List separator specifiers in router/transport headers_add/remove. Bug 1581
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH
24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH
31 US"warn" };
32
4e88a19f
PH
33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH
47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH
49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH
52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK
55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK
61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK
64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
8e669ac1 70#endif
80a47a2c
TK
71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
fb2274d4 74#endif
4840604e
TL
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
77#endif
71fafd95
PH
78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK
87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK
95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH
100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK
105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH
113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH
118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK
122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK
128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK
131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
137#endif
80a47a2c
TK
138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
fb2274d4 141#endif
4840604e
TL
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
144#endif
6ea85e9a
PH
145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK
154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK
162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK
167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH
179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef
PH
183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
c46782ef 186 #endif
ed7f7860 187 CONTROL_DEBUG,
80a47a2c 188 #ifndef DISABLE_DKIM
f7572e5a
TK
189 CONTROL_DKIM_VERIFY,
190 #endif
4840604e
TL
191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH
196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH
200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH
208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
cf8b11a5 211 CONTROL_NO_MULTILINE,
047bdd8c 212 CONTROL_NO_PIPELINING,
4c590bd1
PH
213 CONTROL_NO_DELAY_FLUSH,
214 CONTROL_NO_CALLOUT_FLUSH
c46782ef 215};
9a26b6b2 216
8800895a
PH
217/* ACL control names; keep in step with the table above! This list is used for
218turning ids into names. The actual list of recognized names is in the variable
219control_def controls_list[] below. The fact that there are two lists is a mess
220and should be tidied up. */
9a26b6b2
PH
221
222static uschar *controls[] = {
c46782ef 223 US"allow_auth_unadvertised",
9a26b6b2
PH
224 #ifdef EXPERIMENTAL_BRIGHTMAIL
225 US"bmi_run",
226 #endif
ed7f7860 227 US"debug",
80a47a2c
TK
228 #ifndef DISABLE_DKIM
229 US"dkim_disable_verify",
f7572e5a 230 #endif
4840604e
TL
231 #ifdef EXPERIMENTAL_DMARC
232 US"dmarc_disable_verify",
233 US"dmarc_enable_forensic",
234 #endif
13363eba 235 US"dscp",
c46782ef
PH
236 US"error",
237 US"caseful_local_part",
238 US"caselower_local_part",
e4bdf652 239 US"cutthrough_delivery",
c46782ef
PH
240 US"enforce_sync",
241 US"no_enforce_sync",
242 US"freeze",
243 US"queue_only",
244 US"submission",
245 US"suppress_local_fixups",
9a26b6b2
PH
246 #ifdef WITH_CONTENT_SCAN
247 US"no_mbox_unspool",
248 #endif
cf8b11a5
PH
249 US"fakedefer",
250 US"fakereject",
aa6dc513 251 US"no_multiline_responses",
cf8b11a5 252 US"no_pipelining",
4c590bd1
PH
253 US"no_delay_flush",
254 US"no_callout_flush"
c46782ef 255};
059ec3d9 256
047bdd8c 257/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH
258at the outer level. In the other cases, expansion already occurs in the
259checking functions. */
260
261static uschar cond_expand_at_top[] = {
7421ecab 262 FALSE, /* acl */
3e536984 263 TRUE, /* add_header */
059ec3d9 264 FALSE, /* authenticated */
8523533c
TK
265#ifdef EXPERIMENTAL_BRIGHTMAIL
266 TRUE, /* bmi_optin */
8e669ac1 267#endif
059ec3d9 268 TRUE, /* condition */
c3611384 269 TRUE, /* continue */
059ec3d9 270 TRUE, /* control */
6a8f9482
TK
271#ifdef EXPERIMENTAL_DCC
272 TRUE, /* dcc */
273#endif
8523533c
TK
274#ifdef WITH_CONTENT_SCAN
275 TRUE, /* decode */
276#endif
059ec3d9 277 TRUE, /* delay */
8523533c
TK
278#ifdef WITH_OLD_DEMIME
279 TRUE, /* demime */
280#endif
80a47a2c
TK
281#ifndef DISABLE_DKIM
282 TRUE, /* dkim_signers */
283 TRUE, /* dkim_status */
fb2274d4 284#endif
4840604e
TL
285#ifdef EXPERIMENTAL_DMARC
286 TRUE, /* dmarc_status */
287#endif
059ec3d9
PH
288 TRUE, /* dnslists */
289 FALSE, /* domains */
290 FALSE, /* encrypted */
291 TRUE, /* endpass */
292 FALSE, /* hosts */
293 FALSE, /* local_parts */
294 TRUE, /* log_message */
6ea85e9a 295 TRUE, /* log_reject_target */
059ec3d9 296 TRUE, /* logwrite */
8523533c
TK
297#ifdef WITH_CONTENT_SCAN
298 TRUE, /* malware */
299#endif
059ec3d9 300 TRUE, /* message */
8523533c
TK
301#ifdef WITH_CONTENT_SCAN
302 TRUE, /* mime_regex */
303#endif
870f6ba8 304 TRUE, /* ratelimit */
059ec3d9 305 FALSE, /* recipients */
8523533c
TK
306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* regex */
308#endif
e7568d51 309 TRUE, /* remove_header */
059ec3d9
PH
310 FALSE, /* sender_domains */
311 FALSE, /* senders */
312 TRUE, /* set */
8523533c
TK
313#ifdef WITH_CONTENT_SCAN
314 TRUE, /* spam */
315#endif
316#ifdef EXPERIMENTAL_SPF
317 TRUE, /* spf */
65a7d8c3 318 TRUE, /* spf_guess */
8523533c 319#endif
b0019c78 320 TRUE, /* udpsend */
059ec3d9
PH
321 TRUE /* verify */
322};
323
324/* Flags to identify the modifiers */
325
326static uschar cond_modifiers[] = {
327 FALSE, /* acl */
3e536984 328 TRUE, /* add_header */
059ec3d9 329 FALSE, /* authenticated */
8523533c
TK
330#ifdef EXPERIMENTAL_BRIGHTMAIL
331 TRUE, /* bmi_optin */
8e669ac1 332#endif
059ec3d9 333 FALSE, /* condition */
c3611384 334 TRUE, /* continue */
059ec3d9 335 TRUE, /* control */
6a8f9482
TK
336#ifdef EXPERIMENTAL_DCC
337 FALSE, /* dcc */
338#endif
8523533c
TK
339#ifdef WITH_CONTENT_SCAN
340 FALSE, /* decode */
341#endif
059ec3d9 342 TRUE, /* delay */
8523533c
TK
343#ifdef WITH_OLD_DEMIME
344 FALSE, /* demime */
345#endif
80a47a2c
TK
346#ifndef DISABLE_DKIM
347 FALSE, /* dkim_signers */
348 FALSE, /* dkim_status */
fb2274d4 349#endif
4840604e
TL
350#ifdef EXPERIMENTAL_DMARC
351 FALSE, /* dmarc_status */
352#endif
059ec3d9
PH
353 FALSE, /* dnslists */
354 FALSE, /* domains */
355 FALSE, /* encrypted */
356 TRUE, /* endpass */
357 FALSE, /* hosts */
358 FALSE, /* local_parts */
359 TRUE, /* log_message */
6ea85e9a 360 TRUE, /* log_reject_target */
8523533c
TK
361 TRUE, /* logwrite */
362#ifdef WITH_CONTENT_SCAN
363 FALSE, /* malware */
364#endif
059ec3d9 365 TRUE, /* message */
8523533c
TK
366#ifdef WITH_CONTENT_SCAN
367 FALSE, /* mime_regex */
368#endif
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK
371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH
375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK
378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH
386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH
390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH
393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH
401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH
407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH
416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH
421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH
427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK
434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK
441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
71fafd95 450 #ifdef WITH_OLD_DEMIME
2f079f46 451 (unsigned int)
fd98a5c6 452 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 453 #ifndef DISABLE_PRDR
fd98a5c6 454 (1<<ACL_WHERE_PRDR)|
8ccd00b1 455 #endif
fd98a5c6 456 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 457 #endif
8e669ac1 458
80a47a2c
TK
459 #ifndef DISABLE_DKIM
460 (unsigned int)
461 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 462
80a47a2c
TK
463 (unsigned int)
464 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 465 #endif
fb2274d4 466
4840604e
TL
467 #ifdef EXPERIMENTAL_DMARC
468 (unsigned int)
469 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
470 #endif
471
45b91596
PH
472 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
473 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 474
2f079f46 475 (unsigned int)
fd98a5c6 476 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 477 #ifndef DISABLE_PRDR
fd98a5c6
JH
478 |(1<<ACL_WHERE_PRDR)
479 #endif
480 ),
059ec3d9 481
45b91596
PH
482 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
483 (1<<ACL_WHERE_CONNECT)|
484 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 485 (1<<ACL_WHERE_HELO),
8e669ac1 486
059ec3d9 487 0, /* endpass */
8e669ac1 488
45b91596
PH
489 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
490 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 491
2f079f46 492 (unsigned int)
fd98a5c6 493 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 494 #ifndef DISABLE_PRDR
fd98a5c6
JH
495 |(1<<ACL_WHERE_PRDR)
496 #endif
497 ),
059ec3d9
PH
498
499 0, /* log_message */
8e669ac1 500
6ea85e9a
PH
501 0, /* log_reject_target */
502
059ec3d9 503 0, /* logwrite */
8e669ac1 504
71fafd95 505 #ifdef WITH_CONTENT_SCAN
2f079f46 506 (unsigned int)
fd98a5c6 507 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 508 #ifndef DISABLE_PRDR
fd98a5c6 509 (1<<ACL_WHERE_PRDR)|
8ccd00b1 510 #endif
fd98a5c6 511 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 512 #endif
8523533c 513
059ec3d9
PH
514 0, /* message */
515
71fafd95 516 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
517 (unsigned int)
518 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 519 #endif
8523533c 520
870f6ba8
TF
521 0, /* ratelimit */
522
2f079f46
PH
523 (unsigned int)
524 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46 527 (unsigned int)
fd98a5c6 528 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 529 #ifndef DISABLE_PRDR
fd98a5c6 530 (1<<ACL_WHERE_PRDR)|
8ccd00b1 531 #endif
fd98a5c6 532 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 533 (1<<ACL_WHERE_MIME)),
71fafd95 534 #endif
8523533c 535
e7568d51
TL
536 (unsigned int)
537 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
538 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6
JH
540 (1<<ACL_WHERE_PRDR)|
541 #endif
e7568d51
TL
542 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
543 (1<<ACL_WHERE_NOTSMTP_START)),
544
059ec3d9
PH
545 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
546 (1<<ACL_WHERE_HELO)|
547 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
548 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
549 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 0, /* set */
558
71fafd95 559 #ifdef WITH_CONTENT_SCAN
2f079f46 560 (unsigned int)
fd98a5c6 561 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 562 #ifndef DISABLE_PRDR
fd98a5c6 563 (1<<ACL_WHERE_PRDR)|
8ccd00b1 564 #endif
fd98a5c6 565 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 566 #endif
8523533c 567
71fafd95 568 #ifdef EXPERIMENTAL_SPF
8523533c
TK
569 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
570 (1<<ACL_WHERE_HELO)|
571 (1<<ACL_WHERE_MAILAUTH)|
572 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH
573 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
574 (1<<ACL_WHERE_NOTSMTP)|
575 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM
576
577 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
578 (1<<ACL_WHERE_HELO)|
579 (1<<ACL_WHERE_MAILAUTH)|
580 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
581 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
582 (1<<ACL_WHERE_NOTSMTP)|
583 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 584 #endif
8523533c 585
b0019c78
TF
586 0, /* udpsend */
587
059ec3d9
PH
588 /* Certain types of verify are always allowed, so we let it through
589 always and check in the verify function itself */
590
591 0 /* verify */
059ec3d9
PH
592};
593
594
c5fcb476
PH
595/* Bit map vector of which controls are not allowed at certain times. For
596each control, there's a bitmap of dis-allowed times. For some, it is easier to
597specify the negation of a small number of allowed times. */
598
599static unsigned int control_forbids[] = {
c46782ef
PH
600 (unsigned int)
601 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
602
603 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 604 0, /* bmi_run */
c46782ef
PH
605 #endif
606
ed7f7860
PP
607 0, /* debug */
608
80a47a2c
TK
609 #ifndef DISABLE_DKIM
610 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
8ccd00b1 611 #ifndef DISABLE_PRDR
fd98a5c6 612 (1<<ACL_WHERE_PRDR)|
8ccd00b1 613 #endif
f7572e5a
TK
614 (1<<ACL_WHERE_NOTSMTP_START),
615 #endif
616
4840604e
TL
617 #ifdef EXPERIMENTAL_DMARC
618 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
619 (1<<ACL_WHERE_NOTSMTP_START),
620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
621 (1<<ACL_WHERE_NOTSMTP_START),
622 #endif
623
13363eba
PP
624 (1<<ACL_WHERE_NOTSMTP)|
625 (1<<ACL_WHERE_NOTSMTP_START)|
626 (1<<ACL_WHERE_NOTQUIT), /* dscp */
627
c5fcb476 628 0, /* error */
8e669ac1
PH
629
630 (unsigned int)
c5fcb476 631 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
632
633 (unsigned int)
c5fcb476 634 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 635
e4bdf652
JH
636 (unsigned int)
637 0, /* cutthrough_delivery */
638
45b91596
PH
639 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
640 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 641
45b91596
PH
642 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
643 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH
644
645 (unsigned int)
c5fcb476
PH
646 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
647 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 648 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 649 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
650
651 (unsigned int)
c5fcb476
PH
652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
656
657 (unsigned int)
c5fcb476 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 659 (1<<ACL_WHERE_PREDATA)),
8523533c 660
8800895a
PH
661 (unsigned int)
662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH
663 (1<<ACL_WHERE_PREDATA)|
664 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 665
c46782ef 666 #ifdef WITH_CONTENT_SCAN
8e669ac1 667 (unsigned int)
14d57970 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 669 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 670 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 671 (1<<ACL_WHERE_MIME)),
c46782ef 672 #endif
a6c4ab60 673
8e669ac1 674 (unsigned int)
29aba418
TF
675 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
676 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 677 #ifndef DISABLE_PRDR
fd98a5c6 678 (1<<ACL_WHERE_PRDR)|
8ccd00b1 679 #endif
29aba418
TF
680 (1<<ACL_WHERE_MIME)),
681
682 (unsigned int)
a6c4ab60 683 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 684 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 685 #ifndef DISABLE_PRDR
fd98a5c6 686 (1<<ACL_WHERE_PRDR)|
8ccd00b1 687 #endif
e715ad22 688 (1<<ACL_WHERE_MIME)),
8523533c 689
45b91596 690 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH
691 (1<<ACL_WHERE_NOTSMTP_START),
692
693 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH
694 (1<<ACL_WHERE_NOTSMTP_START),
695
696 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH
697 (1<<ACL_WHERE_NOTSMTP_START),
698
699 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 700 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH
701};
702
703/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
704
705typedef struct control_def {
706 uschar *name;
707 int value; /* CONTROL_xxx value */
059ec3d9
PH
708 BOOL has_option; /* Has /option(s) following */
709} control_def;
710
711static control_def controls_list[] = {
c46782ef 712 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 713#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 714 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
8523533c 715#endif
ed7f7860 716 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK
717#ifndef DISABLE_DKIM
718 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
f7572e5a 719#endif
4840604e
TL
720#ifdef EXPERIMENTAL_DMARC
721 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
722 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
723#endif
13363eba 724 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH
725 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
726 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
727 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
728 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 729 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 730 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH
731 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
732 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 733 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 734 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 735#ifdef WITH_CONTENT_SCAN
c46782ef 736 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 737#endif
c46782ef
PH
738 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
739 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
740 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH
741 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
742 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH
743 };
744
e5a9dba6
PH
745/* Support data structures for Client SMTP Authorization. acl_verify_csa()
746caches its result in a tree to avoid repeated DNS queries. The result is an
747integer code which is used as an index into the following tables of
748explanatory strings and verification return codes. */
749
750static tree_node *csa_cache = NULL;
751
752enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
753 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
754
755/* The acl_verify_csa() return code is translated into an acl_verify() return
756code using the following table. It is OK unless the client is definitely not
757authorized. This is because CSA is supposed to be optional for sending sites,
758so recipients should not be too strict about checking it - especially because
759DNS problems are quite likely to occur. It's possible to use $csa_status in
760further ACL conditions to distinguish ok, unknown, and defer if required, but
761the aim is to make the usual configuration simple. */
762
763static int csa_return_code[] = {
764 OK, OK, OK, OK,
765 FAIL, FAIL, FAIL, FAIL
766};
767
768static uschar *csa_status_string[] = {
769 US"unknown", US"ok", US"defer", US"defer",
770 US"fail", US"fail", US"fail", US"fail"
771};
772
773static uschar *csa_reason_string[] = {
774 US"unknown",
775 US"ok",
776 US"deferred (SRV lookup failed)",
777 US"deferred (target address lookup failed)",
778 US"failed (explicit authorization required)",
779 US"failed (host name not authorized)",
780 US"failed (no authorized addresses)",
781 US"failed (client address mismatch)"
782};
783
c99ce5c9
TF
784/* Options for the ratelimit condition. Note that there are two variants of
785the per_rcpt option, depending on the ACL that is used to measure the rate.
