4364 addr->address = recipient;
059ec3d9
PH		 4365 if (deliver_split_address(addr) == DEFER)
4366 {
4367 *log_msgptr = US"defer in percent_hack_domains check";
4368 return DEFER;
4369 }
8c5d388a 4370#ifdef SUPPORT_I18N
3c8b3577
JH		 4371 if ((addr->prop.utf8_msg = message_smtputf8))
4372 {
4373 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4374 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4375 }
9bfc60eb 4376#endif
059ec3d9
PH		 4377 deliver_domain = addr->domain;
4378 deliver_localpart = addr->local_part;
4379 }
059ec3d9 4380
faa05a93 4381acl_where = where;
e1d04f48
JH		 4382acl_level = 0;
4383rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4384acl_level = 0;
faa05a93 4385acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4386
817d9f57
JH		 4387/* Cutthrough - if requested,
4388and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4389and rcpt acl returned accept,
4390and first recipient (cancel on any subsequents)
e4bdf652 4391open one now and run it up to RCPT acceptance.
f9334a28
JH		 4392A failed verify should cancel cutthrough request,
4393and will pass the fail to the originator.
817d9f57 4394Initial implementation: dual-write to spool.
e4bdf652
JH		 4395Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4396
4397Cease cutthrough copy on rxd final dot; do not send one.
4398
4399On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4400
4401On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4402perm-rejected, reflect that to the original sender - and dump the spooled copy.
4403If temp-reject, close the conn (and keep the spooled copy).
4404If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4405*/
4406switch (where)
ff5929e3
JH		 4407 {
4408 case ACL_WHERE_RCPT:
8ccd00b1 4409#ifndef DISABLE_PRDR
ff5929e3 4410 case ACL_WHERE_PRDR:
fd98a5c6 4411#endif
57cc2785 4412
8768d548 4413 if (f.host_checking_callout) /* -bhc mode */
57cc2785 4414 cancel_cutthrough_connection(TRUE, US"host-checking mode");
ff5929e3
JH		 4415
4416 else if ( rc == OK
4417 && cutthrough.delivery
4418 && rcpt_count > cutthrough.nrcpt
ff5929e3 4419 )
06fdb9f7
JH		 4420 {
4421 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4422 if (cutthrough.defer_pass)
4423 {
4424 uschar * s = addr->message;
4425 /* Horrid kludge to recover target's SMTP message */
4426 while (*s) s++;
4427 do --s; while (!isdigit(*s));
4428 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
8768d548 4429 f.acl_temp_details = TRUE;
06fdb9f7
JH		 4430 }
4431 else
4432 {
4433 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4434 rc = OK;
4435 }
4436 }
4437 else HDEBUG(D_acl) if (cutthrough.delivery)
4438 if (rcpt_count <= cutthrough.nrcpt)
4439 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4440 else if (rc != OK)
4441 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
ff5929e3 4442 break;
e4bdf652 4443
ff5929e3
JH		 4444 case ACL_WHERE_PREDATA:
4445 if (rc == OK)
4446 cutthrough_predata();
4447 else
57cc2785 4448 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
ff5929e3 4449 break;
e4bdf652 4450
ff5929e3
JH		 4451 case ACL_WHERE_QUIT:
4452 case ACL_WHERE_NOTQUIT:
57cc2785
JH		 4453 /* Drop cutthrough conns, and drop heldopen verify conns if
4454 the previous was not DATA */
4455 {
4456 uschar prev = smtp_connection_had[smtp_ch_index-2];
4457 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4458
4459 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
ff5929e3 4460 break;
57cc2785 4461 }
e4bdf652 4462
ff5929e3
JH		 4463 default:
4464 break;
4465 }
e4bdf652 4466
64ffc24f 4467deliver_domain = deliver_localpart = deliver_address_data =
c679ee08 4468 deliver_domain_data = sender_address_data = NULL;
059ec3d9
PH		 4469
4470/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4471ACL, which is really in the middle of an SMTP command. */
4472
4473if (rc == DISCARD)
4474 {
4475 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4476 {
4477 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4478 "ACL", acl_wherenames[where]);
4479 return ERROR;
4480 }
4481 return DISCARD;
4482 }
4483
4484/* A DROP response is not permitted from MAILAUTH */
4485
4486if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4487 {
4488 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4489 "ACL", acl_wherenames[where]);
4490 return ERROR;
4491 }
4492
4e88a19f
PH		 4493/* Before giving a response, take a look at the length of any user message, and
4494split it up into multiple lines if possible. */
059ec3d9 4495
e28326d8
PH		 4496*user_msgptr = string_split_message(*user_msgptr);
4497if (fake_response != OK)
4498 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4499
4500return rc;
4501}
4502
38a0a95f 4503
38a0a95f
PH		 4504/*************************************************
4505* Create ACL variable *
4506*************************************************/
4507
4508/* Create an ACL variable or reuse an existing one. ACL variables are in a
4509binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4510
4511Argument:
4512 name pointer to the variable's name, starting with c or m
4513
4514Returns the pointer to variable's tree node
4515*/
4516
4517tree_node *
2c0f3ea1 4518acl_var_create(uschar * name)
38a0a95f 4519{
2c0f3ea1
JH		 4520tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4521if (!(node = tree_search(*root, name)))
38a0a95f
PH		 4522 {
4523 node = store_get(sizeof(tree_node) + Ustrlen(name));
4524 Ustrcpy(node->name, name);
4525 (void)tree_insertnode(root, node);
4526 }
4527node->data.ptr = NULL;
4528return node;
4529}
4530
4531
4532
4533/*************************************************
4534* Write an ACL variable in spool format *
4535*************************************************/
4536
4537/* This function is used as a callback for tree_walk when writing variables to
4538the spool file. To retain spool file compatibility, what is written is -aclc or
4539-aclm followed by the rest of the name and the data length, space separated,
4540then the value itself, starting on a new line, and terminated by an additional
4541newline. When we had only numbered ACL variables, the first line might look
4542like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4543acl_cfoo.
4544
4545Arguments:
4546 name of the variable
4547 value of the variable
4548 ctx FILE pointer (as a void pointer)
4549
4550Returns: nothing
4551*/
4552
4553void
4554acl_var_write(uschar *name, uschar *value, void *ctx)
4555{
4556FILE *f = (FILE *)ctx;
4557fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4558}
4559
9171d434
JH		 4560/* vi: aw ai sw=2
4561*/
059ec3d9 4562/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.