Compiling with DomainKeys caused the test suite to show up some bugs:
[exim.git] / src / src / acl.c
CommitLineData
9a26b6b2 1/* $Cambridge: exim/src/src/acl.c,v 1.40 2005/06/20 13:58:22 ph10 Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
c988f1f4 7/* Copyright (c) University of Cambridge 1995 - 2005 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Code for handling Access Control Lists (ACLs) */
11
12#include "exim.h"
13
14
15/* Default callout timeout */
16
17#define CALLOUT_TIMEOUT_DEFAULT 30
18
19/* ACL verb codes - keep in step with the table of verbs that follows */
20
21enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
22 ACL_WARN };
23
24/* ACL verbs */
25
26static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
28 US"warn" };
29
30/* For each verb, the condition for which "message" is used */
31
32static int msgcond[] = { FAIL, OK, OK, FAIL, OK, FAIL, OK };
33
34/* ACL condition and modifier codes - keep in step with the table that
35follows. */
36
8523533c
TK
37enum { ACLC_ACL, ACLC_AUTHENTICATED,
38#ifdef EXPERIMENTAL_BRIGHTMAIL
39 ACLC_BMI_OPTIN,
40#endif
41ACLC_CONDITION, ACLC_CONTROL,
42#ifdef WITH_CONTENT_SCAN
43 ACLC_DECODE,
44#endif
45 ACLC_DELAY,
46#ifdef WITH_OLD_DEMIME
47 ACLC_DEMIME,
8e669ac1 48#endif
fb2274d4
TK
49#ifdef EXPERIMENTAL_DOMAINKEYS
50 ACLC_DK_DOMAIN_SOURCE,
51 ACLC_DK_POLICY,
52 ACLC_DK_SENDER_DOMAINS,
53 ACLC_DK_SENDER_LOCAL_PARTS,
54 ACLC_DK_SENDERS,
55 ACLC_DK_STATUS,
56#endif
8523533c
TK
57 ACLC_DNSLISTS, ACLC_DOMAINS, ACLC_ENCRYPTED, ACLC_ENDPASS,
58 ACLC_HOSTS, ACLC_LOCAL_PARTS, ACLC_LOG_MESSAGE, ACLC_LOGWRITE,
59#ifdef WITH_CONTENT_SCAN
60 ACLC_MALWARE,
61#endif
62 ACLC_MESSAGE,
63#ifdef WITH_CONTENT_SCAN
64 ACLC_MIME_REGEX,
65#endif
870f6ba8 66 ACLC_RATELIMIT,
8523533c
TK
67 ACLC_RECIPIENTS,
68#ifdef WITH_CONTENT_SCAN
69 ACLC_REGEX,
70#endif
71 ACLC_SENDER_DOMAINS, ACLC_SENDERS, ACLC_SET,
72#ifdef WITH_CONTENT_SCAN
8e669ac1 73 ACLC_SPAM,
8523533c
TK
74#endif
75#ifdef EXPERIMENTAL_SPF
76 ACLC_SPF,
77#endif
78 ACLC_VERIFY };
059ec3d9
PH
79
80/* ACL conditions/modifiers: "delay", "control", "endpass", "message",
81"log_message", "logwrite", and "set" are modifiers that look like conditions
82but always return TRUE. They are used for their side effects. */
83
9a26b6b2
PH
84static uschar *conditions[] = {
85 US"acl",
86 US"authenticated",
8523533c
TK
87#ifdef EXPERIMENTAL_BRIGHTMAIL
88 US"bmi_optin",
89#endif
90 US"condition",
8e669ac1 91 US"control",
8523533c
TK
92#ifdef WITH_CONTENT_SCAN
93 US"decode",
94#endif
95 US"delay",
96#ifdef WITH_OLD_DEMIME
97 US"demime",
98#endif
fb2274d4 99#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
100 US"dk_domain_source",
101 US"dk_policy",
102 US"dk_sender_domains",
103 US"dk_sender_local_parts",
104 US"dk_senders",
105 US"dk_status",
fb2274d4 106#endif
8523533c 107 US"dnslists", US"domains", US"encrypted",
059ec3d9 108 US"endpass", US"hosts", US"local_parts", US"log_message", US"logwrite",
8523533c
TK
109#ifdef WITH_CONTENT_SCAN
110 US"malware",
111#endif
112 US"message",
113#ifdef WITH_CONTENT_SCAN
114 US"mime_regex",
115#endif
870f6ba8 116 US"ratelimit",
8523533c
TK
117 US"recipients",
118#ifdef WITH_CONTENT_SCAN
119 US"regex",
120#endif
121 US"sender_domains", US"senders", US"set",
122#ifdef WITH_CONTENT_SCAN
123 US"spam",
124#endif
125#ifdef EXPERIMENTAL_SPF
126 US"spf",
127#endif
059ec3d9 128 US"verify" };
8e669ac1 129
c5fcb476 130
9a26b6b2
PH
131/* Return values from decode_control(); keep in step with the table of names
132that follows! */
133
134enum {
135#ifdef EXPERIMENTAL_BRIGHTMAIL
136 CONTROL_BMI_RUN,
137#endif
138#ifdef EXPERIMENTAL_DOMAINKEYS
139 CONTROL_DK_VERIFY,
140#endif
141 CONTROL_ERROR, CONTROL_CASEFUL_LOCAL_PART, CONTROL_CASELOWER_LOCAL_PART,
142 CONTROL_ENFORCE_SYNC, CONTROL_NO_ENFORCE_SYNC, CONTROL_FREEZE,
143 CONTROL_QUEUE_ONLY, CONTROL_SUBMISSION,
144#ifdef WITH_CONTENT_SCAN
145 CONTROL_NO_MBOX_UNSPOOL,
146#endif
147 CONTROL_FAKEDEFER, CONTROL_FAKEREJECT, CONTROL_NO_MULTILINE };
148
149/* ACL control names; keep in step with the table above! */
150
151static uschar *controls[] = {
152 #ifdef EXPERIMENTAL_BRIGHTMAIL
153 US"bmi_run",
154 #endif
155 #ifdef EXPERIMENTAL_DOMAINKEYS
156 US"dk_verify",
157 #endif
158 US"error", US"caseful_local_part",
c5fcb476 159 US"caselower_local_part", US"enforce_sync", US"no_enforce_sync", US"freeze",
9a26b6b2
PH
160 US"queue_only", US"submission",
161 #ifdef WITH_CONTENT_SCAN
162 US"no_mbox_unspool",
163 #endif
164 US"no_multiline"};
059ec3d9
PH
165
166/* Flags to indicate for which conditions /modifiers a string expansion is done
167at the outer level. In the other cases, expansion already occurs in the
168checking functions. */
169
170static uschar cond_expand_at_top[] = {
171 TRUE, /* acl */
172 FALSE, /* authenticated */
8523533c
TK
173#ifdef EXPERIMENTAL_BRIGHTMAIL
174 TRUE, /* bmi_optin */
8e669ac1 175#endif
059ec3d9
PH
176 TRUE, /* condition */
177 TRUE, /* control */
8523533c
TK
178#ifdef WITH_CONTENT_SCAN
179 TRUE, /* decode */
180#endif
059ec3d9 181 TRUE, /* delay */
8523533c
TK
182#ifdef WITH_OLD_DEMIME
183 TRUE, /* demime */
184#endif
fb2274d4 185#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
186 TRUE, /* dk_domain_source */
187 TRUE, /* dk_policy */
188 TRUE, /* dk_sender_domains */
e715ad22 189 TRUE, /* dk_sender_local_parts */
7f45268c
PH
190 TRUE, /* dk_senders */
191 TRUE, /* dk_status */
fb2274d4 192#endif
059ec3d9
PH
193 TRUE, /* dnslists */
194 FALSE, /* domains */
195 FALSE, /* encrypted */
196 TRUE, /* endpass */
197 FALSE, /* hosts */
198 FALSE, /* local_parts */
199 TRUE, /* log_message */
200 TRUE, /* logwrite */
8523533c
TK
201#ifdef WITH_CONTENT_SCAN
202 TRUE, /* malware */
203#endif
059ec3d9 204 TRUE, /* message */
8523533c
TK
205#ifdef WITH_CONTENT_SCAN
206 TRUE, /* mime_regex */
207#endif
870f6ba8 208 TRUE, /* ratelimit */
059ec3d9 209 FALSE, /* recipients */
8523533c
TK
210#ifdef WITH_CONTENT_SCAN
211 TRUE, /* regex */
212#endif
059ec3d9
PH
213 FALSE, /* sender_domains */
214 FALSE, /* senders */
215 TRUE, /* set */
8523533c
TK
216#ifdef WITH_CONTENT_SCAN
217 TRUE, /* spam */
218#endif
219#ifdef EXPERIMENTAL_SPF
220 TRUE, /* spf */
221#endif
059ec3d9
PH
222 TRUE /* verify */
223};
224
225/* Flags to identify the modifiers */
226
227static uschar cond_modifiers[] = {
228 FALSE, /* acl */
229 FALSE, /* authenticated */
8523533c
TK
230#ifdef EXPERIMENTAL_BRIGHTMAIL
231 TRUE, /* bmi_optin */
8e669ac1 232#endif
059ec3d9
PH
233 FALSE, /* condition */
234 TRUE, /* control */
8523533c
TK
235#ifdef WITH_CONTENT_SCAN
236 FALSE, /* decode */
237#endif
059ec3d9 238 TRUE, /* delay */
8523533c
TK
239#ifdef WITH_OLD_DEMIME
240 FALSE, /* demime */
241#endif
fb2274d4 242#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
243 FALSE, /* dk_domain_source */
244 FALSE, /* dk_policy */
245 FALSE, /* dk_sender_domains */
e715ad22 246 FALSE, /* dk_sender_local_parts */
7f45268c
PH
247 FALSE, /* dk_senders */
248 FALSE, /* dk_status */
fb2274d4 249#endif
059ec3d9
PH
250 FALSE, /* dnslists */
251 FALSE, /* domains */
252 FALSE, /* encrypted */
253 TRUE, /* endpass */
254 FALSE, /* hosts */
255 FALSE, /* local_parts */
256 TRUE, /* log_message */
8523533c
TK
257 TRUE, /* logwrite */
258#ifdef WITH_CONTENT_SCAN
259 FALSE, /* malware */
260#endif
059ec3d9 261 TRUE, /* message */
8523533c
TK
262#ifdef WITH_CONTENT_SCAN
263 FALSE, /* mime_regex */
264#endif
870f6ba8 265 FALSE, /* ratelimit */
059ec3d9 266 FALSE, /* recipients */
8523533c
TK
267#ifdef WITH_CONTENT_SCAN
268 FALSE, /* regex */
269#endif
059ec3d9
PH
270 FALSE, /* sender_domains */
271 FALSE, /* senders */
272 TRUE, /* set */
8523533c
TK
273#ifdef WITH_CONTENT_SCAN
274 FALSE, /* spam */
275#endif
276#ifdef EXPERIMENTAL_SPF
277 FALSE, /* spf */
278#endif
059ec3d9
PH
279 FALSE /* verify */
280};
281
c5fcb476 282/* Bit map vector of which conditions are not allowed at certain times. For
2f079f46
PH
283each condition, there's a bitmap of dis-allowed times. For some, it is easier
284to specify the negation of a small number of allowed times. */
059ec3d9
PH
285
286static unsigned int cond_forbids[] = {
287 0, /* acl */
8e669ac1 288
059ec3d9
PH
289 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* authenticated */
290 (1<<ACL_WHERE_HELO),
8e669ac1 291
8523533c 292#ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 293 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
294 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
295 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8e669ac1 296 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
297 (1<<ACL_WHERE_MAILAUTH)|
298 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
299 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA),
300#endif
8e669ac1 301
059ec3d9 302 0, /* condition */
8e669ac1 303
059ec3d9 304 /* Certain types of control are always allowed, so we let it through
2f079f46 305 always and check in the control processing itself. */
8e669ac1 306
059ec3d9 307 0, /* control */
8e669ac1 308
8523533c 309#ifdef WITH_CONTENT_SCAN
2f079f46
PH
310 (unsigned int)
311 ~(1<<ACL_WHERE_MIME), /* decode */
8523533c
TK
312#endif
313
059ec3d9 314 0, /* delay */
8e669ac1 315
f7b63901 316#ifdef WITH_OLD_DEMIME
2f079f46
PH
317 (unsigned int)
318 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* demime */
8523533c 319#endif
8e669ac1 320
fb2274d4 321#ifdef EXPERIMENTAL_DOMAINKEYS
2f079f46 322 (1<<ACL_WHERE_AUTH)| /* dk_domain_source */
fb2274d4
TK
323 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
324 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
325 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
326 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
327 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
328 (1<<ACL_WHERE_VRFY),
84330b7b 329
2f079f46 330 (1<<ACL_WHERE_AUTH)| /* dk_policy */
fb2274d4
TK
331 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
332 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
333 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
334 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
335 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
336 (1<<ACL_WHERE_VRFY),
84330b7b 337
2f079f46 338 (1<<ACL_WHERE_AUTH)| /* dk_sender_domains */
fb2274d4
TK
339 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
340 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
341 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
342 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
343 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
344 (1<<ACL_WHERE_VRFY),
84330b7b 345
2f079f46 346 (1<<ACL_WHERE_AUTH)| /* dk_sender_local_parts */
fb2274d4
TK
347 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
348 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
349 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
350 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
351 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
352 (1<<ACL_WHERE_VRFY),
84330b7b 353
2f079f46 354 (1<<ACL_WHERE_AUTH)| /* dk_senders */
fb2274d4
TK
355 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
356 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
357 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
358 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
359 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
360 (1<<ACL_WHERE_VRFY),
84330b7b 361
2f079f46 362 (1<<ACL_WHERE_AUTH)| /* dk_status */
fb2274d4
TK
363 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
364 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
365 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
366 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
367 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
368 (1<<ACL_WHERE_VRFY),
369#endif
370
059ec3d9
PH
371 (1<<ACL_WHERE_NOTSMTP), /* dnslists */
372
2f079f46
PH
373 (unsigned int)
374 ~(1<<ACL_WHERE_RCPT), /* domains */
059ec3d9
PH
375
376 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* encrypted */
377 (1<<ACL_WHERE_HELO),
8e669ac1 378
059ec3d9 379 0, /* endpass */
8e669ac1 380
059ec3d9
PH
381 (1<<ACL_WHERE_NOTSMTP), /* hosts */
382
2f079f46
PH
383 (unsigned int)
384 ~(1<<ACL_WHERE_RCPT), /* local_parts */
059ec3d9
PH
385
386 0, /* log_message */
8e669ac1 387
059ec3d9 388 0, /* logwrite */
8e669ac1 389
8523533c 390#ifdef WITH_CONTENT_SCAN
2f079f46
PH
391 (unsigned int)
392 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* malware */
8523533c
TK
393#endif
394
059ec3d9
PH
395 0, /* message */
396
8523533c 397#ifdef WITH_CONTENT_SCAN
2f079f46
PH
398 (unsigned int)
399 ~(1<<ACL_WHERE_MIME), /* mime_regex */
8523533c
TK
400#endif
401
870f6ba8
TF
402 0, /* ratelimit */
403
2f079f46
PH
404 (unsigned int)
405 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 406
8523533c 407#ifdef WITH_CONTENT_SCAN
2f079f46
PH
408 (unsigned int)
409 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* regex */
410 (1<<ACL_WHERE_MIME)),
8523533c
TK
411#endif
412
059ec3d9
PH
413 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
414 (1<<ACL_WHERE_HELO)|
415 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
416 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