786However any ACL must be able to look up per_rcpt rates in /noupdate mode,
787so the two variants must have the same internal representation as well as
788the same configuration string. */
789
790enum {
791 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
792 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
793};
794
795#define RATE_SET(var,new) \
796 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
797
798static uschar *ratelimit_option_string[] = {
799 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
800 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
801};
802
059ec3d9
PH
803/* Enable recursion between acl_check_internal() and acl_check_condition() */
804
f60d98e8
JH
805static int acl_check_wargs(int, address_item *, uschar *, int, uschar **,
806 uschar **);
059ec3d9
PH
807
808
809/*************************************************
810* Pick out name from list *
811*************************************************/
812
813/* Use a binary chop method
814
815Arguments:
816 name name to find
817 list list of names
818 end size of list
819
820Returns: offset in list, or -1 if not found
821*/
822
823static int
824acl_checkname(uschar *name, uschar **list, int end)
825{
826int start = 0;
827
828while (start < end)
829 {
830 int mid = (start + end)/2;
831 int c = Ustrcmp(name, list[mid]);
832 if (c == 0) return mid;
833 if (c < 0) end = mid; else start = mid + 1;
834 }
835
836return -1;
837}
838
839
840/*************************************************
841* Read and parse one ACL *
842*************************************************/
843
844/* This function is called both from readconf in order to parse the ACLs in the
845configuration file, and also when an ACL is encountered dynamically (e.g. as
846the result of an expansion). It is given a function to call in order to
847retrieve the lines of the ACL. This function handles skipping comments and
848blank lines (where relevant).
849
850Arguments:
851 func function to get next line of ACL
852 error where to put an error message
853
854Returns: pointer to ACL, or NULL
855 NULL can be legal (empty ACL); in this case error will be NULL
856*/
857
858acl_block *
859acl_read(uschar *(*func)(void), uschar **error)
860{
861acl_block *yield = NULL;
862acl_block **lastp = &yield;
863acl_block *this = NULL;
864acl_condition_block *cond;
865acl_condition_block **condp = NULL;
866uschar *s;
867
868*error = NULL;
869
870while ((s = (*func)()) != NULL)
871 {
872 int v, c;
873 BOOL negated = FALSE;
874 uschar *saveline = s;
875 uschar name[64];
876
877 /* Conditions (but not verbs) are allowed to be negated by an initial
878 exclamation mark. */
879
880 while (isspace(*s)) s++;
881 if (*s == '!')
882 {
883 negated = TRUE;
884 s++;
885 }
886
cf00dad6
PH
887 /* Read the name of a verb or a condition, or the start of a new ACL, which
888 can be started by a name, or by a macro definition. */
059ec3d9
PH
889
890 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 891 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
892
893 /* If a verb is unrecognized, it may be another condition or modifier that
894 continues the previous verb. */
895
896 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
897 if (v < 0)
898 {
899 if (this == NULL)
900 {
4e167a8c
PH
901 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
902 saveline);
059ec3d9
PH
903 return NULL;
904 }
905 }
906
907 /* New verb */
908
909 else
910 {
911 if (negated)
912 {
913 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
914 return NULL;
915 }
916 this = store_get(sizeof(acl_block));
917 *lastp = this;
918 lastp = &(this->next);
919 this->next = NULL;
920 this->verb = v;
921 this->condition = NULL;
922 condp = &(this->condition);
923 if (*s == 0) continue; /* No condition on this line */
924 if (*s == '!')
925 {
926 negated = TRUE;
927 s++;
928 }
929 s = readconf_readname(name, sizeof(name), s); /* Condition name */
930 }
931
932 /* Handle a condition or modifier. */
933
934 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
935 if (c < 0)
936 {
937 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
938 saveline);
939 return NULL;
940 }
941
942 /* The modifiers may not be negated */
943
944 if (negated && cond_modifiers[c])
945 {
946 *error = string_sprintf("ACL error: negation is not allowed with "
947 "\"%s\"", conditions[c]);
948 return NULL;
949 }
950
951 /* ENDPASS may occur only with ACCEPT or DISCARD. */
952
953 if (c == ACLC_ENDPASS &&
954 this->verb != ACL_ACCEPT &&
955 this->verb != ACL_DISCARD)
956 {
957 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
958 conditions[c], verbs[this->verb]);
959 return NULL;
960 }
961
962 cond = store_get(sizeof(acl_condition_block));
963 cond->next = NULL;
964 cond->type = c;
965 cond->u.negated = negated;
966
967 *condp = cond;
968 condp = &(cond->next);
969
970 /* The "set" modifier is different in that its argument is "name=value"
971 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
972 gives us a variable name to insert into the data block. The original ACL
973 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
974 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
975 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
976 After that, we allow alphanumerics and underscores, but the first character
977 after c or m must be a digit or an underscore. This retains backwards
978 compatibility. */
059ec3d9
PH
979
980 if (c == ACLC_SET)
981 {
47ca6d6c
PH
982 uschar *endptr;
983
38a0a95f
PH
984 if (Ustrncmp(s, "acl_c", 5) != 0 &&
985 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 986 {
38a0a95f
PH
987 *error = string_sprintf("invalid variable name after \"set\" in ACL "
988 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
989 return NULL;
47ca6d6c 990 }
38a0a95f
PH
991
992 endptr = s + 5;
641cb756
PH
993 if (!isdigit(*endptr) && *endptr != '_')
994 {
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
997 s);
998 return NULL;
999 }
1000
38a0a95f 1001 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1002 {
38a0a95f
PH
1003 if (!isalnum(*endptr) && *endptr != '_')
1004 {
1005 *error = string_sprintf("invalid character \"%c\" in variable name "
1006 "in ACL modifier \"set %s\"", *endptr, s);
1007 return NULL;
1008 }
1009 endptr++;
47ca6d6c 1010 }
47ca6d6c 1011
38a0a95f 1012 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1013 s = endptr;
059ec3d9
PH
1014 while (isspace(*s)) s++;
1015 }
1016
1017 /* For "set", we are now positioned for the data. For the others, only
1018 "endpass" has no data */
1019
1020 if (c != ACLC_ENDPASS)
1021 {
1022 if (*s++ != '=')
1023 {
1024 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1025 cond_modifiers[c]? US"modifier" : US"condition");
1026 return NULL;
1027 }
1028 while (isspace(*s)) s++;
1029 cond->arg = string_copy(s);
1030 }
1031 }
1032
1033return yield;
1034}
1035
1036
1037
1038/*************************************************
71fafd95
PH
1039* Set up added header line(s) *
1040*************************************************/
1041
1042/* This function is called by the add_header modifier, and also from acl_warn()
1043to implement the now-deprecated way of adding header lines using "message" on a
1044"warn" verb. The argument is treated as a sequence of header lines which are
1045added to a chain, provided there isn't an identical one already there.
1046
1047Argument: string of header lines
1048Returns: nothing
1049*/
1050
1051static void
1052setup_header(uschar *hstring)
1053{
1054uschar *p, *q;
1055int hlen = Ustrlen(hstring);
1056
b1b05573
JH
1057/* Ignore any leading newlines */
1058while (*hstring == '\n') hstring++, hlen--;
71fafd95 1059
b1b05573 1060/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1061if (hlen <= 0) return;
b1b05573
JH
1062if (hstring[--hlen] != '\n') hstring = string_sprintf("%s\n", hstring);
1063else while(hstring[--hlen] == '\n') hstring[hlen+1] = '\0';
71fafd95
PH
1064
1065/* Loop for multiple header lines, taking care about continuations */
1066
1067for (p = q = hstring; *p != 0; )
1068 {
1069 uschar *s;
1070 int newtype = htype_add_bot;
1071 header_line **hptr = &acl_added_headers;
1072
1073 /* Find next header line within the string */
1074
1075 for (;;)
1076 {
1077 q = Ustrchr(q, '\n');
1078 if (*(++q) != ' ' && *q != '\t') break;
1079 }
1080
1081 /* If the line starts with a colon, interpret the instruction for where to
1082 add it. This temporarily sets up a new type. */
1083
1084 if (*p == ':')
1085 {
1086 if (strncmpic(p, US":after_received:", 16) == 0)
1087 {
1088 newtype = htype_add_rec;
1089 p += 16;
1090 }
1091 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1092 {
1093 newtype = htype_add_rfc;
1094 p += 14;
1095 }
1096 else if (strncmpic(p, US":at_start:", 10) == 0)
1097 {
1098 newtype = htype_add_top;
1099 p += 10;
1100 }
1101 else if (strncmpic(p, US":at_end:", 8) == 0)
1102 {
1103 newtype = htype_add_bot;
1104 p += 8;
1105 }
1106 while (*p == ' ' || *p == '\t') p++;
1107 }
1108
1109 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1110 to the front of it. */
1111
1112 for (s = p; s < q - 1; s++)
1113 {
1114 if (*s == ':' || !isgraph(*s)) break;
1115 }
1116
438257ba 1117 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
71fafd95
PH
1118 hlen = Ustrlen(s);
1119
1120 /* See if this line has already been added */
1121
1122 while (*hptr != NULL)
1123 {
1124 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
1125 hptr = &((*hptr)->next);
1126 }
1127
1128 /* Add if not previously present */
1129
1130 if (*hptr == NULL)
1131 {
1132 header_line *h = store_get(sizeof(header_line));
1133 h->text = s;
1134 h->next = NULL;
1135 h->type = newtype;
1136 h->slen = hlen;
1137 *hptr = h;
1138 hptr = &(h->next);
1139 }
1140
1141 /* Advance for next header line within the string */
1142
1143 p = q;
1144 }
1145}
1146
1147
1148
e7568d51 1149/*************************************************
362145b5
JH
1150* List the added header lines *
1151*************************************************/
1152uschar *
1153fn_hdrs_added(void)
1154{
1155uschar * ret = NULL;
1156header_line * h = acl_added_headers;
1157uschar * s;
1158uschar * cp;
1159int size = 0;
1160int ptr = 0;
1161
1162if (!h) return NULL;
1163
1164do
1165 {
1166 s = h->text;
1167 while ((cp = Ustrchr(s, '\n')) != NULL)
1168 {
1169 if (cp[1] == '\0') break;
1170
1171 /* contains embedded newline; needs doubling */
1172 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1173 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH
1174 s = cp+1;
1175 }
1176 /* last bit of header */
1177
1178 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1179 }
6d9cfc47 1180while((h = h->next));
362145b5
JH
1181
1182ret[ptr-1] = '\0'; /* overwrite last newline */
1183return ret;
1184}
1185
1186
1187/*************************************************
e7568d51
TL
1188* Set up removed header line(s) *
1189*************************************************/
1190
1191/* This function is called by the remove_header modifier. The argument is
1192treated as a sequence of header names which are added to a colon separated
1193list, provided there isn't an identical one already there.
