projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Use accessor functions for OpenSSL internal data
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef
PH		 183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
c46782ef 186 #endif
ed7f7860 187 CONTROL_DEBUG,
80a47a2c 188 #ifndef DISABLE_DKIM
f7572e5a
TK		 189 CONTROL_DKIM_VERIFY,
190 #endif
4840604e
TL		 191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH		 208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
cf8b11a5 211 CONTROL_NO_MULTILINE,
047bdd8c 212 CONTROL_NO_PIPELINING,
4c590bd1
PH		 213 CONTROL_NO_DELAY_FLUSH,
214 CONTROL_NO_CALLOUT_FLUSH
c46782ef 215};
9a26b6b2 216
8800895a
PH		 217/* ACL control names; keep in step with the table above! This list is used for
218turning ids into names. The actual list of recognized names is in the variable
219control_def controls_list[] below. The fact that there are two lists is a mess
220and should be tidied up. */
9a26b6b2
PH		 221
222static uschar *controls[] = {
c46782ef 223 US"allow_auth_unadvertised",
9a26b6b2
PH		 224 #ifdef EXPERIMENTAL_BRIGHTMAIL
225 US"bmi_run",
226 #endif
ed7f7860 227 US"debug",
80a47a2c
TK		 228 #ifndef DISABLE_DKIM
229 US"dkim_disable_verify",
f7572e5a 230 #endif
4840604e
TL		 231 #ifdef EXPERIMENTAL_DMARC
232 US"dmarc_disable_verify",
233 US"dmarc_enable_forensic",
234 #endif
13363eba 235 US"dscp",
c46782ef
PH		 236 US"error",
237 US"caseful_local_part",
238 US"caselower_local_part",
e4bdf652 239 US"cutthrough_delivery",
c46782ef
PH		 240 US"enforce_sync",
241 US"no_enforce_sync",
242 US"freeze",
243 US"queue_only",
244 US"submission",
245 US"suppress_local_fixups",
9a26b6b2
PH		 246 #ifdef WITH_CONTENT_SCAN
247 US"no_mbox_unspool",
248 #endif
cf8b11a5
PH		 249 US"fakedefer",
250 US"fakereject",
aa6dc513 251 US"no_multiline_responses",
cf8b11a5 252 US"no_pipelining",
4c590bd1
PH		 253 US"no_delay_flush",
254 US"no_callout_flush"
c46782ef 255};
059ec3d9 256
047bdd8c 257/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 258at the outer level. In the other cases, expansion already occurs in the
259checking functions. */
260
261static uschar cond_expand_at_top[] = {
7421ecab 262 FALSE, /* acl */
3e536984 263 TRUE, /* add_header */
059ec3d9 264 FALSE, /* authenticated */
8523533c
TK		 265#ifdef EXPERIMENTAL_BRIGHTMAIL
266 TRUE, /* bmi_optin */
8e669ac1 267#endif
059ec3d9 268 TRUE, /* condition */
c3611384 269 TRUE, /* continue */
059ec3d9 270 TRUE, /* control */
6a8f9482
TK		 271#ifdef EXPERIMENTAL_DCC
272 TRUE, /* dcc */
273#endif
8523533c
TK		 274#ifdef WITH_CONTENT_SCAN
275 TRUE, /* decode */
276#endif
059ec3d9 277 TRUE, /* delay */
8523533c
TK		 278#ifdef WITH_OLD_DEMIME
279 TRUE, /* demime */
fb2274d4 280#endif
80a47a2c
TK		 281#ifndef DISABLE_DKIM
282 TRUE, /* dkim_signers */
283 TRUE, /* dkim_status */
4840604e
TL		 284#endif
285#ifdef EXPERIMENTAL_DMARC
286 TRUE, /* dmarc_status */
8523533c 287#endif
059ec3d9
PH		 288 TRUE, /* dnslists */
289 FALSE, /* domains */
290 FALSE, /* encrypted */
291 TRUE, /* endpass */
292 FALSE, /* hosts */
293 FALSE, /* local_parts */
294 TRUE, /* log_message */
6ea85e9a 295 TRUE, /* log_reject_target */
059ec3d9 296 TRUE, /* logwrite */
8523533c
TK		 297#ifdef WITH_CONTENT_SCAN
298 TRUE, /* malware */
299#endif
059ec3d9 300 TRUE, /* message */
8523533c
TK		 301#ifdef WITH_CONTENT_SCAN
302 TRUE, /* mime_regex */
303#endif
870f6ba8 304 TRUE, /* ratelimit */
059ec3d9 305 FALSE, /* recipients */
8523533c
TK		 306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* regex */
308#endif
e7568d51 309 TRUE, /* remove_header */
059ec3d9
PH		 310 FALSE, /* sender_domains */
311 FALSE, /* senders */
312 TRUE, /* set */
8523533c
TK		 313#ifdef WITH_CONTENT_SCAN
314 TRUE, /* spam */
315#endif
316#ifdef EXPERIMENTAL_SPF
317 TRUE, /* spf */
65a7d8c3 318 TRUE, /* spf_guess */
8523533c 319#endif
b0019c78 320 TRUE, /* udpsend */
059ec3d9
PH		 321 TRUE /* verify */
322};
323
324/* Flags to identify the modifiers */
325
326static uschar cond_modifiers[] = {
327 FALSE, /* acl */
3e536984 328 TRUE, /* add_header */
059ec3d9 329 FALSE, /* authenticated */
8523533c
TK		 330#ifdef EXPERIMENTAL_BRIGHTMAIL
331 TRUE, /* bmi_optin */
8e669ac1 332#endif
059ec3d9 333 FALSE, /* condition */
c3611384 334 TRUE, /* continue */
059ec3d9 335 TRUE, /* control */
6a8f9482
TK		 336#ifdef EXPERIMENTAL_DCC
337 FALSE, /* dcc */
338#endif
8523533c
TK		 339#ifdef WITH_CONTENT_SCAN
340 FALSE, /* decode */
341#endif
059ec3d9 342 TRUE, /* delay */
8523533c
TK		 343#ifdef WITH_OLD_DEMIME
344 FALSE, /* demime */
fb2274d4 345#endif
80a47a2c
TK		 346#ifndef DISABLE_DKIM
347 FALSE, /* dkim_signers */
348 FALSE, /* dkim_status */
4840604e
TL		 349#endif
350#ifdef EXPERIMENTAL_DMARC
351 FALSE, /* dmarc_status */
8523533c 352#endif
059ec3d9
PH		 353 FALSE, /* dnslists */
354 FALSE, /* domains */
355 FALSE, /* encrypted */
356 TRUE, /* endpass */
357 FALSE, /* hosts */
358 FALSE, /* local_parts */
359 TRUE, /* log_message */
6ea85e9a 360 TRUE, /* log_reject_target */
8523533c
TK		 361 TRUE, /* logwrite */
362#ifdef WITH_CONTENT_SCAN
363 FALSE, /* malware */
364#endif
059ec3d9 365 TRUE, /* message */
8523533c
TK		 366#ifdef WITH_CONTENT_SCAN
367 FALSE, /* mime_regex */
368#endif
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK		 371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH		 375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK		 378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH		 386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH		 393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH		 401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH		 407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH		 416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH		 427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK		 434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
71fafd95 450 #ifdef WITH_OLD_DEMIME
2f079f46 451 (unsigned int)
fd98a5c6 452 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 453 #ifndef DISABLE_PRDR
fd98a5c6 454 (1<<ACL_WHERE_PRDR)|
8ccd00b1 455 #endif
fd98a5c6 456 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 457 #endif
8e669ac1 458
80a47a2c
TK		 459 #ifndef DISABLE_DKIM
460 (unsigned int)
461 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 462
80a47a2c
TK		 463 (unsigned int)
464 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 465 #endif
fb2274d4 466
4840604e
TL		 467 #ifdef EXPERIMENTAL_DMARC
468 (unsigned int)
469 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
470 #endif
471
45b91596
PH		 472 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
473 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 474
2f079f46 475 (unsigned int)
fd98a5c6 476 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 477 #ifndef DISABLE_PRDR
fd98a5c6
JH		 478 |(1<<ACL_WHERE_PRDR)
479 #endif
480 ),
059ec3d9 481
45b91596
PH		 482 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
483 (1<<ACL_WHERE_CONNECT)|
484 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 485 (1<<ACL_WHERE_HELO),
8e669ac1 486
059ec3d9 487 0, /* endpass */
8e669ac1 488
45b91596
PH		 489 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
490 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 491
2f079f46 492 (unsigned int)
fd98a5c6
JH		 493 ~((1<<ACL_WHERE_RCPT) /* local_parts */
494 #ifdef EXPERIMENTAL_PRDR
495 |(1<<ACL_WHERE_PRDR)
496 #endif
497 ),
059ec3d9
PH		 498
499 0, /* log_message */
8e669ac1 500
6ea85e9a
PH		 501 0, /* log_reject_target */
502
059ec3d9 503 0, /* logwrite */
8e669ac1 504
71fafd95 505 #ifdef WITH_CONTENT_SCAN
2f079f46 506 (unsigned int)
fd98a5c6 507 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 508 #ifndef DISABLE_PRDR
fd98a5c6 509 (1<<ACL_WHERE_PRDR)|
8ccd00b1 510 #endif
fd98a5c6 511 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 512 #endif
8523533c 513
059ec3d9
PH		 514 0, /* message */
515
71fafd95 516 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 517 (unsigned int)
518 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 519 #endif
8523533c 520
870f6ba8
TF		 521 0, /* ratelimit */
522
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46 527 (unsigned int)
fd98a5c6 528 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 529 #ifndef DISABLE_PRDR
fd98a5c6 530 (1<<ACL_WHERE_PRDR)|
8ccd00b1 531 #endif
fd98a5c6 532 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 533 (1<<ACL_WHERE_MIME)),
71fafd95 534 #endif
8523533c 535
e7568d51
TL		 536 (unsigned int)
537 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
538 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6
JH		 540 (1<<ACL_WHERE_PRDR)|
541 #endif
e7568d51
TL		 542 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
543 (1<<ACL_WHERE_NOTSMTP_START)),
544
059ec3d9
PH		 545 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
546 (1<<ACL_WHERE_HELO)|
547 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
548 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
549 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 0, /* set */
558
71fafd95 559 #ifdef WITH_CONTENT_SCAN
2f079f46 560 (unsigned int)
fd98a5c6 561 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 562 #ifndef DISABLE_PRDR
fd98a5c6 563 (1<<ACL_WHERE_PRDR)|
8ccd00b1 564 #endif
fd98a5c6 565 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 566 #endif
8523533c 567
71fafd95 568 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 569 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
570 (1<<ACL_WHERE_HELO)|
571 (1<<ACL_WHERE_MAILAUTH)|
572 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 573 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
574 (1<<ACL_WHERE_NOTSMTP)|
575 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 576
577 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
578 (1<<ACL_WHERE_HELO)|
579 (1<<ACL_WHERE_MAILAUTH)|
580 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
581 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
582 (1<<ACL_WHERE_NOTSMTP)|
583 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 584 #endif
8523533c 585
b0019c78
TF		 586 0, /* udpsend */
587
059ec3d9
PH		 588 /* Certain types of verify are always allowed, so we let it through
589 always and check in the verify function itself */
590
591 0 /* verify */
059ec3d9
PH		 592};
593
594
c5fcb476
PH		 595/* Bit map vector of which controls are not allowed at certain times. For
596each control, there's a bitmap of dis-allowed times. For some, it is easier to
597specify the negation of a small number of allowed times. */
598
599static unsigned int control_forbids[] = {
c46782ef
PH		 600 (unsigned int)
601 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
602
603 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 604 0, /* bmi_run */
c46782ef
PH		 605 #endif
606
ed7f7860
PP		 607 0, /* debug */
608
80a47a2c
TK		 609 #ifndef DISABLE_DKIM
610 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
8ccd00b1 611 #ifndef DISABLE_PRDR
fd98a5c6 612 (1<<ACL_WHERE_PRDR)|
8ccd00b1 613 #endif
f7572e5a
TK		 614 (1<<ACL_WHERE_NOTSMTP_START),
615 #endif
616
4840604e
TL		 617 #ifdef EXPERIMENTAL_DMARC
618 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
619 (1<<ACL_WHERE_NOTSMTP_START),
620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
621 (1<<ACL_WHERE_NOTSMTP_START),
622 #endif
623
13363eba
PP		 624 (1<<ACL_WHERE_NOTSMTP)|
625 (1<<ACL_WHERE_NOTSMTP_START)|
626 (1<<ACL_WHERE_NOTQUIT), /* dscp */
627
c5fcb476 628 0, /* error */
8e669ac1
PH		 629
630 (unsigned int)
c5fcb476 631 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 632
633 (unsigned int)
c5fcb476 634 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 635
e4bdf652
JH		 636 (unsigned int)
637 0, /* cutthrough_delivery */
638
45b91596
PH		 639 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
640 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 641
45b91596
PH		 642 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
643 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 644
645 (unsigned int)
c5fcb476
PH		 646 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
647 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 648 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 649 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 659 (1<<ACL_WHERE_PREDATA)),
8523533c 660
8800895a
PH		 661 (unsigned int)
662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 663 (1<<ACL_WHERE_PREDATA)|
664 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 665
c46782ef 666 #ifdef WITH_CONTENT_SCAN
8e669ac1 667 (unsigned int)
14d57970 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 669 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 670 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 671 (1<<ACL_WHERE_MIME)),
c46782ef 672 #endif
a6c4ab60 673
29aba418
TF		 674 (unsigned int)
675 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
676 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 677 #ifndef DISABLE_PRDR
fd98a5c6 678 (1<<ACL_WHERE_PRDR)|
8ccd00b1 679 #endif
29aba418
TF		 680 (1<<ACL_WHERE_MIME)),
681
8e669ac1 682 (unsigned int)
a6c4ab60 683 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 684 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 685 #ifndef DISABLE_PRDR
fd98a5c6 686 (1<<ACL_WHERE_PRDR)|
8ccd00b1 687 #endif
e715ad22 688 (1<<ACL_WHERE_MIME)),
8523533c 689
45b91596 690 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 691 (1<<ACL_WHERE_NOTSMTP_START),
692
693 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 694 (1<<ACL_WHERE_NOTSMTP_START),
695
696 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 697 (1<<ACL_WHERE_NOTSMTP_START),
698
699 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 700 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 701};
702
703/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 704
705typedef struct control_def {
706 uschar *name;
707 int value; /* CONTROL_xxx value */
059ec3d9
PH		 708 BOOL has_option; /* Has /option(s) following */
709} control_def;
710
711static control_def controls_list[] = {
c46782ef 712 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 713#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 714 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 715#endif
ed7f7860 716 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK		 717#ifndef DISABLE_DKIM
718 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 719#endif
720#ifdef EXPERIMENTAL_DMARC
721 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
722 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 723#endif
13363eba 724 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH		 725 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
726 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
727 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
728 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 729 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 730 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH		 731 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
732 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 733 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 734 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 735#ifdef WITH_CONTENT_SCAN
c46782ef 736 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 737#endif
c46782ef
PH		 738 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
739 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
740 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH		 741 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
742 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH		 743 };
744
e5a9dba6
PH		 745/* Support data structures for Client SMTP Authorization. acl_verify_csa()
746caches its result in a tree to avoid repeated DNS queries. The result is an
747integer code which is used as an index into the following tables of
748explanatory strings and verification return codes. */
749
750static tree_node *csa_cache = NULL;
751
752enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
753 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
754
755/* The acl_verify_csa() return code is translated into an acl_verify() return
756code using the following table. It is OK unless the client is definitely not
757authorized. This is because CSA is supposed to be optional for sending sites,
758so recipients should not be too strict about checking it - especially because
759DNS problems are quite likely to occur. It's possible to use $csa_status in
760further ACL conditions to distinguish ok, unknown, and defer if required, but
761the aim is to make the usual configuration simple. */
762
763static int csa_return_code[] = {
764 OK, OK, OK, OK,
765 FAIL, FAIL, FAIL, FAIL
766};
767
768static uschar *csa_status_string[] = {
769 US"unknown", US"ok", US"defer", US"defer",
770 US"fail", US"fail", US"fail", US"fail"
771};
772
773static uschar *csa_reason_string[] = {
774 US"unknown",
775 US"ok",
776 US"deferred (SRV lookup failed)",
777 US"deferred (target address lookup failed)",
778 US"failed (explicit authorization required)",
779 US"failed (host name not authorized)",
780 US"failed (no authorized addresses)",
781 US"failed (client address mismatch)"
782};
783
c99ce5c9
TF		 784/* Options for the ratelimit condition. Note that there are two variants of
785the per_rcpt option, depending on the ACL that is used to measure the rate.