417 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
418
419 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
420 (1<<ACL_WHERE_HELO)|
421 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
422 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
423 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
424
425 0, /* set */
426
8523533c 427#ifdef WITH_CONTENT_SCAN
2f079f46
PH
428 (unsigned int)
429 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* spam */
8523533c
TK
430#endif
431
432#ifdef EXPERIMENTAL_SPF
433 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
434 (1<<ACL_WHERE_HELO)|
435 (1<<ACL_WHERE_MAILAUTH)|
436 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
437 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
438#endif
439
059ec3d9
PH
440 /* Certain types of verify are always allowed, so we let it through
441 always and check in the verify function itself */
442
443 0 /* verify */
059ec3d9
PH
444};
445
446
c5fcb476
PH
447/* Bit map vector of which controls are not allowed at certain times. For
448each control, there's a bitmap of dis-allowed times. For some, it is easier to
449specify the negation of a small number of allowed times. */
450
451static unsigned int control_forbids[] = {
8523533c
TK
452#ifdef EXPERIMENTAL_BRIGHTMAIL
453 0, /* bmi_run */
454#endif
fb2274d4 455#ifdef EXPERIMENTAL_DOMAINKEYS
e715ad22 456 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), /* dk_verify */
fb2274d4 457#endif
3e11c26b 458
c5fcb476 459 0, /* error */
8e669ac1
PH
460
461 (unsigned int)
c5fcb476 462 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
463
464 (unsigned int)
c5fcb476 465 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 466
c5fcb476 467 (1<<ACL_WHERE_NOTSMTP), /* enforce_sync */
8e669ac1 468
c5fcb476 469 (1<<ACL_WHERE_NOTSMTP), /* no_enforce_sync */
8e669ac1
PH
470
471 (unsigned int)
c5fcb476
PH
472 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
473 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 474 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
475
476 (unsigned int)
c5fcb476
PH
477 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
478 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 479 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
480
481 (unsigned int)
c5fcb476 482 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 483 (1<<ACL_WHERE_PREDATA)),
8523533c
TK
484
485#ifdef WITH_CONTENT_SCAN
8e669ac1 486 (unsigned int)
14d57970 487 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22
TK
488 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
489 (1<<ACL_WHERE_MIME)),
8523533c 490#endif
a6c4ab60 491
8e669ac1 492 (unsigned int)
29aba418
TF
493 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
494 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
495 (1<<ACL_WHERE_MIME)),
496
497 (unsigned int)
a6c4ab60 498 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22
TK
499 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
500 (1<<ACL_WHERE_MIME)),
8523533c 501
c5fcb476
PH
502 (1<<ACL_WHERE_NOTSMTP) /* no_multiline */
503};
504
505/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
506
507typedef struct control_def {
508 uschar *name;
509 int value; /* CONTROL_xxx value */
059ec3d9
PH
510 BOOL has_option; /* Has /option(s) following */
511} control_def;
512
513static control_def controls_list[] = {
8523533c
TK
514#ifdef EXPERIMENTAL_BRIGHTMAIL
515 { US"bmi_run", CONTROL_BMI_RUN, FALSE},
516#endif
fb2274d4
TK
517#ifdef EXPERIMENTAL_DOMAINKEYS
518 { US"dk_verify", CONTROL_DK_VERIFY, FALSE},
519#endif
c5fcb476
PH
520 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE},
521 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE},
522 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE},
523 { US"freeze", CONTROL_FREEZE, FALSE},
524 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE},
525 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE},
526 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE},
8523533c
TK
527#ifdef WITH_CONTENT_SCAN
528 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE},
8523533c 529#endif
29aba418 530 { US"fakedefer", CONTROL_FAKEDEFER, TRUE},
0f9b0483 531 { US"fakereject", CONTROL_FAKEREJECT, TRUE},
c5fcb476 532 { US"submission", CONTROL_SUBMISSION, TRUE}
059ec3d9
PH
533 };
534
e5a9dba6
PH
535/* Support data structures for Client SMTP Authorization. acl_verify_csa()
536caches its result in a tree to avoid repeated DNS queries. The result is an
537integer code which is used as an index into the following tables of
538explanatory strings and verification return codes. */
539
540static tree_node *csa_cache = NULL;
541
542enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
543 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
544
545/* The acl_verify_csa() return code is translated into an acl_verify() return
546code using the following table. It is OK unless the client is definitely not
547authorized. This is because CSA is supposed to be optional for sending sites,
548so recipients should not be too strict about checking it - especially because
549DNS problems are quite likely to occur. It's possible to use $csa_status in
550further ACL conditions to distinguish ok, unknown, and defer if required, but
551the aim is to make the usual configuration simple. */
552
553static int csa_return_code[] = {
554 OK, OK, OK, OK,
555 FAIL, FAIL, FAIL, FAIL
556};
557
558static uschar *csa_status_string[] = {
559 US"unknown", US"ok", US"defer", US"defer",
560 US"fail", US"fail", US"fail", US"fail"
561};
562
563static uschar *csa_reason_string[] = {
564 US"unknown",
565 US"ok",
566 US"deferred (SRV lookup failed)",
567 US"deferred (target address lookup failed)",
568 US"failed (explicit authorization required)",
569 US"failed (host name not authorized)",
570 US"failed (no authorized addresses)",
571 US"failed (client address mismatch)"
572};
573
059ec3d9
PH
574/* Enable recursion between acl_check_internal() and acl_check_condition() */
575
576static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
577 uschar **);
578
579
580/*************************************************
581* Pick out name from list *
582*************************************************/
583
584/* Use a binary chop method
585
586Arguments:
587 name name to find
588 list list of names
589 end size of list
590
591Returns: offset in list, or -1 if not found
592*/
593
594static int
595acl_checkname(uschar *name, uschar **list, int end)
596{
597int start = 0;
598
599while (start < end)
600 {
601 int mid = (start + end)/2;
602 int c = Ustrcmp(name, list[mid]);
603 if (c == 0) return mid;
604 if (c < 0) end = mid; else start = mid + 1;
605 }
606
607return -1;
608}
609
610
611/*************************************************
612* Read and parse one ACL *
613*************************************************/
614
615/* This function is called both from readconf in order to parse the ACLs in the
616configuration file, and also when an ACL is encountered dynamically (e.g. as
617the result of an expansion). It is given a function to call in order to
618retrieve the lines of the ACL. This function handles skipping comments and
619blank lines (where relevant).
620
621Arguments:
622 func function to get next line of ACL
623 error where to put an error message
624
625Returns: pointer to ACL, or NULL
626 NULL can be legal (empty ACL); in this case error will be NULL
627*/
628
629acl_block *
630acl_read(uschar *(*func)(void), uschar **error)
631{
632acl_block *yield = NULL;
633acl_block **lastp = &yield;
634acl_block *this = NULL;
635acl_condition_block *cond;
636acl_condition_block **condp = NULL;
637uschar *s;
638
639*error = NULL;
640
641while ((s = (*func)()) != NULL)
642 {
643 int v, c;
644 BOOL negated = FALSE;
645 uschar *saveline = s;
646 uschar name[64];
647
648 /* Conditions (but not verbs) are allowed to be negated by an initial
649 exclamation mark. */
650
651 while (isspace(*s)) s++;
652 if (*s == '!')
653 {
654 negated = TRUE;
655 s++;
656 }
657
cf00dad6
PH
658 /* Read the name of a verb or a condition, or the start of a new ACL, which
659 can be started by a name, or by a macro definition. */
059ec3d9
PH
660
661 s = readconf_readname(name, sizeof(name), s);
cf00dad6 662 if (*s == ':' || isupper(name[0] && *s == '=')) return yield;
059ec3d9
PH
663
664 /* If a verb is unrecognized, it may be another condition or modifier that
665 continues the previous verb. */
666
667 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
668 if (v < 0)
669 {
670 if (this == NULL)
671 {
672 *error = string_sprintf("unknown ACL verb in \"%s\"", saveline);
673 return NULL;
674 }
675 }
676
677 /* New verb */
678
679 else
680 {
681 if (negated)
682 {
683 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
684 return NULL;
685 }
686 this = store_get(sizeof(acl_block));
687 *lastp = this;
688 lastp = &(this->next);
689 this->next = NULL;
690 this->verb = v;
691 this->condition = NULL;
692 condp = &(this->condition);
693 if (*s == 0) continue; /* No condition on this line */
694 if (*s == '!')
695 {
696 negated = TRUE;
697 s++;
698 }
699 s = readconf_readname(name, sizeof(name), s); /* Condition name */
700 }
701
702 /* Handle a condition or modifier. */
703
704 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
705 if (c < 0)
706 {
707 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
708 saveline);
709 return NULL;
710 }
711
712 /* The modifiers may not be negated */
713
714 if (negated && cond_modifiers[c])
715 {
716 *error = string_sprintf("ACL error: negation is not allowed with "
717 "\"%s\"", conditions[c]);
718 return NULL;
719 }
720
721 /* ENDPASS may occur only with ACCEPT or DISCARD. */
722
723 if (c == ACLC_ENDPASS &&
724 this->verb != ACL_ACCEPT &&
725 this->verb != ACL_DISCARD)
726 {
727 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
728 conditions[c], verbs[this->verb]);
729 return NULL;
730 }
731
732 cond = store_get(sizeof(acl_condition_block));
733 cond->next = NULL;
734 cond->type = c;
735 cond->u.negated = negated;
736
737 *condp = cond;
738 condp = &(cond->next);
739
740 /* The "set" modifier is different in that its argument is "name=value"
741 rather than just a value, and we can check the validity of the name, which
742 gives us a variable number to insert into the data block. */
743
744 if (c == ACLC_SET)
745 {
746 if (Ustrncmp(s, "acl_", 4) != 0 || (s[4] != 'c' && s[4] != 'm') ||
747 !isdigit(s[5]) || (!isspace(s[6]) && s[6] != '='))
748 {
749 *error = string_sprintf("unrecognized name after \"set\" in ACL "
750 "modifier \"set %s\"", s);
751 return NULL;
752 }
753
754 cond->u.varnumber = s[5] - '0';
755 if (s[4] == 'm') cond->u.varnumber += ACL_C_MAX;
756 s += 6;
757 while (isspace(*s)) s++;
758 }
759
760 /* For "set", we are now positioned for the data. For the others, only
761 "endpass" has no data */
762
763 if (c != ACLC_ENDPASS)
764 {
765 if (*s++ != '=')
766 {
767 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
768 cond_modifiers[c]? US"modifier" : US"condition");
769 return NULL;
770 }
771 while (isspace(*s)) s++;
772 cond->arg = string_copy(s);
773 }
774 }
775
776return yield;
777}
778
779
780
781/*************************************************
782* Handle warnings *
783*************************************************/
784
785/* This function is called when a WARN verb's conditions are true. It adds to
786the message's headers, and/or writes information to the log. In each case, this
787only happens once (per message for headers, per connection for log).
788
789Arguments:
790 where ACL_WHERE_xxxx indicating which ACL this is
791 user_message message for adding to headers
792 log_message message for logging, if different
793
794Returns: nothing
795*/
796
797static void
798acl_warn(int where, uschar *user_message, uschar *log_message)
799{
800int hlen;
801
802if (log_message != NULL && log_message != user_message)
803 {
804 uschar *text;
805 string_item *logged;
806
807 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
808 string_printing(log_message));
809
810 /* If a sender verification has failed, and the log message is "sender verify
811 failed", add the failure message. */
812
813 if (sender_verified_failed != NULL &&
814 sender_verified_failed->message != NULL &&
815 strcmpic(log_message, US"sender verify failed") == 0)
816 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
817
9c7a242c
PH
818 /* Search previously logged warnings. They are kept in malloc
819 store so they can be freed at the start of a new message. */
059ec3d9
PH
820
821 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
822 if (Ustrcmp(logged->text, text) == 0) break;
823
824 if (logged == NULL)
825 {
826 int length = Ustrlen(text) + 1;
827 log_write(0, LOG_MAIN, "%s", text);
828 logged = store_malloc(sizeof(string_item) + length);
829 logged->text = (uschar *)logged + sizeof(string_item);
830 memcpy(logged->text, text, length);
831 logged->next = acl_warn_logged;
832 acl_warn_logged = logged;
833 }
834 }
835
836/* If there's no user message, we are done. */
837
838if (user_message == NULL) return;
839
840/* If this isn't a message ACL, we can't do anything with a user message.
