4.53 TK/05
[exim.git] / src / src / acl.c
CommitLineData
64ffc24f 1/* $Cambridge: exim/src/src/acl.c,v 1.44 2005/08/22 14:01:37 ph10 Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
c988f1f4 7/* Copyright (c) University of Cambridge 1995 - 2005 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Code for handling Access Control Lists (ACLs) */
11
12#include "exim.h"
13
14
15/* Default callout timeout */
16
17#define CALLOUT_TIMEOUT_DEFAULT 30
18
19/* ACL verb codes - keep in step with the table of verbs that follows */
20
21enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
22 ACL_WARN };
23
24/* ACL verbs */
25
26static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
28 US"warn" };
29
30/* For each verb, the condition for which "message" is used */
31
32static int msgcond[] = { FAIL, OK, OK, FAIL, OK, FAIL, OK };
33
34/* ACL condition and modifier codes - keep in step with the table that
35follows. */
36
8523533c
TK
37enum { ACLC_ACL, ACLC_AUTHENTICATED,
38#ifdef EXPERIMENTAL_BRIGHTMAIL
39 ACLC_BMI_OPTIN,
40#endif
41ACLC_CONDITION, ACLC_CONTROL,
42#ifdef WITH_CONTENT_SCAN
43 ACLC_DECODE,
44#endif
45 ACLC_DELAY,
46#ifdef WITH_OLD_DEMIME
47 ACLC_DEMIME,
8e669ac1 48#endif
fb2274d4
TK
49#ifdef EXPERIMENTAL_DOMAINKEYS
50 ACLC_DK_DOMAIN_SOURCE,
51 ACLC_DK_POLICY,
52 ACLC_DK_SENDER_DOMAINS,
53 ACLC_DK_SENDER_LOCAL_PARTS,
54 ACLC_DK_SENDERS,
55 ACLC_DK_STATUS,
56#endif
8523533c
TK
57 ACLC_DNSLISTS, ACLC_DOMAINS, ACLC_ENCRYPTED, ACLC_ENDPASS,
58 ACLC_HOSTS, ACLC_LOCAL_PARTS, ACLC_LOG_MESSAGE, ACLC_LOGWRITE,
59#ifdef WITH_CONTENT_SCAN
60 ACLC_MALWARE,
61#endif
62 ACLC_MESSAGE,
63#ifdef WITH_CONTENT_SCAN
64 ACLC_MIME_REGEX,
65#endif
870f6ba8 66 ACLC_RATELIMIT,
8523533c
TK
67 ACLC_RECIPIENTS,
68#ifdef WITH_CONTENT_SCAN
69 ACLC_REGEX,
70#endif
71 ACLC_SENDER_DOMAINS, ACLC_SENDERS, ACLC_SET,
72#ifdef WITH_CONTENT_SCAN
8e669ac1 73 ACLC_SPAM,
8523533c
TK
74#endif
75#ifdef EXPERIMENTAL_SPF
76 ACLC_SPF,
77#endif
78 ACLC_VERIFY };
059ec3d9
PH
79
80/* ACL conditions/modifiers: "delay", "control", "endpass", "message",
81"log_message", "logwrite", and "set" are modifiers that look like conditions
82but always return TRUE. They are used for their side effects. */
83
9a26b6b2
PH
84static uschar *conditions[] = {
85 US"acl",
86 US"authenticated",
8523533c
TK
87#ifdef EXPERIMENTAL_BRIGHTMAIL
88 US"bmi_optin",
89#endif
90 US"condition",
8e669ac1 91 US"control",
8523533c
TK
92#ifdef WITH_CONTENT_SCAN
93 US"decode",
94#endif
95 US"delay",
96#ifdef WITH_OLD_DEMIME
97 US"demime",
98#endif
fb2274d4 99#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
100 US"dk_domain_source",
101 US"dk_policy",
102 US"dk_sender_domains",
103 US"dk_sender_local_parts",
104 US"dk_senders",
105 US"dk_status",
fb2274d4 106#endif
8523533c 107 US"dnslists", US"domains", US"encrypted",
059ec3d9 108 US"endpass", US"hosts", US"local_parts", US"log_message", US"logwrite",
8523533c
TK
109#ifdef WITH_CONTENT_SCAN
110 US"malware",
111#endif
112 US"message",
113#ifdef WITH_CONTENT_SCAN
114 US"mime_regex",
115#endif
870f6ba8 116 US"ratelimit",
8523533c
TK
117 US"recipients",
118#ifdef WITH_CONTENT_SCAN
119 US"regex",
120#endif
121 US"sender_domains", US"senders", US"set",
122#ifdef WITH_CONTENT_SCAN
123 US"spam",
124#endif
125#ifdef EXPERIMENTAL_SPF
126 US"spf",
127#endif
059ec3d9 128 US"verify" };
8e669ac1 129
c5fcb476 130
9a26b6b2
PH
131/* Return values from decode_control(); keep in step with the table of names
132that follows! */
133
134enum {
135#ifdef EXPERIMENTAL_BRIGHTMAIL
136 CONTROL_BMI_RUN,
137#endif
138#ifdef EXPERIMENTAL_DOMAINKEYS
139 CONTROL_DK_VERIFY,
140#endif
141 CONTROL_ERROR, CONTROL_CASEFUL_LOCAL_PART, CONTROL_CASELOWER_LOCAL_PART,
142 CONTROL_ENFORCE_SYNC, CONTROL_NO_ENFORCE_SYNC, CONTROL_FREEZE,
143 CONTROL_QUEUE_ONLY, CONTROL_SUBMISSION,
144#ifdef WITH_CONTENT_SCAN
145 CONTROL_NO_MBOX_UNSPOOL,
146#endif
147 CONTROL_FAKEDEFER, CONTROL_FAKEREJECT, CONTROL_NO_MULTILINE };
148
149/* ACL control names; keep in step with the table above! */
150
151static uschar *controls[] = {
152 #ifdef EXPERIMENTAL_BRIGHTMAIL
153 US"bmi_run",
154 #endif
155 #ifdef EXPERIMENTAL_DOMAINKEYS
156 US"dk_verify",
157 #endif
158 US"error", US"caseful_local_part",
c5fcb476 159 US"caselower_local_part", US"enforce_sync", US"no_enforce_sync", US"freeze",
9a26b6b2
PH
160 US"queue_only", US"submission",
161 #ifdef WITH_CONTENT_SCAN
162 US"no_mbox_unspool",
163 #endif
164 US"no_multiline"};
059ec3d9
PH
165
166/* Flags to indicate for which conditions /modifiers a string expansion is done
167at the outer level. In the other cases, expansion already occurs in the
168checking functions. */
169
170static uschar cond_expand_at_top[] = {
171 TRUE, /* acl */
172 FALSE, /* authenticated */
8523533c
TK
173#ifdef EXPERIMENTAL_BRIGHTMAIL
174 TRUE, /* bmi_optin */
8e669ac1 175#endif
059ec3d9
PH
176 TRUE, /* condition */
177 TRUE, /* control */
8523533c
TK
178#ifdef WITH_CONTENT_SCAN
179 TRUE, /* decode */
180#endif
059ec3d9 181 TRUE, /* delay */
8523533c
TK
182#ifdef WITH_OLD_DEMIME
183 TRUE, /* demime */
184#endif
fb2274d4 185#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
186 TRUE, /* dk_domain_source */
187 TRUE, /* dk_policy */
188 TRUE, /* dk_sender_domains */
e715ad22 189 TRUE, /* dk_sender_local_parts */
7f45268c
PH
190 TRUE, /* dk_senders */
191 TRUE, /* dk_status */
fb2274d4 192#endif
059ec3d9
PH
193 TRUE, /* dnslists */
194 FALSE, /* domains */
195 FALSE, /* encrypted */
196 TRUE, /* endpass */
197 FALSE, /* hosts */
198 FALSE, /* local_parts */
199 TRUE, /* log_message */
200 TRUE, /* logwrite */
8523533c
TK
201#ifdef WITH_CONTENT_SCAN
202 TRUE, /* malware */
203#endif
059ec3d9 204 TRUE, /* message */
8523533c
TK
205#ifdef WITH_CONTENT_SCAN
206 TRUE, /* mime_regex */
207#endif
870f6ba8 208 TRUE, /* ratelimit */
059ec3d9 209 FALSE, /* recipients */
8523533c
TK
210#ifdef WITH_CONTENT_SCAN
211 TRUE, /* regex */
212#endif
059ec3d9
PH
213 FALSE, /* sender_domains */
214 FALSE, /* senders */
215 TRUE, /* set */
8523533c
TK
216#ifdef WITH_CONTENT_SCAN
217 TRUE, /* spam */
218#endif
219#ifdef EXPERIMENTAL_SPF
220 TRUE, /* spf */
221#endif
059ec3d9
PH
222 TRUE /* verify */
223};
224
225/* Flags to identify the modifiers */
226
227static uschar cond_modifiers[] = {
228 FALSE, /* acl */
229 FALSE, /* authenticated */
8523533c
TK
230#ifdef EXPERIMENTAL_BRIGHTMAIL
231 TRUE, /* bmi_optin */
8e669ac1 232#endif
059ec3d9
PH
233 FALSE, /* condition */
234 TRUE, /* control */
8523533c
TK
235#ifdef WITH_CONTENT_SCAN
236 FALSE, /* decode */
237#endif
059ec3d9 238 TRUE, /* delay */
8523533c
TK
239#ifdef WITH_OLD_DEMIME
240 FALSE, /* demime */
241#endif
fb2274d4 242#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
243 FALSE, /* dk_domain_source */
244 FALSE, /* dk_policy */
245 FALSE, /* dk_sender_domains */
e715ad22 246 FALSE, /* dk_sender_local_parts */
7f45268c
PH
247 FALSE, /* dk_senders */
248 FALSE, /* dk_status */
fb2274d4 249#endif
059ec3d9
PH
250 FALSE, /* dnslists */
251 FALSE, /* domains */
252 FALSE, /* encrypted */
253 TRUE, /* endpass */
254 FALSE, /* hosts */
255 FALSE, /* local_parts */
256 TRUE, /* log_message */
8523533c
TK
257 TRUE, /* logwrite */
258#ifdef WITH_CONTENT_SCAN
259 FALSE, /* malware */
260#endif
059ec3d9 261 TRUE, /* message */
8523533c
TK
262#ifdef WITH_CONTENT_SCAN
263 FALSE, /* mime_regex */
264#endif
870f6ba8 265 FALSE, /* ratelimit */
059ec3d9 266 FALSE, /* recipients */
8523533c
TK
267#ifdef WITH_CONTENT_SCAN
268 FALSE, /* regex */
269#endif
059ec3d9
PH
270 FALSE, /* sender_domains */
271 FALSE, /* senders */
272 TRUE, /* set */
8523533c
TK
273#ifdef WITH_CONTENT_SCAN
274 FALSE, /* spam */
275#endif
276#ifdef EXPERIMENTAL_SPF
277 FALSE, /* spf */
278#endif
059ec3d9
PH
279 FALSE /* verify */
280};
281
c5fcb476 282/* Bit map vector of which conditions are not allowed at certain times. For
2f079f46
PH
283each condition, there's a bitmap of dis-allowed times. For some, it is easier
284to specify the negation of a small number of allowed times. */
059ec3d9
PH
285
286static unsigned int cond_forbids[] = {
287 0, /* acl */
8e669ac1 288
059ec3d9
PH
289 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* authenticated */
290 (1<<ACL_WHERE_HELO),
8e669ac1 291
8523533c 292#ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 293 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
294 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
295 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8e669ac1 296 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
297 (1<<ACL_WHERE_MAILAUTH)|
298 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
299 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA),
300#endif
8e669ac1 301
059ec3d9 302 0, /* condition */
8e669ac1 303
059ec3d9 304 /* Certain types of control are always allowed, so we let it through
2f079f46 305 always and check in the control processing itself. */
8e669ac1 306
059ec3d9 307 0, /* control */
8e669ac1 308
8523533c 309#ifdef WITH_CONTENT_SCAN
2f079f46
PH
310 (unsigned int)
311 ~(1<<ACL_WHERE_MIME), /* decode */
8523533c
TK
312#endif
313
059ec3d9 314 0, /* delay */
8e669ac1 315
f7b63901 316#ifdef WITH_OLD_DEMIME
2f079f46
PH
317 (unsigned int)
318 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* demime */
8523533c 319#endif
8e669ac1 320
fb2274d4 321#ifdef EXPERIMENTAL_DOMAINKEYS
2f079f46 322 (1<<ACL_WHERE_AUTH)| /* dk_domain_source */
fb2274d4
TK
323 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
324 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
325 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
326 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
327 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
328 (1<<ACL_WHERE_VRFY),
84330b7b 329
2f079f46 330 (1<<ACL_WHERE_AUTH)| /* dk_policy */
fb2274d4
TK
331 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
332 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
333 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
334 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
335 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
336 (1<<ACL_WHERE_VRFY),
84330b7b 337
2f079f46 338 (1<<ACL_WHERE_AUTH)| /* dk_sender_domains */
fb2274d4
TK
339 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
340 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
341 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
342 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
343 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
344 (1<<ACL_WHERE_VRFY),
84330b7b 345
2f079f46 346 (1<<ACL_WHERE_AUTH)| /* dk_sender_local_parts */
fb2274d4
TK
347 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
348 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
349 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
350 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
351 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
352 (1<<ACL_WHERE_VRFY),
84330b7b 353
2f079f46 354 (1<<ACL_WHERE_AUTH)| /* dk_senders */
fb2274d4
TK
355 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
356 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
357 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
358 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
359 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
360 (1<<ACL_WHERE_VRFY),
84330b7b 361
2f079f46 362 (1<<ACL_WHERE_AUTH)| /* dk_status */
fb2274d4
TK
363 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
364 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
365 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
366 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
367 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
368 (1<<ACL_WHERE_VRFY),
369#endif
370
059ec3d9
PH
371 (1<<ACL_WHERE_NOTSMTP), /* dnslists */
372
2f079f46
PH
373 (unsigned int)
374 ~(1<<ACL_WHERE_RCPT), /* domains */
059ec3d9
PH
375
376 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* encrypted */
377 (1<<ACL_WHERE_HELO),
8e669ac1 378
059ec3d9 379 0, /* endpass */
8e669ac1 380
059ec3d9
PH
381 (1<<ACL_WHERE_NOTSMTP), /* hosts */
382
2f079f46
PH
383 (unsigned int)
384 ~(1<<ACL_WHERE_RCPT), /* local_parts */
059ec3d9
PH
385
386 0, /* log_message */
8e669ac1 387
059ec3d9 388 0, /* logwrite */
8e669ac1 389
8523533c 390#ifdef WITH_CONTENT_SCAN
2f079f46
PH
391 (unsigned int)
392 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* malware */
8523533c
TK
393#endif
394
059ec3d9
PH
395 0, /* message */
396
8523533c 397#ifdef WITH_CONTENT_SCAN
2f079f46
PH
398 (unsigned int)
399 ~(1<<ACL_WHERE_MIME), /* mime_regex */
8523533c
TK
400#endif
401
870f6ba8
TF
402 0, /* ratelimit */
403
2f079f46
PH
404 (unsigned int)
405 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 406
8523533c 407#ifdef WITH_CONTENT_SCAN
2f079f46
PH
408 (unsigned int)
409 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* regex */
410 (1<<ACL_WHERE_MIME)),
8523533c
TK
411#endif
412
059ec3d9
PH
413 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
414 (1<<ACL_WHERE_HELO)|
415 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
416 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
417 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