1194
1195Argument: string of header names
1196Returns: nothing
1197*/
1198
1199static void
1200setup_remove_header(uschar *hnames)
1201{
1202if (*hnames != 0)
1203 {
1204 if (acl_removed_headers == NULL)
1205 acl_removed_headers = hnames;
1206 else
1207 acl_removed_headers = string_sprintf("%s : %s", acl_removed_headers, hnames);
1208 }
1209}
1210
1211
71fafd95
PH
1212
1213/*************************************************
059ec3d9
PH
1214* Handle warnings *
1215*************************************************/
1216
1217/* This function is called when a WARN verb's conditions are true. It adds to
1218the message's headers, and/or writes information to the log. In each case, this
1219only happens once (per message for headers, per connection for log).
1220
71fafd95
PH
1221** NOTE: The header adding action using the "message" setting is historic, and
1222its use is now deprecated. The new add_header modifier should be used instead.
1223
059ec3d9
PH
1224Arguments:
1225 where ACL_WHERE_xxxx indicating which ACL this is
1226 user_message message for adding to headers
1227 log_message message for logging, if different
1228
1229Returns: nothing
1230*/
1231
1232static void
1233acl_warn(int where, uschar *user_message, uschar *log_message)
1234{
059ec3d9
PH
1235if (log_message != NULL && log_message != user_message)
1236 {
1237 uschar *text;
1238 string_item *logged;
1239
1240 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1241 string_printing(log_message));
1242
1243 /* If a sender verification has failed, and the log message is "sender verify
1244 failed", add the failure message. */
1245
1246 if (sender_verified_failed != NULL &&
1247 sender_verified_failed->message != NULL &&
1248 strcmpic(log_message, US"sender verify failed") == 0)
1249 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1250
9c7a242c
PH
1251 /* Search previously logged warnings. They are kept in malloc
1252 store so they can be freed at the start of a new message. */
059ec3d9
PH
1253
1254 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1255 if (Ustrcmp(logged->text, text) == 0) break;
1256
1257 if (logged == NULL)
1258 {
1259 int length = Ustrlen(text) + 1;
1260 log_write(0, LOG_MAIN, "%s", text);
1261 logged = store_malloc(sizeof(string_item) + length);
1262 logged->text = (uschar *)logged + sizeof(string_item);
1263 memcpy(logged->text, text, length);
1264 logged->next = acl_warn_logged;
1265 acl_warn_logged = logged;
1266 }
1267 }
1268
1269/* If there's no user message, we are done. */
1270
1271if (user_message == NULL) return;
1272
1273/* If this isn't a message ACL, we can't do anything with a user message.
1274Log an error. */
1275
1276if (where > ACL_WHERE_NOTSMTP)
1277 {
1278 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1279 "found in a non-message (%s) ACL: cannot specify header lines here: "
1280 "message ignored", acl_wherenames[where]);
1281 return;
1282 }
1283
71fafd95
PH
1284/* The code for setting up header lines is now abstracted into a separate
1285function so that it can be used for the add_header modifier as well. */
059ec3d9 1286
71fafd95 1287setup_header(user_message);
059ec3d9
PH
1288}
1289
1290
1291
1292/*************************************************
1293* Verify and check reverse DNS *
1294*************************************************/
1295
1296/* Called from acl_verify() below. We look up the host name(s) of the client IP
1297address if this has not yet been done. The host_name_lookup() function checks
1298that one of these names resolves to an address list that contains the client IP
1299address, so we don't actually have to do the check here.
1300
1301Arguments:
1302 user_msgptr pointer for user message
1303 log_msgptr pointer for log message
1304
1305Returns: OK verification condition succeeded
1306 FAIL verification failed
1307 DEFER there was a problem verifying
1308*/
1309
1310static int
1311acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1312{
1313int rc;
1314
1315user_msgptr = user_msgptr; /* stop compiler warning */
1316
1317/* Previous success */
1318
1319if (sender_host_name != NULL) return OK;
1320
1321/* Previous failure */
1322
1323if (host_lookup_failed)
1324 {
1325 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1326 return FAIL;
1327 }
1328
1329/* Need to do a lookup */
1330
1331HDEBUG(D_acl)
1332 debug_printf("looking up host name to force name/address consistency check\n");
1333
1334if ((rc = host_name_lookup()) != OK)
1335 {
1336 *log_msgptr = (rc == DEFER)?
1337 US"host lookup deferred for reverse lookup check"
1338 :
1339 string_sprintf("host lookup failed for reverse lookup check%s",
1340 host_lookup_msg);
1341 return rc; /* DEFER or FAIL */
1342 }
1343
1344host_build_sender_fullhost();
1345return OK;
1346}
1347
1348
1349
1350/*************************************************
e5a9dba6
PH
1351* Check client IP address matches CSA target *
1352*************************************************/
1353
1354/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1355response for address records belonging to the CSA target hostname. The section
1356is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1357If one of the addresses matches the client's IP address, then the client is
1358authorized by CSA. If there are target IP addresses but none of them match
1359then the client is using an unauthorized IP address. If there are no target IP
1360addresses then the client cannot be using an authorized IP address. (This is
1361an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1362
1363Arguments:
1364 dnsa the DNS answer block
1365 dnss a DNS scan block for us to use
1366 reset option specifing what portion to scan, as described above
1367 target the target hostname to use for matching RR names
1368
1369Returns: CSA_OK successfully authorized
1370 CSA_FAIL_MISMATCH addresses found but none matched
1371 CSA_FAIL_NOADDR no target addresses found
1372*/
1373
1374static int
1375acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1376 uschar *target)
1377{
1378dns_record *rr;
1379dns_address *da;
1380
1381BOOL target_found = FALSE;
1382
1383for (rr = dns_next_rr(dnsa, dnss, reset);
1384 rr != NULL;
1385 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1386 {
1387 /* Check this is an address RR for the target hostname. */
1388
1389 if (rr->type != T_A
1390 #if HAVE_IPV6
1391 && rr->type != T_AAAA
1392 #ifdef SUPPORT_A6
1393 && rr->type != T_A6
1394 #endif
1395 #endif
1396 ) continue;
1397
1398 if (strcmpic(target, rr->name) != 0) continue;
1399
1400 target_found = TRUE;
1401
1402 /* Turn the target address RR into a list of textual IP addresses and scan
1403 the list. There may be more than one if it is an A6 RR. */
1404
1405 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1406 {
1407 /* If the client IP address matches the target IP address, it's good! */
1408
1409 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1410
1411 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1412 }
1413 }
1414
1415/* If we found some target addresses but none of them matched, the client is
1416using an unauthorized IP address, otherwise the target has no authorized IP
1417addresses. */
1418
1419if (target_found) return CSA_FAIL_MISMATCH;
1420else return CSA_FAIL_NOADDR;
1421}
1422
1423
1424
1425/*************************************************
1426* Verify Client SMTP Authorization *
1427*************************************************/
1428
1429/* Called from acl_verify() below. This routine calls dns_lookup_special()
1430to find the CSA SRV record corresponding to the domain argument, or
1431$sender_helo_name if no argument is provided. It then checks that the
1432client is authorized, and that its IP address corresponds to the SRV
1433target's address by calling acl_verify_csa_address() above. The address
1434should have been returned in the DNS response's ADDITIONAL section, but if
1435not we perform another DNS lookup to get it.
1436
1437Arguments:
1438 domain pointer to optional parameter following verify = csa
1439
1440Returns: CSA_UNKNOWN no valid CSA record found
1441 CSA_OK successfully authorized
1442 CSA_FAIL_* client is definitely not authorized
1443 CSA_DEFER_* there was a DNS problem
1444*/
1445
1446static int
1447acl_verify_csa(uschar *domain)
1448{
1449tree_node *t;
1450uschar *found, *p;
1451int priority, weight, port;
1452dns_answer dnsa;
1453dns_scan dnss;
1454dns_record *rr;
1455int rc, type;
1456uschar target[256];
1457
1458/* Work out the domain we are using for the CSA lookup. The default is the
1459client's HELO domain. If the client has not said HELO, use its IP address
1460instead. If it's a local client (exim -bs), CSA isn't applicable. */
1461
1462while (isspace(*domain) && *domain != '\0') ++domain;
1463if (*domain == '\0') domain = sender_helo_name;
1464if (domain == NULL) domain = sender_host_address;
1465if (sender_host_address == NULL) return CSA_UNKNOWN;
1466
1467/* If we have an address literal, strip off the framing ready for turning it
1468into a domain. The framing consists of matched square brackets possibly
1469containing a keyword and a colon before the actual IP address. */
1470
1471if (domain[0] == '[')
1472 {
1473 uschar *start = Ustrchr(domain, ':');
1474 if (start == NULL) start = domain;
1475 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1476 }
1477
1478/* Turn domains that look like bare IP addresses into domains in the reverse
1479DNS. This code also deals with address literals and $sender_host_address. It's
1480not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1481address literals, but it's probably the most friendly thing to do. This is an
1482extension to CSA, so we allow it to be turned off for proper conformance. */
1483
7e66e54d 1484if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1485 {
1486 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1487 dns_build_reverse(domain, target);
1488 domain = target;
1489 }
1490
1491/* Find out if we've already done the CSA check for this domain. If we have,
1492return the same result again. Otherwise build a new cached result structure
1493for this domain. The name is filled in now, and the value is filled in when
1494we return from this function. */
1495
1496t = tree_search(csa_cache, domain);
1497if (t != NULL) return t->data.val;
1498
1499t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1500Ustrcpy(t->name, domain);
1501(void)tree_insertnode(&csa_cache, t);
1502
1503/* Now we are ready to do the actual DNS lookup(s). */
1504
28e6ef29 1505found = domain;
e5a9dba6
PH
1506switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1507 {
1508 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1509
1510 default:
1511 return t->data.val = CSA_DEFER_SRV;
1512
1513 /* If we found nothing, the client's authorization is unknown. */
1514
1515 case DNS_NOMATCH:
1516 case DNS_NODATA:
1517 return t->data.val = CSA_UNKNOWN;
1518
1519 /* We got something! Go on to look at the reply in more detail. */
1520
1521 case DNS_SUCCEED:
1522 break;
1523 }
1524
1525/* Scan the reply for well-formed CSA SRV records. */
1526
1527for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1528 rr != NULL;
1529 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1530 {
1531 if (rr->type != T_SRV) continue;
1532
1533 /* Extract the numerical SRV fields (p is incremented) */
1534
1535 p = rr->data;
1536 GETSHORT(priority, p);
1537 GETSHORT(weight, p);
1538 GETSHORT(port, p);
1539
1540 DEBUG(D_acl)
1541 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1542
1543 /* Check the CSA version number */
1544
1545 if (priority != 1) continue;
1546
1547 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1548 found by dns_special_lookup() is a parent of the one we asked for), we check
1549 the subdomain assertions in the port field. At the moment there's only one
1550 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1551 SRV records of their own. */
1552
1dc92d5a 1553 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH
1554 {
1555 if (port & 1)
1556 return t->data.val = CSA_FAIL_EXPLICIT;
1557 else
1558 return t->data.val = CSA_UNKNOWN;
1559 }
1560
1561 /* This CSA SRV record refers directly to our domain, so we check the value
1562 in the weight field to work out the domain's authorization. 0 and 1 are
1563 unauthorized; 3 means the client is authorized but we can't check the IP
1564 address in order to authenticate it, so we treat it as unknown; values
1565 greater than 3 are undefined. */
1566
1567 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1568
1569 if (weight > 2) continue;
1570
1571 /* Weight == 2, which means the domain is authorized. We must check that the
1572 client's IP address is listed as one of the SRV target addresses. Save the
1573 target hostname then break to scan the additional data for its addresses. */
1574
1575 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1576 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1577
1578 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1579
1580 break;
1581 }
1582
1583/* If we didn't break the loop then no appropriate records were found. */
1584
1585if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1586
1587/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1588A target of "." indicates there are no valid addresses, so the client cannot
1589be authorized. (This is an odd configuration because weight=2 target=. is
1590equivalent to weight=1, but we check for it in order to keep load off the
1591root name servers.) Note that dn_expand() turns "." into "". */
1592
1593if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1594
1595/* Scan the additional section of the CSA SRV reply for addresses belonging
1596to the target. If the name server didn't return any additional data (e.g.