841Log an error. */
842
843if (where > ACL_WHERE_NOTSMTP)
844 {
845 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
846 "found in a non-message (%s) ACL: cannot specify header lines here: "
847 "message ignored", acl_wherenames[where]);
848 return;
849 }
850
851/* Treat the user message as a sequence of one or more header lines. */
852
853hlen = Ustrlen(user_message);
854if (hlen > 0)
855 {
856 uschar *text, *p, *q;
857
858 /* Add a final newline if not present */
859
860 text = ((user_message)[hlen-1] == '\n')? user_message :
861 string_sprintf("%s\n", user_message);
862
863 /* Loop for multiple header lines, taking care about continuations */
864
865 for (p = q = text; *p != 0; )
866 {
867 uschar *s;
868 int newtype = htype_add_bot;
869 header_line **hptr = &acl_warn_headers;
870
871 /* Find next header line within the string */
872
873 for (;;)
874 {
875 q = Ustrchr(q, '\n');
876 if (*(++q) != ' ' && *q != '\t') break;
877 }
878
879 /* If the line starts with a colon, interpret the instruction for where to
880 add it. This temporarily sets up a new type. */
881
882 if (*p == ':')
883 {
884 if (strncmpic(p, US":after_received:", 16) == 0)
885 {
886 newtype = htype_add_rec;
887 p += 16;
888 }
8523533c
TK
889 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
890 {
891 newtype = htype_add_rfc;
892 p += 14;
8e669ac1 893 }
059ec3d9
PH
894 else if (strncmpic(p, US":at_start:", 10) == 0)
895 {
896 newtype = htype_add_top;
897 p += 10;
898 }
899 else if (strncmpic(p, US":at_end:", 8) == 0)
900 {
901 newtype = htype_add_bot;
902 p += 8;
903 }
904 while (*p == ' ' || *p == '\t') p++;
905 }
906
907 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
908 to the front of it. */
909
910 for (s = p; s < q - 1; s++)
911 {
912 if (*s == ':' || !isgraph(*s)) break;
913 }
914
915 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
916 hlen = Ustrlen(s);
917
918 /* See if this line has already been added */
919
920 while (*hptr != NULL)
921 {
922 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
923 hptr = &((*hptr)->next);
924 }
925
926 /* Add if not previously present */
927
928 if (*hptr == NULL)
929 {
930 header_line *h = store_get(sizeof(header_line));
931 h->text = s;
932 h->next = NULL;
933 h->type = newtype;
934 h->slen = hlen;
935 *hptr = h;
936 hptr = &(h->next);
937 }
938
939 /* Advance for next header line within the string */
940
941 p = q;
942 }
943 }
944}
945
946
947
948/*************************************************
949* Verify and check reverse DNS *
950*************************************************/
951
952/* Called from acl_verify() below. We look up the host name(s) of the client IP
953address if this has not yet been done. The host_name_lookup() function checks
954that one of these names resolves to an address list that contains the client IP
955address, so we don't actually have to do the check here.
956
957Arguments:
958 user_msgptr pointer for user message
959 log_msgptr pointer for log message
960
961Returns: OK verification condition succeeded
962 FAIL verification failed
963 DEFER there was a problem verifying
964*/
965
966static int
967acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
968{
969int rc;
970
971user_msgptr = user_msgptr; /* stop compiler warning */
972
973/* Previous success */
974
975if (sender_host_name != NULL) return OK;
976
977/* Previous failure */
978
979if (host_lookup_failed)
980 {
981 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
982 return FAIL;
983 }
984
985/* Need to do a lookup */
986
987HDEBUG(D_acl)
988 debug_printf("looking up host name to force name/address consistency check\n");
989
990if ((rc = host_name_lookup()) != OK)
991 {
992 *log_msgptr = (rc == DEFER)?
993 US"host lookup deferred for reverse lookup check"
994 :
995 string_sprintf("host lookup failed for reverse lookup check%s",
996 host_lookup_msg);
997 return rc; /* DEFER or FAIL */
998 }
999
1000host_build_sender_fullhost();
1001return OK;
1002}
1003
1004
1005
1006/*************************************************
e5a9dba6
PH
1007* Check client IP address matches CSA target *
1008*************************************************/
1009
1010/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1011response for address records belonging to the CSA target hostname. The section
1012is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1013If one of the addresses matches the client's IP address, then the client is
1014authorized by CSA. If there are target IP addresses but none of them match
1015then the client is using an unauthorized IP address. If there are no target IP
1016addresses then the client cannot be using an authorized IP address. (This is
1017an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1018
1019Arguments:
1020 dnsa the DNS answer block
1021 dnss a DNS scan block for us to use
1022 reset option specifing what portion to scan, as described above
1023 target the target hostname to use for matching RR names
1024
1025Returns: CSA_OK successfully authorized
1026 CSA_FAIL_MISMATCH addresses found but none matched
1027 CSA_FAIL_NOADDR no target addresses found
1028*/
1029
1030static int
1031acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1032 uschar *target)
1033{
1034dns_record *rr;
1035dns_address *da;
1036
1037BOOL target_found = FALSE;
1038
1039for (rr = dns_next_rr(dnsa, dnss, reset);
1040 rr != NULL;
1041 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1042 {
1043 /* Check this is an address RR for the target hostname. */
1044
1045 if (rr->type != T_A
1046 #if HAVE_IPV6
1047 && rr->type != T_AAAA
1048 #ifdef SUPPORT_A6
1049 && rr->type != T_A6
1050 #endif
1051 #endif
1052 ) continue;
1053
1054 if (strcmpic(target, rr->name) != 0) continue;
1055
1056 target_found = TRUE;
1057
1058 /* Turn the target address RR into a list of textual IP addresses and scan
1059 the list. There may be more than one if it is an A6 RR. */
1060
1061 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1062 {
1063 /* If the client IP address matches the target IP address, it's good! */
1064
1065 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1066
1067 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1068 }
1069 }
1070
1071/* If we found some target addresses but none of them matched, the client is
1072using an unauthorized IP address, otherwise the target has no authorized IP
1073addresses. */
1074
1075if (target_found) return CSA_FAIL_MISMATCH;
1076else return CSA_FAIL_NOADDR;
1077}
1078
1079
1080
1081/*************************************************
1082* Verify Client SMTP Authorization *
1083*************************************************/
1084
1085/* Called from acl_verify() below. This routine calls dns_lookup_special()
1086to find the CSA SRV record corresponding to the domain argument, or
1087$sender_helo_name if no argument is provided. It then checks that the
1088client is authorized, and that its IP address corresponds to the SRV
1089target's address by calling acl_verify_csa_address() above. The address
1090should have been returned in the DNS response's ADDITIONAL section, but if
1091not we perform another DNS lookup to get it.
1092
1093Arguments:
1094 domain pointer to optional parameter following verify = csa
1095
1096Returns: CSA_UNKNOWN no valid CSA record found
1097 CSA_OK successfully authorized
1098 CSA_FAIL_* client is definitely not authorized
1099 CSA_DEFER_* there was a DNS problem
1100*/
1101
1102static int
1103acl_verify_csa(uschar *domain)
1104{
1105tree_node *t;
1106uschar *found, *p;
1107int priority, weight, port;
1108dns_answer dnsa;
1109dns_scan dnss;
1110dns_record *rr;
1111int rc, type;
1112uschar target[256];
1113
1114/* Work out the domain we are using for the CSA lookup. The default is the
1115client's HELO domain. If the client has not said HELO, use its IP address
1116instead. If it's a local client (exim -bs), CSA isn't applicable. */
1117
1118while (isspace(*domain) && *domain != '\0') ++domain;
1119if (*domain == '\0') domain = sender_helo_name;
1120if (domain == NULL) domain = sender_host_address;
1121if (sender_host_address == NULL) return CSA_UNKNOWN;
1122
1123/* If we have an address literal, strip off the framing ready for turning it
1124into a domain. The framing consists of matched square brackets possibly
1125containing a keyword and a colon before the actual IP address. */
1126
1127if (domain[0] == '[')
1128 {
1129 uschar *start = Ustrchr(domain, ':');
1130 if (start == NULL) start = domain;
1131 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1132 }
1133
1134/* Turn domains that look like bare IP addresses into domains in the reverse
1135DNS. This code also deals with address literals and $sender_host_address. It's
1136not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1137address literals, but it's probably the most friendly thing to do. This is an
1138extension to CSA, so we allow it to be turned off for proper conformance. */
1139
1140if (string_is_ip_address(domain, NULL))
1141 {
1142 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1143 dns_build_reverse(domain, target);
1144 domain = target;
1145 }
1146
1147/* Find out if we've already done the CSA check for this domain. If we have,
1148return the same result again. Otherwise build a new cached result structure
1149for this domain. The name is filled in now, and the value is filled in when
1150we return from this function. */
1151
1152t = tree_search(csa_cache, domain);
1153if (t != NULL) return t->data.val;
1154
1155t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1156Ustrcpy(t->name, domain);
1157(void)tree_insertnode(&csa_cache, t);
1158
1159/* Now we are ready to do the actual DNS lookup(s). */
1160
28e6ef29 1161found = domain;
e5a9dba6
PH
1162switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1163 {
1164 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1165
1166 default:
1167 return t->data.val = CSA_DEFER_SRV;
1168
1169 /* If we found nothing, the client's authorization is unknown. */
1170
1171 case DNS_NOMATCH:
1172 case DNS_NODATA:
1173 return t->data.val = CSA_UNKNOWN;
1174
1175 /* We got something! Go on to look at the reply in more detail. */
1176
1177 case DNS_SUCCEED:
1178 break;
1179 }
1180
1181/* Scan the reply for well-formed CSA SRV records. */
1182
1183for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1184 rr != NULL;
1185 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1186 {
1187 if (rr->type != T_SRV) continue;
1188
1189 /* Extract the numerical SRV fields (p is incremented) */
1190
1191 p = rr->data;
1192 GETSHORT(priority, p);
1193 GETSHORT(weight, p);
1194 GETSHORT(port, p);
1195
1196 DEBUG(D_acl)
1197 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1198
1199 /* Check the CSA version number */
1200
1201 if (priority != 1) continue;
1202
1203 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1204 found by dns_special_lookup() is a parent of the one we asked for), we check
1205 the subdomain assertions in the port field. At the moment there's only one
1206 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1207 SRV records of their own. */
1208
1209 if (found != domain)
1210 {
1211 if (port & 1)
1212 return t->data.val = CSA_FAIL_EXPLICIT;
1213 else
1214 return t->data.val = CSA_UNKNOWN;
1215 }
1216
1217 /* This CSA SRV record refers directly to our domain, so we check the value
1218 in the weight field to work out the domain's authorization. 0 and 1 are
1219 unauthorized; 3 means the client is authorized but we can't check the IP
1220 address in order to authenticate it, so we treat it as unknown; values
1221 greater than 3 are undefined. */
1222
1223 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1224
1225 if (weight > 2) continue;
1226
1227 /* Weight == 2, which means the domain is authorized. We must check that the
1228 client's IP address is listed as one of the SRV target addresses. Save the
1229 target hostname then break to scan the additional data for its addresses. */
1230
1231 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1232 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1233
1234 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1235
1236 break;
1237 }
1238
1239/* If we didn't break the loop then no appropriate records were found. */
1240
1241if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1242
1243/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1244A target of "." indicates there are no valid addresses, so the client cannot
1245be authorized. (This is an odd configuration because weight=2 target=. is
1246equivalent to weight=1, but we check for it in order to keep load off the
1247root name servers.) Note that dn_expand() turns "." into "". */
1248
1249if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1250
1251/* Scan the additional section of the CSA SRV reply for addresses belonging
1252to the target. If the name server didn't return any additional data (e.g.
1253because it does not fully support SRV records), we need to do another lookup
1254to obtain the target addresses; otherwise we have a definitive result. */
1255
1256rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1257if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1258
1259/* The DNS lookup type corresponds to the IP version used by the client. */
1260
1261#if HAVE_IPV6
1262if (Ustrchr(sender_host_address, ':') != NULL)
1263 type = T_AAAA;
1264else
1265#endif /* HAVE_IPV6 */
1266 type = T_A;
1267
1268
1269#if HAVE_IPV6 && defined(SUPPORT_A6)
1270DNS_LOOKUP_AGAIN:
1271#endif
1272
1273switch (dns_lookup(&dnsa, target, type, NULL))
1274 {
1275 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1276
1277 default:
1278 return t->data.val = CSA_DEFER_ADDR;
1279
1280 /* If the query succeeded, scan the addresses and return the result. */
1281
1282 case DNS_SUCCEED:
1283 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1284 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1285 /* else fall through */
1286
1287 /* If the target has no IP addresses, the client cannot have an authorized
1288 IP address. However, if the target site uses A6 records (not AAAA records)
1289 we have to do yet another lookup in order to check them. */
1290
1291 case DNS_NOMATCH:
1292 case DNS_NODATA:
1293
1294 #if HAVE_IPV6 && defined(SUPPORT_A6)
1295 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1296 #endif
1297
1298 return t->data.val = CSA_FAIL_NOADDR;
1299 }
1300}
1301
1302
1303
1304/*************************************************
059ec3d9
PH
1305* Handle verification (address & other) *
1306*************************************************/
1307
1308/* This function implements the "verify" condition. It is called when
1309encountered in any ACL, because some tests are almost always permitted. Some
1310just don't make sense, and always fail (for example, an attempt to test a host
1311lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1312
1313Arguments:
1314 where where called from
1315 addr the recipient address that the ACL is handling, or NULL
1316 arg the argument of "verify"
1317 user_msgptr pointer for user message
1318 log_msgptr pointer for log message
1319 basic_errno where to put verify errno
1320
1321Returns: OK verification condition succeeded
1322 FAIL verification failed
1323 DEFER there was a problem verifying
1324 ERROR syntax error
1325*/
1326
1327static int
1328acl_verify(int where, address_item *addr, uschar *arg,
1329 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1330{
1331int sep = '/';
1332int callout = -1;
1333int callout_overall = -1;
4deaf07d 1334int callout_connect = -1;
059ec3d9
PH
1335int verify_options = 0;
1336int rc;
1337BOOL verify_header_sender = FALSE;
1338BOOL defer_ok = FALSE;
1339BOOL callout_defer_ok = FALSE;
1340BOOL no_details = FALSE;
1341address_item *sender_vaddr = NULL;
1342uschar *verify_sender_address = NULL;
1343uschar *pm_mailfrom = NULL;
1344uschar *se_mailfrom = NULL;
596875b3
PH
1345
1346/* Some of the verify items have slash-separated options; some do not. Diagnose
1347an error if options are given for items that don't expect them. This code has
1348now got very message. Refactoring to use a table would be a good idea one day.
