tidying
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08 24static uschar *verbs[] = {
f2ed27cf
JH
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32};
059ec3d9 33
4e88a19f
PH
34/* For each verb, the conditions for which "message" or "log_message" are used
35are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36"accept", the FAIL case is used only after "endpass", but that is selected in
37the code. */
38
39static int msgcond[] = {
e3a69b62
JH
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
4e88a19f 47 };
059ec3d9
PH
48
49/* ACL condition and modifier codes - keep in step with the table that
2d009132 50follows.
71fafd95 51down. */
059ec3d9 52
71fafd95
PH
53enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
8523533c
TK
56#ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58#endif
71fafd95 59 ACLC_CONDITION,
c3611384 60 ACLC_CONTINUE,
71fafd95 61 ACLC_CONTROL,
6a8f9482
TK
62#ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64#endif
8523533c
TK
65#ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67#endif
68 ACLC_DELAY,
80a47a2c
TK
69#ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
fb2274d4 72#endif
4840604e
TL
73#ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75#endif
71fafd95
PH
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
6ea85e9a 83 ACLC_LOG_REJECT_TARGET,
71fafd95 84 ACLC_LOGWRITE,
8523533c
TK
85#ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87#endif
88 ACLC_MESSAGE,
89#ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91#endif
b0b9dbb1 92 ACLC_QUEUE,
870f6ba8 93 ACLC_RATELIMIT,
8523533c
TK
94 ACLC_RECIPIENTS,
95#ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97#endif
e7568d51 98 ACLC_REMOVE_HEADER,
71fafd95
PH
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
8523533c 102#ifdef WITH_CONTENT_SCAN
8e669ac1 103 ACLC_SPAM,
8523533c 104#endif
7952eef9 105#ifdef SUPPORT_SPF
8523533c 106 ACLC_SPF,
65a7d8c3 107 ACLC_SPF_GUESS,
8523533c 108#endif
b0019c78 109 ACLC_UDPSEND,
8523533c 110 ACLC_VERIFY };
059ec3d9 111
c3611384 112/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 113"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH
114modifiers that look like conditions but always return TRUE. They are used for
115their side effects. */
059ec3d9 116
2d009132
JH
117typedef struct condition_def {
118 uschar *name;
c5fcb476 119
2d009132 120/* Flag to indicate the condition/modifier has a string expansion done
059ec3d9
PH
121at the outer level. In the other cases, expansion already occurs in the
122checking functions. */
2d009132 123 BOOL expand_at_top:1;
059ec3d9 124
2d009132 125 BOOL is_modifier:1;
059ec3d9 126
2d009132
JH
127/* Bit map vector of which conditions and modifiers are not allowed at certain
128times. For each condition and modifier, there's a bitmap of dis-allowed times.
129For some, it is easier to specify the negation of a small number of allowed
130times. */
131 unsigned forbids;
132
133} condition_def;
134
135static condition_def conditions[] = {
f2ed27cf 136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
2d009132 137
f2ed27cf
JH
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
e3a69b62
JH
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 142#ifndef DISABLE_PRDR
e3a69b62 143 ACL_BIT_PRDR |
2d009132 144#endif
e3a69b62
JH
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
2d009132 148 },
059ec3d9 149
f2ed27cf 150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
e3a69b62
JH
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
2d009132 153 },
8523533c 154#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf 155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
e3a69b62
JH
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
2d009132 159# ifndef DISABLE_PRDR
e3a69b62 160 ACL_BIT_PRDR |
2d009132 161# endif
e3a69b62
JH
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
2d009132 167 },
8e669ac1 168#endif
f2ed27cf
JH
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
2d009132
JH
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
f2ed27cf 174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
2d009132 175
6a8f9482 176#ifdef EXPERIMENTAL_DCC
f2ed27cf
JH
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
e3a69b62 179 ~(ACL_BIT_DATA |
2d009132 180# ifndef DISABLE_PRDR
e3a69b62 181 ACL_BIT_PRDR |
2d009132 182# endif
e3a69b62 183 ACL_BIT_NOTSMTP),
2d009132 184 },
6a8f9482 185#endif
8523533c 186#ifdef WITH_CONTENT_SCAN
e3a69b62 187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 188
8523533c 189#endif
e3a69b62 190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
80a47a2c 191#ifndef DISABLE_DKIM
e3a69b62
JH
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
fb2274d4 194#endif
4840604e 195#ifdef EXPERIMENTAL_DMARC
e3a69b62 196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
4840604e 197#endif
059ec3d9 198
2d009132
JH
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
f2ed27cf 201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
c3611384 202
f2ed27cf
JH
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
e3a69b62 205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
2d009132 206#ifndef DISABLE_PRDR
e3a69b62 207 |ACL_BIT_PRDR
2d009132
JH
208#endif
209 ),
210 },
f2ed27cf 211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
e3a69b62
JH
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
2d009132 214 },
8e669ac1 215
f2ed27cf 216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
8e669ac1 217
f2ed27cf 218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
e3a69b62 219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 220 },
f2ed27cf
JH
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
e3a69b62 223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
f2ed27cf 224#ifndef DISABLE_PRDR
e3a69b62 225 | ACL_BIT_PRDR
f2ed27cf 226#endif
2d009132
JH
227 ),
228 },
6a8f9482 229
f2ed27cf 230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
e3a69b62 231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
f2ed27cf 232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
8523533c 233
2d009132 234#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
e3a69b62 237 ~(ACL_BIT_DATA |
2d009132 238# ifndef DISABLE_PRDR
e3a69b62 239 ACL_BIT_PRDR |
2d009132 240# endif
e3a69b62 241 ACL_BIT_NOTSMTP),
2d009132
JH
242 },
243#endif
8e669ac1 244
f2ed27cf 245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
2d009132 246#ifdef WITH_CONTENT_SCAN
e3a69b62 247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 248#endif
84330b7b 249
f2ed27cf 250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
e3a69b62 251 ACL_BIT_NOTSMTP |
2d009132 252#ifndef DISABLE_PRDR
e3a69b62 253 ACL_BIT_PRDR |
2d009132 254#endif
e3a69b62 255 ACL_BIT_DATA,
2d009132 256 },
fb2274d4 257
f2ed27cf 258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
e3a69b62 259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
4840604e 260
2d009132 261#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
e3a69b62 264 ~(ACL_BIT_DATA |
2d009132 265# ifndef DISABLE_PRDR
e3a69b62 266 ACL_BIT_PRDR |
2d009132 267# endif
e3a69b62
JH
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
2d009132 270 },
379ba7d0 271
2d009132 272#endif
f2ed27cf
JH
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
e3a69b62
JH
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 277#ifndef DISABLE_PRDR
e3a69b62 278 ACL_BIT_PRDR |
2d009132 279#endif
e3a69b62
JH
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
2d009132 282 },
f2ed27cf 283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
e3a69b62
JH
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 289 },
f2ed27cf 290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
e3a69b62
JH
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 296 },
65a7d8c3 297
f2ed27cf 298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
8523533c 299
2d009132 300#ifdef WITH_CONTENT_SCAN
f2ed27cf 301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
e3a69b62 302 (unsigned int) ~(ACL_BIT_DATA |
2d009132 303# ifndef DISABLE_PRDR
e3a69b62 304 ACL_BIT_PRDR |
2d009132 305# endif
e3a69b62 306 ACL_BIT_NOTSMTP),
2d009132
JH
307 },
308#endif
7952eef9 309#ifdef SUPPORT_SPF
f2ed27cf 310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
e3a69b62
JH
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 316 },
6e1a8743 317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
e3a69b62
JH
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132
JH
323 },
324#endif
f2ed27cf 325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
b0019c78 326
059ec3d9
PH
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
f2ed27cf 329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
059ec3d9
PH
330};
331
332
2d009132 333
d7bed771
JH
334/* Return values from decode_control(); used as index so keep in step
335with the controls_list table that follows! */
c46782ef 336
d7bed771
JH
337enum {
338 CONTROL_AUTH_UNADVERTISED,
3c8b3577 339#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 340 CONTROL_BMI_RUN,
3c8b3577 341#endif
d7bed771
JH
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
3c8b3577 346#ifndef DISABLE_DKIM
d7bed771 347 CONTROL_DKIM_VERIFY,
3c8b3577 348#endif
3c8b3577 349#ifdef EXPERIMENTAL_DMARC
d7bed771
JH
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
3c8b3577 352#endif
d7bed771
JH
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
4840604e 359
d7bed771
JH
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 363#ifdef WITH_CONTENT_SCAN
d7bed771 364 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 365#endif
d7bed771
JH
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
8523533c 368
d7bed771 369 CONTROL_QUEUE_ONLY,
8ac90765
JH
370#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
371 CONTROL_REQUIRETLS,
372#endif
d7bed771
JH
373 CONTROL_SUBMISSION,
374 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 375#ifdef SUPPORT_I18N
d7bed771 376 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 377#endif
d7bed771 378};
3c8b3577 379
4c590bd1 380
c5fcb476 381
d7bed771
JH
382/* Structure listing various control arguments, with their characteristics.
383For each control, there's a bitmap of dis-allowed times. For some, it is easier
384to specify the negation of a small number of allowed times. */
059ec3d9
PH
385
386typedef struct control_def {
d7bed771
JH
387 uschar *name;
388 BOOL has_option; /* Has /option(s) following */
389 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH
390} control_def;
391
392static control_def controls_list[] = {
f2ed27cf
JH
393 /* name has_option forbids */
394[CONTROL_AUTH_UNADVERTISED] =
d7bed771 395 { US"allow_auth_unadvertised", FALSE,
f2ed27cf 396 (unsigned)
e3a69b62 397 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
d7bed771 398 },
8523533c 399#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH
400[CONTROL_BMI_RUN] =
401 { US"bmi_run", FALSE, 0 },
8523533c 402#endif
f2ed27cf 403[CONTROL_CASEFUL_LOCAL_PART] =
e3a69b62 404 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf 405[CONTROL_CASELOWER_LOCAL_PART] =
e3a69b62 406 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf
JH
407[CONTROL_CUTTHROUGH_DELIVERY] =
408 { US"cutthrough_delivery", TRUE, 0 },
409[CONTROL_DEBUG] =
410 { US"debug", TRUE, 0 },
d7bed771 411
80a47a2c 412#ifndef DISABLE_DKIM
f2ed27cf 413[CONTROL_DKIM_VERIFY] =
d7bed771 414 { US"dkim_disable_verify", FALSE,
e3a69b62 415 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
d7bed771 416# ifndef DISABLE_PRDR
e3a69b62 417 ACL_BIT_PRDR |
d7bed771 418# endif
e3a69b62 419 ACL_BIT_NOTSMTP_START
d7bed771 420 },
f7572e5a 421#endif
d7bed771 422
4840604e 423#ifdef EXPERIMENTAL_DMARC
9904d08c 424[CONTROL_DMARC_VERIFY] =
d7bed771 425 { US"dmarc_disable_verify", FALSE,
e3a69b62 426 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 427 },
9904d08c 428[CONTROL_DMARC_FORENSIC] =
d7bed771 429 { US"dmarc_enable_forensic", FALSE,
e3a69b62 430 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
431 },
432#endif
433
f2ed27cf 434[CONTROL_DSCP] =
d7bed771 435 { US"dscp", TRUE,
e3a69b62 436 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
d7bed771 437 },
f2ed27cf 438[CONTROL_ENFORCE_SYNC] =
d7bed771 439 { US"enforce_sync", FALSE,
e3a69b62 440 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
441 },
442
443 /* Pseudo-value for decode errors */
f2ed27cf 444[CONTROL_ERROR] =
d7bed771
JH
445 { US"error", FALSE, 0 },
446
f2ed27cf 447[CONTROL_FAKEDEFER] =
d7bed771 448 { US"fakedefer", TRUE,
f2ed27cf 449 (unsigned)
e3a69b62
JH
450 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
451 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 452#ifndef DISABLE_PRDR
e3a69b62 453 ACL_BIT_PRDR |
d7bed771 454#endif
e3a69b62 455 ACL_BIT_MIME)
d7bed771 456 },
f2ed27cf 457[CONTROL_FAKEREJECT] =
d7bed771 458 { US"fakereject", TRUE,
f2ed27cf 459 (unsigned)
e3a69b62
JH
460 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
461 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 462#ifndef DISABLE_PRDR
e3a69b62 463 ACL_BIT_PRDR |
d7bed771 464#endif
e3a69b62 465 ACL_BIT_MIME)
d7bed771 466 },
f2ed27cf 467[CONTROL_FREEZE] =
d7bed771 468 { US"freeze", TRUE,
f2ed27cf 469 (unsigned)
e3a69b62
JH
470 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
471 ACL_BIT_PREDATA | ACL_BIT_DATA |
472 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
473 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771
JH
474 },
475
f2ed27cf 476[CONTROL_NO_CALLOUT_FLUSH] =
d7bed771 477 { US"no_callout_flush", FALSE,
e3a69b62 478 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 479 },
f2ed27cf 480[CONTROL_NO_DELAY_FLUSH] =
d7bed771 481 { US"no_delay_flush", FALSE,
e3a69b62 482 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
483 },
484
f2ed27cf 485[CONTROL_NO_ENFORCE_SYNC] =
d7bed771 486 { US"no_enforce_sync", FALSE,
e3a69b62 487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 488 },
8523533c 489#ifdef WITH_CONTENT_SCAN
f2ed27cf 490[CONTROL_NO_MBOX_UNSPOOL] =
d7bed771 491 { US"no_mbox_unspool", FALSE,
f2ed27cf 492 (unsigned)
e3a69b62
JH
493 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
494 ACL_BIT_PREDATA | ACL_BIT_DATA |
495 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 ACL_BIT_MIME)
d7bed771
JH
497 },
498#endif
f2ed27cf 499[CONTROL_NO_MULTILINE] =
d7bed771 500 { US"no_multiline_responses", FALSE,
e3a69b62 501 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 502 },
f2ed27cf 503[CONTROL_NO_PIPELINING] =
d7bed771 504 { US"no_pipelining", FALSE,
e3a69b62 505 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
506 },
507
f2ed27cf 508[CONTROL_QUEUE_ONLY] =
d7bed771 509 { US"queue_only", FALSE,
f2ed27cf 510 (unsigned)
e3a69b62
JH
511 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
512 ACL_BIT_PREDATA | ACL_BIT_DATA |
513 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
514 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771 515 },
8ac90765
JH
516
517
518#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
519[CONTROL_REQUIRETLS] =
520 { US"requiretls", FALSE,
521 (unsigned)
522 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
523 ACL_BIT_DATA | ACL_BIT_MIME |
524 ACL_BIT_NOTSMTP)
525 },
526#endif
527
f2ed27cf 528[CONTROL_SUBMISSION] =
d7bed771 529 { US"submission", TRUE,
f2ed27cf 530 (unsigned)
e3a69b62 531 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
d7bed771 532 },
f2ed27cf 533[CONTROL_SUPPRESS_LOCAL_FIXUPS] =
d7bed771
JH
534 { US"suppress_local_fixups", FALSE,
535 (unsigned)
e3a69b62
JH
536 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
537 ACL_BIT_NOTSMTP_START)
d7bed771 538 },
8c5d388a 539#ifdef SUPPORT_I18N
f2ed27cf 540[CONTROL_UTF8_DOWNCONVERT] =
6741531c
JH
541 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
542 }
3c8b3577 543#endif
d7bed771 544};
059ec3d9 545
e5a9dba6
PH
546/* Support data structures for Client SMTP Authorization. acl_verify_csa()
547caches its result in a tree to avoid repeated DNS queries. The result is an
548integer code which is used as an index into the following tables of
549explanatory strings and verification return codes. */
550
551static tree_node *csa_cache = NULL;
552
553enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
554 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
555
556/* The acl_verify_csa() return code is translated into an acl_verify() return
557code using the following table. It is OK unless the client is definitely not
558authorized. This is because CSA is supposed to be optional for sending sites,
559so recipients should not be too strict about checking it - especially because
560DNS problems are quite likely to occur. It's possible to use $csa_status in
561further ACL conditions to distinguish ok, unknown, and defer if required, but
562the aim is to make the usual configuration simple. */
563
564static int csa_return_code[] = {
f2ed27cf
JH
565 [CSA_UNKNOWN] = OK,
566 [CSA_OK] = OK,
567 [CSA_DEFER_SRV] = OK,
568 [CSA_DEFER_ADDR] = OK,
569 [CSA_FAIL_EXPLICIT] = FAIL,
570 [CSA_FAIL_DOMAIN] = FAIL,
571 [CSA_FAIL_NOADDR] = FAIL,
572 [CSA_FAIL_MISMATCH] = FAIL
e5a9dba6
PH
573};
574
575static uschar *csa_status_string[] = {
f2ed27cf
JH
576 [CSA_UNKNOWN] = US"unknown",
577 [CSA_OK] = US"ok",
578 [CSA_DEFER_SRV] = US"defer",
579 [CSA_DEFER_ADDR] = US"defer",
580 [CSA_FAIL_EXPLICIT] = US"fail",
581 [CSA_FAIL_DOMAIN] = US"fail",
582 [CSA_FAIL_NOADDR] = US"fail",
583 [CSA_FAIL_MISMATCH] = US"fail"
e5a9dba6
PH
584};
585
586static uschar *csa_reason_string[] = {
f2ed27cf
JH
587 [CSA_UNKNOWN] = US"unknown",
588 [CSA_OK] = US"ok",
589 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
590 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
591 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
592 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
593 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
594 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
e5a9dba6
PH
595};
596
c99ce5c9
TF
597/* Options for the ratelimit condition. Note that there are two variants of
598the per_rcpt option, depending on the ACL that is used to measure the rate.
