tidying
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH
24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH
31 US"warn" };
32
4e88a19f
PH
33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH
47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH
49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH
52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK
55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK
61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK
64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
80a47a2c
TK
68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
fb2274d4 71#endif
4840604e
TL
72#ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
74#endif
71fafd95
PH
75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
6ea85e9a 82 ACLC_LOG_REJECT_TARGET,
71fafd95 83 ACLC_LOGWRITE,
8523533c
TK
84#ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86#endif
87 ACLC_MESSAGE,
88#ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90#endif
b0b9dbb1 91 ACLC_QUEUE,
870f6ba8 92 ACLC_RATELIMIT,
8523533c
TK
93 ACLC_RECIPIENTS,
94#ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96#endif
e7568d51 97 ACLC_REMOVE_HEADER,
71fafd95
PH
98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
8523533c 101#ifdef WITH_CONTENT_SCAN
8e669ac1 102 ACLC_SPAM,
8523533c
TK
103#endif
104#ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
65a7d8c3 106 ACLC_SPF_GUESS,
8523533c 107#endif
b0019c78 108 ACLC_UDPSEND,
8523533c 109 ACLC_VERIFY };
059ec3d9 110
c3611384 111/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 112"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH
113modifiers that look like conditions but always return TRUE. They are used for
114their side effects. */
059ec3d9 115
9a26b6b2
PH
116static uschar *conditions[] = {
117 US"acl",
71fafd95 118 US"add_header",
9a26b6b2 119 US"authenticated",
8523533c
TK
120#ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122#endif
123 US"condition",
c3611384 124 US"continue",
8e669ac1 125 US"control",
6a8f9482
TK
126#ifdef EXPERIMENTAL_DCC
127 US"dcc",
128#endif
8523533c
TK
129#ifdef WITH_CONTENT_SCAN
130 US"decode",
131#endif
132 US"delay",
80a47a2c
TK
133#ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
fb2274d4 136#endif
4840604e
TL
137#ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
139#endif
6ea85e9a
PH
140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
8523533c
TK
149#ifdef WITH_CONTENT_SCAN
150 US"malware",
151#endif
152 US"message",
153#ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155#endif
b0b9dbb1 156 US"queue",
870f6ba8 157 US"ratelimit",
8523533c
TK
158 US"recipients",
159#ifdef WITH_CONTENT_SCAN
160 US"regex",
161#endif
e7568d51 162 US"remove_header",
b0b9dbb1
JH
163 US"sender_domains",
164 US"senders",
165 US"set",
8523533c
TK
166#ifdef WITH_CONTENT_SCAN
167 US"spam",
168#endif
169#ifdef EXPERIMENTAL_SPF
170 US"spf",
65a7d8c3 171 US"spf_guess",
8523533c 172#endif
b0019c78 173 US"udpsend",
059ec3d9 174 US"verify" };
8e669ac1 175
c5fcb476 176
9a26b6b2
PH
177/* Return values from decode_control(); keep in step with the table of names
178that follows! */
179
180enum {
c46782ef 181 CONTROL_AUTH_UNADVERTISED,
3c8b3577 182#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 183 CONTROL_BMI_RUN,
3c8b3577 184#endif
ed7f7860 185 CONTROL_DEBUG,
3c8b3577 186#ifndef DISABLE_DKIM
f7572e5a 187 CONTROL_DKIM_VERIFY,
3c8b3577
JH
188#endif
189#ifdef EXPERIMENTAL_DMARC
4840604e
TL
190 CONTROL_DMARC_VERIFY,
191 CONTROL_DMARC_FORENSIC,
3c8b3577 192#endif
13363eba 193 CONTROL_DSCP,
c46782ef
PH
194 CONTROL_ERROR,
195 CONTROL_CASEFUL_LOCAL_PART,
196 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 197 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH
198 CONTROL_ENFORCE_SYNC,
199 CONTROL_NO_ENFORCE_SYNC,
200 CONTROL_FREEZE,
201 CONTROL_QUEUE_ONLY,
202 CONTROL_SUBMISSION,
203 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 204#ifdef WITH_CONTENT_SCAN
9a26b6b2 205 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 206#endif
c46782ef
PH
207 CONTROL_FAKEDEFER,
208 CONTROL_FAKEREJECT,
8c5d388a 209#ifdef SUPPORT_I18N
3c8b3577
JH
210 CONTROL_UTF8_DOWNCONVERT,
211#endif
cf8b11a5 212 CONTROL_NO_MULTILINE,
047bdd8c 213 CONTROL_NO_PIPELINING,
4c590bd1
PH
214 CONTROL_NO_DELAY_FLUSH,
215 CONTROL_NO_CALLOUT_FLUSH
c46782ef 216};
9a26b6b2 217
8800895a
PH
218/* ACL control names; keep in step with the table above! This list is used for
219turning ids into names. The actual list of recognized names is in the variable
220control_def controls_list[] below. The fact that there are two lists is a mess
221and should be tidied up. */
9a26b6b2
PH
222
223static uschar *controls[] = {
c46782ef 224 US"allow_auth_unadvertised",
3c8b3577 225#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 226 US"bmi_run",
3c8b3577 227#endif
ed7f7860 228 US"debug",
3c8b3577 229#ifndef DISABLE_DKIM
80a47a2c 230 US"dkim_disable_verify",
3c8b3577
JH
231#endif
232#ifdef EXPERIMENTAL_DMARC
4840604e
TL
233 US"dmarc_disable_verify",
234 US"dmarc_enable_forensic",
3c8b3577 235#endif
13363eba 236 US"dscp",
c46782ef
PH
237 US"error",
238 US"caseful_local_part",
239 US"caselower_local_part",
e4bdf652 240 US"cutthrough_delivery",
c46782ef
PH
241 US"enforce_sync",
242 US"no_enforce_sync",
243 US"freeze",
244 US"queue_only",
245 US"submission",
246 US"suppress_local_fixups",
3c8b3577 247#ifdef WITH_CONTENT_SCAN
9a26b6b2 248 US"no_mbox_unspool",
3c8b3577 249#endif
cf8b11a5
PH
250 US"fakedefer",
251 US"fakereject",
8c5d388a 252#ifdef SUPPORT_I18N
3c8b3577
JH
253 US"utf8_downconvert",
254#endif
aa6dc513 255 US"no_multiline_responses",
cf8b11a5 256 US"no_pipelining",
4c590bd1
PH
257 US"no_delay_flush",
258 US"no_callout_flush"
c46782ef 259};
059ec3d9 260
047bdd8c 261/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH
262at the outer level. In the other cases, expansion already occurs in the
263checking functions. */
264
265static uschar cond_expand_at_top[] = {
7421ecab 266 FALSE, /* acl */
3e536984 267 TRUE, /* add_header */
059ec3d9 268 FALSE, /* authenticated */
8523533c
TK
269#ifdef EXPERIMENTAL_BRIGHTMAIL
270 TRUE, /* bmi_optin */
8e669ac1 271#endif
059ec3d9 272 TRUE, /* condition */
c3611384 273 TRUE, /* continue */
059ec3d9 274 TRUE, /* control */
6a8f9482
TK
275#ifdef EXPERIMENTAL_DCC
276 TRUE, /* dcc */
277#endif
8523533c
TK
278#ifdef WITH_CONTENT_SCAN
279 TRUE, /* decode */
280#endif
059ec3d9 281 TRUE, /* delay */
80a47a2c
TK
282#ifndef DISABLE_DKIM
283 TRUE, /* dkim_signers */
284 TRUE, /* dkim_status */
fb2274d4 285#endif
4840604e
TL
286#ifdef EXPERIMENTAL_DMARC
287 TRUE, /* dmarc_status */
288#endif
059ec3d9
PH
289 TRUE, /* dnslists */
290 FALSE, /* domains */
291 FALSE, /* encrypted */
292 TRUE, /* endpass */
293 FALSE, /* hosts */
294 FALSE, /* local_parts */
295 TRUE, /* log_message */
6ea85e9a 296 TRUE, /* log_reject_target */
059ec3d9 297 TRUE, /* logwrite */
8523533c
TK
298#ifdef WITH_CONTENT_SCAN
299 TRUE, /* malware */
300#endif
059ec3d9 301 TRUE, /* message */
8523533c
TK
302#ifdef WITH_CONTENT_SCAN
303 TRUE, /* mime_regex */
304#endif
b0b9dbb1 305 TRUE, /* queue */
870f6ba8 306 TRUE, /* ratelimit */
059ec3d9 307 FALSE, /* recipients */
8523533c
TK
308#ifdef WITH_CONTENT_SCAN
309 TRUE, /* regex */
310#endif
e7568d51 311 TRUE, /* remove_header */
059ec3d9
PH
312 FALSE, /* sender_domains */
313 FALSE, /* senders */
314 TRUE, /* set */
8523533c
TK
315#ifdef WITH_CONTENT_SCAN
316 TRUE, /* spam */
317#endif
318#ifdef EXPERIMENTAL_SPF
319 TRUE, /* spf */
65a7d8c3 320 TRUE, /* spf_guess */
8523533c 321#endif
b0019c78 322 TRUE, /* udpsend */
059ec3d9
PH
323 TRUE /* verify */
324};
325
326/* Flags to identify the modifiers */
327
328static uschar cond_modifiers[] = {
329 FALSE, /* acl */
3e536984 330 TRUE, /* add_header */
059ec3d9 331 FALSE, /* authenticated */
8523533c
TK
332#ifdef EXPERIMENTAL_BRIGHTMAIL
333 TRUE, /* bmi_optin */
8e669ac1 334#endif
059ec3d9 335 FALSE, /* condition */
c3611384 336 TRUE, /* continue */
059ec3d9 337 TRUE, /* control */
6a8f9482
TK
338#ifdef EXPERIMENTAL_DCC
339 FALSE, /* dcc */
340#endif
8523533c
TK
341#ifdef WITH_CONTENT_SCAN
342 FALSE, /* decode */
343#endif
059ec3d9 344 TRUE, /* delay */
80a47a2c
TK
345#ifndef DISABLE_DKIM
346 FALSE, /* dkim_signers */
347 FALSE, /* dkim_status */
fb2274d4 348#endif
4840604e
TL
349#ifdef EXPERIMENTAL_DMARC
350 FALSE, /* dmarc_status */
351#endif
059ec3d9
PH
352 FALSE, /* dnslists */
353 FALSE, /* domains */
354 FALSE, /* encrypted */
355 TRUE, /* endpass */
356 FALSE, /* hosts */
357 FALSE, /* local_parts */
358 TRUE, /* log_message */
6ea85e9a 359 TRUE, /* log_reject_target */
8523533c
TK
360 TRUE, /* logwrite */
361#ifdef WITH_CONTENT_SCAN
362 FALSE, /* malware */
363#endif
059ec3d9 364 TRUE, /* message */
8523533c
TK
365#ifdef WITH_CONTENT_SCAN
366 FALSE, /* mime_regex */
367#endif
b0b9dbb1 368 TRUE, /* queue */
870f6ba8 369 FALSE, /* ratelimit */
059ec3d9 370 FALSE, /* recipients */
8523533c
TK
371#ifdef WITH_CONTENT_SCAN
372 FALSE, /* regex */
373#endif
e7568d51 374 TRUE, /* remove_header */
059ec3d9
PH
375 FALSE, /* sender_domains */
376 FALSE, /* senders */
377 TRUE, /* set */
8523533c
TK
378#ifdef WITH_CONTENT_SCAN
379 FALSE, /* spam */
380#endif
381#ifdef EXPERIMENTAL_SPF
382 FALSE, /* spf */
65a7d8c3 383 FALSE, /* spf_guess */
8523533c 384#endif
b0019c78 385 TRUE, /* udpsend */
059ec3d9
PH
386 FALSE /* verify */
387};
388
c3611384 389/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH
390times. For each condition and modifier, there's a bitmap of dis-allowed times.