786However any ACL must be able to look up per_rcpt rates in /noupdate mode,
787so the two variants must have the same internal representation as well as
788the same configuration string. */
789
790enum {
791 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
792 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
793};
794
795#define RATE_SET(var,new) \
796 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
797
798static uschar *ratelimit_option_string[] = {
799 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
800 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
801};
802
059ec3d9
PH		 803/* Enable recursion between acl_check_internal() and acl_check_condition() */
804
f60d98e8
JH		 805static int acl_check_wargs(int, address_item *, uschar *, int, uschar **,
806 uschar **);
059ec3d9
PH		 807
808
809/*************************************************
810* Pick out name from list *
811*************************************************/
812
813/* Use a binary chop method
814
815Arguments:
816 name name to find
817 list list of names
818 end size of list
819
820Returns: offset in list, or -1 if not found
821*/
822
823static int
824acl_checkname(uschar *name, uschar **list, int end)
825{
826int start = 0;
827
828while (start < end)
829 {
830 int mid = (start + end)/2;
831 int c = Ustrcmp(name, list[mid]);
832 if (c == 0) return mid;
833 if (c < 0) end = mid; else start = mid + 1;
834 }
835
836return -1;
837}
838
839
840/*************************************************
841* Read and parse one ACL *
842*************************************************/
843
844/* This function is called both from readconf in order to parse the ACLs in the
845configuration file, and also when an ACL is encountered dynamically (e.g. as
846the result of an expansion). It is given a function to call in order to
847retrieve the lines of the ACL. This function handles skipping comments and
848blank lines (where relevant).
849
850Arguments:
851 func function to get next line of ACL
852 error where to put an error message
853
854Returns: pointer to ACL, or NULL
855 NULL can be legal (empty ACL); in this case error will be NULL
856*/
857
858acl_block *
859acl_read(uschar *(*func)(void), uschar **error)
860{
861acl_block *yield = NULL;
862acl_block **lastp = &yield;
863acl_block *this = NULL;
864acl_condition_block *cond;
865acl_condition_block **condp = NULL;
866uschar *s;
867
868*error = NULL;
869
870while ((s = (*func)()) != NULL)
871 {
872 int v, c;
873 BOOL negated = FALSE;
874 uschar *saveline = s;
875 uschar name[64];
876
877 /* Conditions (but not verbs) are allowed to be negated by an initial
878 exclamation mark. */
879
880 while (isspace(*s)) s++;
881 if (*s == '!')
882 {
883 negated = TRUE;
884 s++;
885 }
886
cf00dad6
PH		 887 /* Read the name of a verb or a condition, or the start of a new ACL, which
888 can be started by a name, or by a macro definition. */
059ec3d9
PH		 889
890 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 891 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 892
893 /* If a verb is unrecognized, it may be another condition or modifier that
894 continues the previous verb. */
895
896 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
897 if (v < 0)
898 {
899 if (this == NULL)
900 {
4e167a8c
PH		 901 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
902 saveline);
059ec3d9
PH		 903 return NULL;
904 }
905 }
906
907 /* New verb */
908
909 else
910 {
911 if (negated)
912 {
913 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
914 return NULL;
915 }
916 this = store_get(sizeof(acl_block));
917 *lastp = this;
918 lastp = &(this->next);
919 this->next = NULL;
920 this->verb = v;
921 this->condition = NULL;
922 condp = &(this->condition);
923 if (*s == 0) continue; /* No condition on this line */
924 if (*s == '!')
925 {
926 negated = TRUE;
927 s++;
928 }
929 s = readconf_readname(name, sizeof(name), s); /* Condition name */
930 }
931
932 /* Handle a condition or modifier. */
933
934 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
935 if (c < 0)
936 {
937 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
938 saveline);
939 return NULL;
940 }
941
942 /* The modifiers may not be negated */
943
944 if (negated && cond_modifiers[c])
945 {
946 *error = string_sprintf("ACL error: negation is not allowed with "
947 "\"%s\"", conditions[c]);
948 return NULL;
949 }
950
951 /* ENDPASS may occur only with ACCEPT or DISCARD. */
952
953 if (c == ACLC_ENDPASS &&
954 this->verb != ACL_ACCEPT &&
955 this->verb != ACL_DISCARD)
956 {
957 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
958 conditions[c], verbs[this->verb]);
959 return NULL;
960 }
961
962 cond = store_get(sizeof(acl_condition_block));
963 cond->next = NULL;
964 cond->type = c;
965 cond->u.negated = negated;
966
967 *condp = cond;
968 condp = &(cond->next);
969
970 /* The "set" modifier is different in that its argument is "name=value"
971 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 972 gives us a variable name to insert into the data block. The original ACL
973 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
974 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 975 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
976 After that, we allow alphanumerics and underscores, but the first character
977 after c or m must be a digit or an underscore. This retains backwards
978 compatibility. */
059ec3d9
PH		 979
980 if (c == ACLC_SET)
981 {
47ca6d6c
PH		 982 uschar *endptr;
983
38a0a95f
PH		 984 if (Ustrncmp(s, "acl_c", 5) != 0 &&
985 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 986 {
38a0a95f
PH		 987 *error = string_sprintf("invalid variable name after \"set\" in ACL "
988 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
989 return NULL;
47ca6d6c 990 }
38a0a95f
PH		 991
992 endptr = s + 5;
641cb756
PH		 993 if (!isdigit(*endptr) && *endptr != '_')
994 {
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
997 s);
998 return NULL;
999 }
1000
38a0a95f 1001 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1002 {
38a0a95f
PH		 1003 if (!isalnum(*endptr) && *endptr != '_')
1004 {
1005 *error = string_sprintf("invalid character \"%c\" in variable name "
1006 "in ACL modifier \"set %s\"", *endptr, s);
1007 return NULL;
1008 }
1009 endptr++;
47ca6d6c 1010 }
47ca6d6c 1011
38a0a95f 1012 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1013 s = endptr;
059ec3d9
PH		 1014 while (isspace(*s)) s++;
1015 }
1016
1017 /* For "set", we are now positioned for the data. For the others, only
1018 "endpass" has no data */
1019
1020 if (c != ACLC_ENDPASS)
1021 {
1022 if (*s++ != '=')
1023 {
1024 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1025 cond_modifiers[c]? US"modifier" : US"condition");
1026 return NULL;
1027 }
1028 while (isspace(*s)) s++;
1029 cond->arg = string_copy(s);
1030 }
1031 }
1032
1033return yield;
1034}
1035
1036
1037
71fafd95
PH		 1038/*************************************************
1039* Set up added header line(s) *
1040*************************************************/
1041
1042/* This function is called by the add_header modifier, and also from acl_warn()
1043to implement the now-deprecated way of adding header lines using "message" on a
1044"warn" verb. The argument is treated as a sequence of header lines which are
1045added to a chain, provided there isn't an identical one already there.
1046
1047Argument: string of header lines
1048Returns: nothing
1049*/
1050
1051static void
1052setup_header(uschar *hstring)
1053{
1054uschar *p, *q;
1055int hlen = Ustrlen(hstring);
1056
b1b05573
JH		 1057/* Ignore any leading newlines */
1058while (*hstring == '\n') hstring++, hlen--;
71fafd95 1059
b1b05573 1060/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1061if (hlen <= 0) return;
b1b05573
JH		 1062if (hstring[--hlen] != '\n') hstring = string_sprintf("%s\n", hstring);
1063else while(hstring[--hlen] == '\n') hstring[hlen+1] = '\0';
71fafd95
PH		 1064
1065/* Loop for multiple header lines, taking care about continuations */
1066
1067for (p = q = hstring; *p != 0; )
1068 {
1069 uschar *s;
1070 int newtype = htype_add_bot;
1071 header_line **hptr = &acl_added_headers;
1072
1073 /* Find next header line within the string */
1074
1075 for (;;)
1076 {
1077 q = Ustrchr(q, '\n');
1078 if (*(++q) != ' ' && *q != '\t') break;
1079 }
1080
1081 /* If the line starts with a colon, interpret the instruction for where to
1082 add it. This temporarily sets up a new type. */
1083
1084 if (*p == ':')
1085 {
1086 if (strncmpic(p, US":after_received:", 16) == 0)
1087 {
1088 newtype = htype_add_rec;
1089 p += 16;
1090 }
1091 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1092 {
1093 newtype = htype_add_rfc;
1094 p += 14;
1095 }
1096 else if (strncmpic(p, US":at_start:", 10) == 0)
1097 {
1098 newtype = htype_add_top;
1099 p += 10;
1100 }
1101 else if (strncmpic(p, US":at_end:", 8) == 0)
1102 {
1103 newtype = htype_add_bot;
1104 p += 8;
1105 }
1106 while (*p == ' ' || *p == '\t') p++;
1107 }
1108
1109 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1110 to the front of it. */
1111
1112 for (s = p; s < q - 1; s++)
1113 {
1114 if (*s == ':' || !isgraph(*s)) break;
1115 }
1116
438257ba 1117 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
71fafd95
PH		 1118 hlen = Ustrlen(s);
1119
1120 /* See if this line has already been added */
1121
1122 while (*hptr != NULL)
1123 {
1124 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
1125 hptr = &((*hptr)->next);
1126 }
1127
1128 /* Add if not previously present */
1129
1130 if (*hptr == NULL)
1131 {
1132 header_line *h = store_get(sizeof(header_line));
1133 h->text = s;
1134 h->next = NULL;
1135 h->type = newtype;
1136 h->slen = hlen;
1137 *hptr = h;
1138 hptr = &(h->next);
1139 }
1140
1141 /* Advance for next header line within the string */
1142
1143 p = q;
1144 }
1145}
1146
1147
1148
362145b5
JH		 1149/*************************************************
1150* List the added header lines *
1151*************************************************/
1152uschar *
1153fn_hdrs_added(void)
1154{
1155uschar * ret = NULL;
1156header_line * h = acl_added_headers;
1157uschar * s;
1158uschar * cp;
1159int size = 0;
1160int ptr = 0;
1161
1162if (!h) return NULL;
1163
1164do
1165 {
1166 s = h->text;
1167 while ((cp = Ustrchr(s, '\n')) != NULL)
1168 {
1169 if (cp[1] == '\0') break;
1170
1171 /* contains embedded newline; needs doubling */
1172 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1173 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1174 s = cp+1;
1175 }
1176 /* last bit of header */
1177
1178 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1179 }
6d9cfc47 1180while((h = h->next));
362145b5
JH		 1181
1182ret[ptr-1] = '\0'; /* overwrite last newline */
1183return ret;
1184}
1185
1186
e7568d51
TL		 1187/*************************************************
1188* Set up removed header line(s) *
1189*************************************************/
1190
1191/* This function is called by the remove_header modifier. The argument is
1192treated as a sequence of header names which are added to a colon separated
1193list, provided there isn't an identical one already there.
1194
1195Argument: string of header names
1196Returns: nothing
1197*/
1198
1199static void
1200setup_remove_header(uschar *hnames)
1201{
1202if (*hnames != 0)
1203 {
1204 if (acl_removed_headers == NULL)
1205 acl_removed_headers = hnames;
1206 else
1207 acl_removed_headers = string_sprintf("%s : %s", acl_removed_headers, hnames);
1208 }
1209}
1210
1211
71fafd95 1212
059ec3d9
PH		 1213/*************************************************
1214* Handle warnings *
1215*************************************************/
1216
1217/* This function is called when a WARN verb's conditions are true. It adds to
1218the message's headers, and/or writes information to the log. In each case, this
1219only happens once (per message for headers, per connection for log).
1220
71fafd95
PH		 1221** NOTE: The header adding action using the "message" setting is historic, and
1222its use is now deprecated. The new add_header modifier should be used instead.
1223
059ec3d9
PH		 1224Arguments:
1225 where ACL_WHERE_xxxx indicating which ACL this is
1226 user_message message for adding to headers
1227 log_message message for logging, if different
1228
1229Returns: nothing
1230*/
1231
1232static void
1233acl_warn(int where, uschar *user_message, uschar *log_message)
1234{
059ec3d9
PH		 1235if (log_message != NULL && log_message != user_message)
1236 {
1237 uschar *text;
1238 string_item *logged;
1239
1240 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1241 string_printing(log_message));
1242
1243 /* If a sender verification has failed, and the log message is "sender verify
1244 failed", add the failure message. */
1245
1246 if (sender_verified_failed != NULL &&
1247 sender_verified_failed->message != NULL &&
1248 strcmpic(log_message, US"sender verify failed") == 0)
1249 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1250
9c7a242c
PH		 1251 /* Search previously logged warnings. They are kept in malloc
1252 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1253
1254 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1255 if (Ustrcmp(logged->text, text) == 0) break;
1256
1257 if (logged == NULL)
1258 {
1259 int length = Ustrlen(text) + 1;
1260 log_write(0, LOG_MAIN, "%s", text);
1261 logged = store_malloc(sizeof(string_item) + length);
1262 logged->text = (uschar *)logged + sizeof(string_item);
1263 memcpy(logged->text, text, length);
1264 logged->next = acl_warn_logged;
1265 acl_warn_logged = logged;
1266 }
1267 }
1268
1269/* If there's no user message, we are done. */
1270
1271if (user_message == NULL) return;
1272
1273/* If this isn't a message ACL, we can't do anything with a user message.
1274Log an error. */
1275
1276if (where > ACL_WHERE_NOTSMTP)
1277 {
1278 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1279 "found in a non-message (%s) ACL: cannot specify header lines here: "
1280 "message ignored", acl_wherenames[where]);
1281 return;
1282 }
1283
71fafd95
PH		 1284/* The code for setting up header lines is now abstracted into a separate
1285function so that it can be used for the add_header modifier as well. */
059ec3d9 1286
71fafd95 1287setup_header(user_message);
059ec3d9
PH		 1288}
1289
1290
1291
1292/*************************************************
1293* Verify and check reverse DNS *
1294*************************************************/
1295
1296/* Called from acl_verify() below. We look up the host name(s) of the client IP
1297address if this has not yet been done. The host_name_lookup() function checks
1298that one of these names resolves to an address list that contains the client IP
1299address, so we don't actually have to do the check here.
1300
1301Arguments:
1302 user_msgptr pointer for user message
1303 log_msgptr pointer for log message
1304
1305Returns: OK verification condition succeeded
1306 FAIL verification failed
1307 DEFER there was a problem verifying
1308*/
1309
1310static int
1311acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1312{
1313int rc;
1314
1315user_msgptr = user_msgptr; /* stop compiler warning */
1316
1317/* Previous success */
1318
1319if (sender_host_name != NULL) return OK;
1320
1321/* Previous failure */
1322
1323if (host_lookup_failed)
1324 {
1325 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1326 return FAIL;
1327 }
1328
1329/* Need to do a lookup */
1330
1331HDEBUG(D_acl)
1332 debug_printf("looking up host name to force name/address consistency check\n");
1333
1334if ((rc = host_name_lookup()) != OK)
1335 {
1336 *log_msgptr = (rc == DEFER)?
