projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
DMARC support by opendmarc libs
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
c4ceed07 5/* Copyright (c) University of Cambridge 1995 - 2012 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
24static uschar *verbs[] =
25 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
26 US"warn" };
27
4e88a19f
PH		 28/* For each verb, the conditions for which "message" or "log_message" are used
29are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
30"accept", the FAIL case is used only after "endpass", but that is selected in
31the code. */
32
33static int msgcond[] = {
34 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
35 (1<<OK), /* defer */
36 (1<<OK), /* deny */
37 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
38 (1<<OK), /* drop */
39 (1<<FAIL) | (1<<FAIL_DROP), /* require */
40 (1<<OK) /* warn */
41 };
059ec3d9
PH		 42
43/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 44follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
45down. */
059ec3d9 46
71fafd95
PH		 47enum { ACLC_ACL,
48 ACLC_ADD_HEADER,
49 ACLC_AUTHENTICATED,
8523533c
TK		 50#ifdef EXPERIMENTAL_BRIGHTMAIL
51 ACLC_BMI_OPTIN,
52#endif
71fafd95 53 ACLC_CONDITION,
c3611384 54 ACLC_CONTINUE,
71fafd95 55 ACLC_CONTROL,
6a8f9482
TK		 56#ifdef EXPERIMENTAL_DCC
57 ACLC_DCC,
58#endif
8523533c
TK		 59#ifdef WITH_CONTENT_SCAN
60 ACLC_DECODE,
61#endif
62 ACLC_DELAY,
63#ifdef WITH_OLD_DEMIME
64 ACLC_DEMIME,
fb2274d4 65#endif
80a47a2c
TK		 66#ifndef DISABLE_DKIM
67 ACLC_DKIM_SIGNER,
68 ACLC_DKIM_STATUS,
4840604e
TL		 69#endif
70#ifdef EXPERIMENTAL_DMARC
71 ACLC_DMARC_STATUS,
8e669ac1 72#endif
71fafd95
PH		 73 ACLC_DNSLISTS,
74 ACLC_DOMAINS,
75 ACLC_ENCRYPTED,
76 ACLC_ENDPASS,
77 ACLC_HOSTS,
78 ACLC_LOCAL_PARTS,
79 ACLC_LOG_MESSAGE,
6ea85e9a 80 ACLC_LOG_REJECT_TARGET,
71fafd95 81 ACLC_LOGWRITE,
8523533c
TK		 82#ifdef WITH_CONTENT_SCAN
83 ACLC_MALWARE,
84#endif
85 ACLC_MESSAGE,
86#ifdef WITH_CONTENT_SCAN
87 ACLC_MIME_REGEX,
88#endif
870f6ba8 89 ACLC_RATELIMIT,
8523533c
TK		 90 ACLC_RECIPIENTS,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_REGEX,
93#endif
e7568d51 94 ACLC_REMOVE_HEADER,
71fafd95
PH		 95 ACLC_SENDER_DOMAINS,
96 ACLC_SENDERS,
97 ACLC_SET,
8523533c 98#ifdef WITH_CONTENT_SCAN
8e669ac1 99 ACLC_SPAM,
8523533c
TK		 100#endif
101#ifdef EXPERIMENTAL_SPF
102 ACLC_SPF,
65a7d8c3 103 ACLC_SPF_GUESS,
8523533c
TK		 104#endif
105 ACLC_VERIFY };
059ec3d9 106
c3611384
PH		 107/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
108"message", "log_message", "log_reject_target", "logwrite", and "set" are
109modifiers that look like conditions but always return TRUE. They are used for
110their side effects. */
059ec3d9 111
9a26b6b2
PH		 112static uschar *conditions[] = {
113 US"acl",
71fafd95 114 US"add_header",
9a26b6b2 115 US"authenticated",
8523533c
TK		 116#ifdef EXPERIMENTAL_BRIGHTMAIL
117 US"bmi_optin",
118#endif
119 US"condition",
c3611384 120 US"continue",
8e669ac1 121 US"control",
6a8f9482
TK		 122#ifdef EXPERIMENTAL_DCC
123 US"dcc",
124#endif
8523533c
TK		 125#ifdef WITH_CONTENT_SCAN
126 US"decode",
127#endif
128 US"delay",
129#ifdef WITH_OLD_DEMIME
130 US"demime",
fb2274d4 131#endif
80a47a2c
TK		 132#ifndef DISABLE_DKIM
133 US"dkim_signers",
134 US"dkim_status",
4840604e
TL		 135#endif
136#ifdef EXPERIMENTAL_DMARC
137 US"dmarc_status",
8523533c 138#endif
6ea85e9a
PH		 139 US"dnslists",
140 US"domains",
141 US"encrypted",
142 US"endpass",
143 US"hosts",
144 US"local_parts",
145 US"log_message",
146 US"log_reject_target",
147 US"logwrite",
8523533c
TK		 148#ifdef WITH_CONTENT_SCAN
149 US"malware",
150#endif
151 US"message",
152#ifdef WITH_CONTENT_SCAN
153 US"mime_regex",
154#endif
870f6ba8 155 US"ratelimit",
8523533c
TK		 156 US"recipients",
157#ifdef WITH_CONTENT_SCAN
158 US"regex",
159#endif
e7568d51 160 US"remove_header",
8523533c
TK		 161 US"sender_domains", US"senders", US"set",
162#ifdef WITH_CONTENT_SCAN
163 US"spam",
164#endif
165#ifdef EXPERIMENTAL_SPF
166 US"spf",
65a7d8c3 167 US"spf_guess",
8523533c 168#endif
059ec3d9 169 US"verify" };
8e669ac1 170
c5fcb476 171
9a26b6b2
PH		 172/* Return values from decode_control(); keep in step with the table of names
173that follows! */
174
175enum {
c46782ef
PH		 176 CONTROL_AUTH_UNADVERTISED,
177 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 178 CONTROL_BMI_RUN,
c46782ef 179 #endif
ed7f7860 180 CONTROL_DEBUG,
80a47a2c 181 #ifndef DISABLE_DKIM
f7572e5a
TK		 182 CONTROL_DKIM_VERIFY,
183 #endif
4840604e
TL		 184 #ifdef EXPERIMENTAL_DMARC
185 CONTROL_DMARC_VERIFY,
186 CONTROL_DMARC_FORENSIC,
187 #endif
13363eba 188 CONTROL_DSCP,
c46782ef
PH		 189 CONTROL_ERROR,
190 CONTROL_CASEFUL_LOCAL_PART,
191 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 192 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 193 CONTROL_ENFORCE_SYNC,
194 CONTROL_NO_ENFORCE_SYNC,
195 CONTROL_FREEZE,
196 CONTROL_QUEUE_ONLY,
197 CONTROL_SUBMISSION,
198 CONTROL_SUPPRESS_LOCAL_FIXUPS,
199 #ifdef WITH_CONTENT_SCAN
9a26b6b2 200 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH		 201 #endif
202 CONTROL_FAKEDEFER,
203 CONTROL_FAKEREJECT,
cf8b11a5 204 CONTROL_NO_MULTILINE,
047bdd8c 205 CONTROL_NO_PIPELINING,
4c590bd1
PH		 206 CONTROL_NO_DELAY_FLUSH,
207 CONTROL_NO_CALLOUT_FLUSH
c46782ef 208};
9a26b6b2 209
8800895a
PH		 210/* ACL control names; keep in step with the table above! This list is used for
211turning ids into names. The actual list of recognized names is in the variable
212control_def controls_list[] below. The fact that there are two lists is a mess
213and should be tidied up. */
9a26b6b2
PH		 214
215static uschar *controls[] = {
c46782ef 216 US"allow_auth_unadvertised",
9a26b6b2
PH		 217 #ifdef EXPERIMENTAL_BRIGHTMAIL
218 US"bmi_run",
219 #endif
ed7f7860 220 US"debug",
80a47a2c
TK		 221 #ifndef DISABLE_DKIM
222 US"dkim_disable_verify",
f7572e5a 223 #endif
4840604e
TL		 224 #ifdef EXPERIMENTAL_DMARC
225 US"dmarc_disable_verify",
226 US"dmarc_enable_forensic",
227 #endif
13363eba 228 US"dscp",
c46782ef
PH		 229 US"error",
230 US"caseful_local_part",
231 US"caselower_local_part",
e4bdf652 232 US"cutthrough_delivery",
c46782ef
PH		 233 US"enforce_sync",
234 US"no_enforce_sync",
235 US"freeze",
236 US"queue_only",
237 US"submission",
238 US"suppress_local_fixups",
9a26b6b2
PH		 239 #ifdef WITH_CONTENT_SCAN
240 US"no_mbox_unspool",
241 #endif
cf8b11a5
PH		 242 US"fakedefer",
243 US"fakereject",
aa6dc513 244 US"no_multiline_responses",
cf8b11a5 245 US"no_pipelining",
4c590bd1
PH		 246 US"no_delay_flush",
247 US"no_callout_flush"
c46782ef 248};
059ec3d9 249
047bdd8c 250/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 251at the outer level. In the other cases, expansion already occurs in the
252checking functions. */
253
254static uschar cond_expand_at_top[] = {
7421ecab 255 FALSE, /* acl */
3e536984 256 TRUE, /* add_header */
059ec3d9 257 FALSE, /* authenticated */
8523533c
TK		 258#ifdef EXPERIMENTAL_BRIGHTMAIL
259 TRUE, /* bmi_optin */
8e669ac1 260#endif
059ec3d9 261 TRUE, /* condition */
c3611384 262 TRUE, /* continue */
059ec3d9 263 TRUE, /* control */
6a8f9482
TK		 264#ifdef EXPERIMENTAL_DCC
265 TRUE, /* dcc */
266#endif
8523533c
TK		 267#ifdef WITH_CONTENT_SCAN
268 TRUE, /* decode */
269#endif
059ec3d9 270 TRUE, /* delay */
8523533c
TK		 271#ifdef WITH_OLD_DEMIME
272 TRUE, /* demime */
fb2274d4 273#endif
80a47a2c
TK		 274#ifndef DISABLE_DKIM
275 TRUE, /* dkim_signers */
276 TRUE, /* dkim_status */
4840604e
TL		 277#endif
278#ifdef EXPERIMENTAL_DMARC
279 TRUE, /* dmarc_status */
8523533c 280#endif
059ec3d9
PH		 281 TRUE, /* dnslists */
282 FALSE, /* domains */
283 FALSE, /* encrypted */
284 TRUE, /* endpass */
285 FALSE, /* hosts */
286 FALSE, /* local_parts */
287 TRUE, /* log_message */
6ea85e9a 288 TRUE, /* log_reject_target */
059ec3d9 289 TRUE, /* logwrite */
8523533c
TK		 290#ifdef WITH_CONTENT_SCAN
291 TRUE, /* malware */
292#endif
059ec3d9 293 TRUE, /* message */
8523533c
TK		 294#ifdef WITH_CONTENT_SCAN
295 TRUE, /* mime_regex */
296#endif
870f6ba8 297 TRUE, /* ratelimit */
059ec3d9 298 FALSE, /* recipients */
8523533c
TK		 299#ifdef WITH_CONTENT_SCAN
300 TRUE, /* regex */
301#endif
e7568d51 302 TRUE, /* remove_header */
059ec3d9
PH		 303 FALSE, /* sender_domains */
304 FALSE, /* senders */
305 TRUE, /* set */
8523533c
TK		 306#ifdef WITH_CONTENT_SCAN
307 TRUE, /* spam */
308#endif
309#ifdef EXPERIMENTAL_SPF
310 TRUE, /* spf */
65a7d8c3 311 TRUE, /* spf_guess */
8523533c 312#endif
059ec3d9
PH		 313 TRUE /* verify */
314};
315
316/* Flags to identify the modifiers */
317
318static uschar cond_modifiers[] = {
319 FALSE, /* acl */
3e536984 320 TRUE, /* add_header */
059ec3d9 321 FALSE, /* authenticated */
8523533c
TK		 322#ifdef EXPERIMENTAL_BRIGHTMAIL
323 TRUE, /* bmi_optin */
8e669ac1 324#endif
059ec3d9 325 FALSE, /* condition */
c3611384 326 TRUE, /* continue */
059ec3d9 327 TRUE, /* control */
6a8f9482
TK		 328#ifdef EXPERIMENTAL_DCC
329 FALSE, /* dcc */
330#endif
8523533c
TK		 331#ifdef WITH_CONTENT_SCAN
332 FALSE, /* decode */
333#endif
059ec3d9 334 TRUE, /* delay */
8523533c
TK		 335#ifdef WITH_OLD_DEMIME
336 FALSE, /* demime */
fb2274d4 337#endif
80a47a2c
TK		 338#ifndef DISABLE_DKIM
339 FALSE, /* dkim_signers */
340 FALSE, /* dkim_status */
4840604e
TL		 341#endif
342#ifdef EXPERIMENTAL_DMARC
343 FALSE, /* dmarc_status */
8523533c 344#endif
059ec3d9
PH		 345 FALSE, /* dnslists */
346 FALSE, /* domains */
347 FALSE, /* encrypted */
348 TRUE, /* endpass */
349 FALSE, /* hosts */
350 FALSE, /* local_parts */
351 TRUE, /* log_message */
6ea85e9a 352 TRUE, /* log_reject_target */
8523533c
TK		 353 TRUE, /* logwrite */
354#ifdef WITH_CONTENT_SCAN
355 FALSE, /* malware */
356#endif
059ec3d9 357 TRUE, /* message */
8523533c
TK		 358#ifdef WITH_CONTENT_SCAN
359 FALSE, /* mime_regex */
360#endif
870f6ba8 361 FALSE, /* ratelimit */
059ec3d9 362 FALSE, /* recipients */
8523533c
TK		 363#ifdef WITH_CONTENT_SCAN
364 FALSE, /* regex */
365#endif
e7568d51 366 TRUE, /* remove_header */
059ec3d9
PH		 367 FALSE, /* sender_domains */
368 FALSE, /* senders */
369 TRUE, /* set */
8523533c
TK		 370#ifdef WITH_CONTENT_SCAN
371 FALSE, /* spam */
372#endif
373#ifdef EXPERIMENTAL_SPF
374 FALSE, /* spf */
65a7d8c3 375 FALSE, /* spf_guess */
8523533c 376#endif
059ec3d9
PH		 377 FALSE /* verify */
378};
379
c3611384 380/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 381times. For each condition and modifier, there's a bitmap of dis-allowed times.