391For some, it is easier to specify the negation of a small number of allowed
392times. */
059ec3d9
PH
393
394static unsigned int cond_forbids[] = {
395 0, /* acl */
8e669ac1 396
71fafd95 397 (unsigned int)
45b91596 398 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 399 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 400 #ifndef DISABLE_PRDR
fd98a5c6
JH
401 (1<<ACL_WHERE_PRDR)|
402 #endif
45b91596 403 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 404 (1<<ACL_WHERE_DKIM)|
45b91596 405 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 406
45b91596
PH
407 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
408 (1<<ACL_WHERE_NOTSMTP_START)|
409 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 410
71fafd95 411 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 412 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
413 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
414 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 415 #ifndef DISABLE_PRDR
fd98a5c6
JH
416 (1<<ACL_WHERE_PRDR)|
417 #endif
8e669ac1 418 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
419 (1<<ACL_WHERE_MAILAUTH)|
420 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH
421 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
422 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 423 #endif
8e669ac1 424
059ec3d9 425 0, /* condition */
8e669ac1 426
c3611384
PH
427 0, /* continue */
428
059ec3d9 429 /* Certain types of control are always allowed, so we let it through
2f079f46 430 always and check in the control processing itself. */
8e669ac1 431
059ec3d9 432 0, /* control */
8e669ac1 433
6a8f9482
TK
434 #ifdef EXPERIMENTAL_DCC
435 (unsigned int)
fd98a5c6 436 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 437 #ifndef DISABLE_PRDR
fd98a5c6 438 (1<<ACL_WHERE_PRDR)|
8ccd00b1 439 #endif
fd98a5c6 440 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK
441 #endif
442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
444 (unsigned int)
445 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 446 #endif
8523533c 447
8f128379 448 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 449
80a47a2c
TK
450 #ifndef DISABLE_DKIM
451 (unsigned int)
452 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 453
80a47a2c
TK
454 (unsigned int)
455 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 456 #endif
fb2274d4 457
4840604e
TL
458 #ifdef EXPERIMENTAL_DMARC
459 (unsigned int)
460 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
461 #endif
462
379ba7d0
JH
463 /* Explicit key lookups can be made in non-smtp ACLs so pass
464 always and check in the verify processing itself. */
465
466 0, /* dnslists */
059ec3d9 467
2f079f46 468 (unsigned int)
fd98a5c6 469 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 470 |(1<<ACL_WHERE_VRFY)
8ccd00b1 471 #ifndef DISABLE_PRDR
fd98a5c6
JH
472 |(1<<ACL_WHERE_PRDR)
473 #endif
474 ),
059ec3d9 475
45b91596
PH
476 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
477 (1<<ACL_WHERE_CONNECT)|
478 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 479 (1<<ACL_WHERE_HELO),
8e669ac1 480
059ec3d9 481 0, /* endpass */
8e669ac1 482
45b91596
PH
483 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
484 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 485
2f079f46 486 (unsigned int)
fd98a5c6 487 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 488 |(1<<ACL_WHERE_VRFY)
2e6afa4f 489 #ifndef DISABLE_PRDR
fd98a5c6
JH
490 |(1<<ACL_WHERE_PRDR)
491 #endif
492 ),
059ec3d9
PH
493
494 0, /* log_message */
8e669ac1 495
6ea85e9a
PH
496 0, /* log_reject_target */
497
059ec3d9 498 0, /* logwrite */
8e669ac1 499
71fafd95 500 #ifdef WITH_CONTENT_SCAN
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 503 #ifndef DISABLE_PRDR
fd98a5c6 504 (1<<ACL_WHERE_PRDR)|
8ccd00b1 505 #endif
fd98a5c6 506 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 507 #endif
8523533c 508
059ec3d9
PH
509 0, /* message */
510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
512 (unsigned int)
513 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 514 #endif
8523533c 515
ecc5f51a
JH
516 (1<<ACL_WHERE_NOTSMTP)| /* queue */
517 #ifndef DISABLE_PRDR
518 (1<<ACL_WHERE_PRDR)|
519 #endif
520 (1<<ACL_WHERE_DATA),
521
870f6ba8
TF
522 0, /* ratelimit */
523
2f079f46
PH
524 (unsigned int)
525 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 526
71fafd95 527 #ifdef WITH_CONTENT_SCAN
2f079f46 528 (unsigned int)
fd98a5c6 529 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 530 #ifndef DISABLE_PRDR
fd98a5c6 531 (1<<ACL_WHERE_PRDR)|
8ccd00b1 532 #endif
fd98a5c6 533 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 534 (1<<ACL_WHERE_MIME)),
71fafd95 535 #endif
8523533c 536
e7568d51
TL
537 (unsigned int)
538 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
539 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 540 #ifndef DISABLE_PRDR
fd98a5c6
JH
541 (1<<ACL_WHERE_PRDR)|
542 #endif
e7568d51
TL
543 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
544 (1<<ACL_WHERE_NOTSMTP_START)),
545
059ec3d9
PH
546 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
547 (1<<ACL_WHERE_HELO)|
548 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
549 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
550 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
551
552 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
553 (1<<ACL_WHERE_HELO)|
554 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
555 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
556 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
557
558 0, /* set */
559
71fafd95 560 #ifdef WITH_CONTENT_SCAN
2f079f46 561 (unsigned int)
fd98a5c6 562 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 563 #ifndef DISABLE_PRDR
fd98a5c6 564 (1<<ACL_WHERE_PRDR)|
8ccd00b1 565 #endif
fd98a5c6 566 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 567 #endif
8523533c 568
71fafd95 569 #ifdef EXPERIMENTAL_SPF
8523533c
TK
570 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
571 (1<<ACL_WHERE_HELO)|
572 (1<<ACL_WHERE_MAILAUTH)|
573 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH
574 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
575 (1<<ACL_WHERE_NOTSMTP)|
576 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM
577
578 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
579 (1<<ACL_WHERE_HELO)|
580 (1<<ACL_WHERE_MAILAUTH)|
581 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
582 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
583 (1<<ACL_WHERE_NOTSMTP)|
584 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 585 #endif
8523533c 586
b0019c78
TF
587 0, /* udpsend */
588
059ec3d9
PH
589 /* Certain types of verify are always allowed, so we let it through
590 always and check in the verify function itself */
591
592 0 /* verify */
059ec3d9
PH
593};
594
595
c5fcb476
PH
596/* Bit map vector of which controls are not allowed at certain times. For
597each control, there's a bitmap of dis-allowed times. For some, it is easier to
598specify the negation of a small number of allowed times. */
599
600static unsigned int control_forbids[] = {
c46782ef
PH
601 (unsigned int)
602 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
603
3c8b3577 604#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 605 0, /* bmi_run */
3c8b3577 606#endif
c46782ef 607
ed7f7860
PP
608 0, /* debug */
609
3c8b3577 610#ifndef DISABLE_DKIM
80a47a2c 611 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 612# ifndef DISABLE_PRDR
fd98a5c6 613 (1<<ACL_WHERE_PRDR)|
3c8b3577 614# endif
f7572e5a 615 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 616#endif
f7572e5a 617
3c8b3577 618#ifdef EXPERIMENTAL_DMARC
4840604e
TL
619 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
620 (1<<ACL_WHERE_NOTSMTP_START),
621 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
622 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 623#endif
4840604e 624
13363eba
PP
625 (1<<ACL_WHERE_NOTSMTP)|
626 (1<<ACL_WHERE_NOTSMTP_START)|
627 (1<<ACL_WHERE_NOTQUIT), /* dscp */
628
c5fcb476 629 0, /* error */
8e669ac1
PH
630
631 (unsigned int)
c5fcb476 632 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
633
634 (unsigned int)
c5fcb476 635 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 636
e4bdf652
JH
637 (unsigned int)
638 0, /* cutthrough_delivery */
639
45b91596
PH
640 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
641 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 642
45b91596
PH
643 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
644 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH
645
646 (unsigned int)
c5fcb476
PH
647 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
648 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 649 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 650 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
651
652 (unsigned int)
c5fcb476
PH
653 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
654 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 655 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 656 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
657
658 (unsigned int)
c5fcb476 659 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 660 (1<<ACL_WHERE_PREDATA)),
8523533c 661
8800895a
PH
662 (unsigned int)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH
664 (1<<ACL_WHERE_PREDATA)|
665 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 666
3c8b3577 667#ifdef WITH_CONTENT_SCAN
8e669ac1 668 (unsigned int)
14d57970 669 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 670 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 671 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 672 (1<<ACL_WHERE_MIME)),
3c8b3577 673#endif
a6c4ab60 674
8e669ac1 675 (unsigned int)
29aba418
TF
676 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
677 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 678#ifndef DISABLE_PRDR
fd98a5c6 679 (1<<ACL_WHERE_PRDR)|
3c8b3577 680#endif
29aba418
TF
681 (1<<ACL_WHERE_MIME)),
682
683 (unsigned int)
a6c4ab60 684 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 685 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 686#ifndef DISABLE_PRDR
fd98a5c6 687 (1<<ACL_WHERE_PRDR)|
3c8b3577 688#endif
e715ad22 689 (1<<ACL_WHERE_MIME)),
8523533c 690
8c5d388a 691#ifdef SUPPORT_I18N
3c8b3577
JH
692 0, /* utf8_downconvert */
693#endif
694
45b91596 695 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH
696 (1<<ACL_WHERE_NOTSMTP_START),
697
698 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH
699 (1<<ACL_WHERE_NOTSMTP_START),
700
701 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH
702 (1<<ACL_WHERE_NOTSMTP_START),
703
704 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 705 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH
706};
707
708/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
709
710typedef struct control_def {
711 uschar *name;
712 int value; /* CONTROL_xxx value */
059ec3d9
PH
713 BOOL has_option; /* Has /option(s) following */
714} control_def;
715
716static control_def controls_list[] = {
3c8b3577 717 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 718#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 719 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
8523533c 720#endif
3c8b3577 721 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 722#ifndef DISABLE_DKIM
3c8b3577 723 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
f7572e5a 724#endif
4840604e 725#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH
726 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
727 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
4840604e 728#endif
3c8b3577
JH
729 { US"dscp", CONTROL_DSCP, TRUE },
730 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
731 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
732 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
733 { US"freeze", CONTROL_FREEZE, TRUE },
734 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
735 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
736 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
737 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
738 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
739 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 740#ifdef WITH_CONTENT_SCAN
3c8b3577 741 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 742#endif
3c8b3577
JH
743 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
744 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
745 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 746 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
ff5929e3 747 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, TRUE },
8c5d388a 748#ifdef SUPPORT_I18N
3c8b3577
JH
749 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
750#endif
059ec3d9
PH
751 };
752
e5a9dba6
PH
753/* Support data structures for Client SMTP Authorization. acl_verify_csa()
754caches its result in a tree to avoid repeated DNS queries. The result is an
755integer code which is used as an index into the following tables of
756explanatory strings and verification return codes. */
757
758static tree_node *csa_cache = NULL;
759
760enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
761 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
762
763/* The acl_verify_csa() return code is translated into an acl_verify() return
764code using the following table. It is OK unless the client is definitely not
765authorized. This is because CSA is supposed to be optional for sending sites,
766so recipients should not be too strict about checking it - especially because
767DNS problems are quite likely to occur. It's possible to use $csa_status in
768further ACL conditions to distinguish ok, unknown, and defer if required, but
769the aim is to make the usual configuration simple. */
770
771static int csa_return_code[] = {
772 OK, OK, OK, OK,
773 FAIL, FAIL, FAIL, FAIL
774};
775
776static uschar *csa_status_string[] = {
777 US"unknown", US"ok", US"defer", US"defer",
778 US"fail", US"fail", US"fail", US"fail"
779};
780
781static uschar *csa_reason_string[] = {
782 US"unknown",
783 US"ok",
784 US"deferred (SRV lookup failed)",
785 US"deferred (target address lookup failed)",
786 US"failed (explicit authorization required)",
787 US"failed (host name not authorized)",
788 US"failed (no authorized addresses)",
789 US"failed (client address mismatch)"
790};
791
c99ce5c9
TF
792/* Options for the ratelimit condition. Note that there are two variants of
793the per_rcpt option, depending on the ACL that is used to measure the rate.
794However any ACL must be able to look up per_rcpt rates in /noupdate mode,
795so the two variants must have the same internal representation as well as
796the same configuration string. */
797
798enum {
799 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
800 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
801};
802
803#define RATE_SET(var,new) \
804 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
805
806static uschar *ratelimit_option_string[] = {
807 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
808 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
809};
810
059ec3d9
PH
811/* Enable recursion between acl_check_internal() and acl_check_condition() */
812
55414b25 813static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 814 uschar **);
059ec3d9
PH
815
816
817/*************************************************
818* Pick out name from list *
819*************************************************/
820
821/* Use a binary chop method
822
823Arguments:
824 name name to find
825 list list of names
826 end size of list
827
828Returns: offset in list, or -1 if not found
829*/
830
831static int
832acl_checkname(uschar *name, uschar **list, int end)
833{
834int start = 0;
835
836while (start < end)
837 {
838 int mid = (start + end)/2;
839 int c = Ustrcmp(name, list[mid]);
840 if (c == 0) return mid;
841 if (c < 0) end = mid; else start = mid + 1;
842 }
843
844return -1;
845}
846
847
848/*************************************************
849* Read and parse one ACL *
850*************************************************/
851
852/* This function is called both from readconf in order to parse the ACLs in the
853configuration file, and also when an ACL is encountered dynamically (e.g. as
854the result of an expansion). It is given a function to call in order to
855retrieve the lines of the ACL. This function handles skipping comments and
856blank lines (where relevant).
857
858Arguments:
859 func function to get next line of ACL
860 error where to put an error message
861
862Returns: pointer to ACL, or NULL
863 NULL can be legal (empty ACL); in this case error will be NULL
864*/
865
866acl_block *
867acl_read(uschar *(*func)(void), uschar **error)
868{
869acl_block *yield = NULL;
870acl_block **lastp = &yield;
871acl_block *this = NULL;
872acl_condition_block *cond;
873acl_condition_block **condp = NULL;
874uschar *s;
875
876*error = NULL;
877
878while ((s = (*func)()) != NULL)
879 {
880 int v, c;
881 BOOL negated = FALSE;
882 uschar *saveline = s;
883 uschar name[64];
884
885 /* Conditions (but not verbs) are allowed to be negated by an initial
886 exclamation mark. */
887
888 while (isspace(*s)) s++;
889 if (*s == '!')
890 {
891 negated = TRUE;
892 s++;
893 }
894
cf00dad6
PH
895 /* Read the name of a verb or a condition, or the start of a new ACL, which
896 can be started by a name, or by a macro definition. */
059ec3d9
PH
897
898 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 899 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
900
901 /* If a verb is unrecognized, it may be another condition or modifier that
902 continues the previous verb. */
903
904 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
905 if (v < 0)
906 {
907 if (this == NULL)
908 {
4e167a8c
PH
909 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
910 saveline);
059ec3d9
PH
911 return NULL;
912 }
913 }
914
915 /* New verb */
916
917 else
918 {
919 if (negated)
920 {
921 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
922 return NULL;
923 }
924 this = store_get(sizeof(acl_block));
925 *lastp = this;
926 lastp = &(this->next);
927 this->next = NULL;
928 this->verb = v;
929 this->condition = NULL;
930 condp = &(this->condition);
931 if (*s == 0) continue; /* No condition on this line */
932 if (*s == '!')