1597because it does not fully support SRV records), we need to do another lookup
1598to obtain the target addresses; otherwise we have a definitive result. */
1599
1600rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1601if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1602
1603/* The DNS lookup type corresponds to the IP version used by the client. */
1604
1605#if HAVE_IPV6
1606if (Ustrchr(sender_host_address, ':') != NULL)
1607 type = T_AAAA;
1608else
1609#endif /* HAVE_IPV6 */
1610 type = T_A;
1611
1612
1613#if HAVE_IPV6 && defined(SUPPORT_A6)
1614DNS_LOOKUP_AGAIN:
1615#endif
1616
4e0983dc 1617lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1618switch (dns_lookup(&dnsa, target, type, NULL))
1619 {
1620 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1621
1622 default:
1623 return t->data.val = CSA_DEFER_ADDR;
1624
1625 /* If the query succeeded, scan the addresses and return the result. */
1626
1627 case DNS_SUCCEED:
1628 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1629 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1630 /* else fall through */
1631
1632 /* If the target has no IP addresses, the client cannot have an authorized
1633 IP address. However, if the target site uses A6 records (not AAAA records)
1634 we have to do yet another lookup in order to check them. */
1635
1636 case DNS_NOMATCH:
1637 case DNS_NODATA:
1638
1639 #if HAVE_IPV6 && defined(SUPPORT_A6)
1640 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1641 #endif
1642
1643 return t->data.val = CSA_FAIL_NOADDR;
1644 }
1645}
1646
1647
1648
1649/*************************************************
059ec3d9
PH
1650* Handle verification (address & other) *
1651*************************************************/
1652
89583014 1653enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM
1654 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1655 VERIFY_HDR_NAMES_ASCII
89583014
JH
1656 };
1657typedef struct {
1658 uschar * name;
1659 int value;
1660 unsigned where_allowed; /* bitmap */
1661 BOOL no_options; /* Never has /option(s) following */
1662 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1663 } verify_type_t;
1664static verify_type_t verify_type_list[] = {
7e8360e6 1665 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH
1666 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1667 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1668 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1669 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1670 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1671 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1672 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1673 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1674 FALSE, 6 },
770747fd
MFM
1675 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1676 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH
1677 };
1678
1679
1680enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1681 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1682 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1683 CALLOUT_TIME
1684 };
1685typedef struct {
1686 uschar * name;
1687 int value;
1688 int flag;
1689 BOOL has_option; /* Has =option(s) following */
1690 BOOL timeval; /* Has a time value */
1691 } callout_opt_t;
1692static callout_opt_t callout_opt_list[] = {
1693 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1694 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1695 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1696 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1697 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1698 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1699 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1700 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1701 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1702 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1703 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1704 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1705 };
1706
1707
1708
059ec3d9
PH
1709/* This function implements the "verify" condition. It is called when
1710encountered in any ACL, because some tests are almost always permitted. Some
1711just don't make sense, and always fail (for example, an attempt to test a host
1712lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1713
1714Arguments:
1715 where where called from
1716 addr the recipient address that the ACL is handling, or NULL
1717 arg the argument of "verify"
1718 user_msgptr pointer for user message
1719 log_msgptr pointer for log message
1720 basic_errno where to put verify errno
1721
1722Returns: OK verification condition succeeded
1723 FAIL verification failed
1724 DEFER there was a problem verifying
1725 ERROR syntax error
1726*/
1727
1728static int
1729acl_verify(int where, address_item *addr, uschar *arg,
1730 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1731{
1732int sep = '/';
1733int callout = -1;
1734int callout_overall = -1;
4deaf07d 1735int callout_connect = -1;
059ec3d9
PH
1736int verify_options = 0;
1737int rc;
1738BOOL verify_header_sender = FALSE;
1739BOOL defer_ok = FALSE;
1740BOOL callout_defer_ok = FALSE;
1741BOOL no_details = FALSE;
eafd343b 1742BOOL success_on_redirect = FALSE;
059ec3d9
PH
1743address_item *sender_vaddr = NULL;
1744uschar *verify_sender_address = NULL;
1745uschar *pm_mailfrom = NULL;
1746uschar *se_mailfrom = NULL;
596875b3
PH
1747
1748/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1749an error if options are given for items that don't expect them.
596875b3
PH
1750*/
1751
1752uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH
1753uschar *list = arg;
1754uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1755verify_type_t * vp;
059ec3d9
PH
1756
1757if (ss == NULL) goto BAD_VERIFY;
1758
1759/* Handle name/address consistency verification in a separate function. */
1760
89583014
JH
1761for (vp= verify_type_list;
1762 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1763 vp++
1764 )
1765 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1766 : strcmpic (ss, vp->name) == 0)
1767 break;
1768if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1769 goto BAD_VERIFY;
1770
1771if (vp->no_options && slash != NULL)
059ec3d9 1772 {
89583014
JH
1773 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1774 "(this verify item has no options)", arg);
1775 return ERROR;
059ec3d9 1776 }
89583014 1777if (!(vp->where_allowed & (1<<where)))
059ec3d9 1778 {
89583014
JH
1779 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1780 return ERROR;
059ec3d9 1781 }
89583014 1782switch(vp->value)
596875b3 1783 {
89583014
JH
1784 case VERIFY_REV_HOST_LKUP:
1785 if (sender_host_address == NULL) return OK;
7e8360e6
JH
1786 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1787 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1788 if (strcmpic(ss, US"defer_ok") == 0)
1789 return OK;
1790 return rc;
059ec3d9 1791
89583014
JH
1792 case VERIFY_CERT:
1793 /* TLS certificate verification is done at STARTTLS time; here we just
1794 test whether it was successful or not. (This is for optional verification; for
1795 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1796
817d9f57 1797 if (tls_in.certificate_verified) return OK;
89583014
JH
1798 *user_msgptr = US"no verified certificate";
1799 return FAIL;
e5a9dba6 1800
89583014
JH
1801 case VERIFY_HELO:
1802 /* We can test the result of optional HELO verification that might have
1803 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1804
89583014
JH
1805 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1806 return helo_verified? OK : FAIL;
059ec3d9 1807
89583014
JH
1808 case VERIFY_CSA:
1809 /* Do Client SMTP Authorization checks in a separate function, and turn the
1810 result code into user-friendly strings. */
1c41c9cc 1811
89583014
JH
1812 rc = acl_verify_csa(list);
1813 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1814 csa_reason_string[rc]);
1815 csa_status = csa_status_string[rc];
1816 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1817 return csa_return_code[rc];
1818
1819 case VERIFY_HDR_SYNTAX:
1820 /* Check that all relevant header lines have the correct syntax. If there is
1821 a syntax error, we return details of the error to the sender if configured to
1822 send out full details. (But a "message" setting on the ACL can override, as
1823 always). */
1824
1825 rc = verify_check_headers(log_msgptr);
1826 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1827 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1828 return rc;
059ec3d9 1829
770747fd
MFM
1830 case VERIFY_HDR_NAMES_ASCII:
1831 /* Check that all header names are true 7 bit strings
1832 See RFC 5322, 2.2. and RFC 6532, 3. */
1833
1834 rc = verify_check_header_names_ascii(log_msgptr);
1835 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1836 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1837 return rc;
1838
89583014
JH
1839 case VERIFY_NOT_BLIND:
1840 /* Check that no recipient of this message is "blind", that is, every envelope
1841 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1842
89583014
JH
1843 rc = verify_check_notblind();
1844 if (rc != OK)
1845 {
1846 *log_msgptr = string_sprintf("bcc recipient detected");
1847 if (smtp_return_error_details)
1848 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1849 }
1850 return rc;
059ec3d9 1851
89583014
JH
1852 /* The remaining verification tests check recipient and sender addresses,
1853 either from the envelope or from the header. There are a number of
1854 slash-separated options that are common to all of them. */
059ec3d9 1855
89583014
JH
1856 case VERIFY_HDR_SNDR:
1857 verify_header_sender = TRUE;
1858 break;
059ec3d9 1859
89583014
JH
1860 case VERIFY_SNDR:
1861 /* In the case of a sender, this can optionally be followed by an address to use
1862 in place of the actual sender (rare special-case requirement). */
059ec3d9 1863 {
89583014
JH
1864 uschar *s = ss + 6;
1865 if (*s == 0)
1866 verify_sender_address = sender_address;
1867 else
1868 {
1869 while (isspace(*s)) s++;
1870 if (*s++ != '=') goto BAD_VERIFY;
1871 while (isspace(*s)) s++;
1872 verify_sender_address = string_copy(s);
1873 }
059ec3d9 1874 }
89583014
JH
1875 break;
1876
1877 case VERIFY_RCPT:
1878 break;
059ec3d9
PH
1879 }
1880
89583014
JH
1881
1882
596875b3
PH
1883/* Remaining items are optional; they apply to sender and recipient
1884verification, including "header sender" verification. */
059ec3d9
PH
1885
1886while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1887 != NULL)
1888 {
1889 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1890 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1891 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1892
1893 /* These two old options are left for backwards compatibility */
1894
1895 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1896 {
1897 callout_defer_ok = TRUE;
1898 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1899 }
1900
1901 else if (strcmpic(ss, US"check_postmaster") == 0)
1902 {
1903 pm_mailfrom = US"";
1904 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1905 }
1906
1907 /* The callout option has a number of sub-options, comma separated */
1908
1909 else if (strncmpic(ss, US"callout", 7) == 0)
1910 {
1911 callout = CALLOUT_TIMEOUT_DEFAULT;
1912 ss += 7;
1913 if (*ss != 0)
1914 {
1915 while (isspace(*ss)) ss++;
1916 if (*ss++ == '=')
1917 {
1918 int optsep = ',';
1919 uschar *opt;
1920 uschar buffer[256];
1921 while (isspace(*ss)) ss++;
8e669ac1 1922
059ec3d9
PH
1923 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1924 != NULL)
1925 {
89583014 1926 callout_opt_t * op;
438257ba 1927 double period = 1.0F;
059ec3d9 1928
89583014 1929 for (op= callout_opt_list; op->name; op++)
438257ba 1930 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1931 break;
059ec3d9 1932
89583014
JH
1933 verify_options |= op->flag;
1934 if (op->has_option)
1935 {
438257ba 1936 opt += Ustrlen(op->name);
4deaf07d
PH
1937 while (isspace(*opt)) opt++;
1938 if (*opt++ != '=')
1939 {
1940 *log_msgptr = string_sprintf("'=' expected after "
89583014 1941 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1942 return ERROR;
1943 }
1944 while (isspace(*opt)) opt++;
89583014
JH
1945 }
1946 if (op->timeval)
1947 {
1948 period = readconf_readtime(opt, 0, FALSE);
1949 if (period < 0)
4deaf07d
PH
1950 {
1951 *log_msgptr = string_sprintf("bad time value in ACL condition "
1952 "\"verify %s\"", arg);
1953 return ERROR;
1954 }
89583014
JH
1955 }
1956
1957 switch(op->value)
1958 {
1959 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1960 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1961 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1962 case CALLOUT_MAILFROM:
1963 if (!verify_header_sender)
1964 {
1965 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1966 "callout option only for verify=header_sender (detected in ACL "
1967 "condition \"%s\")", arg);
1968 return ERROR;
1969 }
1970 se_mailfrom = string_copy(opt);
1971 break;
1972 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1973 case CALLOUT_MAXWAIT: callout_overall = period; break;
1974 case CALLOUT_CONNECT: callout_connect = period; break;
1975 case CALLOUT_TIME: callout = period; break;
1976 }
059ec3d9
PH
1977 }
1978 }
1979 else
1980 {
1981 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1982 "ACL condition \"%s\"", arg);
1983 return ERROR;
1984 }
1985 }
1986 }
1987
1988 /* Option not recognized */
1989
1990 else
1991 {
1992 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1993 "condition \"verify %s\"", ss, arg);
1994 return ERROR;
1995 }
1996 }
1997
1998if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1999 (vopt_callout_recipsender|vopt_callout_recippmaster))
2000 {
2001 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2002 "for a recipient callout";
2003 return ERROR;
2004 }
2005
2006/* Handle sender-in-header verification. Default the user message to the log
2007message if giving out verification details. */
2008
2009if (verify_header_sender)
2010 {
8e669ac1 2011 int verrno;
059ec3d9 2012 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
2013 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2014 &verrno);
2015 if (rc != OK)
8e669ac1 2016 {
fe5b5d0b
PH
2017 *basic_errno = verrno;
2018 if (smtp_return_error_details)
2019 {
2020 if (*user_msgptr == NULL && *log_msgptr != NULL)
2021 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2022 if (rc == DEFER) acl_temp_details = TRUE;
2023 }
8e669ac1 2024 }
059ec3d9
PH
2025 }
2026
2027/* Handle a sender address. The default is to verify *the* sender address, but
2028optionally a different address can be given, for special requirements. If the
2029address is empty, we are dealing with a bounce message that has no sender, so
2030we cannot do any checking. If the real sender address gets rewritten during
2031verification (e.g. DNS widening), set the flag to stop it being rewritten again
2032during message reception.
2033
2034A list of verified "sender" addresses is kept to try to avoid doing to much
2035work repetitively when there are multiple recipients in a message and they all
2036require sender verification. However, when callouts are involved, it gets too
2037complicated because different recipients may require different callout options.