1349*/
1350
1351uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH
1352uschar *list = arg;
1353uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1354
1355if (ss == NULL) goto BAD_VERIFY;
1356
1357/* Handle name/address consistency verification in a separate function. */
1358
1359if (strcmpic(ss, US"reverse_host_lookup") == 0)
1360 {
596875b3 1361 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1362 if (sender_host_address == NULL) return OK;
1363 return acl_verify_reverse(user_msgptr, log_msgptr);
1364 }
1365
1366/* TLS certificate verification is done at STARTTLS time; here we just
1367test whether it was successful or not. (This is for optional verification; for
1368mandatory verification, the connection doesn't last this long.) */
1369
1370if (strcmpic(ss, US"certificate") == 0)
1371 {
596875b3 1372 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1373 if (tls_certificate_verified) return OK;
1374 *user_msgptr = US"no verified certificate";
1375 return FAIL;
1376 }
1377
1378/* We can test the result of optional HELO verification */
1379
596875b3
PH
1380if (strcmpic(ss, US"helo") == 0)
1381 {
1382 if (slash != NULL) goto NO_OPTIONS;
1383 return helo_verified? OK : FAIL;
1384 }
059ec3d9 1385
e5a9dba6
PH
1386/* Do Client SMTP Authorization checks in a separate function, and turn the
1387result code into user-friendly strings. */
1388
1389if (strcmpic(ss, US"csa") == 0)
1390 {
1391 rc = acl_verify_csa(list);
1392 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1393 csa_reason_string[rc]);
1394 csa_status = csa_status_string[rc];
1395 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1396 return csa_return_code[rc];
1397 }
1398
596875b3
PH
1399/* Check that all relevant header lines have the correct syntax. If there is
1400a syntax error, we return details of the error to the sender if configured to
1401send out full details. (But a "message" setting on the ACL can override, as
1402always). */
059ec3d9 1403
596875b3 1404if (strcmpic(ss, US"header_syntax") == 0)
059ec3d9 1405 {
596875b3 1406 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1407 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP)
1408 {
1409 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
1410 "(only possible in ACL for DATA)", acl_wherenames[where]);
1411 return ERROR;
1412 }
596875b3
PH
1413 rc = verify_check_headers(log_msgptr);
1414 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1415 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1416 return rc;
1417 }
059ec3d9 1418
059ec3d9 1419
596875b3
PH
1420/* The remaining verification tests check recipient and sender addresses,
1421either from the envelope or from the header. There are a number of
1422slash-separated options that are common to all of them. */
059ec3d9 1423
059ec3d9 1424
596875b3
PH
1425/* Check that there is at least one verifiable sender address in the relevant
1426header lines. This can be followed by callout and defer options, just like
1427sender and recipient. */
059ec3d9 1428
596875b3
PH
1429if (strcmpic(ss, US"header_sender") == 0)
1430 {
1431 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP)
1432 {
1433 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
1434 "(only possible in ACL for DATA)", acl_wherenames[where]);
1435 return ERROR;
1436 }
1437 verify_header_sender = TRUE;
059ec3d9
PH
1438 }
1439
1440/* Otherwise, first item in verify argument must be "sender" or "recipient".
1441In the case of a sender, this can optionally be followed by an address to use
1442in place of the actual sender (rare special-case requirement). */
1443
1444else if (strncmpic(ss, US"sender", 6) == 0)
1445 {
1446 uschar *s = ss + 6;
1447 if (where > ACL_WHERE_NOTSMTP)
1448 {
1449 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1450 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1451 acl_wherenames[where]);
1452 return ERROR;
1453 }
1454 if (*s == 0)
1455 verify_sender_address = sender_address;
1456 else
1457 {
1458 while (isspace(*s)) s++;
1459 if (*s++ != '=') goto BAD_VERIFY;
1460 while (isspace(*s)) s++;
1461 verify_sender_address = string_copy(s);
1462 }
1463 }
1464else
1465 {
1466 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1467 if (addr == NULL)
1468 {
1469 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1470 "(only possible for RCPT)", acl_wherenames[where]);
1471 return ERROR;
1472 }
1473 }
1474
596875b3
PH
1475/* Remaining items are optional; they apply to sender and recipient
1476verification, including "header sender" verification. */
059ec3d9
PH
1477
1478while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1479 != NULL)
1480 {
1481 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1482 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1483
1484 /* These two old options are left for backwards compatibility */
1485
1486 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1487 {
1488 callout_defer_ok = TRUE;
1489 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1490 }
1491
1492 else if (strcmpic(ss, US"check_postmaster") == 0)
1493 {
1494 pm_mailfrom = US"";
1495 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1496 }
1497
1498 /* The callout option has a number of sub-options, comma separated */
1499
1500 else if (strncmpic(ss, US"callout", 7) == 0)
1501 {
1502 callout = CALLOUT_TIMEOUT_DEFAULT;
1503 ss += 7;
1504 if (*ss != 0)
1505 {
1506 while (isspace(*ss)) ss++;
1507 if (*ss++ == '=')
1508 {
1509 int optsep = ',';
1510 uschar *opt;
1511 uschar buffer[256];
1512 while (isspace(*ss)) ss++;
8e669ac1
PH
1513
1514 /* This callout option handling code has become a mess as new options
1515 have been added in an ad hoc manner. It should be tidied up into some
4deaf07d 1516 kind of table-driven thing. */
8e669ac1 1517
059ec3d9
PH
1518 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1519 != NULL)
1520 {
1521 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1522 else if (strcmpic(opt, US"no_cache") == 0)
1523 verify_options |= vopt_callout_no_cache;
1524 else if (strcmpic(opt, US"random") == 0)
1525 verify_options |= vopt_callout_random;
1526 else if (strcmpic(opt, US"use_sender") == 0)
1527 verify_options |= vopt_callout_recipsender;
1528 else if (strcmpic(opt, US"use_postmaster") == 0)
1529 verify_options |= vopt_callout_recippmaster;
1530 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
2a4be8f9
PH
1531 else if (strcmpic(opt, US"fullpostmaster") == 0)
1532 {
1533 pm_mailfrom = US"";
1534 verify_options |= vopt_callout_fullpm;
1535 }
059ec3d9
PH
1536
1537 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1538 {
1539 if (!verify_header_sender)
1540 {
1541 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1542 "callout option only for verify=header_sender (detected in ACL "
1543 "condition \"%s\")", arg);
1544 return ERROR;
1545 }
1546 opt += 8;
1547 while (isspace(*opt)) opt++;
1548 if (*opt++ != '=')
1549 {
1550 *log_msgptr = string_sprintf("'=' expected after "
1551 "\"mailfrom\" in ACL condition \"%s\"", arg);
1552 return ERROR;
1553 }
1554 while (isspace(*opt)) opt++;
1555 se_mailfrom = string_copy(opt);
1556 }
1557
1558 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1559 {
1560 opt += 19;
1561 while (isspace(*opt)) opt++;
1562 if (*opt++ != '=')
1563 {
1564 *log_msgptr = string_sprintf("'=' expected after "
1565 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1566 return ERROR;
1567 }
1568 while (isspace(*opt)) opt++;
1569 pm_mailfrom = string_copy(opt);
1570 }
1571
1572 else if (strncmpic(opt, US"maxwait", 7) == 0)
1573 {
1574 opt += 7;
1575 while (isspace(*opt)) opt++;
1576 if (*opt++ != '=')
1577 {
1578 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1579 "ACL condition \"%s\"", arg);
1580 return ERROR;
1581 }
1582 while (isspace(*opt)) opt++;
1583 callout_overall = readconf_readtime(opt, 0, FALSE);
1584 if (callout_overall < 0)
1585 {
1586 *log_msgptr = string_sprintf("bad time value in ACL condition "
1587 "\"verify %s\"", arg);
1588 return ERROR;
1589 }
1590 }
4deaf07d
PH
1591 else if (strncmpic(opt, US"connect", 7) == 0)
1592 {
1593 opt += 7;
1594 while (isspace(*opt)) opt++;
1595 if (*opt++ != '=')
1596 {
1597 *log_msgptr = string_sprintf("'=' expected after "
1598 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1599 return ERROR;
1600 }
1601 while (isspace(*opt)) opt++;
1602 callout_connect = readconf_readtime(opt, 0, FALSE);
1603 if (callout_connect < 0)
1604 {
1605 *log_msgptr = string_sprintf("bad time value in ACL condition "
1606 "\"verify %s\"", arg);
1607 return ERROR;
1608 }
1609 }
059ec3d9
PH
1610 else /* Plain time is callout connect/command timeout */
1611 {
1612 callout = readconf_readtime(opt, 0, FALSE);
1613 if (callout < 0)
1614 {
1615 *log_msgptr = string_sprintf("bad time value in ACL condition "
1616 "\"verify %s\"", arg);
1617 return ERROR;
1618 }
1619 }
1620 }
1621 }
1622 else
1623 {
1624 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1625 "ACL condition \"%s\"", arg);
1626 return ERROR;
1627 }
1628 }
1629 }
1630
1631 /* Option not recognized */
1632
1633 else
1634 {
1635 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1636 "condition \"verify %s\"", ss, arg);
1637 return ERROR;
1638 }
1639 }
1640
1641if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1642 (vopt_callout_recipsender|vopt_callout_recippmaster))
1643 {
1644 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1645 "for a recipient callout";
1646 return ERROR;
1647 }
1648
1649/* Handle sender-in-header verification. Default the user message to the log
1650message if giving out verification details. */
1651
1652if (verify_header_sender)
1653 {
8e669ac1 1654 int verrno;
059ec3d9 1655 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
1656 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1657 &verrno);
1658 if (rc != OK)
8e669ac1 1659 {
fe5b5d0b
PH
1660 *basic_errno = verrno;
1661 if (smtp_return_error_details)
1662 {
1663 if (*user_msgptr == NULL && *log_msgptr != NULL)
1664 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1665 if (rc == DEFER) acl_temp_details = TRUE;
1666 }
8e669ac1 1667 }
059ec3d9
PH
1668 }
1669
1670/* Handle a sender address. The default is to verify *the* sender address, but
1671optionally a different address can be given, for special requirements. If the
1672address is empty, we are dealing with a bounce message that has no sender, so
1673we cannot do any checking. If the real sender address gets rewritten during
1674verification (e.g. DNS widening), set the flag to stop it being rewritten again
1675during message reception.
1676
1677A list of verified "sender" addresses is kept to try to avoid doing to much
1678work repetitively when there are multiple recipients in a message and they all
1679require sender verification. However, when callouts are involved, it gets too
1680complicated because different recipients may require different callout options.
1681Therefore, we always do a full sender verify when any kind of callout is
1682specified. Caching elsewhere, for instance in the DNS resolver and in the
1683callout handling, should ensure that this is not terribly inefficient. */
1684
1685else if (verify_sender_address != NULL)
1686 {
1687 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1688 != 0)
1689 {
1690 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1691 "sender verify callout";
1692 return ERROR;
1693 }
1694
1695 sender_vaddr = verify_checked_sender(verify_sender_address);
1696 if (sender_vaddr != NULL && /* Previously checked */
1697 callout <= 0) /* No callout needed this time */
1698 {
1699 /* If the "routed" flag is set, it means that routing worked before, so
1700 this check can give OK (the saved return code value, if set, belongs to a
1701 callout that was done previously). If the "routed" flag is not set, routing
1702 must have failed, so we use the saved return code. */
1703
1704 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1705 {
1706 rc = sender_vaddr->special_action;
1707 *basic_errno = sender_vaddr->basic_errno;
1708 }
1709 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1710 }
1711
1712 /* Do a new verification, and cache the result. The cache is used to avoid
1713 verifying the sender multiple times for multiple RCPTs when callouts are not
1714 specified (see comments above).