1337 US"host lookup deferred for reverse lookup check"
1338 :
1339 string_sprintf("host lookup failed for reverse lookup check%s",
1340 host_lookup_msg);
1341 return rc; /* DEFER or FAIL */
1342 }
1343
1344host_build_sender_fullhost();
1345return OK;
1346}
1347
1348
1349
e5a9dba6
PH		 1350/*************************************************
1351* Check client IP address matches CSA target *
1352*************************************************/
1353
1354/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1355response for address records belonging to the CSA target hostname. The section
1356is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1357If one of the addresses matches the client's IP address, then the client is
1358authorized by CSA. If there are target IP addresses but none of them match
1359then the client is using an unauthorized IP address. If there are no target IP
1360addresses then the client cannot be using an authorized IP address. (This is
1361an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1362
1363Arguments:
1364 dnsa the DNS answer block
1365 dnss a DNS scan block for us to use
1366 reset option specifing what portion to scan, as described above
1367 target the target hostname to use for matching RR names
1368
1369Returns: CSA_OK successfully authorized
1370 CSA_FAIL_MISMATCH addresses found but none matched
1371 CSA_FAIL_NOADDR no target addresses found
1372*/
1373
1374static int
1375acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1376 uschar *target)
1377{
1378dns_record *rr;
1379dns_address *da;
1380
1381BOOL target_found = FALSE;
1382
1383for (rr = dns_next_rr(dnsa, dnss, reset);
1384 rr != NULL;
1385 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1386 {
1387 /* Check this is an address RR for the target hostname. */
1388
1389 if (rr->type != T_A
1390 #if HAVE_IPV6
1391 && rr->type != T_AAAA
1392 #ifdef SUPPORT_A6
1393 && rr->type != T_A6
1394 #endif
1395 #endif
1396 ) continue;
1397
1398 if (strcmpic(target, rr->name) != 0) continue;
1399
1400 target_found = TRUE;
1401
1402 /* Turn the target address RR into a list of textual IP addresses and scan
1403 the list. There may be more than one if it is an A6 RR. */
1404
1405 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1406 {
1407 /* If the client IP address matches the target IP address, it's good! */
1408
1409 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1410
1411 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1412 }
1413 }
1414
1415/* If we found some target addresses but none of them matched, the client is
1416using an unauthorized IP address, otherwise the target has no authorized IP
1417addresses. */
1418
1419if (target_found) return CSA_FAIL_MISMATCH;
1420else return CSA_FAIL_NOADDR;
1421}
1422
1423
1424
1425/*************************************************
1426* Verify Client SMTP Authorization *
1427*************************************************/
1428
1429/* Called from acl_verify() below. This routine calls dns_lookup_special()
1430to find the CSA SRV record corresponding to the domain argument, or
1431$sender_helo_name if no argument is provided. It then checks that the
1432client is authorized, and that its IP address corresponds to the SRV
1433target's address by calling acl_verify_csa_address() above. The address
1434should have been returned in the DNS response's ADDITIONAL section, but if
1435not we perform another DNS lookup to get it.
1436
1437Arguments:
1438 domain pointer to optional parameter following verify = csa
1439
1440Returns: CSA_UNKNOWN no valid CSA record found
1441 CSA_OK successfully authorized
1442 CSA_FAIL_* client is definitely not authorized
1443 CSA_DEFER_* there was a DNS problem
1444*/
1445
1446static int
1447acl_verify_csa(uschar *domain)
1448{
1449tree_node *t;
1450uschar *found, *p;
1451int priority, weight, port;
1452dns_answer dnsa;
1453dns_scan dnss;
1454dns_record *rr;
1455int rc, type;
1456uschar target[256];
1457
1458/* Work out the domain we are using for the CSA lookup. The default is the
1459client's HELO domain. If the client has not said HELO, use its IP address
1460instead. If it's a local client (exim -bs), CSA isn't applicable. */
1461
1462while (isspace(*domain) && *domain != '\0') ++domain;
1463if (*domain == '\0') domain = sender_helo_name;
1464if (domain == NULL) domain = sender_host_address;
1465if (sender_host_address == NULL) return CSA_UNKNOWN;
1466
1467/* If we have an address literal, strip off the framing ready for turning it
1468into a domain. The framing consists of matched square brackets possibly
1469containing a keyword and a colon before the actual IP address. */
1470
1471if (domain[0] == '[')
1472 {
1473 uschar *start = Ustrchr(domain, ':');
1474 if (start == NULL) start = domain;
1475 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1476 }
1477
1478/* Turn domains that look like bare IP addresses into domains in the reverse
1479DNS. This code also deals with address literals and $sender_host_address. It's
1480not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1481address literals, but it's probably the most friendly thing to do. This is an
1482extension to CSA, so we allow it to be turned off for proper conformance. */
1483
7e66e54d 1484if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1485 {
1486 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1487 dns_build_reverse(domain, target);
1488 domain = target;
1489 }
1490
1491/* Find out if we've already done the CSA check for this domain. If we have,
1492return the same result again. Otherwise build a new cached result structure
1493for this domain. The name is filled in now, and the value is filled in when
1494we return from this function. */
1495
1496t = tree_search(csa_cache, domain);
1497if (t != NULL) return t->data.val;
1498
1499t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1500Ustrcpy(t->name, domain);
1501(void)tree_insertnode(&csa_cache, t);
1502
1503/* Now we are ready to do the actual DNS lookup(s). */
1504
28e6ef29 1505found = domain;
e5a9dba6
PH		 1506switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1507 {
1508 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1509
1510 default:
1511 return t->data.val = CSA_DEFER_SRV;
1512
1513 /* If we found nothing, the client's authorization is unknown. */
1514
1515 case DNS_NOMATCH:
1516 case DNS_NODATA:
1517 return t->data.val = CSA_UNKNOWN;
1518
1519 /* We got something! Go on to look at the reply in more detail. */
1520
1521 case DNS_SUCCEED:
1522 break;
1523 }
1524
1525/* Scan the reply for well-formed CSA SRV records. */
1526
1527for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1528 rr != NULL;
1529 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1530 {
1531 if (rr->type != T_SRV) continue;
1532
1533 /* Extract the numerical SRV fields (p is incremented) */
1534
1535 p = rr->data;
1536 GETSHORT(priority, p);
1537 GETSHORT(weight, p);
1538 GETSHORT(port, p);
1539
1540 DEBUG(D_acl)
1541 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1542
1543 /* Check the CSA version number */
1544
1545 if (priority != 1) continue;
1546
1547 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1548 found by dns_special_lookup() is a parent of the one we asked for), we check
1549 the subdomain assertions in the port field. At the moment there's only one
1550 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1551 SRV records of their own. */
1552
1553 if (found != domain)
1554 {
1555 if (port & 1)
1556 return t->data.val = CSA_FAIL_EXPLICIT;
1557 else
1558 return t->data.val = CSA_UNKNOWN;
1559 }
1560
1561 /* This CSA SRV record refers directly to our domain, so we check the value
1562 in the weight field to work out the domain's authorization. 0 and 1 are
1563 unauthorized; 3 means the client is authorized but we can't check the IP
1564 address in order to authenticate it, so we treat it as unknown; values
1565 greater than 3 are undefined. */
1566
1567 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1568
1569 if (weight > 2) continue;
1570
1571 /* Weight == 2, which means the domain is authorized. We must check that the
1572 client's IP address is listed as one of the SRV target addresses. Save the
1573 target hostname then break to scan the additional data for its addresses. */
1574
1575 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1576 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1577
1578 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1579
1580 break;
1581 }
1582
1583/* If we didn't break the loop then no appropriate records were found. */
1584
1585if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1586
1587/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1588A target of "." indicates there are no valid addresses, so the client cannot
1589be authorized. (This is an odd configuration because weight=2 target=. is
1590equivalent to weight=1, but we check for it in order to keep load off the
1591root name servers.) Note that dn_expand() turns "." into "". */
1592
1593if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1594
1595/* Scan the additional section of the CSA SRV reply for addresses belonging
1596to the target. If the name server didn't return any additional data (e.g.
1597because it does not fully support SRV records), we need to do another lookup
1598to obtain the target addresses; otherwise we have a definitive result. */
1599
1600rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1601if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1602
1603/* The DNS lookup type corresponds to the IP version used by the client. */
1604
1605#if HAVE_IPV6
1606if (Ustrchr(sender_host_address, ':') != NULL)
1607 type = T_AAAA;
1608else
1609#endif /* HAVE_IPV6 */
1610 type = T_A;
1611
1612
1613#if HAVE_IPV6 && defined(SUPPORT_A6)
1614DNS_LOOKUP_AGAIN:
1615#endif
1616
4e0983dc 1617lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1618switch (dns_lookup(&dnsa, target, type, NULL))
1619 {
1620 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1621
1622 default:
1623 return t->data.val = CSA_DEFER_ADDR;
1624
1625 /* If the query succeeded, scan the addresses and return the result. */
1626
1627 case DNS_SUCCEED:
1628 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1629 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1630 /* else fall through */
1631
1632 /* If the target has no IP addresses, the client cannot have an authorized
1633 IP address. However, if the target site uses A6 records (not AAAA records)
1634 we have to do yet another lookup in order to check them. */
1635
1636 case DNS_NOMATCH:
1637 case DNS_NODATA:
1638
1639 #if HAVE_IPV6 && defined(SUPPORT_A6)
1640 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1641 #endif
1642
1643 return t->data.val = CSA_FAIL_NOADDR;
1644 }
1645}
1646
1647
1648
059ec3d9
PH		 1649/*************************************************
1650* Handle verification (address & other) *
1651*************************************************/
1652
89583014 1653enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1654 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1655 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1656 };
1657typedef struct {
1658 uschar * name;
1659 int value;
1660 unsigned where_allowed; /* bitmap */
1661 BOOL no_options; /* Never has /option(s) following */
1662 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1663 } verify_type_t;
1664static verify_type_t verify_type_list[] = {
1665 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, TRUE, 0 },
1666 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1667 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1668 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1669 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1670 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1671 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1672 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1673 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1674 FALSE, 6 },
770747fd
MFM		 1675 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1676 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1677 };
1678
1679
1680enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1681 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1682 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1683 CALLOUT_TIME
1684 };
1685typedef struct {
1686 uschar * name;
1687 int value;
1688 int flag;
1689 BOOL has_option; /* Has =option(s) following */
1690 BOOL timeval; /* Has a time value */
1691 } callout_opt_t;
1692static callout_opt_t callout_opt_list[] = {
1693 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1694 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1695 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1696 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1697 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1698 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1699 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1700 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1701 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1702 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1703 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1704 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1705 };
1706
1707
1708
059ec3d9
PH		 1709/* This function implements the "verify" condition. It is called when
1710encountered in any ACL, because some tests are almost always permitted. Some
1711just don't make sense, and always fail (for example, an attempt to test a host
1712lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1713
1714Arguments:
1715 where where called from
1716 addr the recipient address that the ACL is handling, or NULL
1717 arg the argument of "verify"
1718 user_msgptr pointer for user message
1719 log_msgptr pointer for log message
1720 basic_errno where to put verify errno
1721
1722Returns: OK verification condition succeeded
1723 FAIL verification failed
1724 DEFER there was a problem verifying
1725 ERROR syntax error
1726*/
1727
1728static int
1729acl_verify(int where, address_item *addr, uschar *arg,
1730 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1731{
1732int sep = '/';
1733int callout = -1;
1734int callout_overall = -1;
4deaf07d 1735int callout_connect = -1;
059ec3d9
PH		 1736int verify_options = 0;
1737int rc;
1738BOOL verify_header_sender = FALSE;
1739BOOL defer_ok = FALSE;
1740BOOL callout_defer_ok = FALSE;
1741BOOL no_details = FALSE;
eafd343b 1742BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1743address_item *sender_vaddr = NULL;
1744uschar *verify_sender_address = NULL;
1745uschar *pm_mailfrom = NULL;
1746uschar *se_mailfrom = NULL;
596875b3
PH		 1747
1748/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1749an error if options are given for items that don't expect them.
596875b3
PH		 1750*/
1751
1752uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH		 1753uschar *list = arg;
1754uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1755verify_type_t * vp;
059ec3d9
PH		 1756
1757if (ss == NULL) goto BAD_VERIFY;
1758
1759/* Handle name/address consistency verification in a separate function. */
1760
89583014
JH		 1761for (vp= verify_type_list;
1762 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1763 vp++
1764 )
1765 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1766 : strcmpic (ss, vp->name) == 0)
1767 break;
1768if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1769 goto BAD_VERIFY;
1770
1771if (vp->no_options && slash != NULL)
059ec3d9 1772 {
89583014
JH		 1773 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1774 "(this verify item has no options)", arg);
1775 return ERROR;
059ec3d9 1776 }
89583014 1777if (!(vp->where_allowed & (1<<where)))
059ec3d9 1778 {
89583014
JH		 1779 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1780 return ERROR;
059ec3d9 1781 }
89583014 1782switch(vp->value)
596875b3 1783 {
89583014
JH		 1784 case VERIFY_REV_HOST_LKUP:
1785 if (sender_host_address == NULL) return OK;
1786 return acl_verify_reverse(user_msgptr, log_msgptr);
059ec3d9 1787
89583014
JH		 1788 case VERIFY_CERT:
1789 /* TLS certificate verification is done at STARTTLS time; here we just
1790 test whether it was successful or not. (This is for optional verification; for
1791 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1792
817d9f57 1793 if (tls_in.certificate_verified) return OK;
89583014
JH		 1794 *user_msgptr = US"no verified certificate";
1795 return FAIL;
e5a9dba6 1796
89583014
JH		 1797 case VERIFY_HELO:
1798 /* We can test the result of optional HELO verification that might have
1799 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1800
89583014
JH		 1801 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1802 return helo_verified? OK : FAIL;
059ec3d9 1803
89583014
JH		 1804 case VERIFY_CSA:
1805 /* Do Client SMTP Authorization checks in a separate function, and turn the
1806 result code into user-friendly strings. */
1c41c9cc 1807
89583014
JH		 1808 rc = acl_verify_csa(list);
1809 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1810 csa_reason_string[rc]);
1811 csa_status = csa_status_string[rc];
1812 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1813 return csa_return_code[rc];
1814
1815 case VERIFY_HDR_SYNTAX:
1816 /* Check that all relevant header lines have the correct syntax. If there is
1817 a syntax error, we return details of the error to the sender if configured to
1818 send out full details. (But a "message" setting on the ACL can override, as
1819 always). */
1820
1821 rc = verify_check_headers(log_msgptr);
1822 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1823 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1824 return rc;
059ec3d9 1825
770747fd
MFM		 1826 case VERIFY_HDR_NAMES_ASCII:
1827 /* Check that all header names are true 7 bit strings
1828 See RFC 5322, 2.2. and RFC 6532, 3. */
1829
1830 rc = verify_check_header_names_ascii(log_msgptr);
1831 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 return rc;
1834
89583014
JH		 1835 case VERIFY_NOT_BLIND:
1836 /* Check that no recipient of this message is "blind", that is, every envelope
1837 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1838
89583014
JH		 1839 rc = verify_check_notblind();
1840 if (rc != OK)
1841 {
1842 *log_msgptr = string_sprintf("bcc recipient detected");
1843 if (smtp_return_error_details)
1844 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1845 }
1846 return rc;
059ec3d9 1847
89583014
JH		 1848 /* The remaining verification tests check recipient and sender addresses,
1849 either from the envelope or from the header. There are a number of
1850 slash-separated options that are common to all of them. */
059ec3d9 1851
89583014
JH		 1852 case VERIFY_HDR_SNDR:
1853 verify_header_sender = TRUE;
1854 break;
059ec3d9 1855
89583014
JH		 1856 case VERIFY_SNDR:
1857 /* In the case of a sender, this can optionally be followed by an address to use
1858 in place of the actual sender (rare special-case requirement). */
059ec3d9 1859 {
89583014
JH		 1860 uschar *s = ss + 6;
1861 if (*s == 0)
1862 verify_sender_address = sender_address;
1863 else
1864 {
1865 while (isspace(*s)) s++;
1866 if (*s++ != '=') goto BAD_VERIFY;
1867 while (isspace(*s)) s++;
1868 verify_sender_address = string_copy(s);
1869 }
059ec3d9 1870 }
89583014
JH		 1871 break;
1872
1873 case VERIFY_RCPT:
1874 break;
059ec3d9
PH		 1875 }
1876
89583014
JH		 1877
1878
596875b3
PH		 1879/* Remaining items are optional; they apply to sender and recipient
1880verification, including "header sender" verification. */
059ec3d9
PH		 1881
1882while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1883 != NULL)
1884 {
1885 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1886 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1887 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1888
1889 /* These two old options are left for backwards compatibility */
1890
1891 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1892 {
1893 callout_defer_ok = TRUE;
1894 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1895 }
1896
1897 else if (strcmpic(ss, US"check_postmaster") == 0)
1898 {
1899 pm_mailfrom = US"";
1900 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1901 }
1902
1903 /* The callout option has a number of sub-options, comma separated */
1904
1905 else if (strncmpic(ss, US"callout", 7) == 0)
1906 {
1907 callout = CALLOUT_TIMEOUT_DEFAULT;
1908 ss += 7;
1909 if (*ss != 0)
1910 {
1911 while (isspace(*ss)) ss++;
1912 if (*ss++ == '=')
1913 {
1914 int optsep = ',';
1915 uschar *opt;
1916 uschar buffer[256];
1917 while (isspace(*ss)) ss++;
8e669ac1 1918
059ec3d9
PH		 1919 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1920 != NULL)
1921 {
89583014 1922 callout_opt_t * op;
438257ba 1923 double period = 1.0F;
059ec3d9 1924
89583014 1925 for (op= callout_opt_list; op->name; op++)
438257ba 1926 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1927 break;
059ec3d9 1928
89583014
JH		 1929 verify_options |= op->flag;
1930 if (op->has_option)
1931 {
438257ba 1932 opt += Ustrlen(op->name);
4deaf07d
PH		 1933 while (isspace(*opt)) opt++;
1934 if (*opt++ != '=')
1935 {
1936 *log_msgptr = string_sprintf("'=' expected after "
89583014 1937 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1938 return ERROR;
1939 }
1940 while (isspace(*opt)) opt++;
89583014
JH		 1941 }
1942 if (op->timeval)
1943 {
1944 period = readconf_readtime(opt, 0, FALSE);
1945 if (period < 0)
4deaf07d
PH		 1946 {
1947 *log_msgptr = string_sprintf("bad time value in ACL condition "
1948 "\"verify %s\"", arg);
1949 return ERROR;
1950 }
89583014
JH		 1951 }
1952
1953 switch(op->value)
1954 {
1955 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1956 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1957 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1958 case CALLOUT_MAILFROM:
1959 if (!verify_header_sender)
1960 {
1961 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1962 "callout option only for verify=header_sender (detected in ACL "
1963 "condition \"%s\")", arg);
1964 return ERROR;
1965 }
1966 se_mailfrom = string_copy(opt);
1967 break;
1968 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1969 case CALLOUT_MAXWAIT: callout_overall = period; break;
1970 case CALLOUT_CONNECT: callout_connect = period; break;
1971 case CALLOUT_TIME: callout = period; break;
1972 }
059ec3d9
PH		 1973 }
1974 }
1975 else
1976 {
1977 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1978 "ACL condition \"%s\"", arg);
1979 return ERROR;
1980 }
1981 }
1982 }
1983
1984 /* Option not recognized */
1985
1986 else
1987 {
1988 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1989 "condition \"verify %s\"", ss, arg);
1990 return ERROR;
1991 }
1992 }
1993
1994if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1995 (vopt_callout_recipsender|vopt_callout_recippmaster))
1996 {
1997 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1998 "for a recipient callout";
1999 return ERROR;
2000 }
2001
2002/* Handle sender-in-header verification. Default the user message to the log
2003message if giving out verification details. */
2004
2005if (verify_header_sender)
2006 {
8e669ac1 2007 int verrno;
059ec3d9 2008 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2009 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2010 &verrno);
2011 if (rc != OK)
8e669ac1 2012 {
fe5b5d0b
PH		 2013 *basic_errno = verrno;
2014 if (smtp_return_error_details)
2015 {
2016 if (*user_msgptr == NULL && *log_msgptr != NULL)
2017 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2018 if (rc == DEFER) acl_temp_details = TRUE;
2019 }
8e669ac1 2020 }
059ec3d9
PH		 2021 }
2022
2023/* Handle a sender address. The default is to verify *the* sender address, but
2024optionally a different address can be given, for special requirements. If the
2025address is empty, we are dealing with a bounce message that has no sender, so
2026we cannot do any checking. If the real sender address gets rewritten during
2027verification (e.g. DNS widening), set the flag to stop it being rewritten again
2028during message reception.