2038Therefore, we always do a full sender verify when any kind of callout is
2039specified. Caching elsewhere, for instance in the DNS resolver and in the
2040callout handling, should ensure that this is not terribly inefficient. */
2041
2042else if (verify_sender_address != NULL)
2043 {
2044 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2045 != 0)
2046 {
2047 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2048 "sender verify callout";
2049 return ERROR;
2050 }
2051
2052 sender_vaddr = verify_checked_sender(verify_sender_address);
2053 if (sender_vaddr != NULL && /* Previously checked */
2054 callout <= 0) /* No callout needed this time */
2055 {
2056 /* If the "routed" flag is set, it means that routing worked before, so
2057 this check can give OK (the saved return code value, if set, belongs to a
2058 callout that was done previously). If the "routed" flag is not set, routing
2059 must have failed, so we use the saved return code. */
2060
2061 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2062 {
2063 rc = sender_vaddr->special_action;
2064 *basic_errno = sender_vaddr->basic_errno;
2065 }
2066 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2067 }
2068
2069 /* Do a new verification, and cache the result. The cache is used to avoid
2070 verifying the sender multiple times for multiple RCPTs when callouts are not
2071 specified (see comments above).
2072
2073 The cache is also used on failure to give details in response to the first
2074 RCPT that gets bounced for this reason. However, this can be suppressed by
2075 the no_details option, which sets the flag that says "this detail has already
2076 been sent". The cache normally contains just one address, but there may be
2077 more in esoteric circumstances. */
2078
2079 else
2080 {
2081 BOOL routed = TRUE;
2a3eea10 2082 uschar *save_address_data = deliver_address_data;
8e669ac1 2083
059ec3d9
PH
2084 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2085 if (no_details) setflag(sender_vaddr, af_sverify_told);
2086 if (verify_sender_address[0] != 0)
2087 {
2088 /* If this is the real sender address, save the unrewritten version
2089 for use later in receive. Otherwise, set a flag so that rewriting the
2090 sender in verify_address() does not update sender_address. */
2091
2092 if (verify_sender_address == sender_address)
2093 sender_address_unrewritten = sender_address;
2094 else
2095 verify_options |= vopt_fake_sender;
2096
eafd343b
TK
2097 if (success_on_redirect)
2098 verify_options |= vopt_success_on_redirect;
2099
059ec3d9
PH
2100 /* The recipient, qualify, and expn options are never set in
2101 verify_options. */
2102
2103 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2104 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
2105
2106 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2107
2108 if (rc == OK)
2109 {
2110 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2111 {
2112 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2113 verify_sender_address, sender_vaddr->address);
2114 }
2115 else
2116 {
2117 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2118 verify_sender_address);
2119 }
2120 }
2121 else *basic_errno = sender_vaddr->basic_errno;
2122 }
2123 else rc = OK; /* Null sender */
2124
2125 /* Cache the result code */
2126
2127 if (routed) setflag(sender_vaddr, af_verify_routed);
2128 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2129 sender_vaddr->special_action = rc;
2130 sender_vaddr->next = sender_verified_list;
2131 sender_verified_list = sender_vaddr;
8e669ac1
PH
2132
2133 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2134 the sender verification. */
8e669ac1 2135
2a3eea10 2136 deliver_address_data = save_address_data;
059ec3d9 2137 }
8e669ac1 2138
2a3eea10
PH
2139 /* Put the sender address_data value into $sender_address_data */
2140
8e669ac1 2141 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH
2142 }
2143
2144/* A recipient address just gets a straightforward verify; again we must handle
2145the DEFER overrides. */
2146
2147else
2148 {
2149 address_item addr2;
2150
eafd343b
TK
2151 if (success_on_redirect)
2152 verify_options |= vopt_success_on_redirect;
2153
059ec3d9
PH
2154 /* We must use a copy of the address for verification, because it might
2155 get rewritten. */
2156
2157 addr2 = *addr;
2158 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2159 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2160 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2161
42855d71 2162 *basic_errno = addr2.basic_errno;
059ec3d9 2163 *log_msgptr = addr2.message;
8e669ac1 2164 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2165 addr2.user_message : addr2.message;
42855d71
PH
2166
2167 /* Allow details for temporary error if the address is so flagged. */
2168 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
2169
2170 /* Make $address_data visible */
2171 deliver_address_data = addr2.p.address_data;
2172 }
2173
2174/* We have a result from the relevant test. Handle defer overrides first. */
2175
2176if (rc == DEFER && (defer_ok ||
2177 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2178 {
2179 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2180 defer_ok? "defer_ok" : "callout_defer_ok");
2181 rc = OK;
2182 }
2183
2184/* If we've failed a sender, set up a recipient message, and point
2185sender_verified_failed to the address item that actually failed. */
2186
2187if (rc != OK && verify_sender_address != NULL)
2188 {
2189 if (rc != DEFER)
2190 {
2191 *log_msgptr = *user_msgptr = US"Sender verify failed";
2192 }
2193 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2194 {
2195 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2196 }
2197 else
2198 {
2199 *log_msgptr = US"Could not complete sender verify callout";
2200 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2201 *log_msgptr;
2202 }
2203
2204 sender_verified_failed = sender_vaddr;
2205 }
2206
2207/* Verifying an address messes up the values of $domain and $local_part,
2208so reset them before returning if this is a RCPT ACL. */
2209
2210if (addr != NULL)
2211 {
2212 deliver_domain = addr->domain;
2213 deliver_localpart = addr->local_part;
2214 }
2215return rc;
2216
2217/* Syntax errors in the verify argument come here. */
2218
2219BAD_VERIFY:
2220*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2221 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2222 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2223 "\"verify %s\"", arg);
2224return ERROR;
2225}
2226
2227
2228
2229
2230/*************************************************
2231* Check argument for control= modifier *
2232*************************************************/
2233
2234/* Called from acl_check_condition() below
2235
2236Arguments:
2237 arg the argument string for control=
2238 pptr set to point to the terminating character
2239 where which ACL we are in
2240 log_msgptr for error messages
2241
2242Returns: CONTROL_xxx value
2243*/
2244
2245static int
2246decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2247{
2248int len;
2249control_def *d;
2250
2251for (d = controls_list;
2252 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2253 d++)
2254 {
2255 len = Ustrlen(d->name);
2256 if (Ustrncmp(d->name, arg, len) == 0) break;
2257 }
2258
2259if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2260 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2261 {
2262 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2263 return CONTROL_ERROR;
2264 }
2265
059ec3d9
PH
2266*pptr = arg + len;
2267return d->value;
2268}
2269
2270
2271
c99ce5c9
TF
2272
2273/*************************************************
2274* Return a ratelimit error *
2275*************************************************/
2276
2277/* Called from acl_ratelimit() below
2278
2279Arguments:
2280 log_msgptr for error messages
2281 format format string
2282 ... supplementary arguments
2283 ss ratelimit option name
2284 where ACL_WHERE_xxxx indicating which ACL this is
2285
2286Returns: ERROR
2287*/
2288
2289static int
2290ratelimit_error(uschar **log_msgptr, const char *format, ...)
2291{
2292va_list ap;
2293uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2294va_start(ap, format);
2295if (!string_vformat(buffer, sizeof(buffer), format, ap))
2296 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2297 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2298va_end(ap);
2299*log_msgptr = string_sprintf(
2300 "error in arguments to \"ratelimit\" condition: %s", buffer);
2301return ERROR;
2302}
2303
2304
2305
2306
059ec3d9 2307/*************************************************
870f6ba8
TF
2308* Handle rate limiting *
2309*************************************************/
2310
2311/* Called by acl_check_condition() below to calculate the result
2312of the ACL ratelimit condition.
2313
2314Note that the return value might be slightly unexpected: if the
2315sender's rate is above the limit then the result is OK. This is
2316similar to the dnslists condition, and is so that you can write
2317ACL clauses like: defer ratelimit = 15 / 1h
2318
2319Arguments:
2320 arg the option string for ratelimit=
90fc3069 2321 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2322 log_msgptr for error messages
2323
2324Returns: OK - Sender's rate is above limit
2325 FAIL - Sender's rate is below limit
2326 DEFER - Problem opening ratelimit database
2327 ERROR - Syntax error in options.
2328*/
2329
2330static int
90fc3069 2331acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2332{
c99ce5c9 2333double limit, period, count;
8f240103
PH
2334uschar *ss;
2335uschar *key = NULL;
c99ce5c9 2336uschar *unique = NULL;
870f6ba8 2337int sep = '/';
c99ce5c9
TF
2338BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2339BOOL noupdate = FALSE, badacl = FALSE;
2340int mode = RATE_PER_WHAT;
870f6ba8
TF
2341int old_pool, rc;
2342tree_node **anchor, *t;
2343open_db dbblock, *dbm;
c99ce5c9 2344int dbdb_size;
870f6ba8 2345dbdata_ratelimit *dbd;
c99ce5c9 2346dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2347struct timeval tv;
2348
2349/* Parse the first two options and record their values in expansion
2350variables. These variables allow the configuration to have informative
2351error messages based on rate limits obtained from a table lookup. */
2352
c99ce5c9 2353/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2354size, which must be greater than or equal to zero. Zero is useful for
2355rate measurement as opposed to rate limiting. */
2356
2357sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2358if (sender_rate_limit == NULL)
288644dd 2359 {
870f6ba8 2360 limit = -1.0;
288644dd
JH
2361 ss = NULL; /* compiler quietening */
2362 }
870f6ba8
TF
2363else
2364 {
2365 limit = Ustrtod(sender_rate_limit, &ss);
2366 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2367 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2368 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2369 }
c99ce5c9
TF
2370if (limit < 0.0 || *ss != '\0')
2371 return ratelimit_error(log_msgptr,
2372 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2373
c99ce5c9 2374/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2375constant. This must be strictly greater than zero, because zero leads to
2376run-time division errors. */
2377
2378sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2379if (sender_rate_period == NULL) period = -1.0;
2380else period = readconf_readtime(sender_rate_period, 0, FALSE);
2381if (period <= 0.0)
c99ce5c9
TF
2382 return ratelimit_error(log_msgptr,
2383 "\"%s\" is not a time value", sender_rate_period);
2384
2385/* By default we are counting one of something, but the per_rcpt,
2386per_byte, and count options can change this. */
2387
2388count = 1.0;
870f6ba8 2389
c99ce5c9 2390/* Parse the other options. */
870f6ba8
TF
2391
2392while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2393 != NULL)
2394 {
2395 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2396 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2397 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2398 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2399 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2400 else if (strcmpic(ss, US"per_conn") == 0)
2401 {
2402 RATE_SET(mode, PER_CONN);
2403 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2404 badacl = TRUE;
2405 }
2406 else if (strcmpic(ss, US"per_mail") == 0)
2407 {
2408 RATE_SET(mode, PER_MAIL);
2409 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2410 }
2411 else if (strcmpic(ss, US"per_rcpt") == 0)
2412 {
2413 /* If we are running in the RCPT ACL, then we'll count the recipients
2414 one by one, but if we are running when we have accumulated the whole
2415 list then we'll add them all in one batch. */
2416 if (where == ACL_WHERE_RCPT)
2417 RATE_SET(mode, PER_RCPT);
2418 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2419 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2420 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2421 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2422 }
2423 else if (strcmpic(ss, US"per_byte") == 0)
2424 {
2425 /* If we have not yet received the message data and there was no SIZE
2426 declaration on the MAIL comand, then it's safe to just use a value of
2427 zero and let the recorded rate decay as if nothing happened. */
2428 RATE_SET(mode, PER_MAIL);
2429 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2430 else count = message_size < 0 ? 0.0 : (double)message_size;
2431 }
2432 else if (strcmpic(ss, US"per_addr") == 0)
2433 {
2434 RATE_SET(mode, PER_RCPT);
438257ba 2435 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF
2436 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2437 }
2438 else if (strncmpic(ss, US"count=", 6) == 0)
2439 {
2440 uschar *e;
2441 count = Ustrtod(ss+6, &e);
2442 if (count < 0.0 || *e != '\0')
2443 return ratelimit_error(log_msgptr,
2444 "\"%s\" is not a positive number", ss);
2445 }
2446 else if (strncmpic(ss, US"unique=", 7) == 0)
2447 unique = string_copy(ss + 7);
2448 else if (key == NULL)
2449 key = string_copy(ss);
2450 else
2451 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2452 }
2453
c99ce5c9
TF
2454/* Sanity check. When the badacl flag is set the update mode must either
2455be readonly (which is the default if it is omitted) or, for backwards
2456compatibility, a combination of noupdate and strict or leaky. */
2457
2458if (mode == RATE_PER_CLASH)
2459 return ratelimit_error(log_msgptr, "conflicting per_* options");
2460if (leaky + strict + readonly > 1)
2461 return ratelimit_error(log_msgptr, "conflicting update modes");
2462if (badacl && (leaky || strict) && !noupdate)
2463 return ratelimit_error(log_msgptr,
2464 "\"%s\" must not have /leaky or /strict option in %s ACL",
2465 ratelimit_option_string[mode], acl_wherenames[where]);
2466
2467/* Set the default values of any unset options. In readonly mode we
2468perform the rate computation without any increment so that its value
2469decays to eventually allow over-limit senders through. */
2470
2471if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2472if (badacl) readonly = TRUE;
2473if (readonly) count = 0.0;
2474if (!strict && !readonly) leaky = TRUE;
2475if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2476
8f240103
PH
2477/* Create the lookup key. If there is no explicit key, use sender_host_address.
2478If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2479omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2480are added to the key because they alter the meaning of the stored data. */
2481
2482if (key == NULL)
2483 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2484
c99ce5c9 2485key = string_sprintf("%s/%s/%s%s",
8f240103 2486 sender_rate_period,
c99ce5c9
TF
2487 ratelimit_option_string[mode],
2488 unique == NULL ? "" : "unique/",
8f240103 2489 key);
870f6ba8 2490
c99ce5c9
TF
2491HDEBUG(D_acl)
2492 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2493
8f240103
PH
2494/* See if we have already computed the rate by looking in the relevant tree.