1715
1716 The cache is also used on failure to give details in response to the first
1717 RCPT that gets bounced for this reason. However, this can be suppressed by
1718 the no_details option, which sets the flag that says "this detail has already
1719 been sent". The cache normally contains just one address, but there may be
1720 more in esoteric circumstances. */
1721
1722 else
1723 {
1724 BOOL routed = TRUE;
2a3eea10 1725 uschar *save_address_data = deliver_address_data;
8e669ac1 1726
059ec3d9
PH
1727 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1728 if (no_details) setflag(sender_vaddr, af_sverify_told);
1729 if (verify_sender_address[0] != 0)
1730 {
1731 /* If this is the real sender address, save the unrewritten version
1732 for use later in receive. Otherwise, set a flag so that rewriting the
1733 sender in verify_address() does not update sender_address. */
1734
1735 if (verify_sender_address == sender_address)
1736 sender_address_unrewritten = sender_address;
1737 else
1738 verify_options |= vopt_fake_sender;
1739
1740 /* The recipient, qualify, and expn options are never set in
1741 verify_options. */
1742
1743 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1744 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
1745
1746 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1747
1748 if (rc == OK)
1749 {
1750 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1751 {
1752 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1753 verify_sender_address, sender_vaddr->address);
1754 }
1755 else
1756 {
1757 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1758 verify_sender_address);
1759 }
1760 }
1761 else *basic_errno = sender_vaddr->basic_errno;
1762 }
1763 else rc = OK; /* Null sender */
1764
1765 /* Cache the result code */
1766
1767 if (routed) setflag(sender_vaddr, af_verify_routed);
1768 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1769 sender_vaddr->special_action = rc;
1770 sender_vaddr->next = sender_verified_list;
1771 sender_verified_list = sender_vaddr;
8e669ac1
PH
1772
1773 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 1774 the sender verification. */
8e669ac1 1775
2a3eea10 1776 deliver_address_data = save_address_data;
059ec3d9 1777 }
8e669ac1 1778
2a3eea10
PH
1779 /* Put the sender address_data value into $sender_address_data */
1780
8e669ac1 1781 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH
1782 }
1783
1784/* A recipient address just gets a straightforward verify; again we must handle
1785the DEFER overrides. */
1786
1787else
1788 {
1789 address_item addr2;
1790
1791 /* We must use a copy of the address for verification, because it might
1792 get rewritten. */
1793
1794 addr2 = *addr;
1795 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 1796 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 1797 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 1798
059ec3d9 1799 *log_msgptr = addr2.message;
8e669ac1 1800 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 1801 addr2.user_message : addr2.message;
059ec3d9
PH
1802 *basic_errno = addr2.basic_errno;
1803
1804 /* Make $address_data visible */
1805 deliver_address_data = addr2.p.address_data;
1806 }
1807
1808/* We have a result from the relevant test. Handle defer overrides first. */
1809
1810if (rc == DEFER && (defer_ok ||
1811 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1812 {
1813 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1814 defer_ok? "defer_ok" : "callout_defer_ok");
1815 rc = OK;
1816 }
1817
1818/* If we've failed a sender, set up a recipient message, and point
1819sender_verified_failed to the address item that actually failed. */
1820
1821if (rc != OK && verify_sender_address != NULL)
1822 {
1823 if (rc != DEFER)
1824 {
1825 *log_msgptr = *user_msgptr = US"Sender verify failed";
1826 }
1827 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1828 {
1829 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1830 }
1831 else
1832 {
1833 *log_msgptr = US"Could not complete sender verify callout";
1834 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1835 *log_msgptr;
1836 }
1837
1838 sender_verified_failed = sender_vaddr;
1839 }
1840
1841/* Verifying an address messes up the values of $domain and $local_part,
1842so reset them before returning if this is a RCPT ACL. */
1843
1844if (addr != NULL)
1845 {
1846 deliver_domain = addr->domain;
1847 deliver_localpart = addr->local_part;
1848 }
1849return rc;
1850
1851/* Syntax errors in the verify argument come here. */
1852
1853BAD_VERIFY:
1854*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
596875b3
PH
1855 "\"helo\", \"header_syntax\", \"header_sender\" or "
1856 "\"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
1857 "\"verify %s\"", arg);
1858return ERROR;
596875b3
PH
1859
1860/* Options supplied when not allowed come here */
1861
1862NO_OPTIONS:
1863*log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1864 "(this verify item has no options)", arg);
1865return ERROR;
059ec3d9
PH
1866}
1867
1868
1869
1870
1871/*************************************************
1872* Check argument for control= modifier *
1873*************************************************/
1874
1875/* Called from acl_check_condition() below
1876
1877Arguments:
1878 arg the argument string for control=
1879 pptr set to point to the terminating character
1880 where which ACL we are in
1881 log_msgptr for error messages
1882
1883Returns: CONTROL_xxx value
1884*/
1885
1886static int
1887decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
1888{
1889int len;
1890control_def *d;
1891
1892for (d = controls_list;
1893 d < controls_list + sizeof(controls_list)/sizeof(control_def);
1894 d++)
1895 {
1896 len = Ustrlen(d->name);
1897 if (Ustrncmp(d->name, arg, len) == 0) break;
1898 }
1899
1900if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
1901 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
1902 {
1903 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
1904 return CONTROL_ERROR;
1905 }
1906
059ec3d9
PH
1907*pptr = arg + len;
1908return d->value;
1909}
1910
1911
1912
1913/*************************************************
870f6ba8
TF
1914* Handle rate limiting *
1915*************************************************/
1916
1917/* Called by acl_check_condition() below to calculate the result
1918of the ACL ratelimit condition.
1919
1920Note that the return value might be slightly unexpected: if the
1921sender's rate is above the limit then the result is OK. This is
1922similar to the dnslists condition, and is so that you can write
1923ACL clauses like: defer ratelimit = 15 / 1h
1924
1925Arguments:
1926 arg the option string for ratelimit=
1927 log_msgptr for error messages
1928
1929Returns: OK - Sender's rate is above limit
1930 FAIL - Sender's rate is below limit
1931 DEFER - Problem opening ratelimit database
1932 ERROR - Syntax error in options.
1933*/
1934
1935static int
1936acl_ratelimit(uschar *arg, uschar **log_msgptr)
1937{
1938double limit, period;
f3dcf4a2 1939uschar *ss, *key;
870f6ba8
TF
1940int sep = '/';
1941BOOL have_key = FALSE, leaky = FALSE, strict = FALSE;
1942BOOL per_byte = FALSE, per_cmd = FALSE, per_conn = FALSE, per_mail = FALSE;
1943int old_pool, rc;
1944tree_node **anchor, *t;
1945open_db dbblock, *dbm;
1946dbdata_ratelimit *dbd;
1947struct timeval tv;
1948
1949/* Parse the first two options and record their values in expansion
1950variables. These variables allow the configuration to have informative
1951error messages based on rate limits obtained from a table lookup. */
1952
1953/* First is the maximum number of messages per period and maximum burst
1954size, which must be greater than or equal to zero. Zero is useful for
1955rate measurement as opposed to rate limiting. */
1956
1957sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
1958if (sender_rate_limit == NULL)
1959 limit = -1.0;
1960else
1961 {
1962 limit = Ustrtod(sender_rate_limit, &ss);
1963 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
1964 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
1965 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
1966 }
1967if (limit < 0.0 || *ss != 0)
1968 {
1969 *log_msgptr = string_sprintf("syntax error in argument for "
1970 "\"ratelimit\" condition: \"%s\" is not a positive number",
1971 sender_rate_limit);
1972 return ERROR;
1973 }
1974
f3dcf4a2
TF
1975/* We use the rest of the argument list following the limit as the
1976lookup key, because it doesn't make sense to use the same stored data
1977if the period or options are different. */
1978
1979key = arg;
1980
870f6ba8
TF
1981/* Second is the rate measurement period and exponential smoothing time
1982constant. This must be strictly greater than zero, because zero leads to
1983run-time division errors. */
1984
1985sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
1986if (sender_rate_period == NULL) period = -1.0;
1987else period = readconf_readtime(sender_rate_period, 0, FALSE);
1988if (period <= 0.0)
1989 {
1990 *log_msgptr = string_sprintf("syntax error in argument for "
1991 "\"ratelimit\" condition: \"%s\" is not a time value",
1992 sender_rate_period);
1993 return ERROR;
1994 }
1995
1996/* Parse the other options. Should we check if the per_* options are being
1997used in ACLs where they don't make sense, e.g. per_mail in the connect ACL? */
1998
1999while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2000 != NULL)
2001 {
2002 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2003 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2004 else if (strcmpic(ss, US"per_byte") == 0) per_byte = TRUE;
2005 else if (strcmpic(ss, US"per_cmd") == 0) per_cmd = TRUE;
2006 else if (strcmpic(ss, US"per_conn") == 0) per_conn = TRUE;
2007 else if (strcmpic(ss, US"per_mail") == 0) per_mail = TRUE;
2008 else if (strcmpic(ss, US"per_rcpt") == 0) per_cmd = TRUE; /* alias */
2009 else have_key = TRUE;
2010 }
2011if (leaky + strict > 1 || per_byte + per_cmd + per_conn + per_mail > 1)
2012 {
2013 *log_msgptr = US"conflicting options for \"ratelimit\" condition";
2014 return ERROR;
2015 }
2016
2017/* Default option values */
2018if (!strict) leaky = TRUE;
2019if (!per_byte && !per_cmd && !per_conn) per_mail = TRUE;
2020
f3dcf4a2 2021/* If there is no explicit key, use the sender_host_address. If there is no
870f6ba8
TF
2022sender_host_address (e.g. -bs or acl_not_smtp) then we simply omit it. */
2023
2024if (!have_key && sender_host_address != NULL)
2025 key = string_sprintf("%s / %s", key, sender_host_address);
2026
2027HDEBUG(D_acl) debug_printf("ratelimit condition limit=%.0f period=%.0f key=%s\n",
2028 limit, period, key);
2029
fe0dab11 2030/* See if we have already computed the rate by looking in the relevant tree. For
870f6ba8
TF
2031per-connection rate limiting, store tree nodes and dbdata in the permanent pool
2032so that they survive across resets. */
2033
2034anchor = NULL;
2035old_pool = store_pool;
2036
2037if (per_conn)
2038 {
2039 anchor = &ratelimiters_conn;
2040 store_pool = POOL_PERM;
2041 }
fe0dab11 2042else if (per_mail || per_byte)
870f6ba8 2043 anchor = &ratelimiters_mail;
fe0dab11
TF
2044else if (per_cmd)
2045 anchor = &ratelimiters_cmd;
870f6ba8
TF
2046
2047if (anchor != NULL && (t = tree_search(*anchor, key)) != NULL)
2048 {
2049 dbd = t->data.ptr;
2050 /* The following few lines duplicate some of the code below. */
3348576f
TF
2051 if (dbd->rate < limit) rc = FAIL;
2052 else rc = OK;
870f6ba8
TF
2053 store_pool = old_pool;
2054 sender_rate = string_sprintf("%.1f", dbd->rate);
2055 HDEBUG(D_acl)
2056 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2057 return rc;
2058 }
2059
2060/* We aren't using a pre-computed rate, so get a previously recorded
2061rate from the database, update it, and write it back. If there's no
2062previous rate for this key, create one. */
2063
2064dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2065if (dbm == NULL)
2066 {
2067 store_pool = old_pool;
2068 sender_rate = NULL;
2069 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2070 *log_msgptr = US"ratelimit database not available";
2071 return DEFER;
2072 }
2073dbd = dbfn_read(dbm, key);
2074
2075gettimeofday(&tv, NULL);
2076
2077if (dbd == NULL)
2078 {
2079 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's data\n");
2080 dbd = store_get(sizeof(dbdata_ratelimit));
2081 dbd->time_stamp = tv.tv_sec;
2082 dbd->time_usec = tv.tv_usec;
2083 dbd->rate = 0.0;
2084 }
2085else
2086 {
2087 /* The smoothed rate is computed using an exponentially weighted moving
2088 average adjusted for variable sampling intervals. The standard EWMA for
2089 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2090 where f() is the measured value and f'() is the smoothed value.
2091
2092 Old data decays out of the smoothed value exponentially, such that data n
2093 samples old is multiplied by a^n. The exponential decay time constant p
2094 is defined such that data p samples old is multiplied by 1/e, which means
2095 that a = exp(-1/p). We can maintain the same time constant for a variable
2096 sampling interval i by using a = exp(-i/p).
2097
2098 The rate we are measuring is messages per period, suitable for directly
2099 comparing with the limit. The average rate between now and the previous
2100 message is period / interval, which we feed into the EWMA as the sample.
2101
2102 It turns out that the number of messages required for the smoothed rate
2103 to reach the limit when they are sent in a burst is equal to the limit.
2104 This can be seen by analysing the value of the smoothed rate after N
2105 messages sent at even intervals. Let k = (1 - a) * p/i
2106
2107 rate_1 = (1 - a) * p/i + a * rate_0
2108 = k + a * rate_0
2109 rate_2 = k + a * rate_1
2110 = k + a * k + a^2 * rate_0
2111 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2112 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2113 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2114 = rate_0 * a^N + p/i * (1 - a^N)
2115
2116 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2117
2118 rate_N = p/i + (rate_0 - p/i) * a^N
2119 a^N = (rate_N - p/i) / (rate_0 - p/i)
2120 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2121 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2122
2123 Numerical analysis of the above equation, setting the computed rate to
2124 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2125 rates, p/i, the number of messages N = limit. So limit serves as both the
2126 maximum rate measured in messages per period, and the maximum number of
2127 messages that can be sent in a fast burst. */
2128
2129 double this_time = (double)tv.tv_sec
2130 + (double)tv.tv_usec / 1000000.0;
2131 double prev_time = (double)dbd->time_stamp
2132 + (double)dbd->time_usec / 1000000.0;
2133 double interval = this_time - prev_time;
2134
2135 double i_over_p = interval / period;
2136 double a = exp(-i_over_p);
2137
2138 /* We must avoid division by zero, and deal gracefully with the clock going
2139 backwards. If we blunder ahead when time is in reverse then the computed
2140 rate will become bogusly huge. Clamp i/p to a very small number instead. */
2141
2142 if (i_over_p <= 0.0) i_over_p = 1e-9;
2143
2144 dbd->time_stamp = tv.tv_sec;
2145 dbd->time_usec = tv.tv_usec;
2146
2147 /* If we are measuring the rate in bytes per period, multiply the
2148 measured rate by the message size. If we don't know the message size
2149 then it's safe to just use a value of zero and let the recorded rate
2150 decay as if nothing happened. */
2151
2152 if (per_byte)
2153 dbd->rate = (message_size < 0 ? 0.0 : (double)message_size)
2154 * (1 - a) / i_over_p + a * dbd->rate;
2155 else
2156 dbd->rate = (1 - a) / i_over_p + a * dbd->rate;
2157 }
2158
3348576f
TF
2159/* Clients sending at the limit are considered to be over the limit. This
2160matters for edge cases such the first message sent by a client (which gets
2161the initial rate of 0.0) when the rate limit is zero (i.e. the client should
2162be completely blocked). */
2163
2164if (dbd->rate < limit) rc = FAIL;
2165 else rc = OK;
870f6ba8
TF
2166
2167/* Update the state if the rate is low or if we are being strict. If we
2168are in leaky mode and the sender's rate is too high, we do not update
2169the recorded rate in order to avoid an over-aggressive sender's retry
2170rate preventing them from getting any email through. */
2171
2172if (rc == FAIL || !leaky)
2173 dbfn_write(dbm, key, dbd, sizeof(dbdata_ratelimit));
2174dbfn_close(dbm);
2175
2176/* Store the result in the tree for future reference, if necessary. */
2177
2178if (anchor != NULL)
2179 {
2180 t = store_get(sizeof(tree_node) + Ustrlen(key));
2181 t->data.ptr = dbd;
2182 Ustrcpy(t->name, key);
2183 (void)tree_insertnode(anchor, t);
2184 }
2185
2186/* We create the formatted version of the sender's rate very late in
2187order to ensure that it is done using the correct storage pool. */
2188
2189store_pool = old_pool;
2190sender_rate = string_sprintf("%.1f", dbd->rate);
2191
2192HDEBUG(D_acl)
2193 debug_printf("ratelimit computed rate %s\n", sender_rate);
2194
2195return rc;
2196}
2197
2198
2199
2200/*************************************************
059ec3d9
PH
2201* Handle conditions/modifiers on an ACL item *
2202*************************************************/
2203
2204/* Called from acl_check() below.
