Truncate delay when peer closes connection. Bug 348
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH
24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH
31 US"warn" };
32
4e88a19f
PH
33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH
47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH
49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH
52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK
55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK
61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK
64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
8e669ac1 70#endif
80a47a2c
TK
71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
fb2274d4 74#endif
4840604e
TL
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
77#endif
71fafd95
PH
78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK
87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK
95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH
100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK
105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH
113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH
118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK
122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK
128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK
131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
137#endif
80a47a2c
TK
138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
fb2274d4 141#endif
4840604e
TL
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
144#endif
6ea85e9a
PH
145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK
154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK
162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK
167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH
179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef 183 CONTROL_AUTH_UNADVERTISED,
3c8b3577 184#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
3c8b3577 186#endif
ed7f7860 187 CONTROL_DEBUG,
3c8b3577 188#ifndef DISABLE_DKIM
f7572e5a 189 CONTROL_DKIM_VERIFY,
3c8b3577
JH
190#endif
191#ifdef EXPERIMENTAL_DMARC
4840604e
TL
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
3c8b3577 194#endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH
196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH
200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 206#ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 208#endif
c46782ef
PH
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
3c8b3577
JH
211#ifdef EXPERIMENTAL_INTERNATIONAL
212 CONTROL_UTF8_DOWNCONVERT,
213#endif
cf8b11a5 214 CONTROL_NO_MULTILINE,
047bdd8c 215 CONTROL_NO_PIPELINING,
4c590bd1
PH
216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
c46782ef 218};
9a26b6b2 219
8800895a
PH
220/* ACL control names; keep in step with the table above! This list is used for
221turning ids into names. The actual list of recognized names is in the variable
222control_def controls_list[] below. The fact that there are two lists is a mess
223and should be tidied up. */
9a26b6b2
PH
224
225static uschar *controls[] = {
c46782ef 226 US"allow_auth_unadvertised",
3c8b3577 227#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 228 US"bmi_run",
3c8b3577 229#endif
ed7f7860 230 US"debug",
3c8b3577 231#ifndef DISABLE_DKIM
80a47a2c 232 US"dkim_disable_verify",
3c8b3577
JH
233#endif
234#ifdef EXPERIMENTAL_DMARC
4840604e
TL
235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
3c8b3577 237#endif
13363eba 238 US"dscp",
c46782ef
PH
239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
e4bdf652 242 US"cutthrough_delivery",
c46782ef
PH
243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
3c8b3577 249#ifdef WITH_CONTENT_SCAN
9a26b6b2 250 US"no_mbox_unspool",
3c8b3577 251#endif
cf8b11a5
PH
252 US"fakedefer",
253 US"fakereject",
3c8b3577
JH
254#ifdef EXPERIMENTAL_INTERNATIONAL
255 US"utf8_downconvert",
256#endif
aa6dc513 257 US"no_multiline_responses",
cf8b11a5 258 US"no_pipelining",
4c590bd1
PH
259 US"no_delay_flush",
260 US"no_callout_flush"
c46782ef 261};
059ec3d9 262
047bdd8c 263/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH
264at the outer level. In the other cases, expansion already occurs in the
265checking functions. */
266
267static uschar cond_expand_at_top[] = {
7421ecab 268 FALSE, /* acl */
3e536984 269 TRUE, /* add_header */
059ec3d9 270 FALSE, /* authenticated */
8523533c
TK
271#ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
8e669ac1 273#endif
059ec3d9 274 TRUE, /* condition */
c3611384 275 TRUE, /* continue */
059ec3d9 276 TRUE, /* control */
6a8f9482
TK
277#ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279#endif
8523533c
TK
280#ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282#endif
059ec3d9 283 TRUE, /* delay */
8523533c
TK
284#ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
286#endif
80a47a2c
TK
287#ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
fb2274d4 290#endif
4840604e
TL
291#ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
293#endif
059ec3d9
PH
294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
6ea85e9a 301 TRUE, /* log_reject_target */
059ec3d9 302 TRUE, /* logwrite */
8523533c
TK
303#ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305#endif
059ec3d9 306 TRUE, /* message */
8523533c
TK
307#ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309#endif
870f6ba8 310 TRUE, /* ratelimit */
059ec3d9 311 FALSE, /* recipients */
8523533c
TK
312#ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314#endif
e7568d51 315 TRUE, /* remove_header */
059ec3d9
PH
316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
8523533c
TK
319#ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321#endif
322#ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
65a7d8c3 324 TRUE, /* spf_guess */
8523533c 325#endif
b0019c78 326 TRUE, /* udpsend */
059ec3d9
PH
327 TRUE /* verify */
328};
329
330/* Flags to identify the modifiers */
331
332static uschar cond_modifiers[] = {
333 FALSE, /* acl */
3e536984 334 TRUE, /* add_header */
059ec3d9 335 FALSE, /* authenticated */
8523533c
TK
336#ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
8e669ac1 338#endif
059ec3d9 339 FALSE, /* condition */
c3611384 340 TRUE, /* continue */
059ec3d9 341 TRUE, /* control */
6a8f9482
TK
342#ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344#endif
8523533c
TK
345#ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347#endif
059ec3d9 348 TRUE, /* delay */
8523533c
TK
349#ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
351#endif
80a47a2c
TK
352#ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
fb2274d4 355#endif
4840604e
TL
356#ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
358#endif
059ec3d9
PH
359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
6ea85e9a 366 TRUE, /* log_reject_target */
8523533c
TK
367 TRUE, /* logwrite */
368#ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370#endif
059ec3d9 371 TRUE, /* message */
8523533c
TK
372#ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374#endif
870f6ba8 375 FALSE, /* ratelimit */
059ec3d9 376 FALSE, /* recipients */
8523533c
TK
377#ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379#endif
e7568d51 380 TRUE, /* remove_header */
059ec3d9
PH
381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
8523533c
TK
384#ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386#endif
387#ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
65a7d8c3 389 FALSE, /* spf_guess */
8523533c 390#endif
b0019c78 391 TRUE, /* udpsend */
059ec3d9
PH
392 FALSE /* verify */
393};
394
c3611384 395/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH
396times. For each condition and modifier, there's a bitmap of dis-allowed times.
397For some, it is easier to specify the negation of a small number of allowed
398times. */
059ec3d9
PH
399
400static unsigned int cond_forbids[] = {
401 0, /* acl */
8e669ac1 402
71fafd95 403 (unsigned int)
45b91596 404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 406 #ifndef DISABLE_PRDR
fd98a5c6
JH
407 (1<<ACL_WHERE_PRDR)|
408 #endif
45b91596 409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 410 (1<<ACL_WHERE_DKIM)|
45b91596 411 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 412
45b91596
PH
413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 416
71fafd95 417 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 421 #ifndef DISABLE_PRDR
fd98a5c6
JH
422 (1<<ACL_WHERE_PRDR)|
423 #endif
8e669ac1 424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH
427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 429 #endif
8e669ac1 430
059ec3d9 431 0, /* condition */
8e669ac1 432
c3611384
PH
433 0, /* continue */
434
059ec3d9 435 /* Certain types of control are always allowed, so we let it through
2f079f46 436 always and check in the control processing itself. */
8e669ac1 437
059ec3d9 438 0, /* control */
8e669ac1 439
6a8f9482
TK
440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
fd98a5c6 442 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 443 #ifndef DISABLE_PRDR
fd98a5c6 444 (1<<ACL_WHERE_PRDR)|
8ccd00b1 445 #endif
fd98a5c6 446 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK
447 #endif
448
71fafd95 449 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 452 #endif
8523533c 453
8f128379 454 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 455
71fafd95 456 #ifdef WITH_OLD_DEMIME
2f079f46 457 (unsigned int)
fd98a5c6 458 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 459 #ifndef DISABLE_PRDR
fd98a5c6 460 (1<<ACL_WHERE_PRDR)|
8ccd00b1 461 #endif
fd98a5c6 462 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 463 #endif
8e669ac1 464
80a47a2c
TK
465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 468
80a47a2c
TK
469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 471 #endif
fb2274d4 472
4840604e
TL
473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
45b91596
PH
478 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
479 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 480
2f079f46 481 (unsigned int)
fd98a5c6 482 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 483 #ifndef DISABLE_PRDR
fd98a5c6
JH
484 |(1<<ACL_WHERE_PRDR)
485 #endif
486 ),
059ec3d9 487
45b91596
PH
488 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
489 (1<<ACL_WHERE_CONNECT)|
490 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 491 (1<<ACL_WHERE_HELO),
8e669ac1 492
059ec3d9 493 0, /* endpass */
8e669ac1 494
45b91596
PH
495 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
496 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 497
2f079f46 498 (unsigned int)
fd98a5c6 499 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 500 #ifndef DISABLE_PRDR
fd98a5c6
JH
501 |(1<<ACL_WHERE_PRDR)
502 #endif
503 ),
059ec3d9
PH
504
505 0, /* log_message */
8e669ac1 506
6ea85e9a
PH
507 0, /* log_reject_target */
508
059ec3d9 509 0, /* logwrite */
8e669ac1 510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46 512 (unsigned int)
fd98a5c6 513 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 514 #ifndef DISABLE_PRDR
fd98a5c6 515 (1<<ACL_WHERE_PRDR)|
8ccd00b1 516 #endif
fd98a5c6 517 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 518 #endif
8523533c 519
059ec3d9
PH
520 0, /* message */
521
71fafd95 522 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
523 (unsigned int)
524 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 525 #endif
8523533c 526
870f6ba8
TF
527 0, /* ratelimit */
528
2f079f46
PH
529 (unsigned int)
530 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 531
71fafd95 532 #ifdef WITH_CONTENT_SCAN
2f079f46 533 (unsigned int)
fd98a5c6 534 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 535 #ifndef DISABLE_PRDR
fd98a5c6 536 (1<<ACL_WHERE_PRDR)|
8ccd00b1 537 #endif
fd98a5c6 538 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 539 (1<<ACL_WHERE_MIME)),
71fafd95 540 #endif
8523533c 541
e7568d51
TL
542 (unsigned int)
543 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
544 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 545 #ifndef DISABLE_PRDR