2029
2030A list of verified "sender" addresses is kept to try to avoid doing to much
2031work repetitively when there are multiple recipients in a message and they all
2032require sender verification. However, when callouts are involved, it gets too
2033complicated because different recipients may require different callout options.
2034Therefore, we always do a full sender verify when any kind of callout is
2035specified. Caching elsewhere, for instance in the DNS resolver and in the
2036callout handling, should ensure that this is not terribly inefficient. */
2037
2038else if (verify_sender_address != NULL)
2039 {
2040 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2041 != 0)
2042 {
2043 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2044 "sender verify callout";
2045 return ERROR;
2046 }
2047
2048 sender_vaddr = verify_checked_sender(verify_sender_address);
2049 if (sender_vaddr != NULL && /* Previously checked */
2050 callout <= 0) /* No callout needed this time */
2051 {
2052 /* If the "routed" flag is set, it means that routing worked before, so
2053 this check can give OK (the saved return code value, if set, belongs to a
2054 callout that was done previously). If the "routed" flag is not set, routing
2055 must have failed, so we use the saved return code. */
2056
2057 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2058 {
2059 rc = sender_vaddr->special_action;
2060 *basic_errno = sender_vaddr->basic_errno;
2061 }
2062 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2063 }
2064
2065 /* Do a new verification, and cache the result. The cache is used to avoid
2066 verifying the sender multiple times for multiple RCPTs when callouts are not
2067 specified (see comments above).
2068
2069 The cache is also used on failure to give details in response to the first
2070 RCPT that gets bounced for this reason. However, this can be suppressed by
2071 the no_details option, which sets the flag that says "this detail has already
2072 been sent". The cache normally contains just one address, but there may be
2073 more in esoteric circumstances. */
2074
2075 else
2076 {
2077 BOOL routed = TRUE;
2a3eea10 2078 uschar *save_address_data = deliver_address_data;
8e669ac1 2079
059ec3d9
PH		 2080 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2081 if (no_details) setflag(sender_vaddr, af_sverify_told);
2082 if (verify_sender_address[0] != 0)
2083 {
2084 /* If this is the real sender address, save the unrewritten version
2085 for use later in receive. Otherwise, set a flag so that rewriting the
2086 sender in verify_address() does not update sender_address. */
2087
2088 if (verify_sender_address == sender_address)
2089 sender_address_unrewritten = sender_address;
2090 else
2091 verify_options |= vopt_fake_sender;
2092
eafd343b
TK		 2093 if (success_on_redirect)
2094 verify_options |= vopt_success_on_redirect;
2095
059ec3d9
PH		 2096 /* The recipient, qualify, and expn options are never set in
2097 verify_options. */
2098
2099 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2100 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2101
2102 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2103
2104 if (rc == OK)
2105 {
2106 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2107 {
2108 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2109 verify_sender_address, sender_vaddr->address);
2110 }
2111 else
2112 {
2113 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2114 verify_sender_address);
2115 }
2116 }
2117 else *basic_errno = sender_vaddr->basic_errno;
2118 }
2119 else rc = OK; /* Null sender */
2120
2121 /* Cache the result code */
2122
2123 if (routed) setflag(sender_vaddr, af_verify_routed);
2124 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2125 sender_vaddr->special_action = rc;
2126 sender_vaddr->next = sender_verified_list;
2127 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2128
2129 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2130 the sender verification. */
8e669ac1 2131
2a3eea10 2132 deliver_address_data = save_address_data;
059ec3d9 2133 }
8e669ac1 2134
2a3eea10
PH		 2135 /* Put the sender address_data value into $sender_address_data */
2136
8e669ac1 2137 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH		 2138 }
2139
2140/* A recipient address just gets a straightforward verify; again we must handle
2141the DEFER overrides. */
2142
2143else
2144 {
2145 address_item addr2;
2146
eafd343b
TK		 2147 if (success_on_redirect)
2148 verify_options |= vopt_success_on_redirect;
2149
059ec3d9
PH		 2150 /* We must use a copy of the address for verification, because it might
2151 get rewritten. */
2152
2153 addr2 = *addr;
2154 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2155 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2156 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2157
42855d71 2158 *basic_errno = addr2.basic_errno;
059ec3d9 2159 *log_msgptr = addr2.message;
8e669ac1 2160 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2161 addr2.user_message : addr2.message;
42855d71
PH		 2162
2163 /* Allow details for temporary error if the address is so flagged. */
2164 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2165
2166 /* Make $address_data visible */
2167 deliver_address_data = addr2.p.address_data;
2168 }
2169
2170/* We have a result from the relevant test. Handle defer overrides first. */
2171
2172if (rc == DEFER && (defer_ok ||
2173 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2174 {
2175 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2176 defer_ok? "defer_ok" : "callout_defer_ok");
2177 rc = OK;
2178 }
2179
2180/* If we've failed a sender, set up a recipient message, and point
2181sender_verified_failed to the address item that actually failed. */
2182
2183if (rc != OK && verify_sender_address != NULL)
2184 {
2185 if (rc != DEFER)
2186 {
2187 *log_msgptr = *user_msgptr = US"Sender verify failed";
2188 }
2189 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2190 {
2191 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2192 }
2193 else
2194 {
2195 *log_msgptr = US"Could not complete sender verify callout";
2196 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2197 *log_msgptr;
2198 }
2199
2200 sender_verified_failed = sender_vaddr;
2201 }
2202
2203/* Verifying an address messes up the values of $domain and $local_part,
2204so reset them before returning if this is a RCPT ACL. */
2205
2206if (addr != NULL)
2207 {
2208 deliver_domain = addr->domain;
2209 deliver_localpart = addr->local_part;
2210 }
2211return rc;
2212
2213/* Syntax errors in the verify argument come here. */
2214
2215BAD_VERIFY:
2216*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2217 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2218 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2219 "\"verify %s\"", arg);
2220return ERROR;
2221}
2222
2223
2224
2225
2226/*************************************************
2227* Check argument for control= modifier *
2228*************************************************/
2229
2230/* Called from acl_check_condition() below
2231
2232Arguments:
2233 arg the argument string for control=
2234 pptr set to point to the terminating character
2235 where which ACL we are in
2236 log_msgptr for error messages
2237
2238Returns: CONTROL_xxx value
2239*/
2240
2241static int
2242decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2243{
2244int len;
2245control_def *d;
2246
2247for (d = controls_list;
2248 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2249 d++)
2250 {
2251 len = Ustrlen(d->name);
2252 if (Ustrncmp(d->name, arg, len) == 0) break;
2253 }
2254
2255if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2256 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2257 {
2258 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2259 return CONTROL_ERROR;
2260 }
2261
059ec3d9
PH		 2262*pptr = arg + len;
2263return d->value;
2264}
2265
2266
2267
c99ce5c9
TF		 2268
2269/*************************************************
2270* Return a ratelimit error *
2271*************************************************/
2272
2273/* Called from acl_ratelimit() below
2274
2275Arguments:
2276 log_msgptr for error messages
2277 format format string
2278 ... supplementary arguments
2279 ss ratelimit option name
2280 where ACL_WHERE_xxxx indicating which ACL this is
2281
2282Returns: ERROR
2283*/
2284
2285static int
2286ratelimit_error(uschar **log_msgptr, const char *format, ...)
2287{
2288va_list ap;
2289uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2290va_start(ap, format);
2291if (!string_vformat(buffer, sizeof(buffer), format, ap))
2292 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2293 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2294va_end(ap);
2295*log_msgptr = string_sprintf(
2296 "error in arguments to \"ratelimit\" condition: %s", buffer);
2297return ERROR;
2298}
2299
2300
2301
2302
870f6ba8
TF		 2303/*************************************************
2304* Handle rate limiting *
2305*************************************************/
2306
2307/* Called by acl_check_condition() below to calculate the result
2308of the ACL ratelimit condition.
2309
2310Note that the return value might be slightly unexpected: if the
2311sender's rate is above the limit then the result is OK. This is
2312similar to the dnslists condition, and is so that you can write
2313ACL clauses like: defer ratelimit = 15 / 1h
2314
2315Arguments:
2316 arg the option string for ratelimit=
90fc3069 2317 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2318 log_msgptr for error messages
2319
2320Returns: OK - Sender's rate is above limit
2321 FAIL - Sender's rate is below limit
2322 DEFER - Problem opening ratelimit database
2323 ERROR - Syntax error in options.
2324*/
2325
2326static int
90fc3069 2327acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2328{
c99ce5c9 2329double limit, period, count;
8f240103
PH		 2330uschar *ss;
2331uschar *key = NULL;
c99ce5c9 2332uschar *unique = NULL;
870f6ba8 2333int sep = '/';
c99ce5c9
TF		 2334BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2335BOOL noupdate = FALSE, badacl = FALSE;
2336int mode = RATE_PER_WHAT;
870f6ba8
TF		 2337int old_pool, rc;
2338tree_node **anchor, *t;
2339open_db dbblock, *dbm;
c99ce5c9 2340int dbdb_size;
870f6ba8 2341dbdata_ratelimit *dbd;
c99ce5c9 2342dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2343struct timeval tv;
2344
2345/* Parse the first two options and record their values in expansion
2346variables. These variables allow the configuration to have informative
2347error messages based on rate limits obtained from a table lookup. */
2348
c99ce5c9 2349/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2350size, which must be greater than or equal to zero. Zero is useful for
2351rate measurement as opposed to rate limiting. */
2352
2353sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2354if (sender_rate_limit == NULL)
2355 limit = -1.0;
2356else
2357 {
2358 limit = Ustrtod(sender_rate_limit, &ss);
2359 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2360 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2361 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2362 }
c99ce5c9
TF		 2363if (limit < 0.0 || *ss != '\0')
2364 return ratelimit_error(log_msgptr,
2365 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2366
c99ce5c9 2367/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2368constant. This must be strictly greater than zero, because zero leads to
2369run-time division errors. */
2370
2371sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2372if (sender_rate_period == NULL) period = -1.0;
2373else period = readconf_readtime(sender_rate_period, 0, FALSE);
2374if (period <= 0.0)
c99ce5c9
TF		 2375 return ratelimit_error(log_msgptr,
2376 "\"%s\" is not a time value", sender_rate_period);
2377
2378/* By default we are counting one of something, but the per_rcpt,
2379per_byte, and count options can change this. */
2380
2381count = 1.0;
870f6ba8 2382
c99ce5c9 2383/* Parse the other options. */
870f6ba8
TF		 2384
2385while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2386 != NULL)
2387 {
2388 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2389 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2390 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2391 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2392 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2393 else if (strcmpic(ss, US"per_conn") == 0)
2394 {
2395 RATE_SET(mode, PER_CONN);
2396 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2397 badacl = TRUE;
2398 }
2399 else if (strcmpic(ss, US"per_mail") == 0)
2400 {
2401 RATE_SET(mode, PER_MAIL);
2402 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2403 }
2404 else if (strcmpic(ss, US"per_rcpt") == 0)
2405 {
2406 /* If we are running in the RCPT ACL, then we'll count the recipients
2407 one by one, but if we are running when we have accumulated the whole
2408 list then we'll add them all in one batch. */
2409 if (where == ACL_WHERE_RCPT)
2410 RATE_SET(mode, PER_RCPT);
2411 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2412 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2413 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2414 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2415 }
2416 else if (strcmpic(ss, US"per_byte") == 0)
2417 {
2418 /* If we have not yet received the message data and there was no SIZE
2419 declaration on the MAIL comand, then it's safe to just use a value of
2420 zero and let the recorded rate decay as if nothing happened. */
2421 RATE_SET(mode, PER_MAIL);
2422 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2423 else count = message_size < 0 ? 0.0 : (double)message_size;
2424 }
2425 else if (strcmpic(ss, US"per_addr") == 0)
2426 {
2427 RATE_SET(mode, PER_RCPT);
438257ba 2428 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2429 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2430 }
2431 else if (strncmpic(ss, US"count=", 6) == 0)
2432 {
2433 uschar *e;
2434 count = Ustrtod(ss+6, &e);
2435 if (count < 0.0 || *e != '\0')
2436 return ratelimit_error(log_msgptr,
2437 "\"%s\" is not a positive number", ss);
2438 }
2439 else if (strncmpic(ss, US"unique=", 7) == 0)
2440 unique = string_copy(ss + 7);
2441 else if (key == NULL)
2442 key = string_copy(ss);
2443 else
2444 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2445 }
2446
c99ce5c9
TF		 2447/* Sanity check. When the badacl flag is set the update mode must either
2448be readonly (which is the default if it is omitted) or, for backwards
2449compatibility, a combination of noupdate and strict or leaky. */
2450
2451if (mode == RATE_PER_CLASH)
2452 return ratelimit_error(log_msgptr, "conflicting per_* options");
2453if (leaky + strict + readonly > 1)
2454 return ratelimit_error(log_msgptr, "conflicting update modes");
2455if (badacl && (leaky || strict) && !noupdate)
2456 return ratelimit_error(log_msgptr,
2457 "\"%s\" must not have /leaky or /strict option in %s ACL",
2458 ratelimit_option_string[mode], acl_wherenames[where]);
2459
2460/* Set the default values of any unset options. In readonly mode we
2461perform the rate computation without any increment so that its value
2462decays to eventually allow over-limit senders through. */
2463
2464if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2465if (badacl) readonly = TRUE;
2466if (readonly) count = 0.0;
2467if (!strict && !readonly) leaky = TRUE;
2468if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2469
8f240103
PH		 2470/* Create the lookup key. If there is no explicit key, use sender_host_address.