933 {
934 negated = TRUE;
935 s++;
936 }
937 s = readconf_readname(name, sizeof(name), s); /* Condition name */
938 }
939
940 /* Handle a condition or modifier. */
941
942 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
943 if (c < 0)
944 {
945 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
946 saveline);
947 return NULL;
948 }
949
950 /* The modifiers may not be negated */
951
952 if (negated && cond_modifiers[c])
953 {
954 *error = string_sprintf("ACL error: negation is not allowed with "
955 "\"%s\"", conditions[c]);
956 return NULL;
957 }
958
959 /* ENDPASS may occur only with ACCEPT or DISCARD. */
960
961 if (c == ACLC_ENDPASS &&
962 this->verb != ACL_ACCEPT &&
963 this->verb != ACL_DISCARD)
964 {
965 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
966 conditions[c], verbs[this->verb]);
967 return NULL;
968 }
969
970 cond = store_get(sizeof(acl_condition_block));
971 cond->next = NULL;
972 cond->type = c;
973 cond->u.negated = negated;
974
975 *condp = cond;
976 condp = &(cond->next);
977
978 /* The "set" modifier is different in that its argument is "name=value"
979 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
980 gives us a variable name to insert into the data block. The original ACL
981 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
982 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
983 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
984 After that, we allow alphanumerics and underscores, but the first character
985 after c or m must be a digit or an underscore. This retains backwards
986 compatibility. */
059ec3d9
PH
987
988 if (c == ACLC_SET)
989 {
47ca6d6c
PH
990 uschar *endptr;
991
38a0a95f
PH
992 if (Ustrncmp(s, "acl_c", 5) != 0 &&
993 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 994 {
38a0a95f
PH
995 *error = string_sprintf("invalid variable name after \"set\" in ACL "
996 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
997 return NULL;
47ca6d6c 998 }
38a0a95f
PH
999
1000 endptr = s + 5;
641cb756
PH
1001 if (!isdigit(*endptr) && *endptr != '_')
1002 {
1003 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1004 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1005 s);
1006 return NULL;
1007 }
1008
38a0a95f 1009 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1010 {
38a0a95f
PH
1011 if (!isalnum(*endptr) && *endptr != '_')
1012 {
1013 *error = string_sprintf("invalid character \"%c\" in variable name "
1014 "in ACL modifier \"set %s\"", *endptr, s);
1015 return NULL;
1016 }
1017 endptr++;
47ca6d6c 1018 }
47ca6d6c 1019
38a0a95f 1020 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1021 s = endptr;
059ec3d9
PH
1022 while (isspace(*s)) s++;
1023 }
1024
1025 /* For "set", we are now positioned for the data. For the others, only
1026 "endpass" has no data */
1027
1028 if (c != ACLC_ENDPASS)
1029 {
1030 if (*s++ != '=')
1031 {
1032 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1033 cond_modifiers[c]? US"modifier" : US"condition");
1034 return NULL;
1035 }
1036 while (isspace(*s)) s++;
1037 cond->arg = string_copy(s);
1038 }
1039 }
1040
1041return yield;
1042}
1043
1044
1045
1046/*************************************************
71fafd95
PH
1047* Set up added header line(s) *
1048*************************************************/
1049
1050/* This function is called by the add_header modifier, and also from acl_warn()
1051to implement the now-deprecated way of adding header lines using "message" on a
1052"warn" verb. The argument is treated as a sequence of header lines which are
1053added to a chain, provided there isn't an identical one already there.
1054
1055Argument: string of header lines
1056Returns: nothing
1057*/
1058
1059static void
55414b25 1060setup_header(const uschar *hstring)
71fafd95 1061{
55414b25 1062const uschar *p, *q;
71fafd95
PH
1063int hlen = Ustrlen(hstring);
1064
b1b05573
JH
1065/* Ignore any leading newlines */
1066while (*hstring == '\n') hstring++, hlen--;
71fafd95 1067
b1b05573 1068/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1069if (hlen <= 0) return;
96f5fe4c 1070if (hstring[--hlen] != '\n') /* no newline */
55414b25 1071 q = string_sprintf("%s\n", hstring);
96f5fe4c 1072else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH
1073 {
1074 uschar * s = string_copy(hstring);
1075 while(s[--hlen] == '\n')
1076 s[hlen+1] = '\0';
1077 q = s;
1078 }
1079else
1080 q = hstring;
71fafd95
PH
1081
1082/* Loop for multiple header lines, taking care about continuations */
1083
55414b25 1084for (p = q; *p != 0; )
71fafd95 1085 {
55414b25
JH
1086 const uschar *s;
1087 uschar * hdr;
71fafd95
PH
1088 int newtype = htype_add_bot;
1089 header_line **hptr = &acl_added_headers;
1090
1091 /* Find next header line within the string */
1092
1093 for (;;)
1094 {
96f5fe4c 1095 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH
1096 if (*(++q) != ' ' && *q != '\t') break;
1097 }
1098
1099 /* If the line starts with a colon, interpret the instruction for where to
1100 add it. This temporarily sets up a new type. */
1101
1102 if (*p == ':')
1103 {
1104 if (strncmpic(p, US":after_received:", 16) == 0)
1105 {
1106 newtype = htype_add_rec;
1107 p += 16;
1108 }
1109 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1110 {
1111 newtype = htype_add_rfc;
1112 p += 14;
1113 }
1114 else if (strncmpic(p, US":at_start:", 10) == 0)
1115 {
1116 newtype = htype_add_top;
1117 p += 10;
1118 }
1119 else if (strncmpic(p, US":at_end:", 8) == 0)
1120 {
1121 newtype = htype_add_bot;
1122 p += 8;
1123 }
1124 while (*p == ' ' || *p == '\t') p++;
1125 }
1126
1127 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1128 to the front of it. */
1129
1130 for (s = p; s < q - 1; s++)
1131 {
1132 if (*s == ':' || !isgraph(*s)) break;
1133 }
1134
55414b25
JH
1135 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1136 hlen = Ustrlen(hdr);
71fafd95
PH
1137
1138 /* See if this line has already been added */
1139
1140 while (*hptr != NULL)
1141 {
55414b25 1142 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH
1143 hptr = &((*hptr)->next);
1144 }
1145
1146 /* Add if not previously present */
1147
1148 if (*hptr == NULL)
1149 {
1150 header_line *h = store_get(sizeof(header_line));
55414b25 1151 h->text = hdr;
71fafd95
PH
1152 h->next = NULL;
1153 h->type = newtype;
1154 h->slen = hlen;
1155 *hptr = h;
1156 hptr = &(h->next);
1157 }
1158
1159 /* Advance for next header line within the string */
1160
1161 p = q;
1162 }
1163}
1164
1165
1166
e7568d51 1167/*************************************************
362145b5
JH
1168* List the added header lines *
1169*************************************************/
1170uschar *
1171fn_hdrs_added(void)
1172{
1173uschar * ret = NULL;
5f5be492
JH
1174int size = 0;
1175int ptr = 0;
362145b5
JH
1176header_line * h = acl_added_headers;
1177uschar * s;
1178uschar * cp;
362145b5
JH
1179
1180if (!h) return NULL;
1181
1182do
1183 {
1184 s = h->text;
1185 while ((cp = Ustrchr(s, '\n')) != NULL)
1186 {
1187 if (cp[1] == '\0') break;
1188
1189 /* contains embedded newline; needs doubling */
c2f669a4
JH
1190 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1191 ret = string_catn(ret, &size, &ptr, US"\n", 1);
362145b5
JH
1192 s = cp+1;
1193 }
1194 /* last bit of header */
1195
c2f669a4 1196 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
362145b5 1197 }
6d9cfc47 1198while((h = h->next));
362145b5
JH
1199
1200ret[ptr-1] = '\0'; /* overwrite last newline */
1201return ret;
1202}
1203
1204
1205/*************************************************
e7568d51
TL
1206* Set up removed header line(s) *
1207*************************************************/
1208
1209/* This function is called by the remove_header modifier. The argument is
1210treated as a sequence of header names which are added to a colon separated
1211list, provided there isn't an identical one already there.
1212
1213Argument: string of header names
1214Returns: nothing
1215*/
1216
1217static void
55414b25 1218setup_remove_header(const uschar *hnames)
e7568d51
TL
1219{
1220if (*hnames != 0)
55414b25
JH
1221 acl_removed_headers = acl_removed_headers
1222 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1223 : string_copy(hnames);
e7568d51
TL
1224}
1225
1226
71fafd95
PH
1227
1228/*************************************************
059ec3d9
PH
1229* Handle warnings *
1230*************************************************/
1231
1232/* This function is called when a WARN verb's conditions are true. It adds to
1233the message's headers, and/or writes information to the log. In each case, this
1234only happens once (per message for headers, per connection for log).
1235
71fafd95
PH
1236** NOTE: The header adding action using the "message" setting is historic, and
1237its use is now deprecated. The new add_header modifier should be used instead.
1238
059ec3d9
PH
1239Arguments:
1240 where ACL_WHERE_xxxx indicating which ACL this is
1241 user_message message for adding to headers
1242 log_message message for logging, if different
1243
1244Returns: nothing
1245*/
1246
1247static void
1248acl_warn(int where, uschar *user_message, uschar *log_message)
1249{
059ec3d9
PH
1250if (log_message != NULL && log_message != user_message)
1251 {
1252 uschar *text;
1253 string_item *logged;
1254
1255 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1256 string_printing(log_message));
1257
1258 /* If a sender verification has failed, and the log message is "sender verify
1259 failed", add the failure message. */
1260
1261 if (sender_verified_failed != NULL &&
1262 sender_verified_failed->message != NULL &&
1263 strcmpic(log_message, US"sender verify failed") == 0)
1264 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1265
9c7a242c
PH
1266 /* Search previously logged warnings. They are kept in malloc
1267 store so they can be freed at the start of a new message. */
059ec3d9
PH
1268
1269 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1270 if (Ustrcmp(logged->text, text) == 0) break;
1271
1272 if (logged == NULL)
1273 {
1274 int length = Ustrlen(text) + 1;
1275 log_write(0, LOG_MAIN, "%s", text);
1276 logged = store_malloc(sizeof(string_item) + length);
1277 logged->text = (uschar *)logged + sizeof(string_item);
1278 memcpy(logged->text, text, length);
1279 logged->next = acl_warn_logged;
1280 acl_warn_logged = logged;
1281 }
1282 }
1283
1284/* If there's no user message, we are done. */
1285
1286if (user_message == NULL) return;
1287
1288/* If this isn't a message ACL, we can't do anything with a user message.
1289Log an error. */
1290
1291if (where > ACL_WHERE_NOTSMTP)
1292 {
1293 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1294 "found in a non-message (%s) ACL: cannot specify header lines here: "
1295 "message ignored", acl_wherenames[where]);
1296 return;
1297 }
1298
71fafd95
PH
1299/* The code for setting up header lines is now abstracted into a separate
1300function so that it can be used for the add_header modifier as well. */
059ec3d9 1301
71fafd95 1302setup_header(user_message);
059ec3d9
PH
1303}
1304
1305
1306
1307/*************************************************
1308* Verify and check reverse DNS *
1309*************************************************/
1310
1311/* Called from acl_verify() below. We look up the host name(s) of the client IP
1312address if this has not yet been done. The host_name_lookup() function checks
1313that one of these names resolves to an address list that contains the client IP
1314address, so we don't actually have to do the check here.
1315
1316Arguments:
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319
1320Returns: OK verification condition succeeded
1321 FAIL verification failed
1322 DEFER there was a problem verifying
1323*/
1324
1325static int
1326acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1327{
1328int rc;
1329
1330user_msgptr = user_msgptr; /* stop compiler warning */
1331
1332/* Previous success */
1333
1334if (sender_host_name != NULL) return OK;
1335
1336/* Previous failure */
1337
1338if (host_lookup_failed)
1339 {
1340 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1341 return FAIL;
1342 }
1343
1344/* Need to do a lookup */
1345
1346HDEBUG(D_acl)
1347 debug_printf("looking up host name to force name/address consistency check\n");
1348
1349if ((rc = host_name_lookup()) != OK)
1350 {
1351 *log_msgptr = (rc == DEFER)?