fd98a5c6
JH
546 (1<<ACL_WHERE_PRDR)|
547 #endif
e7568d51
TL
548 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
549 (1<<ACL_WHERE_NOTSMTP_START)),
550
059ec3d9
PH
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
558 (1<<ACL_WHERE_HELO)|
559 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
560 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
561 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
562
563 0, /* set */
564
71fafd95 565 #ifdef WITH_CONTENT_SCAN
2f079f46 566 (unsigned int)
fd98a5c6 567 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 568 #ifndef DISABLE_PRDR
fd98a5c6 569 (1<<ACL_WHERE_PRDR)|
8ccd00b1 570 #endif
fd98a5c6 571 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 572 #endif
8523533c 573
71fafd95 574 #ifdef EXPERIMENTAL_SPF
8523533c
TK
575 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
576 (1<<ACL_WHERE_HELO)|
577 (1<<ACL_WHERE_MAILAUTH)|
578 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH
579 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
580 (1<<ACL_WHERE_NOTSMTP)|
581 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM
582
583 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
584 (1<<ACL_WHERE_HELO)|
585 (1<<ACL_WHERE_MAILAUTH)|
586 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
587 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
588 (1<<ACL_WHERE_NOTSMTP)|
589 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 590 #endif
8523533c 591
b0019c78
TF
592 0, /* udpsend */
593
059ec3d9
PH
594 /* Certain types of verify are always allowed, so we let it through
595 always and check in the verify function itself */
596
597 0 /* verify */
059ec3d9
PH
598};
599
600
c5fcb476
PH
601/* Bit map vector of which controls are not allowed at certain times. For
602each control, there's a bitmap of dis-allowed times. For some, it is easier to
603specify the negation of a small number of allowed times. */
604
605static unsigned int control_forbids[] = {
c46782ef
PH
606 (unsigned int)
607 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
608
3c8b3577 609#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 610 0, /* bmi_run */
3c8b3577 611#endif
c46782ef 612
ed7f7860
PP
613 0, /* debug */
614
3c8b3577 615#ifndef DISABLE_DKIM
80a47a2c 616 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 617# ifndef DISABLE_PRDR
fd98a5c6 618 (1<<ACL_WHERE_PRDR)|
3c8b3577 619# endif
f7572e5a 620 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 621#endif
f7572e5a 622
3c8b3577 623#ifdef EXPERIMENTAL_DMARC
4840604e
TL
624 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
625 (1<<ACL_WHERE_NOTSMTP_START),
626 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
627 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 628#endif
4840604e 629
13363eba
PP
630 (1<<ACL_WHERE_NOTSMTP)|
631 (1<<ACL_WHERE_NOTSMTP_START)|
632 (1<<ACL_WHERE_NOTQUIT), /* dscp */
633
c5fcb476 634 0, /* error */
8e669ac1
PH
635
636 (unsigned int)
c5fcb476 637 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
638
639 (unsigned int)
c5fcb476 640 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 641
e4bdf652
JH
642 (unsigned int)
643 0, /* cutthrough_delivery */
644
45b91596
PH
645 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
646 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 647
45b91596
PH
648 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
649 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH
650
651 (unsigned int)
c5fcb476
PH
652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
656
657 (unsigned int)
c5fcb476
PH
658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
659 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 660 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 661 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
662
663 (unsigned int)
c5fcb476 664 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 665 (1<<ACL_WHERE_PREDATA)),
8523533c 666
8800895a
PH
667 (unsigned int)
668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH
669 (1<<ACL_WHERE_PREDATA)|
670 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 671
3c8b3577 672#ifdef WITH_CONTENT_SCAN
8e669ac1 673 (unsigned int)
14d57970 674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 675 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 676 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 677 (1<<ACL_WHERE_MIME)),
3c8b3577 678#endif
a6c4ab60 679
8e669ac1 680 (unsigned int)
29aba418
TF
681 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
682 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 683#ifndef DISABLE_PRDR
fd98a5c6 684 (1<<ACL_WHERE_PRDR)|
3c8b3577 685#endif
29aba418
TF
686 (1<<ACL_WHERE_MIME)),
687
688 (unsigned int)
a6c4ab60 689 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 690 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 691#ifndef DISABLE_PRDR
fd98a5c6 692 (1<<ACL_WHERE_PRDR)|
3c8b3577 693#endif
e715ad22 694 (1<<ACL_WHERE_MIME)),
8523533c 695
3c8b3577
JH
696#ifdef EXPERIMENTAL_INTERNATIONAL
697 0, /* utf8_downconvert */
698#endif
699
45b91596 700 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH
701 (1<<ACL_WHERE_NOTSMTP_START),
702
703 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH
704 (1<<ACL_WHERE_NOTSMTP_START),
705
706 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH
707 (1<<ACL_WHERE_NOTSMTP_START),
708
709 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 710 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH
711};
712
713/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
714
715typedef struct control_def {
716 uschar *name;
717 int value; /* CONTROL_xxx value */
059ec3d9
PH
718 BOOL has_option; /* Has /option(s) following */
719} control_def;
720
721static control_def controls_list[] = {
3c8b3577 722 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 723#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 724 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
8523533c 725#endif
3c8b3577 726 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 727#ifndef DISABLE_DKIM
3c8b3577 728 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
f7572e5a 729#endif
4840604e 730#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH
731 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
732 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
4840604e 733#endif
3c8b3577
JH
734 { US"dscp", CONTROL_DSCP, TRUE },
735 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
736 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
737 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
738 { US"freeze", CONTROL_FREEZE, TRUE },
739 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
740 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
741 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
742 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
743 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
744 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 745#ifdef WITH_CONTENT_SCAN
3c8b3577 746 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 747#endif
3c8b3577
JH
748 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
749 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
750 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 751 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577
JH
752 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
753#ifdef EXPERIMENTAL_INTERNATIONAL
754 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
755#endif
059ec3d9
PH
756 };
757
e5a9dba6
PH
758/* Support data structures for Client SMTP Authorization. acl_verify_csa()
759caches its result in a tree to avoid repeated DNS queries. The result is an
760integer code which is used as an index into the following tables of
761explanatory strings and verification return codes. */
762
763static tree_node *csa_cache = NULL;
764
765enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
766 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
767
768/* The acl_verify_csa() return code is translated into an acl_verify() return
769code using the following table. It is OK unless the client is definitely not
770authorized. This is because CSA is supposed to be optional for sending sites,
771so recipients should not be too strict about checking it - especially because
772DNS problems are quite likely to occur. It's possible to use $csa_status in
773further ACL conditions to distinguish ok, unknown, and defer if required, but
774the aim is to make the usual configuration simple. */
775
776static int csa_return_code[] = {
777 OK, OK, OK, OK,
778 FAIL, FAIL, FAIL, FAIL
779};
780
781static uschar *csa_status_string[] = {
782 US"unknown", US"ok", US"defer", US"defer",
783 US"fail", US"fail", US"fail", US"fail"
784};
785
786static uschar *csa_reason_string[] = {
787 US"unknown",
788 US"ok",
789 US"deferred (SRV lookup failed)",
790 US"deferred (target address lookup failed)",
791 US"failed (explicit authorization required)",
792 US"failed (host name not authorized)",
793 US"failed (no authorized addresses)",
794 US"failed (client address mismatch)"
795};
796
c99ce5c9
TF
797/* Options for the ratelimit condition. Note that there are two variants of
798the per_rcpt option, depending on the ACL that is used to measure the rate.
799However any ACL must be able to look up per_rcpt rates in /noupdate mode,
800so the two variants must have the same internal representation as well as
801the same configuration string. */
802
803enum {
804 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
805 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
806};
807
808#define RATE_SET(var,new) \
809 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
810
811static uschar *ratelimit_option_string[] = {
812 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
813 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
814};
815
059ec3d9
PH
816/* Enable recursion between acl_check_internal() and acl_check_condition() */
817
55414b25 818static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 819 uschar **);
059ec3d9
PH
820
821
822/*************************************************
823* Pick out name from list *
824*************************************************/
825
826/* Use a binary chop method
827
828Arguments:
829 name name to find
830 list list of names
831 end size of list
832
833Returns: offset in list, or -1 if not found
834*/
835
836static int
837acl_checkname(uschar *name, uschar **list, int end)
838{
839int start = 0;
840
841while (start < end)
842 {
843 int mid = (start + end)/2;
844 int c = Ustrcmp(name, list[mid]);
845 if (c == 0) return mid;
846 if (c < 0) end = mid; else start = mid + 1;
847 }
848
849return -1;
850}
851
852
853/*************************************************
854* Read and parse one ACL *
855*************************************************/
856
857/* This function is called both from readconf in order to parse the ACLs in the
858configuration file, and also when an ACL is encountered dynamically (e.g. as
859the result of an expansion). It is given a function to call in order to
860retrieve the lines of the ACL. This function handles skipping comments and
861blank lines (where relevant).
862
863Arguments:
864 func function to get next line of ACL
865 error where to put an error message
866
867Returns: pointer to ACL, or NULL
868 NULL can be legal (empty ACL); in this case error will be NULL
869*/
870
871acl_block *
872acl_read(uschar *(*func)(void), uschar **error)
873{
874acl_block *yield = NULL;
875acl_block **lastp = &yield;
876acl_block *this = NULL;
877acl_condition_block *cond;
878acl_condition_block **condp = NULL;
879uschar *s;
880
881*error = NULL;
882
883while ((s = (*func)()) != NULL)
884 {
885 int v, c;
886 BOOL negated = FALSE;
887 uschar *saveline = s;
888 uschar name[64];
889
890 /* Conditions (but not verbs) are allowed to be negated by an initial
891 exclamation mark. */
892
893 while (isspace(*s)) s++;
894 if (*s == '!')