2471If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2472omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2473are added to the key because they alter the meaning of the stored data. */
2474
2475if (key == NULL)
2476 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2477
c99ce5c9 2478key = string_sprintf("%s/%s/%s%s",
8f240103 2479 sender_rate_period,
c99ce5c9
TF		 2480 ratelimit_option_string[mode],
2481 unique == NULL ? "" : "unique/",
8f240103 2482 key);
870f6ba8 2483
c99ce5c9
TF		 2484HDEBUG(D_acl)
2485 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2486
8f240103
PH		 2487/* See if we have already computed the rate by looking in the relevant tree.
2488For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2489pool so that they survive across resets. In readonly mode we only remember the
2490result for the rest of this command in case a later command changes it. After
2491this bit of logic the code is independent of the per_* mode. */
870f6ba8 2492
870f6ba8
TF		 2493old_pool = store_pool;
2494
c99ce5c9
TF		 2495if (readonly)
2496 anchor = &ratelimiters_cmd;
2497else switch(mode) {
2498case RATE_PER_CONN:
870f6ba8
TF		 2499 anchor = &ratelimiters_conn;
2500 store_pool = POOL_PERM;
c99ce5c9
TF		 2501 break;
2502case RATE_PER_BYTE:
2503case RATE_PER_MAIL:
2504case RATE_PER_ALLRCPTS:
870f6ba8 2505 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2506 break;
2507case RATE_PER_ADDR:
2508case RATE_PER_CMD:
2509case RATE_PER_RCPT:
fe0dab11 2510 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2511 break;
2512default:
3399bb60 2513 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2514 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2515 "internal ACL error: unknown ratelimit mode %d", mode);
2516 break;
2517}
870f6ba8 2518
c99ce5c9
TF		 2519t = tree_search(*anchor, key);
2520if (t != NULL)
870f6ba8
TF		 2521 {
2522 dbd = t->data.ptr;
2523 /* The following few lines duplicate some of the code below. */
8f240103 2524 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2525 store_pool = old_pool;
2526 sender_rate = string_sprintf("%.1f", dbd->rate);
2527 HDEBUG(D_acl)
2528 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2529 return rc;
2530 }
2531
c99ce5c9
TF		 2532/* We aren't using a pre-computed rate, so get a previously recorded rate
2533from the database, which will be updated and written back if required. */
870f6ba8
TF		 2534
2535dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2536if (dbm == NULL)
2537 {
2538 store_pool = old_pool;
2539 sender_rate = NULL;
2540 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2541 *log_msgptr = US"ratelimit database not available";
2542 return DEFER;
2543 }
c99ce5c9
TF		 2544dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2545dbd = NULL;
870f6ba8
TF		 2546
2547gettimeofday(&tv, NULL);
2548
c99ce5c9
TF		 2549if (dbdb != NULL)
2550 {
2551 /* Locate the basic ratelimit block inside the DB data. */
2552 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2553 dbd = &dbdb->dbd;
2554
2555 /* Forget the old Bloom filter if it is too old, so that we count each
2556 repeating event once per period. We don't simply clear and re-use the old
2557 filter because we want its size to change if the limit changes. Note that
2558 we keep the dbd pointer for copying the rate into the new data block. */
2559
2560 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2561 {
2562 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2563 dbdb = NULL;
2564 }
2565
2566 /* Sanity check. */
2567
2568 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2569 {
2570 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2571 dbdb = NULL;
2572 }
2573 }
2574
2575/* Allocate a new data block if the database lookup failed
2576or the Bloom filter passed its age limit. */
2577
2578if (dbdb == NULL)
2579 {
2580 if (unique == NULL)
2581 {
2582 /* No Bloom filter. This basic ratelimit block is initialized below. */
2583 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2584 dbdb_size = sizeof(*dbd);
2585 dbdb = store_get(dbdb_size);
2586 }
2587 else
2588 {
2589 int extra;
2590 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2591
2592 /* See the long comment below for an explanation of the magic number 2.
2593 The filter has a minimum size in case the rate limit is very small;
2594 this is determined by the definition of dbdata_ratelimit_unique. */
2595
2596 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2597 if (extra < 0) extra = 0;
2598 dbdb_size = sizeof(*dbdb) + extra;
2599 dbdb = store_get(dbdb_size);
2600 dbdb->bloom_epoch = tv.tv_sec;
2601 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2602 memset(dbdb->bloom, 0, dbdb->bloom_size);
2603
2604 /* Preserve any basic ratelimit data (which is our longer-term memory)
2605 by copying it from the discarded block. */
2606
2607 if (dbd != NULL)
2608 {
2609 dbdb->dbd = *dbd;
2610 dbd = &dbdb->dbd;
2611 }
2612 }
2613 }
2614
2615/* If we are counting unique events, find out if this event is new or not.
2616If the client repeats the event during the current period then it should be
2617counted. We skip this code in readonly mode for efficiency, because any
2618changes to the filter will be discarded and because count is already set to
2619zero. */
2620
2621if (unique != NULL && !readonly)
2622 {
2623 /* We identify unique events using a Bloom filter. (You can find my
2624 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2625 With the per_addr option, an "event" is a recipient address, though the
2626 user can use the unique option to define their own events. We only count
2627 an event if we have not seen it before.
2628
2629 We size the filter according to the rate limit, which (in leaky mode)
2630 is the limit on the population of the filter. We allow 16 bits of space
2631 per entry (see the construction code above) and we set (up to) 8 of them
2632 when inserting an element (see the loop below). The probability of a false
2633 positive (an event we have not seen before but which we fail to count) is
2634
2635 size = limit * 16
2636 numhash = 8
2637 allzero = exp(-numhash * pop / size)
2638 = exp(-0.5 * pop / limit)
2639 fpr = pow(1 - allzero, numhash)
2640
2641 For senders at the limit the fpr is 0.06% or 1 in 1700
2642 and for senders at half the limit it is 0.0006% or 1 in 170000
2643
2644 In strict mode the Bloom filter can fill up beyond the normal limit, in
2645 which case the false positive rate will rise. This means that the
2646 measured rate for very fast senders can bogusly drop off after a while.
2647
2648 At twice the limit, the fpr is 2.5% or 1 in 40
2649 At four times the limit, it is 31% or 1 in 3.2
2650
2651 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2652 decay below the limit, and if this is more than one then the Bloom filter
2653 will be discarded before the decay gets that far. The false positive rate
2654 at this threshold is 9.3% or 1 in 10.7. */
2655
2656 BOOL seen;
2657 unsigned n, hash, hinc;
2658 uschar md5sum[16];
2659 md5 md5info;
2660
2661 /* Instead of using eight independent hash values, we combine two values
2662 using the formula h1 + n * h2. This does not harm the Bloom filter's
2663 performance, and means the amount of hash we need is independent of the
2664 number of bits we set in the filter. */
2665
2666 md5_start(&md5info);
2667 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2668 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2669 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2670
2671 /* Scan the bits corresponding to this event. A zero bit means we have
2672 not seen it before. Ensure all bits are set to record this event. */
2673
2674 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2675
2676 seen = TRUE;
2677 for (n = 0; n < 8; n++, hash += hinc)
2678 {
2679 int bit = 1 << (hash % 8);
2680 int byte = (hash / 8) % dbdb->bloom_size;
2681 if ((dbdb->bloom[byte] & bit) == 0)
2682 {
2683 dbdb->bloom[byte] |= bit;
2684 seen = FALSE;
2685 }
2686 }
2687
2688 /* If this event has occurred before, do not count it. */
2689
2690 if (seen)
2691 {
2692 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2693 count = 0.0;
2694 }
2695 else
2696 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2697 }
2698
2699/* If there was no previous ratelimit data block for this key, initialize
2700the new one, otherwise update the block from the database. The initial rate
2701is what would be computed by the code below for an infinite interval. */
2702
870f6ba8
TF		 2703if (dbd == NULL)
2704 {
c99ce5c9
TF		 2705 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2706 dbd = &dbdb->dbd;
870f6ba8
TF		 2707 dbd->time_stamp = tv.tv_sec;
2708 dbd->time_usec = tv.tv_usec;
c99ce5c9 2709 dbd->rate = count;
870f6ba8
TF		 2710 }
2711else
2712 {
2713 /* The smoothed rate is computed using an exponentially weighted moving
2714 average adjusted for variable sampling intervals. The standard EWMA for
2715 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2716 where f() is the measured value and f'() is the smoothed value.
2717
2718 Old data decays out of the smoothed value exponentially, such that data n
2719 samples old is multiplied by a^n. The exponential decay time constant p
2720 is defined such that data p samples old is multiplied by 1/e, which means
2721 that a = exp(-1/p). We can maintain the same time constant for a variable
2722 sampling interval i by using a = exp(-i/p).
2723
2724 The rate we are measuring is messages per period, suitable for directly
2725 comparing with the limit. The average rate between now and the previous
2726 message is period / interval, which we feed into the EWMA as the sample.
2727
2728 It turns out that the number of messages required for the smoothed rate
2729 to reach the limit when they are sent in a burst is equal to the limit.
2730 This can be seen by analysing the value of the smoothed rate after N
2731 messages sent at even intervals. Let k = (1 - a) * p/i
2732
2733 rate_1 = (1 - a) * p/i + a * rate_0
2734 = k + a * rate_0
2735 rate_2 = k + a * rate_1
2736 = k + a * k + a^2 * rate_0
2737 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2738 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2739 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2740 = rate_0 * a^N + p/i * (1 - a^N)
2741
2742 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2743
2744 rate_N = p/i + (rate_0 - p/i) * a^N
2745 a^N = (rate_N - p/i) / (rate_0 - p/i)
2746 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2747 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2748
2749 Numerical analysis of the above equation, setting the computed rate to
2750 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2751 rates, p/i, the number of messages N = limit. So limit serves as both the
2752 maximum rate measured in messages per period, and the maximum number of
2753 messages that can be sent in a fast burst. */
2754
2755 double this_time = (double)tv.tv_sec
2756 + (double)tv.tv_usec / 1000000.0;
2757 double prev_time = (double)dbd->time_stamp
2758 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2759
2760 /* We must avoid division by zero, and deal gracefully with the clock going
2761 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2762 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2763
e5d5a95f
TF		 2764 double interval = this_time - prev_time <= 0.0 ? 1e-9
2765 : this_time - prev_time;
2766
2767 double i_over_p = interval / period;
2768 double a = exp(-i_over_p);
870f6ba8 2769
c99ce5c9
TF		 2770 /* Combine the instantaneous rate (period / interval) with the previous rate
2771 using the smoothing factor a. In order to measure sized events, multiply the
2772 instantaneous rate by the count of bytes or recipients etc. */
2773
870f6ba8
TF		 2774 dbd->time_stamp = tv.tv_sec;
2775 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2776 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2777
2778 /* When events are very widely spaced the computed rate tends towards zero.
2779 Although this is accurate it turns out not to be useful for our purposes,
2780 especially when the first event after a long silence is the start of a spam
2781 run. A more useful model is that the rate for an isolated event should be the
2782 size of the event per the period size, ignoring the lack of events outside
2783 the current period and regardless of where the event falls in the period. So,
2784 if the interval was so long that the calculated rate is unhelpfully small, we
2785 re-intialize the rate. In the absence of higher-rate bursts, the condition
2786 below is true if the interval is greater than the period. */
2787
2788 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2789 }
2790
c99ce5c9
TF		 2791/* Clients sending at the limit are considered to be over the limit.
2792This matters for edge cases such as a limit of zero, when the client
2793should be completely blocked. */
3348576f 2794
8f240103 2795rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2796
2797/* Update the state if the rate is low or if we are being strict. If we
2798are in leaky mode and the sender's rate is too high, we do not update
2799the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2800rate preventing them from getting any email through. If readonly is set,
2801neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2802
c99ce5c9 2803if ((rc == FAIL && leaky) || strict)
8f240103 2804 {
c99ce5c9 2805 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2806 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2807 }
2808else
2809 {
2810 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2811 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2812 }
2813
870f6ba8
TF		 2814dbfn_close(dbm);
2815
c99ce5c9 2816/* Store the result in the tree for future reference. */
870f6ba8 2817
c99ce5c9
TF		 2818t = store_get(sizeof(tree_node) + Ustrlen(key));
2819t->data.ptr = dbd;
2820Ustrcpy(t->name, key);
2821(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2822
2823/* We create the formatted version of the sender's rate very late in
2824order to ensure that it is done using the correct storage pool. */
2825
2826store_pool = old_pool;
2827sender_rate = string_sprintf("%.1f", dbd->rate);
2828
2829HDEBUG(D_acl)
2830 debug_printf("ratelimit computed rate %s\n", sender_rate);
2831
2832return rc;
2833}
2834
2835
2836
b0019c78
TF		 2837/*************************************************
2838* The udpsend ACL modifier *
2839*************************************************/
2840
2841/* Called by acl_check_condition() below.
2842
2843Arguments:
2844 arg the option string for udpsend=
2845 log_msgptr for error messages
2846
2847Returns: OK - Completed.