2495For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2496pool so that they survive across resets. In readonly mode we only remember the
2497result for the rest of this command in case a later command changes it. After
2498this bit of logic the code is independent of the per_* mode. */
870f6ba8 2499
870f6ba8
TF
2500old_pool = store_pool;
2501
c99ce5c9
TF
2502if (readonly)
2503 anchor = &ratelimiters_cmd;
2504else switch(mode) {
2505case RATE_PER_CONN:
870f6ba8
TF
2506 anchor = &ratelimiters_conn;
2507 store_pool = POOL_PERM;
c99ce5c9
TF
2508 break;
2509case RATE_PER_BYTE:
2510case RATE_PER_MAIL:
2511case RATE_PER_ALLRCPTS:
870f6ba8 2512 anchor = &ratelimiters_mail;
c99ce5c9
TF
2513 break;
2514case RATE_PER_ADDR:
2515case RATE_PER_CMD:
2516case RATE_PER_RCPT:
fe0dab11 2517 anchor = &ratelimiters_cmd;
c99ce5c9
TF
2518 break;
2519default:
3399bb60 2520 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF
2521 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2522 "internal ACL error: unknown ratelimit mode %d", mode);
2523 break;
2524}
870f6ba8 2525
c99ce5c9
TF
2526t = tree_search(*anchor, key);
2527if (t != NULL)
870f6ba8
TF
2528 {
2529 dbd = t->data.ptr;
2530 /* The following few lines duplicate some of the code below. */
8f240103 2531 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2532 store_pool = old_pool;
2533 sender_rate = string_sprintf("%.1f", dbd->rate);
2534 HDEBUG(D_acl)
2535 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2536 return rc;
2537 }
2538
c99ce5c9
TF
2539/* We aren't using a pre-computed rate, so get a previously recorded rate
2540from the database, which will be updated and written back if required. */
870f6ba8
TF
2541
2542dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2543if (dbm == NULL)
2544 {
2545 store_pool = old_pool;
2546 sender_rate = NULL;
2547 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2548 *log_msgptr = US"ratelimit database not available";
2549 return DEFER;
2550 }
c99ce5c9
TF
2551dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2552dbd = NULL;
870f6ba8
TF
2553
2554gettimeofday(&tv, NULL);
2555
c99ce5c9
TF
2556if (dbdb != NULL)
2557 {
2558 /* Locate the basic ratelimit block inside the DB data. */
2559 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2560 dbd = &dbdb->dbd;
2561
2562 /* Forget the old Bloom filter if it is too old, so that we count each
2563 repeating event once per period. We don't simply clear and re-use the old
2564 filter because we want its size to change if the limit changes. Note that
2565 we keep the dbd pointer for copying the rate into the new data block. */
2566
2567 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2568 {
2569 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2570 dbdb = NULL;
2571 }
2572
2573 /* Sanity check. */
2574
2575 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2576 {
2577 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2578 dbdb = NULL;
2579 }
2580 }
2581
2582/* Allocate a new data block if the database lookup failed
2583or the Bloom filter passed its age limit. */
2584
2585if (dbdb == NULL)
2586 {
2587 if (unique == NULL)
2588 {
2589 /* No Bloom filter. This basic ratelimit block is initialized below. */
2590 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2591 dbdb_size = sizeof(*dbd);
2592 dbdb = store_get(dbdb_size);
2593 }
2594 else
2595 {
2596 int extra;
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2598
2599 /* See the long comment below for an explanation of the magic number 2.
2600 The filter has a minimum size in case the rate limit is very small;
2601 this is determined by the definition of dbdata_ratelimit_unique. */
2602
2603 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2604 if (extra < 0) extra = 0;
2605 dbdb_size = sizeof(*dbdb) + extra;
2606 dbdb = store_get(dbdb_size);
2607 dbdb->bloom_epoch = tv.tv_sec;
2608 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2609 memset(dbdb->bloom, 0, dbdb->bloom_size);
2610
2611 /* Preserve any basic ratelimit data (which is our longer-term memory)
2612 by copying it from the discarded block. */
2613
2614 if (dbd != NULL)
2615 {
2616 dbdb->dbd = *dbd;
2617 dbd = &dbdb->dbd;
2618 }
2619 }
2620 }
2621
2622/* If we are counting unique events, find out if this event is new or not.
2623If the client repeats the event during the current period then it should be
2624counted. We skip this code in readonly mode for efficiency, because any
2625changes to the filter will be discarded and because count is already set to
2626zero. */
2627
2628if (unique != NULL && !readonly)
2629 {
2630 /* We identify unique events using a Bloom filter. (You can find my
2631 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2632 With the per_addr option, an "event" is a recipient address, though the
2633 user can use the unique option to define their own events. We only count
2634 an event if we have not seen it before.
2635
2636 We size the filter according to the rate limit, which (in leaky mode)
2637 is the limit on the population of the filter. We allow 16 bits of space
2638 per entry (see the construction code above) and we set (up to) 8 of them
2639 when inserting an element (see the loop below). The probability of a false
2640 positive (an event we have not seen before but which we fail to count) is
2641
2642 size = limit * 16
2643 numhash = 8
2644 allzero = exp(-numhash * pop / size)
2645 = exp(-0.5 * pop / limit)
2646 fpr = pow(1 - allzero, numhash)
2647
2648 For senders at the limit the fpr is 0.06% or 1 in 1700
2649 and for senders at half the limit it is 0.0006% or 1 in 170000
2650
2651 In strict mode the Bloom filter can fill up beyond the normal limit, in
2652 which case the false positive rate will rise. This means that the
2653 measured rate for very fast senders can bogusly drop off after a while.
2654
2655 At twice the limit, the fpr is 2.5% or 1 in 40
2656 At four times the limit, it is 31% or 1 in 3.2
2657
2658 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2659 decay below the limit, and if this is more than one then the Bloom filter
2660 will be discarded before the decay gets that far. The false positive rate
2661 at this threshold is 9.3% or 1 in 10.7. */
2662
2663 BOOL seen;
2664 unsigned n, hash, hinc;
2665 uschar md5sum[16];
2666 md5 md5info;
2667
2668 /* Instead of using eight independent hash values, we combine two values
2669 using the formula h1 + n * h2. This does not harm the Bloom filter's
2670 performance, and means the amount of hash we need is independent of the
2671 number of bits we set in the filter. */
2672
2673 md5_start(&md5info);
2674 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2675 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2676 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2677
2678 /* Scan the bits corresponding to this event. A zero bit means we have
2679 not seen it before. Ensure all bits are set to record this event. */
2680
2681 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2682
2683 seen = TRUE;
2684 for (n = 0; n < 8; n++, hash += hinc)
2685 {
2686 int bit = 1 << (hash % 8);
2687 int byte = (hash / 8) % dbdb->bloom_size;
2688 if ((dbdb->bloom[byte] & bit) == 0)
2689 {
2690 dbdb->bloom[byte] |= bit;
2691 seen = FALSE;
2692 }
2693 }
2694
2695 /* If this event has occurred before, do not count it. */
2696
2697 if (seen)
2698 {
2699 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2700 count = 0.0;
2701 }
2702 else
2703 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2704 }
2705
2706/* If there was no previous ratelimit data block for this key, initialize
2707the new one, otherwise update the block from the database. The initial rate
2708is what would be computed by the code below for an infinite interval. */
2709
870f6ba8
TF
2710if (dbd == NULL)
2711 {
c99ce5c9
TF
2712 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2713 dbd = &dbdb->dbd;
870f6ba8
TF
2714 dbd->time_stamp = tv.tv_sec;
2715 dbd->time_usec = tv.tv_usec;
c99ce5c9 2716 dbd->rate = count;
870f6ba8
TF
2717 }
2718else
2719 {
2720 /* The smoothed rate is computed using an exponentially weighted moving
2721 average adjusted for variable sampling intervals. The standard EWMA for
2722 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2723 where f() is the measured value and f'() is the smoothed value.
2724
2725 Old data decays out of the smoothed value exponentially, such that data n
2726 samples old is multiplied by a^n. The exponential decay time constant p
2727 is defined such that data p samples old is multiplied by 1/e, which means
2728 that a = exp(-1/p). We can maintain the same time constant for a variable
2729 sampling interval i by using a = exp(-i/p).
2730
2731 The rate we are measuring is messages per period, suitable for directly
2732 comparing with the limit. The average rate between now and the previous
2733 message is period / interval, which we feed into the EWMA as the sample.
2734
2735 It turns out that the number of messages required for the smoothed rate
2736 to reach the limit when they are sent in a burst is equal to the limit.
2737 This can be seen by analysing the value of the smoothed rate after N
2738 messages sent at even intervals. Let k = (1 - a) * p/i
2739
2740 rate_1 = (1 - a) * p/i + a * rate_0
2741 = k + a * rate_0
2742 rate_2 = k + a * rate_1
2743 = k + a * k + a^2 * rate_0
2744 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2745 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2746 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2747 = rate_0 * a^N + p/i * (1 - a^N)
2748
2749 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2750
2751 rate_N = p/i + (rate_0 - p/i) * a^N
2752 a^N = (rate_N - p/i) / (rate_0 - p/i)
2753 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2754 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2755
2756 Numerical analysis of the above equation, setting the computed rate to
2757 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2758 rates, p/i, the number of messages N = limit. So limit serves as both the
2759 maximum rate measured in messages per period, and the maximum number of
2760 messages that can be sent in a fast burst. */
2761
2762 double this_time = (double)tv.tv_sec
2763 + (double)tv.tv_usec / 1000000.0;
2764 double prev_time = (double)dbd->time_stamp
2765 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2766
2767 /* We must avoid division by zero, and deal gracefully with the clock going
2768 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2769 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2770
e5d5a95f
TF
2771 double interval = this_time - prev_time <= 0.0 ? 1e-9
2772 : this_time - prev_time;
2773
2774 double i_over_p = interval / period;
2775 double a = exp(-i_over_p);
870f6ba8 2776
c99ce5c9
TF
2777 /* Combine the instantaneous rate (period / interval) with the previous rate
2778 using the smoothing factor a. In order to measure sized events, multiply the
2779 instantaneous rate by the count of bytes or recipients etc. */
2780
870f6ba8
TF
2781 dbd->time_stamp = tv.tv_sec;
2782 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2783 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2784
2785 /* When events are very widely spaced the computed rate tends towards zero.
2786 Although this is accurate it turns out not to be useful for our purposes,
2787 especially when the first event after a long silence is the start of a spam
2788 run. A more useful model is that the rate for an isolated event should be the
2789 size of the event per the period size, ignoring the lack of events outside
2790 the current period and regardless of where the event falls in the period. So,
2791 if the interval was so long that the calculated rate is unhelpfully small, we
2792 re-intialize the rate. In the absence of higher-rate bursts, the condition
2793 below is true if the interval is greater than the period. */
2794
2795 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2796 }
2797
c99ce5c9
TF
2798/* Clients sending at the limit are considered to be over the limit.
2799This matters for edge cases such as a limit of zero, when the client
2800should be completely blocked. */
3348576f 2801
8f240103 2802rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2803
2804/* Update the state if the rate is low or if we are being strict. If we
2805are in leaky mode and the sender's rate is too high, we do not update
2806the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2807rate preventing them from getting any email through. If readonly is set,
2808neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2809
c99ce5c9 2810if ((rc == FAIL && leaky) || strict)
8f240103 2811 {
c99ce5c9 2812 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH
2813 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2814 }
2815else
2816 {
2817 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2818 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2819 }
2820
870f6ba8
TF
2821dbfn_close(dbm);
2822
c99ce5c9 2823/* Store the result in the tree for future reference. */
870f6ba8 2824
c99ce5c9
TF
2825t = store_get(sizeof(tree_node) + Ustrlen(key));
2826t->data.ptr = dbd;
2827Ustrcpy(t->name, key);
2828(void)tree_insertnode(anchor, t);
870f6ba8
TF
2829
2830/* We create the formatted version of the sender's rate very late in
2831order to ensure that it is done using the correct storage pool. */
2832
2833store_pool = old_pool;
2834sender_rate = string_sprintf("%.1f", dbd->rate);
2835
2836HDEBUG(D_acl)
2837 debug_printf("ratelimit computed rate %s\n", sender_rate);
2838
2839return rc;
2840}
2841
2842
2843
2844/*************************************************
b0019c78
TF
2845* The udpsend ACL modifier *
2846*************************************************/
2847
2848/* Called by acl_check_condition() below.
2849
2850Arguments:
2851 arg the option string for udpsend=
2852 log_msgptr for error messages
2853
2854Returns: OK - Completed.