895 {
896 negated = TRUE;
897 s++;
898 }
899
cf00dad6
PH
900 /* Read the name of a verb or a condition, or the start of a new ACL, which
901 can be started by a name, or by a macro definition. */
059ec3d9
PH
902
903 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 904 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
905
906 /* If a verb is unrecognized, it may be another condition or modifier that
907 continues the previous verb. */
908
909 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
910 if (v < 0)
911 {
912 if (this == NULL)
913 {
4e167a8c
PH
914 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
915 saveline);
059ec3d9
PH
916 return NULL;
917 }
918 }
919
920 /* New verb */
921
922 else
923 {
924 if (negated)
925 {
926 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
927 return NULL;
928 }
929 this = store_get(sizeof(acl_block));
930 *lastp = this;
931 lastp = &(this->next);
932 this->next = NULL;
933 this->verb = v;
934 this->condition = NULL;
935 condp = &(this->condition);
936 if (*s == 0) continue; /* No condition on this line */
937 if (*s == '!')
938 {
939 negated = TRUE;
940 s++;
941 }
942 s = readconf_readname(name, sizeof(name), s); /* Condition name */
943 }
944
945 /* Handle a condition or modifier. */
946
947 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
948 if (c < 0)
949 {
950 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
951 saveline);
952 return NULL;
953 }
954
955 /* The modifiers may not be negated */
956
957 if (negated && cond_modifiers[c])
958 {
959 *error = string_sprintf("ACL error: negation is not allowed with "
960 "\"%s\"", conditions[c]);
961 return NULL;
962 }
963
964 /* ENDPASS may occur only with ACCEPT or DISCARD. */
965
966 if (c == ACLC_ENDPASS &&
967 this->verb != ACL_ACCEPT &&
968 this->verb != ACL_DISCARD)
969 {
970 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
971 conditions[c], verbs[this->verb]);
972 return NULL;
973 }
974
975 cond = store_get(sizeof(acl_condition_block));
976 cond->next = NULL;
977 cond->type = c;
978 cond->u.negated = negated;
979
980 *condp = cond;
981 condp = &(cond->next);
982
983 /* The "set" modifier is different in that its argument is "name=value"
984 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
985 gives us a variable name to insert into the data block. The original ACL
986 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
987 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
988 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
989 After that, we allow alphanumerics and underscores, but the first character
990 after c or m must be a digit or an underscore. This retains backwards
991 compatibility. */
059ec3d9
PH
992
993 if (c == ACLC_SET)
994 {
47ca6d6c
PH
995 uschar *endptr;
996
38a0a95f
PH
997 if (Ustrncmp(s, "acl_c", 5) != 0 &&
998 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 999 {
38a0a95f
PH
1000 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1001 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1002 return NULL;
47ca6d6c 1003 }
38a0a95f
PH
1004
1005 endptr = s + 5;
641cb756
PH
1006 if (!isdigit(*endptr) && *endptr != '_')
1007 {
1008 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1009 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1010 s);
1011 return NULL;
1012 }
1013
38a0a95f 1014 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1015 {
38a0a95f
PH
1016 if (!isalnum(*endptr) && *endptr != '_')
1017 {
1018 *error = string_sprintf("invalid character \"%c\" in variable name "
1019 "in ACL modifier \"set %s\"", *endptr, s);
1020 return NULL;
1021 }
1022 endptr++;
47ca6d6c 1023 }
47ca6d6c 1024
38a0a95f 1025 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1026 s = endptr;
059ec3d9
PH
1027 while (isspace(*s)) s++;
1028 }
1029
1030 /* For "set", we are now positioned for the data. For the others, only
1031 "endpass" has no data */
1032
1033 if (c != ACLC_ENDPASS)
1034 {
1035 if (*s++ != '=')
1036 {
1037 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1038 cond_modifiers[c]? US"modifier" : US"condition");
1039 return NULL;
1040 }
1041 while (isspace(*s)) s++;
1042 cond->arg = string_copy(s);
1043 }
1044 }
1045
1046return yield;
1047}
1048
1049
1050
1051/*************************************************
71fafd95
PH
1052* Set up added header line(s) *
1053*************************************************/
1054
1055/* This function is called by the add_header modifier, and also from acl_warn()
1056to implement the now-deprecated way of adding header lines using "message" on a
1057"warn" verb. The argument is treated as a sequence of header lines which are
1058added to a chain, provided there isn't an identical one already there.
1059
1060Argument: string of header lines
1061Returns: nothing
1062*/
1063
1064static void
55414b25 1065setup_header(const uschar *hstring)
71fafd95 1066{
55414b25 1067const uschar *p, *q;
71fafd95
PH
1068int hlen = Ustrlen(hstring);
1069
b1b05573
JH
1070/* Ignore any leading newlines */
1071while (*hstring == '\n') hstring++, hlen--;
71fafd95 1072
b1b05573 1073/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1074if (hlen <= 0) return;
55414b25
JH
1075if (hstring[--hlen] != '\n')
1076 q = string_sprintf("%s\n", hstring);
1077else if (hstring[hlen-1] == '\n')
1078 {
1079 uschar * s = string_copy(hstring);
1080 while(s[--hlen] == '\n')
1081 s[hlen+1] = '\0';
1082 q = s;
1083 }
1084else
1085 q = hstring;
71fafd95
PH
1086
1087/* Loop for multiple header lines, taking care about continuations */
1088
55414b25 1089for (p = q; *p != 0; )
71fafd95 1090 {
55414b25
JH
1091 const uschar *s;
1092 uschar * hdr;
71fafd95
PH
1093 int newtype = htype_add_bot;
1094 header_line **hptr = &acl_added_headers;
1095
1096 /* Find next header line within the string */
1097
1098 for (;;)
1099 {
1100 q = Ustrchr(q, '\n');
1101 if (*(++q) != ' ' && *q != '\t') break;
1102 }
1103
1104 /* If the line starts with a colon, interpret the instruction for where to
1105 add it. This temporarily sets up a new type. */
1106
1107 if (*p == ':')
1108 {
1109 if (strncmpic(p, US":after_received:", 16) == 0)
1110 {
1111 newtype = htype_add_rec;
1112 p += 16;
1113 }
1114 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1115 {
1116 newtype = htype_add_rfc;
1117 p += 14;
1118 }
1119 else if (strncmpic(p, US":at_start:", 10) == 0)
1120 {
1121 newtype = htype_add_top;
1122 p += 10;
1123 }
1124 else if (strncmpic(p, US":at_end:", 8) == 0)
1125 {
1126 newtype = htype_add_bot;
1127 p += 8;
1128 }
1129 while (*p == ' ' || *p == '\t') p++;
1130 }
1131
1132 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1133 to the front of it. */
1134
1135 for (s = p; s < q - 1; s++)
1136 {
1137 if (*s == ':' || !isgraph(*s)) break;
1138 }
1139
55414b25
JH
1140 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1141 hlen = Ustrlen(hdr);
71fafd95
PH
1142
1143 /* See if this line has already been added */
1144
1145 while (*hptr != NULL)
1146 {
55414b25 1147 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH
1148 hptr = &((*hptr)->next);
1149 }
1150
1151 /* Add if not previously present */
1152
1153 if (*hptr == NULL)
1154 {
1155 header_line *h = store_get(sizeof(header_line));
55414b25 1156 h->text = hdr;
71fafd95
PH
1157 h->next = NULL;
1158 h->type = newtype;
1159 h->slen = hlen;
1160 *hptr = h;
1161 hptr = &(h->next);
1162 }
1163
1164 /* Advance for next header line within the string */
1165
1166 p = q;
1167 }
1168}
1169
1170
1171
e7568d51 1172/*************************************************
362145b5
JH
1173* List the added header lines *
1174*************************************************/
1175uschar *
1176fn_hdrs_added(void)
1177{
1178uschar * ret = NULL;
1179header_line * h = acl_added_headers;
1180uschar * s;
1181uschar * cp;
1182int size = 0;
1183int ptr = 0;
1184
1185if (!h) return NULL;
1186
1187do
1188 {
1189 s = h->text;
1190 while ((cp = Ustrchr(s, '\n')) != NULL)
1191 {
1192 if (cp[1] == '\0') break;
1193
1194 /* contains embedded newline; needs doubling */
1195 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1196 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH
1197 s = cp+1;
1198 }
1199 /* last bit of header */
1200
1201 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1202 }
6d9cfc47 1203while((h = h->next));
362145b5
JH
1204
1205ret[ptr-1] = '\0'; /* overwrite last newline */
1206return ret;
1207}
1208
1209
1210/*************************************************
e7568d51
TL
1211* Set up removed header line(s) *
1212*************************************************/
1213
1214/* This function is called by the remove_header modifier. The argument is
1215treated as a sequence of header names which are added to a colon separated
1216list, provided there isn't an identical one already there.
1217
1218Argument: string of header names
1219Returns: nothing
1220*/
1221
1222static void
55414b25 1223setup_remove_header(const uschar *hnames)
e7568d51
TL
1224{
1225if (*hnames != 0)
55414b25
JH
1226 acl_removed_headers = acl_removed_headers
1227 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1228 : string_copy(hnames);
e7568d51
TL
1229}
1230
1231
71fafd95
PH
1232
1233/*************************************************
059ec3d9
PH
1234* Handle warnings *
1235*************************************************/
1236
1237/* This function is called when a WARN verb's conditions are true. It adds to
1238the message's headers, and/or writes information to the log. In each case, this
1239only happens once (per message for headers, per connection for log).
1240
71fafd95
PH
1241** NOTE: The header adding action using the "message" setting is historic, and
1242its use is now deprecated. The new add_header modifier should be used instead.