2848 DEFER - Problem with DNS lookup.
2849 ERROR - Syntax error in options.
2850*/
2851
2852static int
2853acl_udpsend(uschar *arg, uschar **log_msgptr)
2854{
2855int sep = 0;
2856uschar *hostname;
2857uschar *portstr;
2858uschar *portend;
2859host_item *h;
2860int portnum;
b0019c78
TF		 2861int len;
2862int r, s;
b1f8e4f8 2863uschar * errstr;
b0019c78
TF		 2864
2865hostname = string_nextinlist(&arg, &sep, NULL, 0);
2866portstr = string_nextinlist(&arg, &sep, NULL, 0);
2867
2868if (hostname == NULL)
2869 {
217b0e56 2870 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2871 return ERROR;
2872 }
2873if (portstr == NULL)
2874 {
217b0e56 2875 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2876 return ERROR;
2877 }
2878if (arg == NULL)
2879 {
217b0e56 2880 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2881 return ERROR;
2882 }
2883portnum = Ustrtol(portstr, &portend, 10);
2884if (*portend != '\0')
2885 {
217b0e56 2886 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2887 return ERROR;
2888 }
2889
2890/* Make a single-item host list. */
2891h = store_get(sizeof(host_item));
2892memset(h, 0, sizeof(host_item));
2893h->name = hostname;
2894h->port = portnum;
2895h->mx = MX_NONE;
2896
2897if (string_is_ip_address(hostname, NULL))
2898 h->address = hostname, r = HOST_FOUND;
2899else
2900 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2901if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2902 {
217b0e56 2903 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2904 return DEFER;
2905 }
2906
2907HDEBUG(D_acl)
2908 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2909
b1f8e4f8
JH		 2910r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2911 1, NULL, &errstr);
b0019c78 2912if (r < 0) goto defer;
27f9999e 2913len = Ustrlen(arg);
9cb1785a 2914r = send(s, arg, len, 0);
b1f8e4f8
JH		 2915if (r < 0)
2916 {
2917 errstr = US strerror(errno);
2918 close(s);
2919 goto defer;
2920 }
2921close(s);
b0019c78
TF		 2922if (r < len)
2923 {
2924 *log_msgptr =
2925 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2926 return DEFER;
2927 }
2928
2929HDEBUG(D_acl)
2930 debug_printf("udpsend %d bytes\n", r);
2931
2932return OK;
2933
2934defer:
b1f8e4f8 2935*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2936return DEFER;
2937}
2938
2939
2940
059ec3d9
PH		 2941/*************************************************
2942* Handle conditions/modifiers on an ACL item *
2943*************************************************/
2944
2945/* Called from acl_check() below.
2946
2947Arguments:
2948 verb ACL verb
2949 cb ACL condition block - if NULL, result is OK
2950 where where called from
2951 addr the address being checked for RCPT, or NULL
2952 level the nesting level
2953 epp pointer to pass back TRUE if "endpass" encountered
2954 (applies only to "accept" and "discard")
2955 user_msgptr user message pointer
2956 log_msgptr log message pointer
2957 basic_errno pointer to where to put verify error
2958
2959Returns: OK - all conditions are met
2960 DISCARD - an "acl" condition returned DISCARD - only allowed
2961 for "accept" or "discard" verbs
2962 FAIL - at least one condition fails
2963 FAIL_DROP - an "acl" condition returned FAIL_DROP
2964 DEFER - can't tell at the moment (typically, lookup defer,
2965 but can be temporary callout problem)
2966 ERROR - ERROR from nested ACL or expansion failure or other
2967 error
2968*/
2969
2970static int
2971acl_check_condition(int verb, acl_condition_block *cb, int where,
2972 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2973 uschar **log_msgptr, int *basic_errno)
2974{
2975uschar *user_message = NULL;
2976uschar *log_message = NULL;
ed7f7860
PP		 2977uschar *debug_tag = NULL;
2978uschar *debug_opts = NULL;
91ecef39 2979uschar *p = NULL;
059ec3d9 2980int rc = OK;
8523533c
TK		 2981#ifdef WITH_CONTENT_SCAN
2982int sep = '/';
2983#endif
059ec3d9
PH		 2984
2985for (; cb != NULL; cb = cb->next)
2986 {
2987 uschar *arg;
8e669ac1 2988 int control_type;
059ec3d9
PH		 2989
2990 /* The message and log_message items set up messages to be used in
2991 case of rejection. They are expanded later. */
2992
2993 if (cb->type == ACLC_MESSAGE)
2994 {
187bc588 2995 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 2996 user_message = cb->arg;
2997 continue;
2998 }
2999
3000 if (cb->type == ACLC_LOG_MESSAGE)
3001 {
187bc588 3002 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3003 log_message = cb->arg;
3004 continue;
3005 }
3006
3007 /* The endpass "condition" just sets a flag to show it occurred. This is
3008 checked at compile time to be on an "accept" or "discard" item. */
3009
3010 if (cb->type == ACLC_ENDPASS)
3011 {
3012 *epp = TRUE;
3013 continue;
3014 }
3015
3016 /* For other conditions and modifiers, the argument is expanded now for some
3017 of them, but not for all, because expansion happens down in some lower level
3018 checking functions in some cases. */
3019
3020 if (cond_expand_at_top[cb->type])
3021 {
3022 arg = expand_string(cb->arg);
3023 if (arg == NULL)
3024 {
3025 if (expand_string_forcedfail) continue;
3026 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3027 cb->arg, expand_string_message);
3028 return search_find_defer? DEFER : ERROR;
3029 }
3030 }
3031 else arg = cb->arg;
3032
3033 /* Show condition, and expanded condition if it's different */
3034
3035 HDEBUG(D_acl)
3036 {
3037 int lhswidth = 0;
3038 debug_printf("check %s%s %n",
3039 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3040 conditions[cb->type], &lhswidth);
3041
3042 if (cb->type == ACLC_SET)
3043 {
38a0a95f
PH		 3044 debug_printf("acl_%s ", cb->u.varname);
3045 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3046 }
3047
3048 debug_printf("= %s\n", cb->arg);
3049
3050 if (arg != cb->arg)
3051 debug_printf("%.*s= %s\n", lhswidth,
3052 US" ", CS arg);
3053 }
3054
3055 /* Check that this condition makes sense at this time */
3056
3057 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3058 {
3059 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3060 cond_modifiers[cb->type]? "use" : "test",
3061 conditions[cb->type], acl_wherenames[where]);
3062 return ERROR;
3063 }
3064
3065 /* Run the appropriate test for each condition, or take the appropriate
3066 action for the remaining modifiers. */
3067
3068 switch(cb->type)
3069 {
71fafd95
PH		 3070 case ACLC_ADD_HEADER:
3071 setup_header(arg);
3072 break;
3073
059ec3d9
PH		 3074 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3075 "discard" verb. */
71fafd95 3076
059ec3d9 3077 case ACLC_ACL:
f60d98e8 3078 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3079 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3080 {
3081 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3082 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3083 verbs[verb]);
3084 return ERROR;
3085 }
059ec3d9
PH		 3086 break;
3087
3088 case ACLC_AUTHENTICATED:
3089 rc = (sender_host_authenticated == NULL)? FAIL :
3090 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3091 TRUE, NULL);
3092 break;
3093
71fafd95 3094 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3095 case ACLC_BMI_OPTIN:
3096 {
3097 int old_pool = store_pool;
3098 store_pool = POOL_PERM;
3099 bmi_current_optin = string_copy(arg);
3100 store_pool = old_pool;
3101 }
3102 break;
71fafd95 3103 #endif
8523533c 3104
059ec3d9 3105 case ACLC_CONDITION:
f3766eb5
NM		 3106 /* The true/false parsing here should be kept in sync with that used in
3107 expand.c when dealing with ECOND_BOOL so that we don't have too many
3108 different definitions of what can be a boolean. */
51c7471d
JH		 3109 if (*arg == '-'
3110 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3111 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3112 rc = (Uatoi(arg) == 0)? FAIL : OK;
3113 else
3114 rc = (strcmpic(arg, US"no") == 0 ||
3115 strcmpic(arg, US"false") == 0)? FAIL :
3116 (strcmpic(arg, US"yes") == 0 ||
3117 strcmpic(arg, US"true") == 0)? OK : DEFER;
3118 if (rc == DEFER)
3119 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3120 break;
3121
c3611384
PH		 3122 case ACLC_CONTINUE: /* Always succeeds */
3123 break;
3124
059ec3d9 3125 case ACLC_CONTROL:
c5fcb476
PH		 3126 control_type = decode_control(arg, &p, where, log_msgptr);
3127
8523533c 3128 /* Check if this control makes sense at this time */
c5fcb476
PH		 3129
3130 if ((control_forbids[control_type] & (1 << where)) != 0)
3131 {
3132 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3133 controls[control_type], acl_wherenames[where]);
3134 return ERROR;
8e669ac1 3135 }
c5fcb476
PH		 3136
3137 switch(control_type)
059ec3d9 3138 {
c46782ef
PH		 3139 case CONTROL_AUTH_UNADVERTISED:
3140 allow_auth_unadvertised = TRUE;
3141 break;
3142
3143 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3144 case CONTROL_BMI_RUN:
3145 bmi_run = 1;
3146 break;
c46782ef
PH		 3147 #endif
3148
80a47a2c 3149 #ifndef DISABLE_DKIM
f7572e5a 3150 case CONTROL_DKIM_VERIFY:
80a47a2c 3151 dkim_disable_verify = TRUE;
4840604e
TL		 3152 #ifdef EXPERIMENTAL_DMARC
3153 /* Since DKIM was blocked, skip DMARC too */
3154 dmarc_disable_verify = TRUE;
3155 dmarc_enable_forensic = FALSE;
3156 #endif
3157 break;
3158 #endif
3159
3160 #ifdef EXPERIMENTAL_DMARC
3161 case CONTROL_DMARC_VERIFY:
3162 dmarc_disable_verify = TRUE;
3163 break;
3164
3165 case CONTROL_DMARC_FORENSIC:
3166 dmarc_enable_forensic = TRUE;
f7572e5a
TK		 3167 break;
3168 #endif
3169
13363eba
PP		 3170 case CONTROL_DSCP:
3171 if (*p == '/')
3172 {
3173 int fd, af, level, optname, value;
3174 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3175 a socket; we can accept that, we'll just debug-log failures anyway. */
3176 fd = fileno(smtp_in);
3177 af = ip_get_address_family(fd);
3178 if (af < 0)
3179 {
3180 HDEBUG(D_acl)
3181 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3182 strerror(errno));
3183 break;
3184 }
3185 if (dscp_lookup(p+1, af, &level, &optname, &value))
3186 {
3187 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3188 {
3189 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3190 p+1, strerror(errno));
3191 }
3192 else
3193 {
3194 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3195 }
3196 }
3197 else
3198 {
3199 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3200 return ERROR;
3201 }
3202 }
3203 else
3204 {
3205 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3206 return ERROR;
3207 }
3208 break;
3209
059ec3d9
PH		 3210 case CONTROL_ERROR:
3211 return ERROR;
3212
3213 case CONTROL_CASEFUL_LOCAL_PART:
3214 deliver_localpart = addr->cc_local_part;
3215 break;
3216
3217 case CONTROL_CASELOWER_LOCAL_PART:
3218 deliver_localpart = addr->lc_local_part;
3219 break;
3220
3221 case CONTROL_ENFORCE_SYNC:
3222 smtp_enforce_sync = TRUE;
3223 break;
3224
3225 case CONTROL_NO_ENFORCE_SYNC:
3226 smtp_enforce_sync = FALSE;
3227 break;
3228
c46782ef 3229 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3230 case CONTROL_NO_MBOX_UNSPOOL:
3231 no_mbox_unspool = TRUE;
3232 break;
c46782ef 3233 #endif
8523533c 3234
059ec3d9
PH		 3235 case CONTROL_NO_MULTILINE:
3236 no_multiline_responses = TRUE;
3237 break;
3238
cf8b11a5
PH		 3239 case CONTROL_NO_PIPELINING:
3240 pipelining_enable = FALSE;
3241 break;
3242
047bdd8c
PH		 3243 case CONTROL_NO_DELAY_FLUSH:
3244 disable_delay_flush = TRUE;
3245 break;
3246
4c590bd1
PH		 3247 case CONTROL_NO_CALLOUT_FLUSH:
3248 disable_callout_flush = TRUE;
3249 break;
3250
8523533c 3251 case CONTROL_FAKEREJECT:
9171d434
JH		 3252 cancel_cutthrough_connection("fakereject");
3253 case CONTROL_FAKEDEFER:
29aba418 3254 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 3255 if (*p == '/')
8e669ac1 3256 {
8523533c 3257 uschar *pp = p + 1;
8e669ac1 3258 while (*pp != 0) pp++;
29aba418 3259 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK		 3260 p = pp;
3261 }
3262 else
3263 {
3264 /* Explicitly reset to default string */
29aba418 3265 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK		 3266 }
3267 break;
8523533c 3268
059ec3d9
PH		 3269 case CONTROL_FREEZE:
3270 deliver_freeze = TRUE;
3271 deliver_frozen_at = time(NULL);
6a3f1455
PH		 3272 freeze_tell = freeze_tell_config; /* Reset to configured value */
3273 if (Ustrncmp(p, "/no_tell", 8) == 0)
3274 {
3275 p += 8;
3276 freeze_tell = NULL;
3277 }
3278 if (*p != 0)
3279 {
3280 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3281 return ERROR;
3282 }
9171d434 3283 cancel_cutthrough_connection("item frozen");
059ec3d9
PH		 3284 break;
3285
3286 case CONTROL_QUEUE_ONLY:
3287 queue_only_policy = TRUE;
9171d434 3288 cancel_cutthrough_connection("queueing forced");
059ec3d9
PH		 3289 break;
3290
3291 case CONTROL_SUBMISSION:
87ba3f5f 3292 originator_name = US"";
059ec3d9 3293 submission_mode = TRUE;
69358f02 3294 while (*p == '/')
8e669ac1 3295 {
69358f02
PH		 3296 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3297 {
3298 p += 14;
3299 active_local_sender_retain = TRUE;
8e669ac1
PH		 3300 active_local_from_check = FALSE;
3301 }
69358f02
PH		 3302 else if (Ustrncmp(p, "/domain=", 8) == 0)
3303 {
3304 uschar *pp = p + 8;
8e669ac1 3305 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH		 3306 submission_domain = string_copyn(p+8, pp-p-8);
3307 p = pp;
3308 }
8857ccfd
PH		 3309 /* The name= option must be last, because it swallows the rest of
3310 the string. */
87ba3f5f
PH		 3311 else if (Ustrncmp(p, "/name=", 6) == 0)
3312 {
3313 uschar *pp = p + 6;
8857ccfd 3314 while (*pp != 0) pp++;
2fe1a124 3315 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 3316 big_buffer, big_buffer_size));
8e669ac1 3317 p = pp;
69358f02 3318 }
8e669ac1
PH		 3319 else break;
3320 }
69358f02 3321 if (*p != 0)
059ec3d9 3322 {
69358f02 3323 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH		 3324 return ERROR;
3325 }
3326 break;
8800895a 3327
ed7f7860
PP		 3328 case CONTROL_DEBUG:
3329 while (*p == '/')
3330 {
3331 if (Ustrncmp(p, "/tag=", 5) == 0)
3332 {
3333 uschar *pp = p + 5;
3334 while (*pp != '\0' && *pp != '/') pp++;
3335 debug_tag = string_copyn(p+5, pp-p-5);
3336 p = pp;
3337 }
3338 else if (Ustrncmp(p, "/opts=", 6) == 0)
3339 {
3340 uschar *pp = p + 6;
3341 while (*pp != '\0' && *pp != '/') pp++;
3342 debug_opts = string_copyn(p+6, pp-p-6);
3343 p = pp;
3344 }
3345 }
3346 debug_logging_activate(debug_tag, debug_opts);
3347 break;
3348
8800895a
PH		 3349 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3350 suppress_local_fixups = TRUE;
3351 break;
e4bdf652
JH		 3352
3353 case CONTROL_CUTTHROUGH_DELIVERY:
3354 if (deliver_freeze)
9171d434
JH		 3355 *log_msgptr = US"frozen";
3356 else if (queue_only_policy)
3357 *log_msgptr = US"queue-only";
3358 else if (fake_response == FAIL)
3359 *log_msgptr = US"fakereject";
3360 else
3361 {
3362 cutthrough_delivery = TRUE;
3363 break;
3364 }
3365 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3366 arg, *log_msgptr);
3367 return ERROR;
059ec3d9
PH		 3368 }
3369 break;
3370
6a8f9482
TK		 3371 #ifdef EXPERIMENTAL_DCC
3372 case ACLC_DCC:
3373 {
3374 /* Seperate the regular expression and any optional parameters. */
3375 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3376 /* Run the dcc backend. */
3377 rc = dcc_process(&ss);
3378 /* Modify return code based upon the existance of options. */
3379 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3380 != NULL) {
3381 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3382 {
3383 /* FAIL so that the message is passed to the next ACL */
3384 rc = FAIL;
3385 }
3386 }
3387 }
3388 break;
3389 #endif
3390
71fafd95 3391 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3392 case ACLC_DECODE:
3393 rc = mime_decode(&arg);
3394 break;
71fafd95 3395 #endif
8523533c 3396
059ec3d9
PH		 3397 case ACLC_DELAY:
3398 {
3399 int delay = readconf_readtime(arg, 0, FALSE);
3400 if (delay < 0)
3401 {
3402 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3403 "modifier: \"%s\" is not a time value", arg);
3404 return ERROR;
3405 }
3406 else
3407 {
3408 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3409 delay);
3410 if (host_checking)
3411 {
3412 HDEBUG(D_acl)
3413 debug_printf("delay skipped in -bh checking mode\n");
3414 }
010c2d14
PH		 3415
3416 /* It appears to be impossible to detect that a TCP/IP connection has
3417 gone away without reading from it. This means that we cannot shorten
3418 the delay below if the client goes away, because we cannot discover
3419 that the client has closed its end of the connection. (The connection
3420 is actually in a half-closed state, waiting for the server to close its
3421 end.) It would be nice to be able to detect this state, so that the
3422 Exim process is not held up unnecessarily. However, it seems that we
3423 can't. The poll() function does not do the right thing, and in any case
3424 it is not always available.