1352 US"host lookup deferred for reverse lookup check"
1353 :
1354 string_sprintf("host lookup failed for reverse lookup check%s",
1355 host_lookup_msg);
1356 return rc; /* DEFER or FAIL */
1357 }
1358
1359host_build_sender_fullhost();
1360return OK;
1361}
1362
1363
1364
1365/*************************************************
e5a9dba6
PH
1366* Check client IP address matches CSA target *
1367*************************************************/
1368
1369/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1370response for address records belonging to the CSA target hostname. The section
1371is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1372If one of the addresses matches the client's IP address, then the client is
1373authorized by CSA. If there are target IP addresses but none of them match
1374then the client is using an unauthorized IP address. If there are no target IP
1375addresses then the client cannot be using an authorized IP address. (This is
1376an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1377
1378Arguments:
1379 dnsa the DNS answer block
1380 dnss a DNS scan block for us to use
1381 reset option specifing what portion to scan, as described above
1382 target the target hostname to use for matching RR names
1383
1384Returns: CSA_OK successfully authorized
1385 CSA_FAIL_MISMATCH addresses found but none matched
1386 CSA_FAIL_NOADDR no target addresses found
1387*/
1388
1389static int
1390acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1391 uschar *target)
1392{
1393dns_record *rr;
1394dns_address *da;
1395
1396BOOL target_found = FALSE;
1397
1398for (rr = dns_next_rr(dnsa, dnss, reset);
1399 rr != NULL;
1400 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1401 {
1402 /* Check this is an address RR for the target hostname. */
1403
1404 if (rr->type != T_A
1405 #if HAVE_IPV6
1406 && rr->type != T_AAAA
e5a9dba6
PH
1407 #endif
1408 ) continue;
1409
1410 if (strcmpic(target, rr->name) != 0) continue;
1411
1412 target_found = TRUE;
1413
1414 /* Turn the target address RR into a list of textual IP addresses and scan
1415 the list. There may be more than one if it is an A6 RR. */
1416
1417 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1418 {
1419 /* If the client IP address matches the target IP address, it's good! */
1420
1421 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1422
1423 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1424 }
1425 }
1426
1427/* If we found some target addresses but none of them matched, the client is
1428using an unauthorized IP address, otherwise the target has no authorized IP
1429addresses. */
1430
1431if (target_found) return CSA_FAIL_MISMATCH;
1432else return CSA_FAIL_NOADDR;
1433}
1434
1435
1436
1437/*************************************************
1438* Verify Client SMTP Authorization *
1439*************************************************/
1440
1441/* Called from acl_verify() below. This routine calls dns_lookup_special()
1442to find the CSA SRV record corresponding to the domain argument, or
1443$sender_helo_name if no argument is provided. It then checks that the
1444client is authorized, and that its IP address corresponds to the SRV
1445target's address by calling acl_verify_csa_address() above. The address
1446should have been returned in the DNS response's ADDITIONAL section, but if
1447not we perform another DNS lookup to get it.
1448
1449Arguments:
1450 domain pointer to optional parameter following verify = csa
1451
1452Returns: CSA_UNKNOWN no valid CSA record found
1453 CSA_OK successfully authorized
1454 CSA_FAIL_* client is definitely not authorized
1455 CSA_DEFER_* there was a DNS problem
1456*/
1457
1458static int
55414b25 1459acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1460{
1461tree_node *t;
55414b25
JH
1462const uschar *found;
1463uschar *p;
e5a9dba6
PH
1464int priority, weight, port;
1465dns_answer dnsa;
1466dns_scan dnss;
1467dns_record *rr;
1468int rc, type;
1469uschar target[256];
1470
1471/* Work out the domain we are using for the CSA lookup. The default is the
1472client's HELO domain. If the client has not said HELO, use its IP address
1473instead. If it's a local client (exim -bs), CSA isn't applicable. */
1474
1475while (isspace(*domain) && *domain != '\0') ++domain;
1476if (*domain == '\0') domain = sender_helo_name;
1477if (domain == NULL) domain = sender_host_address;
1478if (sender_host_address == NULL) return CSA_UNKNOWN;
1479
1480/* If we have an address literal, strip off the framing ready for turning it
1481into a domain. The framing consists of matched square brackets possibly
1482containing a keyword and a colon before the actual IP address. */
1483
1484if (domain[0] == '[')
1485 {
55414b25 1486 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1487 if (start == NULL) start = domain;
1488 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1489 }
1490
1491/* Turn domains that look like bare IP addresses into domains in the reverse
1492DNS. This code also deals with address literals and $sender_host_address. It's
1493not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1494address literals, but it's probably the most friendly thing to do. This is an
1495extension to CSA, so we allow it to be turned off for proper conformance. */
1496
7e66e54d 1497if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1498 {
1499 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1500 dns_build_reverse(domain, target);
1501 domain = target;
1502 }
1503
1504/* Find out if we've already done the CSA check for this domain. If we have,
1505return the same result again. Otherwise build a new cached result structure
1506for this domain. The name is filled in now, and the value is filled in when
1507we return from this function. */
1508
1509t = tree_search(csa_cache, domain);
1510if (t != NULL) return t->data.val;
1511
1512t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1513Ustrcpy(t->name, domain);
1514(void)tree_insertnode(&csa_cache, t);
1515
1516/* Now we are ready to do the actual DNS lookup(s). */
1517
28e6ef29 1518found = domain;
e5a9dba6
PH
1519switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1520 {
1521 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1522
1523 default:
1524 return t->data.val = CSA_DEFER_SRV;
1525
1526 /* If we found nothing, the client's authorization is unknown. */
1527
1528 case DNS_NOMATCH:
1529 case DNS_NODATA:
1530 return t->data.val = CSA_UNKNOWN;
1531
1532 /* We got something! Go on to look at the reply in more detail. */
1533
1534 case DNS_SUCCEED:
1535 break;
1536 }
1537
1538/* Scan the reply for well-formed CSA SRV records. */
1539
1540for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1541 rr != NULL;
1542 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1543 {
1544 if (rr->type != T_SRV) continue;
1545
1546 /* Extract the numerical SRV fields (p is incremented) */
1547
1548 p = rr->data;
1549 GETSHORT(priority, p);
1550 GETSHORT(weight, p);
1551 GETSHORT(port, p);
1552
1553 DEBUG(D_acl)
1554 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1555
1556 /* Check the CSA version number */
1557
1558 if (priority != 1) continue;
1559
1560 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1561 found by dns_special_lookup() is a parent of the one we asked for), we check
1562 the subdomain assertions in the port field. At the moment there's only one
1563 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1564 SRV records of their own. */
1565
1dc92d5a 1566 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH
1567 {
1568 if (port & 1)
1569 return t->data.val = CSA_FAIL_EXPLICIT;
1570 else
1571 return t->data.val = CSA_UNKNOWN;
1572 }
1573
1574 /* This CSA SRV record refers directly to our domain, so we check the value
1575 in the weight field to work out the domain's authorization. 0 and 1 are
1576 unauthorized; 3 means the client is authorized but we can't check the IP
1577 address in order to authenticate it, so we treat it as unknown; values
1578 greater than 3 are undefined. */
1579
1580 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1581
1582 if (weight > 2) continue;
1583
1584 /* Weight == 2, which means the domain is authorized. We must check that the
1585 client's IP address is listed as one of the SRV target addresses. Save the
1586 target hostname then break to scan the additional data for its addresses. */
1587
1588 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1589 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1590
1591 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1592
1593 break;
1594 }
1595
1596/* If we didn't break the loop then no appropriate records were found. */
1597
1598if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1599
1600/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1601A target of "." indicates there are no valid addresses, so the client cannot
1602be authorized. (This is an odd configuration because weight=2 target=. is
1603equivalent to weight=1, but we check for it in order to keep load off the
1604root name servers.) Note that dn_expand() turns "." into "". */
1605
1606if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1607
1608/* Scan the additional section of the CSA SRV reply for addresses belonging
1609to the target. If the name server didn't return any additional data (e.g.
1610because it does not fully support SRV records), we need to do another lookup
1611to obtain the target addresses; otherwise we have a definitive result. */
1612
1613rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1614if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1615
1616/* The DNS lookup type corresponds to the IP version used by the client. */
1617
1618#if HAVE_IPV6
1619if (Ustrchr(sender_host_address, ':') != NULL)
1620 type = T_AAAA;
1621else
1622#endif /* HAVE_IPV6 */
1623 type = T_A;
1624
1625
4e0983dc 1626lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1627switch (dns_lookup(&dnsa, target, type, NULL))
1628 {
1629 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1630
1631 default:
cc00f4af 1632 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1633
1634 /* If the query succeeded, scan the addresses and return the result. */
1635
1636 case DNS_SUCCEED:
cc00f4af
JH
1637 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1638 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1639 /* else fall through */
e5a9dba6
PH
1640
1641 /* If the target has no IP addresses, the client cannot have an authorized
1642 IP address. However, if the target site uses A6 records (not AAAA records)
1643 we have to do yet another lookup in order to check them. */
1644
1645 case DNS_NOMATCH:
1646 case DNS_NODATA:
cc00f4af 1647 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1648 }
1649}
1650
1651
1652
1653/*************************************************
059ec3d9
PH
1654* Handle verification (address & other) *
1655*************************************************/
1656
89583014 1657enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM
1658 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1659 VERIFY_HDR_NAMES_ASCII
89583014
JH
1660 };
1661typedef struct {
1662 uschar * name;
1663 int value;
1664 unsigned where_allowed; /* bitmap */
1665 BOOL no_options; /* Never has /option(s) following */
1666 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1667 } verify_type_t;
1668static verify_type_t verify_type_list[] = {
7e8360e6 1669 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH
1670 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1671 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1672 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1673 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1674 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1675 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1676 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1677 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1678 FALSE, 6 },
770747fd
MFM
1679 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1680 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH
1681 };
1682
1683
1684enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1685 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1686 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1687 CALLOUT_TIME
1688 };
1689typedef struct {
1690 uschar * name;
1691 int value;
1692 int flag;
1693 BOOL has_option; /* Has =option(s) following */
1694 BOOL timeval; /* Has a time value */
1695 } callout_opt_t;
1696static callout_opt_t callout_opt_list[] = {
1697 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1698 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1699 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1700 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1701 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1702 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1703 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1704 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1705 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1706 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1707 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1708 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1709 };
1710
1711
1712
059ec3d9
PH
1713/* This function implements the "verify" condition. It is called when
1714encountered in any ACL, because some tests are almost always permitted. Some
1715just don't make sense, and always fail (for example, an attempt to test a host
1716lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1717
1718Arguments:
1719 where where called from
1720 addr the recipient address that the ACL is handling, or NULL
1721 arg the argument of "verify"
1722 user_msgptr pointer for user message
1723 log_msgptr pointer for log message
1724 basic_errno where to put verify errno
1725
1726Returns: OK verification condition succeeded
1727 FAIL verification failed
1728 DEFER there was a problem verifying
1729 ERROR syntax error
1730*/
1731
1732static int
55414b25 1733acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1734 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1735{
1736int sep = '/';
1737int callout = -1;
1738int callout_overall = -1;
4deaf07d 1739int callout_connect = -1;
059ec3d9
PH
1740int verify_options = 0;
1741int rc;
1742BOOL verify_header_sender = FALSE;
1743BOOL defer_ok = FALSE;
1744BOOL callout_defer_ok = FALSE;
1745BOOL no_details = FALSE;
eafd343b 1746BOOL success_on_redirect = FALSE;
059ec3d9
PH
1747address_item *sender_vaddr = NULL;
1748uschar *verify_sender_address = NULL;
1749uschar *pm_mailfrom = NULL;
1750uschar *se_mailfrom = NULL;
596875b3
PH
1751
1752/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1753an error if options are given for items that don't expect them.