382For some, it is easier to specify the negation of a small number of allowed
383times. */
059ec3d9
PH		 384
385static unsigned int cond_forbids[] = {
386 0, /* acl */
8e669ac1 387
71fafd95 388 (unsigned int)
45b91596 389 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 390 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 391 #ifdef EXPERIMENTAL_PRDR
392 (1<<ACL_WHERE_PRDR)|
393 #endif
45b91596 394 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 395 (1<<ACL_WHERE_DKIM)|
45b91596 396 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 397
45b91596
PH		 398 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
399 (1<<ACL_WHERE_NOTSMTP_START)|
400 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 401
71fafd95 402 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 403 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 404 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
405 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
fd98a5c6
JH		 406 #ifdef EXPERIMENTAL_PRDR
407 (1<<ACL_WHERE_PRDR)|
408 #endif
8e669ac1 409 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 410 (1<<ACL_WHERE_MAILAUTH)|
411 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 412 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
413 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 414 #endif
8e669ac1 415
059ec3d9 416 0, /* condition */
8e669ac1 417
c3611384
PH		 418 0, /* continue */
419
059ec3d9 420 /* Certain types of control are always allowed, so we let it through
2f079f46 421 always and check in the control processing itself. */
8e669ac1 422
059ec3d9 423 0, /* control */
8e669ac1 424
6a8f9482
TK		 425 #ifdef EXPERIMENTAL_DCC
426 (unsigned int)
fd98a5c6
JH		 427 ~((1<<ACL_WHERE_DATA)| /* dcc */
428 #ifdef EXPERIMENTAL_PRDR
429 (1<<ACL_WHERE_PRDR)|
430 #endif /* EXPERIMENTAL_PRDR */
431 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 432 #endif
433
71fafd95 434 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 435 (unsigned int)
436 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 437 #endif
8523533c 438
8f128379 439 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 440
71fafd95 441 #ifdef WITH_OLD_DEMIME
2f079f46 442 (unsigned int)
fd98a5c6
JH		 443 ~((1<<ACL_WHERE_DATA)| /* demime */
444 #ifdef EXPERIMENTAL_PRDR
445 (1<<ACL_WHERE_PRDR)|
446 #endif /* EXPERIMENTAL_PRDR */
447 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 448 #endif
8e669ac1 449
80a47a2c
TK		 450 #ifndef DISABLE_DKIM
451 (unsigned int)
452 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 453
80a47a2c
TK		 454 (unsigned int)
455 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 456 #endif
fb2274d4 457
4840604e
TL		 458 #ifdef EXPERIMENTAL_DMARC
459 (unsigned int)
460 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
461 #endif
462
45b91596
PH		 463 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
464 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 465
2f079f46 466 (unsigned int)
fd98a5c6
JH		 467 ~((1<<ACL_WHERE_RCPT) /* domains */
468 #ifdef EXPERIMENTAL_PRDR
469 |(1<<ACL_WHERE_PRDR)
470 #endif
471 ),
059ec3d9 472
45b91596
PH		 473 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
474 (1<<ACL_WHERE_CONNECT)|
475 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 476 (1<<ACL_WHERE_HELO),
8e669ac1 477
059ec3d9 478 0, /* endpass */
8e669ac1 479
45b91596
PH		 480 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
481 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 482
2f079f46 483 (unsigned int)
fd98a5c6
JH		 484 ~((1<<ACL_WHERE_RCPT) /* local_parts */
485 #ifdef EXPERIMENTAL_PRDR
486 |(1<<ACL_WHERE_PRDR)
487 #endif
488 ),
059ec3d9
PH		 489
490 0, /* log_message */
8e669ac1 491
6ea85e9a
PH		 492 0, /* log_reject_target */
493
059ec3d9 494 0, /* logwrite */
8e669ac1 495
71fafd95 496 #ifdef WITH_CONTENT_SCAN
2f079f46 497 (unsigned int)
fd98a5c6
JH		 498 ~((1<<ACL_WHERE_DATA)| /* malware */
499 #ifdef EXPERIMENTAL_PRDR
500 (1<<ACL_WHERE_PRDR)|
501 #endif /* EXPERIMENTAL_PRDR */
502 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 503 #endif
8523533c 504
059ec3d9
PH		 505 0, /* message */
506
71fafd95 507 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 508 (unsigned int)
509 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 510 #endif
8523533c 511
870f6ba8
TF		 512 0, /* ratelimit */
513
2f079f46
PH		 514 (unsigned int)
515 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 516
71fafd95 517 #ifdef WITH_CONTENT_SCAN
2f079f46 518 (unsigned int)
fd98a5c6
JH		 519 ~((1<<ACL_WHERE_DATA)| /* regex */
520 #ifdef EXPERIMENTAL_PRDR
521 (1<<ACL_WHERE_PRDR)|
522 #endif /* EXPERIMENTAL_PRDR */
523 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 524 (1<<ACL_WHERE_MIME)),
71fafd95 525 #endif
8523533c 526
e7568d51
TL		 527 (unsigned int)
528 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
529 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 530 #ifdef EXPERIMENTAL_PRDR
531 (1<<ACL_WHERE_PRDR)|
532 #endif
e7568d51
TL		 533 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
534 (1<<ACL_WHERE_NOTSMTP_START)),
535
059ec3d9
PH		 536 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
537 (1<<ACL_WHERE_HELO)|
538 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
539 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
540 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
541
542 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
543 (1<<ACL_WHERE_HELO)|
544 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
545 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
546 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
547
548 0, /* set */
549
71fafd95 550 #ifdef WITH_CONTENT_SCAN
2f079f46 551 (unsigned int)
fd98a5c6
JH		 552 ~((1<<ACL_WHERE_DATA)| /* spam */
553 #ifdef EXPERIMENTAL_PRDR
554 (1<<ACL_WHERE_PRDR)|
555 #endif /* EXPERIMENTAL_PRDR */
556 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 557 #endif
8523533c 558
71fafd95 559 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 560 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
561 (1<<ACL_WHERE_HELO)|
562 (1<<ACL_WHERE_MAILAUTH)|
563 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 564 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
565 (1<<ACL_WHERE_NOTSMTP)|
566 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 567
568 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
569 (1<<ACL_WHERE_HELO)|
570 (1<<ACL_WHERE_MAILAUTH)|
571 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
572 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
573 (1<<ACL_WHERE_NOTSMTP)|
574 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 575 #endif
8523533c 576
059ec3d9
PH		 577 /* Certain types of verify are always allowed, so we let it through
578 always and check in the verify function itself */
579
580 0 /* verify */
059ec3d9
PH		 581};
582
583
c5fcb476
PH		 584/* Bit map vector of which controls are not allowed at certain times. For
585each control, there's a bitmap of dis-allowed times. For some, it is easier to
586specify the negation of a small number of allowed times. */
587
588static unsigned int control_forbids[] = {
c46782ef
PH		 589 (unsigned int)
590 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
591
592 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 593 0, /* bmi_run */
c46782ef
PH		 594 #endif
595
ed7f7860
PP		 596 0, /* debug */
597
80a47a2c
TK		 598 #ifndef DISABLE_DKIM
599 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
fd98a5c6
JH		 600 #ifdef EXPERIMENTAL_PRDR
601 (1<<ACL_WHERE_PRDR)|
602 #endif /* EXPERIMENTAL_PRDR */
f7572e5a
TK		 603 (1<<ACL_WHERE_NOTSMTP_START),
604 #endif
605
4840604e
TL		 606 #ifdef EXPERIMENTAL_DMARC
607 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
608 (1<<ACL_WHERE_NOTSMTP_START),
609 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
610 (1<<ACL_WHERE_NOTSMTP_START),
611 #endif
612
13363eba
PP		 613 (1<<ACL_WHERE_NOTSMTP)|
614 (1<<ACL_WHERE_NOTSMTP_START)|
615 (1<<ACL_WHERE_NOTQUIT), /* dscp */
616
c5fcb476 617 0, /* error */
8e669ac1
PH		 618
619 (unsigned int)
c5fcb476 620 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 621
622 (unsigned int)
c5fcb476 623 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 624
e4bdf652
JH		 625 (unsigned int)
626 0, /* cutthrough_delivery */
627
45b91596
PH		 628 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
629 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 630
45b91596
PH		 631 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
632 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 633
634 (unsigned int)
c5fcb476
PH		 635 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
636 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 637 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 638 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 639
640 (unsigned int)
c5fcb476
PH		 641 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
642 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 643 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 644 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 645
646 (unsigned int)
c5fcb476 647 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 648 (1<<ACL_WHERE_PREDATA)),
8523533c 649
8800895a
PH		 650 (unsigned int)
651 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 652 (1<<ACL_WHERE_PREDATA)|
653 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 654
c46782ef 655 #ifdef WITH_CONTENT_SCAN
8e669ac1 656 (unsigned int)
14d57970 657 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 658 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 659 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 660 (1<<ACL_WHERE_MIME)),
c46782ef 661 #endif
a6c4ab60 662
29aba418
TF		 663 (unsigned int)
664 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
665 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 666 #ifdef EXPERIMENTAL_PRDR
667 (1<<ACL_WHERE_PRDR)|
668 #endif /* EXPERIMENTAL_PRDR */
29aba418
TF		 669 (1<<ACL_WHERE_MIME)),
670
8e669ac1 671 (unsigned int)
a6c4ab60 672 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 673 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6
JH		 674 #ifdef EXPERIMENTAL_PRDR
675 (1<<ACL_WHERE_PRDR)|
676 #endif /* EXPERIMENTAL_PRDR */
e715ad22 677 (1<<ACL_WHERE_MIME)),
8523533c 678
45b91596 679 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 680 (1<<ACL_WHERE_NOTSMTP_START),
681
682 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 683 (1<<ACL_WHERE_NOTSMTP_START),
684
685 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 686 (1<<ACL_WHERE_NOTSMTP_START),
687
688 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 689 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 690};
691
692/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 693
694typedef struct control_def {
695 uschar *name;
696 int value; /* CONTROL_xxx value */
059ec3d9
PH		 697 BOOL has_option; /* Has /option(s) following */
698} control_def;
699
700static control_def controls_list[] = {
c46782ef 701 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 702#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 703 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 704#endif
ed7f7860 705 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK		 706#ifndef DISABLE_DKIM
707 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 708#endif
709#ifdef EXPERIMENTAL_DMARC
710 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
711 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 712#endif
13363eba 713 { US"dscp", CONTROL_DSCP, TRUE },
c46782ef
PH		 714 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
715 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
716 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
717 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 718 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 719 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH		 720 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
721 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 722 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 723 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 724#ifdef WITH_CONTENT_SCAN
c46782ef 725 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 726#endif
c46782ef
PH		 727 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
728 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
729 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652
JH		 730 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
731 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE }
059ec3d9
PH		 732 };
733
e5a9dba6
PH		 734/* Support data structures for Client SMTP Authorization. acl_verify_csa()
735caches its result in a tree to avoid repeated DNS queries. The result is an
736integer code which is used as an index into the following tables of
737explanatory strings and verification return codes. */
738
739static tree_node *csa_cache = NULL;
740
741enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
742 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
743
744/* The acl_verify_csa() return code is translated into an acl_verify() return
745code using the following table. It is OK unless the client is definitely not
746authorized. This is because CSA is supposed to be optional for sending sites,
747so recipients should not be too strict about checking it - especially because
748DNS problems are quite likely to occur. It's possible to use $csa_status in
749further ACL conditions to distinguish ok, unknown, and defer if required, but
750the aim is to make the usual configuration simple. */
751
752static int csa_return_code[] = {
753 OK, OK, OK, OK,
754 FAIL, FAIL, FAIL, FAIL
755};
756
757static uschar *csa_status_string[] = {
758 US"unknown", US"ok", US"defer", US"defer",
759 US"fail", US"fail", US"fail", US"fail"
760};
761
762static uschar *csa_reason_string[] = {
763 US"unknown",
764 US"ok",
765 US"deferred (SRV lookup failed)",
766 US"deferred (target address lookup failed)",
767 US"failed (explicit authorization required)",
768 US"failed (host name not authorized)",
769 US"failed (no authorized addresses)",
770 US"failed (client address mismatch)"
771};
772
c99ce5c9
TF		 773/* Options for the ratelimit condition. Note that there are two variants of
774the per_rcpt option, depending on the ACL that is used to measure the rate.
775However any ACL must be able to look up per_rcpt rates in /noupdate mode,
776so the two variants must have the same internal representation as well as
777the same configuration string. */
778
779enum {
780 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
781 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
782};
783
784#define RATE_SET(var,new) \
785 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
786
787static uschar *ratelimit_option_string[] = {
788 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
789 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
790};
791
059ec3d9
PH		 792/* Enable recursion between acl_check_internal() and acl_check_condition() */
793
f60d98e8
JH		 794static int acl_check_wargs(int, address_item *, uschar *, int, uschar **,
795 uschar **);
059ec3d9
PH		 796
797
798/*************************************************
799* Pick out name from list *
800*************************************************/
801
802/* Use a binary chop method
803
804Arguments:
805 name name to find
806 list list of names
807 end size of list
808
809Returns: offset in list, or -1 if not found
810*/
811
812static int
813acl_checkname(uschar *name, uschar **list, int end)
814{
815int start = 0;
816
817while (start < end)
818 {
819 int mid = (start + end)/2;
820 int c = Ustrcmp(name, list[mid]);
821 if (c == 0) return mid;
822 if (c < 0) end = mid; else start = mid + 1;
823 }
824
825return -1;
826}
827
828
829/*************************************************
830* Read and parse one ACL *
831*************************************************/
832
833/* This function is called both from readconf in order to parse the ACLs in the
834configuration file, and also when an ACL is encountered dynamically (e.g. as
835the result of an expansion). It is given a function to call in order to
836retrieve the lines of the ACL. This function handles skipping comments and
837blank lines (where relevant).
838
839Arguments:
840 func function to get next line of ACL
841 error where to put an error message
842
843Returns: pointer to ACL, or NULL
844 NULL can be legal (empty ACL); in this case error will be NULL
845*/
846
847acl_block *
848acl_read(uschar *(*func)(void), uschar **error)
849{
850acl_block *yield = NULL;
851acl_block **lastp = &yield;
852acl_block *this = NULL;
853acl_condition_block *cond;
854acl_condition_block **condp = NULL;
855uschar *s;
856
857*error = NULL;
858
859while ((s = (*func)()) != NULL)
860 {
861 int v, c;
862 BOOL negated = FALSE;
863 uschar *saveline = s;
864 uschar name[64];
865
866 /* Conditions (but not verbs) are allowed to be negated by an initial
867 exclamation mark. */
868
869 while (isspace(*s)) s++;
870 if (*s == '!')
871 {
872 negated = TRUE;
873 s++;
874 }
875
cf00dad6
PH		 876 /* Read the name of a verb or a condition, or the start of a new ACL, which
877 can be started by a name, or by a macro definition. */
059ec3d9
PH		 878
879 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 880 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 881
882 /* If a verb is unrecognized, it may be another condition or modifier that
883 continues the previous verb. */
884
885 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
886 if (v < 0)
887 {
888 if (this == NULL)
889 {
4e167a8c
PH		 890 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
891 saveline);
059ec3d9
PH		 892 return NULL;
893 }
894 }
895
896 /* New verb */
897
898 else
899 {
900 if (negated)
901 {
902 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
903 return NULL;
904 }
905 this = store_get(sizeof(acl_block));
906 *lastp = this;
907 lastp = &(this->next);
908 this->next = NULL;
909 this->verb = v;
910 this->condition = NULL;
911 condp = &(this->condition);
912 if (*s == 0) continue; /* No condition on this line */
913 if (*s == '!')
914 {
915 negated = TRUE;
916 s++;
917 }
918 s = readconf_readname(name, sizeof(name), s); /* Condition name */
919 }
920
921 /* Handle a condition or modifier. */
922
923 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
924 if (c < 0)
925 {
926 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
927 saveline);
928 return NULL;
929 }
930
931 /* The modifiers may not be negated */
932
933 if (negated && cond_modifiers[c])
934 {
935 *error = string_sprintf("ACL error: negation is not allowed with "
936 "\"%s\"", conditions[c]);
937 return NULL;
938 }
939
940 /* ENDPASS may occur only with ACCEPT or DISCARD. */
941
942 if (c == ACLC_ENDPASS &&
943 this->verb != ACL_ACCEPT &&
944 this->verb != ACL_DISCARD)
945 {
946 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
947 conditions[c], verbs[this->verb]);
948 return NULL;
949 }
950
951 cond = store_get(sizeof(acl_condition_block));
952 cond->next = NULL;
953 cond->type = c;
954 cond->u.negated = negated;
955
956 *condp = cond;
957 condp = &(cond->next);
958
959 /* The "set" modifier is different in that its argument is "name=value"
960 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 961 gives us a variable name to insert into the data block. The original ACL
962 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
963 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 964 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
965 After that, we allow alphanumerics and underscores, but the first character
966 after c or m must be a digit or an underscore. This retains backwards
967 compatibility. */
059ec3d9
PH		 968
969 if (c == ACLC_SET)
970 {
47ca6d6c
PH		 971 uschar *endptr;
972
38a0a95f
PH		 973 if (Ustrncmp(s, "acl_c", 5) != 0 &&
974 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 975 {
38a0a95f
PH		 976 *error = string_sprintf("invalid variable name after \"set\" in ACL "
977 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
978 return NULL;
47ca6d6c 979 }
38a0a95f
PH		 980
981 endptr = s + 5;
641cb756
PH		 982 if (!isdigit(*endptr) && *endptr != '_')
983 {
984 *error = string_sprintf("invalid variable name after \"set\" in ACL "
985 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
986 s);
987 return NULL;
988 }
989
38a0a95f 990 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 991 {
38a0a95f
PH		 992 if (!isalnum(*endptr) && *endptr != '_')
993 {
994 *error = string_sprintf("invalid character \"%c\" in variable name "
995 "in ACL modifier \"set %s\"", *endptr, s);
996 return NULL;
997 }
998 endptr++;
47ca6d6c 999 }
47ca6d6c 1000
38a0a95f 1001 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1002 s = endptr;
059ec3d9
PH		 1003 while (isspace(*s)) s++;
1004 }
1005
1006 /* For "set", we are now positioned for the data. For the others, only
1007 "endpass" has no data */
1008
1009 if (c != ACLC_ENDPASS)
1010 {
1011 if (*s++ != '=')
1012 {
1013 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1014 cond_modifiers[c]? US"modifier" : US"condition");
1015 return NULL;
1016 }
1017 while (isspace(*s)) s++;
1018 cond->arg = string_copy(s);
1019 }
1020 }
1021
1022return yield;
1023}
1024
1025
1026
71fafd95
PH		 1027/*************************************************
1028* Set up added header line(s) *
1029*************************************************/
1030
1031/* This function is called by the add_header modifier, and also from acl_warn()
1032to implement the now-deprecated way of adding header lines using "message" on a
1033"warn" verb. The argument is treated as a sequence of header lines which are
1034added to a chain, provided there isn't an identical one already there.