3425
047bdd8c 3426 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3427 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3428 Also, delays may be specified for non-SMTP input, where smtp_out and
3429 smtp_in will be NULL. Whatever is done must work in all cases.
3430
3431 NOTE 2: The added feature of flushing the output before a delay must
3432 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3433 */
010c2d14 3434
8e669ac1 3435 else
86b8287f 3436 {
14f4a80d 3437 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3438 while (delay > 0) delay = sleep(delay);
8e669ac1 3439 }
059ec3d9
PH		 3440 }
3441 }
3442 break;
3443
71fafd95 3444 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3445 case ACLC_DEMIME:
3446 rc = demime(&arg);
3447 break;
71fafd95 3448 #endif
8523533c 3449
80a47a2c
TK		 3450 #ifndef DISABLE_DKIM
3451 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3452 if (dkim_cur_signer != NULL)
3453 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3454 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3455 else
80a47a2c 3456 rc = FAIL;
71fafd95
PH		 3457 break;
3458
80a47a2c
TK		 3459 case ACLC_DKIM_STATUS:
3460 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3461 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3462 break;
3463 #endif
fb2274d4 3464
4840604e
TL		 3465 #ifdef EXPERIMENTAL_DMARC
3466 case ACLC_DMARC_STATUS:
4a8ce2d8 3467 if (!dmarc_has_been_checked)
4840604e 3468 dmarc_process();
4a8ce2d8 3469 dmarc_has_been_checked = TRUE;
4840604e
TL		 3470 /* used long way of dmarc_exim_expand_query() in case we need more
3471 * view into the process in the future. */
3472 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3473 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3474 break;
3475 #endif
3476
059ec3d9
PH		 3477 case ACLC_DNSLISTS:
3478 rc = verify_check_dnsbl(&arg);
3479 break;
3480
3481 case ACLC_DOMAINS:
3482 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3483 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
3484 break;
3485
3486 /* The value in tls_cipher is the full cipher name, for example,
3487 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3488 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3489 what may in practice come out of the SSL library - which at the time of
3490 writing is poorly documented. */
3491
3492 case ACLC_ENCRYPTED:
817d9f57 3493 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3494 {
3495 uschar *endcipher = NULL;
817d9f57
JH		 3496 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3497 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3498 {
3499 endcipher = Ustrchr(++cipher, ':');
3500 if (endcipher != NULL) *endcipher = 0;
3501 }
3502 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3503 if (endcipher != NULL) *endcipher = ':';
3504 }
3505 break;
3506
3507 /* Use verify_check_this_host() instead of verify_check_host() so that
3508 we can pass over &host_data to catch any looked up data. Once it has been
3509 set, it retains its value so that it's still there if another ACL verb
3510 comes through here and uses the cache. However, we must put it into
3511 permanent store in case it is also expected to be used in a subsequent
3512 message in the same SMTP connection. */
3513
3514 case ACLC_HOSTS:
3515 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3516 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
3517 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3518 break;
3519
3520 case ACLC_LOCAL_PARTS:
3521 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3522 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3523 &deliver_localpart_data);
3524 break;
3525
6ea85e9a
PH		 3526 case ACLC_LOG_REJECT_TARGET:
3527 {
3528 int logbits = 0;
3529 int sep = 0;
3530 uschar *s = arg;
3531 uschar *ss;
3532 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3533 != NULL)
3534 {
3535 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3536 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3537 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3538 else
3539 {
3540 logbits |= LOG_MAIN|LOG_REJECT;
3541 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3542 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3543 }
3544 }
3545 log_reject_target = logbits;
3546 }
3547 break;
3548
059ec3d9
PH		 3549 case ACLC_LOGWRITE:
3550 {
3551 int logbits = 0;
3552 uschar *s = arg;
3553 if (*s == ':')
3554 {
3555 s++;
3556 while (*s != ':')
3557 {
3558 if (Ustrncmp(s, "main", 4) == 0)
3559 { logbits |= LOG_MAIN; s += 4; }
3560 else if (Ustrncmp(s, "panic", 5) == 0)
3561 { logbits |= LOG_PANIC; s += 5; }
3562 else if (Ustrncmp(s, "reject", 6) == 0)
3563 { logbits |= LOG_REJECT; s += 6; }
3564 else
3565 {
3566 logbits = LOG_MAIN|LOG_PANIC;
3567 s = string_sprintf(":unknown log name in \"%s\" in "
3568 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3569 }
3570 if (*s == ',') s++;
3571 }
3572 s++;
3573 }
3574 while (isspace(*s)) s++;
6ea85e9a
PH		 3575
3576
059ec3d9
PH		 3577 if (logbits == 0) logbits = LOG_MAIN;
3578 log_write(0, logbits, "%s", string_printing(s));
3579 }
3580 break;
8e669ac1 3581
71fafd95 3582 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3583 case ACLC_MALWARE:
3584 {
6ea85e9a 3585 /* Separate the regular expression and any optional parameters. */
8523533c
TK		 3586 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3587 /* Run the malware backend. */
3588 rc = malware(&ss);
3589 /* Modify return code based upon the existance of options. */
3590 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3591 != NULL) {
3592 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3593 {
3594 /* FAIL so that the message is passed to the next ACL */
3595 rc = FAIL;
3596 }
3597 }
3598 }
3599 break;
3600
3601 case ACLC_MIME_REGEX:
71fafd95 3602 rc = mime_regex(&arg);
8523533c 3603 break;
71fafd95 3604 #endif
059ec3d9 3605
870f6ba8 3606 case ACLC_RATELIMIT:
90fc3069 3607 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3608 break;
3609
059ec3d9
PH		 3610 case ACLC_RECIPIENTS:
3611 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3612 &recipient_data);
3613 break;
3614
71fafd95
PH		 3615 #ifdef WITH_CONTENT_SCAN
3616 case ACLC_REGEX:
3617 rc = regex(&arg);
8523533c 3618 break;
71fafd95 3619 #endif
8523533c 3620
e7568d51
TL		 3621 case ACLC_REMOVE_HEADER:
3622 setup_remove_header(arg);
3623 break;
3624
059ec3d9
PH		 3625 case ACLC_SENDER_DOMAINS:
3626 {
3627 uschar *sdomain;
3628 sdomain = Ustrrchr(sender_address, '@');
3629 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3630 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3631 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3632 }
3633 break;
3634
3635 case ACLC_SENDERS:
3636 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
3637 sender_address_cache, -1, 0, &sender_data);
3638 break;
3639
3640 /* Connection variables must persist forever */
3641
3642 case ACLC_SET:
3643 {
3644 int old_pool = store_pool;
38a0a95f
PH		 3645 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3646 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3647 store_pool = old_pool;
3648 }
3649 break;
3650
71fafd95 3651 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3652 case ACLC_SPAM:
3653 {
3654 /* Seperate the regular expression and any optional parameters. */
3655 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3656 /* Run the spam backend. */
3657 rc = spam(&ss);
3658 /* Modify return code based upon the existance of options. */
3659 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3660 != NULL) {
3661 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3662 {
3663 /* FAIL so that the message is passed to the next ACL */
3664 rc = FAIL;
3665 }
3666 }
3667 }
3668 break;
71fafd95 3669 #endif
8523533c 3670
71fafd95 3671 #ifdef EXPERIMENTAL_SPF
8523533c 3672 case ACLC_SPF:
65a7d8c3
NM		 3673 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3674 break;
3675 case ACLC_SPF_GUESS:
3676 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3677 break;
71fafd95 3678 #endif
8523533c 3679
b0019c78
TF		 3680 case ACLC_UDPSEND:
3681 rc = acl_udpsend(arg, log_msgptr);
3682 break;
3683
059ec3d9
PH		 3684 /* If the verb is WARN, discard any user message from verification, because
3685 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3686 only from explicit "message" modifiers. However, put the user message into
3687 $acl_verify_message so it can be used in subsequent conditions or modifiers
3688 (until something changes it). */
059ec3d9
PH		 3689
3690 case ACLC_VERIFY:
3691 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3692 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3693 if (verb == ACL_WARN) *user_msgptr = NULL;
3694 break;
3695
3696 default:
3697 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3698 "condition %d", cb->type);
3699 break;
3700 }
3701
3702 /* If a condition was negated, invert OK/FAIL. */
3703
3704 if (!cond_modifiers[cb->type] && cb->u.negated)
3705 {
3706 if (rc == OK) rc = FAIL;
3707 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3708 }
3709
3710 if (rc != OK) break; /* Conditions loop */
3711 }
3712
3713
3714/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3715handle the values of these modifiers. If there isn't a log message set, we make
3716it the same as the user message.
059ec3d9
PH		 3717
3718"message" is a user message that will be included in an SMTP response. Unless
3719it is empty, it overrides any previously set user message.
3720
3721"log_message" is a non-user message, and it adds to any existing non-user
3722message that is already set.
3723
4e88a19f
PH		 3724Most verbs have but a single return for which the messages are relevant, but
3725for "discard", it's useful to have the log message both when it succeeds and
3726when it fails. For "accept", the message is used in the OK case if there is no
3727"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3728present. */
059ec3d9 3729
4e88a19f
PH		 3730if (*epp && rc == OK) user_message = NULL;
3731
3732if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3733 {
3734 uschar *expmessage;
4e88a19f
PH		 3735 uschar *old_user_msgptr = *user_msgptr;
3736 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3737
3738 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3739 nested ACLs) are always discarded. This also happens for acceptance verbs
3740 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3741 However, the value of an existing message is available in $acl_verify_message
3742 during expansions. */
3743
4e88a19f
PH		 3744 if (verb == ACL_WARN ||
3745 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3746 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3747
3748 if (user_message != NULL)
3749 {
3750 acl_verify_message = old_user_msgptr;
3751 expmessage = expand_string(user_message);
3752 if (expmessage == NULL)
3753 {
3754 if (!expand_string_forcedfail)
3755 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3756 user_message, expand_string_message);
3757 }
3758 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3759 }
3760
3761 if (log_message != NULL)
3762 {
3763 acl_verify_message = old_log_msgptr;
3764 expmessage = expand_string(log_message);
3765 if (expmessage == NULL)
3766 {
3767 if (!expand_string_forcedfail)
3768 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3769 log_message, expand_string_message);
3770 }
3771 else if (expmessage[0] != 0)
3772 {
3773 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3774 string_sprintf("%s: %s", expmessage, *log_msgptr);
3775 }
3776 }
3777
3778 /* If no log message, default it to the user message */
3779
3780 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3781 }
3782
3783acl_verify_message = NULL;
3784return rc;
3785}
3786
3787
3788
3789
3790
3791/*************************************************
3792* Get line from a literal ACL *
3793*************************************************/
3794
3795/* This function is passed to acl_read() in order to extract individual lines
3796of a literal ACL, which we access via static pointers. We can destroy the
3797contents because this is called only once (the compiled ACL is remembered).
3798
3799This code is intended to treat the data in the same way as lines in the main
3800Exim configuration file. That is:
3801
3802 . Leading spaces are ignored.
3803
3804 . A \ at the end of a line is a continuation - trailing spaces after the \
3805 are permitted (this is because I don't believe in making invisible things
3806 significant). Leading spaces on the continued part of a line are ignored.
3807
3808 . Physical lines starting (significantly) with # are totally ignored, and
3809 may appear within a sequence of backslash-continued lines.
3810
3811 . Blank lines are ignored, but will end a sequence of continuations.
3812
3813Arguments: none
3814Returns: a pointer to the next line
3815*/
3816
3817
3818static uschar *acl_text; /* Current pointer in the text */
3819static uschar *acl_text_end; /* Points one past the terminating '0' */
3820
3821
3822static uschar *
3823acl_getline(void)
3824{
3825uschar *yield;
3826
3827/* This loop handles leading blank lines and comments. */
3828
3829for(;;)
3830 {
3831 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3832 if (*acl_text == 0) return NULL; /* No more data */
3833 yield = acl_text; /* Potential data line */
3834
3835 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3836
3837 /* If we hit the end before a newline, we have the whole logical line. If
3838 it's a comment, there's no more data to be given. Otherwise, yield it. */
3839
3840 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3841
3842 /* After reaching a newline, end this loop if the physical line does not
3843 start with '#'. If it does, it's a comment, and the loop continues. */
3844
3845 if (*yield != '#') break;
3846 }
3847
3848/* This loop handles continuations. We know we have some real data, ending in
3849newline. See if there is a continuation marker at the end (ignoring trailing
3850white space). We know that *yield is not white space, so no need to test for
3851cont > yield in the backwards scanning loop. */
3852
3853for(;;)
3854 {
3855 uschar *cont;
3856 for (cont = acl_text - 1; isspace(*cont); cont--);
3857
3858 /* If no continuation follows, we are done. Mark the end of the line and
3859 return it. */
3860
3861 if (*cont != '\\')
3862 {
3863 *acl_text++ = 0;
3864 return yield;
3865 }
3866
3867 /* We have encountered a continuation. Skip over whitespace at the start of
3868 the next line, and indeed the whole of the next line or lines if they are
3869 comment lines. */
3870
3871 for (;;)
3872 {
3873 while (*(++acl_text) == ' ' || *acl_text == '\t');
3874 if (*acl_text != '#') break;
3875 while (*(++acl_text) != 0 && *acl_text != '\n');
3876 }
3877
3878 /* We have the start of a continuation line. Move all the rest of the data
3879 to join onto the previous line, and then find its end. If the end is not a
3880 newline, we are done. Otherwise loop to look for another continuation. */
3881
3882 memmove(cont, acl_text, acl_text_end - acl_text);
3883 acl_text_end -= acl_text - cont;
3884 acl_text = cont;
3885 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3886 if (*acl_text == 0) return yield;
3887 }
3888
3889/* Control does not reach here */
3890}
3891
3892
3893
3894
3895
3896/*************************************************
3897* Check access using an ACL *
3898*************************************************/
3899
3900/* This function is called from address_check. It may recurse via
3901acl_check_condition() - hence the use of a level to stop looping. The ACL is
3902passed as a string which is expanded. A forced failure implies no access check
3903is required. If the result is a single word, it is taken as the name of an ACL
3904which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3905text, complete with newlines, and parsed as such. In both cases, the ACL check
3906is then run. This function uses an auxiliary function for acl_read() to call
3907for reading individual lines of a literal ACL. This is acl_getline(), which
3908appears immediately above.