596875b3
PH
1754*/
1755
1756uschar *slash = Ustrchr(arg, '/');
55414b25 1757const uschar *list = arg;
059ec3d9 1758uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1759verify_type_t * vp;
059ec3d9
PH
1760
1761if (ss == NULL) goto BAD_VERIFY;
1762
1763/* Handle name/address consistency verification in a separate function. */
1764
89583014
JH
1765for (vp= verify_type_list;
1766 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1767 vp++
1768 )
1769 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1770 : strcmpic (ss, vp->name) == 0)
1771 break;
1772if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1773 goto BAD_VERIFY;
1774
1775if (vp->no_options && slash != NULL)
059ec3d9 1776 {
89583014
JH
1777 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1778 "(this verify item has no options)", arg);
1779 return ERROR;
059ec3d9 1780 }
89583014 1781if (!(vp->where_allowed & (1<<where)))
059ec3d9 1782 {
89583014
JH
1783 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786switch(vp->value)
596875b3 1787 {
89583014
JH
1788 case VERIFY_REV_HOST_LKUP:
1789 if (sender_host_address == NULL) return OK;
7e8360e6
JH
1790 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1791 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1792 if (strcmpic(ss, US"defer_ok") == 0)
1793 return OK;
1794 return rc;
059ec3d9 1795
89583014
JH
1796 case VERIFY_CERT:
1797 /* TLS certificate verification is done at STARTTLS time; here we just
1798 test whether it was successful or not. (This is for optional verification; for
1799 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1800
3703d818
JH
1801 if (tls_in.certificate_verified) return OK;
1802 *user_msgptr = US"no verified certificate";
1803 return FAIL;
e5a9dba6 1804
89583014
JH
1805 case VERIFY_HELO:
1806 /* We can test the result of optional HELO verification that might have
1807 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1808
3703d818
JH
1809 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1810 return helo_verified? OK : FAIL;
059ec3d9 1811
89583014
JH
1812 case VERIFY_CSA:
1813 /* Do Client SMTP Authorization checks in a separate function, and turn the
1814 result code into user-friendly strings. */
1c41c9cc 1815
3703d818
JH
1816 rc = acl_verify_csa(list);
1817 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1818 csa_reason_string[rc]);
3703d818
JH
1819 csa_status = csa_status_string[rc];
1820 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1821 return csa_return_code[rc];
89583014
JH
1822
1823 case VERIFY_HDR_SYNTAX:
1824 /* Check that all relevant header lines have the correct syntax. If there is
1825 a syntax error, we return details of the error to the sender if configured to
1826 send out full details. (But a "message" setting on the ACL can override, as
1827 always). */
1828
1829 rc = verify_check_headers(log_msgptr);
3703d818
JH
1830 if (rc != OK && *log_msgptr)
1831 if (smtp_return_error_details)
1832 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1833 else
1834 acl_verify_message = *log_msgptr;
89583014 1835 return rc;
059ec3d9 1836
770747fd
MFM
1837 case VERIFY_HDR_NAMES_ASCII:
1838 /* Check that all header names are true 7 bit strings
1839 See RFC 5322, 2.2. and RFC 6532, 3. */
1840
1841 rc = verify_check_header_names_ascii(log_msgptr);
1842 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1843 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1844 return rc;
1845
89583014
JH
1846 case VERIFY_NOT_BLIND:
1847 /* Check that no recipient of this message is "blind", that is, every envelope
1848 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1849
89583014
JH
1850 rc = verify_check_notblind();
1851 if (rc != OK)
1852 {
1853 *log_msgptr = string_sprintf("bcc recipient detected");
1854 if (smtp_return_error_details)
1855 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1856 }
1857 return rc;
059ec3d9 1858
89583014
JH
1859 /* The remaining verification tests check recipient and sender addresses,
1860 either from the envelope or from the header. There are a number of
1861 slash-separated options that are common to all of them. */
059ec3d9 1862
89583014
JH
1863 case VERIFY_HDR_SNDR:
1864 verify_header_sender = TRUE;
1865 break;
059ec3d9 1866
89583014
JH
1867 case VERIFY_SNDR:
1868 /* In the case of a sender, this can optionally be followed by an address to use
1869 in place of the actual sender (rare special-case requirement). */
059ec3d9 1870 {
89583014
JH
1871 uschar *s = ss + 6;
1872 if (*s == 0)
1873 verify_sender_address = sender_address;
1874 else
1875 {
1876 while (isspace(*s)) s++;
1877 if (*s++ != '=') goto BAD_VERIFY;
1878 while (isspace(*s)) s++;
1879 verify_sender_address = string_copy(s);
1880 }
059ec3d9 1881 }
89583014
JH
1882 break;
1883
1884 case VERIFY_RCPT:
1885 break;
059ec3d9
PH
1886 }
1887
89583014
JH
1888
1889
596875b3
PH
1890/* Remaining items are optional; they apply to sender and recipient
1891verification, including "header sender" verification. */
059ec3d9
PH
1892
1893while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1894 != NULL)
1895 {
1896 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1897 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1898 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1899
1900 /* These two old options are left for backwards compatibility */
1901
1902 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1903 {
1904 callout_defer_ok = TRUE;
1905 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1906 }
1907
1908 else if (strcmpic(ss, US"check_postmaster") == 0)
1909 {
1910 pm_mailfrom = US"";
1911 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1912 }
1913
1914 /* The callout option has a number of sub-options, comma separated */
1915
1916 else if (strncmpic(ss, US"callout", 7) == 0)
1917 {
1918 callout = CALLOUT_TIMEOUT_DEFAULT;
1919 ss += 7;
1920 if (*ss != 0)
1921 {
1922 while (isspace(*ss)) ss++;
1923 if (*ss++ == '=')
1924 {
55414b25 1925 const uschar * sublist = ss;
059ec3d9
PH
1926 int optsep = ',';
1927 uschar *opt;
1928 uschar buffer[256];
55414b25 1929 while (isspace(*sublist)) sublist++;
8e669ac1 1930
55414b25 1931 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH
1932 != NULL)
1933 {
89583014 1934 callout_opt_t * op;
438257ba 1935 double period = 1.0F;
059ec3d9 1936
89583014 1937 for (op= callout_opt_list; op->name; op++)
438257ba 1938 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1939 break;
059ec3d9 1940
89583014
JH
1941 verify_options |= op->flag;
1942 if (op->has_option)
1943 {
438257ba 1944 opt += Ustrlen(op->name);
4deaf07d
PH
1945 while (isspace(*opt)) opt++;
1946 if (*opt++ != '=')
1947 {
1948 *log_msgptr = string_sprintf("'=' expected after "
89583014 1949 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1950 return ERROR;
1951 }
1952 while (isspace(*opt)) opt++;
89583014
JH
1953 }
1954 if (op->timeval)
1955 {
1956 period = readconf_readtime(opt, 0, FALSE);
1957 if (period < 0)
4deaf07d
PH
1958 {
1959 *log_msgptr = string_sprintf("bad time value in ACL condition "
1960 "\"verify %s\"", arg);
1961 return ERROR;
1962 }
89583014
JH
1963 }
1964
1965 switch(op->value)
1966 {
1967 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1968 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1969 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1970 case CALLOUT_MAILFROM:
1971 if (!verify_header_sender)
1972 {
1973 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1974 "callout option only for verify=header_sender (detected in ACL "
1975 "condition \"%s\")", arg);
1976 return ERROR;
1977 }
1978 se_mailfrom = string_copy(opt);
1979 break;
1980 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1981 case CALLOUT_MAXWAIT: callout_overall = period; break;
1982 case CALLOUT_CONNECT: callout_connect = period; break;
1983 case CALLOUT_TIME: callout = period; break;
1984 }
059ec3d9
PH
1985 }
1986 }
1987 else
1988 {
1989 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1990 "ACL condition \"%s\"", arg);
1991 return ERROR;
1992 }
1993 }
1994 }
1995
1996 /* Option not recognized */
1997
1998 else
1999 {
2000 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2001 "condition \"verify %s\"", ss, arg);
2002 return ERROR;
2003 }
2004 }
2005
2006if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2007 (vopt_callout_recipsender|vopt_callout_recippmaster))
2008 {
2009 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2010 "for a recipient callout";
2011 return ERROR;
2012 }
2013
2014/* Handle sender-in-header verification. Default the user message to the log
2015message if giving out verification details. */
2016
2017if (verify_header_sender)
2018 {
8e669ac1 2019 int verrno;
2f682e45
JH
2020
2021 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 2022 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 2023 &verrno)) != OK)
8e669ac1 2024 {
fe5b5d0b
PH
2025 *basic_errno = verrno;
2026 if (smtp_return_error_details)
2027 {
2f682e45 2028 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH
2029 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2030 if (rc == DEFER) acl_temp_details = TRUE;
2031 }
8e669ac1 2032 }
059ec3d9
PH
2033 }
2034
2035/* Handle a sender address. The default is to verify *the* sender address, but
2036optionally a different address can be given, for special requirements. If the
2037address is empty, we are dealing with a bounce message that has no sender, so
2038we cannot do any checking. If the real sender address gets rewritten during
2039verification (e.g. DNS widening), set the flag to stop it being rewritten again
2040during message reception.
2041
2042A list of verified "sender" addresses is kept to try to avoid doing to much
2043work repetitively when there are multiple recipients in a message and they all
2044require sender verification. However, when callouts are involved, it gets too
2045complicated because different recipients may require different callout options.
2046Therefore, we always do a full sender verify when any kind of callout is
2047specified. Caching elsewhere, for instance in the DNS resolver and in the
2048callout handling, should ensure that this is not terribly inefficient. */
2049
2f682e45 2050else if (verify_sender_address)
059ec3d9 2051 {
2f682e45 2052 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH
2053 {
2054 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2055 "sender verify callout";
2056 return ERROR;
2057 }
2058
2059 sender_vaddr = verify_checked_sender(verify_sender_address);
2060 if (sender_vaddr != NULL && /* Previously checked */
2061 callout <= 0) /* No callout needed this time */
2062 {
2063 /* If the "routed" flag is set, it means that routing worked before, so
2064 this check can give OK (the saved return code value, if set, belongs to a
2065 callout that was done previously). If the "routed" flag is not set, routing
2066 must have failed, so we use the saved return code. */
2067
2f682e45
JH
2068 if (testflag(sender_vaddr, af_verify_routed))
2069 rc = OK;
2070 else
059ec3d9
PH
2071 {
2072 rc = sender_vaddr->special_action;
2073 *basic_errno = sender_vaddr->basic_errno;
2074 }
2075 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2076 }
2077
2078 /* Do a new verification, and cache the result. The cache is used to avoid
2079 verifying the sender multiple times for multiple RCPTs when callouts are not
2080 specified (see comments above).
2081
2082 The cache is also used on failure to give details in response to the first
2083 RCPT that gets bounced for this reason. However, this can be suppressed by
2084 the no_details option, which sets the flag that says "this detail has already
2085 been sent". The cache normally contains just one address, but there may be
2086 more in esoteric circumstances. */
2087
2088 else
2089 {
2090 BOOL routed = TRUE;
2a3eea10 2091 uschar *save_address_data = deliver_address_data;
8e669ac1 2092
059ec3d9 2093 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2094#ifdef SUPPORT_I18N
3c8b3577
JH
2095 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2096 {
2097 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2098 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2099 }
f358d5e0 2100#endif
059ec3d9
PH
2101 if (no_details) setflag(sender_vaddr, af_sverify_told);
2102 if (verify_sender_address[0] != 0)
2103 {
2104 /* If this is the real sender address, save the unrewritten version
2105 for use later in receive. Otherwise, set a flag so that rewriting the
2106 sender in verify_address() does not update sender_address. */
2107
2108 if (verify_sender_address == sender_address)
2109 sender_address_unrewritten = sender_address;
2110 else
2111 verify_options |= vopt_fake_sender;
2112
eafd343b
TK
2113 if (success_on_redirect)
2114 verify_options |= vopt_success_on_redirect;
2115
059ec3d9
PH
2116 /* The recipient, qualify, and expn options are never set in
2117 verify_options. */
2118
2119 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2120 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
2121
2122 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2123
2f682e45
JH
2124 if (rc != OK)
2125 *basic_errno = sender_vaddr->basic_errno;
2126 else
2127 DEBUG(D_acl)
2128 {
2129 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2130 debug_printf("sender %s verified ok as %s\n",
2131 verify_sender_address, sender_vaddr->address);
2132 else
2133 debug_printf("sender %s verified ok\n",
2134 verify_sender_address);
2135 }
059ec3d9 2136 }
2f682e45
JH
2137 else
2138 rc = OK; /* Null sender */
059ec3d9
PH
2139
2140 /* Cache the result code */
2141
2142 if (routed) setflag(sender_vaddr, af_verify_routed);
2143 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2144 sender_vaddr->special_action = rc;
2145 sender_vaddr->next = sender_verified_list;
2146 sender_verified_list = sender_vaddr;
8e669ac1
PH
2147
2148 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2149 the sender verification. */
8e669ac1 2150
2a3eea10 2151 deliver_address_data = save_address_data;
059ec3d9 2152 }
8e669ac1 2153
2a3eea10
PH
2154 /* Put the sender address_data value into $sender_address_data */
2155
d43cbe25 2156 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2157 }
2158
2159/* A recipient address just gets a straightforward verify; again we must handle
2160the DEFER overrides. */
2161
2162else
2163 {
2164 address_item addr2;
2165
eafd343b
TK
2166 if (success_on_redirect)
2167 verify_options |= vopt_success_on_redirect;
2168
059ec3d9
PH
2169 /* We must use a copy of the address for verification, because it might
2170 get rewritten. */
2171
2172 addr2 = *addr;
2173 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2174 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2175 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2176
42855d71 2177 *basic_errno = addr2.basic_errno;
059ec3d9 2178 *log_msgptr = addr2.message;
8e669ac1 2179 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2180 addr2.user_message : addr2.message;
42855d71
PH
2181
2182 /* Allow details for temporary error if the address is so flagged. */
2183 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
2184
2185 /* Make $address_data visible */
d43cbe25 2186 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2187 }
2188
2189/* We have a result from the relevant test. Handle defer overrides first. */
2190
2191if (rc == DEFER && (defer_ok ||
2192 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2193 {
2194 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2195 defer_ok? "defer_ok" : "callout_defer_ok");
2196 rc = OK;
2197 }
2198
2199/* If we've failed a sender, set up a recipient message, and point
2200sender_verified_failed to the address item that actually failed. */
2201
2202if (rc != OK && verify_sender_address != NULL)
2203 {
2204 if (rc != DEFER)
059ec3d9 2205 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2206 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2208 else
2209 {
2210 *log_msgptr = US"Could not complete sender verify callout";
2211 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2212 *log_msgptr;
2213 }
2214
2215 sender_verified_failed = sender_vaddr;
2216 }
2217
2218/* Verifying an address messes up the values of $domain and $local_part,
2219so reset them before returning if this is a RCPT ACL. */
2220
2221if (addr != NULL)
2222 {
2223 deliver_domain = addr->domain;
2224 deliver_localpart = addr->local_part;
2225 }
2226return rc;
2227
2228/* Syntax errors in the verify argument come here. */
2229
2230BAD_VERIFY:
2231*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2232 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2233 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2234 "\"verify %s\"", arg);
2235return ERROR;
2236}
2237
2238
2239
2240
2241/*************************************************
2242* Check argument for control= modifier *
2243*************************************************/
2244
2245/* Called from acl_check_condition() below
2246
2247Arguments:
2248 arg the argument string for control=
2249 pptr set to point to the terminating character
2250 where which ACL we are in
2251 log_msgptr for error messages
2252
2253Returns: CONTROL_xxx value
2254*/
2255
2256static int
55414b25 2257decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH
2258{
2259int len;
2260control_def *d;
2261
2262for (d = controls_list;
2263 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2264 d++)
2265 {
2266 len = Ustrlen(d->name);
2267 if (Ustrncmp(d->name, arg, len) == 0) break;
2268 }
2269
2270if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2271 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2272 {
2273 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2274 return CONTROL_ERROR;
2275 }
2276
059ec3d9
PH
2277*pptr = arg + len;
2278return d->value;
2279}
2280
2281
2282
c99ce5c9
TF
2283
2284/*************************************************
2285* Return a ratelimit error *
2286*************************************************/
2287
2288/* Called from acl_ratelimit() below
2289
2290Arguments:
2291 log_msgptr for error messages
2292 format format string
2293 ... supplementary arguments
2294 ss ratelimit option name
2295 where ACL_WHERE_xxxx indicating which ACL this is
2296
2297Returns: ERROR
2298*/
2299
2300static int
2301ratelimit_error(uschar **log_msgptr, const char *format, ...)