1035
1036Argument: string of header lines
1037Returns: nothing
1038*/
1039
1040static void
1041setup_header(uschar *hstring)
1042{
1043uschar *p, *q;
1044int hlen = Ustrlen(hstring);
1045
b1b05573
JH		 1046/* Ignore any leading newlines */
1047while (*hstring == '\n') hstring++, hlen--;
71fafd95 1048
b1b05573 1049/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1050if (hlen <= 0) return;
b1b05573
JH		 1051if (hstring[--hlen] != '\n') hstring = string_sprintf("%s\n", hstring);
1052else while(hstring[--hlen] == '\n') hstring[hlen+1] = '\0';
71fafd95
PH		 1053
1054/* Loop for multiple header lines, taking care about continuations */
1055
1056for (p = q = hstring; *p != 0; )
1057 {
1058 uschar *s;
1059 int newtype = htype_add_bot;
1060 header_line **hptr = &acl_added_headers;
1061
1062 /* Find next header line within the string */
1063
1064 for (;;)
1065 {
1066 q = Ustrchr(q, '\n');
1067 if (*(++q) != ' ' && *q != '\t') break;
1068 }
1069
1070 /* If the line starts with a colon, interpret the instruction for where to
1071 add it. This temporarily sets up a new type. */
1072
1073 if (*p == ':')
1074 {
1075 if (strncmpic(p, US":after_received:", 16) == 0)
1076 {
1077 newtype = htype_add_rec;
1078 p += 16;
1079 }
1080 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1081 {
1082 newtype = htype_add_rfc;
1083 p += 14;
1084 }
1085 else if (strncmpic(p, US":at_start:", 10) == 0)
1086 {
1087 newtype = htype_add_top;
1088 p += 10;
1089 }
1090 else if (strncmpic(p, US":at_end:", 8) == 0)
1091 {
1092 newtype = htype_add_bot;
1093 p += 8;
1094 }
1095 while (*p == ' ' || *p == '\t') p++;
1096 }
1097
1098 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1099 to the front of it. */
1100
1101 for (s = p; s < q - 1; s++)
1102 {
1103 if (*s == ':' || !isgraph(*s)) break;
1104 }
1105
438257ba 1106 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
71fafd95
PH		 1107 hlen = Ustrlen(s);
1108
1109 /* See if this line has already been added */
1110
1111 while (*hptr != NULL)
1112 {
1113 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
1114 hptr = &((*hptr)->next);
1115 }
1116
1117 /* Add if not previously present */
1118
1119 if (*hptr == NULL)
1120 {
1121 header_line *h = store_get(sizeof(header_line));
1122 h->text = s;
1123 h->next = NULL;
1124 h->type = newtype;
1125 h->slen = hlen;
1126 *hptr = h;
1127 hptr = &(h->next);
1128 }
1129
1130 /* Advance for next header line within the string */
1131
1132 p = q;
1133 }
1134}
1135
1136
1137
362145b5
JH		 1138/*************************************************
1139* List the added header lines *
1140*************************************************/
1141uschar *
1142fn_hdrs_added(void)
1143{
1144uschar * ret = NULL;
1145header_line * h = acl_added_headers;
1146uschar * s;
1147uschar * cp;
1148int size = 0;
1149int ptr = 0;
1150
1151if (!h) return NULL;
1152
1153do
1154 {
1155 s = h->text;
1156 while ((cp = Ustrchr(s, '\n')) != NULL)
1157 {
1158 if (cp[1] == '\0') break;
1159
1160 /* contains embedded newline; needs doubling */
1161 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1162 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1163 s = cp+1;
1164 }
1165 /* last bit of header */
1166
1167 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1168 }
6d9cfc47 1169while((h = h->next));
362145b5
JH		 1170
1171ret[ptr-1] = '\0'; /* overwrite last newline */
1172return ret;
1173}
1174
1175
e7568d51
TL		 1176/*************************************************
1177* Set up removed header line(s) *
1178*************************************************/
1179
1180/* This function is called by the remove_header modifier. The argument is
1181treated as a sequence of header names which are added to a colon separated
1182list, provided there isn't an identical one already there.
1183
1184Argument: string of header names
1185Returns: nothing
1186*/
1187
1188static void
1189setup_remove_header(uschar *hnames)
1190{
1191if (*hnames != 0)
1192 {
1193 if (acl_removed_headers == NULL)
1194 acl_removed_headers = hnames;
1195 else
1196 acl_removed_headers = string_sprintf("%s : %s", acl_removed_headers, hnames);
1197 }
1198}
1199
1200
71fafd95 1201
059ec3d9
PH		 1202/*************************************************
1203* Handle warnings *
1204*************************************************/
1205
1206/* This function is called when a WARN verb's conditions are true. It adds to
1207the message's headers, and/or writes information to the log. In each case, this
1208only happens once (per message for headers, per connection for log).
1209
71fafd95
PH		 1210** NOTE: The header adding action using the "message" setting is historic, and
1211its use is now deprecated. The new add_header modifier should be used instead.
1212
059ec3d9
PH		 1213Arguments:
1214 where ACL_WHERE_xxxx indicating which ACL this is
1215 user_message message for adding to headers
1216 log_message message for logging, if different
1217
1218Returns: nothing
1219*/
1220
1221static void
1222acl_warn(int where, uschar *user_message, uschar *log_message)
1223{
059ec3d9
PH		 1224if (log_message != NULL && log_message != user_message)
1225 {
1226 uschar *text;
1227 string_item *logged;
1228
1229 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1230 string_printing(log_message));
1231
1232 /* If a sender verification has failed, and the log message is "sender verify
1233 failed", add the failure message. */
1234
1235 if (sender_verified_failed != NULL &&
1236 sender_verified_failed->message != NULL &&
1237 strcmpic(log_message, US"sender verify failed") == 0)
1238 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1239
9c7a242c
PH		 1240 /* Search previously logged warnings. They are kept in malloc
1241 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1242
1243 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1244 if (Ustrcmp(logged->text, text) == 0) break;
1245
1246 if (logged == NULL)
1247 {
1248 int length = Ustrlen(text) + 1;
1249 log_write(0, LOG_MAIN, "%s", text);
1250 logged = store_malloc(sizeof(string_item) + length);
1251 logged->text = (uschar *)logged + sizeof(string_item);
1252 memcpy(logged->text, text, length);
1253 logged->next = acl_warn_logged;
1254 acl_warn_logged = logged;
1255 }
1256 }
1257
1258/* If there's no user message, we are done. */
1259
1260if (user_message == NULL) return;
1261
1262/* If this isn't a message ACL, we can't do anything with a user message.
1263Log an error. */
1264
1265if (where > ACL_WHERE_NOTSMTP)
1266 {
1267 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1268 "found in a non-message (%s) ACL: cannot specify header lines here: "
1269 "message ignored", acl_wherenames[where]);
1270 return;
1271 }
1272
71fafd95
PH		 1273/* The code for setting up header lines is now abstracted into a separate
1274function so that it can be used for the add_header modifier as well. */
059ec3d9 1275
71fafd95 1276setup_header(user_message);
059ec3d9
PH		 1277}
1278
1279
1280
1281/*************************************************
1282* Verify and check reverse DNS *
1283*************************************************/
1284
1285/* Called from acl_verify() below. We look up the host name(s) of the client IP
1286address if this has not yet been done. The host_name_lookup() function checks
1287that one of these names resolves to an address list that contains the client IP
1288address, so we don't actually have to do the check here.
1289
1290Arguments:
1291 user_msgptr pointer for user message
1292 log_msgptr pointer for log message
1293
1294Returns: OK verification condition succeeded
1295 FAIL verification failed
1296 DEFER there was a problem verifying
1297*/
1298
1299static int
1300acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1301{
1302int rc;
1303
1304user_msgptr = user_msgptr; /* stop compiler warning */
1305
1306/* Previous success */
1307
1308if (sender_host_name != NULL) return OK;
1309
1310/* Previous failure */
1311
1312if (host_lookup_failed)
1313 {
1314 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1315 return FAIL;
1316 }
1317
1318/* Need to do a lookup */
1319
1320HDEBUG(D_acl)
1321 debug_printf("looking up host name to force name/address consistency check\n");
1322
1323if ((rc = host_name_lookup()) != OK)
1324 {
1325 *log_msgptr = (rc == DEFER)?
1326 US"host lookup deferred for reverse lookup check"
1327 :
1328 string_sprintf("host lookup failed for reverse lookup check%s",
1329 host_lookup_msg);
1330 return rc; /* DEFER or FAIL */
1331 }
1332
1333host_build_sender_fullhost();
1334return OK;
1335}
1336
1337
1338
e5a9dba6
PH		 1339/*************************************************
1340* Check client IP address matches CSA target *
1341*************************************************/
1342
1343/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1344response for address records belonging to the CSA target hostname. The section
1345is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1346If one of the addresses matches the client's IP address, then the client is
1347authorized by CSA. If there are target IP addresses but none of them match
1348then the client is using an unauthorized IP address. If there are no target IP
1349addresses then the client cannot be using an authorized IP address. (This is
1350an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1351
1352Arguments:
1353 dnsa the DNS answer block
1354 dnss a DNS scan block for us to use
1355 reset option specifing what portion to scan, as described above
1356 target the target hostname to use for matching RR names
1357
1358Returns: CSA_OK successfully authorized
1359 CSA_FAIL_MISMATCH addresses found but none matched
1360 CSA_FAIL_NOADDR no target addresses found
1361*/
1362
1363static int
1364acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1365 uschar *target)
1366{
1367dns_record *rr;
1368dns_address *da;
1369
1370BOOL target_found = FALSE;
1371
1372for (rr = dns_next_rr(dnsa, dnss, reset);
1373 rr != NULL;
1374 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1375 {
1376 /* Check this is an address RR for the target hostname. */
1377
1378 if (rr->type != T_A
1379 #if HAVE_IPV6
1380 && rr->type != T_AAAA
1381 #ifdef SUPPORT_A6
1382 && rr->type != T_A6
1383 #endif
1384 #endif
1385 ) continue;
1386
1387 if (strcmpic(target, rr->name) != 0) continue;
1388
1389 target_found = TRUE;
1390
1391 /* Turn the target address RR into a list of textual IP addresses and scan
1392 the list. There may be more than one if it is an A6 RR. */
1393
1394 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1395 {
1396 /* If the client IP address matches the target IP address, it's good! */
1397
1398 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1399
1400 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1401 }
1402 }
1403
1404/* If we found some target addresses but none of them matched, the client is
1405using an unauthorized IP address, otherwise the target has no authorized IP
1406addresses. */
1407
1408if (target_found) return CSA_FAIL_MISMATCH;
1409else return CSA_FAIL_NOADDR;
1410}
1411
1412
1413
1414/*************************************************
1415* Verify Client SMTP Authorization *
1416*************************************************/
1417
1418/* Called from acl_verify() below. This routine calls dns_lookup_special()
1419to find the CSA SRV record corresponding to the domain argument, or
1420$sender_helo_name if no argument is provided. It then checks that the
1421client is authorized, and that its IP address corresponds to the SRV
1422target's address by calling acl_verify_csa_address() above. The address
1423should have been returned in the DNS response's ADDITIONAL section, but if
1424not we perform another DNS lookup to get it.
1425
1426Arguments:
1427 domain pointer to optional parameter following verify = csa
1428
1429Returns: CSA_UNKNOWN no valid CSA record found
1430 CSA_OK successfully authorized
1431 CSA_FAIL_* client is definitely not authorized
1432 CSA_DEFER_* there was a DNS problem
1433*/
1434
1435static int
1436acl_verify_csa(uschar *domain)
1437{
1438tree_node *t;
1439uschar *found, *p;
1440int priority, weight, port;
1441dns_answer dnsa;
1442dns_scan dnss;
1443dns_record *rr;
1444int rc, type;
1445uschar target[256];
1446
1447/* Work out the domain we are using for the CSA lookup. The default is the
1448client's HELO domain. If the client has not said HELO, use its IP address
1449instead. If it's a local client (exim -bs), CSA isn't applicable. */
1450
1451while (isspace(*domain) && *domain != '\0') ++domain;
1452if (*domain == '\0') domain = sender_helo_name;
1453if (domain == NULL) domain = sender_host_address;
1454if (sender_host_address == NULL) return CSA_UNKNOWN;
1455
1456/* If we have an address literal, strip off the framing ready for turning it
1457into a domain. The framing consists of matched square brackets possibly
1458containing a keyword and a colon before the actual IP address. */
1459
1460if (domain[0] == '[')
1461 {
1462 uschar *start = Ustrchr(domain, ':');
1463 if (start == NULL) start = domain;
1464 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1465 }
1466
1467/* Turn domains that look like bare IP addresses into domains in the reverse
1468DNS. This code also deals with address literals and $sender_host_address. It's
1469not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1470address literals, but it's probably the most friendly thing to do. This is an
1471extension to CSA, so we allow it to be turned off for proper conformance. */
1472
7e66e54d 1473if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1474 {
1475 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1476 dns_build_reverse(domain, target);
1477 domain = target;
1478 }
1479
1480/* Find out if we've already done the CSA check for this domain. If we have,
1481return the same result again. Otherwise build a new cached result structure
1482for this domain. The name is filled in now, and the value is filled in when
1483we return from this function. */
1484
1485t = tree_search(csa_cache, domain);
1486if (t != NULL) return t->data.val;
1487
1488t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1489Ustrcpy(t->name, domain);
1490(void)tree_insertnode(&csa_cache, t);
1491
1492/* Now we are ready to do the actual DNS lookup(s). */
1493
28e6ef29 1494found = domain;
e5a9dba6
PH		 1495switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1496 {
1497 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1498
1499 default:
1500 return t->data.val = CSA_DEFER_SRV;
1501
1502 /* If we found nothing, the client's authorization is unknown. */
1503
1504 case DNS_NOMATCH:
1505 case DNS_NODATA:
1506 return t->data.val = CSA_UNKNOWN;
1507
1508 /* We got something! Go on to look at the reply in more detail. */
1509
1510 case DNS_SUCCEED:
1511 break;
1512 }
1513
1514/* Scan the reply for well-formed CSA SRV records. */
1515
1516for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1517 rr != NULL;
1518 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1519 {
1520 if (rr->type != T_SRV) continue;
1521
1522 /* Extract the numerical SRV fields (p is incremented) */
1523
1524 p = rr->data;
1525 GETSHORT(priority, p);
1526 GETSHORT(weight, p);
1527 GETSHORT(port, p);
1528
1529 DEBUG(D_acl)
1530 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1531
1532 /* Check the CSA version number */
1533
1534 if (priority != 1) continue;
1535
1536 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1537 found by dns_special_lookup() is a parent of the one we asked for), we check
1538 the subdomain assertions in the port field. At the moment there's only one
1539 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1540 SRV records of their own. */
1541
1542 if (found != domain)
1543 {
1544 if (port & 1)
1545 return t->data.val = CSA_FAIL_EXPLICIT;
1546 else
1547 return t->data.val = CSA_UNKNOWN;
1548 }
1549
1550 /* This CSA SRV record refers directly to our domain, so we check the value
1551 in the weight field to work out the domain's authorization. 0 and 1 are
1552 unauthorized; 3 means the client is authorized but we can't check the IP
1553 address in order to authenticate it, so we treat it as unknown; values
1554 greater than 3 are undefined. */
1555
1556 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1557
1558 if (weight > 2) continue;
1559
1560 /* Weight == 2, which means the domain is authorized. We must check that the
1561 client's IP address is listed as one of the SRV target addresses. Save the
1562 target hostname then break to scan the additional data for its addresses. */
1563
1564 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1565 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1566
1567 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1568
1569 break;
1570 }
1571
1572/* If we didn't break the loop then no appropriate records were found. */
1573
1574if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1575
1576/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1577A target of "." indicates there are no valid addresses, so the client cannot
1578be authorized. (This is an odd configuration because weight=2 target=. is
1579equivalent to weight=1, but we check for it in order to keep load off the
1580root name servers.) Note that dn_expand() turns "." into "". */
1581
1582if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1583
1584/* Scan the additional section of the CSA SRV reply for addresses belonging
1585to the target. If the name server didn't return any additional data (e.g.