599However any ACL must be able to look up per_rcpt rates in /noupdate mode,
600so the two variants must have the same internal representation as well as
601the same configuration string. */
602
603enum {
604 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
605 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
606};
607
608#define RATE_SET(var,new) \
609 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
610
611static uschar *ratelimit_option_string[] = {
f2ed27cf
JH
612 [RATE_PER_WHAT] = US"?",
613 [RATE_PER_CLASH] = US"!",
614 [RATE_PER_ADDR] = US"per_addr",
615 [RATE_PER_BYTE] = US"per_byte",
616 [RATE_PER_CMD] = US"per_cmd",
617 [RATE_PER_CONN] = US"per_conn",
618 [RATE_PER_MAIL] = US"per_mail",
619 [RATE_PER_RCPT] = US"per_rcpt",
620 [RATE_PER_ALLRCPTS] = US"per_rcpt"
c99ce5c9
TF
621};
622
059ec3d9
PH
623/* Enable recursion between acl_check_internal() and acl_check_condition() */
624
e1d04f48 625static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
f60d98e8 626 uschar **);
059ec3d9
PH
627
628
629/*************************************************
d7bed771
JH
630* Find control in list *
631*************************************************/
632
633/* The lists are always in order, so binary chop can be used.
634
635Arguments:
636 name the control name to search for
637 ol the first entry in the control list
638 last one more than the offset of the last entry in the control list
639
640Returns: index of a control entry, or -1 if not found
641*/
642
643static int
644find_control(const uschar * name, control_def * ol, int last)
645{
646int first = 0;
647while (last > first)
648 {
649 int middle = (first + last)/2;
650 uschar * s = ol[middle].name;
651 int c = Ustrncmp(name, s, Ustrlen(s));
652 if (c == 0) return middle;
653 else if (c > 0) first = middle + 1;
654 else last = middle;
655 }
656return -1;
657}
658
659
660
661/*************************************************
2d009132
JH
662* Pick out condition from list *
663*************************************************/
664
665/* Use a binary chop method
666
667Arguments:
668 name name to find
669 list list of conditions
670 end size of list
671
672Returns: offset in list, or -1 if not found
673*/
674
675static int
676acl_checkcondition(uschar * name, condition_def * list, int end)
677{
678int start = 0;
679while (start < end)
680 {
681 int mid = (start + end)/2;
682 int c = Ustrcmp(name, list[mid].name);
683 if (c == 0) return mid;
684 if (c < 0) end = mid;
685 else start = mid + 1;
686 }
687return -1;
688}
689
690
691/*************************************************
059ec3d9
PH
692* Pick out name from list *
693*************************************************/
694
695/* Use a binary chop method
696
697Arguments:
698 name name to find
699 list list of names
700 end size of list
701
702Returns: offset in list, or -1 if not found
703*/
704
705static int
706acl_checkname(uschar *name, uschar **list, int end)
707{
708int start = 0;
709
710while (start < end)
711 {
712 int mid = (start + end)/2;
713 int c = Ustrcmp(name, list[mid]);
714 if (c == 0) return mid;
715 if (c < 0) end = mid; else start = mid + 1;
716 }
717
718return -1;
719}
720
721
722/*************************************************
723* Read and parse one ACL *
724*************************************************/
725
726/* This function is called both from readconf in order to parse the ACLs in the
727configuration file, and also when an ACL is encountered dynamically (e.g. as
728the result of an expansion). It is given a function to call in order to
729retrieve the lines of the ACL. This function handles skipping comments and
730blank lines (where relevant).
731
732Arguments:
733 func function to get next line of ACL
734 error where to put an error message
735
736Returns: pointer to ACL, or NULL
737 NULL can be legal (empty ACL); in this case error will be NULL
738*/
739
740acl_block *
741acl_read(uschar *(*func)(void), uschar **error)
742{
743acl_block *yield = NULL;
744acl_block **lastp = &yield;
745acl_block *this = NULL;
746acl_condition_block *cond;
747acl_condition_block **condp = NULL;
748uschar *s;
749
750*error = NULL;
751
752while ((s = (*func)()) != NULL)
753 {
754 int v, c;
755 BOOL negated = FALSE;
756 uschar *saveline = s;
757 uschar name[64];
758
759 /* Conditions (but not verbs) are allowed to be negated by an initial
760 exclamation mark. */
761
762 while (isspace(*s)) s++;
763 if (*s == '!')
764 {
765 negated = TRUE;
766 s++;
767 }
768
cf00dad6
PH
769 /* Read the name of a verb or a condition, or the start of a new ACL, which
770 can be started by a name, or by a macro definition. */
059ec3d9
PH
771
772 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 773 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
774
775 /* If a verb is unrecognized, it may be another condition or modifier that
776 continues the previous verb. */
777
2d009132 778 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
059ec3d9
PH
779 {
780 if (this == NULL)
781 {
4e167a8c
PH
782 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
783 saveline);
059ec3d9
PH
784 return NULL;
785 }
786 }
787
788 /* New verb */
789
790 else
791 {
792 if (negated)
793 {
794 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
795 return NULL;
796 }
797 this = store_get(sizeof(acl_block));
798 *lastp = this;
799 lastp = &(this->next);
800 this->next = NULL;
801 this->verb = v;
802 this->condition = NULL;
803 condp = &(this->condition);
804 if (*s == 0) continue; /* No condition on this line */
805 if (*s == '!')
806 {
807 negated = TRUE;
808 s++;
809 }
810 s = readconf_readname(name, sizeof(name), s); /* Condition name */
811 }
812
813 /* Handle a condition or modifier. */
814
2d009132 815 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
059ec3d9
PH
816 {
817 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
818 saveline);
819 return NULL;
820 }
821
822 /* The modifiers may not be negated */
823
2d009132 824 if (negated && conditions[c].is_modifier)
059ec3d9
PH
825 {
826 *error = string_sprintf("ACL error: negation is not allowed with "
2d009132 827 "\"%s\"", conditions[c].name);
059ec3d9
PH
828 return NULL;
829 }
830
831 /* ENDPASS may occur only with ACCEPT or DISCARD. */
832
833 if (c == ACLC_ENDPASS &&
834 this->verb != ACL_ACCEPT &&
835 this->verb != ACL_DISCARD)
836 {
837 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
2d009132 838 conditions[c].name, verbs[this->verb]);
059ec3d9
PH
839 return NULL;
840 }
841
842 cond = store_get(sizeof(acl_condition_block));
843 cond->next = NULL;
844 cond->type = c;
845 cond->u.negated = negated;
846
847 *condp = cond;
848 condp = &(cond->next);
849
850 /* The "set" modifier is different in that its argument is "name=value"
851 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
852 gives us a variable name to insert into the data block. The original ACL
853 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
854 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
855 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
856 After that, we allow alphanumerics and underscores, but the first character
857 after c or m must be a digit or an underscore. This retains backwards
858 compatibility. */
059ec3d9
PH
859
860 if (c == ACLC_SET)
a79d8834
JH
861#ifndef DISABLE_DKIM
862 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
863 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
864 {
865 uschar * endptr = s+18;
866
867 if (isalnum(*endptr))
868 {
869 *error = string_sprintf("invalid variable name after \"set\" in ACL "
870 "modifier \"set %s\" "
871 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
872 s);
873 return NULL;
874 }
875 cond->u.varname = string_copyn(s, 18);
876 s = endptr;
877 while (isspace(*s)) s++;
878 }
879 else
880#endif
059ec3d9 881 {
47ca6d6c
PH
882 uschar *endptr;
883
38a0a95f
PH
884 if (Ustrncmp(s, "acl_c", 5) != 0 &&
885 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 886 {
38a0a95f
PH
887 *error = string_sprintf("invalid variable name after \"set\" in ACL "
888 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
889 return NULL;
47ca6d6c 890 }
38a0a95f
PH
891
892 endptr = s + 5;
641cb756
PH
893 if (!isdigit(*endptr) && *endptr != '_')
894 {
895 *error = string_sprintf("invalid variable name after \"set\" in ACL "
896 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
897 s);
898 return NULL;
899 }
900
38a0a95f 901 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 902 {
38a0a95f
PH
903 if (!isalnum(*endptr) && *endptr != '_')
904 {
905 *error = string_sprintf("invalid character \"%c\" in variable name "
906 "in ACL modifier \"set %s\"", *endptr, s);
907 return NULL;
908 }
909 endptr++;
47ca6d6c 910 }
47ca6d6c 911
38a0a95f 912 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 913 s = endptr;
059ec3d9
PH
914 while (isspace(*s)) s++;
915 }
916
917 /* For "set", we are now positioned for the data. For the others, only
918 "endpass" has no data */
919
920 if (c != ACLC_ENDPASS)
921 {
922 if (*s++ != '=')
923 {
924 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
2d009132 925 conditions[c].is_modifier ? US"modifier" : US"condition");
059ec3d9
PH
926 return NULL;
927 }
928 while (isspace(*s)) s++;
929 cond->arg = string_copy(s);
930 }
931 }
932
933return yield;
934}
935
936
937
938/*************************************************
71fafd95
PH
939* Set up added header line(s) *
940*************************************************/
941
942/* This function is called by the add_header modifier, and also from acl_warn()
943to implement the now-deprecated way of adding header lines using "message" on a
944"warn" verb. The argument is treated as a sequence of header lines which are
945added to a chain, provided there isn't an identical one already there.
946
947Argument: string of header lines
948Returns: nothing
949*/
950
951static void
55414b25 952setup_header(const uschar *hstring)
71fafd95 953{
55414b25 954const uschar *p, *q;
71fafd95
PH
955int hlen = Ustrlen(hstring);
956
b1b05573
JH
957/* Ignore any leading newlines */
958while (*hstring == '\n') hstring++, hlen--;
71fafd95 959
b1b05573 960/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 961if (hlen <= 0) return;
96f5fe4c 962if (hstring[--hlen] != '\n') /* no newline */
55414b25 963 q = string_sprintf("%s\n", hstring);
96f5fe4c 964else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH
965 {
966 uschar * s = string_copy(hstring);
967 while(s[--hlen] == '\n')
968 s[hlen+1] = '\0';
969 q = s;
970 }
971else
972 q = hstring;
71fafd95
PH
973
974/* Loop for multiple header lines, taking care about continuations */
975
617d3932 976for (p = q; *p; p = q)
71fafd95 977 {
55414b25
JH
978 const uschar *s;
979 uschar * hdr;
71fafd95
PH
980 int newtype = htype_add_bot;
981 header_line **hptr = &acl_added_headers;
982
983 /* Find next header line within the string */
984
985 for (;;)
986 {
96f5fe4c 987 q = Ustrchr(q, '\n'); /* we know there was a newline */
617d3932 988 if (*++q != ' ' && *q != '\t') break;
71fafd95
PH
989 }
990
991 /* If the line starts with a colon, interpret the instruction for where to
992 add it. This temporarily sets up a new type. */
993
994 if (*p == ':')
995 {
996 if (strncmpic(p, US":after_received:", 16) == 0)
997 {
998 newtype = htype_add_rec;
999 p += 16;
1000 }
1001 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1002 {
1003 newtype = htype_add_rfc;
1004 p += 14;
1005 }
1006 else if (strncmpic(p, US":at_start:", 10) == 0)
1007 {
1008 newtype = htype_add_top;
1009 p += 10;
1010 }
1011 else if (strncmpic(p, US":at_end:", 8) == 0)
1012 {
1013 newtype = htype_add_bot;
1014 p += 8;
1015 }
1016 while (*p == ' ' || *p == '\t') p++;
1017 }
1018
1019 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1020 to the front of it. */
1021
1022 for (s = p; s < q - 1; s++)
71fafd95 1023 if (*s == ':' || !isgraph(*s)) break;
71fafd95 1024
617d3932 1025 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
55414b25 1026 hlen = Ustrlen(hdr);
71fafd95
PH
1027
1028 /* See if this line has already been added */
1029
617d3932 1030 while (*hptr)
71fafd95 1031 {
55414b25 1032 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
617d3932 1033 hptr = &(*hptr)->next;
71fafd95
PH
1034 }
1035
1036 /* Add if not previously present */
1037
617d3932 1038 if (!*hptr)
71fafd95
PH
1039 {
1040 header_line *h = store_get(sizeof(header_line));
55414b25 1041 h->text = hdr;
71fafd95
PH
1042 h->next = NULL;
1043 h->type = newtype;
1044 h->slen = hlen;
1045 *hptr = h;
617d3932 1046 hptr = &h->next;
71fafd95 1047 }
71fafd95
PH
1048 }
1049}
1050
1051
1052
e7568d51 1053/*************************************************
362145b5
JH
1054* List the added header lines *
1055*************************************************/
1056uschar *
1057fn_hdrs_added(void)
1058{
acec9514 1059gstring * g = NULL;
bce15b62 1060header_line * h;
362145b5 1061
bce15b62 1062for (h = acl_added_headers; h; h = h->next)
362145b5 1063 {
bce15b62
JH
1064 int i = h->slen;
1065 if (h->text[i-1] == '\n') i--;
1066 g = string_append_listele_n(g, '\n', h->text, i);
362145b5 1067 }
362145b5 1068
bce15b62 1069return g ? g->s : NULL;
362145b5
JH
1070}
1071
1072
1073/*************************************************
e7568d51
TL
1074* Set up removed header line(s) *
1075*************************************************/
1076
1077/* This function is called by the remove_header modifier. The argument is
1078treated as a sequence of header names which are added to a colon separated
1079list, provided there isn't an identical one already there.
1080
1081Argument: string of header names
1082Returns: nothing
1083*/
1084
1085static void
55414b25 1086setup_remove_header(const uschar *hnames)
e7568d51 1087{
48334568 1088if (*hnames)
55414b25
JH
1089 acl_removed_headers = acl_removed_headers
1090 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1091 : string_copy(hnames);
e7568d51
TL
1092}
1093
1094
71fafd95
PH
1095
1096/*************************************************
059ec3d9
PH
1097* Handle warnings *
1098*************************************************/
1099
1100/* This function is called when a WARN verb's conditions are true. It adds to
1101the message's headers, and/or writes information to the log. In each case, this
1102only happens once (per message for headers, per connection for log).
1103
71fafd95
PH
1104** NOTE: The header adding action using the "message" setting is historic, and
1105its use is now deprecated. The new add_header modifier should be used instead.
1106
059ec3d9
PH
1107Arguments:
1108 where ACL_WHERE_xxxx indicating which ACL this is
1109 user_message message for adding to headers
1110 log_message message for logging, if different
1111
1112Returns: nothing
1113*/
1114
1115static void
1116acl_warn(int where, uschar *user_message, uschar *log_message)
1117{
059ec3d9
PH
1118if (log_message != NULL && log_message != user_message)
1119 {
1120 uschar *text;
1121 string_item *logged;
1122
1123 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1124 string_printing(log_message));
1125
1126 /* If a sender verification has failed, and the log message is "sender verify
1127 failed", add the failure message. */
1128
1129 if (sender_verified_failed != NULL &&
1130 sender_verified_failed->message != NULL &&
1131 strcmpic(log_message, US"sender verify failed") == 0)
1132 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1133
9c7a242c
PH
1134 /* Search previously logged warnings. They are kept in malloc
1135 store so they can be freed at the start of a new message. */
059ec3d9
PH
1136
1137 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1138 if (Ustrcmp(logged->text, text) == 0) break;
1139
1140 if (logged == NULL)
1141 {
1142 int length = Ustrlen(text) + 1;
1143 log_write(0, LOG_MAIN, "%s", text);
1144 logged = store_malloc(sizeof(string_item) + length);
5903c6ff 1145 logged->text = US logged + sizeof(string_item);
059ec3d9
PH
1146 memcpy(logged->text, text, length);
1147 logged->next = acl_warn_logged;
1148 acl_warn_logged = logged;
1149 }
1150 }
1151
1152/* If there's no user message, we are done. */
1153
1154if (user_message == NULL) return;
1155
1156/* If this isn't a message ACL, we can't do anything with a user message.
1157Log an error. */
1158
1159if (where > ACL_WHERE_NOTSMTP)
1160 {
1161 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1162 "found in a non-message (%s) ACL: cannot specify header lines here: "
1163 "message ignored", acl_wherenames[where]);
1164 return;
1165 }
1166
71fafd95
PH
1167/* The code for setting up header lines is now abstracted into a separate
1168function so that it can be used for the add_header modifier as well. */
059ec3d9 1169
71fafd95 1170setup_header(user_message);
059ec3d9
PH
1171}
1172
1173
1174
1175/*************************************************
1176* Verify and check reverse DNS *
1177*************************************************/
1178
1179/* Called from acl_verify() below. We look up the host name(s) of the client IP
1180address if this has not yet been done. The host_name_lookup() function checks
1181that one of these names resolves to an address list that contains the client IP
1182address, so we don't actually have to do the check here.
1183
1184Arguments:
1185 user_msgptr pointer for user message
1186 log_msgptr pointer for log message
1187
1188Returns: OK verification condition succeeded
1189 FAIL verification failed
1190 DEFER there was a problem verifying
1191*/
1192
1193static int
1194acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1195{
1196int rc;
1197
1198user_msgptr = user_msgptr; /* stop compiler warning */
1199
1200/* Previous success */
1201
1202if (sender_host_name != NULL) return OK;
1203
1204/* Previous failure */
1205
1206if (host_lookup_failed)
1207 {
1208 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1209 return FAIL;
1210 }
1211
1212/* Need to do a lookup */
1213
1214HDEBUG(D_acl)
e1d04f48 1215 debug_printf_indent("looking up host name to force name/address consistency check\n");
059ec3d9
PH
1216
1217if ((rc = host_name_lookup()) != OK)
1218 {
1219 *log_msgptr = (rc == DEFER)?
1220 US"host lookup deferred for reverse lookup check"
1221 :
1222 string_sprintf("host lookup failed for reverse lookup check%s",
1223 host_lookup_msg);
1224 return rc; /* DEFER or FAIL */
1225 }
1226
1227host_build_sender_fullhost();
1228return OK;
1229}
1230
1231
1232
1233/*************************************************
e5a9dba6
PH
1234* Check client IP address matches CSA target *
1235*************************************************/
1236
1237/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1238response for address records belonging to the CSA target hostname. The section
1239is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1240If one of the addresses matches the client's IP address, then the client is
1241authorized by CSA. If there are target IP addresses but none of them match
1242then the client is using an unauthorized IP address. If there are no target IP
1243addresses then the client cannot be using an authorized IP address. (This is
1244an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1245
1246Arguments:
1247 dnsa the DNS answer block
1248 dnss a DNS scan block for us to use
4c04137d 1249 reset option specifying what portion to scan, as described above
e5a9dba6
PH
1250 target the target hostname to use for matching RR names
1251
1252Returns: CSA_OK successfully authorized
1253 CSA_FAIL_MISMATCH addresses found but none matched
1254 CSA_FAIL_NOADDR no target addresses found
1255*/
1256
1257static int
1258acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1259 uschar *target)
1260{
1261dns_record *rr;
1262dns_address *da;
1263
1264BOOL target_found = FALSE;
1265
1266for (rr = dns_next_rr(dnsa, dnss, reset);
1267 rr != NULL;
1268 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1269 {
1270 /* Check this is an address RR for the target hostname. */
1271
1272 if (rr->type != T_A
1273 #if HAVE_IPV6
1274 && rr->type != T_AAAA
e5a9dba6
PH
1275 #endif
1276 ) continue;
1277
1278 if (strcmpic(target, rr->name) != 0) continue;
1279
1280 target_found = TRUE;
1281
1282 /* Turn the target address RR into a list of textual IP addresses and scan
1283 the list. There may be more than one if it is an A6 RR. */
1284
1285 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1286 {
1287 /* If the client IP address matches the target IP address, it's good! */
1288
e1d04f48 1289 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
e5a9dba6
PH
1290
1291 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1292 }
1293 }
1294
1295/* If we found some target addresses but none of them matched, the client is
1296using an unauthorized IP address, otherwise the target has no authorized IP
1297addresses. */
1298
1299if (target_found) return CSA_FAIL_MISMATCH;
1300else return CSA_FAIL_NOADDR;
1301}
1302
1303
1304
1305/*************************************************
1306* Verify Client SMTP Authorization *
1307*************************************************/
1308
1309/* Called from acl_verify() below. This routine calls dns_lookup_special()
1310to find the CSA SRV record corresponding to the domain argument, or
1311$sender_helo_name if no argument is provided. It then checks that the
1312client is authorized, and that its IP address corresponds to the SRV
1313target's address by calling acl_verify_csa_address() above. The address
1314should have been returned in the DNS response's ADDITIONAL section, but if
1315not we perform another DNS lookup to get it.
1316
1317Arguments:
1318 domain pointer to optional parameter following verify = csa
1319
1320Returns: CSA_UNKNOWN no valid CSA record found
1321 CSA_OK successfully authorized
1322 CSA_FAIL_* client is definitely not authorized
1323 CSA_DEFER_* there was a DNS problem
1324*/
1325
1326static int
55414b25 1327acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1328{
1329tree_node *t;
55414b25 1330const uschar *found;
e5a9dba6
PH
1331int priority, weight, port;
1332dns_answer dnsa;
1333dns_scan dnss;
1334dns_record *rr;
1335int rc, type;
1336uschar target[256];
1337
1338/* Work out the domain we are using for the CSA lookup. The default is the
1339client's HELO domain. If the client has not said HELO, use its IP address
1340instead. If it's a local client (exim -bs), CSA isn't applicable. */
1341
1342while (isspace(*domain) && *domain != '\0') ++domain;
1343if (*domain == '\0') domain = sender_helo_name;
1344if (domain == NULL) domain = sender_host_address;
1345if (sender_host_address == NULL) return CSA_UNKNOWN;
1346
1347/* If we have an address literal, strip off the framing ready for turning it
1348into a domain. The framing consists of matched square brackets possibly
1349containing a keyword and a colon before the actual IP address. */
1350
1351if (domain[0] == '[')
1352 {
55414b25 1353 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1354 if (start == NULL) start = domain;
1355 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1356 }
1357
1358/* Turn domains that look like bare IP addresses into domains in the reverse
1359DNS. This code also deals with address literals and $sender_host_address. It's
1360not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1361address literals, but it's probably the most friendly thing to do. This is an
1362extension to CSA, so we allow it to be turned off for proper conformance. */
1363
7e66e54d 1364if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1365 {
1366 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1367 dns_build_reverse(domain, target);
1368 domain = target;
1369 }
1370
1371/* Find out if we've already done the CSA check for this domain. If we have,
1372return the same result again. Otherwise build a new cached result structure
1373for this domain. The name is filled in now, and the value is filled in when
1374we return from this function. */
1375
1376t = tree_search(csa_cache, domain);
1377if (t != NULL) return t->data.val;
1378
1379t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1380Ustrcpy(t->name, domain);
1381(void)tree_insertnode(&csa_cache, t);
1382
1383/* Now we are ready to do the actual DNS lookup(s). */
1384
28e6ef29 1385found = domain;
e5a9dba6
PH
1386switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1387 {
1388 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1389
1390 default:
1391 return t->data.val = CSA_DEFER_SRV;
1392
1393 /* If we found nothing, the client's authorization is unknown. */
1394
1395 case DNS_NOMATCH:
1396 case DNS_NODATA:
1397 return t->data.val = CSA_UNKNOWN;
1398
1399 /* We got something! Go on to look at the reply in more detail. */
1400
1401 case DNS_SUCCEED:
1402 break;
1403 }
1404
1405/* Scan the reply for well-formed CSA SRV records. */
1406
1407for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
dd708fd7
JH
1408 rr;
1409 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
e5a9dba6 1410 {
dd708fd7 1411 const uschar * p = rr->data;
e5a9dba6
PH
1412
1413 /* Extract the numerical SRV fields (p is incremented) */
1414
e5a9dba6
PH
1415 GETSHORT(priority, p);
1416 GETSHORT(weight, p);
1417 GETSHORT(port, p);
1418
1419 DEBUG(D_acl)
e1d04f48 1420 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
e5a9dba6
PH
1421
1422 /* Check the CSA version number */
1423
1424 if (priority != 1) continue;
1425
1426 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1427 found by dns_special_lookup() is a parent of the one we asked for), we check
1428 the subdomain assertions in the port field. At the moment there's only one
1429 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1430 SRV records of their own. */
1431
1dc92d5a 1432 if (Ustrcmp(found, domain) != 0)
dd708fd7 1433 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
e5a9dba6
PH
1434
1435 /* This CSA SRV record refers directly to our domain, so we check the value
1436 in the weight field to work out the domain's authorization. 0 and 1 are
1437 unauthorized; 3 means the client is authorized but we can't check the IP
1438 address in order to authenticate it, so we treat it as unknown; values
1439 greater than 3 are undefined. */
1440
1441 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1442
1443 if (weight > 2) continue;
1444
1445 /* Weight == 2, which means the domain is authorized. We must check that the
1446 client's IP address is listed as one of the SRV target addresses. Save the
1447 target hostname then break to scan the additional data for its addresses. */
1448
1449 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1450 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1451
e1d04f48 1452 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
e5a9dba6
PH
1453
1454 break;
1455 }
1456
1457/* If we didn't break the loop then no appropriate records were found. */
1458
1459if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1460
1461/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1462A target of "." indicates there are no valid addresses, so the client cannot
1463be authorized. (This is an odd configuration because weight=2 target=. is
1464equivalent to weight=1, but we check for it in order to keep load off the
1465root name servers.) Note that dn_expand() turns "." into "". */
1466
1467if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1468
1469/* Scan the additional section of the CSA SRV reply for addresses belonging
1470to the target. If the name server didn't return any additional data (e.g.
1471because it does not fully support SRV records), we need to do another lookup
1472to obtain the target addresses; otherwise we have a definitive result. */
1473
1474rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1475if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1476
1477/* The DNS lookup type corresponds to the IP version used by the client. */
1478
1479#if HAVE_IPV6
1480if (Ustrchr(sender_host_address, ':') != NULL)
1481 type = T_AAAA;
1482else
1483#endif /* HAVE_IPV6 */
1484 type = T_A;
1485
1486
4e0983dc 1487lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1488switch (dns_lookup(&dnsa, target, type, NULL))
1489 {
1490 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1491
1492 default:
cc00f4af 1493 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1494
1495 /* If the query succeeded, scan the addresses and return the result. */
1496
1497 case DNS_SUCCEED:
cc00f4af
JH
1498 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1499 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1500 /* else fall through */
e5a9dba6
PH
1501
1502 /* If the target has no IP addresses, the client cannot have an authorized
1503 IP address. However, if the target site uses A6 records (not AAAA records)
1504 we have to do yet another lookup in order to check them. */
1505
1506 case DNS_NOMATCH:
1507 case DNS_NODATA:
cc00f4af 1508 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1509 }
1510}
1511
1512
1513
1514/*************************************************
059ec3d9
PH
1515* Handle verification (address & other) *
1516*************************************************/
1517
89583014 1518enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd 1519 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
e3a69b62 1520 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
89583014
JH
1521 };
1522typedef struct {
1523 uschar * name;
1524 int value;
1525 unsigned where_allowed; /* bitmap */
1526 BOOL no_options; /* Never has /option(s) following */
1527 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1528 } verify_type_t;
1529static verify_type_t verify_type_list[] = {
f2ed27cf 1530 /* name value where no-opt opt-sep */
7e8360e6 1531 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
e3a69b62
JH
1532 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1533 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
89583014 1534 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
e3a69b62
JH
1535 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1536 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1537 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1538 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1539 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
89583014 1540 FALSE, 6 },
e3a69b62
JH
1541 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1542 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1543#ifdef EXPERIMENTAL_ARC
f48946eb 1544 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
e3a69b62 1545#endif
89583014
JH
1546 };
1547
1548
1549enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1550 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1551 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
57cc2785 1552 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
89583014
JH
1553 };
1554typedef struct {
1555 uschar * name;
1556 int value;
1557 int flag;
1558 BOOL has_option; /* Has =option(s) following */
1559 BOOL timeval; /* Has a time value */
1560 } callout_opt_t;
1561static callout_opt_t callout_opt_list[] = {
f2ed27cf 1562 /* name value flag has-opt has-time */
89583014
JH
1563 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1564 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1565 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1566 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1567 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1568 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1569 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1570 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1571 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1572 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1573 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
57cc2785 1574 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
89583014
JH
1575 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1576 };
1577
1578
1579
059ec3d9
PH
1580/* This function implements the "verify" condition. It is called when
1581encountered in any ACL, because some tests are almost always permitted. Some
1582just don't make sense, and always fail (for example, an attempt to test a host
1583lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1584
1585Arguments:
1586 where where called from
1587 addr the recipient address that the ACL is handling, or NULL
1588 arg the argument of "verify"
1589 user_msgptr pointer for user message
1590 log_msgptr pointer for log message
1591 basic_errno where to put verify errno
1592
1593Returns: OK verification condition succeeded
1594 FAIL verification failed
1595 DEFER there was a problem verifying
1596 ERROR syntax error
1597*/
1598
1599static int
55414b25 1600acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1601 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1602{
1603int sep = '/';
1604int callout = -1;
1605int callout_overall = -1;
4deaf07d 1606int callout_connect = -1;
059ec3d9
PH
1607int verify_options = 0;
1608int rc;
1609BOOL verify_header_sender = FALSE;
1610BOOL defer_ok = FALSE;
1611BOOL callout_defer_ok = FALSE;
1612BOOL no_details = FALSE;
eafd343b 1613BOOL success_on_redirect = FALSE;
059ec3d9
PH
1614address_item *sender_vaddr = NULL;
1615uschar *verify_sender_address = NULL;
1616uschar *pm_mailfrom = NULL;
1617uschar *se_mailfrom = NULL;
596875b3
PH
1618
1619/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1620an error if options are given for items that don't expect them.
596875b3
PH
1621*/
1622
1623uschar *slash = Ustrchr(arg, '/');
55414b25 1624const uschar *list = arg;
059ec3d9 1625uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1626verify_type_t * vp;
059ec3d9 1627
e3a69b62 1628if (!ss) goto BAD_VERIFY;
059ec3d9
PH
1629
1630/* Handle name/address consistency verification in a separate function. */
1631
89583014 1632for (vp= verify_type_list;
5903c6ff 1633 CS vp < CS verify_type_list + sizeof(verify_type_list);
89583014
JH
1634 vp++
1635 )
1636 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1637 : strcmpic (ss, vp->name) == 0)
1638 break;
5903c6ff 1639if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
89583014
JH
1640 goto BAD_VERIFY;
1641
e3a69b62 1642if (vp->no_options && slash)
059ec3d9 1643 {
89583014
JH
1644 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1645 "(this verify item has no options)", arg);
1646 return ERROR;
059ec3d9 1647 }
e3a69b62 1648if (!(vp->where_allowed & BIT(where)))
059ec3d9 1649 {
e3a69b62
JH
1650 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1651 vp->name, acl_wherenames[where]);
89583014 1652 return ERROR;
059ec3d9 1653 }
89583014 1654switch(vp->value)
596875b3 1655 {
89583014 1656 case VERIFY_REV_HOST_LKUP:
617d3932 1657 if (!sender_host_address) return OK;
7e8360e6 1658 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
617d3932 1659 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
7e8360e6
JH
1660 if (strcmpic(ss, US"defer_ok") == 0)
1661 return OK;
1662 return rc;
059ec3d9 1663
89583014
JH
1664 case VERIFY_CERT:
1665 /* TLS certificate verification is done at STARTTLS time; here we just
1666 test whether it was successful or not. (This is for optional verification; for
1667 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1668
3703d818
JH
1669 if (tls_in.certificate_verified) return OK;
1670 *user_msgptr = US"no verified certificate";
1671 return FAIL;
e5a9dba6 1672
89583014
JH
1673 case VERIFY_HELO:
1674 /* We can test the result of optional HELO verification that might have
1675 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1676
8768d548
JH
1677 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1678 return f.helo_verified ? OK : FAIL;
059ec3d9 1679
89583014
JH
1680 case VERIFY_CSA:
1681 /* Do Client SMTP Authorization checks in a separate function, and turn the
1682 result code into user-friendly strings. */
1c41c9cc 1683
3703d818
JH
1684 rc = acl_verify_csa(list);
1685 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1686 csa_reason_string[rc]);
3703d818 1687 csa_status = csa_status_string[rc];
e1d04f48 1688 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
3703d818 1689 return csa_return_code[rc];
89583014 1690
617d3932
JH
1691#ifdef EXPERIMENTAL_ARC
1692 case VERIFY_ARC:
1693 { /* Do Authenticated Received Chain checks in a separate function. */
1694 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1695 int csep = 0;
1696 uschar * cond;
1697
1698 if (!(arc_state = acl_verify_arc())) return DEFER;
93c931f8
JH
1699 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1700 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
617d3932
JH
1701
1702 if (!condlist) condlist = US"none:pass";
1703 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1704 if (Ustrcmp(arc_state, cond) == 0) return OK;
1705 return FAIL;
1706 }
1707#endif
1708
89583014 1709 case VERIFY_HDR_SYNTAX:
db57e575 1710 /* Check that all relevant header lines have the correct 5322-syntax. If there is
89583014
JH
1711 a syntax error, we return details of the error to the sender if configured to
1712 send out full details. (But a "message" setting on the ACL can override, as
1713 always). */
1714
1715 rc = verify_check_headers(log_msgptr);
3703d818
JH
1716 if (rc != OK && *log_msgptr)
1717 if (smtp_return_error_details)
1718 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1719 else
1720 acl_verify_message = *log_msgptr;
89583014 1721 return rc;
059ec3d9 1722
770747fd
MFM
1723 case VERIFY_HDR_NAMES_ASCII:
1724 /* Check that all header names are true 7 bit strings
1725 See RFC 5322, 2.2. and RFC 6532, 3. */
1726
1727 rc = verify_check_header_names_ascii(log_msgptr);
617d3932 1728 if (rc != OK && smtp_return_error_details && *log_msgptr)
770747fd
MFM
1729 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1730 return rc;
1731
89583014
JH
1732 case VERIFY_NOT_BLIND:
1733 /* Check that no recipient of this message is "blind", that is, every envelope
1734 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1735
617d3932 1736 if ((rc = verify_check_notblind()) != OK)
89583014
JH
1737 {
1738 *log_msgptr = string_sprintf("bcc recipient detected");
1739 if (smtp_return_error_details)
1740 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1741 }
1742 return rc;
059ec3d9 1743
89583014
JH
1744 /* The remaining verification tests check recipient and sender addresses,
1745 either from the envelope or from the header. There are a number of
1746 slash-separated options that are common to all of them. */
059ec3d9 1747
89583014
JH
1748 case VERIFY_HDR_SNDR:
1749 verify_header_sender = TRUE;
1750 break;
059ec3d9 1751
89583014
JH
1752 case VERIFY_SNDR:
1753 /* In the case of a sender, this can optionally be followed by an address to use
1754 in place of the actual sender (rare special-case requirement). */
059ec3d9 1755 {
89583014
JH
1756 uschar *s = ss + 6;
1757 if (*s == 0)
1758 verify_sender_address = sender_address;
1759 else
1760 {
1761 while (isspace(*s)) s++;
1762 if (*s++ != '=') goto BAD_VERIFY;
1763 while (isspace(*s)) s++;
1764 verify_sender_address = string_copy(s);
1765 }
059ec3d9 1766 }
89583014
JH
1767 break;
1768
1769 case VERIFY_RCPT:
1770 break;
059ec3d9
PH
1771 }
1772
89583014
JH
1773
1774
596875b3
PH
1775/* Remaining items are optional; they apply to sender and recipient
1776verification, including "header sender" verification. */
059ec3d9
PH
1777
1778while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1779 != NULL)
1780 {
1781 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1782 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1783 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1784
1785 /* These two old options are left for backwards compatibility */
1786
1787 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1788 {
1789 callout_defer_ok = TRUE;
1790 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1791 }
1792
1793 else if (strcmpic(ss, US"check_postmaster") == 0)
1794 {
1795 pm_mailfrom = US"";
1796 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1797 }
1798
1799 /* The callout option has a number of sub-options, comma separated */
1800
1801 else if (strncmpic(ss, US"callout", 7) == 0)
1802 {
1803 callout = CALLOUT_TIMEOUT_DEFAULT;
1804 ss += 7;
1805 if (*ss != 0)
1806 {
1807 while (isspace(*ss)) ss++;
1808 if (*ss++ == '=')
1809 {
55414b25 1810 const uschar * sublist = ss;
059ec3d9
PH
1811 int optsep = ',';
1812 uschar *opt;
1813 uschar buffer[256];
55414b25 1814 while (isspace(*sublist)) sublist++;
8e669ac1 1815
57cc2785 1816 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
059ec3d9 1817 {
89583014 1818 callout_opt_t * op;
438257ba 1819 double period = 1.0F;
059ec3d9 1820
89583014 1821 for (op= callout_opt_list; op->name; op++)
438257ba 1822 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1823 break;
059ec3d9 1824
89583014
JH
1825 verify_options |= op->flag;
1826 if (op->has_option)
1827 {
438257ba 1828 opt += Ustrlen(op->name);
4deaf07d
PH
1829 while (isspace(*opt)) opt++;
1830 if (*opt++ != '=')
1831 {
1832 *log_msgptr = string_sprintf("'=' expected after "
89583014 1833 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1834 return ERROR;
1835 }
1836 while (isspace(*opt)) opt++;
89583014 1837 }
57cc2785 1838 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
89583014 1839 {
57cc2785
JH
1840 *log_msgptr = string_sprintf("bad time value in ACL condition "
1841 "\"verify %s\"", arg);
1842 return ERROR;
89583014
JH
1843 }
1844
1845 switch(op->value)
1846 {
1847 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1848 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1849 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1850 case CALLOUT_MAILFROM:
1851 if (!verify_header_sender)
1852 {
1853 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1854 "callout option only for verify=header_sender (detected in ACL "
1855 "condition \"%s\")", arg);
1856 return ERROR;
1857 }
1858 se_mailfrom = string_copy(opt);
1859 break;
1860 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1861 case CALLOUT_MAXWAIT: callout_overall = period; break;
1862 case CALLOUT_CONNECT: callout_connect = period; break;
1863 case CALLOUT_TIME: callout = period; break;
1864 }
059ec3d9
PH
1865 }
1866 }
1867 else
1868 {
1869 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1870 "ACL condition \"%s\"", arg);
1871 return ERROR;
1872 }
1873 }
1874 }
1875
1876 /* Option not recognized */
1877
1878 else
1879 {
1880 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1881 "condition \"verify %s\"", ss, arg);
1882 return ERROR;
1883 }
1884 }
1885
1886if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1887 (vopt_callout_recipsender|vopt_callout_recippmaster))
1888 {
1889 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1890 "for a recipient callout";
1891 return ERROR;
1892 }
1893
1894/* Handle sender-in-header verification. Default the user message to the log
1895message if giving out verification details. */
1896
1897if (verify_header_sender)
1898 {
8e669ac1 1899 int verrno;
2f682e45
JH
1900
1901 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1902 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1903 &verrno)) != OK)
8e669ac1 1904 {
fe5b5d0b
PH
1905 *basic_errno = verrno;
1906 if (smtp_return_error_details)
1907 {
2f682e45 1908 if (!*user_msgptr && *log_msgptr)
fe5b5d0b 1909 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
8768d548 1910 if (rc == DEFER) f.acl_temp_details = TRUE;
fe5b5d0b 1911 }
8e669ac1 1912 }
059ec3d9
PH
1913 }
1914
1915/* Handle a sender address. The default is to verify *the* sender address, but
1916optionally a different address can be given, for special requirements. If the
1917address is empty, we are dealing with a bounce message that has no sender, so
1918we cannot do any checking. If the real sender address gets rewritten during
1919verification (e.g. DNS widening), set the flag to stop it being rewritten again
1920during message reception.
1921
1922A list of verified "sender" addresses is kept to try to avoid doing to much
1923work repetitively when there are multiple recipients in a message and they all
1924require sender verification. However, when callouts are involved, it gets too
1925complicated because different recipients may require different callout options.
1926Therefore, we always do a full sender verify when any kind of callout is
1927specified. Caching elsewhere, for instance in the DNS resolver and in the
1928callout handling, should ensure that this is not terribly inefficient. */
1929
2f682e45 1930else if (verify_sender_address)
059ec3d9 1931 {
2f682e45 1932 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH
1933 {
1934 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1935 "sender verify callout";
1936 return ERROR;
1937 }
1938
1939 sender_vaddr = verify_checked_sender(verify_sender_address);
1940 if (sender_vaddr != NULL && /* Previously checked */
1941 callout <= 0) /* No callout needed this time */
1942 {
1943 /* If the "routed" flag is set, it means that routing worked before, so
1944 this check can give OK (the saved return code value, if set, belongs to a
1945 callout that was done previously). If the "routed" flag is not set, routing
1946 must have failed, so we use the saved return code. */
1947
2f682e45
JH
1948 if (testflag(sender_vaddr, af_verify_routed))
1949 rc = OK;
1950 else
059ec3d9
PH
1951 {
1952 rc = sender_vaddr->special_action;
1953 *basic_errno = sender_vaddr->basic_errno;
1954 }
e1d04f48 1955 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
059ec3d9
PH
1956 }
1957
1958 /* Do a new verification, and cache the result. The cache is used to avoid
1959 verifying the sender multiple times for multiple RCPTs when callouts are not
1960 specified (see comments above).
1961
1962 The cache is also used on failure to give details in response to the first
1963 RCPT that gets bounced for this reason. However, this can be suppressed by
1964 the no_details option, which sets the flag that says "this detail has already
1965 been sent". The cache normally contains just one address, but there may be
1966 more in esoteric circumstances. */
1967
1968 else
1969 {
1970 BOOL routed = TRUE;
2a3eea10 1971 uschar *save_address_data = deliver_address_data;
8e669ac1 1972
059ec3d9 1973 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 1974#ifdef SUPPORT_I18N
3c8b3577
JH
1975 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1976 {
1977 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1978 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1979 }
f358d5e0 1980#endif
059ec3d9
PH
1981 if (no_details) setflag(sender_vaddr, af_sverify_told);
1982 if (verify_sender_address[0] != 0)
1983 {
1984 /* If this is the real sender address, save the unrewritten version
1985 for use later in receive. Otherwise, set a flag so that rewriting the
1986 sender in verify_address() does not update sender_address. */
1987
1988 if (verify_sender_address == sender_address)
1989 sender_address_unrewritten = sender_address;
1990 else
1991 verify_options |= vopt_fake_sender;
1992
eafd343b
TK
1993 if (success_on_redirect)
1994 verify_options |= vopt_success_on_redirect;
1995
059ec3d9
PH
1996 /* The recipient, qualify, and expn options are never set in
1997 verify_options. */
1998
1999 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2000 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9 2001
e1d04f48 2002 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
059ec3d9 2003
2f682e45
JH
2004 if (rc != OK)
2005 *basic_errno = sender_vaddr->basic_errno;
2006 else
2007 DEBUG(D_acl)
2008 {
2009 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
e1d04f48 2010 debug_printf_indent("sender %s verified ok as %s\n",
2f682e45
JH
2011 verify_sender_address, sender_vaddr->address);
2012 else
e1d04f48 2013 debug_printf_indent("sender %s verified ok\n",
2f682e45
JH
2014 verify_sender_address);
2015 }
059ec3d9 2016 }
2f682e45
JH
2017 else
2018 rc = OK; /* Null sender */
059ec3d9
PH
2019
2020 /* Cache the result code */
2021
2022 if (routed) setflag(sender_vaddr, af_verify_routed);
2023 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2024 sender_vaddr->special_action = rc;
2025 sender_vaddr->next = sender_verified_list;
2026 sender_verified_list = sender_vaddr;
8e669ac1
PH
2027
2028 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2029 the sender verification. */
8e669ac1 2030
2a3eea10 2031 deliver_address_data = save_address_data;
059ec3d9 2032 }
8e669ac1 2033
2a3eea10
PH
2034 /* Put the sender address_data value into $sender_address_data */
2035
d43cbe25 2036 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2037 }
2038
2039/* A recipient address just gets a straightforward verify; again we must handle
2040the DEFER overrides. */
2041
2042else
2043 {
2044 address_item addr2;
2045
eafd343b
TK
2046 if (success_on_redirect)
2047 verify_options |= vopt_success_on_redirect;
2048
059ec3d9
PH
2049 /* We must use a copy of the address for verification, because it might
2050 get rewritten. */
2051
2052 addr2 = *addr;
2053 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2054 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
e1d04f48 2055 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
8e669ac1 2056
42855d71 2057 *basic_errno = addr2.basic_errno;
059ec3d9 2058 *log_msgptr = addr2.message;
8e669ac1 2059 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2060 addr2.user_message : addr2.message;
42855d71
PH
2061
2062 /* Allow details for temporary error if the address is so flagged. */
8768d548 2063 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
059ec3d9
PH
2064
2065 /* Make $address_data visible */
d43cbe25 2066 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2067 }
2068
2069/* We have a result from the relevant test. Handle defer overrides first. */
2070
2071if (rc == DEFER && (defer_ok ||
2072 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2073 {
e1d04f48 2074 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
059ec3d9
PH
2075 defer_ok? "defer_ok" : "callout_defer_ok");
2076 rc = OK;
2077 }
2078
2079/* If we've failed a sender, set up a recipient message, and point
2080sender_verified_failed to the address item that actually failed. */
2081
2082if (rc != OK && verify_sender_address != NULL)
2083 {
2084 if (rc != DEFER)
059ec3d9 2085 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2086 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2087 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2088 else
2089 {
2090 *log_msgptr = US"Could not complete sender verify callout";
2091 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2092 *log_msgptr;
2093 }
2094
2095 sender_verified_failed = sender_vaddr;
2096 }
2097
2098/* Verifying an address messes up the values of $domain and $local_part,
2099so reset them before returning if this is a RCPT ACL. */
2100
2101if (addr != NULL)
2102 {
2103 deliver_domain = addr->domain;
2104 deliver_localpart = addr->local_part;
2105 }
2106return rc;
2107
2108/* Syntax errors in the verify argument come here. */
2109
2110BAD_VERIFY:
2111*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2112 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2113 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2114 "\"verify %s\"", arg);
2115return ERROR;
2116}
2117
2118
2119
2120
2121/*************************************************
2122* Check argument for control= modifier *
2123*************************************************/
2124
2125/* Called from acl_check_condition() below
2126
2127Arguments:
2128 arg the argument string for control=
2129 pptr set to point to the terminating character
2130 where which ACL we are in
2131 log_msgptr for error messages
2132
2133Returns: CONTROL_xxx value
2134*/
2135
2136static int
55414b25 2137decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2138{
d7bed771
JH
2139int idx, len;
2140control_def * d;
059ec3d9 2141
d7bed771
JH
2142if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2143 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2144 && (!d->has_option || arg[len] != '/')
2145 ) )
059ec3d9
PH
2146 {
2147 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2148 return CONTROL_ERROR;
2149 }
2150
059ec3d9 2151*pptr = arg + len;
d7bed771 2152return idx;
059ec3d9
PH
2153}
2154
2155
2156
c99ce5c9
TF
2157
2158/*************************************************
2159* Return a ratelimit error *
2160*************************************************/
2161
2162/* Called from acl_ratelimit() below
2163
2164Arguments:
2165 log_msgptr for error messages
2166 format format string
2167 ... supplementary arguments
c99ce5c9
TF
2168
2169Returns: ERROR
2170*/
2171
2172static int
2173ratelimit_error(uschar **log_msgptr, const char *format, ...)
2174{
2175va_list ap;
2176uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2177va_start(ap, format);
2178if (!string_vformat(buffer, sizeof(buffer), format, ap))
2179 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2180 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2181va_end(ap);
2182*log_msgptr = string_sprintf(
2183 "error in arguments to \"ratelimit\" condition: %s", buffer);
2184return ERROR;
2185}
2186
2187
2188
2189
059ec3d9 2190/*************************************************
870f6ba8
TF
2191* Handle rate limiting *
2192*************************************************/
2193
2194/* Called by acl_check_condition() below to calculate the result
2195of the ACL ratelimit condition.
2196
2197Note that the return value might be slightly unexpected: if the
2198sender's rate is above the limit then the result is OK. This is
2199similar to the dnslists condition, and is so that you can write
2200ACL clauses like: defer ratelimit = 15 / 1h
2201
2202Arguments:
2203 arg the option string for ratelimit=
90fc3069 2204 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2205 log_msgptr for error messages
2206
2207Returns: OK - Sender's rate is above limit
2208 FAIL - Sender's rate is below limit
2209 DEFER - Problem opening ratelimit database
2210 ERROR - Syntax error in options.
2211*/
2212
2213static int
55414b25 2214acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2215{
c99ce5c9 2216double limit, period, count;
8f240103
PH
2217uschar *ss;
2218uschar *key = NULL;
c99ce5c9 2219uschar *unique = NULL;
870f6ba8 2220int sep = '/';
c99ce5c9
TF
2221BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2222BOOL noupdate = FALSE, badacl = FALSE;
2223int mode = RATE_PER_WHAT;
870f6ba8
TF
2224int old_pool, rc;
2225tree_node **anchor, *t;
2226open_db dbblock, *dbm;
c99ce5c9 2227int dbdb_size;
870f6ba8 2228dbdata_ratelimit *dbd;
c99ce5c9 2229dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2230struct timeval tv;
2231
2232/* Parse the first two options and record their values in expansion
2233variables. These variables allow the configuration to have informative
2234error messages based on rate limits obtained from a table lookup. */
2235
c99ce5c9 2236/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2237size, which must be greater than or equal to zero. Zero is useful for
2238rate measurement as opposed to rate limiting. */
2239
65a32f85 2240if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
96f5fe4c
JH
2241 return ratelimit_error(log_msgptr, "sender rate limit not set");
2242
2243limit = Ustrtod(sender_rate_limit, &ss);
2244if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2245else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2246else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2247
c99ce5c9
TF
2248if (limit < 0.0 || *ss != '\0')
2249 return ratelimit_error(log_msgptr,
2250 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2251
c99ce5c9 2252/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2253constant. This must be strictly greater than zero, because zero leads to
2254run-time division errors. */
2255
65a32f85
JH
2256period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2257 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
870f6ba8 2258if (period <= 0.0)
c99ce5c9
TF
2259 return ratelimit_error(log_msgptr,
2260 "\"%s\" is not a time value", sender_rate_period);
2261
2262/* By default we are counting one of something, but the per_rcpt,
2263per_byte, and count options can change this. */
2264
2265count = 1.0;
870f6ba8 2266
c99ce5c9 2267/* Parse the other options. */
870f6ba8 2268
65a32f85 2269while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
870f6ba8
TF
2270 {
2271 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2272 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2273 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2274 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2275 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2276 else if (strcmpic(ss, US"per_conn") == 0)
2277 {
2278 RATE_SET(mode, PER_CONN);
2279 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2280 badacl = TRUE;
2281 }
2282 else if (strcmpic(ss, US"per_mail") == 0)
2283 {
2284 RATE_SET(mode, PER_MAIL);
2285 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2286 }
2287 else if (strcmpic(ss, US"per_rcpt") == 0)
2288 {
2289 /* If we are running in the RCPT ACL, then we'll count the recipients
2290 one by one, but if we are running when we have accumulated the whole
2291 list then we'll add them all in one batch. */
2292 if (where == ACL_WHERE_RCPT)
2293 RATE_SET(mode, PER_RCPT);
2294 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2295 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2296 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2297 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2298 }
2299 else if (strcmpic(ss, US"per_byte") == 0)
2300 {
2301 /* If we have not yet received the message data and there was no SIZE
4c04137d 2302 declaration on the MAIL command, then it's safe to just use a value of
c99ce5c9
TF
2303 zero and let the recorded rate decay as if nothing happened. */
2304 RATE_SET(mode, PER_MAIL);
2305 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
65a32f85 2306 else count = message_size < 0 ? 0.0 : (double)message_size;
c99ce5c9
TF
2307 }
2308 else if (strcmpic(ss, US"per_addr") == 0)
2309 {
2310 RATE_SET(mode, PER_RCPT);
438257ba 2311 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
65a32f85 2312 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
c99ce5c9
TF
2313 }
2314 else if (strncmpic(ss, US"count=", 6) == 0)
2315 {
2316 uschar *e;
2317 count = Ustrtod(ss+6, &e);
2318 if (count < 0.0 || *e != '\0')
65a32f85 2319 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
c99ce5c9
TF
2320 }
2321 else if (strncmpic(ss, US"unique=", 7) == 0)
2322 unique = string_copy(ss + 7);
65a32f85 2323 else if (!key)
c99ce5c9
TF
2324 key = string_copy(ss);
2325 else
2326 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2327 }
2328
c99ce5c9
TF
2329/* Sanity check. When the badacl flag is set the update mode must either
2330be readonly (which is the default if it is omitted) or, for backwards
2331compatibility, a combination of noupdate and strict or leaky. */
2332
2333if (mode == RATE_PER_CLASH)
2334 return ratelimit_error(log_msgptr, "conflicting per_* options");
2335if (leaky + strict + readonly > 1)
2336 return ratelimit_error(log_msgptr, "conflicting update modes");
2337if (badacl && (leaky || strict) && !noupdate)
2338 return ratelimit_error(log_msgptr,
bfe6da19 2339 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
c99ce5c9
TF
2340 ratelimit_option_string[mode], acl_wherenames[where]);
2341
2342/* Set the default values of any unset options. In readonly mode we
2343perform the rate computation without any increment so that its value
2344decays to eventually allow over-limit senders through. */
2345
2346if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2347if (badacl) readonly = TRUE;
2348if (readonly) count = 0.0;
2349if (!strict && !readonly) leaky = TRUE;
2350if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2351
8f240103
PH
2352/* Create the lookup key. If there is no explicit key, use sender_host_address.
2353If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2354omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2355are added to the key because they alter the meaning of the stored data. */
2356
65a32f85
JH
2357if (!key)
2358 key = !sender_host_address ? US"" : sender_host_address;
870f6ba8 2359
c99ce5c9 2360key = string_sprintf("%s/%s/%s%s",
8f240103 2361 sender_rate_period,
c99ce5c9
TF
2362 ratelimit_option_string[mode],
2363 unique == NULL ? "" : "unique/",
8f240103 2364 key);
870f6ba8 2365
c99ce5c9 2366HDEBUG(D_acl)
e1d04f48 2367 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2368
8f240103
PH
2369/* See if we have already computed the rate by looking in the relevant tree.
2370For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2371pool so that they survive across resets. In readonly mode we only remember the
2372result for the rest of this command in case a later command changes it. After
2373this bit of logic the code is independent of the per_* mode. */
870f6ba8 2374
870f6ba8
TF
2375old_pool = store_pool;
2376
c99ce5c9
TF
2377if (readonly)
2378 anchor = &ratelimiters_cmd;
65a32f85
JH
2379else switch(mode)
2380 {
2381 case RATE_PER_CONN:
2382 anchor = &ratelimiters_conn;
2383 store_pool = POOL_PERM;
2384 break;
2385 case RATE_PER_BYTE:
2386 case RATE_PER_MAIL:
2387 case RATE_PER_ALLRCPTS:
2388 anchor = &ratelimiters_mail;
2389 break;
2390 case RATE_PER_ADDR:
2391 case RATE_PER_CMD:
2392 case RATE_PER_RCPT:
2393 anchor = &ratelimiters_cmd;
2394 break;
2395 default:
2396 anchor = NULL; /* silence an "unused" complaint */
2397 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2398 "internal ACL error: unknown ratelimit mode %d", mode);
2399 break;
2400 }
870f6ba8 2401
65a32f85 2402if ((t = tree_search(*anchor, key)))
870f6ba8
TF
2403 {
2404 dbd = t->data.ptr;
2405 /* The following few lines duplicate some of the code below. */
8f240103 2406 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2407 store_pool = old_pool;
2408 sender_rate = string_sprintf("%.1f", dbd->rate);
2409 HDEBUG(D_acl)
e1d04f48 2410 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
870f6ba8
TF
2411 return rc;
2412 }
2413
c99ce5c9
TF
2414/* We aren't using a pre-computed rate, so get a previously recorded rate
2415from the database, which will be updated and written back if required. */
870f6ba8 2416
0a6c178c 2417if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
870f6ba8
TF
2418 {
2419 store_pool = old_pool;
2420 sender_rate = NULL;
e1d04f48 2421 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
870f6ba8
TF
2422 *log_msgptr = US"ratelimit database not available";
2423 return DEFER;
2424 }
c99ce5c9
TF
2425dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2426dbd = NULL;
870f6ba8
TF
2427
2428gettimeofday(&tv, NULL);
2429
65a32f85 2430if (dbdb)
c99ce5c9
TF
2431 {
2432 /* Locate the basic ratelimit block inside the DB data. */
e1d04f48 2433 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
c99ce5c9
TF
2434 dbd = &dbdb->dbd;
2435
2436 /* Forget the old Bloom filter if it is too old, so that we count each
2437 repeating event once per period. We don't simply clear and re-use the old
2438 filter because we want its size to change if the limit changes. Note that
2439 we keep the dbd pointer for copying the rate into the new data block. */
2440
65a32f85 2441 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
c99ce5c9 2442 {
e1d04f48 2443 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
c99ce5c9
TF
2444 dbdb = NULL;
2445 }
2446
2447 /* Sanity check. */
2448
65a32f85 2449 if(unique && dbdb_size < sizeof(*dbdb))
c99ce5c9 2450 {
e1d04f48 2451 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
c99ce5c9
TF
2452 dbdb = NULL;
2453 }
2454 }
2455
2456/* Allocate a new data block if the database lookup failed
2457or the Bloom filter passed its age limit. */
2458
65a32f85 2459if (!dbdb)
c99ce5c9 2460 {
65a32f85 2461 if (!unique)
c99ce5c9
TF
2462 {
2463 /* No Bloom filter. This basic ratelimit block is initialized below. */
e1d04f48 2464 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
c99ce5c9
TF
2465 dbdb_size = sizeof(*dbd);
2466 dbdb = store_get(dbdb_size);
2467 }
2468 else
2469 {
2470 int extra;
e1d04f48 2471 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
c99ce5c9
TF
2472
2473 /* See the long comment below for an explanation of the magic number 2.
2474 The filter has a minimum size in case the rate limit is very small;
2475 this is determined by the definition of dbdata_ratelimit_unique. */
2476
2477 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2478 if (extra < 0) extra = 0;
2479 dbdb_size = sizeof(*dbdb) + extra;
2480 dbdb = store_get(dbdb_size);
2481 dbdb->bloom_epoch = tv.tv_sec;
2482 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2483 memset(dbdb->bloom, 0, dbdb->bloom_size);
2484
2485 /* Preserve any basic ratelimit data (which is our longer-term memory)
2486 by copying it from the discarded block. */
2487
65a32f85 2488 if (dbd)
c99ce5c9
TF
2489 {
2490 dbdb->dbd = *dbd;
2491 dbd = &dbdb->dbd;
2492 }
2493 }
2494 }
2495
2496/* If we are counting unique events, find out if this event is new or not.
2497If the client repeats the event during the current period then it should be
2498counted. We skip this code in readonly mode for efficiency, because any
2499changes to the filter will be discarded and because count is already set to
2500zero. */
2501
65a32f85 2502if (unique && !readonly)
c99ce5c9
TF
2503 {
2504 /* We identify unique events using a Bloom filter. (You can find my
2505 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2506 With the per_addr option, an "event" is a recipient address, though the
2507 user can use the unique option to define their own events. We only count
2508 an event if we have not seen it before.
2509
2510 We size the filter according to the rate limit, which (in leaky mode)
2511 is the limit on the population of the filter. We allow 16 bits of space
2512 per entry (see the construction code above) and we set (up to) 8 of them
2513 when inserting an element (see the loop below). The probability of a false
2514 positive (an event we have not seen before but which we fail to count) is
2515
2516 size = limit * 16
2517 numhash = 8
2518 allzero = exp(-numhash * pop / size)
2519 = exp(-0.5 * pop / limit)
2520 fpr = pow(1 - allzero, numhash)
2521
2522 For senders at the limit the fpr is 0.06% or 1 in 1700
2523 and for senders at half the limit it is 0.0006% or 1 in 170000
2524
2525 In strict mode the Bloom filter can fill up beyond the normal limit, in
2526 which case the false positive rate will rise. This means that the
2527 measured rate for very fast senders can bogusly drop off after a while.
2528
2529 At twice the limit, the fpr is 2.5% or 1 in 40
2530 At four times the limit, it is 31% or 1 in 3.2
2531
2532 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2533 decay below the limit, and if this is more than one then the Bloom filter
2534 will be discarded before the decay gets that far. The false positive rate
2535 at this threshold is 9.3% or 1 in 10.7. */
2536
2537 BOOL seen;
2538 unsigned n, hash, hinc;
2539 uschar md5sum[16];
2540 md5 md5info;
2541
2542 /* Instead of using eight independent hash values, we combine two values
2543 using the formula h1 + n * h2. This does not harm the Bloom filter's
2544 performance, and means the amount of hash we need is independent of the
2545 number of bits we set in the filter. */
2546
2547 md5_start(&md5info);
2548 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2549 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2550 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2551
2552 /* Scan the bits corresponding to this event. A zero bit means we have
2553 not seen it before. Ensure all bits are set to record this event. */
2554
e1d04f48 2555 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
c99ce5c9
TF
2556
2557 seen = TRUE;
2558 for (n = 0; n < 8; n++, hash += hinc)
2559 {
2560 int bit = 1 << (hash % 8);
2561 int byte = (hash / 8) % dbdb->bloom_size;
2562 if ((dbdb->bloom[byte] & bit) == 0)
2563 {
2564 dbdb->bloom[byte] |= bit;
2565 seen = FALSE;
2566 }
2567 }
2568
2569 /* If this event has occurred before, do not count it. */
2570
2571 if (seen)
2572 {
e1d04f48 2573 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
c99ce5c9
TF
2574 count = 0.0;
2575 }
2576 else
e1d04f48 2577 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
c99ce5c9
TF
2578 }
2579
2580/* If there was no previous ratelimit data block for this key, initialize
2581the new one, otherwise update the block from the database. The initial rate
2582is what would be computed by the code below for an infinite interval. */
2583
65a32f85 2584if (!dbd)
870f6ba8 2585 {
e1d04f48 2586 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
c99ce5c9 2587 dbd = &dbdb->dbd;
870f6ba8
TF
2588 dbd->time_stamp = tv.tv_sec;
2589 dbd->time_usec = tv.tv_usec;
c99ce5c9 2590 dbd->rate = count;
870f6ba8
TF
2591 }
2592else
2593 {
2594 /* The smoothed rate is computed using an exponentially weighted moving
2595 average adjusted for variable sampling intervals. The standard EWMA for
2596 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2597 where f() is the measured value and f'() is the smoothed value.
2598
2599 Old data decays out of the smoothed value exponentially, such that data n
2600 samples old is multiplied by a^n. The exponential decay time constant p
2601 is defined such that data p samples old is multiplied by 1/e, which means
2602 that a = exp(-1/p). We can maintain the same time constant for a variable
2603 sampling interval i by using a = exp(-i/p).
2604
2605 The rate we are measuring is messages per period, suitable for directly
2606 comparing with the limit. The average rate between now and the previous
2607 message is period / interval, which we feed into the EWMA as the sample.
2608
2609 It turns out that the number of messages required for the smoothed rate
2610 to reach the limit when they are sent in a burst is equal to the limit.
2611 This can be seen by analysing the value of the smoothed rate after N
2612 messages sent at even intervals. Let k = (1 - a) * p/i
2613
2614 rate_1 = (1 - a) * p/i + a * rate_0
2615 = k + a * rate_0
2616 rate_2 = k + a * rate_1
2617 = k + a * k + a^2 * rate_0
2618 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2619 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2620 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2621 = rate_0 * a^N + p/i * (1 - a^N)
2622
2623 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2624
2625 rate_N = p/i + (rate_0 - p/i) * a^N
2626 a^N = (rate_N - p/i) / (rate_0 - p/i)
2627 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2628 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2629
2630 Numerical analysis of the above equation, setting the computed rate to
2631 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2632 rates, p/i, the number of messages N = limit. So limit serves as both the
2633 maximum rate measured in messages per period, and the maximum number of
2634 messages that can be sent in a fast burst. */
2635
2636 double this_time = (double)tv.tv_sec
2637 + (double)tv.tv_usec / 1000000.0;
2638 double prev_time = (double)dbd->time_stamp
2639 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2640
2641 /* We must avoid division by zero, and deal gracefully with the clock going
2642 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2643 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2644
e5d5a95f
TF
2645 double interval = this_time - prev_time <= 0.0 ? 1e-9
2646 : this_time - prev_time;
2647
2648 double i_over_p = interval / period;
2649 double a = exp(-i_over_p);
870f6ba8 2650
c99ce5c9
TF
2651 /* Combine the instantaneous rate (period / interval) with the previous rate
2652 using the smoothing factor a. In order to measure sized events, multiply the
2653 instantaneous rate by the count of bytes or recipients etc. */
2654
870f6ba8
TF
2655 dbd->time_stamp = tv.tv_sec;
2656 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2657 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2658
2659 /* When events are very widely spaced the computed rate tends towards zero.
2660 Although this is accurate it turns out not to be useful for our purposes,
2661 especially when the first event after a long silence is the start of a spam
2662 run. A more useful model is that the rate for an isolated event should be the
2663 size of the event per the period size, ignoring the lack of events outside
2664 the current period and regardless of where the event falls in the period. So,
2665 if the interval was so long that the calculated rate is unhelpfully small, we
4c04137d 2666 re-initialize the rate. In the absence of higher-rate bursts, the condition
c99ce5c9
TF
2667 below is true if the interval is greater than the period. */
2668
2669 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2670 }
2671
c99ce5c9
TF
2672/* Clients sending at the limit are considered to be over the limit.
2673This matters for edge cases such as a limit of zero, when the client
2674should be completely blocked. */
3348576f 2675
65a32f85 2676rc = dbd->rate < limit ? FAIL : OK;
870f6ba8
TF
2677
2678/* Update the state if the rate is low or if we are being strict. If we
2679are in leaky mode and the sender's rate is too high, we do not update
2680the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2681rate preventing them from getting any email through. If readonly is set,
2682neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2683
c99ce5c9 2684if ((rc == FAIL && leaky) || strict)
8f240103 2685 {
c99ce5c9 2686 dbfn_write(dbm, key, dbdb, dbdb_size);
e1d04f48 2687 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
8f240103
PH
2688 }
2689else
2690 {
e1d04f48 2691 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
c99ce5c9 2692 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2693 }
2694
870f6ba8
TF
2695dbfn_close(dbm);
2696
c99ce5c9 2697/* Store the result in the tree for future reference. */
870f6ba8 2698
c99ce5c9
TF
2699t = store_get(sizeof(tree_node) + Ustrlen(key));
2700t->data.ptr = dbd;
2701Ustrcpy(t->name, key);
2702(void)tree_insertnode(anchor, t);
870f6ba8
TF
2703
2704/* We create the formatted version of the sender's rate very late in
2705order to ensure that it is done using the correct storage pool. */
2706
2707store_pool = old_pool;
2708sender_rate = string_sprintf("%.1f", dbd->rate);
2709
2710HDEBUG(D_acl)
e1d04f48 2711 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
870f6ba8
TF
2712
2713return rc;
2714}
2715
2716
2717
2718/*************************************************
b0019c78
TF
2719* The udpsend ACL modifier *
2720*************************************************/
2721
2722/* Called by acl_check_condition() below.