2302{
2303va_list ap;
2304uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2305va_start(ap, format);
2306if (!string_vformat(buffer, sizeof(buffer), format, ap))
2307 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2308 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2309va_end(ap);
2310*log_msgptr = string_sprintf(
2311 "error in arguments to \"ratelimit\" condition: %s", buffer);
2312return ERROR;
2313}
2314
2315
2316
2317
059ec3d9 2318/*************************************************
870f6ba8
TF
2319* Handle rate limiting *
2320*************************************************/
2321
2322/* Called by acl_check_condition() below to calculate the result
2323of the ACL ratelimit condition.
2324
2325Note that the return value might be slightly unexpected: if the
2326sender's rate is above the limit then the result is OK. This is
2327similar to the dnslists condition, and is so that you can write
2328ACL clauses like: defer ratelimit = 15 / 1h
2329
2330Arguments:
2331 arg the option string for ratelimit=
90fc3069 2332 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2333 log_msgptr for error messages
2334
2335Returns: OK - Sender's rate is above limit
2336 FAIL - Sender's rate is below limit
2337 DEFER - Problem opening ratelimit database
2338 ERROR - Syntax error in options.
2339*/
2340
2341static int
55414b25 2342acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2343{
c99ce5c9 2344double limit, period, count;
8f240103
PH
2345uschar *ss;
2346uschar *key = NULL;
c99ce5c9 2347uschar *unique = NULL;
870f6ba8 2348int sep = '/';
c99ce5c9
TF
2349BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2350BOOL noupdate = FALSE, badacl = FALSE;
2351int mode = RATE_PER_WHAT;
870f6ba8
TF
2352int old_pool, rc;
2353tree_node **anchor, *t;
2354open_db dbblock, *dbm;
c99ce5c9 2355int dbdb_size;
870f6ba8 2356dbdata_ratelimit *dbd;
c99ce5c9 2357dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2358struct timeval tv;
2359
2360/* Parse the first two options and record their values in expansion
2361variables. These variables allow the configuration to have informative
2362error messages based on rate limits obtained from a table lookup. */
2363
c99ce5c9 2364/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2365size, which must be greater than or equal to zero. Zero is useful for
2366rate measurement as opposed to rate limiting. */
2367
2368sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2369if (sender_rate_limit == NULL)
96f5fe4c
JH
2370 return ratelimit_error(log_msgptr, "sender rate limit not set");
2371
2372limit = Ustrtod(sender_rate_limit, &ss);
2373if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2374else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2375else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2376
c99ce5c9
TF
2377if (limit < 0.0 || *ss != '\0')
2378 return ratelimit_error(log_msgptr,
2379 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2380
c99ce5c9 2381/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2382constant. This must be strictly greater than zero, because zero leads to
2383run-time division errors. */
2384
2385sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2386if (sender_rate_period == NULL) period = -1.0;
2387else period = readconf_readtime(sender_rate_period, 0, FALSE);
2388if (period <= 0.0)
c99ce5c9
TF
2389 return ratelimit_error(log_msgptr,
2390 "\"%s\" is not a time value", sender_rate_period);
2391
2392/* By default we are counting one of something, but the per_rcpt,
2393per_byte, and count options can change this. */
2394
2395count = 1.0;
870f6ba8 2396
c99ce5c9 2397/* Parse the other options. */
870f6ba8
TF
2398
2399while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2400 != NULL)
2401 {
2402 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2403 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2404 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2405 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2406 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2407 else if (strcmpic(ss, US"per_conn") == 0)
2408 {
2409 RATE_SET(mode, PER_CONN);
2410 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2411 badacl = TRUE;
2412 }
2413 else if (strcmpic(ss, US"per_mail") == 0)
2414 {
2415 RATE_SET(mode, PER_MAIL);
2416 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2417 }
2418 else if (strcmpic(ss, US"per_rcpt") == 0)
2419 {
2420 /* If we are running in the RCPT ACL, then we'll count the recipients
2421 one by one, but if we are running when we have accumulated the whole
2422 list then we'll add them all in one batch. */
2423 if (where == ACL_WHERE_RCPT)
2424 RATE_SET(mode, PER_RCPT);
2425 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2426 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2427 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2429 }
2430 else if (strcmpic(ss, US"per_byte") == 0)
2431 {
2432 /* If we have not yet received the message data and there was no SIZE
2433 declaration on the MAIL comand, then it's safe to just use a value of
2434 zero and let the recorded rate decay as if nothing happened. */
2435 RATE_SET(mode, PER_MAIL);
2436 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2437 else count = message_size < 0 ? 0.0 : (double)message_size;
2438 }
2439 else if (strcmpic(ss, US"per_addr") == 0)
2440 {
2441 RATE_SET(mode, PER_RCPT);
438257ba 2442 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF
2443 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2444 }
2445 else if (strncmpic(ss, US"count=", 6) == 0)
2446 {
2447 uschar *e;
2448 count = Ustrtod(ss+6, &e);
2449 if (count < 0.0 || *e != '\0')
2450 return ratelimit_error(log_msgptr,
2451 "\"%s\" is not a positive number", ss);
2452 }
2453 else if (strncmpic(ss, US"unique=", 7) == 0)
2454 unique = string_copy(ss + 7);
2455 else if (key == NULL)
2456 key = string_copy(ss);
2457 else
2458 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2459 }
2460
c99ce5c9
TF
2461/* Sanity check. When the badacl flag is set the update mode must either
2462be readonly (which is the default if it is omitted) or, for backwards
2463compatibility, a combination of noupdate and strict or leaky. */
2464
2465if (mode == RATE_PER_CLASH)
2466 return ratelimit_error(log_msgptr, "conflicting per_* options");
2467if (leaky + strict + readonly > 1)
2468 return ratelimit_error(log_msgptr, "conflicting update modes");
2469if (badacl && (leaky || strict) && !noupdate)
2470 return ratelimit_error(log_msgptr,
2471 "\"%s\" must not have /leaky or /strict option in %s ACL",
2472 ratelimit_option_string[mode], acl_wherenames[where]);
2473
2474/* Set the default values of any unset options. In readonly mode we
2475perform the rate computation without any increment so that its value
2476decays to eventually allow over-limit senders through. */
2477
2478if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2479if (badacl) readonly = TRUE;
2480if (readonly) count = 0.0;
2481if (!strict && !readonly) leaky = TRUE;
2482if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2483
8f240103
PH
2484/* Create the lookup key. If there is no explicit key, use sender_host_address.
2485If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2486omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2487are added to the key because they alter the meaning of the stored data. */
2488
2489if (key == NULL)
2490 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2491
c99ce5c9 2492key = string_sprintf("%s/%s/%s%s",
8f240103 2493 sender_rate_period,
c99ce5c9
TF
2494 ratelimit_option_string[mode],
2495 unique == NULL ? "" : "unique/",
8f240103 2496 key);
870f6ba8 2497
c99ce5c9
TF
2498HDEBUG(D_acl)
2499 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2500
8f240103
PH
2501/* See if we have already computed the rate by looking in the relevant tree.
2502For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2503pool so that they survive across resets. In readonly mode we only remember the
2504result for the rest of this command in case a later command changes it. After
2505this bit of logic the code is independent of the per_* mode. */
870f6ba8 2506
870f6ba8
TF
2507old_pool = store_pool;
2508
c99ce5c9
TF
2509if (readonly)
2510 anchor = &ratelimiters_cmd;
2511else switch(mode) {
2512case RATE_PER_CONN:
870f6ba8
TF
2513 anchor = &ratelimiters_conn;
2514 store_pool = POOL_PERM;
c99ce5c9
TF
2515 break;
2516case RATE_PER_BYTE:
2517case RATE_PER_MAIL:
2518case RATE_PER_ALLRCPTS:
870f6ba8 2519 anchor = &ratelimiters_mail;
c99ce5c9
TF
2520 break;
2521case RATE_PER_ADDR:
2522case RATE_PER_CMD:
2523case RATE_PER_RCPT:
fe0dab11 2524 anchor = &ratelimiters_cmd;
c99ce5c9
TF
2525 break;
2526default:
3399bb60 2527 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF
2528 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2529 "internal ACL error: unknown ratelimit mode %d", mode);
2530 break;
2531}
870f6ba8 2532
c99ce5c9
TF
2533t = tree_search(*anchor, key);
2534if (t != NULL)
870f6ba8
TF
2535 {
2536 dbd = t->data.ptr;
2537 /* The following few lines duplicate some of the code below. */
8f240103 2538 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2539 store_pool = old_pool;
2540 sender_rate = string_sprintf("%.1f", dbd->rate);
2541 HDEBUG(D_acl)
2542 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2543 return rc;
2544 }
2545
c99ce5c9
TF
2546/* We aren't using a pre-computed rate, so get a previously recorded rate
2547from the database, which will be updated and written back if required. */
870f6ba8
TF
2548
2549dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2550if (dbm == NULL)
2551 {
2552 store_pool = old_pool;
2553 sender_rate = NULL;
2554 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2556 return DEFER;
2557 }
c99ce5c9
TF
2558dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2559dbd = NULL;
870f6ba8
TF
2560
2561gettimeofday(&tv, NULL);
2562
c99ce5c9
TF
2563if (dbdb != NULL)
2564 {
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2567 dbd = &dbdb->dbd;
2568
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2573
2574 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2575 {
2576 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2577 dbdb = NULL;
2578 }
2579
2580 /* Sanity check. */
2581
2582 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2583 {
2584 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2585 dbdb = NULL;
2586 }
2587 }
2588
2589/* Allocate a new data block if the database lookup failed
2590or the Bloom filter passed its age limit. */
2591
2592if (dbdb == NULL)
2593 {
2594 if (unique == NULL)
2595 {
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size);
2600 }
2601 else
2602 {
2603 int extra;
2604 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2605
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2609
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2617
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2620
2621 if (dbd != NULL)
2622 {
2623 dbdb->dbd = *dbd;
2624 dbd = &dbdb->dbd;
2625 }
2626 }
2627 }
2628
2629/* If we are counting unique events, find out if this event is new or not.
2630If the client repeats the event during the current period then it should be
2631counted. We skip this code in readonly mode for efficiency, because any
2632changes to the filter will be discarded and because count is already set to
2633zero. */
2634
2635if (unique != NULL && !readonly)
2636 {
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2642
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2648
2649 size = limit * 16
2650 numhash = 8
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2654
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2657
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2661
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2664
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2669
2670 BOOL seen;
2671 unsigned n, hash, hinc;
2672 uschar md5sum[16];
2673 md5 md5info;
2674
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2679
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2684
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2687
2688 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2689
2690 seen = TRUE;
2691 for (n = 0; n < 8; n++, hash += hinc)
2692 {
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2696 {
2697 dbdb->bloom[byte] |= bit;
2698 seen = FALSE;
2699 }
2700 }
2701
2702 /* If this event has occurred before, do not count it. */
2703
2704 if (seen)
2705 {
2706 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2707 count = 0.0;
2708 }
2709 else
2710 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2711 }
2712
2713/* If there was no previous ratelimit data block for this key, initialize
2714the new one, otherwise update the block from the database. The initial rate
2715is what would be computed by the code below for an infinite interval. */
2716
870f6ba8
TF
2717if (dbd == NULL)
2718 {
c99ce5c9
TF
2719 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2720 dbd = &dbdb->dbd;
870f6ba8
TF
2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
c99ce5c9 2723 dbd->rate = count;
870f6ba8
TF
2724 }
2725else
2726 {
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2731
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2737
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2741
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2746
2747 rate_1 = (1 - a) * p/i + a * rate_0
2748 = k + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2755
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2757
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2762
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2768
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2773
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2776 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2777
e5d5a95f
TF
2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2780
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
870f6ba8 2783
c99ce5c9
TF
2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2787
870f6ba8
TF
2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2791
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-intialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2801
2802 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2803 }
2804
c99ce5c9
TF
2805/* Clients sending at the limit are considered to be over the limit.
2806This matters for edge cases such as a limit of zero, when the client
2807should be completely blocked. */
3348576f 2808
8f240103 2809rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2810
2811/* Update the state if the rate is low or if we are being strict. If we
2812are in leaky mode and the sender's rate is too high, we do not update
2813the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2814rate preventing them from getting any email through. If readonly is set,
2815neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2816
c99ce5c9 2817if ((rc == FAIL && leaky) || strict)
8f240103 2818 {
c99ce5c9 2819 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH
2820 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2821 }
2822else
2823 {
2824 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2825 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2826 }
2827
870f6ba8
TF
2828dbfn_close(dbm);
2829
c99ce5c9 2830/* Store the result in the tree for future reference. */
870f6ba8 2831
c99ce5c9
TF
2832t = store_get(sizeof(tree_node) + Ustrlen(key));
2833t->data.ptr = dbd;
2834Ustrcpy(t->name, key);
2835(void)tree_insertnode(anchor, t);
870f6ba8
TF
2836
2837/* We create the formatted version of the sender's rate very late in
2838order to ensure that it is done using the correct storage pool. */
2839
2840store_pool = old_pool;
2841sender_rate = string_sprintf("%.1f", dbd->rate);
2842
2843HDEBUG(D_acl)
2844 debug_printf("ratelimit computed rate %s\n", sender_rate);
2845
2846return rc;
2847}
2848
2849
2850
2851/*************************************************
b0019c78
TF
2852* The udpsend ACL modifier *
2853*************************************************/
2854
2855/* Called by acl_check_condition() below.