1586because it does not fully support SRV records), we need to do another lookup
1587to obtain the target addresses; otherwise we have a definitive result. */
1588
1589rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1590if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1591
1592/* The DNS lookup type corresponds to the IP version used by the client. */
1593
1594#if HAVE_IPV6
1595if (Ustrchr(sender_host_address, ':') != NULL)
1596 type = T_AAAA;
1597else
1598#endif /* HAVE_IPV6 */
1599 type = T_A;
1600
1601
1602#if HAVE_IPV6 && defined(SUPPORT_A6)
1603DNS_LOOKUP_AGAIN:
1604#endif
1605
1606switch (dns_lookup(&dnsa, target, type, NULL))
1607 {
1608 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1609
1610 default:
1611 return t->data.val = CSA_DEFER_ADDR;
1612
1613 /* If the query succeeded, scan the addresses and return the result. */
1614
1615 case DNS_SUCCEED:
1616 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1617 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1618 /* else fall through */
1619
1620 /* If the target has no IP addresses, the client cannot have an authorized
1621 IP address. However, if the target site uses A6 records (not AAAA records)
1622 we have to do yet another lookup in order to check them. */
1623
1624 case DNS_NOMATCH:
1625 case DNS_NODATA:
1626
1627 #if HAVE_IPV6 && defined(SUPPORT_A6)
1628 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1629 #endif
1630
1631 return t->data.val = CSA_FAIL_NOADDR;
1632 }
1633}
1634
1635
1636
059ec3d9
PH		 1637/*************************************************
1638* Handle verification (address & other) *
1639*************************************************/
1640
89583014
JH		 1641enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1642 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT
1643 };
1644typedef struct {
1645 uschar * name;
1646 int value;
1647 unsigned where_allowed; /* bitmap */
1648 BOOL no_options; /* Never has /option(s) following */
1649 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1650 } verify_type_t;
1651static verify_type_t verify_type_list[] = {
1652 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, TRUE, 0 },
1653 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1654 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1655 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1656 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1657 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1658 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1659 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1660 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1661 FALSE, 6 },
1662 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 }
1663 };
1664
1665
1666enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1667 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1668 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1669 CALLOUT_TIME
1670 };
1671typedef struct {
1672 uschar * name;
1673 int value;
1674 int flag;
1675 BOOL has_option; /* Has =option(s) following */
1676 BOOL timeval; /* Has a time value */
1677 } callout_opt_t;
1678static callout_opt_t callout_opt_list[] = {
1679 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1680 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1681 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1682 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1683 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1684 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1685 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1686 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1687 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1688 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1689 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1690 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1691 };
1692
1693
1694
059ec3d9
PH		 1695/* This function implements the "verify" condition. It is called when
1696encountered in any ACL, because some tests are almost always permitted. Some
1697just don't make sense, and always fail (for example, an attempt to test a host
1698lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1699
1700Arguments:
1701 where where called from
1702 addr the recipient address that the ACL is handling, or NULL
1703 arg the argument of "verify"
1704 user_msgptr pointer for user message
1705 log_msgptr pointer for log message
1706 basic_errno where to put verify errno
1707
1708Returns: OK verification condition succeeded
1709 FAIL verification failed
1710 DEFER there was a problem verifying
1711 ERROR syntax error
1712*/
1713
1714static int
1715acl_verify(int where, address_item *addr, uschar *arg,
1716 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1717{
1718int sep = '/';
1719int callout = -1;
1720int callout_overall = -1;
4deaf07d 1721int callout_connect = -1;
059ec3d9
PH		 1722int verify_options = 0;
1723int rc;
1724BOOL verify_header_sender = FALSE;
1725BOOL defer_ok = FALSE;
1726BOOL callout_defer_ok = FALSE;
1727BOOL no_details = FALSE;
eafd343b 1728BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1729address_item *sender_vaddr = NULL;
1730uschar *verify_sender_address = NULL;
1731uschar *pm_mailfrom = NULL;
1732uschar *se_mailfrom = NULL;
596875b3
PH		 1733
1734/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1735an error if options are given for items that don't expect them.
596875b3
PH		 1736*/
1737
1738uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH		 1739uschar *list = arg;
1740uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1741verify_type_t * vp;
059ec3d9
PH		 1742
1743if (ss == NULL) goto BAD_VERIFY;
1744
1745/* Handle name/address consistency verification in a separate function. */
1746
89583014
JH		 1747for (vp= verify_type_list;
1748 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1749 vp++
1750 )
1751 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1752 : strcmpic (ss, vp->name) == 0)
1753 break;
1754if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1755 goto BAD_VERIFY;
1756
1757if (vp->no_options && slash != NULL)
059ec3d9 1758 {
89583014
JH		 1759 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1760 "(this verify item has no options)", arg);
1761 return ERROR;
059ec3d9 1762 }
89583014 1763if (!(vp->where_allowed & (1<<where)))
059ec3d9 1764 {
89583014
JH		 1765 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1766 return ERROR;
059ec3d9 1767 }
89583014 1768switch(vp->value)
596875b3 1769 {
89583014
JH		 1770 case VERIFY_REV_HOST_LKUP:
1771 if (sender_host_address == NULL) return OK;
1772 return acl_verify_reverse(user_msgptr, log_msgptr);
059ec3d9 1773
89583014
JH		 1774 case VERIFY_CERT:
1775 /* TLS certificate verification is done at STARTTLS time; here we just
1776 test whether it was successful or not. (This is for optional verification; for
1777 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1778
817d9f57 1779 if (tls_in.certificate_verified) return OK;
89583014
JH		 1780 *user_msgptr = US"no verified certificate";
1781 return FAIL;
e5a9dba6 1782
89583014
JH		 1783 case VERIFY_HELO:
1784 /* We can test the result of optional HELO verification that might have
1785 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1786
89583014
JH		 1787 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1788 return helo_verified? OK : FAIL;
059ec3d9 1789
89583014
JH		 1790 case VERIFY_CSA:
1791 /* Do Client SMTP Authorization checks in a separate function, and turn the
1792 result code into user-friendly strings. */
1c41c9cc 1793
89583014
JH		 1794 rc = acl_verify_csa(list);
1795 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1796 csa_reason_string[rc]);
1797 csa_status = csa_status_string[rc];
1798 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1799 return csa_return_code[rc];
1800
1801 case VERIFY_HDR_SYNTAX:
1802 /* Check that all relevant header lines have the correct syntax. If there is
1803 a syntax error, we return details of the error to the sender if configured to
1804 send out full details. (But a "message" setting on the ACL can override, as
1805 always). */
1806
1807 rc = verify_check_headers(log_msgptr);
1808 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1809 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1810 return rc;
059ec3d9 1811
89583014
JH		 1812 case VERIFY_NOT_BLIND:
1813 /* Check that no recipient of this message is "blind", that is, every envelope
1814 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1815
89583014
JH		 1816 rc = verify_check_notblind();
1817 if (rc != OK)
1818 {
1819 *log_msgptr = string_sprintf("bcc recipient detected");
1820 if (smtp_return_error_details)
1821 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1822 }
1823 return rc;
059ec3d9 1824
89583014
JH		 1825 /* The remaining verification tests check recipient and sender addresses,
1826 either from the envelope or from the header. There are a number of
1827 slash-separated options that are common to all of them. */
059ec3d9 1828
89583014
JH		 1829 case VERIFY_HDR_SNDR:
1830 verify_header_sender = TRUE;
1831 break;
059ec3d9 1832
89583014
JH		 1833 case VERIFY_SNDR:
1834 /* In the case of a sender, this can optionally be followed by an address to use
1835 in place of the actual sender (rare special-case requirement). */
059ec3d9 1836 {
89583014
JH		 1837 uschar *s = ss + 6;
1838 if (*s == 0)
1839 verify_sender_address = sender_address;
1840 else
1841 {
1842 while (isspace(*s)) s++;
1843 if (*s++ != '=') goto BAD_VERIFY;
1844 while (isspace(*s)) s++;
1845 verify_sender_address = string_copy(s);
1846 }
059ec3d9 1847 }
89583014
JH		 1848 break;
1849
1850 case VERIFY_RCPT:
1851 break;
059ec3d9
PH		 1852 }
1853
89583014
JH		 1854
1855
596875b3
PH		 1856/* Remaining items are optional; they apply to sender and recipient
1857verification, including "header sender" verification. */
059ec3d9
PH		 1858
1859while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1860 != NULL)
1861 {
1862 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1863 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1864 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1865
1866 /* These two old options are left for backwards compatibility */
1867
1868 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1869 {
1870 callout_defer_ok = TRUE;
1871 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1872 }
1873
1874 else if (strcmpic(ss, US"check_postmaster") == 0)
1875 {
1876 pm_mailfrom = US"";
1877 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1878 }
1879
1880 /* The callout option has a number of sub-options, comma separated */
1881
1882 else if (strncmpic(ss, US"callout", 7) == 0)
1883 {
1884 callout = CALLOUT_TIMEOUT_DEFAULT;
1885 ss += 7;
1886 if (*ss != 0)
1887 {
1888 while (isspace(*ss)) ss++;
1889 if (*ss++ == '=')
1890 {
1891 int optsep = ',';
1892 uschar *opt;
1893 uschar buffer[256];
1894 while (isspace(*ss)) ss++;
8e669ac1 1895
059ec3d9
PH		 1896 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1897 != NULL)
1898 {
89583014 1899 callout_opt_t * op;
438257ba 1900 double period = 1.0F;
059ec3d9 1901
89583014 1902 for (op= callout_opt_list; op->name; op++)
438257ba 1903 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1904 break;
059ec3d9 1905
89583014
JH		 1906 verify_options |= op->flag;
1907 if (op->has_option)
1908 {
438257ba 1909 opt += Ustrlen(op->name);
4deaf07d
PH		 1910 while (isspace(*opt)) opt++;
1911 if (*opt++ != '=')
1912 {
1913 *log_msgptr = string_sprintf("'=' expected after "
89583014 1914 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1915 return ERROR;
1916 }
1917 while (isspace(*opt)) opt++;
89583014
JH		 1918 }
1919 if (op->timeval)
1920 {
1921 period = readconf_readtime(opt, 0, FALSE);
1922 if (period < 0)
4deaf07d
PH		 1923 {
1924 *log_msgptr = string_sprintf("bad time value in ACL condition "
1925 "\"verify %s\"", arg);
1926 return ERROR;
1927 }
89583014
JH		 1928 }
1929
1930 switch(op->value)
1931 {
1932 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1933 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1934 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1935 case CALLOUT_MAILFROM:
1936 if (!verify_header_sender)
1937 {
1938 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1939 "callout option only for verify=header_sender (detected in ACL "
1940 "condition \"%s\")", arg);
1941 return ERROR;
1942 }
1943 se_mailfrom = string_copy(opt);
1944 break;
1945 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1946 case CALLOUT_MAXWAIT: callout_overall = period; break;
1947 case CALLOUT_CONNECT: callout_connect = period; break;
1948 case CALLOUT_TIME: callout = period; break;
1949 }
059ec3d9
PH		 1950 }
1951 }
1952 else
1953 {
1954 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1955 "ACL condition \"%s\"", arg);
1956 return ERROR;
1957 }
1958 }
1959 }
1960
1961 /* Option not recognized */
1962
1963 else
1964 {
1965 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1966 "condition \"verify %s\"", ss, arg);
1967 return ERROR;
1968 }
1969 }
1970
1971if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1972 (vopt_callout_recipsender|vopt_callout_recippmaster))
1973 {
1974 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1975 "for a recipient callout";
1976 return ERROR;
1977 }
1978
1979/* Handle sender-in-header verification. Default the user message to the log
1980message if giving out verification details. */
1981
1982if (verify_header_sender)
1983 {
8e669ac1 1984 int verrno;
059ec3d9 1985 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 1986 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1987 &verrno);
1988 if (rc != OK)
8e669ac1 1989 {
fe5b5d0b
PH		 1990 *basic_errno = verrno;
1991 if (smtp_return_error_details)
1992 {
1993 if (*user_msgptr == NULL && *log_msgptr != NULL)
1994 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1995 if (rc == DEFER) acl_temp_details = TRUE;
1996 }
8e669ac1 1997 }
059ec3d9
PH		 1998 }
1999
2000/* Handle a sender address. The default is to verify *the* sender address, but
2001optionally a different address can be given, for special requirements. If the
2002address is empty, we are dealing with a bounce message that has no sender, so
2003we cannot do any checking. If the real sender address gets rewritten during
2004verification (e.g. DNS widening), set the flag to stop it being rewritten again
2005during message reception.
2006
2007A list of verified "sender" addresses is kept to try to avoid doing to much
2008work repetitively when there are multiple recipients in a message and they all
2009require sender verification. However, when callouts are involved, it gets too
2010complicated because different recipients may require different callout options.
2011Therefore, we always do a full sender verify when any kind of callout is
2012specified. Caching elsewhere, for instance in the DNS resolver and in the
2013callout handling, should ensure that this is not terribly inefficient. */
2014
2015else if (verify_sender_address != NULL)
2016 {
2017 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2018 != 0)
2019 {
2020 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2021 "sender verify callout";
2022 return ERROR;
2023 }
2024
2025 sender_vaddr = verify_checked_sender(verify_sender_address);
2026 if (sender_vaddr != NULL && /* Previously checked */
2027 callout <= 0) /* No callout needed this time */
2028 {
2029 /* If the "routed" flag is set, it means that routing worked before, so
2030 this check can give OK (the saved return code value, if set, belongs to a
2031 callout that was done previously). If the "routed" flag is not set, routing
2032 must have failed, so we use the saved return code. */
2033
2034 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2035 {
2036 rc = sender_vaddr->special_action;
2037 *basic_errno = sender_vaddr->basic_errno;
2038 }
2039 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2040 }
2041
2042 /* Do a new verification, and cache the result. The cache is used to avoid
2043 verifying the sender multiple times for multiple RCPTs when callouts are not
2044 specified (see comments above).
2045
2046 The cache is also used on failure to give details in response to the first
2047 RCPT that gets bounced for this reason. However, this can be suppressed by
2048 the no_details option, which sets the flag that says "this detail has already
2049 been sent". The cache normally contains just one address, but there may be
2050 more in esoteric circumstances. */
2051
2052 else
2053 {
2054 BOOL routed = TRUE;
2a3eea10 2055 uschar *save_address_data = deliver_address_data;
8e669ac1 2056
059ec3d9
PH		 2057 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2058 if (no_details) setflag(sender_vaddr, af_sverify_told);
2059 if (verify_sender_address[0] != 0)
2060 {
2061 /* If this is the real sender address, save the unrewritten version
2062 for use later in receive. Otherwise, set a flag so that rewriting the
2063 sender in verify_address() does not update sender_address. */
2064
2065 if (verify_sender_address == sender_address)
2066 sender_address_unrewritten = sender_address;
2067 else
2068 verify_options |= vopt_fake_sender;
2069
eafd343b
TK		 2070 if (success_on_redirect)
2071 verify_options |= vopt_success_on_redirect;
2072
059ec3d9
PH		 2073 /* The recipient, qualify, and expn options are never set in
2074 verify_options. */
2075
2076 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2077 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2078
2079 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2080
2081 if (rc == OK)
2082 {
2083 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2084 {
2085 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2086 verify_sender_address, sender_vaddr->address);
2087 }
2088 else
2089 {
2090 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2091 verify_sender_address);
2092 }
2093 }
2094 else *basic_errno = sender_vaddr->basic_errno;
2095 }
2096 else rc = OK; /* Null sender */
2097
2098 /* Cache the result code */
2099
2100 if (routed) setflag(sender_vaddr, af_verify_routed);
2101 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2102 sender_vaddr->special_action = rc;
2103 sender_vaddr->next = sender_verified_list;
2104 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2105
2106 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2107 the sender verification. */
8e669ac1 2108
2a3eea10 2109 deliver_address_data = save_address_data;
059ec3d9 2110 }
8e669ac1 2111
2a3eea10
PH		 2112 /* Put the sender address_data value into $sender_address_data */
2113
8e669ac1 2114 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH		 2115 }
2116
2117/* A recipient address just gets a straightforward verify; again we must handle
2118the DEFER overrides. */
2119
2120else
2121 {
2122 address_item addr2;
2123
eafd343b
TK		 2124 if (success_on_redirect)
2125 verify_options |= vopt_success_on_redirect;
2126
059ec3d9
PH		 2127 /* We must use a copy of the address for verification, because it might
2128 get rewritten. */
2129
2130 addr2 = *addr;
2131 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2132 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2133 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2134
42855d71 2135 *basic_errno = addr2.basic_errno;
059ec3d9 2136 *log_msgptr = addr2.message;
8e669ac1 2137 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2138 addr2.user_message : addr2.message;
42855d71
PH		 2139
2140 /* Allow details for temporary error if the address is so flagged. */
2141 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2142
2143 /* Make $address_data visible */
2144 deliver_address_data = addr2.p.address_data;
2145 }
2146
2147/* We have a result from the relevant test. Handle defer overrides first. */
2148
2149if (rc == DEFER && (defer_ok ||
2150 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2151 {
2152 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2153 defer_ok? "defer_ok" : "callout_defer_ok");
2154 rc = OK;
2155 }
2156
2157/* If we've failed a sender, set up a recipient message, and point
2158sender_verified_failed to the address item that actually failed. */
2159
2160if (rc != OK && verify_sender_address != NULL)
2161 {
2162 if (rc != DEFER)
2163 {
2164 *log_msgptr = *user_msgptr = US"Sender verify failed";
2165 }
2166 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2167 {
2168 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2169 }
2170 else
2171 {
2172 *log_msgptr = US"Could not complete sender verify callout";
2173 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2174 *log_msgptr;
2175 }
2176
2177 sender_verified_failed = sender_vaddr;
2178 }
2179
2180/* Verifying an address messes up the values of $domain and $local_part,
2181so reset them before returning if this is a RCPT ACL. */
2182
2183if (addr != NULL)
2184 {
2185 deliver_domain = addr->domain;
2186 deliver_localpart = addr->local_part;
2187 }
2188return rc;
2189
2190/* Syntax errors in the verify argument come here. */
2191
2192BAD_VERIFY:
2193*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
596875b3
PH		 2194 "\"helo\", \"header_syntax\", \"header_sender\" or "
2195 "\"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2196 "\"verify %s\"", arg);
2197return ERROR;
2198}
2199
2200
2201
2202
2203/*************************************************
2204* Check argument for control= modifier *
2205*************************************************/
2206
2207/* Called from acl_check_condition() below
2208
2209Arguments:
2210 arg the argument string for control=
2211 pptr set to point to the terminating character
2212 where which ACL we are in
2213 log_msgptr for error messages
2214
2215Returns: CONTROL_xxx value
2216*/
2217
2218static int
2219decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2220{
2221int len;
2222control_def *d;
2223
2224for (d = controls_list;
2225 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2226 d++)
2227 {
2228 len = Ustrlen(d->name);
2229 if (Ustrncmp(d->name, arg, len) == 0) break;
2230 }
2231
2232if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2233 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2234 {
2235 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2236 return CONTROL_ERROR;
2237 }
2238
059ec3d9
PH		 2239*pptr = arg + len;
2240return d->value;
2241}
2242
2243
2244
c99ce5c9
TF		 2245
2246/*************************************************
2247* Return a ratelimit error *
2248*************************************************/
2249
2250/* Called from acl_ratelimit() below
2251
2252Arguments:
2253 log_msgptr for error messages
2254 format format string
2255 ... supplementary arguments
2256 ss ratelimit option name
2257 where ACL_WHERE_xxxx indicating which ACL this is
2258
2259Returns: ERROR
2260*/
2261
2262static int
2263ratelimit_error(uschar **log_msgptr, const char *format, ...)