1243
059ec3d9
PH
1244Arguments:
1245 where ACL_WHERE_xxxx indicating which ACL this is
1246 user_message message for adding to headers
1247 log_message message for logging, if different
1248
1249Returns: nothing
1250*/
1251
1252static void
1253acl_warn(int where, uschar *user_message, uschar *log_message)
1254{
059ec3d9
PH
1255if (log_message != NULL && log_message != user_message)
1256 {
1257 uschar *text;
1258 string_item *logged;
1259
1260 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1261 string_printing(log_message));
1262
1263 /* If a sender verification has failed, and the log message is "sender verify
1264 failed", add the failure message. */
1265
1266 if (sender_verified_failed != NULL &&
1267 sender_verified_failed->message != NULL &&
1268 strcmpic(log_message, US"sender verify failed") == 0)
1269 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1270
9c7a242c
PH
1271 /* Search previously logged warnings. They are kept in malloc
1272 store so they can be freed at the start of a new message. */
059ec3d9
PH
1273
1274 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1275 if (Ustrcmp(logged->text, text) == 0) break;
1276
1277 if (logged == NULL)
1278 {
1279 int length = Ustrlen(text) + 1;
1280 log_write(0, LOG_MAIN, "%s", text);
1281 logged = store_malloc(sizeof(string_item) + length);
1282 logged->text = (uschar *)logged + sizeof(string_item);
1283 memcpy(logged->text, text, length);
1284 logged->next = acl_warn_logged;
1285 acl_warn_logged = logged;
1286 }
1287 }
1288
1289/* If there's no user message, we are done. */
1290
1291if (user_message == NULL) return;
1292
1293/* If this isn't a message ACL, we can't do anything with a user message.
1294Log an error. */
1295
1296if (where > ACL_WHERE_NOTSMTP)
1297 {
1298 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1299 "found in a non-message (%s) ACL: cannot specify header lines here: "
1300 "message ignored", acl_wherenames[where]);
1301 return;
1302 }
1303
71fafd95
PH
1304/* The code for setting up header lines is now abstracted into a separate
1305function so that it can be used for the add_header modifier as well. */
059ec3d9 1306
71fafd95 1307setup_header(user_message);
059ec3d9
PH
1308}
1309
1310
1311
1312/*************************************************
1313* Verify and check reverse DNS *
1314*************************************************/
1315
1316/* Called from acl_verify() below. We look up the host name(s) of the client IP
1317address if this has not yet been done. The host_name_lookup() function checks
1318that one of these names resolves to an address list that contains the client IP
1319address, so we don't actually have to do the check here.
1320
1321Arguments:
1322 user_msgptr pointer for user message
1323 log_msgptr pointer for log message
1324
1325Returns: OK verification condition succeeded
1326 FAIL verification failed
1327 DEFER there was a problem verifying
1328*/
1329
1330static int
1331acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1332{
1333int rc;
1334
1335user_msgptr = user_msgptr; /* stop compiler warning */
1336
1337/* Previous success */
1338
1339if (sender_host_name != NULL) return OK;
1340
1341/* Previous failure */
1342
1343if (host_lookup_failed)
1344 {
1345 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1346 return FAIL;
1347 }
1348
1349/* Need to do a lookup */
1350
1351HDEBUG(D_acl)
1352 debug_printf("looking up host name to force name/address consistency check\n");
1353
1354if ((rc = host_name_lookup()) != OK)
1355 {
1356 *log_msgptr = (rc == DEFER)?
1357 US"host lookup deferred for reverse lookup check"
1358 :
1359 string_sprintf("host lookup failed for reverse lookup check%s",
1360 host_lookup_msg);
1361 return rc; /* DEFER or FAIL */
1362 }
1363
1364host_build_sender_fullhost();
1365return OK;
1366}
1367
1368
1369
1370/*************************************************
e5a9dba6
PH
1371* Check client IP address matches CSA target *
1372*************************************************/
1373
1374/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1375response for address records belonging to the CSA target hostname. The section
1376is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1377If one of the addresses matches the client's IP address, then the client is
1378authorized by CSA. If there are target IP addresses but none of them match
1379then the client is using an unauthorized IP address. If there are no target IP
1380addresses then the client cannot be using an authorized IP address. (This is
1381an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1382
1383Arguments:
1384 dnsa the DNS answer block
1385 dnss a DNS scan block for us to use
1386 reset option specifing what portion to scan, as described above
1387 target the target hostname to use for matching RR names
1388
1389Returns: CSA_OK successfully authorized
1390 CSA_FAIL_MISMATCH addresses found but none matched
1391 CSA_FAIL_NOADDR no target addresses found
1392*/
1393
1394static int
1395acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1396 uschar *target)
1397{
1398dns_record *rr;
1399dns_address *da;
1400
1401BOOL target_found = FALSE;
1402
1403for (rr = dns_next_rr(dnsa, dnss, reset);
1404 rr != NULL;
1405 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1406 {
1407 /* Check this is an address RR for the target hostname. */
1408
1409 if (rr->type != T_A
1410 #if HAVE_IPV6
1411 && rr->type != T_AAAA
e5a9dba6
PH
1412 #endif
1413 ) continue;
1414
1415 if (strcmpic(target, rr->name) != 0) continue;
1416
1417 target_found = TRUE;
1418
1419 /* Turn the target address RR into a list of textual IP addresses and scan
1420 the list. There may be more than one if it is an A6 RR. */
1421
1422 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1423 {
1424 /* If the client IP address matches the target IP address, it's good! */
1425
1426 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1427
1428 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1429 }
1430 }
1431
1432/* If we found some target addresses but none of them matched, the client is
1433using an unauthorized IP address, otherwise the target has no authorized IP
1434addresses. */
1435
1436if (target_found) return CSA_FAIL_MISMATCH;
1437else return CSA_FAIL_NOADDR;
1438}
1439
1440
1441
1442/*************************************************
1443* Verify Client SMTP Authorization *
1444*************************************************/
1445
1446/* Called from acl_verify() below. This routine calls dns_lookup_special()
1447to find the CSA SRV record corresponding to the domain argument, or
1448$sender_helo_name if no argument is provided. It then checks that the
1449client is authorized, and that its IP address corresponds to the SRV
1450target's address by calling acl_verify_csa_address() above. The address
1451should have been returned in the DNS response's ADDITIONAL section, but if
1452not we perform another DNS lookup to get it.
1453
1454Arguments:
1455 domain pointer to optional parameter following verify = csa
1456
1457Returns: CSA_UNKNOWN no valid CSA record found
1458 CSA_OK successfully authorized
1459 CSA_FAIL_* client is definitely not authorized
1460 CSA_DEFER_* there was a DNS problem
1461*/
1462
1463static int
55414b25 1464acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1465{
1466tree_node *t;
55414b25
JH
1467const uschar *found;
1468uschar *p;
e5a9dba6
PH
1469int priority, weight, port;
1470dns_answer dnsa;
1471dns_scan dnss;
1472dns_record *rr;
1473int rc, type;
1474uschar target[256];
1475
1476/* Work out the domain we are using for the CSA lookup. The default is the
1477client's HELO domain. If the client has not said HELO, use its IP address
1478instead. If it's a local client (exim -bs), CSA isn't applicable. */
1479
1480while (isspace(*domain) && *domain != '\0') ++domain;
1481if (*domain == '\0') domain = sender_helo_name;
1482if (domain == NULL) domain = sender_host_address;
1483if (sender_host_address == NULL) return CSA_UNKNOWN;
1484
1485/* If we have an address literal, strip off the framing ready for turning it
1486into a domain. The framing consists of matched square brackets possibly
1487containing a keyword and a colon before the actual IP address. */
1488
1489if (domain[0] == '[')
1490 {
55414b25 1491 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1492 if (start == NULL) start = domain;
1493 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1494 }
1495
1496/* Turn domains that look like bare IP addresses into domains in the reverse
1497DNS. This code also deals with address literals and $sender_host_address. It's
1498not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1499address literals, but it's probably the most friendly thing to do. This is an
1500extension to CSA, so we allow it to be turned off for proper conformance. */
1501
7e66e54d 1502if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1503 {
1504 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1505 dns_build_reverse(domain, target);
1506 domain = target;
1507 }
1508
1509/* Find out if we've already done the CSA check for this domain. If we have,
1510return the same result again. Otherwise build a new cached result structure
1511for this domain. The name is filled in now, and the value is filled in when
1512we return from this function. */
1513
1514t = tree_search(csa_cache, domain);
1515if (t != NULL) return t->data.val;
1516
1517t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1518Ustrcpy(t->name, domain);
1519(void)tree_insertnode(&csa_cache, t);
1520
1521/* Now we are ready to do the actual DNS lookup(s). */
1522
28e6ef29 1523found = domain;
e5a9dba6
PH
1524switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1525 {
1526 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1527
1528 default:
1529 return t->data.val = CSA_DEFER_SRV;
1530
1531 /* If we found nothing, the client's authorization is unknown. */
1532
1533 case DNS_NOMATCH:
1534 case DNS_NODATA:
1535 return t->data.val = CSA_UNKNOWN;
1536
1537 /* We got something! Go on to look at the reply in more detail. */
1538
1539 case DNS_SUCCEED:
1540 break;
1541 }
1542
1543/* Scan the reply for well-formed CSA SRV records. */
1544
1545for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1546 rr != NULL;
1547 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1548 {
1549 if (rr->type != T_SRV) continue;
1550
1551 /* Extract the numerical SRV fields (p is incremented) */
1552
1553 p = rr->data;
1554 GETSHORT(priority, p);
1555 GETSHORT(weight, p);
1556 GETSHORT(port, p);
1557
1558 DEBUG(D_acl)
1559 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1560
1561 /* Check the CSA version number */
1562
1563 if (priority != 1) continue;
1564
1565 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1566 found by dns_special_lookup() is a parent of the one we asked for), we check
1567 the subdomain assertions in the port field. At the moment there's only one
1568 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1569 SRV records of their own. */
1570
1dc92d5a 1571 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH
1572 {
1573 if (port & 1)
1574 return t->data.val = CSA_FAIL_EXPLICIT;
1575 else
1576 return t->data.val = CSA_UNKNOWN;
1577 }
1578
1579 /* This CSA SRV record refers directly to our domain, so we check the value
1580 in the weight field to work out the domain's authorization. 0 and 1 are
1581 unauthorized; 3 means the client is authorized but we can't check the IP
1582 address in order to authenticate it, so we treat it as unknown; values
1583 greater than 3 are undefined. */
1584
1585 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1586
1587 if (weight > 2) continue;
1588
1589 /* Weight == 2, which means the domain is authorized. We must check that the
1590 client's IP address is listed as one of the SRV target addresses. Save the
1591 target hostname then break to scan the additional data for its addresses. */
1592
1593 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1594 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1595
1596 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1597
1598 break;
1599 }
1600
1601/* If we didn't break the loop then no appropriate records were found. */
1602
1603if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1604
1605/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1606A target of "." indicates there are no valid addresses, so the client cannot
1607be authorized. (This is an odd configuration because weight=2 target=. is
1608equivalent to weight=1, but we check for it in order to keep load off the
1609root name servers.) Note that dn_expand() turns "." into "". */
1610
1611if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1612
1613/* Scan the additional section of the CSA SRV reply for addresses belonging
1614to the target. If the name server didn't return any additional data (e.g.