2856
2857Arguments:
2858 arg the option string for udpsend=
2859 log_msgptr for error messages
2860
2861Returns: OK - Completed.
2862 DEFER - Problem with DNS lookup.
2863 ERROR - Syntax error in options.
2864*/
2865
2866static int
55414b25 2867acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2868{
2869int sep = 0;
2870uschar *hostname;
2871uschar *portstr;
2872uschar *portend;
2873host_item *h;
2874int portnum;
b0019c78
TF
2875int len;
2876int r, s;
b1f8e4f8 2877uschar * errstr;
b0019c78
TF
2878
2879hostname = string_nextinlist(&arg, &sep, NULL, 0);
2880portstr = string_nextinlist(&arg, &sep, NULL, 0);
2881
2882if (hostname == NULL)
2883 {
217b0e56 2884 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2885 return ERROR;
2886 }
2887if (portstr == NULL)
2888 {
217b0e56 2889 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2890 return ERROR;
2891 }
2892if (arg == NULL)
2893 {
217b0e56 2894 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2895 return ERROR;
2896 }
2897portnum = Ustrtol(portstr, &portend, 10);
2898if (*portend != '\0')
2899 {
217b0e56 2900 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2901 return ERROR;
2902 }
2903
2904/* Make a single-item host list. */
2905h = store_get(sizeof(host_item));
2906memset(h, 0, sizeof(host_item));
2907h->name = hostname;
2908h->port = portnum;
2909h->mx = MX_NONE;
2910
2911if (string_is_ip_address(hostname, NULL))
2912 h->address = hostname, r = HOST_FOUND;
2913else
2914 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2915if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2916 {
217b0e56 2917 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2918 return DEFER;
2919 }
2920
2921HDEBUG(D_acl)
2922 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2923
b1f8e4f8
JH
2924r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2925 1, NULL, &errstr);
b0019c78 2926if (r < 0) goto defer;
27f9999e 2927len = Ustrlen(arg);
9cb1785a 2928r = send(s, arg, len, 0);
b1f8e4f8
JH
2929if (r < 0)
2930 {
2931 errstr = US strerror(errno);
2932 close(s);
2933 goto defer;
2934 }
2935close(s);
b0019c78
TF
2936if (r < len)
2937 {
2938 *log_msgptr =
2939 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2940 return DEFER;
2941 }
2942
2943HDEBUG(D_acl)
2944 debug_printf("udpsend %d bytes\n", r);
2945
2946return OK;
2947
2948defer:
b1f8e4f8 2949*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2950return DEFER;
2951}
2952
2953
2954
2955/*************************************************
059ec3d9
PH
2956* Handle conditions/modifiers on an ACL item *
2957*************************************************/
2958
2959/* Called from acl_check() below.
2960
2961Arguments:
2962 verb ACL verb
2963 cb ACL condition block - if NULL, result is OK
2964 where where called from
2965 addr the address being checked for RCPT, or NULL
2966 level the nesting level
2967 epp pointer to pass back TRUE if "endpass" encountered
2968 (applies only to "accept" and "discard")
2969 user_msgptr user message pointer
2970 log_msgptr log message pointer
2971 basic_errno pointer to where to put verify error
2972
2973Returns: OK - all conditions are met
2974 DISCARD - an "acl" condition returned DISCARD - only allowed
2975 for "accept" or "discard" verbs
2976 FAIL - at least one condition fails
2977 FAIL_DROP - an "acl" condition returned FAIL_DROP
2978 DEFER - can't tell at the moment (typically, lookup defer,
2979 but can be temporary callout problem)
2980 ERROR - ERROR from nested ACL or expansion failure or other
2981 error
2982*/
2983
2984static int
2985acl_check_condition(int verb, acl_condition_block *cb, int where,
2986 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2987 uschar **log_msgptr, int *basic_errno)
2988{
2989uschar *user_message = NULL;
2990uschar *log_message = NULL;
059ec3d9 2991int rc = OK;
8523533c 2992#ifdef WITH_CONTENT_SCAN
0f0c8159 2993int sep = -'/';
8523533c 2994#endif
059ec3d9
PH
2995
2996for (; cb != NULL; cb = cb->next)
2997 {
55414b25 2998 const uschar *arg;
8e669ac1 2999 int control_type;
059ec3d9
PH
3000
3001 /* The message and log_message items set up messages to be used in
3002 case of rejection. They are expanded later. */
3003
3004 if (cb->type == ACLC_MESSAGE)
3005 {
187bc588 3006 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH
3007 user_message = cb->arg;
3008 continue;
3009 }
3010
3011 if (cb->type == ACLC_LOG_MESSAGE)
3012 {
187bc588 3013 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH
3014 log_message = cb->arg;
3015 continue;
3016 }
3017
3018 /* The endpass "condition" just sets a flag to show it occurred. This is
3019 checked at compile time to be on an "accept" or "discard" item. */
3020
3021 if (cb->type == ACLC_ENDPASS)
3022 {
3023 *epp = TRUE;
3024 continue;
3025 }
3026
3027 /* For other conditions and modifiers, the argument is expanded now for some
3028 of them, but not for all, because expansion happens down in some lower level
3029 checking functions in some cases. */
3030
3031 if (cond_expand_at_top[cb->type])
3032 {
3033 arg = expand_string(cb->arg);
3034 if (arg == NULL)
3035 {
3036 if (expand_string_forcedfail) continue;
3037 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3038 cb->arg, expand_string_message);
3039 return search_find_defer? DEFER : ERROR;
3040 }
3041 }
3042 else arg = cb->arg;
3043
3044 /* Show condition, and expanded condition if it's different */
3045
3046 HDEBUG(D_acl)
3047 {
3048 int lhswidth = 0;
3049 debug_printf("check %s%s %n",
3050 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3051 conditions[cb->type], &lhswidth);
3052
3053 if (cb->type == ACLC_SET)
3054 {
38a0a95f
PH
3055 debug_printf("acl_%s ", cb->u.varname);
3056 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH
3057 }
3058
3059 debug_printf("= %s\n", cb->arg);
3060
3061 if (arg != cb->arg)
3062 debug_printf("%.*s= %s\n", lhswidth,
3063 US" ", CS arg);
3064 }
3065
3066 /* Check that this condition makes sense at this time */
3067
3068 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3069 {
3070 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3071 cond_modifiers[cb->type]? "use" : "test",
3072 conditions[cb->type], acl_wherenames[where]);
3073 return ERROR;
3074 }
3075
3076 /* Run the appropriate test for each condition, or take the appropriate
3077 action for the remaining modifiers. */
3078
3079 switch(cb->type)
3080 {
71fafd95
PH
3081 case ACLC_ADD_HEADER:
3082 setup_header(arg);
3083 break;
3084
059ec3d9
PH
3085 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3086 "discard" verb. */
71fafd95 3087
059ec3d9 3088 case ACLC_ACL:
f60d98e8 3089 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH
3090 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3091 {
3092 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3093 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3094 verbs[verb]);
3095 return ERROR;
3096 }
059ec3d9
PH
3097 break;
3098
3099 case ACLC_AUTHENTICATED:
3100 rc = (sender_host_authenticated == NULL)? FAIL :
3101 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3102 TRUE, NULL);
3103 break;
3104
71fafd95 3105 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
3106 case ACLC_BMI_OPTIN:
3107 {
3108 int old_pool = store_pool;
3109 store_pool = POOL_PERM;
3110 bmi_current_optin = string_copy(arg);
3111 store_pool = old_pool;
3112 }
3113 break;
71fafd95 3114 #endif
8523533c 3115
059ec3d9 3116 case ACLC_CONDITION:
f3766eb5
NM
3117 /* The true/false parsing here should be kept in sync with that used in
3118 expand.c when dealing with ECOND_BOOL so that we don't have too many
3119 different definitions of what can be a boolean. */
51c7471d
JH
3120 if (*arg == '-'
3121 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3122 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
3123 rc = (Uatoi(arg) == 0)? FAIL : OK;
3124 else
3125 rc = (strcmpic(arg, US"no") == 0 ||
3126 strcmpic(arg, US"false") == 0)? FAIL :
3127 (strcmpic(arg, US"yes") == 0 ||
3128 strcmpic(arg, US"true") == 0)? OK : DEFER;
3129 if (rc == DEFER)
3130 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3131 break;
3132
c3611384
PH
3133 case ACLC_CONTINUE: /* Always succeeds */
3134 break;
3135
059ec3d9 3136 case ACLC_CONTROL:
c5fcb476 3137 {
55414b25
JH
3138 const uschar *p = NULL;
3139 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3140
55414b25 3141 /* Check if this control makes sense at this time */
f7572e5a 3142
55414b25
JH
3143 if ((control_forbids[control_type] & (1 << where)) != 0)
3144 {
3145 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3146 controls[control_type], acl_wherenames[where]);
3147 return ERROR;
3148 }
8800895a 3149
55414b25
JH
3150 switch(control_type)
3151 {
3152 case CONTROL_AUTH_UNADVERTISED:
3153 allow_auth_unadvertised = TRUE;
3154 break;
3155
3156 #ifdef EXPERIMENTAL_BRIGHTMAIL
3157 case CONTROL_BMI_RUN:
3158 bmi_run = 1;
3159 break;
3160 #endif
3161
3162 #ifndef DISABLE_DKIM
3163 case CONTROL_DKIM_VERIFY:
3164 dkim_disable_verify = TRUE;
3165 #ifdef EXPERIMENTAL_DMARC
3166 /* Since DKIM was blocked, skip DMARC too */
3167 dmarc_disable_verify = TRUE;
3168 dmarc_enable_forensic = FALSE;
3169 #endif
3170 break;
3171 #endif
3172
3173 #ifdef EXPERIMENTAL_DMARC
3174 case CONTROL_DMARC_VERIFY:
3175 dmarc_disable_verify = TRUE;
3176 break;
3177
3178 case CONTROL_DMARC_FORENSIC:
3179 dmarc_enable_forensic = TRUE;
3180 break;
3181 #endif
3182
3183 case CONTROL_DSCP:
3184 if (*p == '/')
3185 {
3186 int fd, af, level, optname, value;
3187 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3188 a socket; we can accept that, we'll just debug-log failures anyway. */
3189 fd = fileno(smtp_in);
3190 af = ip_get_address_family(fd);
3191 if (af < 0)
3192 {
3193 HDEBUG(D_acl)
3194 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3195 strerror(errno));
3196 break;
3197 }
3198 if (dscp_lookup(p+1, af, &level, &optname, &value))
3199 {
3200 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3201 {
3202 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3203 p+1, strerror(errno));
3204 }
3205 else
3206 {
3207 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3208 }
3209 }
3210 else
3211 {
3212 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3213 return ERROR;
3214 }
3215 }
3216 else
3217 {
3218 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3219 return ERROR;
3220 }
3221 break;
3222
3223 case CONTROL_ERROR:
3224 return ERROR;
3225
3226 case CONTROL_CASEFUL_LOCAL_PART:
3227 deliver_localpart = addr->cc_local_part;
3228 break;
3229
3230 case CONTROL_CASELOWER_LOCAL_PART:
3231 deliver_localpart = addr->lc_local_part;
3232 break;
3233
3234 case CONTROL_ENFORCE_SYNC:
3235 smtp_enforce_sync = TRUE;
3236 break;
3237
3238 case CONTROL_NO_ENFORCE_SYNC:
3239 smtp_enforce_sync = FALSE;
3240 break;
3241
3242 #ifdef WITH_CONTENT_SCAN
3243 case CONTROL_NO_MBOX_UNSPOOL:
3244 no_mbox_unspool = TRUE;
3245 break;
3246 #endif
3247
3248 case CONTROL_NO_MULTILINE:
3249 no_multiline_responses = TRUE;
3250 break;
3251
3252 case CONTROL_NO_PIPELINING:
3253 pipelining_enable = FALSE;
3254 break;
3255
3256 case CONTROL_NO_DELAY_FLUSH:
3257 disable_delay_flush = TRUE;
3258 break;
3259
3260 case CONTROL_NO_CALLOUT_FLUSH:
3261 disable_callout_flush = TRUE;
3262 break;
3263
3264 case CONTROL_FAKEREJECT:
3265 cancel_cutthrough_connection("fakereject");
3266 case CONTROL_FAKEDEFER:
3267 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3268 if (*p == '/')
3269 {
3270 const uschar *pp = p + 1;
3271 while (*pp != 0) pp++;
3272 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3273 p = pp;
3274 }
3275 else
3276 {
3277 /* Explicitly reset to default string */
3278 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3279 }
3280 break;
ed7f7860 3281
55414b25
JH
3282 case CONTROL_FREEZE:
3283 deliver_freeze = TRUE;
3284 deliver_frozen_at = time(NULL);
3285 freeze_tell = freeze_tell_config; /* Reset to configured value */
3286 if (Ustrncmp(p, "/no_tell", 8) == 0)
3287 {
3288 p += 8;
3289 freeze_tell = NULL;
3290 }
3291 if (*p != 0)
3292 {
3293 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3294 return ERROR;
3295 }
3296 cancel_cutthrough_connection("item frozen");
3297 break;
3298
3299 case CONTROL_QUEUE_ONLY:
3300 queue_only_policy = TRUE;
3301 cancel_cutthrough_connection("queueing forced");
3302 break;
3303
3304 case CONTROL_SUBMISSION:
3305 originator_name = US"";