2855 DEFER - Problem with DNS lookup.
2856 ERROR - Syntax error in options.
2857*/
2858
2859static int
2860acl_udpsend(uschar *arg, uschar **log_msgptr)
2861{
2862int sep = 0;
2863uschar *hostname;
2864uschar *portstr;
2865uschar *portend;
2866host_item *h;
2867int portnum;
b0019c78
TF
2868int len;
2869int r, s;
b1f8e4f8 2870uschar * errstr;
b0019c78
TF
2871
2872hostname = string_nextinlist(&arg, &sep, NULL, 0);
2873portstr = string_nextinlist(&arg, &sep, NULL, 0);
2874
2875if (hostname == NULL)
2876 {
217b0e56 2877 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2878 return ERROR;
2879 }
2880if (portstr == NULL)
2881 {
217b0e56 2882 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2883 return ERROR;
2884 }
2885if (arg == NULL)
2886 {
217b0e56 2887 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2888 return ERROR;
2889 }
2890portnum = Ustrtol(portstr, &portend, 10);
2891if (*portend != '\0')
2892 {
217b0e56 2893 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2894 return ERROR;
2895 }
2896
2897/* Make a single-item host list. */
2898h = store_get(sizeof(host_item));
2899memset(h, 0, sizeof(host_item));
2900h->name = hostname;
2901h->port = portnum;
2902h->mx = MX_NONE;
2903
2904if (string_is_ip_address(hostname, NULL))
2905 h->address = hostname, r = HOST_FOUND;
2906else
2907 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2908if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2909 {
217b0e56 2910 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2911 return DEFER;
2912 }
2913
2914HDEBUG(D_acl)
2915 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2916
b1f8e4f8
JH
2917r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2918 1, NULL, &errstr);
b0019c78 2919if (r < 0) goto defer;
27f9999e 2920len = Ustrlen(arg);
9cb1785a 2921r = send(s, arg, len, 0);
b1f8e4f8
JH
2922if (r < 0)
2923 {
2924 errstr = US strerror(errno);
2925 close(s);
2926 goto defer;
2927 }
2928close(s);
b0019c78
TF
2929if (r < len)
2930 {
2931 *log_msgptr =
2932 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2933 return DEFER;
2934 }
2935
2936HDEBUG(D_acl)
2937 debug_printf("udpsend %d bytes\n", r);
2938
2939return OK;
2940
2941defer:
b1f8e4f8 2942*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2943return DEFER;
2944}
2945
2946
2947
2948/*************************************************
059ec3d9
PH
2949* Handle conditions/modifiers on an ACL item *
2950*************************************************/
2951
2952/* Called from acl_check() below.
2953
2954Arguments:
2955 verb ACL verb
2956 cb ACL condition block - if NULL, result is OK
2957 where where called from
2958 addr the address being checked for RCPT, or NULL
2959 level the nesting level
2960 epp pointer to pass back TRUE if "endpass" encountered
2961 (applies only to "accept" and "discard")
2962 user_msgptr user message pointer
2963 log_msgptr log message pointer
2964 basic_errno pointer to where to put verify error
2965
2966Returns: OK - all conditions are met
2967 DISCARD - an "acl" condition returned DISCARD - only allowed
2968 for "accept" or "discard" verbs
2969 FAIL - at least one condition fails
2970 FAIL_DROP - an "acl" condition returned FAIL_DROP
2971 DEFER - can't tell at the moment (typically, lookup defer,
2972 but can be temporary callout problem)
2973 ERROR - ERROR from nested ACL or expansion failure or other
2974 error
2975*/
2976
2977static int
2978acl_check_condition(int verb, acl_condition_block *cb, int where,
2979 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2980 uschar **log_msgptr, int *basic_errno)
2981{
2982uschar *user_message = NULL;
2983uschar *log_message = NULL;
ed7f7860
PP
2984uschar *debug_tag = NULL;
2985uschar *debug_opts = NULL;
91ecef39 2986uschar *p = NULL;
059ec3d9 2987int rc = OK;
8523533c 2988#ifdef WITH_CONTENT_SCAN
0f0c8159 2989int sep = -'/';
8523533c 2990#endif
059ec3d9
PH
2991
2992for (; cb != NULL; cb = cb->next)
2993 {
2994 uschar *arg;
8e669ac1 2995 int control_type;
059ec3d9
PH
2996
2997 /* The message and log_message items set up messages to be used in
2998 case of rejection. They are expanded later. */
2999
3000 if (cb->type == ACLC_MESSAGE)
3001 {
187bc588 3002 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH
3003 user_message = cb->arg;
3004 continue;
3005 }
3006
3007 if (cb->type == ACLC_LOG_MESSAGE)
3008 {
187bc588 3009 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH
3010 log_message = cb->arg;
3011 continue;
3012 }
3013
3014 /* The endpass "condition" just sets a flag to show it occurred. This is
3015 checked at compile time to be on an "accept" or "discard" item. */
3016
3017 if (cb->type == ACLC_ENDPASS)
3018 {
3019 *epp = TRUE;
3020 continue;
3021 }
3022
3023 /* For other conditions and modifiers, the argument is expanded now for some
3024 of them, but not for all, because expansion happens down in some lower level
3025 checking functions in some cases. */
3026
3027 if (cond_expand_at_top[cb->type])
3028 {
3029 arg = expand_string(cb->arg);
3030 if (arg == NULL)
3031 {
3032 if (expand_string_forcedfail) continue;
3033 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3034 cb->arg, expand_string_message);
3035 return search_find_defer? DEFER : ERROR;
3036 }
3037 }
3038 else arg = cb->arg;
3039
3040 /* Show condition, and expanded condition if it's different */
3041
3042 HDEBUG(D_acl)
3043 {
3044 int lhswidth = 0;
3045 debug_printf("check %s%s %n",
3046 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3047 conditions[cb->type], &lhswidth);
3048
3049 if (cb->type == ACLC_SET)
3050 {
38a0a95f
PH
3051 debug_printf("acl_%s ", cb->u.varname);
3052 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH
3053 }
3054
3055 debug_printf("= %s\n", cb->arg);
3056
3057 if (arg != cb->arg)
3058 debug_printf("%.*s= %s\n", lhswidth,
3059 US" ", CS arg);
3060 }
3061
3062 /* Check that this condition makes sense at this time */
3063
3064 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3065 {
3066 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3067 cond_modifiers[cb->type]? "use" : "test",
3068 conditions[cb->type], acl_wherenames[where]);
3069 return ERROR;
3070 }
3071
3072 /* Run the appropriate test for each condition, or take the appropriate
3073 action for the remaining modifiers. */
3074
3075 switch(cb->type)
3076 {
71fafd95
PH
3077 case ACLC_ADD_HEADER:
3078 setup_header(arg);
3079 break;
3080
059ec3d9
PH
3081 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3082 "discard" verb. */
71fafd95 3083
059ec3d9 3084 case ACLC_ACL:
f60d98e8 3085 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH
3086 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3087 {
3088 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3089 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3090 verbs[verb]);
3091 return ERROR;
3092 }
059ec3d9
PH
3093 break;
3094
3095 case ACLC_AUTHENTICATED:
3096 rc = (sender_host_authenticated == NULL)? FAIL :
3097 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3098 TRUE, NULL);
3099 break;
3100
71fafd95 3101 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
3102 case ACLC_BMI_OPTIN:
3103 {
3104 int old_pool = store_pool;
3105 store_pool = POOL_PERM;
3106 bmi_current_optin = string_copy(arg);
3107 store_pool = old_pool;
3108 }
3109 break;
71fafd95 3110 #endif
8523533c 3111
059ec3d9 3112 case ACLC_CONDITION:
f3766eb5
NM
3113 /* The true/false parsing here should be kept in sync with that used in
3114 expand.c when dealing with ECOND_BOOL so that we don't have too many
3115 different definitions of what can be a boolean. */
51c7471d
JH
3116 if (*arg == '-'
3117 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3118 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
3119 rc = (Uatoi(arg) == 0)? FAIL : OK;
3120 else
3121 rc = (strcmpic(arg, US"no") == 0 ||
3122 strcmpic(arg, US"false") == 0)? FAIL :
3123 (strcmpic(arg, US"yes") == 0 ||
3124 strcmpic(arg, US"true") == 0)? OK : DEFER;
3125 if (rc == DEFER)
3126 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3127 break;
3128
c3611384
PH
3129 case ACLC_CONTINUE: /* Always succeeds */
3130 break;
3131
059ec3d9 3132 case ACLC_CONTROL:
c5fcb476
PH
3133 control_type = decode_control(arg, &p, where, log_msgptr);
3134
8523533c 3135 /* Check if this control makes sense at this time */
c5fcb476
PH
3136
3137 if ((control_forbids[control_type] & (1 << where)) != 0)
3138 {
3139 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3140 controls[control_type], acl_wherenames[where]);
3141 return ERROR;
8e669ac1 3142 }
c5fcb476
PH
3143
3144 switch(control_type)
059ec3d9 3145 {
c46782ef
PH
3146 case CONTROL_AUTH_UNADVERTISED:
3147 allow_auth_unadvertised = TRUE;
3148 break;
3149
3150 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
3151 case CONTROL_BMI_RUN:
3152 bmi_run = 1;
3153 break;
c46782ef
PH
3154 #endif
3155
80a47a2c 3156 #ifndef DISABLE_DKIM
f7572e5a 3157 case CONTROL_DKIM_VERIFY:
80a47a2c 3158 dkim_disable_verify = TRUE;
4840604e
TL
3159 #ifdef EXPERIMENTAL_DMARC
3160 /* Since DKIM was blocked, skip DMARC too */
3161 dmarc_disable_verify = TRUE;
3162 dmarc_enable_forensic = FALSE;
3163 #endif
3164 break;
3165 #endif
3166
3167 #ifdef EXPERIMENTAL_DMARC
3168 case CONTROL_DMARC_VERIFY:
3169 dmarc_disable_verify = TRUE;
3170 break;
3171
3172 case CONTROL_DMARC_FORENSIC:
3173 dmarc_enable_forensic = TRUE;
f7572e5a
TK
3174 break;
3175 #endif
3176
13363eba
PP
3177 case CONTROL_DSCP:
3178 if (*p == '/')
3179 {
3180 int fd, af, level, optname, value;
3181 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3182 a socket; we can accept that, we'll just debug-log failures anyway. */
3183 fd = fileno(smtp_in);
3184 af = ip_get_address_family(fd);
3185 if (af < 0)
3186 {
3187 HDEBUG(D_acl)
3188 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3189 strerror(errno));
3190 break;
3191 }
3192 if (dscp_lookup(p+1, af, &level, &optname, &value))
3193 {
3194 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3195 {
3196 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3197 p+1, strerror(errno));
3198 }
3199 else
3200 {
3201 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3202 }
3203 }
3204 else
3205 {
3206 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3207 return ERROR;
3208 }
3209 }
3210 else
3211 {
3212 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3213 return ERROR;
3214 }
3215 break;
3216
059ec3d9
PH
3217 case CONTROL_ERROR:
3218 return ERROR;
3219
3220 case CONTROL_CASEFUL_LOCAL_PART:
3221 deliver_localpart = addr->cc_local_part;
3222 break;
3223
3224 case CONTROL_CASELOWER_LOCAL_PART:
3225 deliver_localpart = addr->lc_local_part;
3226 break;
3227
3228 case CONTROL_ENFORCE_SYNC:
3229 smtp_enforce_sync = TRUE;
3230 break;
3231
3232 case CONTROL_NO_ENFORCE_SYNC:
3233 smtp_enforce_sync = FALSE;
3234 break;
3235
c46782ef 3236 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3237 case CONTROL_NO_MBOX_UNSPOOL:
3238 no_mbox_unspool = TRUE;
3239 break;
c46782ef 3240 #endif
8523533c 3241
059ec3d9
PH
3242 case CONTROL_NO_MULTILINE:
3243 no_multiline_responses = TRUE;
3244 break;
3245
cf8b11a5
PH
3246 case CONTROL_NO_PIPELINING:
3247 pipelining_enable = FALSE;
3248 break;
3249
047bdd8c
PH
3250 case CONTROL_NO_DELAY_FLUSH:
3251 disable_delay_flush = TRUE;
3252 break;
3253
4c590bd1
PH
3254 case CONTROL_NO_CALLOUT_FLUSH:
3255 disable_callout_flush = TRUE;
3256 break;
3257
8523533c 3258 case CONTROL_FAKEREJECT:
9171d434
JH
3259 cancel_cutthrough_connection("fakereject");
3260 case CONTROL_FAKEDEFER:
29aba418 3261 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 3262 if (*p == '/')
8e669ac1 3263 {
8523533c 3264 uschar *pp = p + 1;
8e669ac1 3265 while (*pp != 0) pp++;
29aba418 3266 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK
3267 p = pp;
3268 }
3269 else
3270 {
3271 /* Explicitly reset to default string */
29aba418 3272 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK
3273 }
3274 break;
8523533c 3275
059ec3d9
PH
3276 case CONTROL_FREEZE:
3277 deliver_freeze = TRUE;
3278 deliver_frozen_at = time(NULL);
6a3f1455
PH
3279 freeze_tell = freeze_tell_config; /* Reset to configured value */
3280 if (Ustrncmp(p, "/no_tell", 8) == 0)
3281 {
3282 p += 8;
3283 freeze_tell = NULL;
3284 }
3285 if (*p != 0)
3286 {
3287 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3288 return ERROR;
3289 }
9171d434 3290 cancel_cutthrough_connection("item frozen");
059ec3d9
PH
3291 break;
3292
3293 case CONTROL_QUEUE_ONLY:
3294 queue_only_policy = TRUE;
9171d434 3295 cancel_cutthrough_connection("queueing forced");
059ec3d9
PH
3296 break;
3297
3298 case CONTROL_SUBMISSION:
87ba3f5f 3299 originator_name = US"";
059ec3d9 3300 submission_mode = TRUE;
69358f02 3301 while (*p == '/')
8e669ac1 3302 {
69358f02
PH
3303 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3304 {
3305 p += 14;
3306 active_local_sender_retain = TRUE;
8e669ac1
PH
3307 active_local_from_check = FALSE;
3308 }
69358f02
PH
3309 else if (Ustrncmp(p, "/domain=", 8) == 0)
3310 {
3311 uschar *pp = p + 8;
8e669ac1 3312 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH
3313 submission_domain = string_copyn(p+8, pp-p-8);
3314 p = pp;
3315 }
8857ccfd
PH
3316 /* The name= option must be last, because it swallows the rest of
3317 the string. */
87ba3f5f
PH
3318 else if (Ustrncmp(p, "/name=", 6) == 0)
3319 {
3320 uschar *pp = p + 6;