1615because it does not fully support SRV records), we need to do another lookup
1616to obtain the target addresses; otherwise we have a definitive result. */
1617
1618rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1619if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1620
1621/* The DNS lookup type corresponds to the IP version used by the client. */
1622
1623#if HAVE_IPV6
1624if (Ustrchr(sender_host_address, ':') != NULL)
1625 type = T_AAAA;
1626else
1627#endif /* HAVE_IPV6 */
1628 type = T_A;
1629
1630
4e0983dc 1631lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1632switch (dns_lookup(&dnsa, target, type, NULL))
1633 {
1634 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1635
1636 default:
cc00f4af 1637 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1638
1639 /* If the query succeeded, scan the addresses and return the result. */
1640
1641 case DNS_SUCCEED:
cc00f4af
JH
1642 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1643 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1644 /* else fall through */
e5a9dba6
PH
1645
1646 /* If the target has no IP addresses, the client cannot have an authorized
1647 IP address. However, if the target site uses A6 records (not AAAA records)
1648 we have to do yet another lookup in order to check them. */
1649
1650 case DNS_NOMATCH:
1651 case DNS_NODATA:
cc00f4af 1652 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1653 }
1654}
1655
1656
1657
1658/*************************************************
059ec3d9
PH
1659* Handle verification (address & other) *
1660*************************************************/
1661
89583014 1662enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM
1663 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1664 VERIFY_HDR_NAMES_ASCII
89583014
JH
1665 };
1666typedef struct {
1667 uschar * name;
1668 int value;
1669 unsigned where_allowed; /* bitmap */
1670 BOOL no_options; /* Never has /option(s) following */
1671 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1672 } verify_type_t;
1673static verify_type_t verify_type_list[] = {
7e8360e6 1674 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH
1675 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1676 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1677 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1678 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1679 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1680 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1681 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1682 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1683 FALSE, 6 },
770747fd
MFM
1684 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1685 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH
1686 };
1687
1688
1689enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1690 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1691 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1692 CALLOUT_TIME
1693 };
1694typedef struct {
1695 uschar * name;
1696 int value;
1697 int flag;
1698 BOOL has_option; /* Has =option(s) following */
1699 BOOL timeval; /* Has a time value */
1700 } callout_opt_t;
1701static callout_opt_t callout_opt_list[] = {
1702 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1703 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1704 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1705 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1706 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1707 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1708 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1709 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1710 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1711 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1712 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1713 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1714 };
1715
1716
1717
059ec3d9
PH
1718/* This function implements the "verify" condition. It is called when
1719encountered in any ACL, because some tests are almost always permitted. Some
1720just don't make sense, and always fail (for example, an attempt to test a host
1721lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1722
1723Arguments:
1724 where where called from
1725 addr the recipient address that the ACL is handling, or NULL
1726 arg the argument of "verify"
1727 user_msgptr pointer for user message
1728 log_msgptr pointer for log message
1729 basic_errno where to put verify errno
1730
1731Returns: OK verification condition succeeded
1732 FAIL verification failed
1733 DEFER there was a problem verifying
1734 ERROR syntax error
1735*/
1736
1737static int
55414b25 1738acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1739 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1740{
1741int sep = '/';
1742int callout = -1;
1743int callout_overall = -1;
4deaf07d 1744int callout_connect = -1;
059ec3d9
PH
1745int verify_options = 0;
1746int rc;
1747BOOL verify_header_sender = FALSE;
1748BOOL defer_ok = FALSE;
1749BOOL callout_defer_ok = FALSE;
1750BOOL no_details = FALSE;
eafd343b 1751BOOL success_on_redirect = FALSE;
059ec3d9
PH
1752address_item *sender_vaddr = NULL;
1753uschar *verify_sender_address = NULL;
1754uschar *pm_mailfrom = NULL;
1755uschar *se_mailfrom = NULL;
596875b3
PH
1756
1757/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1758an error if options are given for items that don't expect them.
596875b3
PH
1759*/
1760
1761uschar *slash = Ustrchr(arg, '/');
55414b25 1762const uschar *list = arg;
059ec3d9 1763uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1764verify_type_t * vp;
059ec3d9
PH
1765
1766if (ss == NULL) goto BAD_VERIFY;
1767
1768/* Handle name/address consistency verification in a separate function. */
1769
89583014
JH
1770for (vp= verify_type_list;
1771 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1772 vp++
1773 )
1774 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1775 : strcmpic (ss, vp->name) == 0)
1776 break;
1777if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1778 goto BAD_VERIFY;
1779
1780if (vp->no_options && slash != NULL)
059ec3d9 1781 {
89583014
JH
1782 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1783 "(this verify item has no options)", arg);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786if (!(vp->where_allowed & (1<<where)))
059ec3d9 1787 {
89583014
JH
1788 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1789 return ERROR;
059ec3d9 1790 }
89583014 1791switch(vp->value)
596875b3 1792 {
89583014
JH
1793 case VERIFY_REV_HOST_LKUP:
1794 if (sender_host_address == NULL) return OK;
7e8360e6
JH
1795 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1796 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1797 if (strcmpic(ss, US"defer_ok") == 0)
1798 return OK;
1799 return rc;
059ec3d9 1800
89583014
JH
1801 case VERIFY_CERT:
1802 /* TLS certificate verification is done at STARTTLS time; here we just
1803 test whether it was successful or not. (This is for optional verification; for
1804 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1805
817d9f57 1806 if (tls_in.certificate_verified) return OK;
89583014
JH
1807 *user_msgptr = US"no verified certificate";
1808 return FAIL;
e5a9dba6 1809
89583014
JH
1810 case VERIFY_HELO:
1811 /* We can test the result of optional HELO verification that might have
1812 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1813
89583014
JH
1814 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1815 return helo_verified? OK : FAIL;
059ec3d9 1816
89583014
JH
1817 case VERIFY_CSA:
1818 /* Do Client SMTP Authorization checks in a separate function, and turn the
1819 result code into user-friendly strings. */
1c41c9cc 1820
89583014
JH
1821 rc = acl_verify_csa(list);
1822 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1823 csa_reason_string[rc]);
1824 csa_status = csa_status_string[rc];
1825 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1826 return csa_return_code[rc];
1827
1828 case VERIFY_HDR_SYNTAX:
1829 /* Check that all relevant header lines have the correct syntax. If there is
1830 a syntax error, we return details of the error to the sender if configured to
1831 send out full details. (But a "message" setting on the ACL can override, as
1832 always). */
1833
1834 rc = verify_check_headers(log_msgptr);
1835 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1836 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1837 return rc;
059ec3d9 1838
770747fd
MFM
1839 case VERIFY_HDR_NAMES_ASCII:
1840 /* Check that all header names are true 7 bit strings
1841 See RFC 5322, 2.2. and RFC 6532, 3. */
1842
1843 rc = verify_check_header_names_ascii(log_msgptr);
1844 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1845 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1846 return rc;
1847
89583014
JH
1848 case VERIFY_NOT_BLIND:
1849 /* Check that no recipient of this message is "blind", that is, every envelope
1850 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1851
89583014
JH
1852 rc = verify_check_notblind();
1853 if (rc != OK)
1854 {
1855 *log_msgptr = string_sprintf("bcc recipient detected");
1856 if (smtp_return_error_details)
1857 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1858 }
1859 return rc;
059ec3d9 1860
89583014
JH
1861 /* The remaining verification tests check recipient and sender addresses,
1862 either from the envelope or from the header. There are a number of
1863 slash-separated options that are common to all of them. */
059ec3d9 1864
89583014
JH
1865 case VERIFY_HDR_SNDR:
1866 verify_header_sender = TRUE;
1867 break;
059ec3d9 1868
89583014
JH
1869 case VERIFY_SNDR:
1870 /* In the case of a sender, this can optionally be followed by an address to use
1871 in place of the actual sender (rare special-case requirement). */
059ec3d9 1872 {
89583014
JH
1873 uschar *s = ss + 6;
1874 if (*s == 0)
1875 verify_sender_address = sender_address;
1876 else
1877 {
1878 while (isspace(*s)) s++;
1879 if (*s++ != '=') goto BAD_VERIFY;
1880 while (isspace(*s)) s++;
1881 verify_sender_address = string_copy(s);
1882 }
059ec3d9 1883 }
89583014
JH
1884 break;
1885
1886 case VERIFY_RCPT:
1887 break;
059ec3d9
PH
1888 }
1889
89583014
JH
1890
1891
596875b3
PH
1892/* Remaining items are optional; they apply to sender and recipient
1893verification, including "header sender" verification. */
059ec3d9
PH
1894
1895while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1896 != NULL)
1897 {
1898 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1899 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1900 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1901
1902 /* These two old options are left for backwards compatibility */
1903
1904 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1905 {
1906 callout_defer_ok = TRUE;
1907 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1908 }
1909
1910 else if (strcmpic(ss, US"check_postmaster") == 0)
1911 {
1912 pm_mailfrom = US"";
1913 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1914 }
1915
1916 /* The callout option has a number of sub-options, comma separated */
1917
1918 else if (strncmpic(ss, US"callout", 7) == 0)
1919 {
1920 callout = CALLOUT_TIMEOUT_DEFAULT;
1921 ss += 7;
1922 if (*ss != 0)
1923 {
1924 while (isspace(*ss)) ss++;
1925 if (*ss++ == '=')
1926 {
55414b25 1927 const uschar * sublist = ss;
059ec3d9
PH
1928 int optsep = ',';
1929 uschar *opt;
1930 uschar buffer[256];
55414b25 1931 while (isspace(*sublist)) sublist++;
8e669ac1 1932
55414b25 1933 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH
1934 != NULL)
1935 {
89583014 1936 callout_opt_t * op;
438257ba 1937 double period = 1.0F;
059ec3d9 1938
89583014 1939 for (op= callout_opt_list; op->name; op++)
438257ba 1940 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1941 break;