3306 submission_mode = TRUE;
3307 while (*p == '/')
3308 {
3309 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3310 {
3311 p += 14;
3312 active_local_sender_retain = TRUE;
3313 active_local_from_check = FALSE;
3314 }
3315 else if (Ustrncmp(p, "/domain=", 8) == 0)
3316 {
3317 const uschar *pp = p + 8;
3318 while (*pp != 0 && *pp != '/') pp++;
3319 submission_domain = string_copyn(p+8, pp-p-8);
3320 p = pp;
3321 }
3322 /* The name= option must be last, because it swallows the rest of
3323 the string. */
3324 else if (Ustrncmp(p, "/name=", 6) == 0)
3325 {
3326 const uschar *pp = p + 6;
3327 while (*pp != 0) pp++;
3328 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3329 big_buffer, big_buffer_size));
3330 p = pp;
3331 }
3332 else break;
3333 }
3334 if (*p != 0)
3335 {
3336 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3337 return ERROR;
3338 }
3339 break;
e4bdf652 3340
55414b25 3341 case CONTROL_DEBUG:
55414b25 3342 {
b0d68adc
JH
3343 uschar * debug_tag = NULL;
3344 uschar * debug_opts = NULL;
3345 BOOL kill = FALSE;
3346
3347 while (*p == '/')
55414b25 3348 {
b0d68adc
JH
3349 const uschar * pp = p+1;
3350 if (Ustrncmp(pp, "tag=", 4) == 0)
3351 {
3352 for (pp += 4; *pp && *pp != '/';) pp++;
3353 debug_tag = string_copyn(p+5, pp-p-5);
3354 }
3355 else if (Ustrncmp(pp, "opts=", 5) == 0)
3356 {
3357 for (pp += 5; *pp && *pp != '/';) pp++;
3358 debug_opts = string_copyn(p+6, pp-p-6);
3359 }
3360 else if (Ustrncmp(pp, "kill", 4) == 0)
3361 {
3362 for (pp += 4; *pp && *pp != '/';) pp++;
3363 kill = TRUE;
3364 }
3365 else
3366 while (*pp && *pp != '/') pp++;
55414b25
JH
3367 p = pp;
3368 }
b0d68adc
JH
3369
3370 if (kill)
3371 debug_logging_stop();
3372 else
3373 debug_logging_activate(debug_tag, debug_opts);
55414b25 3374 }
55414b25
JH
3375 break;
3376
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 suppress_local_fixups = TRUE;
3379 break;
3380
3381 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3382#ifndef DISABLE_PRDR
55414b25 3383 if (prdr_requested)
a2b89db1
PP
3384#else
3385 if (0)
3386#endif
55414b25
JH
3387 /* Too hard to think about for now. We might in future cutthrough
3388 the case where both sides handle prdr and this-node prdr acl
3389 is "accept" */
93a6fce2 3390 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH
3391 else
3392 {
55414b25
JH
3393 if (deliver_freeze)
3394 *log_msgptr = US"frozen";
3395 else if (queue_only_policy)
3396 *log_msgptr = US"queue-only";
3397 else if (fake_response == FAIL)
3398 *log_msgptr = US"fakereject";
3399 else
3400 {
ff5929e3
JH
3401 if (rcpt_count == 1)
3402 {
3403 cutthrough.delivery = TRUE;
3404 while (*p == '/')
3405 {
3406 const uschar * pp = p+1;
3407 if (Ustrncmp(pp, "defer=", 6) == 0)
3408 {
3409 pp += 6;
3410 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3411 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3412 }
3413 else
3414 while (*pp && *pp != '/') pp++;
3415 p = pp;
3416 }
3417 }
55414b25
JH
3418 break;
3419 }
3420 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3421 arg, *log_msgptr);
5032d1cf 3422 }
55414b25 3423 return ERROR;
3c8b3577 3424
8c5d388a 3425#ifdef SUPPORT_I18N
3c8b3577
JH
3426 case CONTROL_UTF8_DOWNCONVERT:
3427 if (*p == '/')
3428 {
921dfc11
JH
3429 if (p[1] == '1')
3430 {
3431 message_utf8_downconvert = 1;
3432 addr->prop.utf8_downcvt = TRUE;
3433 addr->prop.utf8_downcvt_maybe = FALSE;
3434 p += 2;
3435 break;
3436 }
3437 if (p[1] == '0')
3438 {
3439 message_utf8_downconvert = 0;
3440 addr->prop.utf8_downcvt = FALSE;
3441 addr->prop.utf8_downcvt_maybe = FALSE;
3442 p += 2;
3443 break;
3444 }
3c8b3577 3445 if (p[1] == '-' && p[2] == '1')
921dfc11
JH
3446 {
3447 message_utf8_downconvert = -1;
3448 addr->prop.utf8_downcvt = FALSE;
3449 addr->prop.utf8_downcvt_maybe = TRUE;
3450 p += 3;
3451 break;
3452 }
3c8b3577
JH
3453 *log_msgptr = US"bad option value for control=utf8_downconvert";
3454 }
3455 else
3456 {
921dfc11
JH
3457 message_utf8_downconvert = 1;
3458 addr->prop.utf8_downcvt = TRUE;
3459 addr->prop.utf8_downcvt_maybe = FALSE;
3460 break;
3c8b3577
JH
3461 }
3462 return ERROR;
8c5d388a 3463#endif
3c8b3577 3464
9171d434 3465 }
55414b25 3466 break;
059ec3d9 3467 }
059ec3d9 3468
6a8f9482
TK
3469 #ifdef EXPERIMENTAL_DCC
3470 case ACLC_DCC:
3471 {
3472 /* Seperate the regular expression and any optional parameters. */
55414b25
JH
3473 const uschar * list = arg;
3474 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3475 /* Run the dcc backend. */
3476 rc = dcc_process(&ss);
3477 /* Modify return code based upon the existance of options. */
3c8b3577 3478 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3479 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3480 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3481 }
3482 break;
3483 #endif
3484
71fafd95 3485 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3486 case ACLC_DECODE:
3487 rc = mime_decode(&arg);
3488 break;
71fafd95 3489 #endif
8523533c 3490
059ec3d9
PH
3491 case ACLC_DELAY:
3492 {
3493 int delay = readconf_readtime(arg, 0, FALSE);
3494 if (delay < 0)
3495 {
3496 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3497 "modifier: \"%s\" is not a time value", arg);
3498 return ERROR;
3499 }
3500 else
3501 {
3502 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3503 delay);
3504 if (host_checking)
3505 {
3506 HDEBUG(D_acl)
3507 debug_printf("delay skipped in -bh checking mode\n");
3508 }
010c2d14 3509
ae9d18bc
JH
3510 /* NOTE 1: Remember that we may be
3511 dealing with stdin/stdout here, in addition to TCP/IP connections.
3512 Also, delays may be specified for non-SMTP input, where smtp_out and
3513 smtp_in will be NULL. Whatever is done must work in all cases.
3514
3515 NOTE 2: The added feature of flushing the output before a delay must
3516 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3517 */
3518
3519 else
3520 {
3521 if (smtp_out != NULL && !disable_delay_flush)
3522 mac_smtp_fflush();
3523
861a7c51 3524#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH
3525 {
3526 struct pollfd p;
3527 nfds_t n = 0;
3528 if (smtp_out)
3529 {
3530 p.fd = fileno(smtp_out);
3531 p.events = POLLRDHUP;
3532 n = 1;
3533 }
3534 if (poll(&p, n, delay*1000) > 0)
3535 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3536 }
3537#else
010c2d14
PH
3538 /* It appears to be impossible to detect that a TCP/IP connection has
3539 gone away without reading from it. This means that we cannot shorten
3540 the delay below if the client goes away, because we cannot discover
3541 that the client has closed its end of the connection. (The connection
3542 is actually in a half-closed state, waiting for the server to close its
3543 end.) It would be nice to be able to detect this state, so that the
3544 Exim process is not held up unnecessarily. However, it seems that we
3545 can't. The poll() function does not do the right thing, and in any case
3546 it is not always available.
047bdd8c 3547 */
010c2d14 3548
86b8287f 3549 while (delay > 0) delay = sleep(delay);
ae9d18bc 3550#endif
8e669ac1 3551 }
059ec3d9
PH
3552 }
3553 }
3554 break;
3555
80a47a2c
TK
3556 #ifndef DISABLE_DKIM
3557 case ACLC_DKIM_SIGNER:
9e5d6b55
TK
3558 if (dkim_cur_signer != NULL)
3559 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3560 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3561 else
b0b9dbb1 3562 rc = FAIL;
71fafd95
PH
3563 break;
3564
80a47a2c
TK
3565 case ACLC_DKIM_STATUS:
3566 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3567 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3568 break;
3569 #endif
fb2274d4 3570
4840604e
TL
3571 #ifdef EXPERIMENTAL_DMARC
3572 case ACLC_DMARC_STATUS:
4a8ce2d8 3573 if (!dmarc_has_been_checked)
4840604e 3574 dmarc_process();
4a8ce2d8 3575 dmarc_has_been_checked = TRUE;
4840604e
TL
3576 /* used long way of dmarc_exim_expand_query() in case we need more
3577 * view into the process in the future. */
3578 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3579 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3580 break;
3581 #endif
3582
059ec3d9 3583 case ACLC_DNSLISTS:
379ba7d0 3584 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH
3585 break;
3586
3587 case ACLC_DOMAINS:
3588 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3589 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3590 break;
3591
3592 /* The value in tls_cipher is the full cipher name, for example,
3593 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3594 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3595 what may in practice come out of the SSL library - which at the time of
3596 writing is poorly documented. */
3597
3598 case ACLC_ENCRYPTED:
817d9f57 3599 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3600 {
3601 uschar *endcipher = NULL;
817d9f57
JH
3602 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3603 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3604 {
3605 endcipher = Ustrchr(++cipher, ':');
3606 if (endcipher != NULL) *endcipher = 0;
3607 }
3608 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3609 if (endcipher != NULL) *endcipher = ':';
3610 }
3611 break;
3612
3613 /* Use verify_check_this_host() instead of verify_check_host() so that
3614 we can pass over &host_data to catch any looked up data. Once it has been
3615 set, it retains its value so that it's still there if another ACL verb
3616 comes through here and uses the cache. However, we must put it into
3617 permanent store in case it is also expected to be used in a subsequent
3618 message in the same SMTP connection. */
3619
3620 case ACLC_HOSTS:
3621 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH
3622 (sender_host_address == NULL)? US"" : sender_host_address,
3623 CUSS &host_data);
4a452c43
JH
3624 if (rc == DEFER) *log_msgptr = search_error_message;
3625 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH
3626 break;
3627
3628 case ACLC_LOCAL_PARTS:
3629 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3630 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3631 CUSS &deliver_localpart_data);
059ec3d9
PH
3632 break;
3633
6ea85e9a
PH
3634 case ACLC_LOG_REJECT_TARGET:
3635 {
3636 int logbits = 0;
3637 int sep = 0;
55414b25 3638 const uschar *s = arg;
6ea85e9a 3639 uschar *ss;
4a452c43 3640 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH
3641 {
3642 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3643 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3644 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3645 else
3646 {
3647 logbits |= LOG_MAIN|LOG_REJECT;
3648 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3649 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3650 }
3651 }
3652 log_reject_target = logbits;
3653 }
3654 break;
3655
059ec3d9
PH
3656 case ACLC_LOGWRITE:
3657 {
3658 int logbits = 0;
55414b25 3659 const uschar *s = arg;
059ec3d9
PH
3660 if (*s == ':')
3661 {
3662 s++;
3663 while (*s != ':')
3664 {
3665 if (Ustrncmp(s, "main", 4) == 0)
3666 { logbits |= LOG_MAIN; s += 4; }
3667 else if (Ustrncmp(s, "panic", 5) == 0)
3668 { logbits |= LOG_PANIC; s += 5; }
3669 else if (Ustrncmp(s, "reject", 6) == 0)
3670 { logbits |= LOG_REJECT; s += 6; }
3671 else
3672 {
3673 logbits = LOG_MAIN|LOG_PANIC;
3674 s = string_sprintf(":unknown log name in \"%s\" in "
3675 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3676 }
3677 if (*s == ',') s++;
3678 }
3679 s++;
3680 }
3681 while (isspace(*s)) s++;
6ea85e9a
PH
3682
3683
059ec3d9
PH
3684 if (logbits == 0) logbits = LOG_MAIN;
3685 log_write(0, logbits, "%s", string_printing(s));
3686 }
3687 break;
8e669ac1 3688
71fafd95 3689 #ifdef WITH_CONTENT_SCAN
0f0c8159 3690 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3691 {
6ea85e9a 3692 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3693 const uschar * list = arg;
3694 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH
3695 uschar *opt;
3696 BOOL defer_ok = FALSE;
3697 int timeout = 0;
3698
55414b25 3699 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH
3700 if (strcmpic(opt, US"defer_ok") == 0)
3701 defer_ok = TRUE;
3702 else if ( strncmpic(opt, US"tmo=", 4) == 0
3703 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3704 )
3705 {
3706 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3707 return ERROR;
3708 }
3709
3710 rc = malware(ss, timeout);
3711 if (rc == DEFER && defer_ok)
3712 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK