exiwhat: Ensure the SIGUSR1 signal handler is safe.
[exim.git] / src / src / acl.c
CommitLineData
ed7f7860 1/* $Cambridge: exim/src/src/acl.c,v 1.88 2010/06/06 00:27:52 pdp Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
0a49a7a4 7/* Copyright (c) University of Cambridge 1995 - 2009 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Code for handling Access Control Lists (ACLs) */
11
12#include "exim.h"
13
14
15/* Default callout timeout */
16
17#define CALLOUT_TIMEOUT_DEFAULT 30
18
19/* ACL verb codes - keep in step with the table of verbs that follows */
20
21enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
22 ACL_WARN };
23
24/* ACL verbs */
25
26static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
28 US"warn" };
29
4e88a19f
PH
30/* For each verb, the conditions for which "message" or "log_message" are used
31are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
32"accept", the FAIL case is used only after "endpass", but that is selected in
33the code. */
34
35static int msgcond[] = {
36 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
37 (1<<OK), /* defer */
38 (1<<OK), /* deny */
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
40 (1<<OK), /* drop */
41 (1<<FAIL) | (1<<FAIL_DROP), /* require */
42 (1<<OK) /* warn */
43 };
059ec3d9
PH
44
45/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH
46follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
47down. */
059ec3d9 48
71fafd95
PH
49enum { ACLC_ACL,
50 ACLC_ADD_HEADER,
51 ACLC_AUTHENTICATED,
8523533c
TK
52#ifdef EXPERIMENTAL_BRIGHTMAIL
53 ACLC_BMI_OPTIN,
54#endif
71fafd95 55 ACLC_CONDITION,
c3611384 56 ACLC_CONTINUE,
71fafd95 57 ACLC_CONTROL,
6a8f9482
TK
58#ifdef EXPERIMENTAL_DCC
59 ACLC_DCC,
60#endif
8523533c
TK
61#ifdef WITH_CONTENT_SCAN
62 ACLC_DECODE,
63#endif
64 ACLC_DELAY,
65#ifdef WITH_OLD_DEMIME
66 ACLC_DEMIME,
8e669ac1 67#endif
80a47a2c
TK
68#ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
fb2274d4 71#endif
71fafd95
PH
72 ACLC_DNSLISTS,
73 ACLC_DOMAINS,
74 ACLC_ENCRYPTED,
75 ACLC_ENDPASS,
76 ACLC_HOSTS,
77 ACLC_LOCAL_PARTS,
78 ACLC_LOG_MESSAGE,
6ea85e9a 79 ACLC_LOG_REJECT_TARGET,
71fafd95 80 ACLC_LOGWRITE,
8523533c
TK
81#ifdef WITH_CONTENT_SCAN
82 ACLC_MALWARE,
83#endif
84 ACLC_MESSAGE,
85#ifdef WITH_CONTENT_SCAN
86 ACLC_MIME_REGEX,
87#endif
870f6ba8 88 ACLC_RATELIMIT,
8523533c
TK
89 ACLC_RECIPIENTS,
90#ifdef WITH_CONTENT_SCAN
91 ACLC_REGEX,
92#endif
71fafd95
PH
93 ACLC_SENDER_DOMAINS,
94 ACLC_SENDERS,
95 ACLC_SET,
8523533c 96#ifdef WITH_CONTENT_SCAN
8e669ac1 97 ACLC_SPAM,
8523533c
TK
98#endif
99#ifdef EXPERIMENTAL_SPF
100 ACLC_SPF,
65a7d8c3 101 ACLC_SPF_GUESS,
8523533c
TK
102#endif
103 ACLC_VERIFY };
059ec3d9 104
c3611384
PH
105/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
106"message", "log_message", "log_reject_target", "logwrite", and "set" are
107modifiers that look like conditions but always return TRUE. They are used for
108their side effects. */
059ec3d9 109
9a26b6b2
PH
110static uschar *conditions[] = {
111 US"acl",
71fafd95 112 US"add_header",
9a26b6b2 113 US"authenticated",
8523533c
TK
114#ifdef EXPERIMENTAL_BRIGHTMAIL
115 US"bmi_optin",
116#endif
117 US"condition",
c3611384 118 US"continue",
8e669ac1 119 US"control",
6a8f9482
TK
120#ifdef EXPERIMENTAL_DCC
121 US"dcc",
122#endif
8523533c
TK
123#ifdef WITH_CONTENT_SCAN
124 US"decode",
125#endif
126 US"delay",
127#ifdef WITH_OLD_DEMIME
128 US"demime",
129#endif
80a47a2c
TK
130#ifndef DISABLE_DKIM
131 US"dkim_signers",
132 US"dkim_status",
fb2274d4 133#endif
6ea85e9a
PH
134 US"dnslists",
135 US"domains",
136 US"encrypted",
137 US"endpass",
138 US"hosts",
139 US"local_parts",
140 US"log_message",
141 US"log_reject_target",
142 US"logwrite",
8523533c
TK
143#ifdef WITH_CONTENT_SCAN
144 US"malware",
145#endif
146 US"message",
147#ifdef WITH_CONTENT_SCAN
148 US"mime_regex",
149#endif
870f6ba8 150 US"ratelimit",
8523533c
TK
151 US"recipients",
152#ifdef WITH_CONTENT_SCAN
153 US"regex",
154#endif
155 US"sender_domains", US"senders", US"set",
156#ifdef WITH_CONTENT_SCAN
157 US"spam",
158#endif
159#ifdef EXPERIMENTAL_SPF
160 US"spf",
65a7d8c3 161 US"spf_guess",
8523533c 162#endif
059ec3d9 163 US"verify" };
8e669ac1 164
c5fcb476 165
9a26b6b2
PH
166/* Return values from decode_control(); keep in step with the table of names
167that follows! */
168
169enum {
c46782ef
PH
170 CONTROL_AUTH_UNADVERTISED,
171 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 172 CONTROL_BMI_RUN,
c46782ef 173 #endif
ed7f7860 174 CONTROL_DEBUG,
80a47a2c 175 #ifndef DISABLE_DKIM
f7572e5a
TK
176 CONTROL_DKIM_VERIFY,
177 #endif
c46782ef
PH
178 CONTROL_ERROR,
179 CONTROL_CASEFUL_LOCAL_PART,
180 CONTROL_CASELOWER_LOCAL_PART,
181 CONTROL_ENFORCE_SYNC,
182 CONTROL_NO_ENFORCE_SYNC,
183 CONTROL_FREEZE,
184 CONTROL_QUEUE_ONLY,
185 CONTROL_SUBMISSION,
186 CONTROL_SUPPRESS_LOCAL_FIXUPS,
187 #ifdef WITH_CONTENT_SCAN
9a26b6b2 188 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH
189 #endif
190 CONTROL_FAKEDEFER,
191 CONTROL_FAKEREJECT,
cf8b11a5 192 CONTROL_NO_MULTILINE,
047bdd8c 193 CONTROL_NO_PIPELINING,
4c590bd1
PH
194 CONTROL_NO_DELAY_FLUSH,
195 CONTROL_NO_CALLOUT_FLUSH
c46782ef 196};
9a26b6b2 197
8800895a
PH
198/* ACL control names; keep in step with the table above! This list is used for
199turning ids into names. The actual list of recognized names is in the variable
200control_def controls_list[] below. The fact that there are two lists is a mess
201and should be tidied up. */
9a26b6b2
PH
202
203static uschar *controls[] = {
c46782ef 204 US"allow_auth_unadvertised",
9a26b6b2
PH
205 #ifdef EXPERIMENTAL_BRIGHTMAIL
206 US"bmi_run",
207 #endif
ed7f7860 208 US"debug",
80a47a2c
TK
209 #ifndef DISABLE_DKIM
210 US"dkim_disable_verify",
f7572e5a 211 #endif
c46782ef
PH
212 US"error",
213 US"caseful_local_part",
214 US"caselower_local_part",
215 US"enforce_sync",
216 US"no_enforce_sync",
217 US"freeze",
218 US"queue_only",
219 US"submission",
220 US"suppress_local_fixups",
9a26b6b2
PH
221 #ifdef WITH_CONTENT_SCAN
222 US"no_mbox_unspool",
223 #endif
cf8b11a5
PH
224 US"fakedefer",
225 US"fakereject",
aa6dc513 226 US"no_multiline_responses",
cf8b11a5 227 US"no_pipelining",
4c590bd1
PH
228 US"no_delay_flush",
229 US"no_callout_flush"
c46782ef 230};
059ec3d9 231
047bdd8c 232/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH
233at the outer level. In the other cases, expansion already occurs in the
234checking functions. */
235
236static uschar cond_expand_at_top[] = {
237 TRUE, /* acl */
3e536984 238 TRUE, /* add_header */
059ec3d9 239 FALSE, /* authenticated */
8523533c
TK
240#ifdef EXPERIMENTAL_BRIGHTMAIL
241 TRUE, /* bmi_optin */
8e669ac1 242#endif
059ec3d9 243 TRUE, /* condition */
c3611384 244 TRUE, /* continue */
059ec3d9 245 TRUE, /* control */
6a8f9482
TK
246#ifdef EXPERIMENTAL_DCC
247 TRUE, /* dcc */
248#endif
8523533c
TK
249#ifdef WITH_CONTENT_SCAN
250 TRUE, /* decode */
251#endif
059ec3d9 252 TRUE, /* delay */
8523533c
TK
253#ifdef WITH_OLD_DEMIME
254 TRUE, /* demime */
255#endif
80a47a2c
TK
256#ifndef DISABLE_DKIM
257 TRUE, /* dkim_signers */
258 TRUE, /* dkim_status */
fb2274d4 259#endif
059ec3d9
PH
260 TRUE, /* dnslists */
261 FALSE, /* domains */
262 FALSE, /* encrypted */
263 TRUE, /* endpass */
264 FALSE, /* hosts */
265 FALSE, /* local_parts */
266 TRUE, /* log_message */
6ea85e9a 267 TRUE, /* log_reject_target */
059ec3d9 268 TRUE, /* logwrite */
8523533c
TK
269#ifdef WITH_CONTENT_SCAN
270 TRUE, /* malware */
271#endif
059ec3d9 272 TRUE, /* message */
8523533c
TK
273#ifdef WITH_CONTENT_SCAN
274 TRUE, /* mime_regex */
275#endif
870f6ba8 276 TRUE, /* ratelimit */
059ec3d9 277 FALSE, /* recipients */
8523533c
TK
278#ifdef WITH_CONTENT_SCAN
279 TRUE, /* regex */
280#endif
059ec3d9
PH
281 FALSE, /* sender_domains */
282 FALSE, /* senders */
283 TRUE, /* set */
8523533c
TK
284#ifdef WITH_CONTENT_SCAN
285 TRUE, /* spam */
286#endif
287#ifdef EXPERIMENTAL_SPF
288 TRUE, /* spf */
65a7d8c3 289 TRUE, /* spf_guess */
8523533c 290#endif
059ec3d9
PH
291 TRUE /* verify */
292};
293
294/* Flags to identify the modifiers */
295
296static uschar cond_modifiers[] = {
297 FALSE, /* acl */
3e536984 298 TRUE, /* add_header */
059ec3d9 299 FALSE, /* authenticated */
8523533c
TK
300#ifdef EXPERIMENTAL_BRIGHTMAIL
301 TRUE, /* bmi_optin */
8e669ac1 302#endif
059ec3d9 303 FALSE, /* condition */
c3611384 304 TRUE, /* continue */
059ec3d9 305 TRUE, /* control */
6a8f9482
TK
306#ifdef EXPERIMENTAL_DCC
307 FALSE, /* dcc */
308#endif
8523533c
TK
309#ifdef WITH_CONTENT_SCAN
310 FALSE, /* decode */
311#endif
059ec3d9 312 TRUE, /* delay */
8523533c
TK
313#ifdef WITH_OLD_DEMIME
314 FALSE, /* demime */
315#endif
80a47a2c
TK
316#ifndef DISABLE_DKIM
317 FALSE, /* dkim_signers */
318 FALSE, /* dkim_status */
fb2274d4 319#endif
059ec3d9
PH
320 FALSE, /* dnslists */
321 FALSE, /* domains */
322 FALSE, /* encrypted */
323 TRUE, /* endpass */
324 FALSE, /* hosts */
325 FALSE, /* local_parts */
326 TRUE, /* log_message */
6ea85e9a 327 TRUE, /* log_reject_target */
8523533c
TK
328 TRUE, /* logwrite */
329#ifdef WITH_CONTENT_SCAN
330 FALSE, /* malware */
331#endif
059ec3d9 332 TRUE, /* message */
8523533c
TK
333#ifdef WITH_CONTENT_SCAN
334 FALSE, /* mime_regex */
335#endif
870f6ba8 336 FALSE, /* ratelimit */
059ec3d9 337 FALSE, /* recipients */
8523533c
TK
338#ifdef WITH_CONTENT_SCAN
339 FALSE, /* regex */
340#endif
059ec3d9
PH
341 FALSE, /* sender_domains */
342 FALSE, /* senders */
343 TRUE, /* set */
8523533c
TK
344#ifdef WITH_CONTENT_SCAN
345 FALSE, /* spam */
346#endif
347#ifdef EXPERIMENTAL_SPF
348 FALSE, /* spf */
65a7d8c3 349 FALSE, /* spf_guess */
8523533c 350#endif
059ec3d9
PH
351 FALSE /* verify */
352};
353
c3611384 354/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH
355times. For each condition and modifier, there's a bitmap of dis-allowed times.
356For some, it is easier to specify the negation of a small number of allowed
357times. */
059ec3d9
PH
358
359static unsigned int cond_forbids[] = {
360 0, /* acl */
8e669ac1 361
71fafd95 362 (unsigned int)
45b91596 363 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 364 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
45b91596 365 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 366 (1<<ACL_WHERE_DKIM)|
45b91596 367 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 368
45b91596
PH
369 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
370 (1<<ACL_WHERE_NOTSMTP_START)|
371 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 372
71fafd95 373 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 374 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
375 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
376 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8e669ac1 377 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
378 (1<<ACL_WHERE_MAILAUTH)|
379 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH
380 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
381 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 382 #endif
8e669ac1 383
059ec3d9 384 0, /* condition */
8e669ac1 385
c3611384
PH
386 0, /* continue */
387
059ec3d9 388 /* Certain types of control are always allowed, so we let it through
2f079f46 389 always and check in the control processing itself. */
8e669ac1 390
059ec3d9 391 0, /* control */
8e669ac1 392
6a8f9482
TK
393 #ifdef EXPERIMENTAL_DCC
394 (unsigned int)
395 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* dcc */
396 #endif
397
71fafd95 398 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
399 (unsigned int)
400 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 401 #endif
8523533c 402
8f128379 403 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 404
71fafd95 405 #ifdef WITH_OLD_DEMIME
2f079f46
PH
406 (unsigned int)
407 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* demime */
71fafd95 408 #endif
8e669ac1 409
80a47a2c
TK
410 #ifndef DISABLE_DKIM
411 (unsigned int)
412 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 413
80a47a2c
TK
414 (unsigned int)
415 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 416 #endif
fb2274d4 417
45b91596
PH
418 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
419 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 420
2f079f46
PH
421 (unsigned int)
422 ~(1<<ACL_WHERE_RCPT), /* domains */
059ec3d9 423
45b91596
PH
424 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
425 (1<<ACL_WHERE_CONNECT)|
426 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 427 (1<<ACL_WHERE_HELO),
8e669ac1 428
059ec3d9 429 0, /* endpass */
8e669ac1 430
45b91596
PH
431 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
432 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 433
2f079f46
PH
434 (unsigned int)
435 ~(1<<ACL_WHERE_RCPT), /* local_parts */
059ec3d9
PH
436
437 0, /* log_message */
8e669ac1 438
6ea85e9a
PH
439 0, /* log_reject_target */
440
059ec3d9 441 0, /* logwrite */
8e669ac1 442
71fafd95 443 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
444 (unsigned int)
445 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* malware */
71fafd95 446 #endif
8523533c 447
059ec3d9
PH
448 0, /* message */
449
71fafd95 450 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
451 (unsigned int)
452 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 453 #endif
8523533c 454
870f6ba8
TF
455 0, /* ratelimit */
456
2f079f46
PH
457 (unsigned int)
458 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 459
71fafd95 460 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
461 (unsigned int)
462 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* regex */
463 (1<<ACL_WHERE_MIME)),
71fafd95 464 #endif
8523533c 465
059ec3d9
PH
466 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
467 (1<<ACL_WHERE_HELO)|
468 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
469 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
470 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
471
472 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
473 (1<<ACL_WHERE_HELO)|
474 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
475 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
476 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
477
478 0, /* set */
479
71fafd95 480 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
481 (unsigned int)
482 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* spam */
71fafd95 483 #endif
8523533c 484
71fafd95 485 #ifdef EXPERIMENTAL_SPF
8523533c
TK
486 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
487 (1<<ACL_WHERE_HELO)|
488 (1<<ACL_WHERE_MAILAUTH)|
489 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH
490 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
491 (1<<ACL_WHERE_NOTSMTP)|
492 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM
493
494 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
495 (1<<ACL_WHERE_HELO)|
496 (1<<ACL_WHERE_MAILAUTH)|
497 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
498 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
499 (1<<ACL_WHERE_NOTSMTP)|
500 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 501 #endif
8523533c 502
059ec3d9
PH
503 /* Certain types of verify are always allowed, so we let it through
504 always and check in the verify function itself */
505
506 0 /* verify */
059ec3d9
PH
507};
508
509
c5fcb476
PH
510/* Bit map vector of which controls are not allowed at certain times. For
511each control, there's a bitmap of dis-allowed times. For some, it is easier to
512specify the negation of a small number of allowed times. */
513
514static unsigned int control_forbids[] = {
c46782ef
PH
515 (unsigned int)
516 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
517
518 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 519 0, /* bmi_run */
c46782ef
PH
520 #endif
521
ed7f7860
PP
522 0, /* debug */
523
80a47a2c
TK
524 #ifndef DISABLE_DKIM
525 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
f7572e5a
TK
526 (1<<ACL_WHERE_NOTSMTP_START),
527 #endif
528
c5fcb476 529 0, /* error */
8e669ac1
PH
530
531 (unsigned int)
c5fcb476 532 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
533
534 (unsigned int)
c5fcb476 535 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 536
45b91596
PH
537 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
538 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 539
45b91596
PH
540 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
541 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH
542
543 (unsigned int)
c5fcb476
PH
544 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
545 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 546 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
547
548 (unsigned int)
c5fcb476
PH
549 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
550 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 551 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
552
553 (unsigned int)
c5fcb476 554 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 555 (1<<ACL_WHERE_PREDATA)),
8523533c 556
8800895a
PH
557 (unsigned int)
558 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH
559 (1<<ACL_WHERE_PREDATA)|
560 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 561
c46782ef 562 #ifdef WITH_CONTENT_SCAN
8e669ac1 563 (unsigned int)
14d57970 564 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22
TK
565 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
566 (1<<ACL_WHERE_MIME)),
c46782ef 567 #endif
a6c4ab60 568
8e669ac1 569 (unsigned int)
29aba418
TF
570 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
571 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
572 (1<<ACL_WHERE_MIME)),
573
574 (unsigned int)
a6c4ab60 575 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22
TK
576 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
577 (1<<ACL_WHERE_MIME)),
8523533c 578
45b91596 579 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH
580 (1<<ACL_WHERE_NOTSMTP_START),
581
582 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH
583 (1<<ACL_WHERE_NOTSMTP_START),
584
585 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH
586 (1<<ACL_WHERE_NOTSMTP_START),
587
588 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 589 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH
590};
591
592/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
593
594typedef struct control_def {
595 uschar *name;
596 int value; /* CONTROL_xxx value */
059ec3d9
PH
597 BOOL has_option; /* Has /option(s) following */
598} control_def;
599
600static control_def controls_list[] = {
c46782ef 601 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 602#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 603 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
8523533c 604#endif
ed7f7860 605 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c
TK
606#ifndef DISABLE_DKIM
607 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
f7572e5a 608#endif
c46782ef
PH
609 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
610 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
611 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
612 { US"freeze", CONTROL_FREEZE, TRUE },
4c590bd1 613 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
047bdd8c 614 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
c46782ef
PH
615 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
616 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
cf8b11a5 617 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
c46782ef 618 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 619#ifdef WITH_CONTENT_SCAN
c46782ef 620 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 621#endif
c46782ef
PH
622 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
623 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
624 { US"submission", CONTROL_SUBMISSION, TRUE },
625 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE }
059ec3d9
PH
626 };
627
e5a9dba6
PH
628/* Support data structures for Client SMTP Authorization. acl_verify_csa()
629caches its result in a tree to avoid repeated DNS queries. The result is an
630integer code which is used as an index into the following tables of
631explanatory strings and verification return codes. */
632
633static tree_node *csa_cache = NULL;
634
635enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
636 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
637
638/* The acl_verify_csa() return code is translated into an acl_verify() return
639code using the following table. It is OK unless the client is definitely not
640authorized. This is because CSA is supposed to be optional for sending sites,
641so recipients should not be too strict about checking it - especially because
642DNS problems are quite likely to occur. It's possible to use $csa_status in
643further ACL conditions to distinguish ok, unknown, and defer if required, but
644the aim is to make the usual configuration simple. */
645
646static int csa_return_code[] = {
647 OK, OK, OK, OK,
648 FAIL, FAIL, FAIL, FAIL
649};
650
651static uschar *csa_status_string[] = {
652 US"unknown", US"ok", US"defer", US"defer",
653 US"fail", US"fail", US"fail", US"fail"
654};
655
656static uschar *csa_reason_string[] = {
657 US"unknown",
658 US"ok",
659 US"deferred (SRV lookup failed)",
660 US"deferred (target address lookup failed)",
661 US"failed (explicit authorization required)",
662 US"failed (host name not authorized)",
663 US"failed (no authorized addresses)",
664 US"failed (client address mismatch)"
665};
666
059ec3d9
PH
667/* Enable recursion between acl_check_internal() and acl_check_condition() */
668
669static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
670 uschar **);
671
672
673/*************************************************
674* Pick out name from list *
675*************************************************/
676
677/* Use a binary chop method
678
679Arguments:
680 name name to find
681 list list of names
682 end size of list
683
684Returns: offset in list, or -1 if not found
685*/
686
687static int
688acl_checkname(uschar *name, uschar **list, int end)
689{
690int start = 0;
691
692while (start < end)
693 {
694 int mid = (start + end)/2;
695 int c = Ustrcmp(name, list[mid]);
696 if (c == 0) return mid;
697 if (c < 0) end = mid; else start = mid + 1;
698 }
699
700return -1;
701}
702
703
704/*************************************************
705* Read and parse one ACL *
706*************************************************/
707
708/* This function is called both from readconf in order to parse the ACLs in the
709configuration file, and also when an ACL is encountered dynamically (e.g. as
710the result of an expansion). It is given a function to call in order to
711retrieve the lines of the ACL. This function handles skipping comments and
712blank lines (where relevant).
713
714Arguments:
715 func function to get next line of ACL
716 error where to put an error message
717
718Returns: pointer to ACL, or NULL
719 NULL can be legal (empty ACL); in this case error will be NULL
720*/
721
722acl_block *
723acl_read(uschar *(*func)(void), uschar **error)
724{
725acl_block *yield = NULL;
726acl_block **lastp = &yield;
727acl_block *this = NULL;
728acl_condition_block *cond;
729acl_condition_block **condp = NULL;
730uschar *s;
731
732*error = NULL;
733
734while ((s = (*func)()) != NULL)
735 {
736 int v, c;
737 BOOL negated = FALSE;
738 uschar *saveline = s;
739 uschar name[64];
740
741 /* Conditions (but not verbs) are allowed to be negated by an initial
742 exclamation mark. */
743
744 while (isspace(*s)) s++;
745 if (*s == '!')
746 {
747 negated = TRUE;
748 s++;
749 }
750
cf00dad6
PH
751 /* Read the name of a verb or a condition, or the start of a new ACL, which
752 can be started by a name, or by a macro definition. */
059ec3d9
PH
753
754 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 755 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
756
757 /* If a verb is unrecognized, it may be another condition or modifier that
758 continues the previous verb. */
759
760 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
761 if (v < 0)
762 {
763 if (this == NULL)
764 {
4e167a8c
PH
765 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
766 saveline);
059ec3d9
PH
767 return NULL;
768 }
769 }
770
771 /* New verb */
772
773 else
774 {
775 if (negated)
776 {
777 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
778 return NULL;
779 }
780 this = store_get(sizeof(acl_block));
781 *lastp = this;
782 lastp = &(this->next);
783 this->next = NULL;
784 this->verb = v;
785 this->condition = NULL;
786 condp = &(this->condition);
787 if (*s == 0) continue; /* No condition on this line */
788 if (*s == '!')
789 {
790 negated = TRUE;
791 s++;
792 }
793 s = readconf_readname(name, sizeof(name), s); /* Condition name */
794 }
795
796 /* Handle a condition or modifier. */
797
798 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
799 if (c < 0)
800 {
801 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
802 saveline);
803 return NULL;
804 }
805
806 /* The modifiers may not be negated */
807
808 if (negated && cond_modifiers[c])
809 {
810 *error = string_sprintf("ACL error: negation is not allowed with "
811 "\"%s\"", conditions[c]);
812 return NULL;
813 }
814
815 /* ENDPASS may occur only with ACCEPT or DISCARD. */
816
817 if (c == ACLC_ENDPASS &&
818 this->verb != ACL_ACCEPT &&
819 this->verb != ACL_DISCARD)
820 {
821 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
822 conditions[c], verbs[this->verb]);
823 return NULL;
824 }
825
826 cond = store_get(sizeof(acl_condition_block));
827 cond->next = NULL;
828 cond->type = c;
829 cond->u.negated = negated;
830
831 *condp = cond;
832 condp = &(cond->next);
833
834 /* The "set" modifier is different in that its argument is "name=value"
835 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
836 gives us a variable name to insert into the data block. The original ACL
837 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
838 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
839 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
840 After that, we allow alphanumerics and underscores, but the first character
841 after c or m must be a digit or an underscore. This retains backwards
842 compatibility. */
059ec3d9
PH
843
844 if (c == ACLC_SET)
845 {
47ca6d6c
PH
846 uschar *endptr;
847
38a0a95f
PH
848 if (Ustrncmp(s, "acl_c", 5) != 0 &&
849 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 850 {
38a0a95f
PH
851 *error = string_sprintf("invalid variable name after \"set\" in ACL "
852 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
853 return NULL;
47ca6d6c 854 }
38a0a95f
PH
855
856 endptr = s + 5;
641cb756
PH
857 if (!isdigit(*endptr) && *endptr != '_')
858 {
859 *error = string_sprintf("invalid variable name after \"set\" in ACL "
860 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
861 s);
862 return NULL;
863 }
864
38a0a95f 865 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 866 {
38a0a95f
PH
867 if (!isalnum(*endptr) && *endptr != '_')
868 {
869 *error = string_sprintf("invalid character \"%c\" in variable name "
870 "in ACL modifier \"set %s\"", *endptr, s);
871 return NULL;
872 }
873 endptr++;
47ca6d6c 874 }
47ca6d6c 875
38a0a95f 876 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 877 s = endptr;
059ec3d9
PH
878 while (isspace(*s)) s++;
879 }
880
881 /* For "set", we are now positioned for the data. For the others, only
882 "endpass" has no data */
883
884 if (c != ACLC_ENDPASS)
885 {
886 if (*s++ != '=')
887 {
888 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
889 cond_modifiers[c]? US"modifier" : US"condition");
890 return NULL;
891 }
892 while (isspace(*s)) s++;
893 cond->arg = string_copy(s);
894 }
895 }
896
897return yield;
898}
899
900
901
902/*************************************************
71fafd95
PH
903* Set up added header line(s) *
904*************************************************/
905
906/* This function is called by the add_header modifier, and also from acl_warn()
907to implement the now-deprecated way of adding header lines using "message" on a
908"warn" verb. The argument is treated as a sequence of header lines which are
909added to a chain, provided there isn't an identical one already there.
910
911Argument: string of header lines
912Returns: nothing
913*/
914
915static void
916setup_header(uschar *hstring)
917{
918uschar *p, *q;
919int hlen = Ustrlen(hstring);
920
921/* An empty string does nothing; otherwise add a final newline if necessary. */
922
923if (hlen <= 0) return;
924if (hstring[hlen-1] != '\n') hstring = string_sprintf("%s\n", hstring);
925
926/* Loop for multiple header lines, taking care about continuations */
927
928for (p = q = hstring; *p != 0; )
929 {
930 uschar *s;
931 int newtype = htype_add_bot;
932 header_line **hptr = &acl_added_headers;
933
934 /* Find next header line within the string */
935
936 for (;;)
937 {
938 q = Ustrchr(q, '\n');
939 if (*(++q) != ' ' && *q != '\t') break;
940 }
941
942 /* If the line starts with a colon, interpret the instruction for where to
943 add it. This temporarily sets up a new type. */
944
945 if (*p == ':')
946 {
947 if (strncmpic(p, US":after_received:", 16) == 0)
948 {
949 newtype = htype_add_rec;
950 p += 16;
951 }
952 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
953 {
954 newtype = htype_add_rfc;
955 p += 14;
956 }
957 else if (strncmpic(p, US":at_start:", 10) == 0)
958 {
959 newtype = htype_add_top;
960 p += 10;
961 }
962 else if (strncmpic(p, US":at_end:", 8) == 0)
963 {
964 newtype = htype_add_bot;
965 p += 8;
966 }
967 while (*p == ' ' || *p == '\t') p++;
968 }
969
970 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
971 to the front of it. */
972
973 for (s = p; s < q - 1; s++)
974 {
975 if (*s == ':' || !isgraph(*s)) break;
976 }
977
978 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
979 hlen = Ustrlen(s);
980
981 /* See if this line has already been added */
982
983 while (*hptr != NULL)
984 {
985 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
986 hptr = &((*hptr)->next);
987 }
988
989 /* Add if not previously present */
990
991 if (*hptr == NULL)
992 {
993 header_line *h = store_get(sizeof(header_line));
994 h->text = s;
995 h->next = NULL;
996 h->type = newtype;
997 h->slen = hlen;
998 *hptr = h;
999 hptr = &(h->next);
1000 }
1001
1002 /* Advance for next header line within the string */
1003
1004 p = q;
1005 }
1006}
1007
1008
1009
1010
1011/*************************************************
059ec3d9
PH
1012* Handle warnings *
1013*************************************************/
1014
1015/* This function is called when a WARN verb's conditions are true. It adds to
1016the message's headers, and/or writes information to the log. In each case, this
1017only happens once (per message for headers, per connection for log).
1018
71fafd95
PH
1019** NOTE: The header adding action using the "message" setting is historic, and
1020its use is now deprecated. The new add_header modifier should be used instead.
1021
059ec3d9
PH
1022Arguments:
1023 where ACL_WHERE_xxxx indicating which ACL this is
1024 user_message message for adding to headers
1025 log_message message for logging, if different
1026
1027Returns: nothing
1028*/
1029
1030static void
1031acl_warn(int where, uschar *user_message, uschar *log_message)
1032{
059ec3d9
PH
1033if (log_message != NULL && log_message != user_message)
1034 {
1035 uschar *text;
1036 string_item *logged;
1037
1038 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1039 string_printing(log_message));
1040
1041 /* If a sender verification has failed, and the log message is "sender verify
1042 failed", add the failure message. */
1043
1044 if (sender_verified_failed != NULL &&
1045 sender_verified_failed->message != NULL &&
1046 strcmpic(log_message, US"sender verify failed") == 0)
1047 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1048
9c7a242c
PH
1049 /* Search previously logged warnings. They are kept in malloc
1050 store so they can be freed at the start of a new message. */
059ec3d9
PH
1051
1052 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1053 if (Ustrcmp(logged->text, text) == 0) break;
1054
1055 if (logged == NULL)
1056 {
1057 int length = Ustrlen(text) + 1;
1058 log_write(0, LOG_MAIN, "%s", text);
1059 logged = store_malloc(sizeof(string_item) + length);
1060 logged->text = (uschar *)logged + sizeof(string_item);
1061 memcpy(logged->text, text, length);
1062 logged->next = acl_warn_logged;
1063 acl_warn_logged = logged;
1064 }
1065 }
1066
1067/* If there's no user message, we are done. */
1068
1069if (user_message == NULL) return;
1070
1071/* If this isn't a message ACL, we can't do anything with a user message.
1072Log an error. */
1073
1074if (where > ACL_WHERE_NOTSMTP)
1075 {
1076 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1077 "found in a non-message (%s) ACL: cannot specify header lines here: "
1078 "message ignored", acl_wherenames[where]);
1079 return;
1080 }
1081
71fafd95
PH
1082/* The code for setting up header lines is now abstracted into a separate
1083function so that it can be used for the add_header modifier as well. */
059ec3d9 1084
71fafd95 1085setup_header(user_message);
059ec3d9
PH
1086}
1087
1088
1089
1090/*************************************************
1091* Verify and check reverse DNS *
1092*************************************************/
1093
1094/* Called from acl_verify() below. We look up the host name(s) of the client IP
1095address if this has not yet been done. The host_name_lookup() function checks
1096that one of these names resolves to an address list that contains the client IP
1097address, so we don't actually have to do the check here.
1098
1099Arguments:
1100 user_msgptr pointer for user message
1101 log_msgptr pointer for log message
1102
1103Returns: OK verification condition succeeded
1104 FAIL verification failed
1105 DEFER there was a problem verifying
1106*/
1107
1108static int
1109acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1110{
1111int rc;
1112
1113user_msgptr = user_msgptr; /* stop compiler warning */
1114
1115/* Previous success */
1116
1117if (sender_host_name != NULL) return OK;
1118
1119/* Previous failure */
1120
1121if (host_lookup_failed)
1122 {
1123 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1124 return FAIL;
1125 }
1126
1127/* Need to do a lookup */
1128
1129HDEBUG(D_acl)
1130 debug_printf("looking up host name to force name/address consistency check\n");
1131
1132if ((rc = host_name_lookup()) != OK)
1133 {
1134 *log_msgptr = (rc == DEFER)?
1135 US"host lookup deferred for reverse lookup check"
1136 :
1137 string_sprintf("host lookup failed for reverse lookup check%s",
1138 host_lookup_msg);
1139 return rc; /* DEFER or FAIL */
1140 }
1141
1142host_build_sender_fullhost();
1143return OK;
1144}
1145
1146
1147
1148/*************************************************
e5a9dba6
PH
1149* Check client IP address matches CSA target *
1150*************************************************/
1151
1152/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1153response for address records belonging to the CSA target hostname. The section
1154is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1155If one of the addresses matches the client's IP address, then the client is
1156authorized by CSA. If there are target IP addresses but none of them match
1157then the client is using an unauthorized IP address. If there are no target IP
1158addresses then the client cannot be using an authorized IP address. (This is
1159an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1160
1161Arguments:
1162 dnsa the DNS answer block
1163 dnss a DNS scan block for us to use
1164 reset option specifing what portion to scan, as described above
1165 target the target hostname to use for matching RR names
1166
1167Returns: CSA_OK successfully authorized
1168 CSA_FAIL_MISMATCH addresses found but none matched
1169 CSA_FAIL_NOADDR no target addresses found
1170*/
1171
1172static int
1173acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1174 uschar *target)
1175{
1176dns_record *rr;
1177dns_address *da;
1178
1179BOOL target_found = FALSE;
1180
1181for (rr = dns_next_rr(dnsa, dnss, reset);
1182 rr != NULL;
1183 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1184 {
1185 /* Check this is an address RR for the target hostname. */
1186
1187 if (rr->type != T_A
1188 #if HAVE_IPV6
1189 && rr->type != T_AAAA
1190 #ifdef SUPPORT_A6
1191 && rr->type != T_A6
1192 #endif
1193 #endif
1194 ) continue;
1195
1196 if (strcmpic(target, rr->name) != 0) continue;
1197
1198 target_found = TRUE;
1199
1200 /* Turn the target address RR into a list of textual IP addresses and scan
1201 the list. There may be more than one if it is an A6 RR. */
1202
1203 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1204 {
1205 /* If the client IP address matches the target IP address, it's good! */
1206
1207 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1208
1209 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1210 }
1211 }
1212
1213/* If we found some target addresses but none of them matched, the client is
1214using an unauthorized IP address, otherwise the target has no authorized IP
1215addresses. */
1216
1217if (target_found) return CSA_FAIL_MISMATCH;
1218else return CSA_FAIL_NOADDR;
1219}
1220
1221
1222
1223/*************************************************
1224* Verify Client SMTP Authorization *
1225*************************************************/
1226
1227/* Called from acl_verify() below. This routine calls dns_lookup_special()
1228to find the CSA SRV record corresponding to the domain argument, or
1229$sender_helo_name if no argument is provided. It then checks that the
1230client is authorized, and that its IP address corresponds to the SRV
1231target's address by calling acl_verify_csa_address() above. The address
1232should have been returned in the DNS response's ADDITIONAL section, but if
1233not we perform another DNS lookup to get it.
1234
1235Arguments:
1236 domain pointer to optional parameter following verify = csa
1237
1238Returns: CSA_UNKNOWN no valid CSA record found
1239 CSA_OK successfully authorized
1240 CSA_FAIL_* client is definitely not authorized
1241 CSA_DEFER_* there was a DNS problem
1242*/
1243
1244static int
1245acl_verify_csa(uschar *domain)
1246{
1247tree_node *t;
1248uschar *found, *p;
1249int priority, weight, port;
1250dns_answer dnsa;
1251dns_scan dnss;
1252dns_record *rr;
1253int rc, type;
1254uschar target[256];
1255
1256/* Work out the domain we are using for the CSA lookup. The default is the
1257client's HELO domain. If the client has not said HELO, use its IP address
1258instead. If it's a local client (exim -bs), CSA isn't applicable. */
1259
1260while (isspace(*domain) && *domain != '\0') ++domain;
1261if (*domain == '\0') domain = sender_helo_name;
1262if (domain == NULL) domain = sender_host_address;
1263if (sender_host_address == NULL) return CSA_UNKNOWN;
1264
1265/* If we have an address literal, strip off the framing ready for turning it
1266into a domain. The framing consists of matched square brackets possibly
1267containing a keyword and a colon before the actual IP address. */
1268
1269if (domain[0] == '[')
1270 {
1271 uschar *start = Ustrchr(domain, ':');
1272 if (start == NULL) start = domain;
1273 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1274 }
1275
1276/* Turn domains that look like bare IP addresses into domains in the reverse
1277DNS. This code also deals with address literals and $sender_host_address. It's
1278not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1279address literals, but it's probably the most friendly thing to do. This is an
1280extension to CSA, so we allow it to be turned off for proper conformance. */
1281
7e66e54d 1282if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1283 {
1284 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1285 dns_build_reverse(domain, target);
1286 domain = target;
1287 }
1288
1289/* Find out if we've already done the CSA check for this domain. If we have,
1290return the same result again. Otherwise build a new cached result structure
1291for this domain. The name is filled in now, and the value is filled in when
1292we return from this function. */
1293
1294t = tree_search(csa_cache, domain);
1295if (t != NULL) return t->data.val;
1296
1297t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1298Ustrcpy(t->name, domain);
1299(void)tree_insertnode(&csa_cache, t);
1300
1301/* Now we are ready to do the actual DNS lookup(s). */
1302
28e6ef29 1303found = domain;
e5a9dba6
PH
1304switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1305 {
1306 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1307
1308 default:
1309 return t->data.val = CSA_DEFER_SRV;
1310
1311 /* If we found nothing, the client's authorization is unknown. */
1312
1313 case DNS_NOMATCH:
1314 case DNS_NODATA:
1315 return t->data.val = CSA_UNKNOWN;
1316
1317 /* We got something! Go on to look at the reply in more detail. */
1318
1319 case DNS_SUCCEED:
1320 break;
1321 }
1322
1323/* Scan the reply for well-formed CSA SRV records. */
1324
1325for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1326 rr != NULL;
1327 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1328 {
1329 if (rr->type != T_SRV) continue;
1330
1331 /* Extract the numerical SRV fields (p is incremented) */
1332
1333 p = rr->data;
1334 GETSHORT(priority, p);
1335 GETSHORT(weight, p);
1336 GETSHORT(port, p);
1337
1338 DEBUG(D_acl)
1339 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1340
1341 /* Check the CSA version number */
1342
1343 if (priority != 1) continue;
1344
1345 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1346 found by dns_special_lookup() is a parent of the one we asked for), we check
1347 the subdomain assertions in the port field. At the moment there's only one
1348 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1349 SRV records of their own. */
1350
1351 if (found != domain)
1352 {
1353 if (port & 1)
1354 return t->data.val = CSA_FAIL_EXPLICIT;
1355 else
1356 return t->data.val = CSA_UNKNOWN;
1357 }
1358
1359 /* This CSA SRV record refers directly to our domain, so we check the value
1360 in the weight field to work out the domain's authorization. 0 and 1 are
1361 unauthorized; 3 means the client is authorized but we can't check the IP
1362 address in order to authenticate it, so we treat it as unknown; values
1363 greater than 3 are undefined. */
1364
1365 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1366
1367 if (weight > 2) continue;
1368
1369 /* Weight == 2, which means the domain is authorized. We must check that the
1370 client's IP address is listed as one of the SRV target addresses. Save the
1371 target hostname then break to scan the additional data for its addresses. */
1372
1373 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1374 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1375
1376 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1377
1378 break;
1379 }
1380
1381/* If we didn't break the loop then no appropriate records were found. */
1382
1383if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1384
1385/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1386A target of "." indicates there are no valid addresses, so the client cannot
1387be authorized. (This is an odd configuration because weight=2 target=. is
1388equivalent to weight=1, but we check for it in order to keep load off the
1389root name servers.) Note that dn_expand() turns "." into "". */
1390
1391if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1392
1393/* Scan the additional section of the CSA SRV reply for addresses belonging
1394to the target. If the name server didn't return any additional data (e.g.
1395because it does not fully support SRV records), we need to do another lookup
1396to obtain the target addresses; otherwise we have a definitive result. */
1397
1398rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1399if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1400
1401/* The DNS lookup type corresponds to the IP version used by the client. */
1402
1403#if HAVE_IPV6
1404if (Ustrchr(sender_host_address, ':') != NULL)
1405 type = T_AAAA;
1406else
1407#endif /* HAVE_IPV6 */
1408 type = T_A;
1409
1410
1411#if HAVE_IPV6 && defined(SUPPORT_A6)
1412DNS_LOOKUP_AGAIN:
1413#endif
1414
1415switch (dns_lookup(&dnsa, target, type, NULL))
1416 {
1417 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1418
1419 default:
1420 return t->data.val = CSA_DEFER_ADDR;
1421
1422 /* If the query succeeded, scan the addresses and return the result. */
1423
1424 case DNS_SUCCEED:
1425 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1426 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1427 /* else fall through */
1428
1429 /* If the target has no IP addresses, the client cannot have an authorized
1430 IP address. However, if the target site uses A6 records (not AAAA records)
1431 we have to do yet another lookup in order to check them. */
1432
1433 case DNS_NOMATCH:
1434 case DNS_NODATA:
1435
1436 #if HAVE_IPV6 && defined(SUPPORT_A6)
1437 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1438 #endif
1439
1440 return t->data.val = CSA_FAIL_NOADDR;
1441 }
1442}
1443
1444
1445
1446/*************************************************
059ec3d9
PH
1447* Handle verification (address & other) *
1448*************************************************/
1449
1450/* This function implements the "verify" condition. It is called when
1451encountered in any ACL, because some tests are almost always permitted. Some
1452just don't make sense, and always fail (for example, an attempt to test a host
1453lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1454
1455Arguments:
1456 where where called from
1457 addr the recipient address that the ACL is handling, or NULL
1458 arg the argument of "verify"
1459 user_msgptr pointer for user message
1460 log_msgptr pointer for log message
1461 basic_errno where to put verify errno
1462
1463Returns: OK verification condition succeeded
1464 FAIL verification failed
1465 DEFER there was a problem verifying
1466 ERROR syntax error
1467*/
1468
1469static int
1470acl_verify(int where, address_item *addr, uschar *arg,
1471 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1472{
1473int sep = '/';
1474int callout = -1;
1475int callout_overall = -1;
4deaf07d 1476int callout_connect = -1;
059ec3d9
PH
1477int verify_options = 0;
1478int rc;
1479BOOL verify_header_sender = FALSE;
1480BOOL defer_ok = FALSE;
1481BOOL callout_defer_ok = FALSE;
1482BOOL no_details = FALSE;
eafd343b 1483BOOL success_on_redirect = FALSE;
059ec3d9
PH
1484address_item *sender_vaddr = NULL;
1485uschar *verify_sender_address = NULL;
1486uschar *pm_mailfrom = NULL;
1487uschar *se_mailfrom = NULL;
596875b3
PH
1488
1489/* Some of the verify items have slash-separated options; some do not. Diagnose
1490an error if options are given for items that don't expect them. This code has
1491now got very message. Refactoring to use a table would be a good idea one day.
1492*/
1493
1494uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH
1495uschar *list = arg;
1496uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1497
1498if (ss == NULL) goto BAD_VERIFY;
1499
1500/* Handle name/address consistency verification in a separate function. */
1501
1502if (strcmpic(ss, US"reverse_host_lookup") == 0)
1503 {
596875b3 1504 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1505 if (sender_host_address == NULL) return OK;
1506 return acl_verify_reverse(user_msgptr, log_msgptr);
1507 }
1508
1509/* TLS certificate verification is done at STARTTLS time; here we just
1510test whether it was successful or not. (This is for optional verification; for
1511mandatory verification, the connection doesn't last this long.) */
1512
1513if (strcmpic(ss, US"certificate") == 0)
1514 {
596875b3 1515 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1516 if (tls_certificate_verified) return OK;
1517 *user_msgptr = US"no verified certificate";
1518 return FAIL;
1519 }
1520
d7b47fd0
PH
1521/* We can test the result of optional HELO verification that might have
1522occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1523
596875b3
PH
1524if (strcmpic(ss, US"helo") == 0)
1525 {
1526 if (slash != NULL) goto NO_OPTIONS;
0154e85a
TF
1527 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1528 return helo_verified? OK : FAIL;
596875b3 1529 }
059ec3d9 1530
e5a9dba6
PH
1531/* Do Client SMTP Authorization checks in a separate function, and turn the
1532result code into user-friendly strings. */
1533
1534if (strcmpic(ss, US"csa") == 0)
1535 {
1536 rc = acl_verify_csa(list);
1537 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1538 csa_reason_string[rc]);
1539 csa_status = csa_status_string[rc];
1540 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1541 return csa_return_code[rc];
1542 }
1543
596875b3
PH
1544/* Check that all relevant header lines have the correct syntax. If there is
1545a syntax error, we return details of the error to the sender if configured to
1546send out full details. (But a "message" setting on the ACL can override, as
1547always). */
059ec3d9 1548
596875b3 1549if (strcmpic(ss, US"header_syntax") == 0)
059ec3d9 1550 {
596875b3 1551 if (slash != NULL) goto NO_OPTIONS;
1c41c9cc 1552 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
596875b3
PH
1553 rc = verify_check_headers(log_msgptr);
1554 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1555 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1556 return rc;
1557 }
059ec3d9 1558
1c41c9cc
PH
1559/* Check that no recipient of this message is "blind", that is, every envelope
1560recipient must be mentioned in either To: or Cc:. */
1561
1562if (strcmpic(ss, US"not_blind") == 0)
1563 {
1564 if (slash != NULL) goto NO_OPTIONS;
1565 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
1566 rc = verify_check_notblind();
1567 if (rc != OK)
1568 {
1569 *log_msgptr = string_sprintf("bcc recipient detected");
1570 if (smtp_return_error_details)
1571 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1572 }
1573 return rc;
1574 }
059ec3d9 1575
596875b3
PH
1576/* The remaining verification tests check recipient and sender addresses,
1577either from the envelope or from the header. There are a number of
1578slash-separated options that are common to all of them. */
059ec3d9 1579
059ec3d9 1580
596875b3
PH
1581/* Check that there is at least one verifiable sender address in the relevant
1582header lines. This can be followed by callout and defer options, just like
1583sender and recipient. */
059ec3d9 1584
596875b3
PH
1585if (strcmpic(ss, US"header_sender") == 0)
1586 {
1c41c9cc 1587 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
596875b3 1588 verify_header_sender = TRUE;
059ec3d9
PH
1589 }
1590
1591/* Otherwise, first item in verify argument must be "sender" or "recipient".
1592In the case of a sender, this can optionally be followed by an address to use
1593in place of the actual sender (rare special-case requirement). */
1594
1595else if (strncmpic(ss, US"sender", 6) == 0)
1596 {
1597 uschar *s = ss + 6;
1598 if (where > ACL_WHERE_NOTSMTP)
1599 {
1600 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1601 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1602 acl_wherenames[where]);
1603 return ERROR;
1604 }
1605 if (*s == 0)
1606 verify_sender_address = sender_address;
1607 else
1608 {
1609 while (isspace(*s)) s++;
1610 if (*s++ != '=') goto BAD_VERIFY;
1611 while (isspace(*s)) s++;
1612 verify_sender_address = string_copy(s);
1613 }
1614 }
1615else
1616 {
1617 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1618 if (addr == NULL)
1619 {
1620 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1621 "(only possible for RCPT)", acl_wherenames[where]);
1622 return ERROR;
1623 }
1624 }
1625
596875b3
PH
1626/* Remaining items are optional; they apply to sender and recipient
1627verification, including "header sender" verification. */
059ec3d9
PH
1628
1629while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1630 != NULL)
1631 {
1632 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1633 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1634 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1635
1636 /* These two old options are left for backwards compatibility */
1637
1638 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1639 {
1640 callout_defer_ok = TRUE;
1641 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1642 }
1643
1644 else if (strcmpic(ss, US"check_postmaster") == 0)
1645 {
1646 pm_mailfrom = US"";
1647 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1648 }
1649
1650 /* The callout option has a number of sub-options, comma separated */
1651
1652 else if (strncmpic(ss, US"callout", 7) == 0)
1653 {
1654 callout = CALLOUT_TIMEOUT_DEFAULT;
1655 ss += 7;
1656 if (*ss != 0)
1657 {
1658 while (isspace(*ss)) ss++;
1659 if (*ss++ == '=')
1660 {
1661 int optsep = ',';
1662 uschar *opt;
1663 uschar buffer[256];
1664 while (isspace(*ss)) ss++;
8e669ac1
PH
1665
1666 /* This callout option handling code has become a mess as new options
1667 have been added in an ad hoc manner. It should be tidied up into some
4deaf07d 1668 kind of table-driven thing. */
8e669ac1 1669
059ec3d9
PH
1670 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1671 != NULL)
1672 {
1673 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1674 else if (strcmpic(opt, US"no_cache") == 0)
1675 verify_options |= vopt_callout_no_cache;
1676 else if (strcmpic(opt, US"random") == 0)
1677 verify_options |= vopt_callout_random;
1678 else if (strcmpic(opt, US"use_sender") == 0)
1679 verify_options |= vopt_callout_recipsender;
1680 else if (strcmpic(opt, US"use_postmaster") == 0)
1681 verify_options |= vopt_callout_recippmaster;
1682 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
2a4be8f9
PH
1683 else if (strcmpic(opt, US"fullpostmaster") == 0)
1684 {
1685 pm_mailfrom = US"";
1686 verify_options |= vopt_callout_fullpm;
1687 }
059ec3d9
PH
1688
1689 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1690 {
1691 if (!verify_header_sender)
1692 {
1693 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1694 "callout option only for verify=header_sender (detected in ACL "
1695 "condition \"%s\")", arg);
1696 return ERROR;
1697 }
1698 opt += 8;
1699 while (isspace(*opt)) opt++;
1700 if (*opt++ != '=')
1701 {
1702 *log_msgptr = string_sprintf("'=' expected after "
1703 "\"mailfrom\" in ACL condition \"%s\"", arg);
1704 return ERROR;
1705 }
1706 while (isspace(*opt)) opt++;
1707 se_mailfrom = string_copy(opt);
1708 }
1709
1710 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1711 {
1712 opt += 19;
1713 while (isspace(*opt)) opt++;
1714 if (*opt++ != '=')
1715 {
1716 *log_msgptr = string_sprintf("'=' expected after "
1717 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1718 return ERROR;
1719 }
1720 while (isspace(*opt)) opt++;
1721 pm_mailfrom = string_copy(opt);
1722 }
1723
1724 else if (strncmpic(opt, US"maxwait", 7) == 0)
1725 {
1726 opt += 7;
1727 while (isspace(*opt)) opt++;
1728 if (*opt++ != '=')
1729 {
1730 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1731 "ACL condition \"%s\"", arg);
1732 return ERROR;
1733 }
1734 while (isspace(*opt)) opt++;
1735 callout_overall = readconf_readtime(opt, 0, FALSE);
1736 if (callout_overall < 0)
1737 {
1738 *log_msgptr = string_sprintf("bad time value in ACL condition "
1739 "\"verify %s\"", arg);
1740 return ERROR;
1741 }
1742 }
4deaf07d
PH
1743 else if (strncmpic(opt, US"connect", 7) == 0)
1744 {
1745 opt += 7;
1746 while (isspace(*opt)) opt++;
1747 if (*opt++ != '=')
1748 {
1749 *log_msgptr = string_sprintf("'=' expected after "
1750 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1751 return ERROR;
1752 }
1753 while (isspace(*opt)) opt++;
1754 callout_connect = readconf_readtime(opt, 0, FALSE);
1755 if (callout_connect < 0)
1756 {
1757 *log_msgptr = string_sprintf("bad time value in ACL condition "
1758 "\"verify %s\"", arg);
1759 return ERROR;
1760 }
1761 }
059ec3d9
PH
1762 else /* Plain time is callout connect/command timeout */
1763 {
1764 callout = readconf_readtime(opt, 0, FALSE);
1765 if (callout < 0)
1766 {
1767 *log_msgptr = string_sprintf("bad time value in ACL condition "
1768 "\"verify %s\"", arg);
1769 return ERROR;
1770 }
1771 }
1772 }
1773 }
1774 else
1775 {
1776 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1777 "ACL condition \"%s\"", arg);
1778 return ERROR;
1779 }
1780 }
1781 }
1782
1783 /* Option not recognized */
1784
1785 else
1786 {
1787 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1788 "condition \"verify %s\"", ss, arg);
1789 return ERROR;
1790 }
1791 }
1792
1793if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1794 (vopt_callout_recipsender|vopt_callout_recippmaster))
1795 {
1796 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1797 "for a recipient callout";
1798 return ERROR;
1799 }
1800
1801/* Handle sender-in-header verification. Default the user message to the log
1802message if giving out verification details. */
1803
1804if (verify_header_sender)
1805 {
8e669ac1 1806 int verrno;
059ec3d9 1807 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
1808 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1809 &verrno);
1810 if (rc != OK)
8e669ac1 1811 {
fe5b5d0b
PH
1812 *basic_errno = verrno;
1813 if (smtp_return_error_details)
1814 {
1815 if (*user_msgptr == NULL && *log_msgptr != NULL)
1816 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1817 if (rc == DEFER) acl_temp_details = TRUE;
1818 }
8e669ac1 1819 }
059ec3d9
PH
1820 }
1821
1822/* Handle a sender address. The default is to verify *the* sender address, but
1823optionally a different address can be given, for special requirements. If the
1824address is empty, we are dealing with a bounce message that has no sender, so
1825we cannot do any checking. If the real sender address gets rewritten during
1826verification (e.g. DNS widening), set the flag to stop it being rewritten again
1827during message reception.
1828
1829A list of verified "sender" addresses is kept to try to avoid doing to much
1830work repetitively when there are multiple recipients in a message and they all
1831require sender verification. However, when callouts are involved, it gets too
1832complicated because different recipients may require different callout options.
1833Therefore, we always do a full sender verify when any kind of callout is
1834specified. Caching elsewhere, for instance in the DNS resolver and in the
1835callout handling, should ensure that this is not terribly inefficient. */
1836
1837else if (verify_sender_address != NULL)
1838 {
1839 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1840 != 0)
1841 {
1842 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1843 "sender verify callout";
1844 return ERROR;
1845 }
1846
1847 sender_vaddr = verify_checked_sender(verify_sender_address);
1848 if (sender_vaddr != NULL && /* Previously checked */
1849 callout <= 0) /* No callout needed this time */
1850 {
1851 /* If the "routed" flag is set, it means that routing worked before, so
1852 this check can give OK (the saved return code value, if set, belongs to a
1853 callout that was done previously). If the "routed" flag is not set, routing
1854 must have failed, so we use the saved return code. */
1855
1856 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1857 {
1858 rc = sender_vaddr->special_action;
1859 *basic_errno = sender_vaddr->basic_errno;
1860 }
1861 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1862 }
1863
1864 /* Do a new verification, and cache the result. The cache is used to avoid
1865 verifying the sender multiple times for multiple RCPTs when callouts are not
1866 specified (see comments above).
1867
1868 The cache is also used on failure to give details in response to the first
1869 RCPT that gets bounced for this reason. However, this can be suppressed by
1870 the no_details option, which sets the flag that says "this detail has already
1871 been sent". The cache normally contains just one address, but there may be
1872 more in esoteric circumstances. */
1873
1874 else
1875 {
1876 BOOL routed = TRUE;
2a3eea10 1877 uschar *save_address_data = deliver_address_data;
8e669ac1 1878
059ec3d9
PH
1879 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1880 if (no_details) setflag(sender_vaddr, af_sverify_told);
1881 if (verify_sender_address[0] != 0)
1882 {
1883 /* If this is the real sender address, save the unrewritten version
1884 for use later in receive. Otherwise, set a flag so that rewriting the
1885 sender in verify_address() does not update sender_address. */
1886
1887 if (verify_sender_address == sender_address)
1888 sender_address_unrewritten = sender_address;
1889 else
1890 verify_options |= vopt_fake_sender;
1891
eafd343b
TK
1892 if (success_on_redirect)
1893 verify_options |= vopt_success_on_redirect;
1894
059ec3d9
PH
1895 /* The recipient, qualify, and expn options are never set in
1896 verify_options. */
1897
1898 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1899 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
1900
1901 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1902
1903 if (rc == OK)
1904 {
1905 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1906 {
1907 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1908 verify_sender_address, sender_vaddr->address);
1909 }
1910 else
1911 {
1912 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1913 verify_sender_address);
1914 }
1915 }
1916 else *basic_errno = sender_vaddr->basic_errno;
1917 }
1918 else rc = OK; /* Null sender */
1919
1920 /* Cache the result code */
1921
1922 if (routed) setflag(sender_vaddr, af_verify_routed);
1923 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1924 sender_vaddr->special_action = rc;
1925 sender_vaddr->next = sender_verified_list;
1926 sender_verified_list = sender_vaddr;
8e669ac1
PH
1927
1928 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 1929 the sender verification. */
8e669ac1 1930
2a3eea10 1931 deliver_address_data = save_address_data;
059ec3d9 1932 }
8e669ac1 1933
2a3eea10
PH
1934 /* Put the sender address_data value into $sender_address_data */
1935
8e669ac1 1936 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH
1937 }
1938
1939/* A recipient address just gets a straightforward verify; again we must handle
1940the DEFER overrides. */
1941
1942else
1943 {
1944 address_item addr2;
1945
eafd343b
TK
1946 if (success_on_redirect)
1947 verify_options |= vopt_success_on_redirect;
1948
059ec3d9
PH
1949 /* We must use a copy of the address for verification, because it might
1950 get rewritten. */
1951
1952 addr2 = *addr;
1953 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 1954 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 1955 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 1956
42855d71 1957 *basic_errno = addr2.basic_errno;
059ec3d9 1958 *log_msgptr = addr2.message;
8e669ac1 1959 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 1960 addr2.user_message : addr2.message;
42855d71
PH
1961
1962 /* Allow details for temporary error if the address is so flagged. */
1963 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
1964
1965 /* Make $address_data visible */
1966 deliver_address_data = addr2.p.address_data;
1967 }
1968
1969/* We have a result from the relevant test. Handle defer overrides first. */
1970
1971if (rc == DEFER && (defer_ok ||
1972 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1973 {
1974 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1975 defer_ok? "defer_ok" : "callout_defer_ok");
1976 rc = OK;
1977 }
1978
1979/* If we've failed a sender, set up a recipient message, and point
1980sender_verified_failed to the address item that actually failed. */
1981
1982if (rc != OK && verify_sender_address != NULL)
1983 {
1984 if (rc != DEFER)
1985 {
1986 *log_msgptr = *user_msgptr = US"Sender verify failed";
1987 }
1988 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1989 {
1990 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1991 }
1992 else
1993 {
1994 *log_msgptr = US"Could not complete sender verify callout";
1995 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1996 *log_msgptr;
1997 }
1998
1999 sender_verified_failed = sender_vaddr;
2000 }
2001
2002/* Verifying an address messes up the values of $domain and $local_part,
2003so reset them before returning if this is a RCPT ACL. */
2004
2005if (addr != NULL)
2006 {
2007 deliver_domain = addr->domain;
2008 deliver_localpart = addr->local_part;
2009 }
2010return rc;
2011
2012/* Syntax errors in the verify argument come here. */
2013
2014BAD_VERIFY:
2015*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
596875b3
PH
2016 "\"helo\", \"header_syntax\", \"header_sender\" or "
2017 "\"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2018 "\"verify %s\"", arg);
2019return ERROR;
596875b3
PH
2020
2021/* Options supplied when not allowed come here */
2022
2023NO_OPTIONS:
2024*log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
2025 "(this verify item has no options)", arg);
2026return ERROR;
1c41c9cc
PH
2027
2028/* Calls in the wrong ACL come here */
2029
2030WRONG_ACL:
2031*log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
2032 "(only possible in ACL for DATA)", acl_wherenames[where]);
2033return ERROR;
059ec3d9
PH
2034}
2035
2036
2037
2038
2039/*************************************************
2040* Check argument for control= modifier *
2041*************************************************/
2042
2043/* Called from acl_check_condition() below
2044
2045Arguments:
2046 arg the argument string for control=
2047 pptr set to point to the terminating character
2048 where which ACL we are in
2049 log_msgptr for error messages
2050
2051Returns: CONTROL_xxx value
2052*/
2053
2054static int
2055decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2056{
2057int len;
2058control_def *d;
2059
2060for (d = controls_list;
2061 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2062 d++)
2063 {
2064 len = Ustrlen(d->name);
2065 if (Ustrncmp(d->name, arg, len) == 0) break;
2066 }
2067
2068if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2069 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2070 {
2071 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2072 return CONTROL_ERROR;
2073 }
2074
059ec3d9
PH
2075*pptr = arg + len;
2076return d->value;
2077}
2078
2079
2080
2081/*************************************************
870f6ba8
TF
2082* Handle rate limiting *
2083*************************************************/
2084
2085/* Called by acl_check_condition() below to calculate the result
2086of the ACL ratelimit condition.
2087
2088Note that the return value might be slightly unexpected: if the
2089sender's rate is above the limit then the result is OK. This is
2090similar to the dnslists condition, and is so that you can write
2091ACL clauses like: defer ratelimit = 15 / 1h
2092
2093Arguments:
2094 arg the option string for ratelimit=
90fc3069 2095 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2096 log_msgptr for error messages
2097
2098Returns: OK - Sender's rate is above limit
2099 FAIL - Sender's rate is below limit
2100 DEFER - Problem opening ratelimit database
2101 ERROR - Syntax error in options.
2102*/
2103
2104static int
90fc3069 2105acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8
TF
2106{
2107double limit, period;
8f240103
PH
2108uschar *ss;
2109uschar *key = NULL;
870f6ba8 2110int sep = '/';
8f240103 2111BOOL leaky = FALSE, strict = FALSE, noupdate = FALSE;
870f6ba8
TF
2112BOOL per_byte = FALSE, per_cmd = FALSE, per_conn = FALSE, per_mail = FALSE;
2113int old_pool, rc;
2114tree_node **anchor, *t;
2115open_db dbblock, *dbm;
2116dbdata_ratelimit *dbd;
2117struct timeval tv;
2118
2119/* Parse the first two options and record their values in expansion
2120variables. These variables allow the configuration to have informative
2121error messages based on rate limits obtained from a table lookup. */
2122
2123/* First is the maximum number of messages per period and maximum burst
2124size, which must be greater than or equal to zero. Zero is useful for
2125rate measurement as opposed to rate limiting. */
2126
2127sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2128if (sender_rate_limit == NULL)
2129 limit = -1.0;
2130else
2131 {
2132 limit = Ustrtod(sender_rate_limit, &ss);
2133 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2134 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2135 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2136 }
2137if (limit < 0.0 || *ss != 0)
2138 {
2139 *log_msgptr = string_sprintf("syntax error in argument for "
2140 "\"ratelimit\" condition: \"%s\" is not a positive number",
2141 sender_rate_limit);
2142 return ERROR;
2143 }
2144
2145/* Second is the rate measurement period and exponential smoothing time
2146constant. This must be strictly greater than zero, because zero leads to
2147run-time division errors. */
2148
2149sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2150if (sender_rate_period == NULL) period = -1.0;
2151else period = readconf_readtime(sender_rate_period, 0, FALSE);
2152if (period <= 0.0)
2153 {
2154 *log_msgptr = string_sprintf("syntax error in argument for "
2155 "\"ratelimit\" condition: \"%s\" is not a time value",
2156 sender_rate_period);
2157 return ERROR;
2158 }
2159
2160/* Parse the other options. Should we check if the per_* options are being
2161used in ACLs where they don't make sense, e.g. per_mail in the connect ACL? */
2162
2163while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2164 != NULL)
2165 {
2166 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2167 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2168 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
870f6ba8 2169 else if (strcmpic(ss, US"per_byte") == 0) per_byte = TRUE;
8f240103
PH
2170 else if (strcmpic(ss, US"per_cmd") == 0) per_cmd = TRUE;
2171 else if (strcmpic(ss, US"per_rcpt") == 0) per_cmd = TRUE; /* alias */
870f6ba8
TF
2172 else if (strcmpic(ss, US"per_conn") == 0) per_conn = TRUE;
2173 else if (strcmpic(ss, US"per_mail") == 0) per_mail = TRUE;
8f240103 2174 else key = string_sprintf("%s", ss);
870f6ba8 2175 }
8f240103 2176
870f6ba8
TF
2177if (leaky + strict > 1 || per_byte + per_cmd + per_conn + per_mail > 1)
2178 {
2179 *log_msgptr = US"conflicting options for \"ratelimit\" condition";
2180 return ERROR;
2181 }
2182
2183/* Default option values */
8f240103 2184
870f6ba8
TF
2185if (!strict) leaky = TRUE;
2186if (!per_byte && !per_cmd && !per_conn) per_mail = TRUE;
2187
8f240103
PH
2188/* Create the lookup key. If there is no explicit key, use sender_host_address.
2189If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2190omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2191are added to the key because they alter the meaning of the stored data. */
2192
2193if (key == NULL)
2194 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2195
8f240103
PH
2196key = string_sprintf("%s/%s/%s/%s",
2197 sender_rate_period,
2198 per_byte? US"per_byte" :
2199 per_cmd? US"per_cmd" :
2200 per_mail? US"per_mail" : US"per_conn",
2201 strict? US"strict" : US"leaky",
2202 key);
870f6ba8
TF
2203
2204HDEBUG(D_acl) debug_printf("ratelimit condition limit=%.0f period=%.0f key=%s\n",
2205 limit, period, key);
2206
8f240103
PH
2207/* See if we have already computed the rate by looking in the relevant tree.
2208For per-connection rate limiting, store tree nodes and dbdata in the permanent
2209pool so that they survive across resets. */
870f6ba8
TF
2210
2211anchor = NULL;
2212old_pool = store_pool;
2213
2214if (per_conn)
2215 {
2216 anchor = &ratelimiters_conn;
2217 store_pool = POOL_PERM;
2218 }
fe0dab11 2219else if (per_mail || per_byte)
870f6ba8 2220 anchor = &ratelimiters_mail;
fe0dab11
TF
2221else if (per_cmd)
2222 anchor = &ratelimiters_cmd;
870f6ba8
TF
2223
2224if (anchor != NULL && (t = tree_search(*anchor, key)) != NULL)
2225 {
2226 dbd = t->data.ptr;
2227 /* The following few lines duplicate some of the code below. */
8f240103 2228 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2229 store_pool = old_pool;
2230 sender_rate = string_sprintf("%.1f", dbd->rate);
2231 HDEBUG(D_acl)
2232 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2233 return rc;
2234 }
2235
2236/* We aren't using a pre-computed rate, so get a previously recorded
8f240103
PH
2237rate from the database, update it, and write it back when required. If there's
2238no previous rate for this key, create one. */
870f6ba8
TF
2239
2240dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2241if (dbm == NULL)
2242 {
2243 store_pool = old_pool;
2244 sender_rate = NULL;
2245 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2246 *log_msgptr = US"ratelimit database not available";
2247 return DEFER;
2248 }
2249dbd = dbfn_read(dbm, key);
2250
2251gettimeofday(&tv, NULL);
2252
2253if (dbd == NULL)
2254 {
2255 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's data\n");
2256 dbd = store_get(sizeof(dbdata_ratelimit));
2257 dbd->time_stamp = tv.tv_sec;
2258 dbd->time_usec = tv.tv_usec;
2259 dbd->rate = 0.0;
2260 }
2261else
2262 {
2263 /* The smoothed rate is computed using an exponentially weighted moving
2264 average adjusted for variable sampling intervals. The standard EWMA for
2265 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2266 where f() is the measured value and f'() is the smoothed value.
2267
2268 Old data decays out of the smoothed value exponentially, such that data n
2269 samples old is multiplied by a^n. The exponential decay time constant p
2270 is defined such that data p samples old is multiplied by 1/e, which means
2271 that a = exp(-1/p). We can maintain the same time constant for a variable
2272 sampling interval i by using a = exp(-i/p).
2273
2274 The rate we are measuring is messages per period, suitable for directly
2275 comparing with the limit. The average rate between now and the previous
2276 message is period / interval, which we feed into the EWMA as the sample.
2277
2278 It turns out that the number of messages required for the smoothed rate
2279 to reach the limit when they are sent in a burst is equal to the limit.
2280 This can be seen by analysing the value of the smoothed rate after N
2281 messages sent at even intervals. Let k = (1 - a) * p/i
2282
2283 rate_1 = (1 - a) * p/i + a * rate_0
2284 = k + a * rate_0
2285 rate_2 = k + a * rate_1
2286 = k + a * k + a^2 * rate_0
2287 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2288 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2289 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2290 = rate_0 * a^N + p/i * (1 - a^N)
2291
2292 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2293
2294 rate_N = p/i + (rate_0 - p/i) * a^N
2295 a^N = (rate_N - p/i) / (rate_0 - p/i)
2296 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2297 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2298
2299 Numerical analysis of the above equation, setting the computed rate to
2300 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2301 rates, p/i, the number of messages N = limit. So limit serves as both the
2302 maximum rate measured in messages per period, and the maximum number of
2303 messages that can be sent in a fast burst. */
2304
2305 double this_time = (double)tv.tv_sec
2306 + (double)tv.tv_usec / 1000000.0;
2307 double prev_time = (double)dbd->time_stamp
2308 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2309
2310 /* We must avoid division by zero, and deal gracefully with the clock going
2311 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2312 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2313
e5d5a95f
TF
2314 double interval = this_time - prev_time <= 0.0 ? 1e-9
2315 : this_time - prev_time;
2316
2317 double i_over_p = interval / period;
2318 double a = exp(-i_over_p);
870f6ba8
TF
2319
2320 dbd->time_stamp = tv.tv_sec;
2321 dbd->time_usec = tv.tv_usec;
2322
2323 /* If we are measuring the rate in bytes per period, multiply the
2324 measured rate by the message size. If we don't know the message size
2325 then it's safe to just use a value of zero and let the recorded rate
2326 decay as if nothing happened. */
2327
2328 if (per_byte)
2329 dbd->rate = (message_size < 0 ? 0.0 : (double)message_size)
2330 * (1 - a) / i_over_p + a * dbd->rate;
90fc3069
TF
2331 else if (per_cmd && where == ACL_WHERE_NOTSMTP)
2332 dbd->rate = (double)recipients_count
2333 * (1 - a) / i_over_p + a * dbd->rate;
870f6ba8
TF
2334 else
2335 dbd->rate = (1 - a) / i_over_p + a * dbd->rate;
2336 }
2337
3348576f
TF
2338/* Clients sending at the limit are considered to be over the limit. This
2339matters for edge cases such the first message sent by a client (which gets
2340the initial rate of 0.0) when the rate limit is zero (i.e. the client should
2341be completely blocked). */
2342
8f240103 2343rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2344
2345/* Update the state if the rate is low or if we are being strict. If we
2346are in leaky mode and the sender's rate is too high, we do not update
2347the recorded rate in order to avoid an over-aggressive sender's retry
8f240103
PH
2348rate preventing them from getting any email through. If noupdate is set,
2349do not do any updates. */
870f6ba8 2350
8f240103
PH
2351if ((rc == FAIL || !leaky) && !noupdate)
2352 {
870f6ba8 2353 dbfn_write(dbm, key, dbd, sizeof(dbdata_ratelimit));
8f240103
PH
2354 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2355 }
2356else
2357 {
2358 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
2359 noupdate? "noupdate set" : "over the limit, but leaky");
2360 }
2361
870f6ba8
TF
2362dbfn_close(dbm);
2363
2364/* Store the result in the tree for future reference, if necessary. */
2365
8f240103 2366if (anchor != NULL && !noupdate)
870f6ba8
TF
2367 {
2368 t = store_get(sizeof(tree_node) + Ustrlen(key));
2369 t->data.ptr = dbd;
2370 Ustrcpy(t->name, key);
2371 (void)tree_insertnode(anchor, t);
2372 }
2373
2374/* We create the formatted version of the sender's rate very late in
2375order to ensure that it is done using the correct storage pool. */
2376
2377store_pool = old_pool;
2378sender_rate = string_sprintf("%.1f", dbd->rate);
2379
2380HDEBUG(D_acl)
2381 debug_printf("ratelimit computed rate %s\n", sender_rate);
2382
2383return rc;
2384}
2385
2386
2387
2388/*************************************************
059ec3d9
PH
2389* Handle conditions/modifiers on an ACL item *
2390*************************************************/
2391
2392/* Called from acl_check() below.
2393
2394Arguments:
2395 verb ACL verb
2396 cb ACL condition block - if NULL, result is OK
2397 where where called from
2398 addr the address being checked for RCPT, or NULL
2399 level the nesting level
2400 epp pointer to pass back TRUE if "endpass" encountered
2401 (applies only to "accept" and "discard")
2402 user_msgptr user message pointer
2403 log_msgptr log message pointer
2404 basic_errno pointer to where to put verify error
2405
2406Returns: OK - all conditions are met
2407 DISCARD - an "acl" condition returned DISCARD - only allowed
2408 for "accept" or "discard" verbs
2409 FAIL - at least one condition fails
2410 FAIL_DROP - an "acl" condition returned FAIL_DROP
2411 DEFER - can't tell at the moment (typically, lookup defer,
2412 but can be temporary callout problem)
2413 ERROR - ERROR from nested ACL or expansion failure or other
2414 error
2415*/
2416
2417static int
2418acl_check_condition(int verb, acl_condition_block *cb, int where,
2419 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2420 uschar **log_msgptr, int *basic_errno)
2421{
2422uschar *user_message = NULL;
2423uschar *log_message = NULL;
ed7f7860
PP
2424uschar *debug_tag = NULL;
2425uschar *debug_opts = NULL;
91ecef39 2426uschar *p = NULL;
059ec3d9 2427int rc = OK;
8523533c
TK
2428#ifdef WITH_CONTENT_SCAN
2429int sep = '/';
2430#endif
059ec3d9
PH
2431
2432for (; cb != NULL; cb = cb->next)
2433 {
2434 uschar *arg;
8e669ac1 2435 int control_type;
059ec3d9
PH
2436
2437 /* The message and log_message items set up messages to be used in
2438 case of rejection. They are expanded later. */
2439
2440 if (cb->type == ACLC_MESSAGE)
2441 {
2442 user_message = cb->arg;
2443 continue;
2444 }
2445
2446 if (cb->type == ACLC_LOG_MESSAGE)
2447 {
2448 log_message = cb->arg;
2449 continue;
2450 }
2451
2452 /* The endpass "condition" just sets a flag to show it occurred. This is
2453 checked at compile time to be on an "accept" or "discard" item. */
2454
2455 if (cb->type == ACLC_ENDPASS)
2456 {
2457 *epp = TRUE;
2458 continue;
2459 }
2460
2461 /* For other conditions and modifiers, the argument is expanded now for some
2462 of them, but not for all, because expansion happens down in some lower level
2463 checking functions in some cases. */
2464
2465 if (cond_expand_at_top[cb->type])
2466 {
2467 arg = expand_string(cb->arg);
2468 if (arg == NULL)
2469 {
2470 if (expand_string_forcedfail) continue;
2471 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2472 cb->arg, expand_string_message);
2473 return search_find_defer? DEFER : ERROR;
2474 }
2475 }
2476 else arg = cb->arg;
2477
2478 /* Show condition, and expanded condition if it's different */
2479
2480 HDEBUG(D_acl)
2481 {
2482 int lhswidth = 0;
2483 debug_printf("check %s%s %n",
2484 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2485 conditions[cb->type], &lhswidth);
2486
2487 if (cb->type == ACLC_SET)
2488 {
38a0a95f
PH
2489 debug_printf("acl_%s ", cb->u.varname);
2490 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH
2491 }
2492
2493 debug_printf("= %s\n", cb->arg);
2494
2495 if (arg != cb->arg)
2496 debug_printf("%.*s= %s\n", lhswidth,
2497 US" ", CS arg);
2498 }
2499
2500 /* Check that this condition makes sense at this time */
2501
2502 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2503 {
2504 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2505 cond_modifiers[cb->type]? "use" : "test",
2506 conditions[cb->type], acl_wherenames[where]);
2507 return ERROR;
2508 }
2509
2510 /* Run the appropriate test for each condition, or take the appropriate
2511 action for the remaining modifiers. */
2512
2513 switch(cb->type)
2514 {
71fafd95
PH
2515 case ACLC_ADD_HEADER:
2516 setup_header(arg);
2517 break;
2518
059ec3d9
PH
2519 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2520 "discard" verb. */
71fafd95 2521
059ec3d9
PH
2522 case ACLC_ACL:
2523 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
2524 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2525 {
2526 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2527 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2528 verbs[verb]);
2529 return ERROR;
2530 }
2531 break;
2532
2533 case ACLC_AUTHENTICATED:
2534 rc = (sender_host_authenticated == NULL)? FAIL :
2535 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2536 TRUE, NULL);
2537 break;
2538
71fafd95 2539 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2540 case ACLC_BMI_OPTIN:
2541 {
2542 int old_pool = store_pool;
2543 store_pool = POOL_PERM;
2544 bmi_current_optin = string_copy(arg);
2545 store_pool = old_pool;
2546 }
2547 break;
71fafd95 2548 #endif
8523533c 2549
059ec3d9 2550 case ACLC_CONDITION:
f3766eb5
NM
2551 /* The true/false parsing here should be kept in sync with that used in
2552 expand.c when dealing with ECOND_BOOL so that we don't have too many
2553 different definitions of what can be a boolean. */
059ec3d9
PH
2554 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2555 rc = (Uatoi(arg) == 0)? FAIL : OK;
2556 else
2557 rc = (strcmpic(arg, US"no") == 0 ||
2558 strcmpic(arg, US"false") == 0)? FAIL :
2559 (strcmpic(arg, US"yes") == 0 ||
2560 strcmpic(arg, US"true") == 0)? OK : DEFER;
2561 if (rc == DEFER)
2562 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2563 break;
2564
c3611384
PH
2565 case ACLC_CONTINUE: /* Always succeeds */
2566 break;
2567
059ec3d9 2568 case ACLC_CONTROL:
c5fcb476
PH
2569 control_type = decode_control(arg, &p, where, log_msgptr);
2570
8523533c 2571 /* Check if this control makes sense at this time */
c5fcb476
PH
2572
2573 if ((control_forbids[control_type] & (1 << where)) != 0)
2574 {
2575 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2576 controls[control_type], acl_wherenames[where]);
2577 return ERROR;
8e669ac1 2578 }
c5fcb476
PH
2579
2580 switch(control_type)
059ec3d9 2581 {
c46782ef
PH
2582 case CONTROL_AUTH_UNADVERTISED:
2583 allow_auth_unadvertised = TRUE;
2584 break;
2585
2586 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2587 case CONTROL_BMI_RUN:
2588 bmi_run = 1;
2589 break;
c46782ef
PH
2590 #endif
2591
80a47a2c 2592 #ifndef DISABLE_DKIM
f7572e5a 2593 case CONTROL_DKIM_VERIFY:
80a47a2c 2594 dkim_disable_verify = TRUE;
f7572e5a
TK
2595 break;
2596 #endif
2597
059ec3d9
PH
2598 case CONTROL_ERROR:
2599 return ERROR;
2600
2601 case CONTROL_CASEFUL_LOCAL_PART:
2602 deliver_localpart = addr->cc_local_part;
2603 break;
2604
2605 case CONTROL_CASELOWER_LOCAL_PART:
2606 deliver_localpart = addr->lc_local_part;
2607 break;
2608
2609 case CONTROL_ENFORCE_SYNC:
2610 smtp_enforce_sync = TRUE;
2611 break;
2612
2613 case CONTROL_NO_ENFORCE_SYNC:
2614 smtp_enforce_sync = FALSE;
2615 break;
2616
c46782ef 2617 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2618 case CONTROL_NO_MBOX_UNSPOOL:
2619 no_mbox_unspool = TRUE;
2620 break;
c46782ef 2621 #endif
8523533c 2622
059ec3d9
PH
2623 case CONTROL_NO_MULTILINE:
2624 no_multiline_responses = TRUE;
2625 break;
2626
cf8b11a5
PH
2627 case CONTROL_NO_PIPELINING:
2628 pipelining_enable = FALSE;
2629 break;
2630
047bdd8c
PH
2631 case CONTROL_NO_DELAY_FLUSH:
2632 disable_delay_flush = TRUE;
2633 break;
2634
4c590bd1
PH
2635 case CONTROL_NO_CALLOUT_FLUSH:
2636 disable_callout_flush = TRUE;
2637 break;
2638
29aba418 2639 case CONTROL_FAKEDEFER:
8523533c 2640 case CONTROL_FAKEREJECT:
29aba418 2641 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 2642 if (*p == '/')
8e669ac1 2643 {
8523533c 2644 uschar *pp = p + 1;
8e669ac1 2645 while (*pp != 0) pp++;
29aba418 2646 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK
2647 p = pp;
2648 }
2649 else
2650 {
2651 /* Explicitly reset to default string */
29aba418 2652 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK
2653 }
2654 break;
8523533c 2655
059ec3d9
PH
2656 case CONTROL_FREEZE:
2657 deliver_freeze = TRUE;
2658 deliver_frozen_at = time(NULL);
6a3f1455
PH
2659 freeze_tell = freeze_tell_config; /* Reset to configured value */
2660 if (Ustrncmp(p, "/no_tell", 8) == 0)
2661 {
2662 p += 8;
2663 freeze_tell = NULL;
2664 }
2665 if (*p != 0)
2666 {
2667 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2668 return ERROR;
2669 }
059ec3d9
PH
2670 break;
2671
2672 case CONTROL_QUEUE_ONLY:
2673 queue_only_policy = TRUE;
2674 break;
2675
2676 case CONTROL_SUBMISSION:
87ba3f5f 2677 originator_name = US"";
059ec3d9 2678 submission_mode = TRUE;
69358f02 2679 while (*p == '/')
8e669ac1 2680 {
69358f02
PH
2681 if (Ustrncmp(p, "/sender_retain", 14) == 0)
2682 {
2683 p += 14;
2684 active_local_sender_retain = TRUE;
8e669ac1
PH
2685 active_local_from_check = FALSE;
2686 }
69358f02
PH
2687 else if (Ustrncmp(p, "/domain=", 8) == 0)
2688 {
2689 uschar *pp = p + 8;
8e669ac1 2690 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH
2691 submission_domain = string_copyn(p+8, pp-p-8);
2692 p = pp;
2693 }
8857ccfd
PH
2694 /* The name= option must be last, because it swallows the rest of
2695 the string. */
87ba3f5f
PH
2696 else if (Ustrncmp(p, "/name=", 6) == 0)
2697 {
2698 uschar *pp = p + 6;
8857ccfd 2699 while (*pp != 0) pp++;
2fe1a124 2700 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 2701 big_buffer, big_buffer_size));
8e669ac1 2702 p = pp;
69358f02 2703 }
8e669ac1
PH
2704 else break;
2705 }
69358f02 2706 if (*p != 0)
059ec3d9 2707 {
69358f02 2708 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH
2709 return ERROR;
2710 }
2711 break;
8800895a 2712
ed7f7860
PP
2713 case CONTROL_DEBUG:
2714 while (*p == '/')
2715 {
2716 if (Ustrncmp(p, "/tag=", 5) == 0)
2717 {
2718 uschar *pp = p + 5;
2719 while (*pp != '\0' && *pp != '/') pp++;
2720 debug_tag = string_copyn(p+5, pp-p-5);
2721 p = pp;
2722 }
2723 else if (Ustrncmp(p, "/opts=", 6) == 0)
2724 {
2725 uschar *pp = p + 6;
2726 while (*pp != '\0' && *pp != '/') pp++;
2727 debug_opts = string_copyn(p+6, pp-p-6);
2728 p = pp;
2729 }
2730 }
2731 debug_logging_activate(debug_tag, debug_opts);
2732 break;
2733
8800895a
PH
2734 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
2735 suppress_local_fixups = TRUE;
2736 break;
059ec3d9
PH
2737 }
2738 break;
2739
6a8f9482
TK
2740 #ifdef EXPERIMENTAL_DCC
2741 case ACLC_DCC:
2742 {
2743 /* Seperate the regular expression and any optional parameters. */
2744 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2745 /* Run the dcc backend. */
2746 rc = dcc_process(&ss);
2747 /* Modify return code based upon the existance of options. */
2748 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2749 != NULL) {
2750 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2751 {
2752 /* FAIL so that the message is passed to the next ACL */
2753 rc = FAIL;
2754 }
2755 }
2756 }
2757 break;
2758 #endif
2759
71fafd95 2760 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2761 case ACLC_DECODE:
2762 rc = mime_decode(&arg);
2763 break;
71fafd95 2764 #endif
8523533c 2765
059ec3d9
PH
2766 case ACLC_DELAY:
2767 {
2768 int delay = readconf_readtime(arg, 0, FALSE);
2769 if (delay < 0)
2770 {
2771 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
2772 "modifier: \"%s\" is not a time value", arg);
2773 return ERROR;
2774 }
2775 else
2776 {
2777 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
2778 delay);
2779 if (host_checking)
2780 {
2781 HDEBUG(D_acl)
2782 debug_printf("delay skipped in -bh checking mode\n");
2783 }
010c2d14
PH
2784
2785 /* It appears to be impossible to detect that a TCP/IP connection has
2786 gone away without reading from it. This means that we cannot shorten
2787 the delay below if the client goes away, because we cannot discover
2788 that the client has closed its end of the connection. (The connection
2789 is actually in a half-closed state, waiting for the server to close its
2790 end.) It would be nice to be able to detect this state, so that the
2791 Exim process is not held up unnecessarily. However, it seems that we
2792 can't. The poll() function does not do the right thing, and in any case
2793 it is not always available.
2794
047bdd8c 2795 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 2796 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH
2797 Also, delays may be specified for non-SMTP input, where smtp_out and
2798 smtp_in will be NULL. Whatever is done must work in all cases.
2799
2800 NOTE 2: The added feature of flushing the output before a delay must
2801 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
2802 */
010c2d14 2803
8e669ac1 2804 else
86b8287f 2805 {
14f4a80d 2806 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 2807 while (delay > 0) delay = sleep(delay);
8e669ac1 2808 }
059ec3d9
PH
2809 }
2810 }
2811 break;
2812
71fafd95 2813 #ifdef WITH_OLD_DEMIME
8523533c
TK
2814 case ACLC_DEMIME:
2815 rc = demime(&arg);
2816 break;
71fafd95 2817 #endif
8523533c 2818
80a47a2c
TK
2819 #ifndef DISABLE_DKIM
2820 case ACLC_DKIM_SIGNER:
9e5d6b55
TK
2821 if (dkim_cur_signer != NULL)
2822 rc = match_isinlist(dkim_cur_signer,
80a47a2c 2823 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 2824 else
80a47a2c 2825 rc = FAIL;
71fafd95
PH
2826 break;
2827
80a47a2c
TK
2828 case ACLC_DKIM_STATUS:
2829 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
2830 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
2831 break;
2832 #endif
fb2274d4 2833
059ec3d9
PH
2834 case ACLC_DNSLISTS:
2835 rc = verify_check_dnsbl(&arg);
2836 break;
2837
2838 case ACLC_DOMAINS:
2839 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
2840 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
2841 break;
2842
2843 /* The value in tls_cipher is the full cipher name, for example,
2844 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
2845 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
2846 what may in practice come out of the SSL library - which at the time of
2847 writing is poorly documented. */
2848
2849 case ACLC_ENCRYPTED:
2850 if (tls_cipher == NULL) rc = FAIL; else
2851 {
2852 uschar *endcipher = NULL;
2853 uschar *cipher = Ustrchr(tls_cipher, ':');
2854 if (cipher == NULL) cipher = tls_cipher; else
2855 {
2856 endcipher = Ustrchr(++cipher, ':');
2857 if (endcipher != NULL) *endcipher = 0;
2858 }
2859 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
2860 if (endcipher != NULL) *endcipher = ':';
2861 }
2862 break;
2863
2864 /* Use verify_check_this_host() instead of verify_check_host() so that
2865 we can pass over &host_data to catch any looked up data. Once it has been
2866 set, it retains its value so that it's still there if another ACL verb
2867 comes through here and uses the cache. However, we must put it into
2868 permanent store in case it is also expected to be used in a subsequent
2869 message in the same SMTP connection. */
2870
2871 case ACLC_HOSTS:
2872 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
2873 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
2874 if (host_data != NULL) host_data = string_copy_malloc(host_data);
2875 break;
2876
2877 case ACLC_LOCAL_PARTS:
2878 rc = match_isinlist(addr->cc_local_part, &arg, 0,
2879 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
2880 &deliver_localpart_data);
2881 break;
2882
6ea85e9a
PH
2883 case ACLC_LOG_REJECT_TARGET:
2884 {
2885 int logbits = 0;
2886 int sep = 0;
2887 uschar *s = arg;
2888 uschar *ss;
2889 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
2890 != NULL)
2891 {
2892 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
2893 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
2894 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
2895 else
2896 {
2897 logbits |= LOG_MAIN|LOG_REJECT;
2898 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
2899 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
2900 }
2901 }
2902 log_reject_target = logbits;
2903 }
2904 break;
2905
059ec3d9
PH
2906 case ACLC_LOGWRITE:
2907 {
2908 int logbits = 0;
2909 uschar *s = arg;
2910 if (*s == ':')
2911 {
2912 s++;
2913 while (*s != ':')
2914 {
2915 if (Ustrncmp(s, "main", 4) == 0)
2916 { logbits |= LOG_MAIN; s += 4; }
2917 else if (Ustrncmp(s, "panic", 5) == 0)
2918 { logbits |= LOG_PANIC; s += 5; }
2919 else if (Ustrncmp(s, "reject", 6) == 0)
2920 { logbits |= LOG_REJECT; s += 6; }
2921 else
2922 {
2923 logbits = LOG_MAIN|LOG_PANIC;
2924 s = string_sprintf(":unknown log name in \"%s\" in "
2925 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
2926 }
2927 if (*s == ',') s++;
2928 }
2929 s++;
2930 }
2931 while (isspace(*s)) s++;
6ea85e9a
PH
2932
2933
059ec3d9
PH
2934 if (logbits == 0) logbits = LOG_MAIN;
2935 log_write(0, logbits, "%s", string_printing(s));
2936 }
2937 break;
8e669ac1 2938
71fafd95 2939 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2940 case ACLC_MALWARE:
2941 {
6ea85e9a 2942 /* Separate the regular expression and any optional parameters. */
8523533c
TK
2943 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2944 /* Run the malware backend. */
2945 rc = malware(&ss);
2946 /* Modify return code based upon the existance of options. */
2947 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2948 != NULL) {
2949 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2950 {
2951 /* FAIL so that the message is passed to the next ACL */
2952 rc = FAIL;
2953 }
2954 }
2955 }
2956 break;
2957
2958 case ACLC_MIME_REGEX:
71fafd95 2959 rc = mime_regex(&arg);
8523533c 2960 break;
71fafd95 2961 #endif
059ec3d9 2962
870f6ba8 2963 case ACLC_RATELIMIT:
90fc3069 2964 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF
2965 break;
2966
059ec3d9
PH
2967 case ACLC_RECIPIENTS:
2968 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
2969 &recipient_data);
2970 break;
2971
71fafd95
PH
2972 #ifdef WITH_CONTENT_SCAN
2973 case ACLC_REGEX:
2974 rc = regex(&arg);
8523533c 2975 break;
71fafd95 2976 #endif
8523533c 2977
059ec3d9
PH
2978 case ACLC_SENDER_DOMAINS:
2979 {
2980 uschar *sdomain;
2981 sdomain = Ustrrchr(sender_address, '@');
2982 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
2983 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
2984 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
2985 }
2986 break;
2987
2988 case ACLC_SENDERS:
2989 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
2990 sender_address_cache, -1, 0, &sender_data);
2991 break;
2992
2993 /* Connection variables must persist forever */
2994
2995 case ACLC_SET:
2996 {
2997 int old_pool = store_pool;
38a0a95f
PH
2998 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
2999 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH
3000 store_pool = old_pool;
3001 }
3002 break;
3003
71fafd95 3004 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3005 case ACLC_SPAM:
3006 {
3007 /* Seperate the regular expression and any optional parameters. */
3008 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3009 /* Run the spam backend. */
3010 rc = spam(&ss);
3011 /* Modify return code based upon the existance of options. */
3012 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3013 != NULL) {
3014 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3015 {
3016 /* FAIL so that the message is passed to the next ACL */
3017 rc = FAIL;
3018 }
3019 }
3020 }
3021 break;
71fafd95 3022 #endif
8523533c 3023
71fafd95 3024 #ifdef EXPERIMENTAL_SPF
8523533c 3025 case ACLC_SPF:
65a7d8c3
NM
3026 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3027 break;
3028 case ACLC_SPF_GUESS:
3029 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3030 break;
71fafd95 3031 #endif
8523533c 3032
059ec3d9
PH
3033 /* If the verb is WARN, discard any user message from verification, because
3034 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH
3035 only from explicit "message" modifiers. However, put the user message into
3036 $acl_verify_message so it can be used in subsequent conditions or modifiers
3037 (until something changes it). */
059ec3d9
PH
3038
3039 case ACLC_VERIFY:
3040 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3041 acl_verify_message = *user_msgptr;
059ec3d9
PH
3042 if (verb == ACL_WARN) *user_msgptr = NULL;
3043 break;
3044
3045 default:
3046 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3047 "condition %d", cb->type);
3048 break;
3049 }
3050
3051 /* If a condition was negated, invert OK/FAIL. */
3052
3053 if (!cond_modifiers[cb->type] && cb->u.negated)
3054 {
3055 if (rc == OK) rc = FAIL;
3056 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3057 }
3058
3059 if (rc != OK) break; /* Conditions loop */
3060 }
3061
3062
3063/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH
3064handle the values of these modifiers. If there isn't a log message set, we make
3065it the same as the user message.
059ec3d9
PH
3066
3067"message" is a user message that will be included in an SMTP response. Unless
3068it is empty, it overrides any previously set user message.
3069
3070"log_message" is a non-user message, and it adds to any existing non-user
3071message that is already set.
3072
4e88a19f
PH
3073Most verbs have but a single return for which the messages are relevant, but
3074for "discard", it's useful to have the log message both when it succeeds and
3075when it fails. For "accept", the message is used in the OK case if there is no
3076"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3077present. */
059ec3d9 3078
4e88a19f
PH
3079if (*epp && rc == OK) user_message = NULL;
3080
3081if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH
3082 {
3083 uschar *expmessage;
4e88a19f
PH
3084 uschar *old_user_msgptr = *user_msgptr;
3085 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH
3086
3087 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH
3088 nested ACLs) are always discarded. This also happens for acceptance verbs
3089 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH
3090 However, the value of an existing message is available in $acl_verify_message
3091 during expansions. */
3092
4e88a19f
PH
3093 if (verb == ACL_WARN ||
3094 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3095 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH
3096
3097 if (user_message != NULL)
3098 {
3099 acl_verify_message = old_user_msgptr;
3100 expmessage = expand_string(user_message);
3101 if (expmessage == NULL)
3102 {
3103 if (!expand_string_forcedfail)
3104 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3105 user_message, expand_string_message);
3106 }
3107 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3108 }
3109
3110 if (log_message != NULL)
3111 {
3112 acl_verify_message = old_log_msgptr;
3113 expmessage = expand_string(log_message);
3114 if (expmessage == NULL)
3115 {
3116 if (!expand_string_forcedfail)
3117 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3118 log_message, expand_string_message);
3119 }
3120 else if (expmessage[0] != 0)
3121 {
3122 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3123 string_sprintf("%s: %s", expmessage, *log_msgptr);
3124 }
3125 }
3126
3127 /* If no log message, default it to the user message */
3128
3129 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3130 }
3131
3132acl_verify_message = NULL;
3133return rc;
3134}
3135
3136
3137
3138
3139
3140/*************************************************
3141* Get line from a literal ACL *
3142*************************************************/
3143
3144/* This function is passed to acl_read() in order to extract individual lines
3145of a literal ACL, which we access via static pointers. We can destroy the
3146contents because this is called only once (the compiled ACL is remembered).
3147
3148This code is intended to treat the data in the same way as lines in the main
3149Exim configuration file. That is:
3150
3151 . Leading spaces are ignored.
3152
3153 . A \ at the end of a line is a continuation - trailing spaces after the \
3154 are permitted (this is because I don't believe in making invisible things
3155 significant). Leading spaces on the continued part of a line are ignored.
3156
3157 . Physical lines starting (significantly) with # are totally ignored, and
3158 may appear within a sequence of backslash-continued lines.
3159
3160 . Blank lines are ignored, but will end a sequence of continuations.