2264{
2265va_list ap;
2266uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2267va_start(ap, format);
2268if (!string_vformat(buffer, sizeof(buffer), format, ap))
2269 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2270 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2271va_end(ap);
2272*log_msgptr = string_sprintf(
2273 "error in arguments to \"ratelimit\" condition: %s", buffer);
2274return ERROR;
2275}
2276
2277
2278
2279
870f6ba8
TF		 2280/*************************************************
2281* Handle rate limiting *
2282*************************************************/
2283
2284/* Called by acl_check_condition() below to calculate the result
2285of the ACL ratelimit condition.
2286
2287Note that the return value might be slightly unexpected: if the
2288sender's rate is above the limit then the result is OK. This is
2289similar to the dnslists condition, and is so that you can write
2290ACL clauses like: defer ratelimit = 15 / 1h
2291
2292Arguments:
2293 arg the option string for ratelimit=
90fc3069 2294 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2295 log_msgptr for error messages
2296
2297Returns: OK - Sender's rate is above limit
2298 FAIL - Sender's rate is below limit
2299 DEFER - Problem opening ratelimit database
2300 ERROR - Syntax error in options.
2301*/
2302
2303static int
90fc3069 2304acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2305{
c99ce5c9 2306double limit, period, count;
8f240103
PH		 2307uschar *ss;
2308uschar *key = NULL;
c99ce5c9 2309uschar *unique = NULL;
870f6ba8 2310int sep = '/';
c99ce5c9
TF		 2311BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2312BOOL noupdate = FALSE, badacl = FALSE;
2313int mode = RATE_PER_WHAT;
870f6ba8
TF		 2314int old_pool, rc;
2315tree_node **anchor, *t;
2316open_db dbblock, *dbm;
c99ce5c9 2317int dbdb_size;
870f6ba8 2318dbdata_ratelimit *dbd;
c99ce5c9 2319dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2320struct timeval tv;
2321
2322/* Parse the first two options and record their values in expansion
2323variables. These variables allow the configuration to have informative
2324error messages based on rate limits obtained from a table lookup. */
2325
c99ce5c9 2326/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2327size, which must be greater than or equal to zero. Zero is useful for
2328rate measurement as opposed to rate limiting. */
2329
2330sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2331if (sender_rate_limit == NULL)
2332 limit = -1.0;
2333else
2334 {
2335 limit = Ustrtod(sender_rate_limit, &ss);
2336 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2337 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2338 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2339 }
c99ce5c9
TF		 2340if (limit < 0.0 || *ss != '\0')
2341 return ratelimit_error(log_msgptr,
2342 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2343
c99ce5c9 2344/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2345constant. This must be strictly greater than zero, because zero leads to
2346run-time division errors. */
2347
2348sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2349if (sender_rate_period == NULL) period = -1.0;
2350else period = readconf_readtime(sender_rate_period, 0, FALSE);
2351if (period <= 0.0)
c99ce5c9
TF		 2352 return ratelimit_error(log_msgptr,
2353 "\"%s\" is not a time value", sender_rate_period);
2354
2355/* By default we are counting one of something, but the per_rcpt,
2356per_byte, and count options can change this. */
2357
2358count = 1.0;
870f6ba8 2359
c99ce5c9 2360/* Parse the other options. */
870f6ba8
TF		 2361
2362while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2363 != NULL)
2364 {
2365 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2366 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2367 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2368 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2369 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2370 else if (strcmpic(ss, US"per_conn") == 0)
2371 {
2372 RATE_SET(mode, PER_CONN);
2373 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2374 badacl = TRUE;
2375 }
2376 else if (strcmpic(ss, US"per_mail") == 0)
2377 {
2378 RATE_SET(mode, PER_MAIL);
2379 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2380 }
2381 else if (strcmpic(ss, US"per_rcpt") == 0)
2382 {
2383 /* If we are running in the RCPT ACL, then we'll count the recipients
2384 one by one, but if we are running when we have accumulated the whole
2385 list then we'll add them all in one batch. */
2386 if (where == ACL_WHERE_RCPT)
2387 RATE_SET(mode, PER_RCPT);
2388 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2389 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2390 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2391 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2392 }
2393 else if (strcmpic(ss, US"per_byte") == 0)
2394 {
2395 /* If we have not yet received the message data and there was no SIZE
2396 declaration on the MAIL comand, then it's safe to just use a value of
2397 zero and let the recorded rate decay as if nothing happened. */
2398 RATE_SET(mode, PER_MAIL);
2399 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2400 else count = message_size < 0 ? 0.0 : (double)message_size;
2401 }
2402 else if (strcmpic(ss, US"per_addr") == 0)
2403 {
2404 RATE_SET(mode, PER_RCPT);
438257ba 2405 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2406 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2407 }
2408 else if (strncmpic(ss, US"count=", 6) == 0)
2409 {
2410 uschar *e;
2411 count = Ustrtod(ss+6, &e);
2412 if (count < 0.0 || *e != '\0')
2413 return ratelimit_error(log_msgptr,
2414 "\"%s\" is not a positive number", ss);
2415 }
2416 else if (strncmpic(ss, US"unique=", 7) == 0)
2417 unique = string_copy(ss + 7);
2418 else if (key == NULL)
2419 key = string_copy(ss);
2420 else
2421 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2422 }
2423
c99ce5c9
TF		 2424/* Sanity check. When the badacl flag is set the update mode must either
2425be readonly (which is the default if it is omitted) or, for backwards
2426compatibility, a combination of noupdate and strict or leaky. */
2427
2428if (mode == RATE_PER_CLASH)
2429 return ratelimit_error(log_msgptr, "conflicting per_* options");
2430if (leaky + strict + readonly > 1)
2431 return ratelimit_error(log_msgptr, "conflicting update modes");
2432if (badacl && (leaky || strict) && !noupdate)
2433 return ratelimit_error(log_msgptr,
2434 "\"%s\" must not have /leaky or /strict option in %s ACL",
2435 ratelimit_option_string[mode], acl_wherenames[where]);
2436
2437/* Set the default values of any unset options. In readonly mode we
2438perform the rate computation without any increment so that its value
2439decays to eventually allow over-limit senders through. */
2440
2441if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2442if (badacl) readonly = TRUE;
2443if (readonly) count = 0.0;
2444if (!strict && !readonly) leaky = TRUE;
2445if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2446
8f240103
PH		 2447/* Create the lookup key. If there is no explicit key, use sender_host_address.
2448If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2449omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2450are added to the key because they alter the meaning of the stored data. */
2451
2452if (key == NULL)
2453 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2454
c99ce5c9 2455key = string_sprintf("%s/%s/%s%s",
8f240103 2456 sender_rate_period,
c99ce5c9
TF		 2457 ratelimit_option_string[mode],
2458 unique == NULL ? "" : "unique/",
8f240103 2459 key);
870f6ba8 2460
c99ce5c9
TF		 2461HDEBUG(D_acl)
2462 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2463
8f240103
PH		 2464/* See if we have already computed the rate by looking in the relevant tree.
2465For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2466pool so that they survive across resets. In readonly mode we only remember the
2467result for the rest of this command in case a later command changes it. After
2468this bit of logic the code is independent of the per_* mode. */
870f6ba8 2469
870f6ba8
TF		 2470old_pool = store_pool;
2471
c99ce5c9
TF		 2472if (readonly)
2473 anchor = &ratelimiters_cmd;
2474else switch(mode) {
2475case RATE_PER_CONN:
870f6ba8
TF		 2476 anchor = &ratelimiters_conn;
2477 store_pool = POOL_PERM;
c99ce5c9
TF		 2478 break;
2479case RATE_PER_BYTE:
2480case RATE_PER_MAIL:
2481case RATE_PER_ALLRCPTS:
870f6ba8 2482 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2483 break;
2484case RATE_PER_ADDR:
2485case RATE_PER_CMD:
2486case RATE_PER_RCPT:
fe0dab11 2487 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2488 break;
2489default:
3399bb60 2490 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2491 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2492 "internal ACL error: unknown ratelimit mode %d", mode);
2493 break;
2494}
870f6ba8 2495
c99ce5c9
TF		 2496t = tree_search(*anchor, key);
2497if (t != NULL)
870f6ba8
TF		 2498 {
2499 dbd = t->data.ptr;
2500 /* The following few lines duplicate some of the code below. */
8f240103 2501 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2502 store_pool = old_pool;
2503 sender_rate = string_sprintf("%.1f", dbd->rate);
2504 HDEBUG(D_acl)
2505 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2506 return rc;
2507 }
2508
c99ce5c9
TF		 2509/* We aren't using a pre-computed rate, so get a previously recorded rate
2510from the database, which will be updated and written back if required. */
870f6ba8
TF		 2511
2512dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2513if (dbm == NULL)
2514 {
2515 store_pool = old_pool;
2516 sender_rate = NULL;
2517 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2518 *log_msgptr = US"ratelimit database not available";
2519 return DEFER;
2520 }
c99ce5c9
TF		 2521dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2522dbd = NULL;
870f6ba8
TF		 2523
2524gettimeofday(&tv, NULL);
2525
c99ce5c9
TF		 2526if (dbdb != NULL)
2527 {
2528 /* Locate the basic ratelimit block inside the DB data. */
2529 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2530 dbd = &dbdb->dbd;
2531
2532 /* Forget the old Bloom filter if it is too old, so that we count each
2533 repeating event once per period. We don't simply clear and re-use the old
2534 filter because we want its size to change if the limit changes. Note that
2535 we keep the dbd pointer for copying the rate into the new data block. */
2536
2537 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2538 {
2539 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2540 dbdb = NULL;
2541 }
2542
2543 /* Sanity check. */
2544
2545 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2546 {
2547 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2548 dbdb = NULL;
2549 }
2550 }
2551
2552/* Allocate a new data block if the database lookup failed
2553or the Bloom filter passed its age limit. */
2554
2555if (dbdb == NULL)
2556 {
2557 if (unique == NULL)
2558 {
2559 /* No Bloom filter. This basic ratelimit block is initialized below. */
2560 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2561 dbdb_size = sizeof(*dbd);
2562 dbdb = store_get(dbdb_size);
2563 }
2564 else
2565 {
2566 int extra;
2567 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2568
2569 /* See the long comment below for an explanation of the magic number 2.
2570 The filter has a minimum size in case the rate limit is very small;
2571 this is determined by the definition of dbdata_ratelimit_unique. */
2572
2573 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2574 if (extra < 0) extra = 0;
2575 dbdb_size = sizeof(*dbdb) + extra;
2576 dbdb = store_get(dbdb_size);
2577 dbdb->bloom_epoch = tv.tv_sec;
2578 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2579 memset(dbdb->bloom, 0, dbdb->bloom_size);
2580
2581 /* Preserve any basic ratelimit data (which is our longer-term memory)
2582 by copying it from the discarded block. */
2583
2584 if (dbd != NULL)
2585 {
2586 dbdb->dbd = *dbd;
2587 dbd = &dbdb->dbd;
2588 }
2589 }
2590 }
2591
2592/* If we are counting unique events, find out if this event is new or not.
2593If the client repeats the event during the current period then it should be
2594counted. We skip this code in readonly mode for efficiency, because any
2595changes to the filter will be discarded and because count is already set to
2596zero. */
2597
2598if (unique != NULL && !readonly)
2599 {
2600 /* We identify unique events using a Bloom filter. (You can find my
2601 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2602 With the per_addr option, an "event" is a recipient address, though the
2603 user can use the unique option to define their own events. We only count
2604 an event if we have not seen it before.
2605
2606 We size the filter according to the rate limit, which (in leaky mode)
2607 is the limit on the population of the filter. We allow 16 bits of space
2608 per entry (see the construction code above) and we set (up to) 8 of them
2609 when inserting an element (see the loop below). The probability of a false
2610 positive (an event we have not seen before but which we fail to count) is
2611
2612 size = limit * 16
2613 numhash = 8
2614 allzero = exp(-numhash * pop / size)
2615 = exp(-0.5 * pop / limit)
2616 fpr = pow(1 - allzero, numhash)
2617
2618 For senders at the limit the fpr is 0.06% or 1 in 1700
2619 and for senders at half the limit it is 0.0006% or 1 in 170000
2620
2621 In strict mode the Bloom filter can fill up beyond the normal limit, in
2622 which case the false positive rate will rise. This means that the
2623 measured rate for very fast senders can bogusly drop off after a while.
2624
2625 At twice the limit, the fpr is 2.5% or 1 in 40
2626 At four times the limit, it is 31% or 1 in 3.2
2627
2628 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2629 decay below the limit, and if this is more than one then the Bloom filter
2630 will be discarded before the decay gets that far. The false positive rate
2631 at this threshold is 9.3% or 1 in 10.7. */
2632
2633 BOOL seen;
2634 unsigned n, hash, hinc;
2635 uschar md5sum[16];
2636 md5 md5info;
2637
2638 /* Instead of using eight independent hash values, we combine two values
2639 using the formula h1 + n * h2. This does not harm the Bloom filter's
2640 performance, and means the amount of hash we need is independent of the
2641 number of bits we set in the filter. */
2642
2643 md5_start(&md5info);
2644 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2645 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2646 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2647
2648 /* Scan the bits corresponding to this event. A zero bit means we have
2649 not seen it before. Ensure all bits are set to record this event. */
2650
2651 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2652
2653 seen = TRUE;
2654 for (n = 0; n < 8; n++, hash += hinc)
2655 {
2656 int bit = 1 << (hash % 8);
2657 int byte = (hash / 8) % dbdb->bloom_size;
2658 if ((dbdb->bloom[byte] & bit) == 0)
2659 {
2660 dbdb->bloom[byte] |= bit;
2661 seen = FALSE;
2662 }
2663 }
2664
2665 /* If this event has occurred before, do not count it. */
2666
2667 if (seen)
2668 {
2669 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2670 count = 0.0;
2671 }
2672 else
2673 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2674 }
2675
2676/* If there was no previous ratelimit data block for this key, initialize
2677the new one, otherwise update the block from the database. The initial rate
2678is what would be computed by the code below for an infinite interval. */
2679
870f6ba8
TF		 2680if (dbd == NULL)
2681 {
c99ce5c9
TF		 2682 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2683 dbd = &dbdb->dbd;
870f6ba8
TF		 2684 dbd->time_stamp = tv.tv_sec;
2685 dbd->time_usec = tv.tv_usec;
c99ce5c9 2686 dbd->rate = count;
870f6ba8
TF		 2687 }
2688else
2689 {
2690 /* The smoothed rate is computed using an exponentially weighted moving
2691 average adjusted for variable sampling intervals. The standard EWMA for
2692 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2693 where f() is the measured value and f'() is the smoothed value.