2723
2724Arguments:
2725 arg the option string for udpsend=
2726 log_msgptr for error messages
2727
2728Returns: OK - Completed.
2729 DEFER - Problem with DNS lookup.
2730 ERROR - Syntax error in options.
2731*/
2732
2733static int
55414b25 2734acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2735{
2736int sep = 0;
2737uschar *hostname;
2738uschar *portstr;
2739uschar *portend;
2740host_item *h;
2741int portnum;
b0019c78
TF
2742int len;
2743int r, s;
b1f8e4f8 2744uschar * errstr;
b0019c78
TF
2745
2746hostname = string_nextinlist(&arg, &sep, NULL, 0);
2747portstr = string_nextinlist(&arg, &sep, NULL, 0);
2748
f5d25c2b 2749if (!hostname)
b0019c78 2750 {
217b0e56 2751 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2752 return ERROR;
2753 }
f5d25c2b 2754if (!portstr)
b0019c78 2755 {
217b0e56 2756 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2757 return ERROR;
2758 }
f5d25c2b 2759if (!arg)
b0019c78 2760 {
217b0e56 2761 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2762 return ERROR;
2763 }
2764portnum = Ustrtol(portstr, &portend, 10);
2765if (*portend != '\0')
2766 {
217b0e56 2767 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2768 return ERROR;
2769 }
2770
2771/* Make a single-item host list. */
2772h = store_get(sizeof(host_item));
2773memset(h, 0, sizeof(host_item));
2774h->name = hostname;
2775h->port = portnum;
2776h->mx = MX_NONE;
2777
2778if (string_is_ip_address(hostname, NULL))
2779 h->address = hostname, r = HOST_FOUND;
2780else
2781 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2782if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2783 {
217b0e56 2784 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2785 return DEFER;
2786 }
2787
2788HDEBUG(D_acl)
e1d04f48 2789 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
b0019c78 2790
4a5cbaff 2791/*XXX this could better use sendto */
b1f8e4f8 2792r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
4a5cbaff 2793 1, NULL, &errstr, NULL);
b0019c78 2794if (r < 0) goto defer;
27f9999e 2795len = Ustrlen(arg);
9cb1785a 2796r = send(s, arg, len, 0);
b1f8e4f8
JH
2797if (r < 0)
2798 {
2799 errstr = US strerror(errno);
2800 close(s);
2801 goto defer;
2802 }
2803close(s);
b0019c78
TF
2804if (r < len)
2805 {
2806 *log_msgptr =
2807 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2808 return DEFER;
2809 }
2810
2811HDEBUG(D_acl)
e1d04f48 2812 debug_printf_indent("udpsend %d bytes\n", r);
b0019c78
TF
2813
2814return OK;
2815
2816defer:
b1f8e4f8 2817*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2818return DEFER;
2819}
2820
2821
2822
2823/*************************************************
059ec3d9
PH
2824* Handle conditions/modifiers on an ACL item *
2825*************************************************/
2826
2827/* Called from acl_check() below.
2828
2829Arguments:
2830 verb ACL verb
2831 cb ACL condition block - if NULL, result is OK
2832 where where called from
2833 addr the address being checked for RCPT, or NULL
2834 level the nesting level
2835 epp pointer to pass back TRUE if "endpass" encountered
2836 (applies only to "accept" and "discard")
2837 user_msgptr user message pointer
2838 log_msgptr log message pointer
2839 basic_errno pointer to where to put verify error
2840
2841Returns: OK - all conditions are met
2842 DISCARD - an "acl" condition returned DISCARD - only allowed
2843 for "accept" or "discard" verbs
2844 FAIL - at least one condition fails
2845 FAIL_DROP - an "acl" condition returned FAIL_DROP
2846 DEFER - can't tell at the moment (typically, lookup defer,
2847 but can be temporary callout problem)
2848 ERROR - ERROR from nested ACL or expansion failure or other
2849 error
2850*/
2851
2852static int
2853acl_check_condition(int verb, acl_condition_block *cb, int where,
2854 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2855 uschar **log_msgptr, int *basic_errno)
2856{
2857uschar *user_message = NULL;
2858uschar *log_message = NULL;
059ec3d9 2859int rc = OK;
8523533c 2860#ifdef WITH_CONTENT_SCAN
0f0c8159 2861int sep = -'/';
8523533c 2862#endif
059ec3d9 2863
bce15b62 2864for (; cb; cb = cb->next)
059ec3d9 2865 {
55414b25 2866 const uschar *arg;
8e669ac1 2867 int control_type;
059ec3d9
PH
2868
2869 /* The message and log_message items set up messages to be used in
2870 case of rejection. They are expanded later. */
2871
2872 if (cb->type == ACLC_MESSAGE)
2873 {
e1d04f48 2874 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
059ec3d9
PH
2875 user_message = cb->arg;
2876 continue;
2877 }
2878
2879 if (cb->type == ACLC_LOG_MESSAGE)
2880 {
e1d04f48 2881 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
059ec3d9
PH
2882 log_message = cb->arg;
2883 continue;
2884 }
2885
2886 /* The endpass "condition" just sets a flag to show it occurred. This is
2887 checked at compile time to be on an "accept" or "discard" item. */
2888
2889 if (cb->type == ACLC_ENDPASS)
2890 {
2891 *epp = TRUE;
2892 continue;
2893 }
2894
2895 /* For other conditions and modifiers, the argument is expanded now for some
2896 of them, but not for all, because expansion happens down in some lower level
2897 checking functions in some cases. */
2898
560e71cc
JH
2899 if (!conditions[cb->type].expand_at_top)
2900 arg = cb->arg;
2901 else if (!(arg = expand_string(cb->arg)))
059ec3d9 2902 {
8768d548 2903 if (f.expand_string_forcedfail) continue;
560e71cc
JH
2904 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2905 cb->arg, expand_string_message);
8768d548 2906 return f.search_find_defer ? DEFER : ERROR;
059ec3d9 2907 }
059ec3d9
PH
2908
2909 /* Show condition, and expanded condition if it's different */
2910
2911 HDEBUG(D_acl)
2912 {
2913 int lhswidth = 0;
e1d04f48 2914 debug_printf_indent("check %s%s %n",
2d009132
JH
2915 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2916 conditions[cb->type].name, &lhswidth);
059ec3d9
PH
2917
2918 if (cb->type == ACLC_SET)
2919 {
a79d8834
JH
2920#ifndef DISABLE_DKIM
2921 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2922 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2923 {
2924 debug_printf("%s ", cb->u.varname);
2925 lhswidth += 19;
2926 }
2927 else
2928#endif
2929 {
2930 debug_printf("acl_%s ", cb->u.varname);
2931 lhswidth += 5 + Ustrlen(cb->u.varname);
2932 }
059ec3d9
PH
2933 }
2934
2935 debug_printf("= %s\n", cb->arg);
2936
2937 if (arg != cb->arg)
2938 debug_printf("%.*s= %s\n", lhswidth,
2939 US" ", CS arg);
2940 }
2941
2942 /* Check that this condition makes sense at this time */
2943
2d009132 2944 if ((conditions[cb->type].forbids & (1 << where)) != 0)
059ec3d9
PH
2945 {
2946 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2d009132
JH
2947 conditions[cb->type].is_modifier ? "use" : "test",
2948 conditions[cb->type].name, acl_wherenames[where]);
059ec3d9
PH
2949 return ERROR;
2950 }
2951
2952 /* Run the appropriate test for each condition, or take the appropriate
2953 action for the remaining modifiers. */
2954
2955 switch(cb->type)
2956 {
71fafd95
PH
2957 case ACLC_ADD_HEADER:
2958 setup_header(arg);
2959 break;
2960
059ec3d9
PH
2961 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2962 "discard" verb. */
71fafd95 2963
059ec3d9 2964 case ACLC_ACL:
e1d04f48 2965 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
7421ecab
JH
2966 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2967 {
2968 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2969 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2970 verbs[verb]);
2971 return ERROR;
2972 }
059ec3d9
PH
2973 break;
2974
2975 case ACLC_AUTHENTICATED:
c44ff8be
JH
2976 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2977 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
059ec3d9
PH
2978 break;
2979
71fafd95 2980 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2981 case ACLC_BMI_OPTIN:
2982 {
2983 int old_pool = store_pool;
2984 store_pool = POOL_PERM;
2985 bmi_current_optin = string_copy(arg);
2986 store_pool = old_pool;
2987 }
2988 break;
71fafd95 2989 #endif
8523533c 2990
059ec3d9 2991 case ACLC_CONDITION:
f3766eb5
NM
2992 /* The true/false parsing here should be kept in sync with that used in
2993 expand.c when dealing with ECOND_BOOL so that we don't have too many
2994 different definitions of what can be a boolean. */
51c7471d
JH
2995 if (*arg == '-'
2996 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2997 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
2998 rc = (Uatoi(arg) == 0)? FAIL : OK;
2999 else
3000 rc = (strcmpic(arg, US"no") == 0 ||
3001 strcmpic(arg, US"false") == 0)? FAIL :
3002 (strcmpic(arg, US"yes") == 0 ||
3003 strcmpic(arg, US"true") == 0)? OK : DEFER;
3004 if (rc == DEFER)
3005 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3006 break;
3007
c3611384
PH
3008 case ACLC_CONTINUE: /* Always succeeds */
3009 break;
3010
059ec3d9 3011 case ACLC_CONTROL:
c5fcb476 3012 {
55414b25
JH
3013 const uschar *p = NULL;
3014 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3015
55414b25 3016 /* Check if this control makes sense at this time */
f7572e5a 3017
d7bed771 3018 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH
3019 {
3020 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3021 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH
3022 return ERROR;
3023 }
8800895a 3024
55414b25
JH
3025 switch(control_type)
3026 {
3027 case CONTROL_AUTH_UNADVERTISED:
8768d548 3028 f.allow_auth_unadvertised = TRUE;
55414b25
JH
3029 break;
3030
3031 #ifdef EXPERIMENTAL_BRIGHTMAIL
3032 case CONTROL_BMI_RUN:
3033 bmi_run = 1;
3034 break;
3035 #endif
3036
3037 #ifndef DISABLE_DKIM
3038 case CONTROL_DKIM_VERIFY:
8768d548 3039 f.dkim_disable_verify = TRUE;
55414b25
JH
3040 #ifdef EXPERIMENTAL_DMARC
3041 /* Since DKIM was blocked, skip DMARC too */
8768d548
JH
3042 f.dmarc_disable_verify = TRUE;
3043 f.dmarc_enable_forensic = FALSE;
55414b25
JH
3044 #endif
3045 break;
3046 #endif
3047
3048 #ifdef EXPERIMENTAL_DMARC
3049 case CONTROL_DMARC_VERIFY:
8768d548 3050 f.dmarc_disable_verify = TRUE;
55414b25
JH
3051 break;
3052
3053 case CONTROL_DMARC_FORENSIC:
8768d548 3054 f.dmarc_enable_forensic = TRUE;
55414b25
JH
3055 break;
3056 #endif
3057
3058 case CONTROL_DSCP:
3059 if (*p == '/')
3060 {
3061 int fd, af, level, optname, value;
3062 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3063 a socket; we can accept that, we'll just debug-log failures anyway. */
3064 fd = fileno(smtp_in);
3065 af = ip_get_address_family(fd);
3066 if (af < 0)
3067 {
3068 HDEBUG(D_acl)
e1d04f48 3069 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
55414b25
JH
3070 strerror(errno));
3071 break;
3072 }
3073 if (dscp_lookup(p+1, af, &level, &optname, &value))
3074 {
3075 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3076 {
e1d04f48 3077 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
55414b25
JH
3078 p+1, strerror(errno));
3079 }
3080 else
3081 {
e1d04f48 3082 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
55414b25
JH
3083 }
3084 }
3085 else
3086 {
3087 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3088 return ERROR;
3089 }
3090 }
3091 else
3092 {
3093 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3094 return ERROR;
3095 }
3096 break;
3097
3098 case CONTROL_ERROR:
3099 return ERROR;
3100
3101 case CONTROL_CASEFUL_LOCAL_PART:
3102 deliver_localpart = addr->cc_local_part;
3103 break;
3104
3105 case CONTROL_CASELOWER_LOCAL_PART:
3106 deliver_localpart = addr->lc_local_part;
3107 break;
3108
3109 case CONTROL_ENFORCE_SYNC:
3110 smtp_enforce_sync = TRUE;
3111 break;
3112
3113 case CONTROL_NO_ENFORCE_SYNC:
3114 smtp_enforce_sync = FALSE;
3115 break;
3116
3117 #ifdef WITH_CONTENT_SCAN
3118 case CONTROL_NO_MBOX_UNSPOOL:
8768d548 3119 f.no_mbox_unspool = TRUE;
55414b25
JH
3120 break;
3121 #endif
3122
3123 case CONTROL_NO_MULTILINE:
8768d548 3124 f.no_multiline_responses = TRUE;
55414b25
JH
3125 break;
3126
3127 case CONTROL_NO_PIPELINING:
8768d548 3128 f.pipelining_enable = FALSE;
55414b25
JH
3129 break;
3130
3131 case CONTROL_NO_DELAY_FLUSH:
8768d548 3132 f.disable_delay_flush = TRUE;
55414b25
JH
3133 break;
3134
3135 case CONTROL_NO_CALLOUT_FLUSH:
8768d548 3136 f.disable_callout_flush = TRUE;
55414b25
JH
3137 break;
3138
3139 case CONTROL_FAKEREJECT:
57cc2785 3140 cancel_cutthrough_connection(TRUE, US"fakereject");
55414b25
JH
3141 case CONTROL_FAKEDEFER:
3142 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3143 if (*p == '/')
3144 {
3145 const uschar *pp = p + 1;
3146 while (*pp != 0) pp++;
3147 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3148 p = pp;
3149 }
3150 else
3151 {
3152 /* Explicitly reset to default string */
3153 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3154 }
3155 break;
ed7f7860 3156
55414b25 3157 case CONTROL_FREEZE:
8768d548 3158 f.deliver_freeze = TRUE;
55414b25
JH
3159 deliver_frozen_at = time(NULL);
3160 freeze_tell = freeze_tell_config; /* Reset to configured value */
3161 if (Ustrncmp(p, "/no_tell", 8) == 0)
3162 {
3163 p += 8;
3164 freeze_tell = NULL;
3165 }
3166 if (*p != 0)
3167 {
3168 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3169 return ERROR;
3170 }
57cc2785 3171 cancel_cutthrough_connection(TRUE, US"item frozen");
55414b25
JH
3172 break;
3173
3174 case CONTROL_QUEUE_ONLY:
8768d548 3175 f.queue_only_policy = TRUE;
57cc2785 3176 cancel_cutthrough_connection(TRUE, US"queueing forced");
55414b25
JH
3177 break;
3178
8ac90765
JH
3179#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
3180 case CONTROL_REQUIRETLS:
3181 tls_requiretls |= REQUIRETLS_MSG;
3182 break;
3183#endif
55414b25
JH
3184 case CONTROL_SUBMISSION:
3185 originator_name = US"";
8768d548 3186 f.submission_mode = TRUE;
55414b25
JH
3187 while (*p == '/')
3188 {
3189 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3190 {
3191 p += 14;
8768d548
JH
3192 f.active_local_sender_retain = TRUE;
3193 f.active_local_from_check = FALSE;
55414b25
JH
3194 }
3195 else if (Ustrncmp(p, "/domain=", 8) == 0)
3196 {
3197 const uschar *pp = p + 8;
3198 while (*pp != 0 && *pp != '/') pp++;
3199 submission_domain = string_copyn(p+8, pp-p-8);
3200 p = pp;
3201 }
3202 /* The name= option must be last, because it swallows the rest of
3203 the string. */
3204 else if (Ustrncmp(p, "/name=", 6) == 0)
3205 {
3206 const uschar *pp = p + 6;
3207 while (*pp != 0) pp++;
3208 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3209 big_buffer, big_buffer_size));
3210 p = pp;
3211 }
3212 else break;
3213 }
3214 if (*p != 0)
3215 {
3216 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3217 return ERROR;
3218 }
3219 break;
e4bdf652 3220
55414b25 3221 case CONTROL_DEBUG:
55414b25 3222 {
b0d68adc
JH
3223 uschar * debug_tag = NULL;
3224 uschar * debug_opts = NULL;
3225 BOOL kill = FALSE;
3226
3227 while (*p == '/')
55414b25 3228 {
b0d68adc
JH
3229 const uschar * pp = p+1;
3230 if (Ustrncmp(pp, "tag=", 4) == 0)
3231 {
3232 for (pp += 4; *pp && *pp != '/';) pp++;
3233 debug_tag = string_copyn(p+5, pp-p-5);
3234 }
3235 else if (Ustrncmp(pp, "opts=", 5) == 0)
3236 {
3237 for (pp += 5; *pp && *pp != '/';) pp++;
3238 debug_opts = string_copyn(p+6, pp-p-6);
3239 }
3240 else if (Ustrncmp(pp, "kill", 4) == 0)
3241 {
3242 for (pp += 4; *pp && *pp != '/';) pp++;
3243 kill = TRUE;
3244 }
3245 else
3246 while (*pp && *pp != '/') pp++;
55414b25
JH
3247 p = pp;
3248 }
b0d68adc
JH
3249
3250 if (kill)
3251 debug_logging_stop();
3252 else
3253 debug_logging_activate(debug_tag, debug_opts);
55414b25 3254 }
55414b25
JH
3255 break;
3256
3257 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
8768d548 3258 f.suppress_local_fixups = TRUE;
55414b25
JH
3259 break;
3260
3261 case CONTROL_CUTTHROUGH_DELIVERY:
051d5efa
JH
3262 {
3263 uschar * ignored = NULL;
a2b89db1 3264#ifndef DISABLE_PRDR
55414b25 3265 if (prdr_requested)
a2b89db1
PP
3266#else
3267 if (0)
3268#endif
55414b25
JH
3269 /* Too hard to think about for now. We might in future cutthrough
3270 the case where both sides handle prdr and this-node prdr acl
3271 is "accept" */
051d5efa 3272 ignored = US"PRDR active";
5032d1cf
JH
3273 else
3274 {
8768d548 3275 if (f.deliver_freeze)
051d5efa 3276 ignored = US"frozen";
8768d548 3277 else if (f.queue_only_policy)
051d5efa 3278 ignored = US"queue-only";
55414b25 3279 else if (fake_response == FAIL)
051d5efa 3280 ignored = US"fakereject";
55414b25
JH
3281 else
3282 {
ff5929e3
JH
3283 if (rcpt_count == 1)
3284 {
051d5efa 3285 cutthrough.delivery = TRUE; /* control accepted */
ff5929e3
JH
3286 while (*p == '/')
3287 {
3288 const uschar * pp = p+1;
3289 if (Ustrncmp(pp, "defer=", 6) == 0)
3290 {
3291 pp += 6;
3292 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3293 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3294 }
3295 else
3296 while (*pp && *pp != '/') pp++;
3297 p = pp;
3298 }
3299 }
06fdb9f7 3300 else
051d5efa 3301 ignored = US"nonfirst rcpt";
55414b25 3302 }
5032d1cf 3303 }
051d5efa
JH
3304 DEBUG(D_acl) if (ignored)
3305 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3306 }
3307 break;
3c8b3577 3308
8c5d388a 3309#ifdef SUPPORT_I18N
3c8b3577
JH
3310 case CONTROL_UTF8_DOWNCONVERT:
3311 if (*p == '/')
3312 {
921dfc11
JH
3313 if (p[1] == '1')
3314 {
3315 message_utf8_downconvert = 1;
3316 addr->prop.utf8_downcvt = TRUE;
3317 addr->prop.utf8_downcvt_maybe = FALSE;
3318 p += 2;
3319 break;
3320 }
3321 if (p[1] == '0')
3322 {
3323 message_utf8_downconvert = 0;
3324 addr->prop.utf8_downcvt = FALSE;
3325 addr->prop.utf8_downcvt_maybe = FALSE;
3326 p += 2;
3327 break;
3328 }
3c8b3577 3329 if (p[1] == '-' && p[2] == '1')
921dfc11
JH
3330 {
3331 message_utf8_downconvert = -1;
3332 addr->prop.utf8_downcvt = FALSE;
3333 addr->prop.utf8_downcvt_maybe = TRUE;
3334 p += 3;
3335 break;
3336 }
3c8b3577
JH
3337 *log_msgptr = US"bad option value for control=utf8_downconvert";
3338 }
3339 else
3340 {
921dfc11
JH
3341 message_utf8_downconvert = 1;
3342 addr->prop.utf8_downcvt = TRUE;
3343 addr->prop.utf8_downcvt_maybe = FALSE;
3344 break;
3c8b3577
JH
3345 }
3346 return ERROR;
8c5d388a 3347#endif
3c8b3577 3348
9171d434 3349 }
55414b25 3350 break;
059ec3d9 3351 }
059ec3d9 3352
6a8f9482
TK
3353 #ifdef EXPERIMENTAL_DCC
3354 case ACLC_DCC:
3355 {
4c04137d 3356 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3357 const uschar * list = arg;
3358 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3359 /* Run the dcc backend. */
3360 rc = dcc_process(&ss);
4c04137d 3361 /* Modify return code based upon the existence of options. */
3c8b3577 3362 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3363 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3364 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3365 }
3366 break;
3367 #endif
3368
71fafd95 3369 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3370 case ACLC_DECODE:
3371 rc = mime_decode(&arg);
3372 break;
71fafd95 3373 #endif
8523533c 3374
059ec3d9
PH
3375 case ACLC_DELAY:
3376 {
3377 int delay = readconf_readtime(arg, 0, FALSE);
3378 if (delay < 0)
3379 {
3380 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3381 "modifier: \"%s\" is not a time value", arg);
3382 return ERROR;
3383 }
3384 else
3385 {
e1d04f48 3386 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
059ec3d9
PH
3387 delay);
3388 if (host_checking)
3389 {
3390 HDEBUG(D_acl)
e1d04f48 3391 debug_printf_indent("delay skipped in -bh checking mode\n");
059ec3d9 3392 }
010c2d14 3393
ae9d18bc
JH
3394 /* NOTE 1: Remember that we may be
3395 dealing with stdin/stdout here, in addition to TCP/IP connections.
3396 Also, delays may be specified for non-SMTP input, where smtp_out and
3397 smtp_in will be NULL. Whatever is done must work in all cases.
3398
3399 NOTE 2: The added feature of flushing the output before a delay must
3400 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3401 */
3402
3403 else
3404 {
02c30a32 3405 if (smtp_out && !f.disable_delay_flush)
ae9d18bc
JH
3406 mac_smtp_fflush();
3407
861a7c51 3408#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH
3409 {
3410 struct pollfd p;
3411 nfds_t n = 0;
3412 if (smtp_out)
3413 {
3414 p.fd = fileno(smtp_out);
3415 p.events = POLLRDHUP;
3416 n = 1;
3417 }
3418 if (poll(&p, n, delay*1000) > 0)
e1d04f48 3419 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
ae9d18bc
JH
3420 }
3421#else
02c30a32
JH
3422 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3423 TCP/IP connection has gone away without reading from it. This means
3424 that we cannot shorten the delay below if the client goes away,
3425 because we cannot discover that the client has closed its end of the
3426 connection. (The connection is actually in a half-closed state,
3427 waiting for the server to close its end.) It would be nice to be able
3428 to detect this state, so that the Exim process is not held up
3429 unnecessarily. However, it seems that we can't. The poll() function
3430 does not do the right thing, and in any case it is not always
3431 available. */
010c2d14 3432
86b8287f 3433 while (delay > 0) delay = sleep(delay);
ae9d18bc 3434#endif
8e669ac1 3435 }
059ec3d9
PH
3436 }
3437 }
3438 break;
3439
80a47a2c
TK
3440 #ifndef DISABLE_DKIM
3441 case ACLC_DKIM_SIGNER:
a79d8834 3442 if (dkim_cur_signer)
9e5d6b55 3443 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3444 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3445 else
b0b9dbb1 3446 rc = FAIL;
71fafd95
PH
3447 break;
3448
80a47a2c 3449 case ACLC_DKIM_STATUS:
a79d8834 3450 rc = match_isinlist(dkim_verify_status,
80a47a2c 3451 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3452 break;
3453 #endif
fb2274d4 3454
4840604e
TL
3455 #ifdef EXPERIMENTAL_DMARC
3456 case ACLC_DMARC_STATUS:
8768d548 3457 if (!f.dmarc_has_been_checked)
4840604e 3458 dmarc_process();
8768d548 3459 f.dmarc_has_been_checked = TRUE;
4840604e
TL
3460 /* used long way of dmarc_exim_expand_query() in case we need more
3461 * view into the process in the future. */
3462 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3463 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3464 break;
3465 #endif
3466
059ec3d9 3467 case ACLC_DNSLISTS:
379ba7d0 3468 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH
3469 break;
3470
3471 case ACLC_DOMAINS:
3472 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3473 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3474 break;
3475
3476 /* The value in tls_cipher is the full cipher name, for example,
3477 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3478 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3479 what may in practice come out of the SSL library - which at the time of
3480 writing is poorly documented. */
3481
3482 case ACLC_ENCRYPTED:
817d9f57 3483 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3484 {
3485 uschar *endcipher = NULL;
817d9f57
JH
3486 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3487 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3488 {
3489 endcipher = Ustrchr(++cipher, ':');
3490 if (endcipher != NULL) *endcipher = 0;
3491 }
3492 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3493 if (endcipher != NULL) *endcipher = ':';
3494 }
3495 break;
3496
3497 /* Use verify_check_this_host() instead of verify_check_host() so that
3498 we can pass over &host_data to catch any looked up data. Once it has been
3499 set, it retains its value so that it's still there if another ACL verb
3500 comes through here and uses the cache. However, we must put it into
3501 permanent store in case it is also expected to be used in a subsequent
3502 message in the same SMTP connection. */
3503
3504 case ACLC_HOSTS:
3505 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH
3506 (sender_host_address == NULL)? US"" : sender_host_address,
3507 CUSS &host_data);
4a452c43
JH
3508 if (rc == DEFER) *log_msgptr = search_error_message;
3509 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH
3510 break;
3511
3512 case ACLC_LOCAL_PARTS:
3513 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3514 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3515 CUSS &deliver_localpart_data);
059ec3d9
PH
3516 break;
3517
6ea85e9a
PH
3518 case ACLC_LOG_REJECT_TARGET:
3519 {
3520 int logbits = 0;
3521 int sep = 0;
55414b25 3522 const uschar *s = arg;
6ea85e9a 3523 uschar *ss;
4a452c43 3524 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH
3525 {
3526 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3527 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3528 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3529 else
3530 {
3531 logbits |= LOG_MAIN|LOG_REJECT;
3532 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3533 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3534 }
3535 }
3536 log_reject_target = logbits;
3537 }
3538 break;
3539
059ec3d9
PH
3540 case ACLC_LOGWRITE:
3541 {
3542 int logbits = 0;
55414b25 3543 const uschar *s = arg;
059ec3d9
PH
3544 if (*s == ':')
3545 {
3546 s++;
3547 while (*s != ':')
3548 {
3549 if (Ustrncmp(s, "main", 4) == 0)
3550 { logbits |= LOG_MAIN; s += 4; }
3551 else if (Ustrncmp(s, "panic", 5) == 0)
3552 { logbits |= LOG_PANIC; s += 5; }
3553 else if (Ustrncmp(s, "reject", 6) == 0)
3554 { logbits |= LOG_REJECT; s += 6; }
3555 else
3556 {
3557 logbits = LOG_MAIN|LOG_PANIC;
3558 s = string_sprintf(":unknown log name in \"%s\" in "
3559 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3560 }
3561 if (*s == ',') s++;
3562 }
3563 s++;
3564 }
3565 while (isspace(*s)) s++;
6ea85e9a 3566
059ec3d9
PH
3567 if (logbits == 0) logbits = LOG_MAIN;