2205
2206Arguments:
2207 verb ACL verb
2208 cb ACL condition block - if NULL, result is OK
2209 where where called from
2210 addr the address being checked for RCPT, or NULL
2211 level the nesting level
2212 epp pointer to pass back TRUE if "endpass" encountered
2213 (applies only to "accept" and "discard")
2214 user_msgptr user message pointer
2215 log_msgptr log message pointer
2216 basic_errno pointer to where to put verify error
2217
2218Returns: OK - all conditions are met
2219 DISCARD - an "acl" condition returned DISCARD - only allowed
2220 for "accept" or "discard" verbs
2221 FAIL - at least one condition fails
2222 FAIL_DROP - an "acl" condition returned FAIL_DROP
2223 DEFER - can't tell at the moment (typically, lookup defer,
2224 but can be temporary callout problem)
2225 ERROR - ERROR from nested ACL or expansion failure or other
2226 error
2227*/
2228
2229static int
2230acl_check_condition(int verb, acl_condition_block *cb, int where,
2231 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2232 uschar **log_msgptr, int *basic_errno)
2233{
2234uschar *user_message = NULL;
2235uschar *log_message = NULL;
2236uschar *p;
2237int rc = OK;
8523533c
TK
2238#ifdef WITH_CONTENT_SCAN
2239int sep = '/';
2240#endif
059ec3d9
PH
2241
2242for (; cb != NULL; cb = cb->next)
2243 {
2244 uschar *arg;
8e669ac1 2245 int control_type;
059ec3d9
PH
2246
2247 /* The message and log_message items set up messages to be used in
2248 case of rejection. They are expanded later. */
2249
2250 if (cb->type == ACLC_MESSAGE)
2251 {
2252 user_message = cb->arg;
2253 continue;
2254 }
2255
2256 if (cb->type == ACLC_LOG_MESSAGE)
2257 {
2258 log_message = cb->arg;
2259 continue;
2260 }
2261
2262 /* The endpass "condition" just sets a flag to show it occurred. This is
2263 checked at compile time to be on an "accept" or "discard" item. */
2264
2265 if (cb->type == ACLC_ENDPASS)
2266 {
2267 *epp = TRUE;
2268 continue;
2269 }
2270
2271 /* For other conditions and modifiers, the argument is expanded now for some
2272 of them, but not for all, because expansion happens down in some lower level
2273 checking functions in some cases. */
2274
2275 if (cond_expand_at_top[cb->type])
2276 {
2277 arg = expand_string(cb->arg);
2278 if (arg == NULL)
2279 {
2280 if (expand_string_forcedfail) continue;
2281 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2282 cb->arg, expand_string_message);
2283 return search_find_defer? DEFER : ERROR;
2284 }
2285 }
2286 else arg = cb->arg;
2287
2288 /* Show condition, and expanded condition if it's different */
2289
2290 HDEBUG(D_acl)
2291 {
2292 int lhswidth = 0;
2293 debug_printf("check %s%s %n",
2294 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2295 conditions[cb->type], &lhswidth);
2296
2297 if (cb->type == ACLC_SET)
2298 {
2299 int n = cb->u.varnumber;
2300 int t = (n < ACL_C_MAX)? 'c' : 'm';
2301 if (n >= ACL_C_MAX) n -= ACL_C_MAX;
2302 debug_printf("acl_%c%d ", t, n);
2303 lhswidth += 7;
2304 }
2305
2306 debug_printf("= %s\n", cb->arg);
2307
2308 if (arg != cb->arg)
2309 debug_printf("%.*s= %s\n", lhswidth,
2310 US" ", CS arg);
2311 }
2312
2313 /* Check that this condition makes sense at this time */
2314
2315 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2316 {
2317 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2318 cond_modifiers[cb->type]? "use" : "test",
2319 conditions[cb->type], acl_wherenames[where]);
2320 return ERROR;
2321 }
2322
2323 /* Run the appropriate test for each condition, or take the appropriate
2324 action for the remaining modifiers. */
2325
2326 switch(cb->type)
2327 {
2328 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2329 "discard" verb. */
2330
2331 case ACLC_ACL:
2332 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
2333 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2334 {
2335 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2336 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2337 verbs[verb]);
2338 return ERROR;
2339 }
2340 break;
2341
2342 case ACLC_AUTHENTICATED:
2343 rc = (sender_host_authenticated == NULL)? FAIL :
2344 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2345 TRUE, NULL);
2346 break;
2347
8523533c
TK
2348#ifdef EXPERIMENTAL_BRIGHTMAIL
2349 case ACLC_BMI_OPTIN:
2350 {
2351 int old_pool = store_pool;
2352 store_pool = POOL_PERM;
2353 bmi_current_optin = string_copy(arg);
2354 store_pool = old_pool;
2355 }
2356 break;
2357#endif
2358
059ec3d9
PH
2359 case ACLC_CONDITION:
2360 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2361 rc = (Uatoi(arg) == 0)? FAIL : OK;
2362 else
2363 rc = (strcmpic(arg, US"no") == 0 ||
2364 strcmpic(arg, US"false") == 0)? FAIL :
2365 (strcmpic(arg, US"yes") == 0 ||
2366 strcmpic(arg, US"true") == 0)? OK : DEFER;
2367 if (rc == DEFER)
2368 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2369 break;
2370
2371 case ACLC_CONTROL:
c5fcb476
PH
2372 control_type = decode_control(arg, &p, where, log_msgptr);
2373
8523533c 2374 /* Check if this control makes sense at this time */
c5fcb476
PH
2375
2376 if ((control_forbids[control_type] & (1 << where)) != 0)
2377 {
2378 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2379 controls[control_type], acl_wherenames[where]);
2380 return ERROR;
8e669ac1 2381 }
c5fcb476
PH
2382
2383 switch(control_type)
059ec3d9 2384 {
8523533c
TK
2385#ifdef EXPERIMENTAL_BRIGHTMAIL
2386 case CONTROL_BMI_RUN:
2387 bmi_run = 1;
2388 break;
2389#endif
fb2274d4
TK
2390#ifdef EXPERIMENTAL_DOMAINKEYS
2391 case CONTROL_DK_VERIFY:
2392 dk_do_verify = 1;
2393 break;
2394#endif
059ec3d9
PH
2395 case CONTROL_ERROR:
2396 return ERROR;
2397
2398 case CONTROL_CASEFUL_LOCAL_PART:
2399 deliver_localpart = addr->cc_local_part;
2400 break;
2401
2402 case CONTROL_CASELOWER_LOCAL_PART:
2403 deliver_localpart = addr->lc_local_part;
2404 break;
2405
2406 case CONTROL_ENFORCE_SYNC:
2407 smtp_enforce_sync = TRUE;
2408 break;
2409
2410 case CONTROL_NO_ENFORCE_SYNC:
2411 smtp_enforce_sync = FALSE;
2412 break;
2413
8523533c
TK
2414#ifdef WITH_CONTENT_SCAN
2415 case CONTROL_NO_MBOX_UNSPOOL:
2416 no_mbox_unspool = TRUE;
2417 break;
2418#endif
2419
059ec3d9
PH
2420 case CONTROL_NO_MULTILINE:
2421 no_multiline_responses = TRUE;
2422 break;
2423
29aba418 2424 case CONTROL_FAKEDEFER:
8523533c 2425 case CONTROL_FAKEREJECT:
29aba418 2426 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 2427 if (*p == '/')
8e669ac1 2428 {
8523533c 2429 uschar *pp = p + 1;
8e669ac1 2430 while (*pp != 0) pp++;
29aba418 2431 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK
2432 p = pp;
2433 }
2434 else
2435 {
2436 /* Explicitly reset to default string */
29aba418 2437 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK
2438 }
2439 break;
8523533c 2440
059ec3d9
PH
2441 case CONTROL_FREEZE:
2442 deliver_freeze = TRUE;
2443 deliver_frozen_at = time(NULL);
2444 break;
2445
2446 case CONTROL_QUEUE_ONLY:
2447 queue_only_policy = TRUE;
2448 break;
2449
2450 case CONTROL_SUBMISSION:
87ba3f5f 2451 originator_name = US"";
059ec3d9 2452 submission_mode = TRUE;
69358f02 2453 while (*p == '/')
8e669ac1 2454 {
69358f02
PH
2455 if (Ustrncmp(p, "/sender_retain", 14) == 0)
2456 {
2457 p += 14;
2458 active_local_sender_retain = TRUE;
8e669ac1
PH
2459 active_local_from_check = FALSE;
2460 }
69358f02
PH
2461 else if (Ustrncmp(p, "/domain=", 8) == 0)
2462 {
2463 uschar *pp = p + 8;
8e669ac1 2464 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH
2465 submission_domain = string_copyn(p+8, pp-p-8);
2466 p = pp;
2467 }
2468 else if (Ustrncmp(p, "/name=", 6) == 0)
2469 {
2470 uschar *pp = p + 6;
2471 while (*pp != 0 && *pp != '/') pp++;
2472 originator_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
2473 big_buffer, big_buffer_size));
8e669ac1 2474 p = pp;
69358f02 2475 }
8e669ac1
PH
2476 else break;
2477 }
69358f02 2478 if (*p != 0)
059ec3d9 2479 {
69358f02 2480 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH
2481 return ERROR;
2482 }
2483 break;
2484 }
2485 break;
2486
8523533c
TK
2487#ifdef WITH_CONTENT_SCAN
2488 case ACLC_DECODE:
2489 rc = mime_decode(&arg);
2490 break;
2491#endif
2492
059ec3d9
PH
2493 case ACLC_DELAY:
2494 {
2495 int delay = readconf_readtime(arg, 0, FALSE);
2496 if (delay < 0)
2497 {
2498 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
2499 "modifier: \"%s\" is not a time value", arg);
2500 return ERROR;
2501 }
2502 else
2503 {
2504 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
2505 delay);
2506 if (host_checking)
2507 {
2508 HDEBUG(D_acl)
2509 debug_printf("delay skipped in -bh checking mode\n");
2510 }
010c2d14
PH
2511
2512 /* It appears to be impossible to detect that a TCP/IP connection has
2513 gone away without reading from it. This means that we cannot shorten
2514 the delay below if the client goes away, because we cannot discover
2515 that the client has closed its end of the connection. (The connection
2516 is actually in a half-closed state, waiting for the server to close its
2517 end.) It would be nice to be able to detect this state, so that the
2518 Exim process is not held up unnecessarily. However, it seems that we
2519 can't. The poll() function does not do the right thing, and in any case
2520 it is not always available.
2521
2522 NOTE: If ever this state of affairs changes, remember that we may be
2523 dealing with stdin/stdout here, in addition to TCP/IP connections.