059ec3d9 1942
89583014
JH
1943 verify_options |= op->flag;
1944 if (op->has_option)
1945 {
438257ba 1946 opt += Ustrlen(op->name);
4deaf07d
PH
1947 while (isspace(*opt)) opt++;
1948 if (*opt++ != '=')
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after "
89583014 1951 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1952 return ERROR;
1953 }
1954 while (isspace(*opt)) opt++;
89583014
JH
1955 }
1956 if (op->timeval)
1957 {
1958 period = readconf_readtime(opt, 0, FALSE);
1959 if (period < 0)
4deaf07d
PH
1960 {
1961 *log_msgptr = string_sprintf("bad time value in ACL condition "
1962 "\"verify %s\"", arg);
1963 return ERROR;
1964 }
89583014
JH
1965 }
1966
1967 switch(op->value)
1968 {
1969 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1970 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1971 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1972 case CALLOUT_MAILFROM:
1973 if (!verify_header_sender)
1974 {
1975 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1976 "callout option only for verify=header_sender (detected in ACL "
1977 "condition \"%s\")", arg);
1978 return ERROR;
1979 }
1980 se_mailfrom = string_copy(opt);
1981 break;
1982 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1983 case CALLOUT_MAXWAIT: callout_overall = period; break;
1984 case CALLOUT_CONNECT: callout_connect = period; break;
1985 case CALLOUT_TIME: callout = period; break;
1986 }
059ec3d9
PH
1987 }
1988 }
1989 else
1990 {
1991 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1992 "ACL condition \"%s\"", arg);
1993 return ERROR;
1994 }
1995 }
1996 }
1997
1998 /* Option not recognized */
1999
2000 else
2001 {
2002 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2003 "condition \"verify %s\"", ss, arg);
2004 return ERROR;
2005 }
2006 }
2007
2008if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2009 (vopt_callout_recipsender|vopt_callout_recippmaster))
2010 {
2011 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2012 "for a recipient callout";
2013 return ERROR;
2014 }
2015
2016/* Handle sender-in-header verification. Default the user message to the log
2017message if giving out verification details. */
2018
2019if (verify_header_sender)
2020 {
8e669ac1 2021 int verrno;
059ec3d9 2022 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
2023 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2024 &verrno);
2025 if (rc != OK)
8e669ac1 2026 {
fe5b5d0b
PH
2027 *basic_errno = verrno;
2028 if (smtp_return_error_details)
2029 {
2030 if (*user_msgptr == NULL && *log_msgptr != NULL)
2031 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2032 if (rc == DEFER) acl_temp_details = TRUE;
2033 }
8e669ac1 2034 }
059ec3d9
PH
2035 }
2036
2037/* Handle a sender address. The default is to verify *the* sender address, but
2038optionally a different address can be given, for special requirements. If the
2039address is empty, we are dealing with a bounce message that has no sender, so
2040we cannot do any checking. If the real sender address gets rewritten during
2041verification (e.g. DNS widening), set the flag to stop it being rewritten again
2042during message reception.
2043
2044A list of verified "sender" addresses is kept to try to avoid doing to much
2045work repetitively when there are multiple recipients in a message and they all
2046require sender verification. However, when callouts are involved, it gets too
2047complicated because different recipients may require different callout options.
2048Therefore, we always do a full sender verify when any kind of callout is
2049specified. Caching elsewhere, for instance in the DNS resolver and in the
2050callout handling, should ensure that this is not terribly inefficient. */
2051
2052else if (verify_sender_address != NULL)
2053 {
2054 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2055 != 0)
2056 {
2057 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2058 "sender verify callout";
2059 return ERROR;
2060 }
2061
2062 sender_vaddr = verify_checked_sender(verify_sender_address);
2063 if (sender_vaddr != NULL && /* Previously checked */
2064 callout <= 0) /* No callout needed this time */
2065 {
2066 /* If the "routed" flag is set, it means that routing worked before, so
2067 this check can give OK (the saved return code value, if set, belongs to a
2068 callout that was done previously). If the "routed" flag is not set, routing
2069 must have failed, so we use the saved return code. */
2070
2071 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2072 {
2073 rc = sender_vaddr->special_action;
2074 *basic_errno = sender_vaddr->basic_errno;
2075 }
2076 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2077 }
2078
2079 /* Do a new verification, and cache the result. The cache is used to avoid
2080 verifying the sender multiple times for multiple RCPTs when callouts are not
2081 specified (see comments above).
2082
2083 The cache is also used on failure to give details in response to the first
2084 RCPT that gets bounced for this reason. However, this can be suppressed by
2085 the no_details option, which sets the flag that says "this detail has already
2086 been sent". The cache normally contains just one address, but there may be
2087 more in esoteric circumstances. */
2088
2089 else
2090 {
2091 BOOL routed = TRUE;
2a3eea10 2092 uschar *save_address_data = deliver_address_data;
8e669ac1 2093
059ec3d9 2094 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
f358d5e0 2095#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH
2096 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2097 {
2098 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2099 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2100 }
f358d5e0 2101#endif
059ec3d9
PH
2102 if (no_details) setflag(sender_vaddr, af_sverify_told);
2103 if (verify_sender_address[0] != 0)
2104 {
2105 /* If this is the real sender address, save the unrewritten version
2106 for use later in receive. Otherwise, set a flag so that rewriting the
2107 sender in verify_address() does not update sender_address. */
2108
2109 if (verify_sender_address == sender_address)
2110 sender_address_unrewritten = sender_address;
2111 else
2112 verify_options |= vopt_fake_sender;
2113
eafd343b
TK
2114 if (success_on_redirect)
2115 verify_options |= vopt_success_on_redirect;
2116
059ec3d9
PH
2117 /* The recipient, qualify, and expn options are never set in
2118 verify_options. */
2119
2120 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2121 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
2122
2123 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2124
2125 if (rc == OK)
2126 {
2127 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2128 {
2129 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2130 verify_sender_address, sender_vaddr->address);
2131 }
2132 else
2133 {
2134 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2135 verify_sender_address);
2136 }
2137 }
2138 else *basic_errno = sender_vaddr->basic_errno;
2139 }
2140 else rc = OK; /* Null sender */
2141
2142 /* Cache the result code */
2143
2144 if (routed) setflag(sender_vaddr, af_verify_routed);
2145 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2146 sender_vaddr->special_action = rc;
2147 sender_vaddr->next = sender_verified_list;
2148 sender_verified_list = sender_vaddr;
8e669ac1
PH
2149
2150 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2151 the sender verification. */
8e669ac1 2152
2a3eea10 2153 deliver_address_data = save_address_data;
059ec3d9 2154 }
8e669ac1 2155
2a3eea10
PH
2156 /* Put the sender address_data value into $sender_address_data */
2157
d43cbe25 2158 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2159 }
2160
2161/* A recipient address just gets a straightforward verify; again we must handle
2162the DEFER overrides. */
2163
2164else
2165 {
2166 address_item addr2;
2167
eafd343b
TK
2168 if (success_on_redirect)
2169 verify_options |= vopt_success_on_redirect;
2170
059ec3d9
PH
2171 /* We must use a copy of the address for verification, because it might
2172 get rewritten. */
2173
2174 addr2 = *addr;
2175 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2176 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2177 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2178
42855d71 2179 *basic_errno = addr2.basic_errno;
059ec3d9 2180 *log_msgptr = addr2.message;
8e669ac1 2181 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2182 addr2.user_message : addr2.message;
42855d71
PH
2183
2184 /* Allow details for temporary error if the address is so flagged. */
2185 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
2186
2187 /* Make $address_data visible */
d43cbe25 2188 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2189 }
2190
2191/* We have a result from the relevant test. Handle defer overrides first. */
2192
2193if (rc == DEFER && (defer_ok ||
2194 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2195 {
2196 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2197 defer_ok? "defer_ok" : "callout_defer_ok");
2198 rc = OK;
2199 }
2200
2201/* If we've failed a sender, set up a recipient message, and point
2202sender_verified_failed to the address item that actually failed. */
2203
2204if (rc != OK && verify_sender_address != NULL)
2205 {
2206 if (rc != DEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2208 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2209 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2210 else
2211 {
2212 *log_msgptr = US"Could not complete sender verify callout";
2213 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2214 *log_msgptr;
2215 }
2216
2217 sender_verified_failed = sender_vaddr;
2218 }
2219
2220/* Verifying an address messes up the values of $domain and $local_part,
2221so reset them before returning if this is a RCPT ACL. */
2222
2223if (addr != NULL)
2224 {
2225 deliver_domain = addr->domain;
2226 deliver_localpart = addr->local_part;
2227 }
2228return rc;
2229
2230/* Syntax errors in the verify argument come here. */
2231
2232BAD_VERIFY:
2233*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2234 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2235 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2236 "\"verify %s\"", arg);
2237return ERROR;
2238}
2239
2240
2241
2242
2243/*************************************************
2244* Check argument for control= modifier *
2245*************************************************/
2246
2247/* Called from acl_check_condition() below
2248
2249Arguments:
2250 arg the argument string for control=
2251 pptr set to point to the terminating character
2252 where which ACL we are in
2253 log_msgptr for error messages
2254
2255Returns: CONTROL_xxx value
2256*/
2257
2258static int
55414b25 2259decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH
2260{
2261int len;
2262control_def *d;
2263
2264for (d = controls_list;
2265 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2266 d++)
2267 {
2268 len = Ustrlen(d->name);
2269 if (Ustrncmp(d->name, arg, len) == 0) break;
2270 }
2271
2272if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2273 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2274 {
2275 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2276 return CONTROL_ERROR;
2277 }
2278
059ec3d9
PH
2279*pptr = arg + len;
2280return d->value;
2281}
2282
2283
2284
c99ce5c9
TF
2285
2286/*************************************************
2287* Return a ratelimit error *
2288*************************************************/
2289
2290/* Called from acl_ratelimit() below
2291
2292Arguments:
2293 log_msgptr for error messages
2294 format format string
2295 ... supplementary arguments
2296 ss ratelimit option name
2297 where ACL_WHERE_xxxx indicating which ACL this is
2298
2299Returns: ERROR
2300*/
2301
2302static int
2303ratelimit_error(uschar **log_msgptr, const char *format, ...)