3909
3910Arguments:
3911 where where called from
3912 addr address item when called from RCPT; otherwise NULL
3913 s the input string; NULL is the same as an empty ACL => DENY
3914 level the nesting level
3915 user_msgptr where to put a user error (for SMTP response)
3916 log_msgptr where to put a logging message (not for SMTP response)
3917
3918Returns: OK access is granted
3919 DISCARD access is apparently granted...
3920 FAIL access is denied
3921 FAIL_DROP access is denied; drop the connection
3922 DEFER can't tell at the moment
3923 ERROR disaster
3924*/
3925
3926static int
3927acl_check_internal(int where, address_item *addr, uschar *s, int level,
3928 uschar **user_msgptr, uschar **log_msgptr)
3929{
3930int fd = -1;
3931acl_block *acl = NULL;
3932uschar *acl_name = US"inline ACL";
3933uschar *ss;
3934
3935/* Catch configuration loops */
3936
3937if (level > 20)
3938 {
3939 *log_msgptr = US"ACL nested too deep: possible loop";
3940 return ERROR;
3941 }
3942
3943if (s == NULL)
3944 {
3945 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3946 return FAIL;
3947 }
3948
3949/* At top level, we expand the incoming string. At lower levels, it has already
3950been expanded as part of condition processing. */
3951
3952if (level == 0)
3953 {
3954 ss = expand_string(s);
3955 if (ss == NULL)
3956 {
3957 if (expand_string_forcedfail) return OK;
3958 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3959 expand_string_message);
3960 return ERROR;
3961 }
3962 }
3963else ss = s;
3964
3965while (isspace(*ss))ss++;
3966
3967/* If we can't find a named ACL, the default is to parse it as an inline one.
3968(Unless it begins with a slash; non-existent files give rise to an error.) */
3969
3970acl_text = ss;
3971
3972/* Handle the case of a string that does not contain any spaces. Look for a
3973named ACL among those read from the configuration, or a previously read file.
3974It is possible that the pointer to the ACL is NULL if the configuration
3975contains a name with no data. If not found, and the text begins with '/',
3976read an ACL from a file, and save it so it can be re-used. */
3977
3978if (Ustrchr(ss, ' ') == NULL)
3979 {
3980 tree_node *t = tree_search(acl_anchor, ss);
3981 if (t != NULL)
3982 {
3983 acl = (acl_block *)(t->data.ptr);
3984 if (acl == NULL)
3985 {
3986 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3987 return FAIL;
3988 }
3989 acl_name = string_sprintf("ACL \"%s\"", ss);
3990 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3991 }
3992
3993 else if (*ss == '/')
3994 {
3995 struct stat statbuf;
3996 fd = Uopen(ss, O_RDONLY, 0);
3997 if (fd < 0)
3998 {
3999 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4000 strerror(errno));
4001 return ERROR;
4002 }
4003
4004 if (fstat(fd, &statbuf) != 0)
4005 {
4006 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4007 strerror(errno));
4008 return ERROR;
4009 }
4010
4011 acl_text = store_get(statbuf.st_size + 1);
4012 acl_text_end = acl_text + statbuf.st_size + 1;
4013
4014 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4015 {
4016 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4017 ss, strerror(errno));
4018 return ERROR;
4019 }
4020 acl_text[statbuf.st_size] = 0;
f1e894f3 4021 (void)close(fd);
059ec3d9
PH		 4022
4023 acl_name = string_sprintf("ACL \"%s\"", ss);
4024 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4025 }
4026 }
4027
4028/* Parse an ACL that is still in text form. If it came from a file, remember it
4029in the ACL tree, having read it into the POOL_PERM store pool so that it
4030persists between multiple messages. */
4031
4032if (acl == NULL)
4033 {
4034 int old_pool = store_pool;
4035 if (fd >= 0) store_pool = POOL_PERM;
4036 acl = acl_read(acl_getline, log_msgptr);
4037 store_pool = old_pool;
4038 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4039 if (fd >= 0)
4040 {
4041 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4042 Ustrcpy(t->name, ss);
4043 t->data.ptr = acl;
4044 (void)tree_insertnode(&acl_anchor, t);
4045 }
4046 }
4047
4048/* Now we have an ACL to use. It's possible it may be NULL. */
4049
4050while (acl != NULL)
4051 {
4052 int cond;
4053 int basic_errno = 0;
4054 BOOL endpass_seen = FALSE;
4055
4056 *log_msgptr = *user_msgptr = NULL;
4057 acl_temp_details = FALSE;
4058
7353285c 4059 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
059ec3d9
PH		 4060 acl->verb != ACL_ACCEPT &&
4061 acl->verb != ACL_WARN)
4062 {
7353285c 4063 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
059ec3d9
PH		 4064 verbs[acl->verb]);
4065 return ERROR;
4066 }
4067
4068 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4069
4070 /* Clear out any search error message from a previous check before testing
4071 this condition. */
4072
4073 search_error_message = NULL;
4074 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4075 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4076
4077 /* Handle special returns: DEFER causes a return except on a WARN verb;
4078 ERROR always causes a return. */
4079
4080 switch (cond)
4081 {
4082 case DEFER:
6968512f 4083 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4084 if (basic_errno != ERRNO_CALLOUTDEFER)
4085 {
4086 if (search_error_message != NULL && *search_error_message != 0)
4087 *log_msgptr = search_error_message;
4088 if (smtp_return_error_details) acl_temp_details = TRUE;
4089 }
4090 else
4091 {
4092 acl_temp_details = TRUE;
4093 }
4094 if (acl->verb != ACL_WARN) return DEFER;
4095 break;
4096
4097 default: /* Paranoia */
4098 case ERROR:
6968512f 4099 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4100 return ERROR;
4101
4102 case OK:
6968512f
JH		 4103 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4104 verbs[acl->verb], acl_name);
059ec3d9
PH		 4105 break;
4106
4107 case FAIL:
6968512f 4108 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4109 break;
4110
4111 /* DISCARD and DROP can happen only from a nested ACL condition, and
4112 DISCARD can happen only for an "accept" or "discard" verb. */
4113
4114 case DISCARD:
6968512f
JH		 4115 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4116 verbs[acl->verb], acl_name);
059ec3d9
PH		 4117 break;
4118
4119 case FAIL_DROP:
6968512f
JH		 4120 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4121 verbs[acl->verb], acl_name);
059ec3d9
PH		 4122 break;
4123 }
4124
4125 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4126 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4127 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4128
4129 switch(acl->verb)
4130 {
4131 case ACL_ACCEPT:
4132 if (cond == OK || cond == DISCARD) return cond;
4133 if (endpass_seen)
4134 {
4135 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4136 return cond;
4137 }
4138 break;
4139
4140 case ACL_DEFER:
4141 if (cond == OK)
4142 {
4143 acl_temp_details = TRUE;
4144 return DEFER;
4145 }
4146 break;
4147
4148 case ACL_DENY:
4149 if (cond == OK) return FAIL;
4150 break;
4151
4152 case ACL_DISCARD:
4153 if (cond == OK || cond == DISCARD) return DISCARD;
4154 if (endpass_seen)
4155 {
4156 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4157 return cond;
4158 }
4159 break;
4160
4161 case ACL_DROP:
4162 if (cond == OK) return FAIL_DROP;
4163 break;
4164
4165 case ACL_REQUIRE:
4166 if (cond != OK) return cond;
4167 break;
4168
4169 case ACL_WARN:
4170 if (cond == OK)
4171 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4172 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4173 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4174 "condition test deferred%s%s", host_and_ident(TRUE),
4175 (*log_msgptr == NULL)? US"" : US": ",
4176 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4177 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4178 break;
4179
4180 default:
4181 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4182 acl->verb);
4183 break;
4184 }
4185
4186 /* Pass to the next ACL item */
4187
4188 acl = acl->next;
4189 }
4190
4191/* We have reached the end of the ACL. This is an implicit DENY. */
4192
4193HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4194return FAIL;
4195}
4196
4197
333eea9c
JH		 4198
4199
4200/* Same args as acl_check_internal() above, but the string s is
4201the name of an ACL followed optionally by up to 9 space-separated arguments.
4202The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8
JH		 4203static int
4204acl_check_wargs(int where, address_item *addr, uschar *s, int level,
333eea9c
JH		 4205 uschar **user_msgptr, uschar **log_msgptr)
4206{
4207uschar * tmp;
bef3ea7f 4208uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4209uschar * sav_arg[9]; /* must match acl_arg[] */
4210int sav_narg;
333eea9c 4211uschar * name;
bef3ea7f 4212int i;
ef21c07d 4213int ret;
333eea9c
JH		 4214
4215if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4216 goto bad;
4217
bef3ea7f 4218for (i = 0; i < 9; i++)
333eea9c
JH		 4219 {
4220 while (*s && isspace(*s)) s++;
4221 if (!*s) break;
bef3ea7f 4222 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4223 {
4224 tmp = name;
4225 goto bad;
4226 }
4227 }
ef21c07d
JH		 4228
4229sav_narg = acl_narg;
bef3ea7f 4230acl_narg = i;
ef21c07d
JH		 4231for (i = 0; i < acl_narg; i++)
4232 {
4233 sav_arg[i] = acl_arg[i];
4234 acl_arg[i] = tmp_arg[i];
4235 }
4236while (i < 9)
4237 {
4238 sav_arg[i] = acl_arg[i];
4239 acl_arg[i++] = NULL;
4240 }
4241
4242ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4243
ef21c07d
JH		 4244acl_narg = sav_narg;
4245for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4246return ret;
333eea9c
JH		 4247
4248bad:
4249if (expand_string_forcedfail) return ERROR;
4250*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4251 tmp, expand_string_message);
4252return search_find_defer?DEFER:ERROR;
4253}
4254
4255
4256
059ec3d9
PH		 4257/*************************************************
4258* Check access using an ACL *
4259*************************************************/
4260
faa05a93
JH		 4261/* Alternate interface for ACL, used by expansions */
4262int
05caaeaa 4263acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4264{
faa05a93
JH		 4265address_item adb;
4266address_item *addr = NULL;
4267
4268*user_msgptr = *log_msgptr = NULL;
4269sender_verified_failed = NULL;
4270ratelimiters_cmd = NULL;
4271log_reject_target = LOG_MAIN|LOG_REJECT;
4272
4273if (where == ACL_WHERE_RCPT)
4274 {
4275 adb = address_defaults;
4276 addr = &adb;
05caaeaa
JH		 4277 addr->address = expand_string(US"$local_part@$domain");
4278 addr->domain = deliver_domain;
4279 addr->local_part = deliver_localpart;
4280 addr->cc_local_part = deliver_localpart;
4281 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4282 }
4283
4284return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4285}
4286
4287
4288
059ec3d9
PH		 4289/* This is the external interface for ACL checks. It sets up an address and the
4290expansions for $domain and $local_part when called after RCPT, then calls
4291acl_check_internal() to do the actual work.
4292
4293Arguments:
4294 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4295 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4296 s the input string; NULL is the same as an empty ACL => DENY
4297 user_msgptr where to put a user error (for SMTP response)
4298 log_msgptr where to put a logging message (not for SMTP response)
4299
4300Returns: OK access is granted by an ACCEPT verb
4301 DISCARD access is granted by a DISCARD verb
4302 FAIL access is denied
4303 FAIL_DROP access is denied; drop the connection
4304 DEFER can't tell at the moment
4305 ERROR disaster
4306*/
faa05a93 4307int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4308
4309int
64ffc24f 4310acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4311 uschar **log_msgptr)
4312{
4313int rc;
4314address_item adb;
64ffc24f 4315address_item *addr = NULL;
059ec3d9
PH		 4316
4317*user_msgptr = *log_msgptr = NULL;
4318sender_verified_failed = NULL;
fe0dab11 4319ratelimiters_cmd = NULL;
6ea85e9a 4320log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4321
8ccd00b1 4322#ifndef DISABLE_PRDR
fd98a5c6
JH		 4323if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR )
4324#else
4325if (where == ACL_WHERE_RCPT )
4326#endif
059ec3d9
PH		 4327 {
4328 adb = address_defaults;
4329 addr = &adb;
64ffc24f 4330 addr->address = recipient;
059ec3d9
PH		 4331 if (deliver_split_address(addr) == DEFER)
4332 {
4333 *log_msgptr = US"defer in percent_hack_domains check";
4334 return DEFER;
4335 }
4336 deliver_domain = addr->domain;
4337 deliver_localpart = addr->local_part;
4338 }
059ec3d9 4339
faa05a93 4340acl_where = where;
059ec3d9 4341rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4342acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4343
817d9f57
JH		 4344/* Cutthrough - if requested,
4345and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4346and rcpt acl returned accept,
4347and first recipient (cancel on any subsequents)
e4bdf652 4348open one now and run it up to RCPT acceptance.
e4bdf652 4349A failed verify should cancel cutthrough request.
e4bdf652 4350
817d9f57 4351Initial implementation: dual-write to spool.
e4bdf652
JH		 4352Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4353
4354Cease cutthrough copy on rxd final dot; do not send one.
4355
4356On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4357
4358On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4359perm-rejected, reflect that to the original sender - and dump the spooled copy.
4360If temp-reject, close the conn (and keep the spooled copy).
4361If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4362*/
4363switch (where)
4364{
4365case ACL_WHERE_RCPT:
8ccd00b1 4366#ifndef DISABLE_PRDR
fd98a5c6
JH		 4367case ACL_WHERE_PRDR:
4368#endif
e4bdf652 4369 if( rcpt_count > 1 )
2e5b33cd 4370 cancel_cutthrough_connection("more than one recipient");
e4bdf652
JH		 4371 else if (rc == OK && cutthrough_delivery && cutthrough_fd < 0)
4372 open_cutthrough_connection(addr);
4373 break;
4374
4375case ACL_WHERE_PREDATA:
4376 if( rc == OK )
4377 cutthrough_predata();
4378 else
2e5b33cd 4379 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4380 break;
4381
4382case ACL_WHERE_QUIT:
4383case ACL_WHERE_NOTQUIT:
2e5b33cd 4384 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4385 break;
4386
4387default:
4388 break;
4389}
4390
64ffc24f
PH		 4391deliver_domain = deliver_localpart = deliver_address_data =
4392 sender_address_data = NULL;
059ec3d9
PH		 4393
4394/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4395ACL, which is really in the middle of an SMTP command. */
4396
4397if (rc == DISCARD)
4398 {
4399 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4400 {
4401 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4402 "ACL", acl_wherenames[where]);
4403 return ERROR;
4404 }
4405 return DISCARD;
4406 }
4407
4408/* A DROP response is not permitted from MAILAUTH */
4409
4410if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4411 {
4412 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4413 "ACL", acl_wherenames[where]);
4414 return ERROR;
4415 }
4416
4e88a19f
PH		 4417/* Before giving a response, take a look at the length of any user message, and
4418split it up into multiple lines if possible. */
059ec3d9 4419
e28326d8
PH		 4420*user_msgptr = string_split_message(*user_msgptr);
4421if (fake_response != OK)
4422 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4423
4424return rc;
4425}
4426
38a0a95f 4427
38a0a95f
PH		 4428/*************************************************
4429* Create ACL variable *
4430*************************************************/
4431
4432/* Create an ACL variable or reuse an existing one. ACL variables are in a
4433binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4434
4435Argument:
4436 name pointer to the variable's name, starting with c or m
4437
4438Returns the pointer to variable's tree node
4439*/
4440
4441tree_node *
4442acl_var_create(uschar *name)
4443{
4444tree_node *node, **root;
4445root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4446node = tree_search(*root, name);
4447if (node == NULL)
4448 {
4449 node = store_get(sizeof(tree_node) + Ustrlen(name));
4450 Ustrcpy(node->name, name);
4451 (void)tree_insertnode(root, node);
4452 }
4453node->data.ptr = NULL;
4454return node;
4455}
4456
4457
4458
4459/*************************************************
4460* Write an ACL variable in spool format *
4461*************************************************/
4462
4463/* This function is used as a callback for tree_walk when writing variables to
4464the spool file. To retain spool file compatibility, what is written is -aclc or
4465-aclm followed by the rest of the name and the data length, space separated,
4466then the value itself, starting on a new line, and terminated by an additional
4467newline. When we had only numbered ACL variables, the first line might look
4468like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4469acl_cfoo.
4470
4471Arguments:
4472 name of the variable
4473 value of the variable
4474 ctx FILE pointer (as a void pointer)
4475
4476Returns: nothing
4477*/
4478
4479void
4480acl_var_write(uschar *name, uschar *value, void *ctx)
4481{
4482FILE *f = (FILE *)ctx;
4483fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4484}
4485
9171d434
JH		 4486/* vi: aw ai sw=2
4487*/
059ec3d9 4488/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.