3161
3162Arguments: none
3163Returns: a pointer to the next line
3164*/
3165
3166
3167static uschar *acl_text; /* Current pointer in the text */
3168static uschar *acl_text_end; /* Points one past the terminating '0' */
3169
3170
3171static uschar *
3172acl_getline(void)
3173{
3174uschar *yield;
3175
3176/* This loop handles leading blank lines and comments. */
3177
3178for(;;)
3179 {
3180 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3181 if (*acl_text == 0) return NULL; /* No more data */
3182 yield = acl_text; /* Potential data line */
3183
3184 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3185
3186 /* If we hit the end before a newline, we have the whole logical line. If
3187 it's a comment, there's no more data to be given. Otherwise, yield it. */
3188
3189 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3190
3191 /* After reaching a newline, end this loop if the physical line does not
3192 start with '#'. If it does, it's a comment, and the loop continues. */
3193
3194 if (*yield != '#') break;
3195 }
3196
3197/* This loop handles continuations. We know we have some real data, ending in
3198newline. See if there is a continuation marker at the end (ignoring trailing
3199white space). We know that *yield is not white space, so no need to test for
3200cont > yield in the backwards scanning loop. */
3201
3202for(;;)
3203 {
3204 uschar *cont;
3205 for (cont = acl_text - 1; isspace(*cont); cont--);
3206
3207 /* If no continuation follows, we are done. Mark the end of the line and
3208 return it. */
3209
3210 if (*cont != '\\')
3211 {
3212 *acl_text++ = 0;
3213 return yield;
3214 }
3215
3216 /* We have encountered a continuation. Skip over whitespace at the start of
3217 the next line, and indeed the whole of the next line or lines if they are
3218 comment lines. */
3219
3220 for (;;)
3221 {
3222 while (*(++acl_text) == ' ' || *acl_text == '\t');
3223 if (*acl_text != '#') break;
3224 while (*(++acl_text) != 0 && *acl_text != '\n');
3225 }
3226
3227 /* We have the start of a continuation line. Move all the rest of the data
3228 to join onto the previous line, and then find its end. If the end is not a
3229 newline, we are done. Otherwise loop to look for another continuation. */
3230
3231 memmove(cont, acl_text, acl_text_end - acl_text);
3232 acl_text_end -= acl_text - cont;
3233 acl_text = cont;
3234 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3235 if (*acl_text == 0) return yield;
3236 }
3237
3238/* Control does not reach here */
3239}
3240
3241
3242
3243
3244
3245/*************************************************
3246* Check access using an ACL *
3247*************************************************/
3248
3249/* This function is called from address_check. It may recurse via
3250acl_check_condition() - hence the use of a level to stop looping. The ACL is
3251passed as a string which is expanded. A forced failure implies no access check
3252is required. If the result is a single word, it is taken as the name of an ACL
3253which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3254text, complete with newlines, and parsed as such. In both cases, the ACL check
3255is then run. This function uses an auxiliary function for acl_read() to call
3256for reading individual lines of a literal ACL. This is acl_getline(), which
3257appears immediately above.
3258
3259Arguments:
3260 where where called from
3261 addr address item when called from RCPT; otherwise NULL
3262 s the input string; NULL is the same as an empty ACL => DENY
3263 level the nesting level
3264 user_msgptr where to put a user error (for SMTP response)
3265 log_msgptr where to put a logging message (not for SMTP response)
3266
3267Returns: OK access is granted
3268 DISCARD access is apparently granted...
3269 FAIL access is denied
3270 FAIL_DROP access is denied; drop the connection
3271 DEFER can't tell at the moment
3272 ERROR disaster
3273*/
3274
3275static int
3276acl_check_internal(int where, address_item *addr, uschar *s, int level,
3277 uschar **user_msgptr, uschar **log_msgptr)
3278{
3279int fd = -1;
3280acl_block *acl = NULL;
3281uschar *acl_name = US"inline ACL";
3282uschar *ss;
3283
3284/* Catch configuration loops */
3285
3286if (level > 20)
3287 {
3288 *log_msgptr = US"ACL nested too deep: possible loop";
3289 return ERROR;
3290 }
3291
3292if (s == NULL)
3293 {
3294 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3295 return FAIL;
3296 }
3297
3298/* At top level, we expand the incoming string. At lower levels, it has already
3299been expanded as part of condition processing. */
3300
3301if (level == 0)
3302 {
3303 ss = expand_string(s);
3304 if (ss == NULL)
3305 {
3306 if (expand_string_forcedfail) return OK;
3307 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3308 expand_string_message);
3309 return ERROR;
3310 }
3311 }
3312else ss = s;
3313
3314while (isspace(*ss))ss++;
3315
3316/* If we can't find a named ACL, the default is to parse it as an inline one.
3317(Unless it begins with a slash; non-existent files give rise to an error.) */
3318
3319acl_text = ss;
3320
3321/* Handle the case of a string that does not contain any spaces. Look for a
3322named ACL among those read from the configuration, or a previously read file.
3323It is possible that the pointer to the ACL is NULL if the configuration
3324contains a name with no data. If not found, and the text begins with '/',
3325read an ACL from a file, and save it so it can be re-used. */
3326
3327if (Ustrchr(ss, ' ') == NULL)
3328 {
3329 tree_node *t = tree_search(acl_anchor, ss);
3330 if (t != NULL)
3331 {
3332 acl = (acl_block *)(t->data.ptr);
3333 if (acl == NULL)
3334 {
3335 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3336 return FAIL;
3337 }
3338 acl_name = string_sprintf("ACL \"%s\"", ss);
3339 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3340 }
3341
3342 else if (*ss == '/')
3343 {
3344 struct stat statbuf;
3345 fd = Uopen(ss, O_RDONLY, 0);
3346 if (fd < 0)
3347 {
3348 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3349 strerror(errno));
3350 return ERROR;
3351 }
3352
3353 if (fstat(fd, &statbuf) != 0)
3354 {
3355 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3356 strerror(errno));
3357 return ERROR;
3358 }
3359
3360 acl_text = store_get(statbuf.st_size + 1);
3361 acl_text_end = acl_text + statbuf.st_size + 1;
3362
3363 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3364 {
3365 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3366 ss, strerror(errno));
3367 return ERROR;
3368 }
3369 acl_text[statbuf.st_size] = 0;
f1e894f3 3370 (void)close(fd);
059ec3d9
PH
3371
3372 acl_name = string_sprintf("ACL \"%s\"", ss);
3373 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3374 }
3375 }
3376
3377/* Parse an ACL that is still in text form. If it came from a file, remember it
3378in the ACL tree, having read it into the POOL_PERM store pool so that it
3379persists between multiple messages. */
3380
3381if (acl == NULL)
3382 {
3383 int old_pool = store_pool;
3384 if (fd >= 0) store_pool = POOL_PERM;
3385 acl = acl_read(acl_getline, log_msgptr);
3386 store_pool = old_pool;
3387 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3388 if (fd >= 0)
3389 {
3390 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3391 Ustrcpy(t->name, ss);
3392 t->data.ptr = acl;
3393 (void)tree_insertnode(&acl_anchor, t);
3394 }
3395 }
3396
3397/* Now we have an ACL to use. It's possible it may be NULL. */
3398
3399while (acl != NULL)
3400 {
3401 int cond;
3402 int basic_errno = 0;
3403 BOOL endpass_seen = FALSE;
3404
3405 *log_msgptr = *user_msgptr = NULL;
3406 acl_temp_details = FALSE;
3407
7353285c 3408 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
059ec3d9
PH
3409 acl->verb != ACL_ACCEPT &&
3410 acl->verb != ACL_WARN)
3411 {
7353285c 3412 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
059ec3d9
PH
3413 verbs[acl->verb]);
3414 return ERROR;
3415 }
3416
3417 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3418
3419 /* Clear out any search error message from a previous check before testing
3420 this condition. */
3421
3422 search_error_message = NULL;
3423 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3424 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3425
3426 /* Handle special returns: DEFER causes a return except on a WARN verb;
3427 ERROR always causes a return. */
3428
3429 switch (cond)
3430 {
3431 case DEFER:
3432 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
3433 if (basic_errno != ERRNO_CALLOUTDEFER)
3434 {
3435 if (search_error_message != NULL && *search_error_message != 0)
3436 *log_msgptr = search_error_message;
3437 if (smtp_return_error_details) acl_temp_details = TRUE;
3438 }
3439 else
3440 {
3441 acl_temp_details = TRUE;
3442 }
3443 if (acl->verb != ACL_WARN) return DEFER;
3444 break;
3445
3446 default: /* Paranoia */
3447 case ERROR:
3448 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
3449 return ERROR;
3450
3451 case OK:
3452 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
3453 verbs[acl->verb]);
3454 break;
3455
3456 case FAIL:
3457 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
3458 break;
3459
3460 /* DISCARD and DROP can happen only from a nested ACL condition, and
3461 DISCARD can happen only for an "accept" or "discard" verb. */
3462
3463 case DISCARD:
3464 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
3465 verbs[acl->verb]);
3466 break;
3467
3468 case FAIL_DROP:
3469 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
3470 verbs[acl->verb]);
3471 break;
3472 }
3473
3474 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3475 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3476 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3477
3478 switch(acl->verb)
3479 {
3480 case ACL_ACCEPT:
3481 if (cond == OK || cond == DISCARD) return cond;
3482 if (endpass_seen)
3483 {
3484 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3485 return cond;
3486 }
3487 break;
3488
3489 case ACL_DEFER:
3490 if (cond == OK)
3491 {
3492 acl_temp_details = TRUE;
3493 return DEFER;
3494 }
3495 break;
3496
3497 case ACL_DENY:
3498 if (cond == OK) return FAIL;
3499 break;
3500
3501 case ACL_DISCARD:
3502 if (cond == OK || cond == DISCARD) return DISCARD;
3503 if (endpass_seen)
3504 {
3505 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
3506 return cond;
3507 }
3508 break;
3509
3510 case ACL_DROP:
3511 if (cond == OK) return FAIL_DROP;
3512 break;
3513
3514 case ACL_REQUIRE:
3515 if (cond != OK) return cond;
3516 break;
3517
3518 case ACL_WARN:
3519 if (cond == OK)
3520 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 3521 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH
3522 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
3523 "condition test deferred%s%s", host_and_ident(TRUE),
3524 (*log_msgptr == NULL)? US"" : US": ",
3525 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH
3526 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
3527 break;
3528
3529 default:
3530 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
3531 acl->verb);
3532 break;
3533 }
3534
3535 /* Pass to the next ACL item */
3536
3537 acl = acl->next;
3538 }
3539
3540/* We have reached the end of the ACL. This is an implicit DENY. */
3541
3542HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
3543return FAIL;
3544}
3545
3546
3547/*************************************************
3548* Check access using an ACL *
3549*************************************************/
3550
3551/* This is the external interface for ACL checks. It sets up an address and the
3552expansions for $domain and $local_part when called after RCPT, then calls
3553acl_check_internal() to do the actual work.
3554
3555Arguments:
3556 where ACL_WHERE_xxxx indicating where called from
64ffc24f 3557 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH
3558 s the input string; NULL is the same as an empty ACL => DENY
3559 user_msgptr where to put a user error (for SMTP response)
3560 log_msgptr where to put a logging message (not for SMTP response)
3561
3562Returns: OK access is granted by an ACCEPT verb
3563 DISCARD access is granted by a DISCARD verb
3564 FAIL access is denied
3565 FAIL_DROP access is denied; drop the connection
3566 DEFER can't tell at the moment
3567 ERROR disaster
3568*/
3569
3570int
64ffc24f 3571acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH
3572 uschar **log_msgptr)
3573{
3574int rc;
3575address_item adb;
64ffc24f 3576address_item *addr = NULL;
059ec3d9
PH
3577
3578*user_msgptr = *log_msgptr = NULL;
3579sender_verified_failed = NULL;
fe0dab11 3580ratelimiters_cmd = NULL;
6ea85e9a 3581log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9
PH
3582
3583if (where == ACL_WHERE_RCPT)
3584 {
3585 adb = address_defaults;
3586 addr = &adb;
64ffc24f 3587 addr->address = recipient;
059ec3d9
PH
3588 if (deliver_split_address(addr) == DEFER)
3589 {
3590 *log_msgptr = US"defer in percent_hack_domains check";
3591 return DEFER;
3592 }
3593 deliver_domain = addr->domain;
3594 deliver_localpart = addr->local_part;
3595 }
059ec3d9
PH
3596
3597rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
3598
64ffc24f
PH
3599deliver_domain = deliver_localpart = deliver_address_data =
3600 sender_address_data = NULL;
059ec3d9
PH
3601
3602/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
3603ACL, which is really in the middle of an SMTP command. */
3604
3605if (rc == DISCARD)
3606 {
3607 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
3608 {
3609 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
3610 "ACL", acl_wherenames[where]);
3611 return ERROR;
3612 }
3613 return DISCARD;
3614 }
3615
3616/* A DROP response is not permitted from MAILAUTH */
3617
3618if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
3619 {
3620 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
3621 "ACL", acl_wherenames[where]);
3622 return ERROR;
3623 }
3624
4e88a19f
PH
3625/* Before giving a response, take a look at the length of any user message, and
3626split it up into multiple lines if possible. */
059ec3d9 3627
e28326d8
PH
3628*user_msgptr = string_split_message(*user_msgptr);
3629if (fake_response != OK)
3630 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH
3631
3632return rc;
3633}
3634
38a0a95f
PH
3635
3636
3637/*************************************************
3638* Create ACL variable *
3639*************************************************/
3640
3641/* Create an ACL variable or reuse an existing one. ACL variables are in a
3642binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
3643
3644Argument:
3645 name pointer to the variable's name, starting with c or m
3646
3647Returns the pointer to variable's tree node
3648*/
3649
3650tree_node *
3651acl_var_create(uschar *name)
3652{
3653tree_node *node, **root;
3654root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
3655node = tree_search(*root, name);
3656if (node == NULL)
3657 {
3658 node = store_get(sizeof(tree_node) + Ustrlen(name));
3659 Ustrcpy(node->name, name);
3660 (void)tree_insertnode(root, node);
3661 }
3662node->data.ptr = NULL;
3663return node;
3664}
3665
3666
3667
3668/*************************************************
3669* Write an ACL variable in spool format *
3670*************************************************/
3671
3672/* This function is used as a callback for tree_walk when writing variables to
3673the spool file. To retain spool file compatibility, what is written is -aclc or
3674-aclm followed by the rest of the name and the data length, space separated,
3675then the value itself, starting on a new line, and terminated by an additional
3676newline. When we had only numbered ACL variables, the first line might look
3677like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
3678acl_cfoo.
3679
3680Arguments:
3681 name of the variable
3682 value of the variable
3683 ctx FILE pointer (as a void pointer)
3684
3685Returns: nothing
3686*/
3687
3688void
3689acl_var_write(uschar *name, uschar *value, void *ctx)
3690{
3691FILE *f = (FILE *)ctx;
3692fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
3693}
3694
059ec3d9 3695/* End of acl.c */