2694
2695 Old data decays out of the smoothed value exponentially, such that data n
2696 samples old is multiplied by a^n. The exponential decay time constant p
2697 is defined such that data p samples old is multiplied by 1/e, which means
2698 that a = exp(-1/p). We can maintain the same time constant for a variable
2699 sampling interval i by using a = exp(-i/p).
2700
2701 The rate we are measuring is messages per period, suitable for directly
2702 comparing with the limit. The average rate between now and the previous
2703 message is period / interval, which we feed into the EWMA as the sample.
2704
2705 It turns out that the number of messages required for the smoothed rate
2706 to reach the limit when they are sent in a burst is equal to the limit.
2707 This can be seen by analysing the value of the smoothed rate after N
2708 messages sent at even intervals. Let k = (1 - a) * p/i
2709
2710 rate_1 = (1 - a) * p/i + a * rate_0
2711 = k + a * rate_0
2712 rate_2 = k + a * rate_1
2713 = k + a * k + a^2 * rate_0
2714 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2715 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2716 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2717 = rate_0 * a^N + p/i * (1 - a^N)
2718
2719 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2720
2721 rate_N = p/i + (rate_0 - p/i) * a^N
2722 a^N = (rate_N - p/i) / (rate_0 - p/i)
2723 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2724 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2725
2726 Numerical analysis of the above equation, setting the computed rate to
2727 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2728 rates, p/i, the number of messages N = limit. So limit serves as both the
2729 maximum rate measured in messages per period, and the maximum number of
2730 messages that can be sent in a fast burst. */
2731
2732 double this_time = (double)tv.tv_sec
2733 + (double)tv.tv_usec / 1000000.0;
2734 double prev_time = (double)dbd->time_stamp
2735 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2736
2737 /* We must avoid division by zero, and deal gracefully with the clock going
2738 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2739 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2740
e5d5a95f
TF		 2741 double interval = this_time - prev_time <= 0.0 ? 1e-9
2742 : this_time - prev_time;
2743
2744 double i_over_p = interval / period;
2745 double a = exp(-i_over_p);
870f6ba8 2746
c99ce5c9
TF		 2747 /* Combine the instantaneous rate (period / interval) with the previous rate
2748 using the smoothing factor a. In order to measure sized events, multiply the
2749 instantaneous rate by the count of bytes or recipients etc. */
2750
870f6ba8
TF		 2751 dbd->time_stamp = tv.tv_sec;
2752 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2753 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2754
2755 /* When events are very widely spaced the computed rate tends towards zero.
2756 Although this is accurate it turns out not to be useful for our purposes,
2757 especially when the first event after a long silence is the start of a spam
2758 run. A more useful model is that the rate for an isolated event should be the
2759 size of the event per the period size, ignoring the lack of events outside
2760 the current period and regardless of where the event falls in the period. So,
2761 if the interval was so long that the calculated rate is unhelpfully small, we
2762 re-intialize the rate. In the absence of higher-rate bursts, the condition
2763 below is true if the interval is greater than the period. */
2764
2765 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2766 }
2767
c99ce5c9
TF		 2768/* Clients sending at the limit are considered to be over the limit.
2769This matters for edge cases such as a limit of zero, when the client
2770should be completely blocked. */
3348576f 2771
8f240103 2772rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2773
2774/* Update the state if the rate is low or if we are being strict. If we
2775are in leaky mode and the sender's rate is too high, we do not update
2776the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2777rate preventing them from getting any email through. If readonly is set,
2778neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2779
c99ce5c9 2780if ((rc == FAIL && leaky) || strict)
8f240103 2781 {
c99ce5c9 2782 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2783 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2784 }
2785else
2786 {
2787 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2788 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2789 }
2790
870f6ba8
TF		 2791dbfn_close(dbm);
2792
c99ce5c9 2793/* Store the result in the tree for future reference. */
870f6ba8 2794
c99ce5c9
TF		 2795t = store_get(sizeof(tree_node) + Ustrlen(key));
2796t->data.ptr = dbd;
2797Ustrcpy(t->name, key);
2798(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2799
2800/* We create the formatted version of the sender's rate very late in
2801order to ensure that it is done using the correct storage pool. */
2802
2803store_pool = old_pool;
2804sender_rate = string_sprintf("%.1f", dbd->rate);
2805
2806HDEBUG(D_acl)
2807 debug_printf("ratelimit computed rate %s\n", sender_rate);
2808
2809return rc;
2810}
2811
2812
2813
059ec3d9
PH		 2814/*************************************************
2815* Handle conditions/modifiers on an ACL item *
2816*************************************************/
2817
2818/* Called from acl_check() below.
2819
2820Arguments:
2821 verb ACL verb
2822 cb ACL condition block - if NULL, result is OK
2823 where where called from
2824 addr the address being checked for RCPT, or NULL
2825 level the nesting level
2826 epp pointer to pass back TRUE if "endpass" encountered
2827 (applies only to "accept" and "discard")
2828 user_msgptr user message pointer
2829 log_msgptr log message pointer
2830 basic_errno pointer to where to put verify error
2831
2832Returns: OK - all conditions are met
2833 DISCARD - an "acl" condition returned DISCARD - only allowed
2834 for "accept" or "discard" verbs
2835 FAIL - at least one condition fails
2836 FAIL_DROP - an "acl" condition returned FAIL_DROP
2837 DEFER - can't tell at the moment (typically, lookup defer,
2838 but can be temporary callout problem)
2839 ERROR - ERROR from nested ACL or expansion failure or other
2840 error
2841*/
2842
2843static int
2844acl_check_condition(int verb, acl_condition_block *cb, int where,
2845 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2846 uschar **log_msgptr, int *basic_errno)
2847{
2848uschar *user_message = NULL;
2849uschar *log_message = NULL;
ed7f7860
PP		 2850uschar *debug_tag = NULL;
2851uschar *debug_opts = NULL;
91ecef39 2852uschar *p = NULL;
059ec3d9 2853int rc = OK;
8523533c
TK		 2854#ifdef WITH_CONTENT_SCAN
2855int sep = '/';
2856#endif
059ec3d9
PH		 2857
2858for (; cb != NULL; cb = cb->next)
2859 {
2860 uschar *arg;
8e669ac1 2861 int control_type;
059ec3d9
PH		 2862
2863 /* The message and log_message items set up messages to be used in
2864 case of rejection. They are expanded later. */
2865
2866 if (cb->type == ACLC_MESSAGE)
2867 {
2868 user_message = cb->arg;
2869 continue;
2870 }
2871
2872 if (cb->type == ACLC_LOG_MESSAGE)
2873 {
2874 log_message = cb->arg;
2875 continue;
2876 }
2877
2878 /* The endpass "condition" just sets a flag to show it occurred. This is
2879 checked at compile time to be on an "accept" or "discard" item. */
2880
2881 if (cb->type == ACLC_ENDPASS)
2882 {
2883 *epp = TRUE;
2884 continue;
2885 }
2886
2887 /* For other conditions and modifiers, the argument is expanded now for some
2888 of them, but not for all, because expansion happens down in some lower level
2889 checking functions in some cases. */
2890
2891 if (cond_expand_at_top[cb->type])
2892 {
2893 arg = expand_string(cb->arg);
2894 if (arg == NULL)
2895 {
2896 if (expand_string_forcedfail) continue;
2897 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2898 cb->arg, expand_string_message);
2899 return search_find_defer? DEFER : ERROR;
2900 }
2901 }
2902 else arg = cb->arg;
2903
2904 /* Show condition, and expanded condition if it's different */
2905
2906 HDEBUG(D_acl)
2907 {
2908 int lhswidth = 0;
2909 debug_printf("check %s%s %n",
2910 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2911 conditions[cb->type], &lhswidth);
2912
2913 if (cb->type == ACLC_SET)
2914 {
38a0a95f
PH		 2915 debug_printf("acl_%s ", cb->u.varname);
2916 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 2917 }
2918
2919 debug_printf("= %s\n", cb->arg);
2920
2921 if (arg != cb->arg)
2922 debug_printf("%.*s= %s\n", lhswidth,
2923 US" ", CS arg);
2924 }
2925
2926 /* Check that this condition makes sense at this time */
2927
2928 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2929 {
2930 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2931 cond_modifiers[cb->type]? "use" : "test",
2932 conditions[cb->type], acl_wherenames[where]);
2933 return ERROR;
2934 }
2935
2936 /* Run the appropriate test for each condition, or take the appropriate
2937 action for the remaining modifiers. */
2938
2939 switch(cb->type)
2940 {
71fafd95
PH		 2941 case ACLC_ADD_HEADER:
2942 setup_header(arg);
2943 break;
2944
059ec3d9
PH		 2945 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2946 "discard" verb. */
71fafd95 2947
059ec3d9 2948 case ACLC_ACL:
f60d98e8 2949 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 2950 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2951 {
2952 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2953 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2954 verbs[verb]);
2955 return ERROR;
2956 }
059ec3d9
PH		 2957 break;
2958
2959 case ACLC_AUTHENTICATED:
2960 rc = (sender_host_authenticated == NULL)? FAIL :
2961 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2962 TRUE, NULL);
2963 break;
2964
71fafd95 2965 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 2966 case ACLC_BMI_OPTIN:
2967 {
2968 int old_pool = store_pool;
2969 store_pool = POOL_PERM;
2970 bmi_current_optin = string_copy(arg);
2971 store_pool = old_pool;
2972 }
2973 break;
71fafd95 2974 #endif
8523533c 2975
059ec3d9 2976 case ACLC_CONDITION:
f3766eb5
NM		 2977 /* The true/false parsing here should be kept in sync with that used in
2978 expand.c when dealing with ECOND_BOOL so that we don't have too many
2979 different definitions of what can be a boolean. */
059ec3d9
PH		 2980 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2981 rc = (Uatoi(arg) == 0)? FAIL : OK;
2982 else
2983 rc = (strcmpic(arg, US"no") == 0 ||
2984 strcmpic(arg, US"false") == 0)? FAIL :
2985 (strcmpic(arg, US"yes") == 0 ||
2986 strcmpic(arg, US"true") == 0)? OK : DEFER;
2987 if (rc == DEFER)
2988 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2989 break;
2990
c3611384
PH		 2991 case ACLC_CONTINUE: /* Always succeeds */
2992 break;
2993
059ec3d9 2994 case ACLC_CONTROL:
c5fcb476
PH		 2995 control_type = decode_control(arg, &p, where, log_msgptr);
2996
8523533c 2997 /* Check if this control makes sense at this time */
c5fcb476
PH		 2998
2999 if ((control_forbids[control_type] & (1 << where)) != 0)
3000 {
3001 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3002 controls[control_type], acl_wherenames[where]);
3003 return ERROR;
8e669ac1 3004 }
c5fcb476
PH		 3005
3006 switch(control_type)
059ec3d9 3007 {
c46782ef
PH		 3008 case CONTROL_AUTH_UNADVERTISED:
3009 allow_auth_unadvertised = TRUE;
3010 break;
3011
3012 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3013 case CONTROL_BMI_RUN:
3014 bmi_run = 1;
3015 break;
c46782ef
PH		 3016 #endif
3017
80a47a2c 3018 #ifndef DISABLE_DKIM
f7572e5a 3019 case CONTROL_DKIM_VERIFY:
80a47a2c 3020 dkim_disable_verify = TRUE;
4840604e
TL		 3021 #ifdef EXPERIMENTAL_DMARC
3022 /* Since DKIM was blocked, skip DMARC too */
3023 dmarc_disable_verify = TRUE;
3024 dmarc_enable_forensic = FALSE;
3025 #endif
3026 break;
3027 #endif
3028
3029 #ifdef EXPERIMENTAL_DMARC
3030 case CONTROL_DMARC_VERIFY:
3031 dmarc_disable_verify = TRUE;
3032 break;
3033
3034 case CONTROL_DMARC_FORENSIC:
3035 dmarc_enable_forensic = TRUE;
f7572e5a
TK		 3036 break;
3037 #endif
3038
13363eba
PP		 3039 case CONTROL_DSCP:
3040 if (*p == '/')
3041 {
3042 int fd, af, level, optname, value;
3043 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3044 a socket; we can accept that, we'll just debug-log failures anyway. */
3045 fd = fileno(smtp_in);
3046 af = ip_get_address_family(fd);
3047 if (af < 0)
3048 {
3049 HDEBUG(D_acl)
3050 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3051 strerror(errno));
3052 break;
3053 }
3054 if (dscp_lookup(p+1, af, &level, &optname, &value))
3055 {
3056 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3057 {
3058 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3059 p+1, strerror(errno));
3060 }
3061 else
3062 {
3063 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3064 }
3065 }
3066 else
3067 {
3068 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3069 return ERROR;
3070 }
3071 }
3072 else
3073 {
3074 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3075 return ERROR;
3076 }
3077 break;
3078
059ec3d9
PH		 3079 case CONTROL_ERROR:
3080 return ERROR;
3081
3082 case CONTROL_CASEFUL_LOCAL_PART:
3083 deliver_localpart = addr->cc_local_part;
3084 break;
3085
3086 case CONTROL_CASELOWER_LOCAL_PART:
3087 deliver_localpart = addr->lc_local_part;
3088 break;
3089
3090 case CONTROL_ENFORCE_SYNC:
3091 smtp_enforce_sync = TRUE;
3092 break;
3093
3094 case CONTROL_NO_ENFORCE_SYNC:
3095 smtp_enforce_sync = FALSE;
3096 break;
3097
c46782ef 3098 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3099 case CONTROL_NO_MBOX_UNSPOOL:
3100 no_mbox_unspool = TRUE;
3101 break;
c46782ef 3102 #endif
8523533c 3103
059ec3d9
PH		 3104 case CONTROL_NO_MULTILINE:
3105 no_multiline_responses = TRUE;
3106 break;
3107
cf8b11a5
PH		 3108 case CONTROL_NO_PIPELINING:
3109 pipelining_enable = FALSE;
3110 break;
3111
047bdd8c
PH		 3112 case CONTROL_NO_DELAY_FLUSH:
3113 disable_delay_flush = TRUE;
3114 break;
3115
4c590bd1
PH		 3116 case CONTROL_NO_CALLOUT_FLUSH:
3117 disable_callout_flush = TRUE;
3118 break;
3119
29aba418 3120 case CONTROL_FAKEDEFER:
8523533c 3121 case CONTROL_FAKEREJECT:
29aba418 3122 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 3123 if (*p == '/')
8e669ac1 3124 {
8523533c 3125 uschar *pp = p + 1;
8e669ac1 3126 while (*pp != 0) pp++;
29aba418 3127 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK		 3128 p = pp;
3129 }
3130 else
3131 {
3132 /* Explicitly reset to default string */
29aba418 3133 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK		 3134 }
3135 break;
8523533c 3136
059ec3d9
PH		 3137 case CONTROL_FREEZE:
3138 deliver_freeze = TRUE;
3139 deliver_frozen_at = time(NULL);
6a3f1455
PH		 3140 freeze_tell = freeze_tell_config; /* Reset to configured value */
3141 if (Ustrncmp(p, "/no_tell", 8) == 0)
3142 {
3143 p += 8;
3144 freeze_tell = NULL;
3145 }
3146 if (*p != 0)
3147 {
3148 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3149 return ERROR;
3150 }
059ec3d9
PH		 3151 break;
3152
3153 case CONTROL_QUEUE_ONLY:
3154 queue_only_policy = TRUE;
3155 break;
3156
3157 case CONTROL_SUBMISSION:
87ba3f5f 3158 originator_name = US"";
059ec3d9 3159 submission_mode = TRUE;
69358f02 3160 while (*p == '/')
8e669ac1 3161 {
69358f02
PH		 3162 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3163 {
3164 p += 14;
3165 active_local_sender_retain = TRUE;
8e669ac1
PH		 3166 active_local_from_check = FALSE;
3167 }
69358f02
PH		 3168 else if (Ustrncmp(p, "/domain=", 8) == 0)
3169 {
3170 uschar *pp = p + 8;
8e669ac1 3171 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH		 3172 submission_domain = string_copyn(p+8, pp-p-8);
3173 p = pp;
3174 }
8857ccfd
PH		 3175 /* The name= option must be last, because it swallows the rest of
3176 the string. */
87ba3f5f
PH		 3177 else if (Ustrncmp(p, "/name=", 6) == 0)
3178 {
3179 uschar *pp = p + 6;
8857ccfd 3180 while (*pp != 0) pp++;
2fe1a124 3181 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 3182 big_buffer, big_buffer_size));
8e669ac1 3183 p = pp;
69358f02 3184 }
8e669ac1
PH		 3185 else break;
3186 }
69358f02 3187 if (*p != 0)
059ec3d9 3188 {
69358f02 3189 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH		 3190 return ERROR;
3191 }
3192 break;
8800895a 3193
ed7f7860
PP		 3194 case CONTROL_DEBUG:
3195 while (*p == '/')
3196 {
3197 if (Ustrncmp(p, "/tag=", 5) == 0)
3198 {
3199 uschar *pp = p + 5;
3200 while (*pp != '\0' && *pp != '/') pp++;
3201 debug_tag = string_copyn(p+5, pp-p-5);
3202 p = pp;
3203 }
3204 else if (Ustrncmp(p, "/opts=", 6) == 0)
3205 {
3206 uschar *pp = p + 6;
3207 while (*pp != '\0' && *pp != '/') pp++;
3208 debug_opts = string_copyn(p+6, pp-p-6);
3209 p = pp;
3210 }
3211 }
3212 debug_logging_activate(debug_tag, debug_opts);
3213 break;
3214
8800895a
PH		 3215 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3216 suppress_local_fixups = TRUE;
3217 break;
e4bdf652
JH		 3218
3219 case CONTROL_CUTTHROUGH_DELIVERY:
3220 if (deliver_freeze)
3221 {
3222 *log_msgptr = string_sprintf("\"control=%s\" on frozen item", arg);
3223 return ERROR;
3224 }
3225 if (queue_only_policy)
3226 {
3227 *log_msgptr = string_sprintf("\"control=%s\" on queue-only item", arg);
3228 return ERROR;
3229 }
3230 cutthrough_delivery = TRUE;
3231 break;
059ec3d9
PH		 3232 }
3233 break;
3234
6a8f9482
TK		 3235 #ifdef EXPERIMENTAL_DCC
3236 case ACLC_DCC:
3237 {
3238 /* Seperate the regular expression and any optional parameters. */
3239 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3240 /* Run the dcc backend. */
3241 rc = dcc_process(&ss);
3242 /* Modify return code based upon the existance of options. */
3243 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3244 != NULL) {
3245 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3246 {
3247 /* FAIL so that the message is passed to the next ACL */
3248 rc = FAIL;
3249 }
3250 }
3251 }
3252 break;
3253 #endif
3254
71fafd95 3255 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3256 case ACLC_DECODE:
3257 rc = mime_decode(&arg);
3258 break;
71fafd95 3259 #endif
8523533c 3260
059ec3d9
PH		 3261 case ACLC_DELAY:
3262 {
3263 int delay = readconf_readtime(arg, 0, FALSE);
3264 if (delay < 0)
3265 {
3266 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3267 "modifier: \"%s\" is not a time value", arg);
3268 return ERROR;
3269 }
3270 else
3271 {
3272 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3273 delay);
3274 if (host_checking)
3275 {
3276 HDEBUG(D_acl)
3277 debug_printf("delay skipped in -bh checking mode\n");
3278 }
010c2d14
PH		 3279
3280 /* It appears to be impossible to detect that a TCP/IP connection has
3281 gone away without reading from it. This means that we cannot shorten
3282 the delay below if the client goes away, because we cannot discover
3283 that the client has closed its end of the connection. (The connection
3284 is actually in a half-closed state, waiting for the server to close its
3285 end.) It would be nice to be able to detect this state, so that the
3286 Exim process is not held up unnecessarily. However, it seems that we
3287 can't. The poll() function does not do the right thing, and in any case
3288 it is not always available.