418
419 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
420 (1<<ACL_WHERE_HELO)|
421 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
422 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
423 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
424
425 0, /* set */
426
8523533c 427#ifdef WITH_CONTENT_SCAN
2f079f46
PH
428 (unsigned int)
429 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* spam */
8523533c
TK
430#endif
431
432#ifdef EXPERIMENTAL_SPF
433 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
434 (1<<ACL_WHERE_HELO)|
435 (1<<ACL_WHERE_MAILAUTH)|
436 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
437 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
438#endif
439
059ec3d9
PH
440 /* Certain types of verify are always allowed, so we let it through
441 always and check in the verify function itself */
442
443 0 /* verify */
059ec3d9
PH
444};
445
446
c5fcb476
PH
447/* Bit map vector of which controls are not allowed at certain times. For
448each control, there's a bitmap of dis-allowed times. For some, it is easier to
449specify the negation of a small number of allowed times. */
450
451static unsigned int control_forbids[] = {
8523533c
TK
452#ifdef EXPERIMENTAL_BRIGHTMAIL
453 0, /* bmi_run */
454#endif
fb2274d4 455#ifdef EXPERIMENTAL_DOMAINKEYS
e715ad22 456 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), /* dk_verify */
fb2274d4 457#endif
3e11c26b 458
c5fcb476 459 0, /* error */
8e669ac1
PH
460
461 (unsigned int)
c5fcb476 462 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
463
464 (unsigned int)
c5fcb476 465 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 466
c5fcb476 467 (1<<ACL_WHERE_NOTSMTP), /* enforce_sync */
8e669ac1 468
c5fcb476 469 (1<<ACL_WHERE_NOTSMTP), /* no_enforce_sync */
8e669ac1
PH
470
471 (unsigned int)
c5fcb476
PH
472 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
473 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 474 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
475
476 (unsigned int)
c5fcb476
PH
477 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
478 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 479 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
480
481 (unsigned int)
c5fcb476 482 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 483 (1<<ACL_WHERE_PREDATA)),
8523533c
TK
484
485#ifdef WITH_CONTENT_SCAN
8e669ac1 486 (unsigned int)
14d57970 487 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22
TK
488 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
489 (1<<ACL_WHERE_MIME)),
8523533c 490#endif
a6c4ab60 491
8e669ac1 492 (unsigned int)
29aba418
TF
493 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
494 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
495 (1<<ACL_WHERE_MIME)),
496
497 (unsigned int)
a6c4ab60 498 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22
TK
499 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
500 (1<<ACL_WHERE_MIME)),
8523533c 501
c5fcb476
PH
502 (1<<ACL_WHERE_NOTSMTP) /* no_multiline */
503};
504
505/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
506
507typedef struct control_def {
508 uschar *name;
509 int value; /* CONTROL_xxx value */
059ec3d9
PH
510 BOOL has_option; /* Has /option(s) following */
511} control_def;
512
513static control_def controls_list[] = {
8523533c
TK
514#ifdef EXPERIMENTAL_BRIGHTMAIL
515 { US"bmi_run", CONTROL_BMI_RUN, FALSE},
516#endif
fb2274d4
TK
517#ifdef EXPERIMENTAL_DOMAINKEYS
518 { US"dk_verify", CONTROL_DK_VERIFY, FALSE},
519#endif
c5fcb476
PH
520 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE},
521 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE},
522 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE},
523 { US"freeze", CONTROL_FREEZE, FALSE},
524 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE},
525 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE},
526 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE},
8523533c
TK
527#ifdef WITH_CONTENT_SCAN
528 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE},
8523533c 529#endif
29aba418 530 { US"fakedefer", CONTROL_FAKEDEFER, TRUE},
0f9b0483 531 { US"fakereject", CONTROL_FAKEREJECT, TRUE},
c5fcb476 532 { US"submission", CONTROL_SUBMISSION, TRUE}
059ec3d9
PH
533 };
534
e5a9dba6
PH
535/* Support data structures for Client SMTP Authorization. acl_verify_csa()
536caches its result in a tree to avoid repeated DNS queries. The result is an
537integer code which is used as an index into the following tables of
538explanatory strings and verification return codes. */
539
540static tree_node *csa_cache = NULL;
541
542enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
543 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
544
545/* The acl_verify_csa() return code is translated into an acl_verify() return
546code using the following table. It is OK unless the client is definitely not
547authorized. This is because CSA is supposed to be optional for sending sites,
548so recipients should not be too strict about checking it - especially because
549DNS problems are quite likely to occur. It's possible to use $csa_status in
550further ACL conditions to distinguish ok, unknown, and defer if required, but
551the aim is to make the usual configuration simple. */
552
553static int csa_return_code[] = {
554 OK, OK, OK, OK,
555 FAIL, FAIL, FAIL, FAIL
556};
557
558static uschar *csa_status_string[] = {
559 US"unknown", US"ok", US"defer", US"defer",
560 US"fail", US"fail", US"fail", US"fail"
561};
562
563static uschar *csa_reason_string[] = {
564 US"unknown",
565 US"ok",
566 US"deferred (SRV lookup failed)",
567 US"deferred (target address lookup failed)",
568 US"failed (explicit authorization required)",
569 US"failed (host name not authorized)",
570 US"failed (no authorized addresses)",
571 US"failed (client address mismatch)"
572};
573
059ec3d9
PH
574/* Enable recursion between acl_check_internal() and acl_check_condition() */
575
576static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
577 uschar **);
578
579
580/*************************************************
581* Pick out name from list *
582*************************************************/
583
584/* Use a binary chop method
585
586Arguments:
587 name name to find
588 list list of names
589 end size of list
590
591Returns: offset in list, or -1 if not found
592*/
593
594static int
595acl_checkname(uschar *name, uschar **list, int end)
596{
597int start = 0;
598
599while (start < end)
600 {
601 int mid = (start + end)/2;
602 int c = Ustrcmp(name, list[mid]);
603 if (c == 0) return mid;
604 if (c < 0) end = mid; else start = mid + 1;
605 }
606
607return -1;
608}
609
610
611/*************************************************
612* Read and parse one ACL *
613*************************************************/
614
615/* This function is called both from readconf in order to parse the ACLs in the
616configuration file, and also when an ACL is encountered dynamically (e.g. as
617the result of an expansion). It is given a function to call in order to
618retrieve the lines of the ACL. This function handles skipping comments and
619blank lines (where relevant).
620
621Arguments:
622 func function to get next line of ACL
623 error where to put an error message
624
625Returns: pointer to ACL, or NULL
626 NULL can be legal (empty ACL); in this case error will be NULL
627*/
628
629acl_block *
630acl_read(uschar *(*func)(void), uschar **error)
631{
632acl_block *yield = NULL;
633acl_block **lastp = &yield;
634acl_block *this = NULL;
635acl_condition_block *cond;
636acl_condition_block **condp = NULL;
637uschar *s;
638
639*error = NULL;
640
641while ((s = (*func)()) != NULL)
642 {
643 int v, c;
644 BOOL negated = FALSE;
645 uschar *saveline = s;
646 uschar name[64];
647
648 /* Conditions (but not verbs) are allowed to be negated by an initial
649 exclamation mark. */
650
651 while (isspace(*s)) s++;
652 if (*s == '!')
653 {
654 negated = TRUE;
655 s++;
656 }
657
cf00dad6
PH
658 /* Read the name of a verb or a condition, or the start of a new ACL, which
659 can be started by a name, or by a macro definition. */
059ec3d9
PH
660
661 s = readconf_readname(name, sizeof(name), s);
cf00dad6 662 if (*s == ':' || isupper(name[0] && *s == '=')) return yield;
059ec3d9
PH
663
664 /* If a verb is unrecognized, it may be another condition or modifier that
665 continues the previous verb. */
666
667 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
668 if (v < 0)
669 {
670 if (this == NULL)
671 {
672 *error = string_sprintf("unknown ACL verb in \"%s\"", saveline);
673 return NULL;
674 }
675 }
676
677 /* New verb */
678
679 else
680 {
681 if (negated)
682 {
683 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
684 return NULL;
685 }
686 this = store_get(sizeof(acl_block));
687 *lastp = this;
688 lastp = &(this->next);
689 this->next = NULL;
690 this->verb = v;
691 this->condition = NULL;
692 condp = &(this->condition);
693 if (*s == 0) continue; /* No condition on this line */
694 if (*s == '!')
695 {
696 negated = TRUE;
697 s++;
698 }
699 s = readconf_readname(name, sizeof(name), s); /* Condition name */
700 }
701
702 /* Handle a condition or modifier. */
703
704 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
705 if (c < 0)
706 {
707 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
708 saveline);
709 return NULL;
710 }
711
712 /* The modifiers may not be negated */
713
714 if (negated && cond_modifiers[c])
715 {
716 *error = string_sprintf("ACL error: negation is not allowed with "
717 "\"%s\"", conditions[c]);
718 return NULL;
719 }
720
721 /* ENDPASS may occur only with ACCEPT or DISCARD. */
722
723 if (c == ACLC_ENDPASS &&
724 this->verb != ACL_ACCEPT &&
725 this->verb != ACL_DISCARD)
726 {
727 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
728 conditions[c], verbs[this->verb]);
729 return NULL;
730 }
731
732 cond = store_get(sizeof(acl_condition_block));
733 cond->next = NULL;
734 cond->type = c;
735 cond->u.negated = negated;
736
737 *condp = cond;
738 condp = &(cond->next);
739
740 /* The "set" modifier is different in that its argument is "name=value"
741 rather than just a value, and we can check the validity of the name, which
742 gives us a variable number to insert into the data block. */
743
744 if (c == ACLC_SET)
745 {
746 if (Ustrncmp(s, "acl_", 4) != 0 || (s[4] != 'c' && s[4] != 'm') ||
747 !isdigit(s[5]) || (!isspace(s[6]) && s[6] != '='))
748 {
749 *error = string_sprintf("unrecognized name after \"set\" in ACL "
750 "modifier \"set %s\"", s);
751 return NULL;
752 }
753
754 cond->u.varnumber = s[5] - '0';
755 if (s[4] == 'm') cond->u.varnumber += ACL_C_MAX;
756 s += 6;
757 while (isspace(*s)) s++;
758 }
759
760 /* For "set", we are now positioned for the data. For the others, only
761 "endpass" has no data */
762
763 if (c != ACLC_ENDPASS)
764 {
765 if (*s++ != '=')
766 {
767 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
768 cond_modifiers[c]? US"modifier" : US"condition");
769 return NULL;
770 }
771 while (isspace(*s)) s++;
772 cond->arg = string_copy(s);
773 }
774 }
775
776return yield;
777}
778
779
780
781/*************************************************
782* Handle warnings *
783*************************************************/
784
785/* This function is called when a WARN verb's conditions are true. It adds to
786the message's headers, and/or writes information to the log. In each case, this
787only happens once (per message for headers, per connection for log).
788
789Arguments:
790 where ACL_WHERE_xxxx indicating which ACL this is
791 user_message message for adding to headers
792 log_message message for logging, if different
793
794Returns: nothing
795*/
796
797static void
798acl_warn(int where, uschar *user_message, uschar *log_message)
799{
800int hlen;
801
802if (log_message != NULL && log_message != user_message)
803 {
804 uschar *text;
805 string_item *logged;
806
807 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
808 string_printing(log_message));
809
810 /* If a sender verification has failed, and the log message is "sender verify
811 failed", add the failure message. */
812
813 if (sender_verified_failed != NULL &&
814 sender_verified_failed->message != NULL &&
815 strcmpic(log_message, US"sender verify failed") == 0)
816 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
817
9c7a242c
PH
818 /* Search previously logged warnings. They are kept in malloc
819 store so they can be freed at the start of a new message. */
059ec3d9
PH
820
821 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
822 if (Ustrcmp(logged->text, text) == 0) break;
823
824 if (logged == NULL)
825 {
826 int length = Ustrlen(text) + 1;
827 log_write(0, LOG_MAIN, "%s", text);
828 logged = store_malloc(sizeof(string_item) + length);
829 logged->text = (uschar *)logged + sizeof(string_item);
830 memcpy(logged->text, text, length);
831 logged->next = acl_warn_logged;
832 acl_warn_logged = logged;
833 }
834 }
835
836/* If there's no user message, we are done. */
837
838if (user_message == NULL) return;
839
840/* If this isn't a message ACL, we can't do anything with a user message.
841Log an error. */
842
843if (where > ACL_WHERE_NOTSMTP)
844 {
845 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
846 "found in a non-message (%s) ACL: cannot specify header lines here: "
847 "message ignored", acl_wherenames[where]);
848 return;
849 }
850
851/* Treat the user message as a sequence of one or more header lines. */
852
853hlen = Ustrlen(user_message);
854if (hlen > 0)
855 {
856 uschar *text, *p, *q;
857
858 /* Add a final newline if not present */
859
860 text = ((user_message)[hlen-1] == '\n')? user_message :
861 string_sprintf("%s\n", user_message);
862
863 /* Loop for multiple header lines, taking care about continuations */
864
865 for (p = q = text; *p != 0; )
866 {
867 uschar *s;
868 int newtype = htype_add_bot;
869 header_line **hptr = &acl_warn_headers;
870
871 /* Find next header line within the string */
872
873 for (;;)
874 {
875 q = Ustrchr(q, '\n');
876 if (*(++q) != ' ' && *q != '\t') break;
877 }
878
879 /* If the line starts with a colon, interpret the instruction for where to
880 add it. This temporarily sets up a new type. */
881
882 if (*p == ':')
883 {
884 if (strncmpic(p, US":after_received:", 16) == 0)
885 {
886 newtype = htype_add_rec;
887 p += 16;
888 }
8523533c
TK
889 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
890 {
891 newtype = htype_add_rfc;
892 p += 14;
8e669ac1 893 }
059ec3d9
PH
894 else if (strncmpic(p, US":at_start:", 10) == 0)
895 {
896 newtype = htype_add_top;
897 p += 10;
898 }
899 else if (strncmpic(p, US":at_end:", 8) == 0)
900 {
901 newtype = htype_add_bot;
902 p += 8;
903 }
904 while (*p == ' ' || *p == '\t') p++;
905 }
906
907 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
908 to the front of it. */
909
910 for (s = p; s < q - 1; s++)
911 {
912 if (*s == ':' || !isgraph(*s)) break;
913 }
914
915 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
916 hlen = Ustrlen(s);
917
918 /* See if this line has already been added */
919
920 while (*hptr != NULL)
921 {
922 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
923 hptr = &((*hptr)->next);
924 }
925
926 /* Add if not previously present */
927
928 if (*hptr == NULL)
929 {
930 header_line *h = store_get(sizeof(header_line));
931 h->text = s;
932 h->next = NULL;
933 h->type = newtype;
934 h->slen = hlen;
935 *hptr = h;
936 hptr = &(h->next);
937 }
938
939 /* Advance for next header line within the string */
940
941 p = q;
942 }
943 }
944}
945
946
947
948/*************************************************
949* Verify and check reverse DNS *
950*************************************************/
951
952/* Called from acl_verify() below. We look up the host name(s) of the client IP
953address if this has not yet been done. The host_name_lookup() function checks
954that one of these names resolves to an address list that contains the client IP
955address, so we don't actually have to do the check here.
956
957Arguments:
958 user_msgptr pointer for user message
959 log_msgptr pointer for log message
960
961Returns: OK verification condition succeeded
962 FAIL verification failed
963 DEFER there was a problem verifying
964*/
965
966static int
967acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
968{
969int rc;
970
971user_msgptr = user_msgptr; /* stop compiler warning */
972
973/* Previous success */
974
975if (sender_host_name != NULL) return OK;
976
977/* Previous failure */
978
979if (host_lookup_failed)
980 {
981 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
982 return FAIL;
983 }
984
985/* Need to do a lookup */
986
987HDEBUG(D_acl)
988 debug_printf("looking up host name to force name/address consistency check\n");
989
990if ((rc = host_name_lookup()) != OK)
991 {
992 *log_msgptr = (rc == DEFER)?
993 US"host lookup deferred for reverse lookup check"
994 :
995 string_sprintf("host lookup failed for reverse lookup check%s",
996 host_lookup_msg);
997 return rc; /* DEFER or FAIL */
998 }
999
1000host_build_sender_fullhost();
1001return OK;
1002}
1003
1004
1005
1006/*************************************************
e5a9dba6
PH
1007* Check client IP address matches CSA target *
1008*************************************************/
1009
1010/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1011response for address records belonging to the CSA target hostname. The section
1012is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1013If one of the addresses matches the client's IP address, then the client is
1014authorized by CSA. If there are target IP addresses but none of them match
1015then the client is using an unauthorized IP address. If there are no target IP
1016addresses then the client cannot be using an authorized IP address. (This is
1017an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1018
1019Arguments:
1020 dnsa the DNS answer block
1021 dnss a DNS scan block for us to use
1022 reset option specifing what portion to scan, as described above
1023 target the target hostname to use for matching RR names
1024
1025Returns: CSA_OK successfully authorized
1026 CSA_FAIL_MISMATCH addresses found but none matched
1027 CSA_FAIL_NOADDR no target addresses found
1028*/
1029
1030static int
1031acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1032 uschar *target)
1033{
1034dns_record *rr;
1035dns_address *da;
1036
1037BOOL target_found = FALSE;
1038
1039for (rr = dns_next_rr(dnsa, dnss, reset);
1040 rr != NULL;
1041 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1042 {
1043 /* Check this is an address RR for the target hostname. */
1044
1045 if (rr->type != T_A
1046 #if HAVE_IPV6
1047 && rr->type != T_AAAA
1048 #ifdef SUPPORT_A6
1049 && rr->type != T_A6
1050 #endif
1051 #endif
1052 ) continue;
1053
1054 if (strcmpic(target, rr->name) != 0) continue;
1055
1056 target_found = TRUE;
1057
1058 /* Turn the target address RR into a list of textual IP addresses and scan
1059 the list. There may be more than one if it is an A6 RR. */
1060
1061 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1062 {
1063 /* If the client IP address matches the target IP address, it's good! */
1064
1065 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1066
1067 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1068 }
1069 }
1070
1071/* If we found some target addresses but none of them matched, the client is
1072using an unauthorized IP address, otherwise the target has no authorized IP
1073addresses. */
1074
1075if (target_found) return CSA_FAIL_MISMATCH;
1076else return CSA_FAIL_NOADDR;
1077}
1078
1079
1080
1081/*************************************************
1082* Verify Client SMTP Authorization *
1083*************************************************/
1084
1085/* Called from acl_verify() below. This routine calls dns_lookup_special()
1086to find the CSA SRV record corresponding to the domain argument, or
1087$sender_helo_name if no argument is provided. It then checks that the
1088client is authorized, and that its IP address corresponds to the SRV
1089target's address by calling acl_verify_csa_address() above. The address
1090should have been returned in the DNS response's ADDITIONAL section, but if
1091not we perform another DNS lookup to get it.
1092
1093Arguments:
1094 domain pointer to optional parameter following verify = csa
1095
1096Returns: CSA_UNKNOWN no valid CSA record found
1097 CSA_OK successfully authorized
1098 CSA_FAIL_* client is definitely not authorized
1099 CSA_DEFER_* there was a DNS problem
1100*/
1101
1102static int
1103acl_verify_csa(uschar *domain)
1104{
1105tree_node *t;
1106uschar *found, *p;
1107int priority, weight, port;
1108dns_answer dnsa;
1109dns_scan dnss;
1110dns_record *rr;
1111int rc, type;
1112uschar target[256];
1113
1114/* Work out the domain we are using for the CSA lookup. The default is the
1115client's HELO domain. If the client has not said HELO, use its IP address
1116instead. If it's a local client (exim -bs), CSA isn't applicable. */
1117
1118while (isspace(*domain) && *domain != '\0') ++domain;
1119if (*domain == '\0') domain = sender_helo_name;
1120if (domain == NULL) domain = sender_host_address;
1121if (sender_host_address == NULL) return CSA_UNKNOWN;
1122
1123/* If we have an address literal, strip off the framing ready for turning it
1124into a domain. The framing consists of matched square brackets possibly
1125containing a keyword and a colon before the actual IP address. */
1126
1127if (domain[0] == '[')
1128 {
1129 uschar *start = Ustrchr(domain, ':');
1130 if (start == NULL) start = domain;
1131 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1132 }
1133
1134/* Turn domains that look like bare IP addresses into domains in the reverse
1135DNS. This code also deals with address literals and $sender_host_address. It's
1136not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1137address literals, but it's probably the most friendly thing to do. This is an
1138extension to CSA, so we allow it to be turned off for proper conformance. */
1139
1140if (string_is_ip_address(domain, NULL))
1141 {
1142 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1143 dns_build_reverse(domain, target);
1144 domain = target;
1145 }
1146
1147/* Find out if we've already done the CSA check for this domain. If we have,
1148return the same result again. Otherwise build a new cached result structure
1149for this domain. The name is filled in now, and the value is filled in when
1150we return from this function. */
1151
1152t = tree_search(csa_cache, domain);
1153if (t != NULL) return t->data.val;
1154
1155t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1156Ustrcpy(t->name, domain);
1157(void)tree_insertnode(&csa_cache, t);
1158
1159/* Now we are ready to do the actual DNS lookup(s). */
1160
28e6ef29 1161found = domain;
e5a9dba6
PH
1162switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1163 {
1164 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1165
1166 default:
1167 return t->data.val = CSA_DEFER_SRV;
1168
1169 /* If we found nothing, the client's authorization is unknown. */
1170
1171 case DNS_NOMATCH:
1172 case DNS_NODATA:
1173 return t->data.val = CSA_UNKNOWN;
1174
1175 /* We got something! Go on to look at the reply in more detail. */
1176
1177 case DNS_SUCCEED:
1178 break;
1179 }
1180
1181/* Scan the reply for well-formed CSA SRV records. */
1182
1183for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1184 rr != NULL;
1185 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1186 {
1187 if (rr->type != T_SRV) continue;
1188
1189 /* Extract the numerical SRV fields (p is incremented) */
1190
1191 p = rr->data;
1192 GETSHORT(priority, p);
1193 GETSHORT(weight, p);
1194 GETSHORT(port, p);
1195
1196 DEBUG(D_acl)
1197 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1198
1199 /* Check the CSA version number */
1200
1201 if (priority != 1) continue;
1202
1203 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1204 found by dns_special_lookup() is a parent of the one we asked for), we check
1205 the subdomain assertions in the port field. At the moment there's only one
1206 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1207 SRV records of their own. */
1208
1209 if (found != domain)
1210 {
1211 if (port & 1)
1212 return t->data.val = CSA_FAIL_EXPLICIT;
1213 else
1214 return t->data.val = CSA_UNKNOWN;
1215 }
1216
1217 /* This CSA SRV record refers directly to our domain, so we check the value
1218 in the weight field to work out the domain's authorization. 0 and 1 are
1219 unauthorized; 3 means the client is authorized but we can't check the IP
1220 address in order to authenticate it, so we treat it as unknown; values
1221 greater than 3 are undefined. */
1222
1223 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1224
1225 if (weight > 2) continue;
1226
1227 /* Weight == 2, which means the domain is authorized. We must check that the
1228 client's IP address is listed as one of the SRV target addresses. Save the
1229 target hostname then break to scan the additional data for its addresses. */
1230
1231 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1232 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1233
1234 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1235
1236 break;
1237 }
1238
1239/* If we didn't break the loop then no appropriate records were found. */
1240
1241if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1242
1243/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1244A target of "." indicates there are no valid addresses, so the client cannot
1245be authorized. (This is an odd configuration because weight=2 target=. is
1246equivalent to weight=1, but we check for it in order to keep load off the
1247root name servers.) Note that dn_expand() turns "." into "". */
1248
1249if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1250
1251/* Scan the additional section of the CSA SRV reply for addresses belonging
1252to the target. If the name server didn't return any additional data (e.g.
1253because it does not fully support SRV records), we need to do another lookup
1254to obtain the target addresses; otherwise we have a definitive result. */
1255
1256rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1257if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1258
1259/* The DNS lookup type corresponds to the IP version used by the client. */
1260
1261#if HAVE_IPV6
1262if (Ustrchr(sender_host_address, ':') != NULL)
1263 type = T_AAAA;
1264else
1265#endif /* HAVE_IPV6 */
1266 type = T_A;
1267
1268
1269#if HAVE_IPV6 && defined(SUPPORT_A6)
1270DNS_LOOKUP_AGAIN:
1271#endif
1272
1273switch (dns_lookup(&dnsa, target, type, NULL))
1274 {
1275 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1276
1277 default:
1278 return t->data.val = CSA_DEFER_ADDR;
1279
1280 /* If the query succeeded, scan the addresses and return the result. */
1281
1282 case DNS_SUCCEED:
1283 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1284 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1285 /* else fall through */
1286
1287 /* If the target has no IP addresses, the client cannot have an authorized
1288 IP address. However, if the target site uses A6 records (not AAAA records)
1289 we have to do yet another lookup in order to check them. */
1290
1291 case DNS_NOMATCH:
1292 case DNS_NODATA:
1293
1294 #if HAVE_IPV6 && defined(SUPPORT_A6)
1295 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1296 #endif
1297
1298 return t->data.val = CSA_FAIL_NOADDR;
1299 }
1300}
1301
1302
1303
1304/*************************************************
059ec3d9
PH
1305* Handle verification (address & other) *
1306*************************************************/
1307
1308/* This function implements the "verify" condition. It is called when
1309encountered in any ACL, because some tests are almost always permitted. Some
1310just don't make sense, and always fail (for example, an attempt to test a host
1311lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1312
1313Arguments:
1314 where where called from
1315 addr the recipient address that the ACL is handling, or NULL
1316 arg the argument of "verify"
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319 basic_errno where to put verify errno
1320
1321Returns: OK verification condition succeeded
1322 FAIL verification failed
1323 DEFER there was a problem verifying
1324 ERROR syntax error
1325*/
1326
1327static int
1328acl_verify(int where, address_item *addr, uschar *arg,
1329 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1330{
1331int sep = '/';
1332int callout = -1;
1333int callout_overall = -1;
4deaf07d 1334int callout_connect = -1;
059ec3d9
PH
1335int verify_options = 0;
1336int rc;
1337BOOL verify_header_sender = FALSE;
1338BOOL defer_ok = FALSE;
1339BOOL callout_defer_ok = FALSE;
1340BOOL no_details = FALSE;
eafd343b 1341BOOL success_on_redirect = FALSE;
059ec3d9
PH
1342address_item *sender_vaddr = NULL;
1343uschar *verify_sender_address = NULL;
1344uschar *pm_mailfrom = NULL;
1345uschar *se_mailfrom = NULL;
596875b3
PH
1346
1347/* Some of the verify items have slash-separated options; some do not. Diagnose
1348an error if options are given for items that don't expect them. This code has
1349now got very message. Refactoring to use a table would be a good idea one day.