2304{
2305va_list ap;
2306uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2307va_start(ap, format);
2308if (!string_vformat(buffer, sizeof(buffer), format, ap))
2309 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2310 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2311va_end(ap);
2312*log_msgptr = string_sprintf(
2313 "error in arguments to \"ratelimit\" condition: %s", buffer);
2314return ERROR;
2315}
2316
2317
2318
2319
059ec3d9 2320/*************************************************
870f6ba8
TF
2321* Handle rate limiting *
2322*************************************************/
2323
2324/* Called by acl_check_condition() below to calculate the result
2325of the ACL ratelimit condition.
2326
2327Note that the return value might be slightly unexpected: if the
2328sender's rate is above the limit then the result is OK. This is
2329similar to the dnslists condition, and is so that you can write
2330ACL clauses like: defer ratelimit = 15 / 1h
2331
2332Arguments:
2333 arg the option string for ratelimit=
90fc3069 2334 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2335 log_msgptr for error messages
2336
2337Returns: OK - Sender's rate is above limit
2338 FAIL - Sender's rate is below limit
2339 DEFER - Problem opening ratelimit database
2340 ERROR - Syntax error in options.
2341*/
2342
2343static int
55414b25 2344acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2345{
c99ce5c9 2346double limit, period, count;
8f240103
PH
2347uschar *ss;
2348uschar *key = NULL;
c99ce5c9 2349uschar *unique = NULL;
870f6ba8 2350int sep = '/';
c99ce5c9
TF
2351BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2352BOOL noupdate = FALSE, badacl = FALSE;
2353int mode = RATE_PER_WHAT;
870f6ba8
TF
2354int old_pool, rc;
2355tree_node **anchor, *t;
2356open_db dbblock, *dbm;
c99ce5c9 2357int dbdb_size;
870f6ba8 2358dbdata_ratelimit *dbd;
c99ce5c9 2359dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2360struct timeval tv;
2361
2362/* Parse the first two options and record their values in expansion
2363variables. These variables allow the configuration to have informative
2364error messages based on rate limits obtained from a table lookup. */
2365
c99ce5c9 2366/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2367size, which must be greater than or equal to zero. Zero is useful for
2368rate measurement as opposed to rate limiting. */
2369
2370sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2371if (sender_rate_limit == NULL)
288644dd 2372 {
870f6ba8 2373 limit = -1.0;
288644dd
JH
2374 ss = NULL; /* compiler quietening */
2375 }
870f6ba8
TF
2376else
2377 {
2378 limit = Ustrtod(sender_rate_limit, &ss);
2379 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2380 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2381 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2382 }
c99ce5c9
TF
2383if (limit < 0.0 || *ss != '\0')
2384 return ratelimit_error(log_msgptr,
2385 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2386
c99ce5c9 2387/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2388constant. This must be strictly greater than zero, because zero leads to
2389run-time division errors. */
2390
2391sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2392if (sender_rate_period == NULL) period = -1.0;
2393else period = readconf_readtime(sender_rate_period, 0, FALSE);
2394if (period <= 0.0)
c99ce5c9
TF
2395 return ratelimit_error(log_msgptr,
2396 "\"%s\" is not a time value", sender_rate_period);
2397
2398/* By default we are counting one of something, but the per_rcpt,
2399per_byte, and count options can change this. */
2400
2401count = 1.0;
870f6ba8 2402
c99ce5c9 2403/* Parse the other options. */
870f6ba8
TF
2404
2405while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2406 != NULL)
2407 {
2408 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2409 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2410 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2411 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2412 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2413 else if (strcmpic(ss, US"per_conn") == 0)
2414 {
2415 RATE_SET(mode, PER_CONN);
2416 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2417 badacl = TRUE;
2418 }
2419 else if (strcmpic(ss, US"per_mail") == 0)
2420 {
2421 RATE_SET(mode, PER_MAIL);
2422 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2423 }
2424 else if (strcmpic(ss, US"per_rcpt") == 0)
2425 {
2426 /* If we are running in the RCPT ACL, then we'll count the recipients
2427 one by one, but if we are running when we have accumulated the whole
2428 list then we'll add them all in one batch. */
2429 if (where == ACL_WHERE_RCPT)
2430 RATE_SET(mode, PER_RCPT);
2431 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2432 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2433 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2434 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2435 }
2436 else if (strcmpic(ss, US"per_byte") == 0)
2437 {
2438 /* If we have not yet received the message data and there was no SIZE
2439 declaration on the MAIL comand, then it's safe to just use a value of
2440 zero and let the recorded rate decay as if nothing happened. */
2441 RATE_SET(mode, PER_MAIL);
2442 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2443 else count = message_size < 0 ? 0.0 : (double)message_size;
2444 }
2445 else if (strcmpic(ss, US"per_addr") == 0)
2446 {
2447 RATE_SET(mode, PER_RCPT);
438257ba 2448 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF
2449 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2450 }
2451 else if (strncmpic(ss, US"count=", 6) == 0)
2452 {
2453 uschar *e;
2454 count = Ustrtod(ss+6, &e);
2455 if (count < 0.0 || *e != '\0')
2456 return ratelimit_error(log_msgptr,
2457 "\"%s\" is not a positive number", ss);
2458 }
2459 else if (strncmpic(ss, US"unique=", 7) == 0)
2460 unique = string_copy(ss + 7);
2461 else if (key == NULL)
2462 key = string_copy(ss);
2463 else
2464 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2465 }
2466
c99ce5c9
TF
2467/* Sanity check. When the badacl flag is set the update mode must either
2468be readonly (which is the default if it is omitted) or, for backwards
2469compatibility, a combination of noupdate and strict or leaky. */
2470
2471if (mode == RATE_PER_CLASH)
2472 return ratelimit_error(log_msgptr, "conflicting per_* options");
2473if (leaky + strict + readonly > 1)
2474 return ratelimit_error(log_msgptr, "conflicting update modes");
2475if (badacl && (leaky || strict) && !noupdate)
2476 return ratelimit_error(log_msgptr,
2477 "\"%s\" must not have /leaky or /strict option in %s ACL",
2478 ratelimit_option_string[mode], acl_wherenames[where]);
2479
2480/* Set the default values of any unset options. In readonly mode we
2481perform the rate computation without any increment so that its value
2482decays to eventually allow over-limit senders through. */
2483
2484if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2485if (badacl) readonly = TRUE;
2486if (readonly) count = 0.0;
2487if (!strict && !readonly) leaky = TRUE;
2488if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2489
8f240103
PH
2490/* Create the lookup key. If there is no explicit key, use sender_host_address.
2491If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2492omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2493are added to the key because they alter the meaning of the stored data. */
2494
2495if (key == NULL)
2496 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2497
c99ce5c9 2498key = string_sprintf("%s/%s/%s%s",
8f240103 2499 sender_rate_period,
c99ce5c9
TF
2500 ratelimit_option_string[mode],
2501 unique == NULL ? "" : "unique/",
8f240103 2502 key);
870f6ba8 2503
c99ce5c9
TF
2504HDEBUG(D_acl)
2505 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2506
8f240103
PH
2507/* See if we have already computed the rate by looking in the relevant tree.