3289
047bdd8c 3290 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3291 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3292 Also, delays may be specified for non-SMTP input, where smtp_out and
3293 smtp_in will be NULL. Whatever is done must work in all cases.
3294
3295 NOTE 2: The added feature of flushing the output before a delay must
3296 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3297 */
010c2d14 3298
8e669ac1 3299 else
86b8287f 3300 {
14f4a80d 3301 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3302 while (delay > 0) delay = sleep(delay);
8e669ac1 3303 }
059ec3d9
PH		 3304 }
3305 }
3306 break;
3307
71fafd95 3308 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3309 case ACLC_DEMIME:
3310 rc = demime(&arg);
3311 break;
71fafd95 3312 #endif
8523533c 3313
80a47a2c
TK		 3314 #ifndef DISABLE_DKIM
3315 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3316 if (dkim_cur_signer != NULL)
3317 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3318 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3319 else
80a47a2c 3320 rc = FAIL;
71fafd95
PH		 3321 break;
3322
80a47a2c
TK		 3323 case ACLC_DKIM_STATUS:
3324 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3325 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3326 break;
3327 #endif
fb2274d4 3328
4840604e
TL		 3329 #ifdef EXPERIMENTAL_DMARC
3330 case ACLC_DMARC_STATUS:
3331 if (dmarc_has_been_checked++ == 0)
3332 dmarc_process();
3333 /* used long way of dmarc_exim_expand_query() in case we need more
3334 * view into the process in the future. */
3335 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3336 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3337 break;
3338 #endif
3339
059ec3d9
PH		 3340 case ACLC_DNSLISTS:
3341 rc = verify_check_dnsbl(&arg);
3342 break;
3343
3344 case ACLC_DOMAINS:
3345 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3346 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
3347 break;
3348
3349 /* The value in tls_cipher is the full cipher name, for example,
3350 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3351 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3352 what may in practice come out of the SSL library - which at the time of
3353 writing is poorly documented. */
3354
3355 case ACLC_ENCRYPTED:
817d9f57 3356 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3357 {
3358 uschar *endcipher = NULL;
817d9f57
JH		 3359 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3360 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3361 {
3362 endcipher = Ustrchr(++cipher, ':');
3363 if (endcipher != NULL) *endcipher = 0;
3364 }
3365 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3366 if (endcipher != NULL) *endcipher = ':';
3367 }
3368 break;
3369
3370 /* Use verify_check_this_host() instead of verify_check_host() so that
3371 we can pass over &host_data to catch any looked up data. Once it has been
3372 set, it retains its value so that it's still there if another ACL verb
3373 comes through here and uses the cache. However, we must put it into
3374 permanent store in case it is also expected to be used in a subsequent
3375 message in the same SMTP connection. */
3376
3377 case ACLC_HOSTS:
3378 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3379 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
3380 if (host_data != NULL) host_data = string_copy_malloc(host_data);
3381 break;
3382
3383 case ACLC_LOCAL_PARTS:
3384 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3385 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3386 &deliver_localpart_data);
3387 break;
3388
6ea85e9a
PH		 3389 case ACLC_LOG_REJECT_TARGET:
3390 {
3391 int logbits = 0;
3392 int sep = 0;
3393 uschar *s = arg;
3394 uschar *ss;
3395 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
3396 != NULL)
3397 {
3398 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3399 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3400 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3401 else
3402 {
3403 logbits |= LOG_MAIN|LOG_REJECT;
3404 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3405 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3406 }
3407 }
3408 log_reject_target = logbits;
3409 }
3410 break;
3411
059ec3d9
PH		 3412 case ACLC_LOGWRITE:
3413 {
3414 int logbits = 0;
3415 uschar *s = arg;
3416 if (*s == ':')
3417 {
3418 s++;
3419 while (*s != ':')
3420 {
3421 if (Ustrncmp(s, "main", 4) == 0)
3422 { logbits |= LOG_MAIN; s += 4; }
3423 else if (Ustrncmp(s, "panic", 5) == 0)
3424 { logbits |= LOG_PANIC; s += 5; }
3425 else if (Ustrncmp(s, "reject", 6) == 0)
3426 { logbits |= LOG_REJECT; s += 6; }
3427 else
3428 {
3429 logbits = LOG_MAIN|LOG_PANIC;
3430 s = string_sprintf(":unknown log name in \"%s\" in "
3431 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3432 }
3433 if (*s == ',') s++;
3434 }
3435 s++;
3436 }
3437 while (isspace(*s)) s++;
6ea85e9a
PH		 3438
3439
059ec3d9
PH		 3440 if (logbits == 0) logbits = LOG_MAIN;
3441 log_write(0, logbits, "%s", string_printing(s));
3442 }
3443 break;
8e669ac1 3444
71fafd95 3445 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3446 case ACLC_MALWARE:
3447 {
6ea85e9a 3448 /* Separate the regular expression and any optional parameters. */
8523533c
TK		 3449 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3450 /* Run the malware backend. */
3451 rc = malware(&ss);
3452 /* Modify return code based upon the existance of options. */
3453 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3454 != NULL) {
3455 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3456 {
3457 /* FAIL so that the message is passed to the next ACL */
3458 rc = FAIL;
3459 }
3460 }
3461 }
3462 break;
3463
3464 case ACLC_MIME_REGEX:
71fafd95 3465 rc = mime_regex(&arg);
8523533c 3466 break;
71fafd95 3467 #endif
059ec3d9 3468
870f6ba8 3469 case ACLC_RATELIMIT:
90fc3069 3470 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3471 break;
3472
059ec3d9
PH		 3473 case ACLC_RECIPIENTS:
3474 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3475 &recipient_data);
3476 break;
3477
71fafd95
PH		 3478 #ifdef WITH_CONTENT_SCAN
3479 case ACLC_REGEX:
3480 rc = regex(&arg);
8523533c 3481 break;
71fafd95 3482 #endif
8523533c 3483
e7568d51
TL		 3484 case ACLC_REMOVE_HEADER:
3485 setup_remove_header(arg);
3486 break;
3487
059ec3d9
PH		 3488 case ACLC_SENDER_DOMAINS:
3489 {
3490 uschar *sdomain;
3491 sdomain = Ustrrchr(sender_address, '@');
3492 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3493 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3494 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3495 }
3496 break;
3497
3498 case ACLC_SENDERS:
3499 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
3500 sender_address_cache, -1, 0, &sender_data);
3501 break;
3502
3503 /* Connection variables must persist forever */
3504
3505 case ACLC_SET:
3506 {
3507 int old_pool = store_pool;
38a0a95f
PH		 3508 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3509 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3510 store_pool = old_pool;
3511 }
3512 break;
3513
71fafd95 3514 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3515 case ACLC_SPAM:
3516 {
3517 /* Seperate the regular expression and any optional parameters. */
3518 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3519 /* Run the spam backend. */
3520 rc = spam(&ss);
3521 /* Modify return code based upon the existance of options. */
3522 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3523 != NULL) {
3524 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3525 {
3526 /* FAIL so that the message is passed to the next ACL */
3527 rc = FAIL;
3528 }
3529 }
3530 }
3531 break;
71fafd95 3532 #endif
8523533c 3533
71fafd95 3534 #ifdef EXPERIMENTAL_SPF
8523533c 3535 case ACLC_SPF:
65a7d8c3
NM		 3536 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3537 break;
3538 case ACLC_SPF_GUESS:
3539 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3540 break;
71fafd95 3541 #endif
8523533c 3542
059ec3d9
PH		 3543 /* If the verb is WARN, discard any user message from verification, because
3544 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3545 only from explicit "message" modifiers. However, put the user message into
3546 $acl_verify_message so it can be used in subsequent conditions or modifiers
3547 (until something changes it). */
059ec3d9
PH		 3548
3549 case ACLC_VERIFY:
3550 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3551 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3552 if (verb == ACL_WARN) *user_msgptr = NULL;
3553 break;
3554
3555 default:
3556 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3557 "condition %d", cb->type);
3558 break;
3559 }
3560
3561 /* If a condition was negated, invert OK/FAIL. */
3562
3563 if (!cond_modifiers[cb->type] && cb->u.negated)
3564 {
3565 if (rc == OK) rc = FAIL;
3566 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3567 }
3568
3569 if (rc != OK) break; /* Conditions loop */
3570 }
3571
3572
3573/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3574handle the values of these modifiers. If there isn't a log message set, we make
3575it the same as the user message.
059ec3d9
PH		 3576
3577"message" is a user message that will be included in an SMTP response. Unless
3578it is empty, it overrides any previously set user message.
3579
3580"log_message" is a non-user message, and it adds to any existing non-user
3581message that is already set.
3582
4e88a19f
PH		 3583Most verbs have but a single return for which the messages are relevant, but
3584for "discard", it's useful to have the log message both when it succeeds and
3585when it fails. For "accept", the message is used in the OK case if there is no
3586"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3587present. */
059ec3d9 3588
4e88a19f
PH		 3589if (*epp && rc == OK) user_message = NULL;
3590
3591if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3592 {
3593 uschar *expmessage;
4e88a19f
PH		 3594 uschar *old_user_msgptr = *user_msgptr;
3595 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3596
3597 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3598 nested ACLs) are always discarded. This also happens for acceptance verbs
3599 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3600 However, the value of an existing message is available in $acl_verify_message
3601 during expansions. */
3602
4e88a19f
PH		 3603 if (verb == ACL_WARN ||
3604 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3605 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3606
3607 if (user_message != NULL)
3608 {
3609 acl_verify_message = old_user_msgptr;
3610 expmessage = expand_string(user_message);
3611 if (expmessage == NULL)
3612 {
3613 if (!expand_string_forcedfail)
3614 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3615 user_message, expand_string_message);
3616 }
3617 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3618 }
3619
3620 if (log_message != NULL)
3621 {
3622 acl_verify_message = old_log_msgptr;
3623 expmessage = expand_string(log_message);
3624 if (expmessage == NULL)
3625 {
3626 if (!expand_string_forcedfail)
3627 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3628 log_message, expand_string_message);
3629 }
3630 else if (expmessage[0] != 0)
3631 {
3632 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3633 string_sprintf("%s: %s", expmessage, *log_msgptr);
3634 }
3635 }
3636
3637 /* If no log message, default it to the user message */
3638
3639 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3640 }
3641
3642acl_verify_message = NULL;
3643return rc;
3644}
3645
3646
3647
3648
3649
3650/*************************************************
3651* Get line from a literal ACL *
3652*************************************************/
3653
3654/* This function is passed to acl_read() in order to extract individual lines
3655of a literal ACL, which we access via static pointers. We can destroy the
3656contents because this is called only once (the compiled ACL is remembered).
3657
3658This code is intended to treat the data in the same way as lines in the main
3659Exim configuration file. That is:
3660
3661 . Leading spaces are ignored.
3662
3663 . A \ at the end of a line is a continuation - trailing spaces after the \
3664 are permitted (this is because I don't believe in making invisible things
3665 significant). Leading spaces on the continued part of a line are ignored.
3666
3667 . Physical lines starting (significantly) with # are totally ignored, and
3668 may appear within a sequence of backslash-continued lines.
3669
3670 . Blank lines are ignored, but will end a sequence of continuations.
3671
3672Arguments: none
3673Returns: a pointer to the next line
3674*/
3675
3676
3677static uschar *acl_text; /* Current pointer in the text */
3678static uschar *acl_text_end; /* Points one past the terminating '0' */
3679
3680
3681static uschar *
3682acl_getline(void)
3683{
3684uschar *yield;
3685
3686/* This loop handles leading blank lines and comments. */
3687
3688for(;;)
3689 {
3690 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3691 if (*acl_text == 0) return NULL; /* No more data */
3692 yield = acl_text; /* Potential data line */
3693
3694 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3695
3696 /* If we hit the end before a newline, we have the whole logical line. If
3697 it's a comment, there's no more data to be given. Otherwise, yield it. */
3698
3699 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3700
3701 /* After reaching a newline, end this loop if the physical line does not
3702 start with '#'. If it does, it's a comment, and the loop continues. */
3703
3704 if (*yield != '#') break;
3705 }
3706
3707/* This loop handles continuations. We know we have some real data, ending in
3708newline. See if there is a continuation marker at the end (ignoring trailing
3709white space). We know that *yield is not white space, so no need to test for
3710cont > yield in the backwards scanning loop. */
3711
3712for(;;)
3713 {
3714 uschar *cont;
3715 for (cont = acl_text - 1; isspace(*cont); cont--);
3716
3717 /* If no continuation follows, we are done. Mark the end of the line and
3718 return it. */
3719
3720 if (*cont != '\\')
3721 {
3722 *acl_text++ = 0;
3723 return yield;
3724 }
3725
3726 /* We have encountered a continuation. Skip over whitespace at the start of
3727 the next line, and indeed the whole of the next line or lines if they are
3728 comment lines. */
3729
3730 for (;;)
3731 {
3732 while (*(++acl_text) == ' ' || *acl_text == '\t');
3733 if (*acl_text != '#') break;
3734 while (*(++acl_text) != 0 && *acl_text != '\n');
3735 }
3736
3737 /* We have the start of a continuation line. Move all the rest of the data
3738 to join onto the previous line, and then find its end. If the end is not a
3739 newline, we are done. Otherwise loop to look for another continuation. */
3740
3741 memmove(cont, acl_text, acl_text_end - acl_text);
3742 acl_text_end -= acl_text - cont;
3743 acl_text = cont;
3744 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3745 if (*acl_text == 0) return yield;
3746 }
3747
3748/* Control does not reach here */
3749}
3750
3751
3752
3753
3754
3755/*************************************************
3756* Check access using an ACL *
3757*************************************************/
3758
3759/* This function is called from address_check. It may recurse via
3760acl_check_condition() - hence the use of a level to stop looping. The ACL is
3761passed as a string which is expanded. A forced failure implies no access check
3762is required. If the result is a single word, it is taken as the name of an ACL
3763which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3764text, complete with newlines, and parsed as such. In both cases, the ACL check
3765is then run. This function uses an auxiliary function for acl_read() to call
3766for reading individual lines of a literal ACL. This is acl_getline(), which
3767appears immediately above.