2524 Whatever is done must work in both cases. To detected the stdin/stdout
2525 case, check for smtp_in or smtp_out being NULL. */
2526
8e669ac1 2527 else
86b8287f
PH
2528 {
2529 while (delay > 0) delay = sleep(delay);
8e669ac1 2530 }
059ec3d9
PH
2531 }
2532 }
2533 break;
2534
8523533c
TK
2535#ifdef WITH_OLD_DEMIME
2536 case ACLC_DEMIME:
2537 rc = demime(&arg);
2538 break;
2539#endif
2540
fb2274d4
TK
2541#ifdef EXPERIMENTAL_DOMAINKEYS
2542 case ACLC_DK_DOMAIN_SOURCE:
2543 if (dk_verify_block == NULL) { rc = FAIL; break; };
2544 /* check header source of domain against given string */
2545 switch (dk_verify_block->address_source) {
2546 case DK_EXIM_ADDRESS_FROM_FROM:
2547 rc = match_isinlist(US"from", &arg, 0, NULL,
2548 NULL, MCL_STRING, TRUE, NULL);
2549 break;
2550 case DK_EXIM_ADDRESS_FROM_SENDER:
2551 rc = match_isinlist(US"sender", &arg, 0, NULL,
2552 NULL, MCL_STRING, TRUE, NULL);
2553 break;
2554 case DK_EXIM_ADDRESS_NONE:
2555 rc = match_isinlist(US"none", &arg, 0, NULL,
2556 NULL, MCL_STRING, TRUE, NULL);
2557 break;
2558 }
2559 break;
2560 case ACLC_DK_POLICY:
2561 if (dk_verify_block == NULL) { rc = FAIL; break; };
2562 /* check policy against given string, default FAIL */
2563 rc = FAIL;
2564 if (dk_verify_block->signsall)
2565 rc = match_isinlist(US"signsall", &arg, 0, NULL,
2566 NULL, MCL_STRING, TRUE, NULL);
2567 if (dk_verify_block->testing)
2568 rc = match_isinlist(US"testing", &arg, 0, NULL,
2569 NULL, MCL_STRING, TRUE, NULL);
2570 break;
2571 case ACLC_DK_SENDER_DOMAINS:
2572 if (dk_verify_block == NULL) { rc = FAIL; break; };
2573 if (dk_verify_block->domain != NULL)
2574 rc = match_isinlist(dk_verify_block->domain, &arg, 0, &domainlist_anchor,
2575 NULL, MCL_DOMAIN, TRUE, NULL);
2576 else rc = FAIL;
2577 break;
2578 case ACLC_DK_SENDER_LOCAL_PARTS:
2579 if (dk_verify_block == NULL) { rc = FAIL; break; };
2580 if (dk_verify_block->local_part != NULL)
2581 rc = match_isinlist(dk_verify_block->local_part, &arg, 0, &localpartlist_anchor,
2582 NULL, MCL_LOCALPART, TRUE, NULL);
2583 else rc = FAIL;
2584 break;
2585 case ACLC_DK_SENDERS:
2586 if (dk_verify_block == NULL) { rc = FAIL; break; };
2587 if (dk_verify_block->address != NULL)
2588 rc = match_address_list(dk_verify_block->address, TRUE, TRUE, &arg, NULL, -1, 0, NULL);
2589 else rc = FAIL;
2590 break;
2591 case ACLC_DK_STATUS:
2592 if (dk_verify_block == NULL) { rc = FAIL; break; };
2593 if (dk_verify_block->result > 0) {
2594 switch(dk_verify_block->result) {
2595 case DK_EXIM_RESULT_BAD_FORMAT:
2596 rc = match_isinlist(US"bad format", &arg, 0, NULL,
2597 NULL, MCL_STRING, TRUE, NULL);
2598 break;
2599 case DK_EXIM_RESULT_NO_KEY:
2600 rc = match_isinlist(US"no key", &arg, 0, NULL,
2601 NULL, MCL_STRING, TRUE, NULL);
2602 break;
2603 case DK_EXIM_RESULT_NO_SIGNATURE:
2604 rc = match_isinlist(US"no signature", &arg, 0, NULL,
2605 NULL, MCL_STRING, TRUE, NULL);
2606 break;
2607 case DK_EXIM_RESULT_REVOKED:
2608 rc = match_isinlist(US"revoked", &arg, 0, NULL,
2609 NULL, MCL_STRING, TRUE, NULL);
2610 break;
2611 case DK_EXIM_RESULT_NON_PARTICIPANT:
2612 rc = match_isinlist(US"non-participant", &arg, 0, NULL,
2613 NULL, MCL_STRING, TRUE, NULL);
2614 break;
2615 case DK_EXIM_RESULT_GOOD:
2616 rc = match_isinlist(US"good", &arg, 0, NULL,
2617 NULL, MCL_STRING, TRUE, NULL);
2618 break;
2619 case DK_EXIM_RESULT_BAD:
2620 rc = match_isinlist(US"bad", &arg, 0, NULL,
2621 NULL, MCL_STRING, TRUE, NULL);
2622 break;
2623 }
2624 }
2625 break;
2626#endif
2627
059ec3d9
PH
2628 case ACLC_DNSLISTS:
2629 rc = verify_check_dnsbl(&arg);
2630 break;
2631
2632 case ACLC_DOMAINS:
2633 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
2634 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
2635 break;
2636
2637 /* The value in tls_cipher is the full cipher name, for example,
2638 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
2639 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
2640 what may in practice come out of the SSL library - which at the time of
2641 writing is poorly documented. */
2642
2643 case ACLC_ENCRYPTED:
2644 if (tls_cipher == NULL) rc = FAIL; else
2645 {
2646 uschar *endcipher = NULL;
2647 uschar *cipher = Ustrchr(tls_cipher, ':');
2648 if (cipher == NULL) cipher = tls_cipher; else
2649 {
2650 endcipher = Ustrchr(++cipher, ':');
2651 if (endcipher != NULL) *endcipher = 0;
2652 }
2653 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
2654 if (endcipher != NULL) *endcipher = ':';
2655 }
2656 break;
2657
2658 /* Use verify_check_this_host() instead of verify_check_host() so that
2659 we can pass over &host_data to catch any looked up data. Once it has been
2660 set, it retains its value so that it's still there if another ACL verb
2661 comes through here and uses the cache. However, we must put it into
2662 permanent store in case it is also expected to be used in a subsequent
2663 message in the same SMTP connection. */
2664
2665 case ACLC_HOSTS:
2666 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
2667 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
2668 if (host_data != NULL) host_data = string_copy_malloc(host_data);
2669 break;
2670
2671 case ACLC_LOCAL_PARTS:
2672 rc = match_isinlist(addr->cc_local_part, &arg, 0,
2673 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
2674 &deliver_localpart_data);
2675 break;
2676
2677 case ACLC_LOGWRITE:
2678 {
2679 int logbits = 0;
2680 uschar *s = arg;
2681 if (*s == ':')
2682 {
2683 s++;
2684 while (*s != ':')
2685 {
2686 if (Ustrncmp(s, "main", 4) == 0)
2687 { logbits |= LOG_MAIN; s += 4; }
2688 else if (Ustrncmp(s, "panic", 5) == 0)
2689 { logbits |= LOG_PANIC; s += 5; }
2690 else if (Ustrncmp(s, "reject", 6) == 0)
2691 { logbits |= LOG_REJECT; s += 6; }
2692 else
2693 {
2694 logbits = LOG_MAIN|LOG_PANIC;
2695 s = string_sprintf(":unknown log name in \"%s\" in "
2696 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
2697 }
2698 if (*s == ',') s++;
2699 }
2700 s++;
2701 }
2702 while (isspace(*s)) s++;
2703 if (logbits == 0) logbits = LOG_MAIN;
2704 log_write(0, logbits, "%s", string_printing(s));
2705 }
2706 break;
8e669ac1 2707
8523533c
TK
2708#ifdef WITH_CONTENT_SCAN
2709 case ACLC_MALWARE:
2710 {
2711 /* Seperate the regular expression and any optional parameters. */
2712 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2713 /* Run the malware backend. */
2714 rc = malware(&ss);
2715 /* Modify return code based upon the existance of options. */
2716 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2717 != NULL) {
2718 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2719 {
2720 /* FAIL so that the message is passed to the next ACL */
2721 rc = FAIL;
2722 }
2723 }
2724 }
2725 break;
2726
2727 case ACLC_MIME_REGEX:
2728 rc = mime_regex(&arg);
2729 break;
2730#endif
059ec3d9 2731
870f6ba8
TF
2732 case ACLC_RATELIMIT:
2733 rc = acl_ratelimit(arg, log_msgptr);
2734 break;
2735
059ec3d9
PH
2736 case ACLC_RECIPIENTS:
2737 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
2738 &recipient_data);
2739 break;
2740
8523533c
TK
2741#ifdef WITH_CONTENT_SCAN
2742 case ACLC_REGEX:
2743 rc = regex(&arg);
2744 break;
2745#endif
2746
059ec3d9
PH
2747 case ACLC_SENDER_DOMAINS:
2748 {
2749 uschar *sdomain;
2750 sdomain = Ustrrchr(sender_address, '@');
2751 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
2752 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
2753 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
2754 }
2755 break;
2756
2757 case ACLC_SENDERS:
2758 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
2759 sender_address_cache, -1, 0, &sender_data);
2760 break;
2761
2762 /* Connection variables must persist forever */
2763
2764 case ACLC_SET:
2765 {
2766 int old_pool = store_pool;
2767 if (cb->u.varnumber < ACL_C_MAX) store_pool = POOL_PERM;
2768 acl_var[cb->u.varnumber] = string_copy(arg);
2769 store_pool = old_pool;
2770 }
2771 break;
2772
8523533c
TK
2773#ifdef WITH_CONTENT_SCAN
2774 case ACLC_SPAM:
2775 {
2776 /* Seperate the regular expression and any optional parameters. */
2777 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2778 /* Run the spam backend. */
2779 rc = spam(&ss);
2780 /* Modify return code based upon the existance of options. */
2781 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2782 != NULL) {
2783 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2784 {
2785 /* FAIL so that the message is passed to the next ACL */
2786 rc = FAIL;
2787 }
2788 }
2789 }
2790 break;
2791#endif
2792
2793#ifdef EXPERIMENTAL_SPF
2794 case ACLC_SPF:
2795 rc = spf_process(&arg, sender_address);
2796 break;
2797#endif
2798
059ec3d9
PH
2799 /* If the verb is WARN, discard any user message from verification, because
2800 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH
2801 only from explicit "message" modifiers. However, put the user message into
2802 $acl_verify_message so it can be used in subsequent conditions or modifiers
2803 (until something changes it). */
059ec3d9
PH
2804
2805 case ACLC_VERIFY:
2806 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 2807 acl_verify_message = *user_msgptr;
059ec3d9
PH
2808 if (verb == ACL_WARN) *user_msgptr = NULL;
2809 break;
2810
2811 default:
2812 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
2813 "condition %d", cb->type);
2814 break;
2815 }
2816
2817 /* If a condition was negated, invert OK/FAIL. */
2818
2819 if (!cond_modifiers[cb->type] && cb->u.negated)
2820 {
2821 if (rc == OK) rc = FAIL;
2822 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
2823 }
2824
2825 if (rc != OK) break; /* Conditions loop */
2826 }
2827
2828
2829/* If the result is the one for which "message" and/or "log_message" are used,
2830handle the values of these options. Most verbs have but a single return for
2831which the messages are relevant, but for "discard", it's useful to have the log
2832message both when it succeeds and when it fails. Also, for an "accept" that
2833appears in a QUIT ACL, we want to handle the user message. Since only "accept"
2834and "warn" are permitted in that ACL, we don't need to test the verb.
2835
2836These modifiers act in different ways:
2837
2838"message" is a user message that will be included in an SMTP response. Unless
2839it is empty, it overrides any previously set user message.
2840
2841"log_message" is a non-user message, and it adds to any existing non-user
2842message that is already set.
2843
2844If there isn't a log message set, we make it the same as the user message. */
2845
2846if (((rc == FAIL_DROP)? FAIL : rc) == msgcond[verb] ||
2847 (verb == ACL_DISCARD && rc == OK) ||
2848 (where == ACL_WHERE_QUIT))
2849 {
2850 uschar *expmessage;
2851
2852 /* If the verb is "warn", messages generated by conditions (verification or
2853 nested ACLs) are discarded. Only messages specified at this level are used.
2854 However, the value of an existing message is available in $acl_verify_message
2855 during expansions. */
2856
2857 uschar *old_user_msgptr = *user_msgptr;
2858 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
2859
2860 if (verb == ACL_WARN) *log_msgptr = *user_msgptr = NULL;
2861
2862 if (user_message != NULL)
2863 {
2864 acl_verify_message = old_user_msgptr;
2865 expmessage = expand_string(user_message);
2866 if (expmessage == NULL)
2867 {
2868 if (!expand_string_forcedfail)
2869 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2870 user_message, expand_string_message);
2871 }
2872 else if (expmessage[0] != 0) *user_msgptr = expmessage;
2873 }
2874
2875 if (log_message != NULL)
2876 {
2877 acl_verify_message = old_log_msgptr;
2878 expmessage = expand_string(log_message);
2879 if (expmessage == NULL)
2880 {
2881 if (!expand_string_forcedfail)
2882 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2883 log_message, expand_string_message);
2884 }
2885 else if (expmessage[0] != 0)
2886 {
2887 *log_msgptr = (*log_msgptr == NULL)? expmessage :
2888 string_sprintf("%s: %s", expmessage, *log_msgptr);
2889 }
2890 }
2891
2892 /* If no log message, default it to the user message */
2893
2894 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
2895 }
2896
2897acl_verify_message = NULL;
2898return rc;
2899}
2900
2901
2902
2903
2904
2905/*************************************************
2906* Get line from a literal ACL *
2907*************************************************/
2908
2909/* This function is passed to acl_read() in order to extract individual lines
2910of a literal ACL, which we access via static pointers. We can destroy the
2911contents because this is called only once (the compiled ACL is remembered).
2912
2913This code is intended to treat the data in the same way as lines in the main
2914Exim configuration file. That is:
2915
2916 . Leading spaces are ignored.
2917
2918 . A \ at the end of a line is a continuation - trailing spaces after the \
2919 are permitted (this is because I don't believe in making invisible things
2920 significant). Leading spaces on the continued part of a line are ignored.
2921
2922 . Physical lines starting (significantly) with # are totally ignored, and
2923 may appear within a sequence of backslash-continued lines.
2924
2925 . Blank lines are ignored, but will end a sequence of continuations.