8857ccfd 3321 while (*pp != 0) pp++;
2fe1a124 3322 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 3323 big_buffer, big_buffer_size));
8e669ac1 3324 p = pp;
69358f02 3325 }
8e669ac1
PH
3326 else break;
3327 }
69358f02 3328 if (*p != 0)
059ec3d9 3329 {
69358f02 3330 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH
3331 return ERROR;
3332 }
3333 break;
8800895a 3334
ed7f7860
PP
3335 case CONTROL_DEBUG:
3336 while (*p == '/')
3337 {
3338 if (Ustrncmp(p, "/tag=", 5) == 0)
3339 {
3340 uschar *pp = p + 5;
3341 while (*pp != '\0' && *pp != '/') pp++;
3342 debug_tag = string_copyn(p+5, pp-p-5);
3343 p = pp;
3344 }
3345 else if (Ustrncmp(p, "/opts=", 6) == 0)
3346 {
3347 uschar *pp = p + 6;
3348 while (*pp != '\0' && *pp != '/') pp++;
3349 debug_opts = string_copyn(p+6, pp-p-6);
3350 p = pp;
3351 }
3352 }
3353 debug_logging_activate(debug_tag, debug_opts);
3354 break;
3355
8800895a
PH
3356 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3357 suppress_local_fixups = TRUE;
3358 break;
e4bdf652
JH
3359
3360 case CONTROL_CUTTHROUGH_DELIVERY:
5032d1cf
JH
3361 if (prdr_requested)
3362 /* Too hard to think about for now. We might in future cutthrough
3363 the case where both sides handle prdr and this-node prdr acl
3364 is "accept" */
3365 *log_msgptr = string_sprintf(US"PRDR on %s reception\n", arg);
9171d434
JH
3366 else
3367 {
5032d1cf
JH
3368 if (deliver_freeze)
3369 *log_msgptr = US"frozen";
3370 else if (queue_only_policy)
3371 *log_msgptr = US"queue-only";
3372 else if (fake_response == FAIL)
3373 *log_msgptr = US"fakereject";
3374 else
3375 {
3376 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3377 break;
3378 }
3379 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3380 arg, *log_msgptr);
9171d434 3381 }
9171d434 3382 return ERROR;
059ec3d9
PH
3383 }
3384 break;
3385
6a8f9482
TK
3386 #ifdef EXPERIMENTAL_DCC
3387 case ACLC_DCC:
3388 {
3389 /* Seperate the regular expression and any optional parameters. */
3390 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3391 /* Run the dcc backend. */
3392 rc = dcc_process(&ss);
3393 /* Modify return code based upon the existance of options. */
3394 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3395 != NULL) {
3396 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3397 {
3398 /* FAIL so that the message is passed to the next ACL */
3399 rc = FAIL;
3400 }
3401 }
3402 }
3403 break;
3404 #endif
3405
71fafd95 3406 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3407 case ACLC_DECODE:
3408 rc = mime_decode(&arg);
3409 break;
71fafd95 3410 #endif
8523533c 3411
059ec3d9
PH
3412 case ACLC_DELAY:
3413 {
3414 int delay = readconf_readtime(arg, 0, FALSE);
3415 if (delay < 0)
3416 {
3417 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3418 "modifier: \"%s\" is not a time value", arg);
3419 return ERROR;
3420 }
3421 else
3422 {
3423 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3424 delay);
3425 if (host_checking)
3426 {
3427 HDEBUG(D_acl)
3428 debug_printf("delay skipped in -bh checking mode\n");
3429 }
010c2d14
PH
3430
3431 /* It appears to be impossible to detect that a TCP/IP connection has
3432 gone away without reading from it. This means that we cannot shorten
3433 the delay below if the client goes away, because we cannot discover
3434 that the client has closed its end of the connection. (The connection
3435 is actually in a half-closed state, waiting for the server to close its
3436 end.) It would be nice to be able to detect this state, so that the
3437 Exim process is not held up unnecessarily. However, it seems that we
3438 can't. The poll() function does not do the right thing, and in any case
3439 it is not always available.
3440
047bdd8c 3441 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3442 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH
3443 Also, delays may be specified for non-SMTP input, where smtp_out and
3444 smtp_in will be NULL. Whatever is done must work in all cases.
3445
3446 NOTE 2: The added feature of flushing the output before a delay must
3447 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3448 */
010c2d14 3449
8e669ac1 3450 else
86b8287f 3451 {
14f4a80d 3452 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3453 while (delay > 0) delay = sleep(delay);
8e669ac1 3454 }
059ec3d9
PH
3455 }
3456 }
3457 break;
3458
71fafd95 3459 #ifdef WITH_OLD_DEMIME
8523533c
TK
3460 case ACLC_DEMIME:
3461 rc = demime(&arg);
3462 break;
71fafd95 3463 #endif
8523533c 3464
80a47a2c
TK
3465 #ifndef DISABLE_DKIM
3466 case ACLC_DKIM_SIGNER:
9e5d6b55
TK
3467 if (dkim_cur_signer != NULL)
3468 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3469 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3470 else
80a47a2c 3471 rc = FAIL;
71fafd95
PH
3472 break;
3473
80a47a2c
TK
3474 case ACLC_DKIM_STATUS:
3475 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3476 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3477 break;
3478 #endif
fb2274d4 3479
4840604e
TL
3480 #ifdef EXPERIMENTAL_DMARC
3481 case ACLC_DMARC_STATUS:
4a8ce2d8 3482 if (!dmarc_has_been_checked)
4840604e 3483 dmarc_process();
4a8ce2d8 3484 dmarc_has_been_checked = TRUE;
4840604e
TL
3485 /* used long way of dmarc_exim_expand_query() in case we need more
3486 * view into the process in the future. */
3487 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3488 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3489 break;
3490 #endif
3491
059ec3d9
PH
3492 case ACLC_DNSLISTS:
3493 rc = verify_check_dnsbl(&arg);
3494 break;
3495
3496 case ACLC_DOMAINS:
3497 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3498 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
3499 break;
3500
3501 /* The value in tls_cipher is the full cipher name, for example,
3502 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3503 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3504 what may in practice come out of the SSL library - which at the time of
3505 writing is poorly documented. */
3506
3507 case ACLC_ENCRYPTED:
817d9f57 3508 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3509 {
3510 uschar *endcipher = NULL;
817d9f57
JH
3511 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3512 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3513 {
3514 endcipher = Ustrchr(++cipher, ':');
3515 if (endcipher != NULL) *endcipher = 0;
3516 }
3517 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3518 if (endcipher != NULL) *endcipher = ':';
3519 }
3520 break;
3521
3522 /* Use verify_check_this_host() instead of verify_check_host() so that
3523 we can pass over &host_data to catch any looked up data. Once it has been
3524 set, it retains its value so that it's still there if another ACL verb
3525 comes through here and uses the cache. However, we must put it into
3526 permanent store in case it is also expected to be used in a subsequent
3527 message in the same SMTP connection. */
3528
3529 case ACLC_HOSTS:
3530 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3531 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
3532 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3533 break;
3534
3535 case ACLC_LOCAL_PARTS:
3536 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3537 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3538 &deliver_localpart_data);
3539 break;
3540
6ea85e9a
PH
3541 case ACLC_LOG_REJECT_TARGET:
3542 {
3543 int logbits = 0;
3544 int sep = 0;
3545 uschar *s = arg;
3546 uschar *ss;
3547 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3548 != NULL)
3549 {
3550 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3551 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3552 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3553 else
3554 {
3555 logbits |= LOG_MAIN|LOG_REJECT;
3556 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3557 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3558 }
3559 }
3560 log_reject_target = logbits;
3561 }
3562 break;
3563
059ec3d9
PH
3564 case ACLC_LOGWRITE:
3565 {
3566 int logbits = 0;
3567 uschar *s = arg;
3568 if (*s == ':')
3569 {
3570 s++;
3571 while (*s != ':')
3572 {
3573 if (Ustrncmp(s, "main", 4) == 0)
3574 { logbits |= LOG_MAIN; s += 4; }
3575 else if (Ustrncmp(s, "panic", 5) == 0)
3576 { logbits |= LOG_PANIC; s += 5; }
3577 else if (Ustrncmp(s, "reject", 6) == 0)
3578 { logbits |= LOG_REJECT; s += 6; }
3579 else
3580 {
3581 logbits = LOG_MAIN|LOG_PANIC;
3582 s = string_sprintf(":unknown log name in \"%s\" in "
3583 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3584 }
3585 if (*s == ',') s++;
3586 }
3587 s++;
3588 }
3589 while (isspace(*s)) s++;
6ea85e9a
PH
3590
3591
059ec3d9
PH
3592 if (logbits == 0) logbits = LOG_MAIN;
3593 log_write(0, logbits, "%s", string_printing(s));
3594 }
3595 break;
8e669ac1 3596
71fafd95 3597 #ifdef WITH_CONTENT_SCAN
0f0c8159 3598 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3599 {
6ea85e9a 3600 /* Separate the regular expression and any optional parameters. */
8523533c 3601 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
0f0c8159
JH
3602 uschar *opt;
3603 BOOL defer_ok = FALSE;
3604 int timeout = 0;
3605
3606 while ((opt = string_nextinlist(&arg, &sep, NULL, 0)))
3607 if (strcmpic(opt, US"defer_ok") == 0)
3608 defer_ok = TRUE;
3609 else if ( strncmpic(opt, US"tmo=", 4) == 0
3610 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3611 )
3612 {
3613 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3614 return ERROR;
3615 }
3616
3617 rc = malware(ss, timeout);
3618 if (rc == DEFER && defer_ok)
3619 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK
3620 }
3621 break;
3622
3623 case ACLC_MIME_REGEX:
71fafd95 3624 rc = mime_regex(&arg);
8523533c 3625 break;
71fafd95 3626 #endif
059ec3d9 3627
870f6ba8 3628 case ACLC_RATELIMIT:
90fc3069 3629 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF
3630 break;
3631
059ec3d9
PH
3632 case ACLC_RECIPIENTS:
3633 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3634 &recipient_data);
3635 break;
3636
71fafd95
PH
3637 #ifdef WITH_CONTENT_SCAN
3638 case ACLC_REGEX:
3639 rc = regex(&arg);
8523533c 3640 break;
71fafd95 3641 #endif
8523533c 3642
e7568d51
TL
3643 case ACLC_REMOVE_HEADER:
3644 setup_remove_header(arg);
3645 break;
3646
059ec3d9
PH
3647 case ACLC_SENDER_DOMAINS:
3648 {
3649 uschar *sdomain;
3650 sdomain = Ustrrchr(sender_address, '@');
3651 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3652 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3653 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3654 }
3655 break;
3656
3657 case ACLC_SENDERS:
3658 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
3659 sender_address_cache, -1, 0, &sender_data);
3660 break;
3661
3662 /* Connection variables must persist forever */
3663
3664 case ACLC_SET:
3665 {
3666 int old_pool = store_pool;
38a0a95f
PH
3667 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3668 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH
3669 store_pool = old_pool;
3670 }
3671 break;
3672
71fafd95 3673 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3674 case ACLC_SPAM:
3675 {
3676 /* Seperate the regular expression and any optional parameters. */
3677 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3678 /* Run the spam backend. */
3679 rc = spam(&ss);
3680 /* Modify return code based upon the existance of options. */
3681 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3682 != NULL) {
3683 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3684 {
3685 /* FAIL so that the message is passed to the next ACL */
3686 rc = FAIL;
3687 }
3688 }
3689 }
3690 break;
71fafd95 3691 #endif
8523533c 3692
71fafd95 3693 #ifdef EXPERIMENTAL_SPF
8523533c 3694 case ACLC_SPF:
65a7d8c3
NM
3695 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3696 break;
3697 case ACLC_SPF_GUESS:
3698 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3699 break;
71fafd95 3700 #endif
8523533c 3701
b0019c78
TF
3702 case ACLC_UDPSEND:
3703 rc = acl_udpsend(arg, log_msgptr);
3704 break;
3705
059ec3d9
PH
3706 /* If the verb is WARN, discard any user message from verification, because
3707 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH
3708 only from explicit "message" modifiers. However, put the user message into
3709 $acl_verify_message so it can be used in subsequent conditions or modifiers
3710 (until something changes it). */
059ec3d9
PH
3711
3712 case ACLC_VERIFY:
3713 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3714 acl_verify_message = *user_msgptr;
059ec3d9
PH
3715 if (verb == ACL_WARN) *user_msgptr = NULL;
3716 break;
3717
3718 default:
3719 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3720 "condition %d", cb->type);
3721 break;
3722 }
3723
3724 /* If a condition was negated, invert OK/FAIL. */
3725
3726 if (!cond_modifiers[cb->type] && cb->u.negated)
3727 {
3728 if (rc == OK) rc = FAIL;
3729 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3730 }
3731
3732 if (rc != OK) break; /* Conditions loop */
3733 }
3734
3735
3736/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH
3737handle the values of these modifiers. If there isn't a log message set, we make
3738it the same as the user message.
059ec3d9
PH
3739
3740"message" is a user message that will be included in an SMTP response. Unless
3741it is empty, it overrides any previously set user message.
3742