3768
3769Arguments:
3770 where where called from
3771 addr address item when called from RCPT; otherwise NULL
3772 s the input string; NULL is the same as an empty ACL => DENY
3773 level the nesting level
3774 user_msgptr where to put a user error (for SMTP response)
3775 log_msgptr where to put a logging message (not for SMTP response)
3776
3777Returns: OK access is granted
3778 DISCARD access is apparently granted...
3779 FAIL access is denied
3780 FAIL_DROP access is denied; drop the connection
3781 DEFER can't tell at the moment
3782 ERROR disaster
3783*/
3784
3785static int
3786acl_check_internal(int where, address_item *addr, uschar *s, int level,
3787 uschar **user_msgptr, uschar **log_msgptr)
3788{
3789int fd = -1;
3790acl_block *acl = NULL;
3791uschar *acl_name = US"inline ACL";
3792uschar *ss;
3793
3794/* Catch configuration loops */
3795
3796if (level > 20)
3797 {
3798 *log_msgptr = US"ACL nested too deep: possible loop";
3799 return ERROR;
3800 }
3801
3802if (s == NULL)
3803 {
3804 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3805 return FAIL;
3806 }
3807
3808/* At top level, we expand the incoming string. At lower levels, it has already
3809been expanded as part of condition processing. */
3810
3811if (level == 0)
3812 {
3813 ss = expand_string(s);
3814 if (ss == NULL)
3815 {
3816 if (expand_string_forcedfail) return OK;
3817 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3818 expand_string_message);
3819 return ERROR;
3820 }
3821 }
3822else ss = s;
3823
3824while (isspace(*ss))ss++;
3825
3826/* If we can't find a named ACL, the default is to parse it as an inline one.
3827(Unless it begins with a slash; non-existent files give rise to an error.) */
3828
3829acl_text = ss;
3830
3831/* Handle the case of a string that does not contain any spaces. Look for a
3832named ACL among those read from the configuration, or a previously read file.
3833It is possible that the pointer to the ACL is NULL if the configuration
3834contains a name with no data. If not found, and the text begins with '/',
3835read an ACL from a file, and save it so it can be re-used. */
3836
3837if (Ustrchr(ss, ' ') == NULL)
3838 {
3839 tree_node *t = tree_search(acl_anchor, ss);
3840 if (t != NULL)
3841 {
3842 acl = (acl_block *)(t->data.ptr);
3843 if (acl == NULL)
3844 {
3845 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3846 return FAIL;
3847 }
3848 acl_name = string_sprintf("ACL \"%s\"", ss);
3849 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3850 }
3851
3852 else if (*ss == '/')
3853 {
3854 struct stat statbuf;
3855 fd = Uopen(ss, O_RDONLY, 0);
3856 if (fd < 0)
3857 {
3858 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3859 strerror(errno));
3860 return ERROR;
3861 }
3862
3863 if (fstat(fd, &statbuf) != 0)
3864 {
3865 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3866 strerror(errno));
3867 return ERROR;
3868 }
3869
3870 acl_text = store_get(statbuf.st_size + 1);
3871 acl_text_end = acl_text + statbuf.st_size + 1;
3872
3873 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3874 {
3875 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3876 ss, strerror(errno));
3877 return ERROR;
3878 }
3879 acl_text[statbuf.st_size] = 0;
f1e894f3 3880 (void)close(fd);
059ec3d9
PH		 3881
3882 acl_name = string_sprintf("ACL \"%s\"", ss);
3883 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3884 }
3885 }
3886
3887/* Parse an ACL that is still in text form. If it came from a file, remember it
3888in the ACL tree, having read it into the POOL_PERM store pool so that it
3889persists between multiple messages. */
3890
3891if (acl == NULL)
3892 {
3893 int old_pool = store_pool;
3894 if (fd >= 0) store_pool = POOL_PERM;
3895 acl = acl_read(acl_getline, log_msgptr);
3896 store_pool = old_pool;
3897 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3898 if (fd >= 0)
3899 {
3900 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3901 Ustrcpy(t->name, ss);
3902 t->data.ptr = acl;
3903 (void)tree_insertnode(&acl_anchor, t);
3904 }
3905 }
3906
3907/* Now we have an ACL to use. It's possible it may be NULL. */
3908
3909while (acl != NULL)
3910 {
3911 int cond;
3912 int basic_errno = 0;
3913 BOOL endpass_seen = FALSE;
3914
3915 *log_msgptr = *user_msgptr = NULL;
3916 acl_temp_details = FALSE;
3917
7353285c 3918 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
059ec3d9
PH		 3919 acl->verb != ACL_ACCEPT &&
3920 acl->verb != ACL_WARN)
3921 {
7353285c 3922 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
059ec3d9
PH		 3923 verbs[acl->verb]);
3924 return ERROR;
3925 }
3926
3927 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3928
3929 /* Clear out any search error message from a previous check before testing
3930 this condition. */
3931
3932 search_error_message = NULL;
3933 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3934 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3935
3936 /* Handle special returns: DEFER causes a return except on a WARN verb;
3937 ERROR always causes a return. */
3938
3939 switch (cond)
3940 {
3941 case DEFER:
6968512f 3942 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 3943 if (basic_errno != ERRNO_CALLOUTDEFER)
3944 {
3945 if (search_error_message != NULL && *search_error_message != 0)
3946 *log_msgptr = search_error_message;
3947 if (smtp_return_error_details) acl_temp_details = TRUE;
3948 }
3949 else
3950 {
3951 acl_temp_details = TRUE;
3952 }
3953 if (acl->verb != ACL_WARN) return DEFER;
3954 break;
3955
3956 default: /* Paranoia */
3957 case ERROR:
6968512f 3958 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 3959 return ERROR;
3960
3961 case OK:
6968512f
JH		 3962 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
3963 verbs[acl->verb], acl_name);
059ec3d9
PH		 3964 break;
3965
3966 case FAIL:
6968512f 3967 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 3968 break;
3969
3970 /* DISCARD and DROP can happen only from a nested ACL condition, and
3971 DISCARD can happen only for an "accept" or "discard" verb. */
3972
3973 case DISCARD:
6968512f
JH		 3974 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
3975 verbs[acl->verb], acl_name);
059ec3d9
PH		 3976 break;
3977
3978 case FAIL_DROP:
6968512f
JH		 3979 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
3980 verbs[acl->verb], acl_name);
059ec3d9
PH		 3981 break;
3982 }
3983
3984 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3985 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3986 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3987
3988 switch(acl->verb)
3989 {
3990 case ACL_ACCEPT:
3991 if (cond == OK || cond == DISCARD) return cond;
3992 if (endpass_seen)
3993 {
3994 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3995 return cond;
3996 }
3997 break;
3998
3999 case ACL_DEFER:
4000 if (cond == OK)
4001 {
4002 acl_temp_details = TRUE;
4003 return DEFER;
4004 }
4005 break;
4006
4007 case ACL_DENY:
4008 if (cond == OK) return FAIL;
4009 break;
4010
4011 case ACL_DISCARD:
4012 if (cond == OK || cond == DISCARD) return DISCARD;
4013 if (endpass_seen)
4014 {
4015 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4016 return cond;
4017 }
4018 break;
4019
4020 case ACL_DROP:
4021 if (cond == OK) return FAIL_DROP;
4022 break;
4023
4024 case ACL_REQUIRE:
4025 if (cond != OK) return cond;
4026 break;
4027
4028 case ACL_WARN:
4029 if (cond == OK)
4030 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4031 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4032 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4033 "condition test deferred%s%s", host_and_ident(TRUE),
4034 (*log_msgptr == NULL)? US"" : US": ",
4035 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4036 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4037 break;
4038
4039 default:
4040 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4041 acl->verb);
4042 break;
4043 }
4044
4045 /* Pass to the next ACL item */
4046
4047 acl = acl->next;
4048 }
4049
4050/* We have reached the end of the ACL. This is an implicit DENY. */
4051
4052HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4053return FAIL;
4054}
4055
4056
333eea9c
JH		 4057
4058
4059/* Same args as acl_check_internal() above, but the string s is
4060the name of an ACL followed optionally by up to 9 space-separated arguments.
4061The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8
JH		 4062static int
4063acl_check_wargs(int where, address_item *addr, uschar *s, int level,
333eea9c
JH		 4064 uschar **user_msgptr, uschar **log_msgptr)
4065{
4066uschar * tmp;
bef3ea7f 4067uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4068uschar * sav_arg[9]; /* must match acl_arg[] */
4069int sav_narg;
333eea9c 4070uschar * name;
bef3ea7f 4071int i;
ef21c07d 4072int ret;
333eea9c
JH		 4073
4074if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4075 goto bad;
4076
bef3ea7f 4077for (i = 0; i < 9; i++)
333eea9c
JH		 4078 {
4079 while (*s && isspace(*s)) s++;
4080 if (!*s) break;
bef3ea7f 4081 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4082 {
4083 tmp = name;
4084 goto bad;
4085 }
4086 }
ef21c07d
JH		 4087
4088sav_narg = acl_narg;
bef3ea7f 4089acl_narg = i;
ef21c07d
JH		 4090for (i = 0; i < acl_narg; i++)
4091 {
4092 sav_arg[i] = acl_arg[i];
4093 acl_arg[i] = tmp_arg[i];
4094 }
4095while (i < 9)
4096 {
4097 sav_arg[i] = acl_arg[i];
4098 acl_arg[i++] = NULL;
4099 }
4100
4101ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4102
ef21c07d
JH		 4103acl_narg = sav_narg;
4104for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4105return ret;
333eea9c
JH		 4106
4107bad:
4108if (expand_string_forcedfail) return ERROR;
4109*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4110 tmp, expand_string_message);
4111return search_find_defer?DEFER:ERROR;
4112}
4113
4114
4115
059ec3d9
PH		 4116/*************************************************
4117* Check access using an ACL *
4118*************************************************/
4119
faa05a93
JH		 4120/* Alternate interface for ACL, used by expansions */
4121int
05caaeaa 4122acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4123{
faa05a93
JH		 4124address_item adb;
4125address_item *addr = NULL;
4126
4127*user_msgptr = *log_msgptr = NULL;
4128sender_verified_failed = NULL;
4129ratelimiters_cmd = NULL;
4130log_reject_target = LOG_MAIN|LOG_REJECT;
4131
4132if (where == ACL_WHERE_RCPT)
4133 {
4134 adb = address_defaults;
4135 addr = &adb;
05caaeaa
JH		 4136 addr->address = expand_string(US"$local_part@$domain");
4137 addr->domain = deliver_domain;
4138 addr->local_part = deliver_localpart;
4139 addr->cc_local_part = deliver_localpart;
4140 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4141 }
4142
4143return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4144}
4145
4146
4147
059ec3d9
PH		 4148/* This is the external interface for ACL checks. It sets up an address and the
4149expansions for $domain and $local_part when called after RCPT, then calls
4150acl_check_internal() to do the actual work.
4151
4152Arguments:
4153 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4154 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4155 s the input string; NULL is the same as an empty ACL => DENY
4156 user_msgptr where to put a user error (for SMTP response)
4157 log_msgptr where to put a logging message (not for SMTP response)
4158
4159Returns: OK access is granted by an ACCEPT verb
4160 DISCARD access is granted by a DISCARD verb
4161 FAIL access is denied
4162 FAIL_DROP access is denied; drop the connection
4163 DEFER can't tell at the moment
4164 ERROR disaster
4165*/
faa05a93 4166int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4167
4168int
64ffc24f 4169acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4170 uschar **log_msgptr)
4171{
4172int rc;
4173address_item adb;
64ffc24f 4174address_item *addr = NULL;
059ec3d9
PH		 4175
4176*user_msgptr = *log_msgptr = NULL;
4177sender_verified_failed = NULL;
fe0dab11 4178ratelimiters_cmd = NULL;
6ea85e9a 4179log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4180
fd98a5c6
JH		 4181#ifdef EXPERIMENTAL_PRDR
4182if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR )
4183#else
4184if (where == ACL_WHERE_RCPT )
4185#endif
059ec3d9
PH		 4186 {
4187 adb = address_defaults;
4188 addr = &adb;
64ffc24f 4189 addr->address = recipient;
059ec3d9
PH		 4190 if (deliver_split_address(addr) == DEFER)
4191 {
4192 *log_msgptr = US"defer in percent_hack_domains check";
4193 return DEFER;
4194 }
4195 deliver_domain = addr->domain;
4196 deliver_localpart = addr->local_part;
4197 }
059ec3d9 4198
faa05a93 4199acl_where = where;
059ec3d9 4200rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4201acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4202
817d9f57
JH		 4203/* Cutthrough - if requested,
4204and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4205and rcpt acl returned accept,
4206and first recipient (cancel on any subsequents)
e4bdf652 4207open one now and run it up to RCPT acceptance.
e4bdf652 4208A failed verify should cancel cutthrough request.
e4bdf652 4209
817d9f57 4210Initial implementation: dual-write to spool.
e4bdf652
JH		 4211Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4212
4213Cease cutthrough copy on rxd final dot; do not send one.
4214
4215On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4216
4217On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4218perm-rejected, reflect that to the original sender - and dump the spooled copy.
4219If temp-reject, close the conn (and keep the spooled copy).
4220If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4221*/
4222switch (where)
4223{
4224case ACL_WHERE_RCPT:
fd98a5c6
JH		 4225#ifdef EXPERIMENTAL_PRDR
4226case ACL_WHERE_PRDR:
4227#endif
e4bdf652 4228 if( rcpt_count > 1 )
2e5b33cd 4229 cancel_cutthrough_connection("more than one recipient");
e4bdf652
JH		 4230 else if (rc == OK && cutthrough_delivery && cutthrough_fd < 0)
4231 open_cutthrough_connection(addr);
4232 break;
4233
4234case ACL_WHERE_PREDATA:
4235 if( rc == OK )
4236 cutthrough_predata();
4237 else
2e5b33cd 4238 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4239 break;
4240
4241case ACL_WHERE_QUIT:
4242case ACL_WHERE_NOTQUIT:
2e5b33cd 4243 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4244 break;
4245
4246default:
4247 break;
4248}
4249
64ffc24f
PH		 4250deliver_domain = deliver_localpart = deliver_address_data =
4251 sender_address_data = NULL;
059ec3d9
PH		 4252
4253/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4254ACL, which is really in the middle of an SMTP command. */
4255
4256if (rc == DISCARD)
4257 {
4258 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4259 {
4260 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4261 "ACL", acl_wherenames[where]);
4262 return ERROR;
4263 }
4264 return DISCARD;
4265 }
4266
4267/* A DROP response is not permitted from MAILAUTH */
4268
4269if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4270 {
4271 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4272 "ACL", acl_wherenames[where]);
4273 return ERROR;
4274 }
4275
4e88a19f
PH		 4276/* Before giving a response, take a look at the length of any user message, and
4277split it up into multiple lines if possible. */
059ec3d9 4278
e28326d8
PH		 4279*user_msgptr = string_split_message(*user_msgptr);
4280if (fake_response != OK)
4281 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4282
4283return rc;
4284}
4285
38a0a95f 4286
38a0a95f
PH		 4287/*************************************************
4288* Create ACL variable *
4289*************************************************/
4290
4291/* Create an ACL variable or reuse an existing one. ACL variables are in a
4292binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4293
4294Argument:
4295 name pointer to the variable's name, starting with c or m
4296
4297Returns the pointer to variable's tree node
4298*/
4299
4300tree_node *
4301acl_var_create(uschar *name)
4302{
4303tree_node *node, **root;
4304root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4305node = tree_search(*root, name);
4306if (node == NULL)
4307 {
4308 node = store_get(sizeof(tree_node) + Ustrlen(name));
4309 Ustrcpy(node->name, name);
4310 (void)tree_insertnode(root, node);
4311 }
4312node->data.ptr = NULL;
4313return node;
4314}
4315
4316
4317
4318/*************************************************
4319* Write an ACL variable in spool format *
4320*************************************************/
4321
4322/* This function is used as a callback for tree_walk when writing variables to
4323the spool file. To retain spool file compatibility, what is written is -aclc or
4324-aclm followed by the rest of the name and the data length, space separated,
4325then the value itself, starting on a new line, and terminated by an additional
4326newline. When we had only numbered ACL variables, the first line might look
4327like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4328acl_cfoo.
4329
4330Arguments:
4331 name of the variable
4332 value of the variable
4333 ctx FILE pointer (as a void pointer)
4334
4335Returns: nothing
4336*/
4337
4338void
4339acl_var_write(uschar *name, uschar *value, void *ctx)
4340{
4341FILE *f = (FILE *)ctx;
4342fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4343}
4344
059ec3d9 4345/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.