2926
2927Arguments: none
2928Returns: a pointer to the next line
2929*/
2930
2931
2932static uschar *acl_text; /* Current pointer in the text */
2933static uschar *acl_text_end; /* Points one past the terminating '0' */
2934
2935
2936static uschar *
2937acl_getline(void)
2938{
2939uschar *yield;
2940
2941/* This loop handles leading blank lines and comments. */
2942
2943for(;;)
2944 {
2945 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
2946 if (*acl_text == 0) return NULL; /* No more data */
2947 yield = acl_text; /* Potential data line */
2948
2949 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
2950
2951 /* If we hit the end before a newline, we have the whole logical line. If
2952 it's a comment, there's no more data to be given. Otherwise, yield it. */
2953
2954 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
2955
2956 /* After reaching a newline, end this loop if the physical line does not
2957 start with '#'. If it does, it's a comment, and the loop continues. */
2958
2959 if (*yield != '#') break;
2960 }
2961
2962/* This loop handles continuations. We know we have some real data, ending in
2963newline. See if there is a continuation marker at the end (ignoring trailing
2964white space). We know that *yield is not white space, so no need to test for
2965cont > yield in the backwards scanning loop. */
2966
2967for(;;)
2968 {
2969 uschar *cont;
2970 for (cont = acl_text - 1; isspace(*cont); cont--);
2971
2972 /* If no continuation follows, we are done. Mark the end of the line and
2973 return it. */
2974
2975 if (*cont != '\\')
2976 {
2977 *acl_text++ = 0;
2978 return yield;
2979 }
2980
2981 /* We have encountered a continuation. Skip over whitespace at the start of
2982 the next line, and indeed the whole of the next line or lines if they are
2983 comment lines. */
2984
2985 for (;;)
2986 {
2987 while (*(++acl_text) == ' ' || *acl_text == '\t');
2988 if (*acl_text != '#') break;
2989 while (*(++acl_text) != 0 && *acl_text != '\n');
2990 }
2991
2992 /* We have the start of a continuation line. Move all the rest of the data
2993 to join onto the previous line, and then find its end. If the end is not a
2994 newline, we are done. Otherwise loop to look for another continuation. */
2995
2996 memmove(cont, acl_text, acl_text_end - acl_text);
2997 acl_text_end -= acl_text - cont;
2998 acl_text = cont;
2999 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3000 if (*acl_text == 0) return yield;
3001 }
3002
3003/* Control does not reach here */
3004}
3005
3006
3007
3008
3009
3010/*************************************************
3011* Check access using an ACL *
3012*************************************************/
3013
3014/* This function is called from address_check. It may recurse via
3015acl_check_condition() - hence the use of a level to stop looping. The ACL is
3016passed as a string which is expanded. A forced failure implies no access check
3017is required. If the result is a single word, it is taken as the name of an ACL
3018which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3019text, complete with newlines, and parsed as such. In both cases, the ACL check
3020is then run. This function uses an auxiliary function for acl_read() to call
3021for reading individual lines of a literal ACL. This is acl_getline(), which
3022appears immediately above.
3023
3024Arguments:
3025 where where called from
3026 addr address item when called from RCPT; otherwise NULL
3027 s the input string; NULL is the same as an empty ACL => DENY
3028 level the nesting level
3029 user_msgptr where to put a user error (for SMTP response)
3030 log_msgptr where to put a logging message (not for SMTP response)
3031
3032Returns: OK access is granted
3033 DISCARD access is apparently granted...
3034 FAIL access is denied
3035 FAIL_DROP access is denied; drop the connection
3036 DEFER can't tell at the moment
3037 ERROR disaster
3038*/
3039
3040static int
3041acl_check_internal(int where, address_item *addr, uschar *s, int level,
3042 uschar **user_msgptr, uschar **log_msgptr)
3043{
3044int fd = -1;
3045acl_block *acl = NULL;
3046uschar *acl_name = US"inline ACL";
3047uschar *ss;
3048
3049/* Catch configuration loops */
3050
3051if (level > 20)
3052 {
3053 *log_msgptr = US"ACL nested too deep: possible loop";
3054 return ERROR;
3055 }
3056
3057if (s == NULL)
3058 {
3059 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3060 return FAIL;
3061 }
3062
3063/* At top level, we expand the incoming string. At lower levels, it has already
3064been expanded as part of condition processing. */
3065
3066if (level == 0)
3067 {
3068 ss = expand_string(s);
3069 if (ss == NULL)
3070 {
3071 if (expand_string_forcedfail) return OK;
3072 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3073 expand_string_message);
3074 return ERROR;
3075 }
3076 }
3077else ss = s;
3078
3079while (isspace(*ss))ss++;
3080
3081/* If we can't find a named ACL, the default is to parse it as an inline one.
3082(Unless it begins with a slash; non-existent files give rise to an error.) */
3083
3084acl_text = ss;
3085
3086/* Handle the case of a string that does not contain any spaces. Look for a
3087named ACL among those read from the configuration, or a previously read file.
3088It is possible that the pointer to the ACL is NULL if the configuration
3089contains a name with no data. If not found, and the text begins with '/',
3090read an ACL from a file, and save it so it can be re-used. */
3091
3092if (Ustrchr(ss, ' ') == NULL)
3093 {
3094 tree_node *t = tree_search(acl_anchor, ss);
3095 if (t != NULL)
3096 {
3097 acl = (acl_block *)(t->data.ptr);
3098 if (acl == NULL)
3099 {
3100 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3101 return FAIL;
3102 }
3103 acl_name = string_sprintf("ACL \"%s\"", ss);
3104 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3105 }
3106
3107 else if (*ss == '/')
3108 {
3109 struct stat statbuf;
3110 fd = Uopen(ss, O_RDONLY, 0);
3111 if (fd < 0)
3112 {
3113 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3114 strerror(errno));
3115 return ERROR;
3116 }
3117
3118 if (fstat(fd, &statbuf) != 0)
3119 {
3120 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3121 strerror(errno));
3122 return ERROR;
3123 }
3124
3125 acl_text = store_get(statbuf.st_size + 1);
3126 acl_text_end = acl_text + statbuf.st_size + 1;
3127
3128 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3129 {
3130 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3131 ss, strerror(errno));
3132 return ERROR;
3133 }
3134 acl_text[statbuf.st_size] = 0;
3135 close(fd);
3136
3137 acl_name = string_sprintf("ACL \"%s\"", ss);
3138 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3139 }
3140 }
3141
3142/* Parse an ACL that is still in text form. If it came from a file, remember it
3143in the ACL tree, having read it into the POOL_PERM store pool so that it
3144persists between multiple messages. */
3145
3146if (acl == NULL)
3147 {
3148 int old_pool = store_pool;
3149 if (fd >= 0) store_pool = POOL_PERM;
3150 acl = acl_read(acl_getline, log_msgptr);
3151 store_pool = old_pool;
3152 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3153 if (fd >= 0)
3154 {
3155 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3156 Ustrcpy(t->name, ss);
3157 t->data.ptr = acl;
3158 (void)tree_insertnode(&acl_anchor, t);
3159 }
3160 }
3161
3162/* Now we have an ACL to use. It's possible it may be NULL. */
3163
3164while (acl != NULL)
3165 {
3166 int cond;
3167 int basic_errno = 0;
3168 BOOL endpass_seen = FALSE;
3169
3170 *log_msgptr = *user_msgptr = NULL;
3171 acl_temp_details = FALSE;
3172
3173 if (where == ACL_WHERE_QUIT &&
3174 acl->verb != ACL_ACCEPT &&
3175 acl->verb != ACL_WARN)
3176 {
3177 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT ACL",
3178 verbs[acl->verb]);
3179 return ERROR;
3180 }
3181
3182 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3183
3184 /* Clear out any search error message from a previous check before testing
3185 this condition. */
3186
3187 search_error_message = NULL;
3188 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3189 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3190
3191 /* Handle special returns: DEFER causes a return except on a WARN verb;
3192 ERROR always causes a return. */
3193
3194 switch (cond)
3195 {
3196 case DEFER:
3197 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
3198 if (basic_errno != ERRNO_CALLOUTDEFER)
3199 {
3200 if (search_error_message != NULL && *search_error_message != 0)
3201 *log_msgptr = search_error_message;
3202 if (smtp_return_error_details) acl_temp_details = TRUE;
3203 }
3204 else
3205 {
3206 acl_temp_details = TRUE;
3207 }
3208 if (acl->verb != ACL_WARN) return DEFER;
3209 break;
3210
3211 default: /* Paranoia */
3212 case ERROR:
3213 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
3214 return ERROR;
3215
3216 case OK:
3217 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
3218 verbs[acl->verb]);
3219 break;
3220
3221 case FAIL:
3222 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
3223 break;
3224
3225 /* DISCARD and DROP can happen only from a nested ACL condition, and
3226 DISCARD can happen only for an "accept" or "discard" verb. */
3227
3228 case DISCARD:
3229 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
3230 verbs[acl->verb]);
3231 break;
3232
3233 case FAIL_DROP:
3234 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
3235 verbs[acl->verb]);
3236 break;
3237 }
3238
3239 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3240 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3241 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3242
3243 switch(acl->verb)
3244 {
3245 case ACL_ACCEPT:
3246 if (cond == OK || cond == DISCARD) return cond;
3247 if (endpass_seen)
3248 {
3249 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3250 return cond;
3251 }
3252 break;
3253
3254 case ACL_DEFER:
3255 if (cond == OK)
3256 {
3257 acl_temp_details = TRUE;
3258 return DEFER;
3259 }
3260 break;
3261
3262 case ACL_DENY:
3263 if (cond == OK) return FAIL;
3264 break;
3265
3266 case ACL_DISCARD:
3267 if (cond == OK || cond == DISCARD) return DISCARD;
3268 if (endpass_seen)
3269 {
3270 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
3271 return cond;
3272 }
3273 break;
3274
3275 case ACL_DROP:
3276 if (cond == OK) return FAIL_DROP;
3277 break;
3278
3279 case ACL_REQUIRE:
3280 if (cond != OK) return cond;
3281 break;
3282
3283 case ACL_WARN:
3284 if (cond == OK)
3285 acl_warn(where, *user_msgptr, *log_msgptr);
3286 else if (cond == DEFER)
9c7a242c
PH
3287 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
3288 "condition test deferred%s%s", host_and_ident(TRUE),
3289 (*log_msgptr == NULL)? US"" : US": ",
3290 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH
3291 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
3292 break;
3293
3294 default:
3295 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
3296 acl->verb);
3297 break;
3298 }
3299
3300 /* Pass to the next ACL item */
3301
3302 acl = acl->next;
3303 }
3304
3305/* We have reached the end of the ACL. This is an implicit DENY. */
3306
3307HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
3308return FAIL;
3309}
3310
3311
3312/*************************************************
3313* Check access using an ACL *
3314*************************************************/
3315
3316/* This is the external interface for ACL checks. It sets up an address and the
3317expansions for $domain and $local_part when called after RCPT, then calls
3318acl_check_internal() to do the actual work.
3319
3320Arguments:
3321 where ACL_WHERE_xxxx indicating where called from
3322 data_string RCPT address, or SMTP command argument, or NULL
3323 s the input string; NULL is the same as an empty ACL => DENY
3324 user_msgptr where to put a user error (for SMTP response)
3325 log_msgptr where to put a logging message (not for SMTP response)
3326
3327Returns: OK access is granted by an ACCEPT verb
3328 DISCARD access is granted by a DISCARD verb
3329 FAIL access is denied
3330 FAIL_DROP access is denied; drop the connection
3331 DEFER can't tell at the moment
3332 ERROR disaster
3333*/
3334
3335int
3336acl_check(int where, uschar *data_string, uschar *s, uschar **user_msgptr,
3337 uschar **log_msgptr)
3338{
3339int rc;
3340address_item adb;
3341address_item *addr;
3342
3343*user_msgptr = *log_msgptr = NULL;
3344sender_verified_failed = NULL;
fe0dab11 3345ratelimiters_cmd = NULL;
059ec3d9
PH
3346
3347if (where == ACL_WHERE_RCPT)
3348 {
3349 adb = address_defaults;
3350 addr = &adb;
3351 addr->address = data_string;
3352 if (deliver_split_address(addr) == DEFER)
3353 {
3354 *log_msgptr = US"defer in percent_hack_domains check";
3355 return DEFER;
3356 }
3357 deliver_domain = addr->domain;
3358 deliver_localpart = addr->local_part;
3359 }
3360else
3361 {
3362 addr = NULL;
3363 smtp_command_argument = data_string;
3364 }
3365
3366rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
3367
3368smtp_command_argument = deliver_domain =
2a3eea10 3369 deliver_localpart = deliver_address_data = sender_address_data = NULL;
059ec3d9
PH
3370
3371/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
3372ACL, which is really in the middle of an SMTP command. */
3373
3374if (rc == DISCARD)
3375 {
3376 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
3377 {
3378 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
3379 "ACL", acl_wherenames[where]);
3380 return ERROR;
3381 }
3382 return DISCARD;
3383 }
3384
3385/* A DROP response is not permitted from MAILAUTH */
3386
3387if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
3388 {
3389 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
3390 "ACL", acl_wherenames[where]);
3391 return ERROR;
3392 }
3393
3394/* Before giving an error response, take a look at the length of any user
3395message, and split it up into multiple lines if possible. */
3396
3397if (rc != OK && *user_msgptr != NULL && Ustrlen(*user_msgptr) > 75)
3398 {
3399 uschar *s = *user_msgptr = string_copy(*user_msgptr);
3400 uschar *ss = s;
3401
3402 for (;;)
3403 {
3404 int i = 0;
3405 while (i < 75 && *ss != 0 && *ss != '\n') ss++, i++;
3406 if (*ss == 0) break;
3407 if (*ss == '\n')
3408 s = ++ss;
3409 else
3410 {
3411 uschar *t = ss + 1;
3412 uschar *tt = NULL;
3413 while (--t > s + 35)
3414 {
3415 if (*t == ' ')
3416 {
3417 if (t[-1] == ':') { tt = t; break; }
3418 if (tt == NULL) tt = t;
3419 }
3420 }
3421
3422 if (tt == NULL) /* Can't split behind - try ahead */
3423 {
3424 t = ss + 1;
3425 while (*t != 0)
3426 {
3427 if (*t == ' ' || *t == '\n')
3428 { tt = t; break; }
3429 t++;
3430 }
3431 }
3432
3433 if (tt == NULL) break; /* Can't find anywhere to split */
3434 *tt = '\n';
3435 s = ss = tt+1;
3436 }
3437 }
3438 }
3439
3440return rc;
3441}
3442
3443/* End of acl.c */