1350*/
1351
1352uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH
1353uschar *list = arg;
1354uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1355
1356if (ss == NULL) goto BAD_VERIFY;
1357
1358/* Handle name/address consistency verification in a separate function. */
1359
1360if (strcmpic(ss, US"reverse_host_lookup") == 0)
1361 {
596875b3 1362 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1363 if (sender_host_address == NULL) return OK;
1364 return acl_verify_reverse(user_msgptr, log_msgptr);
1365 }
1366
1367/* TLS certificate verification is done at STARTTLS time; here we just
1368test whether it was successful or not. (This is for optional verification; for
1369mandatory verification, the connection doesn't last this long.) */
1370
1371if (strcmpic(ss, US"certificate") == 0)
1372 {
596875b3 1373 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1374 if (tls_certificate_verified) return OK;
1375 *user_msgptr = US"no verified certificate";
1376 return FAIL;
1377 }
1378
d7b47fd0
PH
1379/* We can test the result of optional HELO verification that might have
1380occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1381
596875b3
PH
1382if (strcmpic(ss, US"helo") == 0)
1383 {
1384 if (slash != NULL) goto NO_OPTIONS;
d7b47fd0
PH
1385 if (helo_verified) return OK;
1386 if (helo_verify_failed) return FAIL;
1387 if (smtp_verify_helo()) return helo_verified? OK : FAIL;
1388 return DEFER;
596875b3 1389 }
059ec3d9 1390
e5a9dba6
PH
1391/* Do Client SMTP Authorization checks in a separate function, and turn the
1392result code into user-friendly strings. */
1393
1394if (strcmpic(ss, US"csa") == 0)
1395 {
1396 rc = acl_verify_csa(list);
1397 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1398 csa_reason_string[rc]);
1399 csa_status = csa_status_string[rc];
1400 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1401 return csa_return_code[rc];
1402 }
1403
596875b3
PH
1404/* Check that all relevant header lines have the correct syntax. If there is
1405a syntax error, we return details of the error to the sender if configured to
1406send out full details. (But a "message" setting on the ACL can override, as
1407always). */
059ec3d9 1408
596875b3 1409if (strcmpic(ss, US"header_syntax") == 0)
059ec3d9 1410 {
596875b3 1411 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1412 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP)
1413 {
1414 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
1415 "(only possible in ACL for DATA)", acl_wherenames[where]);
1416 return ERROR;
1417 }
596875b3
PH
1418 rc = verify_check_headers(log_msgptr);
1419 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1420 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1421 return rc;
1422 }
059ec3d9 1423
059ec3d9 1424
596875b3
PH
1425/* The remaining verification tests check recipient and sender addresses,
1426either from the envelope or from the header. There are a number of
1427slash-separated options that are common to all of them. */
059ec3d9 1428
059ec3d9 1429
596875b3
PH
1430/* Check that there is at least one verifiable sender address in the relevant
1431header lines. This can be followed by callout and defer options, just like
1432sender and recipient. */
059ec3d9 1433
596875b3
PH
1434if (strcmpic(ss, US"header_sender") == 0)
1435 {
1436 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP)
1437 {
1438 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
1439 "(only possible in ACL for DATA)", acl_wherenames[where]);
1440 return ERROR;
1441 }
1442 verify_header_sender = TRUE;
059ec3d9
PH
1443 }
1444
1445/* Otherwise, first item in verify argument must be "sender" or "recipient".
1446In the case of a sender, this can optionally be followed by an address to use
1447in place of the actual sender (rare special-case requirement). */
1448
1449else if (strncmpic(ss, US"sender", 6) == 0)
1450 {
1451 uschar *s = ss + 6;
1452 if (where > ACL_WHERE_NOTSMTP)
1453 {
1454 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1455 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1456 acl_wherenames[where]);
1457 return ERROR;
1458 }
1459 if (*s == 0)
1460 verify_sender_address = sender_address;
1461 else
1462 {
1463 while (isspace(*s)) s++;
1464 if (*s++ != '=') goto BAD_VERIFY;
1465 while (isspace(*s)) s++;
1466 verify_sender_address = string_copy(s);
1467 }
1468 }
1469else
1470 {
1471 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1472 if (addr == NULL)
1473 {
1474 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1475 "(only possible for RCPT)", acl_wherenames[where]);
1476 return ERROR;
1477 }
1478 }
1479
596875b3
PH
1480/* Remaining items are optional; they apply to sender and recipient
1481verification, including "header sender" verification. */
059ec3d9
PH
1482
1483while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1484 != NULL)
1485 {
1486 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1487 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1488 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1489
1490 /* These two old options are left for backwards compatibility */
1491
1492 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1493 {
1494 callout_defer_ok = TRUE;
1495 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1496 }
1497
1498 else if (strcmpic(ss, US"check_postmaster") == 0)
1499 {
1500 pm_mailfrom = US"";
1501 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1502 }
1503
1504 /* The callout option has a number of sub-options, comma separated */
1505
1506 else if (strncmpic(ss, US"callout", 7) == 0)
1507 {
1508 callout = CALLOUT_TIMEOUT_DEFAULT;
1509 ss += 7;
1510 if (*ss != 0)
1511 {
1512 while (isspace(*ss)) ss++;
1513 if (*ss++ == '=')
1514 {
1515 int optsep = ',';
1516 uschar *opt;
1517 uschar buffer[256];
1518 while (isspace(*ss)) ss++;
8e669ac1
PH
1519
1520 /* This callout option handling code has become a mess as new options
1521 have been added in an ad hoc manner. It should be tidied up into some
4deaf07d 1522 kind of table-driven thing. */
8e669ac1 1523
059ec3d9
PH
1524 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1525 != NULL)
1526 {
1527 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1528 else if (strcmpic(opt, US"no_cache") == 0)
1529 verify_options |= vopt_callout_no_cache;
1530 else if (strcmpic(opt, US"random") == 0)
1531 verify_options |= vopt_callout_random;
1532 else if (strcmpic(opt, US"use_sender") == 0)
1533 verify_options |= vopt_callout_recipsender;
1534 else if (strcmpic(opt, US"use_postmaster") == 0)
1535 verify_options |= vopt_callout_recippmaster;
1536 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
2a4be8f9
PH
1537 else if (strcmpic(opt, US"fullpostmaster") == 0)
1538 {
1539 pm_mailfrom = US"";
1540 verify_options |= vopt_callout_fullpm;
1541 }
059ec3d9
PH
1542
1543 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1544 {
1545 if (!verify_header_sender)
1546 {
1547 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1548 "callout option only for verify=header_sender (detected in ACL "
1549 "condition \"%s\")", arg);
1550 return ERROR;
1551 }
1552 opt += 8;
1553 while (isspace(*opt)) opt++;
1554 if (*opt++ != '=')
1555 {
1556 *log_msgptr = string_sprintf("'=' expected after "
1557 "\"mailfrom\" in ACL condition \"%s\"", arg);
1558 return ERROR;
1559 }
1560 while (isspace(*opt)) opt++;
1561 se_mailfrom = string_copy(opt);
1562 }
1563
1564 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1565 {
1566 opt += 19;
1567 while (isspace(*opt)) opt++;
1568 if (*opt++ != '=')
1569 {
1570 *log_msgptr = string_sprintf("'=' expected after "
1571 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1572 return ERROR;
1573 }
1574 while (isspace(*opt)) opt++;
1575 pm_mailfrom = string_copy(opt);
1576 }
1577
1578 else if (strncmpic(opt, US"maxwait", 7) == 0)
1579 {
1580 opt += 7;
1581 while (isspace(*opt)) opt++;
1582 if (*opt++ != '=')
1583 {
1584 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1585 "ACL condition \"%s\"", arg);
1586 return ERROR;
1587 }
1588 while (isspace(*opt)) opt++;
1589 callout_overall = readconf_readtime(opt, 0, FALSE);
1590 if (callout_overall < 0)
1591 {
1592 *log_msgptr = string_sprintf("bad time value in ACL condition "
1593 "\"verify %s\"", arg);
1594 return ERROR;
1595 }
1596 }
4deaf07d
PH
1597 else if (strncmpic(opt, US"connect", 7) == 0)
1598 {
1599 opt += 7;
1600 while (isspace(*opt)) opt++;
1601 if (*opt++ != '=')
1602 {
1603 *log_msgptr = string_sprintf("'=' expected after "
1604 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1605 return ERROR;
1606 }
1607 while (isspace(*opt)) opt++;
1608 callout_connect = readconf_readtime(opt, 0, FALSE);
1609 if (callout_connect < 0)
1610 {
1611 *log_msgptr = string_sprintf("bad time value in ACL condition "
1612 "\"verify %s\"", arg);
1613 return ERROR;
1614 }
1615 }
059ec3d9
PH
1616 else /* Plain time is callout connect/command timeout */
1617 {
1618 callout = readconf_readtime(opt, 0, FALSE);
1619 if (callout < 0)
1620 {
1621 *log_msgptr = string_sprintf("bad time value in ACL condition "
1622 "\"verify %s\"", arg);
1623 return ERROR;
1624 }
1625 }
1626 }
1627 }
1628 else
1629 {
1630 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1631 "ACL condition \"%s\"", arg);
1632 return ERROR;
1633 }
1634 }
1635 }
1636
1637 /* Option not recognized */
1638
1639 else
1640 {
1641 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1642 "condition \"verify %s\"", ss, arg);
1643 return ERROR;
1644 }
1645 }
1646
1647if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1648 (vopt_callout_recipsender|vopt_callout_recippmaster))
1649 {
1650 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1651 "for a recipient callout";
1652 return ERROR;
1653 }
1654
1655/* Handle sender-in-header verification. Default the user message to the log
1656message if giving out verification details. */
1657
1658if (verify_header_sender)
1659 {
8e669ac1 1660 int verrno;
059ec3d9 1661 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
1662 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1663 &verrno);
1664 if (rc != OK)
8e669ac1 1665 {
fe5b5d0b
PH
1666 *basic_errno = verrno;
1667 if (smtp_return_error_details)
1668 {
1669 if (*user_msgptr == NULL && *log_msgptr != NULL)
1670 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1671 if (rc == DEFER) acl_temp_details = TRUE;
1672 }
8e669ac1 1673 }
059ec3d9
PH
1674 }
1675
1676/* Handle a sender address. The default is to verify *the* sender address, but
1677optionally a different address can be given, for special requirements. If the
1678address is empty, we are dealing with a bounce message that has no sender, so
1679we cannot do any checking. If the real sender address gets rewritten during
1680verification (e.g. DNS widening), set the flag to stop it being rewritten again
1681during message reception.
1682
1683A list of verified "sender" addresses is kept to try to avoid doing to much
1684work repetitively when there are multiple recipients in a message and they all
1685require sender verification. However, when callouts are involved, it gets too
1686complicated because different recipients may require different callout options.
1687Therefore, we always do a full sender verify when any kind of callout is
1688specified. Caching elsewhere, for instance in the DNS resolver and in the
1689callout handling, should ensure that this is not terribly inefficient. */
1690
1691else if (verify_sender_address != NULL)
1692 {
1693 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1694 != 0)
1695 {
1696 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1697 "sender verify callout";
1698 return ERROR;
1699 }
1700
1701 sender_vaddr = verify_checked_sender(verify_sender_address);
1702 if (sender_vaddr != NULL && /* Previously checked */
1703 callout <= 0) /* No callout needed this time */
1704 {
1705 /* If the "routed" flag is set, it means that routing worked before, so
1706 this check can give OK (the saved return code value, if set, belongs to a
1707 callout that was done previously). If the "routed" flag is not set, routing
1708 must have failed, so we use the saved return code. */
1709
1710 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1711 {
1712 rc = sender_vaddr->special_action;
1713 *basic_errno = sender_vaddr->basic_errno;
1714 }
1715 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1716 }
1717
1718 /* Do a new verification, and cache the result. The cache is used to avoid
1719 verifying the sender multiple times for multiple RCPTs when callouts are not
1720 specified (see comments above).
1721
1722 The cache is also used on failure to give details in response to the first
1723 RCPT that gets bounced for this reason. However, this can be suppressed by
1724 the no_details option, which sets the flag that says "this detail has already
1725 been sent". The cache normally contains just one address, but there may be
1726 more in esoteric circumstances. */
1727
1728 else
1729 {
1730 BOOL routed = TRUE;
2a3eea10 1731 uschar *save_address_data = deliver_address_data;
8e669ac1 1732
059ec3d9
PH
1733 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1734 if (no_details) setflag(sender_vaddr, af_sverify_told);
1735 if (verify_sender_address[0] != 0)
1736 {
1737 /* If this is the real sender address, save the unrewritten version
1738 for use later in receive. Otherwise, set a flag so that rewriting the
1739 sender in verify_address() does not update sender_address. */
1740
1741 if (verify_sender_address == sender_address)
1742 sender_address_unrewritten = sender_address;
1743 else
1744 verify_options |= vopt_fake_sender;
1745
eafd343b
TK
1746 if (success_on_redirect)
1747 verify_options |= vopt_success_on_redirect;
1748
059ec3d9
PH
1749 /* The recipient, qualify, and expn options are never set in
1750 verify_options. */
1751
1752 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1753 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
1754
1755 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1756
1757 if (rc == OK)
1758 {
1759 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1760 {
1761 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1762 verify_sender_address, sender_vaddr->address);
1763 }
1764 else
1765 {
1766 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1767 verify_sender_address);
1768 }
1769 }
1770 else *basic_errno = sender_vaddr->basic_errno;
1771 }
1772 else rc = OK; /* Null sender */
1773
1774 /* Cache the result code */
1775
1776 if (routed) setflag(sender_vaddr, af_verify_routed);
1777 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1778 sender_vaddr->special_action = rc;
1779 sender_vaddr->next = sender_verified_list;
1780 sender_verified_list = sender_vaddr;
8e669ac1
PH
1781
1782 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 1783 the sender verification. */
8e669ac1 1784
2a3eea10 1785 deliver_address_data = save_address_data;
059ec3d9 1786 }
8e669ac1 1787
2a3eea10
PH
1788 /* Put the sender address_data value into $sender_address_data */
1789
8e669ac1 1790 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH
1791 }
1792
1793/* A recipient address just gets a straightforward verify; again we must handle
1794the DEFER overrides. */
1795
1796else
1797 {
1798 address_item addr2;
1799
eafd343b
TK
1800 if (success_on_redirect)
1801 verify_options |= vopt_success_on_redirect;
1802
059ec3d9
PH
1803 /* We must use a copy of the address for verification, because it might
1804 get rewritten. */
1805
1806 addr2 = *addr;
1807 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 1808 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 1809 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 1810
059ec3d9 1811 *log_msgptr = addr2.message;
8e669ac1 1812 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 1813 addr2.user_message : addr2.message;
059ec3d9
PH
1814 *basic_errno = addr2.basic_errno;
1815
1816 /* Make $address_data visible */
1817 deliver_address_data = addr2.p.address_data;
1818 }
1819
1820/* We have a result from the relevant test. Handle defer overrides first. */
1821
1822if (rc == DEFER && (defer_ok ||
1823 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1824 {
1825 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1826 defer_ok? "defer_ok" : "callout_defer_ok");
1827 rc = OK;
1828 }
1829
1830/* If we've failed a sender, set up a recipient message, and point
1831sender_verified_failed to the address item that actually failed. */
1832
1833if (rc != OK && verify_sender_address != NULL)
1834 {
1835 if (rc != DEFER)
1836 {
1837 *log_msgptr = *user_msgptr = US"Sender verify failed";
1838 }
1839 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1840 {
1841 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1842 }
1843 else
1844 {
1845 *log_msgptr = US"Could not complete sender verify callout";
1846 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1847 *log_msgptr;
1848 }
1849
1850 sender_verified_failed = sender_vaddr;
1851 }
1852
1853/* Verifying an address messes up the values of $domain and $local_part,
1854so reset them before returning if this is a RCPT ACL. */
1855
1856if (addr != NULL)
1857 {
1858 deliver_domain = addr->domain;
1859 deliver_localpart = addr->local_part;
1860 }
1861return rc;
1862
1863/* Syntax errors in the verify argument come here. */
1864
1865BAD_VERIFY:
1866*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
596875b3
PH
1867 "\"helo\", \"header_syntax\", \"header_sender\" or "
1868 "\"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
1869 "\"verify %s\"", arg);
1870return ERROR;
596875b3
PH
1871
1872/* Options supplied when not allowed come here */
1873
1874NO_OPTIONS:
1875*log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1876 "(this verify item has no options)", arg);
1877return ERROR;
059ec3d9
PH
1878}
1879
1880
1881
1882
1883/*************************************************
1884* Check argument for control= modifier *
1885*************************************************/
1886
1887/* Called from acl_check_condition() below
1888
1889Arguments:
1890 arg the argument string for control=
1891 pptr set to point to the terminating character
1892 where which ACL we are in
1893 log_msgptr for error messages
1894
1895Returns: CONTROL_xxx value
1896*/
1897
1898static int
1899decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
1900{
1901int len;
1902control_def *d;
1903
1904for (d = controls_list;
1905 d < controls_list + sizeof(controls_list)/sizeof(control_def);
1906 d++)
1907 {
1908 len = Ustrlen(d->name);
1909 if (Ustrncmp(d->name, arg, len) == 0) break;
1910 }
1911
1912if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
1913 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
1914 {
1915 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
1916 return CONTROL_ERROR;
1917 }
1918
059ec3d9
PH
1919*pptr = arg + len;
1920return d->value;
1921}
1922
1923
1924
1925/*************************************************
870f6ba8
TF
1926* Handle rate limiting *
1927*************************************************/
1928
1929/* Called by acl_check_condition() below to calculate the result
1930of the ACL ratelimit condition.
1931
1932Note that the return value might be slightly unexpected: if the
1933sender's rate is above the limit then the result is OK. This is
1934similar to the dnslists condition, and is so that you can write
1935ACL clauses like: defer ratelimit = 15 / 1h
1936
1937Arguments:
1938 arg the option string for ratelimit=
1939 log_msgptr for error messages
1940
1941Returns: OK - Sender's rate is above limit
1942 FAIL - Sender's rate is below limit
1943 DEFER - Problem opening ratelimit database
1944 ERROR - Syntax error in options.
1945*/
1946
1947static int
1948acl_ratelimit(uschar *arg, uschar **log_msgptr)
1949{
1950double limit, period;
f3dcf4a2 1951uschar *ss, *key;
870f6ba8
TF
1952int sep = '/';
1953BOOL have_key = FALSE, leaky = FALSE, strict = FALSE;
1954BOOL per_byte = FALSE, per_cmd = FALSE, per_conn = FALSE, per_mail = FALSE;
1955int old_pool, rc;
1956tree_node **anchor, *t;
1957open_db dbblock, *dbm;
1958dbdata_ratelimit *dbd;
1959struct timeval tv;
1960
1961/* Parse the first two options and record their values in expansion
1962variables. These variables allow the configuration to have informative
1963error messages based on rate limits obtained from a table lookup. */
1964
1965/* First is the maximum number of messages per period and maximum burst
1966size, which must be greater than or equal to zero. Zero is useful for
1967rate measurement as opposed to rate limiting. */
1968
1969sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
1970if (sender_rate_limit == NULL)
1971 limit = -1.0;
1972else
1973 {
1974 limit = Ustrtod(sender_rate_limit, &ss);
1975 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
1976 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
1977 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
1978 }
1979if (limit < 0.0 || *ss != 0)
1980 {
1981 *log_msgptr = string_sprintf("syntax error in argument for "
1982 "\"ratelimit\" condition: \"%s\" is not a positive number",
1983 sender_rate_limit);
1984 return ERROR;
1985 }
1986
f3dcf4a2
TF
1987/* We use the rest of the argument list following the limit as the
1988lookup key, because it doesn't make sense to use the same stored data
1989if the period or options are different. */
1990
1991key = arg;
1992
870f6ba8
TF
1993/* Second is the rate measurement period and exponential smoothing time
1994constant. This must be strictly greater than zero, because zero leads to
1995run-time division errors. */
1996
1997sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
1998if (sender_rate_period == NULL) period = -1.0;
1999else period = readconf_readtime(sender_rate_period, 0, FALSE);
2000if (period <= 0.0)
2001 {
2002 *log_msgptr = string_sprintf("syntax error in argument for "
2003 "\"ratelimit\" condition: \"%s\" is not a time value",
2004 sender_rate_period);
2005 return ERROR;
2006 }
2007
2008/* Parse the other options. Should we check if the per_* options are being
2009used in ACLs where they don't make sense, e.g. per_mail in the connect ACL? */
2010
2011while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2012 != NULL)
2013 {
2014 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2015 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2016 else if (strcmpic(ss, US"per_byte") == 0) per_byte = TRUE;
2017 else if (strcmpic(ss, US"per_cmd") == 0) per_cmd = TRUE;
2018 else if (strcmpic(ss, US"per_conn") == 0) per_conn = TRUE;
2019 else if (strcmpic(ss, US"per_mail") == 0) per_mail = TRUE;
2020 else if (strcmpic(ss, US"per_rcpt") == 0) per_cmd = TRUE; /* alias */
2021 else have_key = TRUE;
2022 }
2023if (leaky + strict > 1 || per_byte + per_cmd + per_conn + per_mail > 1)
2024 {
2025 *log_msgptr = US"conflicting options for \"ratelimit\" condition";
2026 return ERROR;
2027 }
2028
2029/* Default option values */
2030if (!strict) leaky = TRUE;
2031if (!per_byte && !per_cmd && !per_conn) per_mail = TRUE;
2032
f3dcf4a2 2033/* If there is no explicit key, use the sender_host_address. If there is no
870f6ba8
TF
2034sender_host_address (e.g. -bs or acl_not_smtp) then we simply omit it. */
2035
2036if (!have_key && sender_host_address != NULL)
2037 key = string_sprintf("%s / %s", key, sender_host_address);
2038
2039HDEBUG(D_acl) debug_printf("ratelimit condition limit=%.0f period=%.0f key=%s\n",
2040 limit, period, key);
2041
fe0dab11 2042/* See if we have already computed the rate by looking in the relevant tree. For
870f6ba8
TF
2043per-connection rate limiting, store tree nodes and dbdata in the permanent pool
2044so that they survive across resets. */
2045
2046anchor = NULL;
2047old_pool = store_pool;
2048
2049if (per_conn)
2050 {
2051 anchor = &ratelimiters_conn;
2052 store_pool = POOL_PERM;
2053 }
fe0dab11 2054else if (per_mail || per_byte)
870f6ba8 2055 anchor = &ratelimiters_mail;
fe0dab11
TF
2056else if (per_cmd)
2057 anchor = &ratelimiters_cmd;
870f6ba8
TF
2058
2059if (anchor != NULL && (t = tree_search(*anchor, key)) != NULL)
2060 {
2061 dbd = t->data.ptr;
2062 /* The following few lines duplicate some of the code below. */
3348576f
TF
2063 if (dbd->rate < limit) rc = FAIL;
2064 else rc = OK;
870f6ba8
TF
2065 store_pool = old_pool;
2066 sender_rate = string_sprintf("%.1f", dbd->rate);
2067 HDEBUG(D_acl)
2068 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2069 return rc;
2070 }
2071
2072/* We aren't using a pre-computed rate, so get a previously recorded
2073rate from the database, update it, and write it back. If there's no
2074previous rate for this key, create one. */
2075
2076dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2077if (dbm == NULL)
2078 {
2079 store_pool = old_pool;
2080 sender_rate = NULL;
2081 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2082 *log_msgptr = US"ratelimit database not available";
2083 return DEFER;
2084 }
2085dbd = dbfn_read(dbm, key);
2086
2087gettimeofday(&tv, NULL);
2088
2089if (dbd == NULL)
2090 {
2091 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's data\n");
2092 dbd = store_get(sizeof(dbdata_ratelimit));
2093 dbd->time_stamp = tv.tv_sec;
2094 dbd->time_usec = tv.tv_usec;
2095 dbd->rate = 0.0;
2096 }
2097else
2098 {
2099 /* The smoothed rate is computed using an exponentially weighted moving
2100 average adjusted for variable sampling intervals. The standard EWMA for
2101 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2102 where f() is the measured value and f'() is the smoothed value.
2103
2104 Old data decays out of the smoothed value exponentially, such that data n
2105 samples old is multiplied by a^n. The exponential decay time constant p
2106 is defined such that data p samples old is multiplied by 1/e, which means
2107 that a = exp(-1/p). We can maintain the same time constant for a variable
2108 sampling interval i by using a = exp(-i/p).
2109
2110 The rate we are measuring is messages per period, suitable for directly
2111 comparing with the limit. The average rate between now and the previous
2112 message is period / interval, which we feed into the EWMA as the sample.
2113
2114 It turns out that the number of messages required for the smoothed rate
2115 to reach the limit when they are sent in a burst is equal to the limit.
2116 This can be seen by analysing the value of the smoothed rate after N
2117 messages sent at even intervals. Let k = (1 - a) * p/i
2118
2119 rate_1 = (1 - a) * p/i + a * rate_0
2120 = k + a * rate_0
2121 rate_2 = k + a * rate_1
2122 = k + a * k + a^2 * rate_0
2123 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2124 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2125 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2126 = rate_0 * a^N + p/i * (1 - a^N)
2127
2128 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2129
2130 rate_N = p/i + (rate_0 - p/i) * a^N
2131 a^N = (rate_N - p/i) / (rate_0 - p/i)
2132 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2133 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2134
2135 Numerical analysis of the above equation, setting the computed rate to
2136 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2137 rates, p/i, the number of messages N = limit. So limit serves as both the
2138 maximum rate measured in messages per period, and the maximum number of
2139 messages that can be sent in a fast burst. */
2140
2141 double this_time = (double)tv.tv_sec
2142 + (double)tv.tv_usec / 1000000.0;
2143 double prev_time = (double)dbd->time_stamp
2144 + (double)dbd->time_usec / 1000000.0;
2145 double interval = this_time - prev_time;
2146
2147 double i_over_p = interval / period;
2148 double a = exp(-i_over_p);
2149
2150 /* We must avoid division by zero, and deal gracefully with the clock going
2151 backwards. If we blunder ahead when time is in reverse then the computed
2152 rate will become bogusly huge. Clamp i/p to a very small number instead. */
2153
2154 if (i_over_p <= 0.0) i_over_p = 1e-9;
2155
2156 dbd->time_stamp = tv.tv_sec;
2157 dbd->time_usec = tv.tv_usec;
2158
2159 /* If we are measuring the rate in bytes per period, multiply the
2160 measured rate by the message size. If we don't know the message size
2161 then it's safe to just use a value of zero and let the recorded rate
2162 decay as if nothing happened. */
2163
2164 if (per_byte)
2165 dbd->rate = (message_size < 0 ? 0.0 : (double)message_size)
2166 * (1 - a) / i_over_p + a * dbd->rate;
2167 else
2168 dbd->rate = (1 - a) / i_over_p + a * dbd->rate;
2169 }
2170
3348576f
TF
2171/* Clients sending at the limit are considered to be over the limit. This
2172matters for edge cases such the first message sent by a client (which gets
2173the initial rate of 0.0) when the rate limit is zero (i.e. the client should
2174be completely blocked). */
2175
2176if (dbd->rate < limit) rc = FAIL;
2177 else rc = OK;
870f6ba8
TF
2178
2179/* Update the state if the rate is low or if we are being strict. If we
2180are in leaky mode and the sender's rate is too high, we do not update
2181the recorded rate in order to avoid an over-aggressive sender's retry
2182rate preventing them from getting any email through. */
2183
2184if (rc == FAIL || !leaky)
2185 dbfn_write(dbm, key, dbd, sizeof(dbdata_ratelimit));
2186dbfn_close(dbm);
2187
2188/* Store the result in the tree for future reference, if necessary. */
2189
2190if (anchor != NULL)
2191 {
2192 t = store_get(sizeof(tree_node) + Ustrlen(key));
2193 t->data.ptr = dbd;
2194 Ustrcpy(t->name, key);
2195 (void)tree_insertnode(anchor, t);
2196 }
2197
2198/* We create the formatted version of the sender's rate very late in
2199order to ensure that it is done using the correct storage pool. */
2200
2201store_pool = old_pool;
2202sender_rate = string_sprintf("%.1f", dbd->rate);
2203
2204HDEBUG(D_acl)
2205 debug_printf("ratelimit computed rate %s\n", sender_rate);
2206
2207return rc;
2208}
2209
2210
2211
2212/*************************************************
059ec3d9
PH
2213* Handle conditions/modifiers on an ACL item *
2214*************************************************/
2215
2216/* Called from acl_check() below.
2217
2218Arguments:
2219 verb ACL verb
2220 cb ACL condition block - if NULL, result is OK
2221 where where called from
2222 addr the address being checked for RCPT, or NULL
2223 level the nesting level
2224 epp pointer to pass back TRUE if "endpass" encountered
2225 (applies only to "accept" and "discard")
2226 user_msgptr user message pointer
2227 log_msgptr log message pointer
2228 basic_errno pointer to where to put verify error
2229
2230Returns: OK - all conditions are met
2231 DISCARD - an "acl" condition returned DISCARD - only allowed
2232 for "accept" or "discard" verbs
2233 FAIL - at least one condition fails
2234 FAIL_DROP - an "acl" condition returned FAIL_DROP
2235 DEFER - can't tell at the moment (typically, lookup defer,
2236 but can be temporary callout problem)
2237 ERROR - ERROR from nested ACL or expansion failure or other
2238 error
2239*/
2240
2241static int
2242acl_check_condition(int verb, acl_condition_block *cb, int where,
2243 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2244 uschar **log_msgptr, int *basic_errno)
2245{
2246uschar *user_message = NULL;
2247uschar *log_message = NULL;
2248uschar *p;
2249int rc = OK;
8523533c
TK
2250#ifdef WITH_CONTENT_SCAN
2251int sep = '/';
2252#endif
059ec3d9
PH
2253
2254for (; cb != NULL; cb = cb->next)
2255 {
2256 uschar *arg;
8e669ac1 2257 int control_type;
059ec3d9
PH
2258
2259 /* The message and log_message items set up messages to be used in
2260 case of rejection. They are expanded later. */
2261
2262 if (cb->type == ACLC_MESSAGE)
2263 {
2264 user_message = cb->arg;
2265 continue;
2266 }
2267
2268 if (cb->type == ACLC_LOG_MESSAGE)
2269 {
2270 log_message = cb->arg;
2271 continue;
2272 }
2273
2274 /* The endpass "condition" just sets a flag to show it occurred. This is
2275 checked at compile time to be on an "accept" or "discard" item. */
2276
2277 if (cb->type == ACLC_ENDPASS)
2278 {
2279 *epp = TRUE;
2280 continue;
2281 }
2282
2283 /* For other conditions and modifiers, the argument is expanded now for some
2284 of them, but not for all, because expansion happens down in some lower level
2285 checking functions in some cases. */
2286
2287 if (cond_expand_at_top[cb->type])
2288 {
2289 arg = expand_string(cb->arg);
2290 if (arg == NULL)
2291 {
2292 if (expand_string_forcedfail) continue;
2293 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2294 cb->arg, expand_string_message);
2295 return search_find_defer? DEFER : ERROR;
2296 }
2297 }
2298 else arg = cb->arg;
2299
2300 /* Show condition, and expanded condition if it's different */
2301
2302 HDEBUG(D_acl)
2303 {
2304 int lhswidth = 0;
2305 debug_printf("check %s%s %n",
2306 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2307 conditions[cb->type], &lhswidth);
2308
2309 if (cb->type == ACLC_SET)
2310 {
2311 int n = cb->u.varnumber;
2312 int t = (n < ACL_C_MAX)? 'c' : 'm';
2313 if (n >= ACL_C_MAX) n -= ACL_C_MAX;
2314 debug_printf("acl_%c%d ", t, n);
2315 lhswidth += 7;
2316 }
2317
2318 debug_printf("= %s\n", cb->arg);
2319
2320 if (arg != cb->arg)
2321 debug_printf("%.*s= %s\n", lhswidth,
2322 US" ", CS arg);
2323 }
2324
2325 /* Check that this condition makes sense at this time */
2326
2327 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2328 {
2329 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2330 cond_modifiers[cb->type]? "use" : "test",
2331 conditions[cb->type], acl_wherenames[where]);
2332 return ERROR;
2333 }
2334
2335 /* Run the appropriate test for each condition, or take the appropriate
2336 action for the remaining modifiers. */
2337
2338 switch(cb->type)
2339 {
2340 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2341 "discard" verb. */
2342
2343 case ACLC_ACL:
2344 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
2345 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2346 {
2347 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2348 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2349 verbs[verb]);
2350 return ERROR;
2351 }
2352 break;
2353
2354 case ACLC_AUTHENTICATED:
2355 rc = (sender_host_authenticated == NULL)? FAIL :
2356 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2357 TRUE, NULL);
2358 break;
2359
8523533c
TK
2360#ifdef EXPERIMENTAL_BRIGHTMAIL
2361 case ACLC_BMI_OPTIN:
2362 {
2363 int old_pool = store_pool;
2364 store_pool = POOL_PERM;
2365 bmi_current_optin = string_copy(arg);
2366 store_pool = old_pool;
2367 }
2368 break;
2369#endif
2370
059ec3d9
PH
2371 case ACLC_CONDITION:
2372 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2373 rc = (Uatoi(arg) == 0)? FAIL : OK;
2374 else
2375 rc = (strcmpic(arg, US"no") == 0 ||
2376 strcmpic(arg, US"false") == 0)? FAIL :
2377 (strcmpic(arg, US"yes") == 0 ||
2378 strcmpic(arg, US"true") == 0)? OK : DEFER;
2379 if (rc == DEFER)
2380 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2381 break;
2382
2383 case ACLC_CONTROL:
c5fcb476
PH
2384 control_type = decode_control(arg, &p, where, log_msgptr);
2385
8523533c 2386 /* Check if this control makes sense at this time */
c5fcb476
PH
2387
2388 if ((control_forbids[control_type] & (1 << where)) != 0)
2389 {
2390 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2391 controls[control_type], acl_wherenames[where]);
2392 return ERROR;
8e669ac1 2393 }
c5fcb476
PH
2394
2395 switch(control_type)
059ec3d9 2396 {
8523533c
TK
2397#ifdef EXPERIMENTAL_BRIGHTMAIL
2398 case CONTROL_BMI_RUN:
2399 bmi_run = 1;
2400 break;
2401#endif
fb2274d4
TK
2402#ifdef EXPERIMENTAL_DOMAINKEYS
2403 case CONTROL_DK_VERIFY:
2404 dk_do_verify = 1;
2405 break;
2406#endif
059ec3d9
PH
2407 case CONTROL_ERROR:
2408 return ERROR;
2409
2410 case CONTROL_CASEFUL_LOCAL_PART:
2411 deliver_localpart = addr->cc_local_part;
2412 break;
2413
2414 case CONTROL_CASELOWER_LOCAL_PART:
2415 deliver_localpart = addr->lc_local_part;
2416 break;
2417
2418 case CONTROL_ENFORCE_SYNC:
2419 smtp_enforce_sync = TRUE;
2420 break;
2421
2422 case CONTROL_NO_ENFORCE_SYNC:
2423 smtp_enforce_sync = FALSE;
2424 break;
2425
8523533c
TK
2426#ifdef WITH_CONTENT_SCAN
2427 case CONTROL_NO_MBOX_UNSPOOL:
2428 no_mbox_unspool = TRUE;
2429 break;
2430#endif
2431
059ec3d9
PH
2432 case CONTROL_NO_MULTILINE:
2433 no_multiline_responses = TRUE;
2434 break;
2435
29aba418 2436 case CONTROL_FAKEDEFER:
8523533c 2437 case CONTROL_FAKEREJECT:
29aba418 2438 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 2439 if (*p == '/')
8e669ac1 2440 {
8523533c 2441 uschar *pp = p + 1;
8e669ac1 2442 while (*pp != 0) pp++;
29aba418 2443 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK
2444 p = pp;
2445 }
2446 else
2447 {
2448 /* Explicitly reset to default string */
29aba418 2449 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK
2450 }
2451 break;
8523533c 2452
059ec3d9
PH
2453 case CONTROL_FREEZE:
2454 deliver_freeze = TRUE;
2455 deliver_frozen_at = time(NULL);
2456 break;
2457
2458 case CONTROL_QUEUE_ONLY:
2459 queue_only_policy = TRUE;
2460 break;
2461
2462 case CONTROL_SUBMISSION:
87ba3f5f 2463 originator_name = US"";
059ec3d9 2464 submission_mode = TRUE;
69358f02 2465 while (*p == '/')
8e669ac1 2466 {
69358f02
PH
2467 if (Ustrncmp(p, "/sender_retain", 14) == 0)
2468 {
2469 p += 14;
2470 active_local_sender_retain = TRUE;
8e669ac1
PH
2471 active_local_from_check = FALSE;
2472 }
69358f02
PH
2473 else if (Ustrncmp(p, "/domain=", 8) == 0)
2474 {
2475 uschar *pp = p + 8;
8e669ac1 2476 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH
2477 submission_domain = string_copyn(p+8, pp-p-8);
2478 p = pp;
2479 }
2480 else if (Ustrncmp(p, "/name=", 6) == 0)
2481 {
2482 uschar *pp = p + 6;
2483 while (*pp != 0 && *pp != '/') pp++;
2484 originator_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
2485 big_buffer, big_buffer_size));
8e669ac1 2486 p = pp;
69358f02 2487 }
8e669ac1
PH
2488 else break;
2489 }
69358f02 2490 if (*p != 0)
059ec3d9 2491 {
69358f02 2492 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH
2493 return ERROR;
2494 }
2495 break;
2496 }
2497 break;
2498
8523533c
TK
2499#ifdef WITH_CONTENT_SCAN
2500 case ACLC_DECODE:
2501 rc = mime_decode(&arg);
2502 break;
2503#endif
2504
059ec3d9
PH
2505 case ACLC_DELAY:
2506 {
2507 int delay = readconf_readtime(arg, 0, FALSE);
2508 if (delay < 0)
2509 {
2510 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
2511 "modifier: \"%s\" is not a time value", arg);
2512 return ERROR;
2513 }
2514 else
2515 {
2516 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
2517 delay);
2518 if (host_checking)
2519 {
2520 HDEBUG(D_acl)
2521 debug_printf("delay skipped in -bh checking mode\n");
2522 }
010c2d14
PH
2523
2524 /* It appears to be impossible to detect that a TCP/IP connection has
2525 gone away without reading from it. This means that we cannot shorten
2526 the delay below if the client goes away, because we cannot discover
2527 that the client has closed its end of the connection. (The connection
2528 is actually in a half-closed state, waiting for the server to close its
2529 end.) It would be nice to be able to detect this state, so that the
2530 Exim process is not held up unnecessarily. However, it seems that we
2531 can't. The poll() function does not do the right thing, and in any case
2532 it is not always available.
2533
2534 NOTE: If ever this state of affairs changes, remember that we may be
2535 dealing with stdin/stdout here, in addition to TCP/IP connections.
2536 Whatever is done must work in both cases. To detected the stdin/stdout
2537 case, check for smtp_in or smtp_out being NULL. */
2538
8e669ac1 2539 else
86b8287f
PH
2540 {
2541 while (delay > 0) delay = sleep(delay);
8e669ac1 2542 }
059ec3d9
PH
2543 }
2544 }
2545 break;
2546
8523533c
TK
2547#ifdef WITH_OLD_DEMIME
2548 case ACLC_DEMIME:
2549 rc = demime(&arg);
2550 break;
2551#endif
2552
fb2274d4
TK
2553#ifdef EXPERIMENTAL_DOMAINKEYS
2554 case ACLC_DK_DOMAIN_SOURCE:
2555 if (dk_verify_block == NULL) { rc = FAIL; break; };
2556 /* check header source of domain against given string */
2557 switch (dk_verify_block->address_source) {
2558 case DK_EXIM_ADDRESS_FROM_FROM:
2559 rc = match_isinlist(US"from", &arg, 0, NULL,
2560 NULL, MCL_STRING, TRUE, NULL);
2561 break;
2562 case DK_EXIM_ADDRESS_FROM_SENDER:
2563 rc = match_isinlist(US"sender", &arg, 0, NULL,
2564 NULL, MCL_STRING, TRUE, NULL);
2565 break;
2566 case DK_EXIM_ADDRESS_NONE:
2567 rc = match_isinlist(US"none", &arg, 0, NULL,
2568 NULL, MCL_STRING, TRUE, NULL);
2569 break;
2570 }
2571 break;
2572 case ACLC_DK_POLICY:
2573 if (dk_verify_block == NULL) { rc = FAIL; break; };
2574 /* check policy against given string, default FAIL */
2575 rc = FAIL;
2576 if (dk_verify_block->signsall)
2577 rc = match_isinlist(US"signsall", &arg, 0, NULL,
2578 NULL, MCL_STRING, TRUE, NULL);
2579 if (dk_verify_block->testing)
2580 rc = match_isinlist(US"testing", &arg, 0, NULL,
2581 NULL, MCL_STRING, TRUE, NULL);
2582 break;
2583 case ACLC_DK_SENDER_DOMAINS:
2584 if (dk_verify_block == NULL) { rc = FAIL; break; };
2585 if (dk_verify_block->domain != NULL)
2586 rc = match_isinlist(dk_verify_block->domain, &arg, 0, &domainlist_anchor,
2587 NULL, MCL_DOMAIN, TRUE, NULL);
2588 else rc = FAIL;
2589 break;
2590 case ACLC_DK_SENDER_LOCAL_PARTS:
2591 if (dk_verify_block == NULL) { rc = FAIL; break; };
2592 if (dk_verify_block->local_part != NULL)
2593 rc = match_isinlist(dk_verify_block->local_part, &arg, 0, &localpartlist_anchor,
2594 NULL, MCL_LOCALPART, TRUE, NULL);
2595 else rc = FAIL;
2596 break;
2597 case ACLC_DK_SENDERS:
2598 if (dk_verify_block == NULL) { rc = FAIL; break; };
2599 if (dk_verify_block->address != NULL)
2600 rc = match_address_list(dk_verify_block->address, TRUE, TRUE, &arg, NULL, -1, 0, NULL);
2601 else rc = FAIL;
2602 break;
2603 case ACLC_DK_STATUS:
2604 if (dk_verify_block == NULL) { rc = FAIL; break; };
2605 if (dk_verify_block->result > 0) {
2606 switch(dk_verify_block->result) {
2607 case DK_EXIM_RESULT_BAD_FORMAT:
2608 rc = match_isinlist(US"bad format", &arg, 0, NULL,
2609 NULL, MCL_STRING, TRUE, NULL);
2610 break;
2611 case DK_EXIM_RESULT_NO_KEY:
2612 rc = match_isinlist(US"no key", &arg, 0, NULL,
2613 NULL, MCL_STRING, TRUE, NULL);
2614 break;
2615 case DK_EXIM_RESULT_NO_SIGNATURE:
2616 rc = match_isinlist(US"no signature", &arg, 0, NULL,
2617 NULL, MCL_STRING, TRUE, NULL);
2618 break;
2619 case DK_EXIM_RESULT_REVOKED:
2620 rc = match_isinlist(US"revoked", &arg, 0, NULL,
2621 NULL, MCL_STRING, TRUE, NULL);
2622 break;
2623 case DK_EXIM_RESULT_NON_PARTICIPANT:
2624 rc = match_isinlist(US"non-participant", &arg, 0, NULL,
2625 NULL, MCL_STRING, TRUE, NULL);
2626 break;
2627 case DK_EXIM_RESULT_GOOD:
2628 rc = match_isinlist(US"good", &arg, 0, NULL,
2629 NULL, MCL_STRING, TRUE, NULL);
2630 break;
2631 case DK_EXIM_RESULT_BAD:
2632 rc = match_isinlist(US"bad", &arg, 0, NULL,
2633 NULL, MCL_STRING, TRUE, NULL);
2634 break;
2635 }
2636 }
2637 break;
2638#endif
2639
059ec3d9
PH
2640 case ACLC_DNSLISTS:
2641 rc = verify_check_dnsbl(&arg);
2642 break;
2643
2644 case ACLC_DOMAINS:
2645 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
2646 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
2647 break;
2648
2649 /* The value in tls_cipher is the full cipher name, for example,
2650 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
2651 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
2652 what may in practice come out of the SSL library - which at the time of
2653 writing is poorly documented. */
2654
2655 case ACLC_ENCRYPTED:
2656 if (tls_cipher == NULL) rc = FAIL; else
2657 {
2658 uschar *endcipher = NULL;
2659 uschar *cipher = Ustrchr(tls_cipher, ':');
2660 if (cipher == NULL) cipher = tls_cipher; else
2661 {
2662 endcipher = Ustrchr(++cipher, ':');
2663 if (endcipher != NULL) *endcipher = 0;
2664 }
2665 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
2666 if (endcipher != NULL) *endcipher = ':';
2667 }
2668 break;
2669
2670 /* Use verify_check_this_host() instead of verify_check_host() so that
2671 we can pass over &host_data to catch any looked up data. Once it has been
2672 set, it retains its value so that it's still there if another ACL verb
2673 comes through here and uses the cache. However, we must put it into
2674 permanent store in case it is also expected to be used in a subsequent
2675 message in the same SMTP connection. */
2676
2677 case ACLC_HOSTS:
2678 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
2679 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
2680 if (host_data != NULL) host_data = string_copy_malloc(host_data);
2681 break;
2682
2683 case ACLC_LOCAL_PARTS:
2684 rc = match_isinlist(addr->cc_local_part, &arg, 0,
2685 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
2686 &deliver_localpart_data);
2687 break;
2688
2689 case ACLC_LOGWRITE:
2690 {
2691 int logbits = 0;
2692 uschar *s = arg;
2693 if (*s == ':')
2694 {
2695 s++;
2696 while (*s != ':')
2697 {
2698 if (Ustrncmp(s, "main", 4) == 0)
2699 { logbits |= LOG_MAIN; s += 4; }
2700 else if (Ustrncmp(s, "panic", 5) == 0)
2701 { logbits |= LOG_PANIC; s += 5; }
2702 else if (Ustrncmp(s, "reject", 6) == 0)
2703 { logbits |= LOG_REJECT; s += 6; }
2704 else
2705 {
2706 logbits = LOG_MAIN|LOG_PANIC;
2707 s = string_sprintf(":unknown log name in \"%s\" in "
2708 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
2709 }
2710 if (*s == ',') s++;
2711 }
2712 s++;
2713 }
2714 while (isspace(*s)) s++;
2715 if (logbits == 0) logbits = LOG_MAIN;
2716 log_write(0, logbits, "%s", string_printing(s));
2717 }
2718 break;
8e669ac1 2719
8523533c
TK
2720#ifdef WITH_CONTENT_SCAN
2721 case ACLC_MALWARE:
2722 {
2723 /* Seperate the regular expression and any optional parameters. */
2724 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2725 /* Run the malware backend. */
2726 rc = malware(&ss);
2727 /* Modify return code based upon the existance of options. */
2728 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2729 != NULL) {
2730 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2731 {
2732 /* FAIL so that the message is passed to the next ACL */
2733 rc = FAIL;
2734 }
2735 }
2736 }
2737 break;
2738
2739 case ACLC_MIME_REGEX:
2740 rc = mime_regex(&arg);
2741 break;
2742#endif
059ec3d9 2743
870f6ba8
TF
2744 case ACLC_RATELIMIT:
2745 rc = acl_ratelimit(arg, log_msgptr);
2746 break;
2747
059ec3d9
PH
2748 case ACLC_RECIPIENTS:
2749 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
2750 &recipient_data);
2751 break;
2752
8523533c
TK
2753#ifdef WITH_CONTENT_SCAN
2754 case ACLC_REGEX:
2755 rc = regex(&arg);
2756 break;
2757#endif
2758
059ec3d9
PH
2759 case ACLC_SENDER_DOMAINS:
2760 {
2761 uschar *sdomain;
2762 sdomain = Ustrrchr(sender_address, '@');
2763 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
2764 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
2765 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
2766 }
2767 break;
2768
2769 case ACLC_SENDERS:
2770 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
2771 sender_address_cache, -1, 0, &sender_data);
2772 break;
2773
2774 /* Connection variables must persist forever */
2775
2776 case ACLC_SET:
2777 {
2778 int old_pool = store_pool;
2779 if (cb->u.varnumber < ACL_C_MAX) store_pool = POOL_PERM;
2780 acl_var[cb->u.varnumber] = string_copy(arg);
2781 store_pool = old_pool;
2782 }
2783 break;
2784
8523533c
TK
2785#ifdef WITH_CONTENT_SCAN
2786 case ACLC_SPAM:
2787 {
2788 /* Seperate the regular expression and any optional parameters. */
2789 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2790 /* Run the spam backend. */
2791 rc = spam(&ss);
2792 /* Modify return code based upon the existance of options. */
2793 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2794 != NULL) {
2795 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2796 {
2797 /* FAIL so that the message is passed to the next ACL */
2798 rc = FAIL;
2799 }
2800 }
2801 }
2802 break;
2803#endif
2804
2805#ifdef EXPERIMENTAL_SPF
2806 case ACLC_SPF:
2807 rc = spf_process(&arg, sender_address);
2808 break;
2809#endif
2810
059ec3d9
PH
2811 /* If the verb is WARN, discard any user message from verification, because
2812 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH
2813 only from explicit "message" modifiers. However, put the user message into
2814 $acl_verify_message so it can be used in subsequent conditions or modifiers
2815 (until something changes it). */
059ec3d9
PH
2816
2817 case ACLC_VERIFY:
2818 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 2819 acl_verify_message = *user_msgptr;
059ec3d9
PH
2820 if (verb == ACL_WARN) *user_msgptr = NULL;
2821 break;
2822
2823 default:
2824 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
2825 "condition %d", cb->type);
2826 break;
2827 }
2828
2829 /* If a condition was negated, invert OK/FAIL. */
2830
2831 if (!cond_modifiers[cb->type] && cb->u.negated)
2832 {
2833 if (rc == OK) rc = FAIL;
2834 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
2835 }
2836
2837 if (rc != OK) break; /* Conditions loop */
2838 }
2839
2840
2841/* If the result is the one for which "message" and/or "log_message" are used,
2842handle the values of these options. Most verbs have but a single return for
2843which the messages are relevant, but for "discard", it's useful to have the log
2844message both when it succeeds and when it fails. Also, for an "accept" that
2845appears in a QUIT ACL, we want to handle the user message. Since only "accept"
2846and "warn" are permitted in that ACL, we don't need to test the verb.
2847
2848These modifiers act in different ways:
2849
2850"message" is a user message that will be included in an SMTP response. Unless
2851it is empty, it overrides any previously set user message.
2852
2853"log_message" is a non-user message, and it adds to any existing non-user
2854message that is already set.
2855
2856If there isn't a log message set, we make it the same as the user message. */
2857
2858if (((rc == FAIL_DROP)? FAIL : rc) == msgcond[verb] ||
2859 (verb == ACL_DISCARD && rc == OK) ||
2860 (where == ACL_WHERE_QUIT))
2861 {
2862 uschar *expmessage;
2863
2864 /* If the verb is "warn", messages generated by conditions (verification or
2865 nested ACLs) are discarded. Only messages specified at this level are used.
2866 However, the value of an existing message is available in $acl_verify_message
2867 during expansions. */
2868
2869 uschar *old_user_msgptr = *user_msgptr;
2870 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
2871
2872 if (verb == ACL_WARN) *log_msgptr = *user_msgptr = NULL;
2873
2874 if (user_message != NULL)
2875 {
2876 acl_verify_message = old_user_msgptr;
2877 expmessage = expand_string(user_message);
2878 if (expmessage == NULL)
2879 {
2880 if (!expand_string_forcedfail)
2881 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2882 user_message, expand_string_message);
2883 }
2884 else if (expmessage[0] != 0) *user_msgptr = expmessage;
2885 }
2886
2887 if (log_message != NULL)
2888 {
2889 acl_verify_message = old_log_msgptr;
2890 expmessage = expand_string(log_message);
2891 if (expmessage == NULL)
2892 {
2893 if (!expand_string_forcedfail)
2894 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2895 log_message, expand_string_message);
2896 }
2897 else if (expmessage[0] != 0)
2898 {
2899 *log_msgptr = (*log_msgptr == NULL)? expmessage :
2900 string_sprintf("%s: %s", expmessage, *log_msgptr);
2901 }
2902 }
2903
2904 /* If no log message, default it to the user message */
2905
2906 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
2907 }
2908
2909acl_verify_message = NULL;
2910return rc;
2911}
2912
2913
2914
2915
2916
2917/*************************************************
2918* Get line from a literal ACL *
2919*************************************************/
2920
2921/* This function is passed to acl_read() in order to extract individual lines
2922of a literal ACL, which we access via static pointers. We can destroy the
2923contents because this is called only once (the compiled ACL is remembered).
2924
2925This code is intended to treat the data in the same way as lines in the main
2926Exim configuration file. That is:
2927
2928 . Leading spaces are ignored.
2929
2930 . A \ at the end of a line is a continuation - trailing spaces after the \
2931 are permitted (this is because I don't believe in making invisible things
2932 significant). Leading spaces on the continued part of a line are ignored.
2933
2934 . Physical lines starting (significantly) with # are totally ignored, and
2935 may appear within a sequence of backslash-continued lines.
2936
2937 . Blank lines are ignored, but will end a sequence of continuations.
2938
2939Arguments: none
2940Returns: a pointer to the next line
2941*/
2942
2943
2944static uschar *acl_text; /* Current pointer in the text */
2945static uschar *acl_text_end; /* Points one past the terminating '0' */
2946
2947
2948static uschar *
2949acl_getline(void)
2950{
2951uschar *yield;
2952
2953/* This loop handles leading blank lines and comments. */
2954
2955for(;;)
2956 {
2957 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
2958 if (*acl_text == 0) return NULL; /* No more data */
2959 yield = acl_text; /* Potential data line */
2960
2961 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
2962
2963 /* If we hit the end before a newline, we have the whole logical line. If
2964 it's a comment, there's no more data to be given. Otherwise, yield it. */
2965
2966 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
2967
2968 /* After reaching a newline, end this loop if the physical line does not
2969 start with '#'. If it does, it's a comment, and the loop continues. */
2970
2971 if (*yield != '#') break;
2972 }
2973
2974/* This loop handles continuations. We know we have some real data, ending in
2975newline. See if there is a continuation marker at the end (ignoring trailing
2976white space). We know that *yield is not white space, so no need to test for
2977cont > yield in the backwards scanning loop. */
2978
2979for(;;)
2980 {
2981 uschar *cont;
2982 for (cont = acl_text - 1; isspace(*cont); cont--);
2983
2984 /* If no continuation follows, we are done. Mark the end of the line and
2985 return it. */
2986
2987 if (*cont != '\\')
2988 {
2989 *acl_text++ = 0;
2990 return yield;
2991 }
2992
2993 /* We have encountered a continuation. Skip over whitespace at the start of
2994 the next line, and indeed the whole of the next line or lines if they are
2995 comment lines. */
2996
2997 for (;;)
2998 {
2999 while (*(++acl_text) == ' ' || *acl_text == '\t');
3000 if (*acl_text != '#') break;
3001 while (*(++acl_text) != 0 && *acl_text != '\n');
3002 }
3003
3004 /* We have the start of a continuation line. Move all the rest of the data
3005 to join onto the previous line, and then find its end. If the end is not a
3006 newline, we are done. Otherwise loop to look for another continuation. */
3007
3008 memmove(cont, acl_text, acl_text_end - acl_text);
3009 acl_text_end -= acl_text - cont;
3010 acl_text = cont;
3011 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3012 if (*acl_text == 0) return yield;
3013 }
3014
3015/* Control does not reach here */
3016}
3017
3018
3019
3020
3021
3022/*************************************************
3023* Check access using an ACL *
3024*************************************************/
3025
3026/* This function is called from address_check. It may recurse via
3027acl_check_condition() - hence the use of a level to stop looping. The ACL is
3028passed as a string which is expanded. A forced failure implies no access check
3029is required. If the result is a single word, it is taken as the name of an ACL
3030which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3031text, complete with newlines, and parsed as such. In both cases, the ACL check
3032is then run. This function uses an auxiliary function for acl_read() to call
3033for reading individual lines of a literal ACL. This is acl_getline(), which
3034appears immediately above.
3035
3036Arguments:
3037 where where called from
3038 addr address item when called from RCPT; otherwise NULL
3039 s the input string; NULL is the same as an empty ACL => DENY
3040 level the nesting level
3041 user_msgptr where to put a user error (for SMTP response)
3042 log_msgptr where to put a logging message (not for SMTP response)
3043
3044Returns: OK access is granted
3045 DISCARD access is apparently granted...
3046 FAIL access is denied
3047 FAIL_DROP access is denied; drop the connection
3048 DEFER can't tell at the moment
3049 ERROR disaster
3050*/
3051
3052static int
3053acl_check_internal(int where, address_item *addr, uschar *s, int level,
3054 uschar **user_msgptr, uschar **log_msgptr)
3055{
3056int fd = -1;
3057acl_block *acl = NULL;
3058uschar *acl_name = US"inline ACL";
3059uschar *ss;
3060
3061/* Catch configuration loops */
3062
3063if (level > 20)
3064 {
3065 *log_msgptr = US"ACL nested too deep: possible loop";
3066 return ERROR;
3067 }
3068
3069if (s == NULL)
3070 {
3071 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3072 return FAIL;
3073 }
3074
3075/* At top level, we expand the incoming string. At lower levels, it has already
3076been expanded as part of condition processing. */
3077
3078if (level == 0)
3079 {
3080 ss = expand_string(s);
3081 if (ss == NULL)
3082 {
3083 if (expand_string_forcedfail) return OK;
3084 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3085 expand_string_message);
3086 return ERROR;
3087 }
3088 }
3089else ss = s;
3090
3091while (isspace(*ss))ss++;
3092
3093/* If we can't find a named ACL, the default is to parse it as an inline one.
3094(Unless it begins with a slash; non-existent files give rise to an error.) */
3095
3096acl_text = ss;
3097
3098/* Handle the case of a string that does not contain any spaces. Look for a
3099named ACL among those read from the configuration, or a previously read file.
3100It is possible that the pointer to the ACL is NULL if the configuration
3101contains a name with no data. If not found, and the text begins with '/',
3102read an ACL from a file, and save it so it can be re-used. */
3103
3104if (Ustrchr(ss, ' ') == NULL)
3105 {
3106 tree_node *t = tree_search(acl_anchor, ss);
3107 if (t != NULL)
3108 {
3109 acl = (acl_block *)(t->data.ptr);
3110 if (acl == NULL)
3111 {
3112 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3113 return FAIL;
3114 }
3115 acl_name = string_sprintf("ACL \"%s\"", ss);
3116 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3117 }
3118
3119 else if (*ss == '/')
3120 {
3121 struct stat statbuf;
3122 fd = Uopen(ss, O_RDONLY, 0);
3123 if (fd < 0)
3124 {
3125 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3126 strerror(errno));
3127 return ERROR;
3128 }
3129
3130 if (fstat(fd, &statbuf) != 0)
3131 {
3132 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3133 strerror(errno));
3134 return ERROR;
3135 }
3136
3137 acl_text = store_get(statbuf.st_size + 1);
3138 acl_text_end = acl_text + statbuf.st_size + 1;
3139
3140 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3141 {
3142 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3143 ss, strerror(errno));
3144 return ERROR;
3145 }
3146 acl_text[statbuf.st_size] = 0;
f1e894f3 3147 (void)close(fd);
059ec3d9
PH
3148
3149 acl_name = string_sprintf("ACL \"%s\"", ss);
3150 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3151 }
3152 }
3153
3154/* Parse an ACL that is still in text form. If it came from a file, remember it
3155in the ACL tree, having read it into the POOL_PERM store pool so that it
3156persists between multiple messages. */
3157
3158if (acl == NULL)
3159 {
3160 int old_pool = store_pool;
3161 if (fd >= 0) store_pool = POOL_PERM;
3162 acl = acl_read(acl_getline, log_msgptr);
3163 store_pool = old_pool;
3164 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3165 if (fd >= 0)
3166 {
3167 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3168 Ustrcpy(t->name, ss);
3169 t->data.ptr = acl;
3170 (void)tree_insertnode(&acl_anchor, t);
3171 }
3172 }
3173
3174/* Now we have an ACL to use. It's possible it may be NULL. */
3175
3176while (acl != NULL)
3177 {
3178 int cond;
3179 int basic_errno = 0;
3180 BOOL endpass_seen = FALSE;
3181
3182 *log_msgptr = *user_msgptr = NULL;
3183 acl_temp_details = FALSE;
3184
3185 if (where == ACL_WHERE_QUIT &&
3186 acl->verb != ACL_ACCEPT &&
3187 acl->verb != ACL_WARN)
3188 {
3189 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT ACL",
3190 verbs[acl->verb]);
3191 return ERROR;
3192 }
3193
3194 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3195
3196 /* Clear out any search error message from a previous check before testing
3197 this condition. */
3198
3199 search_error_message = NULL;
3200 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3201 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3202
3203 /* Handle special returns: DEFER causes a return except on a WARN verb;
3204 ERROR always causes a return. */
3205
3206 switch (cond)
3207 {
3208 case DEFER:
3209 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
3210 if (basic_errno != ERRNO_CALLOUTDEFER)
3211 {
3212 if (search_error_message != NULL && *search_error_message != 0)
3213 *log_msgptr = search_error_message;
3214 if (smtp_return_error_details) acl_temp_details = TRUE;
3215 }
3216 else
3217 {
3218 acl_temp_details = TRUE;
3219 }
3220 if (acl->verb != ACL_WARN) return DEFER;
3221 break;
3222
3223 default: /* Paranoia */
3224 case ERROR:
3225 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
3226 return ERROR;
3227
3228 case OK:
3229 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
3230 verbs[acl->verb]);
3231 break;
3232
3233 case FAIL:
3234 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
3235 break;
3236
3237 /* DISCARD and DROP can happen only from a nested ACL condition, and
3238 DISCARD can happen only for an "accept" or "discard" verb. */
3239
3240 case DISCARD:
3241 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
3242 verbs[acl->verb]);
3243 break;
3244
3245 case FAIL_DROP:
3246 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
3247 verbs[acl->verb]);
3248 break;
3249 }
3250
3251 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3252 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3253 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3254
3255 switch(acl->verb)
3256 {
3257 case ACL_ACCEPT:
3258 if (cond == OK || cond == DISCARD) return cond;
3259 if (endpass_seen)
3260 {
3261 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3262 return cond;
3263 }
3264 break;
3265
3266 case ACL_DEFER:
3267 if (cond == OK)
3268 {
3269 acl_temp_details = TRUE;
3270 return DEFER;
3271 }
3272 break;
3273
3274 case ACL_DENY:
3275 if (cond == OK) return FAIL;
3276 break;
3277
3278 case ACL_DISCARD:
3279 if (cond == OK || cond == DISCARD) return DISCARD;
3280 if (endpass_seen)
3281 {
3282 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
3283 return cond;
3284 }
3285 break;
3286
3287 case ACL_DROP:
3288 if (cond == OK) return FAIL_DROP;
3289 break;
3290
3291 case ACL_REQUIRE:
3292 if (cond != OK) return cond;
3293 break;
3294
3295 case ACL_WARN:
3296 if (cond == OK)
3297 acl_warn(where, *user_msgptr, *log_msgptr);
3298 else if (cond == DEFER)
9c7a242c
PH
3299 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
3300 "condition test deferred%s%s", host_and_ident(TRUE),
3301 (*log_msgptr == NULL)? US"" : US": ",
3302 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH
3303 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
3304 break;
3305
3306 default:
3307 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
3308 acl->verb);
3309 break;
3310 }
3311
3312 /* Pass to the next ACL item */
3313
3314 acl = acl->next;
3315 }
3316
3317/* We have reached the end of the ACL. This is an implicit DENY. */
3318
3319HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
3320return FAIL;
3321}
3322
3323
3324/*************************************************
3325* Check access using an ACL *
3326*************************************************/
3327
3328/* This is the external interface for ACL checks. It sets up an address and the
3329expansions for $domain and $local_part when called after RCPT, then calls
3330acl_check_internal() to do the actual work.
3331
3332Arguments:
3333 where ACL_WHERE_xxxx indicating where called from
64ffc24f 3334 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH
3335 s the input string; NULL is the same as an empty ACL => DENY
3336 user_msgptr where to put a user error (for SMTP response)
3337 log_msgptr where to put a logging message (not for SMTP response)
3338
3339Returns: OK access is granted by an ACCEPT verb
3340 DISCARD access is granted by a DISCARD verb
3341 FAIL access is denied
3342 FAIL_DROP access is denied; drop the connection
3343 DEFER can't tell at the moment
3344 ERROR disaster
3345*/
3346
3347int
64ffc24f 3348acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH
3349 uschar **log_msgptr)
3350{
3351int rc;
3352address_item adb;
64ffc24f 3353address_item *addr = NULL;
059ec3d9
PH
3354
3355*user_msgptr = *log_msgptr = NULL;
3356sender_verified_failed = NULL;
fe0dab11 3357ratelimiters_cmd = NULL;
059ec3d9
PH
3358
3359if (where == ACL_WHERE_RCPT)
3360 {
3361 adb = address_defaults;
3362 addr = &adb;
64ffc24f 3363 addr->address = recipient;
059ec3d9
PH
3364 if (deliver_split_address(addr) == DEFER)
3365 {
3366 *log_msgptr = US"defer in percent_hack_domains check";
3367 return DEFER;
3368 }
3369 deliver_domain = addr->domain;
3370 deliver_localpart = addr->local_part;
3371 }
059ec3d9
PH
3372
3373rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
3374
64ffc24f
PH
3375deliver_domain = deliver_localpart = deliver_address_data =
3376 sender_address_data = NULL;
059ec3d9
PH
3377
3378/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
3379ACL, which is really in the middle of an SMTP command. */
3380
3381if (rc == DISCARD)
3382 {
3383 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
3384 {
3385 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
3386 "ACL", acl_wherenames[where]);
3387 return ERROR;
3388 }
3389 return DISCARD;
3390 }
3391
3392/* A DROP response is not permitted from MAILAUTH */
3393
3394if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
3395 {
3396 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
3397 "ACL", acl_wherenames[where]);
3398 return ERROR;
3399 }
3400
3401/* Before giving an error response, take a look at the length of any user
3402message, and split it up into multiple lines if possible. */
3403
3404if (rc != OK && *user_msgptr != NULL && Ustrlen(*user_msgptr) > 75)
3405 {
3406 uschar *s = *user_msgptr = string_copy(*user_msgptr);
3407 uschar *ss = s;
3408
3409 for (;;)
3410 {
3411 int i = 0;
3412 while (i < 75 && *ss != 0 && *ss != '\n') ss++, i++;
3413 if (*ss == 0) break;
3414 if (*ss == '\n')
3415 s = ++ss;
3416 else
3417 {
3418 uschar *t = ss + 1;
3419 uschar *tt = NULL;
3420 while (--t > s + 35)
3421 {
3422 if (*t == ' ')
3423 {
3424 if (t[-1] == ':') { tt = t; break; }
3425 if (tt == NULL) tt = t;
3426 }
3427 }
3428
3429 if (tt == NULL) /* Can't split behind - try ahead */
3430 {
3431 t = ss + 1;
3432 while (*t != 0)
3433 {
3434 if (*t == ' ' || *t == '\n')
3435 { tt = t; break; }
3436 t++;
3437 }
3438 }
3439
3440 if (tt == NULL) break; /* Can't find anywhere to split */
3441 *tt = '\n';
3442 s = ss = tt+1;
3443 }
3444 }
3445 }
3446
3447return rc;
3448}
3449
3450/* End of acl.c */