2508For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2509pool so that they survive across resets. In readonly mode we only remember the
2510result for the rest of this command in case a later command changes it. After
2511this bit of logic the code is independent of the per_* mode. */
870f6ba8 2512
870f6ba8
TF
2513old_pool = store_pool;
2514
c99ce5c9
TF
2515if (readonly)
2516 anchor = &ratelimiters_cmd;
2517else switch(mode) {
2518case RATE_PER_CONN:
870f6ba8
TF
2519 anchor = &ratelimiters_conn;
2520 store_pool = POOL_PERM;
c99ce5c9
TF
2521 break;
2522case RATE_PER_BYTE:
2523case RATE_PER_MAIL:
2524case RATE_PER_ALLRCPTS:
870f6ba8 2525 anchor = &ratelimiters_mail;
c99ce5c9
TF
2526 break;
2527case RATE_PER_ADDR:
2528case RATE_PER_CMD:
2529case RATE_PER_RCPT:
fe0dab11 2530 anchor = &ratelimiters_cmd;
c99ce5c9
TF
2531 break;
2532default:
3399bb60 2533 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF
2534 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2535 "internal ACL error: unknown ratelimit mode %d", mode);
2536 break;
2537}
870f6ba8 2538
c99ce5c9
TF
2539t = tree_search(*anchor, key);
2540if (t != NULL)
870f6ba8
TF
2541 {
2542 dbd = t->data.ptr;
2543 /* The following few lines duplicate some of the code below. */
8f240103 2544 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2545 store_pool = old_pool;
2546 sender_rate = string_sprintf("%.1f", dbd->rate);
2547 HDEBUG(D_acl)
2548 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2549 return rc;
2550 }
2551
c99ce5c9
TF
2552/* We aren't using a pre-computed rate, so get a previously recorded rate
2553from the database, which will be updated and written back if required. */
870f6ba8
TF
2554
2555dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2556if (dbm == NULL)
2557 {
2558 store_pool = old_pool;
2559 sender_rate = NULL;
2560 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2561 *log_msgptr = US"ratelimit database not available";
2562 return DEFER;
2563 }
c99ce5c9
TF
2564dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2565dbd = NULL;
870f6ba8
TF
2566
2567gettimeofday(&tv, NULL);
2568
c99ce5c9
TF
2569if (dbdb != NULL)
2570 {
2571 /* Locate the basic ratelimit block inside the DB data. */
2572 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2573 dbd = &dbdb->dbd;
2574
2575 /* Forget the old Bloom filter if it is too old, so that we count each
2576 repeating event once per period. We don't simply clear and re-use the old
2577 filter because we want its size to change if the limit changes. Note that
2578 we keep the dbd pointer for copying the rate into the new data block. */
2579
2580 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2581 {
2582 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2583 dbdb = NULL;
2584 }
2585
2586 /* Sanity check. */
2587
2588 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2589 {
2590 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2591 dbdb = NULL;
2592 }
2593 }
2594
2595/* Allocate a new data block if the database lookup failed
2596or the Bloom filter passed its age limit. */
2597
2598if (dbdb == NULL)
2599 {
2600 if (unique == NULL)
2601 {
2602 /* No Bloom filter. This basic ratelimit block is initialized below. */
2603 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2604 dbdb_size = sizeof(*dbd);
2605 dbdb = store_get(dbdb_size);
2606 }
2607 else
2608 {
2609 int extra;
2610 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2611
2612 /* See the long comment below for an explanation of the magic number 2.
2613 The filter has a minimum size in case the rate limit is very small;
2614 this is determined by the definition of dbdata_ratelimit_unique. */
2615
2616 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2617 if (extra < 0) extra = 0;
2618 dbdb_size = sizeof(*dbdb) + extra;
2619 dbdb = store_get(dbdb_size);
2620 dbdb->bloom_epoch = tv.tv_sec;
2621 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2622 memset(dbdb->bloom, 0, dbdb->bloom_size);
2623
2624 /* Preserve any basic ratelimit data (which is our longer-term memory)
2625 by copying it from the discarded block. */
2626
2627 if (dbd != NULL)
2628 {
2629 dbdb->dbd = *dbd;
2630 dbd = &dbdb->dbd;
2631 }
2632 }
2633 }
2634
2635/* If we are counting unique events, find out if this event is new or not.
2636If the client repeats the event during the current period then it should be
2637counted. We skip this code in readonly mode for efficiency, because any
2638changes to the filter will be discarded and because count is already set to
2639zero. */
2640
2641if (unique != NULL && !readonly)
2642 {
2643 /* We identify unique events using a Bloom filter. (You can find my
2644 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2645 With the per_addr option, an "event" is a recipient address, though the
2646 user can use the unique option to define their own events. We only count
2647 an event if we have not seen it before.
2648
2649 We size the filter according to the rate limit, which (in leaky mode)
2650 is the limit on the population of the filter. We allow 16 bits of space
2651 per entry (see the construction code above) and we set (up to) 8 of them
2652 when inserting an element (see the loop below). The probability of a false
2653 positive (an event we have not seen before but which we fail to count) is
2654
2655 size = limit * 16
2656 numhash = 8
2657 allzero = exp(-numhash * pop / size)
2658 = exp(-0.5 * pop / limit)
2659 fpr = pow(1 - allzero, numhash)
2660
2661 For senders at the limit the fpr is 0.06% or 1 in 1700
2662 and for senders at half the limit it is 0.0006% or 1 in 170000
2663
2664 In strict mode the Bloom filter can fill up beyond the normal limit, in
2665 which case the false positive rate will rise. This means that the
2666 measured rate for very fast senders can bogusly drop off after a while.
2667
2668 At twice the limit, the fpr is 2.5% or 1 in 40
2669 At four times the limit, it is 31% or 1 in 3.2
2670
2671 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2672 decay below the limit, and if this is more than one then the Bloom filter
2673 will be discarded before the decay gets that far. The false positive rate
2674 at this threshold is 9.3% or 1 in 10.7. */
2675
2676 BOOL seen;
2677 unsigned n, hash, hinc;
2678 uschar md5sum[16];
2679 md5 md5info;
2680
2681 /* Instead of using eight independent hash values, we combine two values
2682 using the formula h1 + n * h2. This does not harm the Bloom filter's
2683 performance, and means the amount of hash we need is independent of the
2684 number of bits we set in the filter. */
2685
2686 md5_start(&md5info);
2687 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2688 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2689 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2690
2691 /* Scan the bits corresponding to this event. A zero bit means we have
2692 not seen it before. Ensure all bits are set to record this event. */
2693
2694 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2695
2696 seen = TRUE;
2697 for (n = 0; n < 8; n++, hash += hinc)
2698 {
2699 int bit = 1 << (hash % 8);
2700 int byte = (hash / 8) % dbdb->bloom_size;
2701 if ((dbdb->bloom[byte] & bit) == 0)
2702 {
2703 dbdb->bloom[byte] |= bit;
2704 seen = FALSE;
2705 }
2706 }
2707
2708 /* If this event has occurred before, do not count it. */
2709
2710 if (seen)
2711 {
2712 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2713 count = 0.0;
2714 }
2715 else
2716 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2717 }
2718
2719/* If there was no previous ratelimit data block for this key, initialize
2720the new one, otherwise update the block from the database. The initial rate
2721is what would be computed by the code below for an infinite interval. */
2722
870f6ba8
TF
2723if (dbd == NULL)
2724 {
c99ce5c9
TF
2725 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2726 dbd = &dbdb->dbd;
870f6ba8
TF
2727 dbd->time_stamp = tv.tv_sec;
2728 dbd->time_usec = tv.tv_usec;
c99ce5c9 2729 dbd->rate = count;
870f6ba8
TF
2730 }
2731else
2732 {
2733 /* The smoothed rate is computed using an exponentially weighted moving
2734 average adjusted for variable sampling intervals. The standard EWMA for
2735 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2736 where f() is the measured value and f'() is the smoothed value.
2737
2738 Old data decays out of the smoothed value exponentially, such that data n
2739 samples old is multiplied by a^n. The exponential decay time constant p
2740 is defined such that data p samples old is multiplied by 1/e, which means
2741 that a = exp(-1/p). We can maintain the same time constant for a variable
2742 sampling interval i by using a = exp(-i/p).
2743
2744 The rate we are measuring is messages per period, suitable for directly
2745 comparing with the limit. The average rate between now and the previous
2746 message is period / interval, which we feed into the EWMA as the sample.
2747
2748 It turns out that the number of messages required for the smoothed rate
2749 to reach the limit when they are sent in a burst is equal to the limit.
2750 This can be seen by analysing the value of the smoothed rate after N
2751 messages sent at even intervals. Let k = (1 - a) * p/i
2752
2753 rate_1 = (1 - a) * p/i + a * rate_0
2754 = k + a * rate_0
2755 rate_2 = k + a * rate_1
2756 = k + a * k + a^2 * rate_0
2757 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2758 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2759 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2760 = rate_0 * a^N + p/i * (1 - a^N)
2761
2762 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2763
2764 rate_N = p/i + (rate_0 - p/i) * a^N
2765 a^N = (rate_N - p/i) / (rate_0 - p/i)
2766 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2767 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2768
2769 Numerical analysis of the above equation, setting the computed rate to
2770 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2771 rates, p/i, the number of messages N = limit. So limit serves as both the
2772 maximum rate measured in messages per period, and the maximum number of
2773 messages that can be sent in a fast burst. */
2774
2775 double this_time = (double)tv.tv_sec
2776 + (double)tv.tv_usec / 1000000.0;
2777 double prev_time = (double)dbd->time_stamp
2778 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2779
2780 /* We must avoid division by zero, and deal gracefully with the clock going
2781 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2782 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2783
e5d5a95f
TF
2784 double interval = this_time - prev_time <= 0.0 ? 1e-9
2785 : this_time - prev_time;
2786
2787 double i_over_p = interval / period;
2788 double a = exp(-i_over_p);
870f6ba8 2789
c99ce5c9
TF
2790 /* Combine the instantaneous rate (period / interval) with the previous rate
2791 using the smoothing factor a. In order to measure sized events, multiply the
2792 instantaneous rate by the count of bytes or recipients etc. */
2793
870f6ba8
TF
2794 dbd->time_stamp = tv.tv_sec;
2795 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2796 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2797
2798 /* When events are very widely spaced the computed rate tends towards zero.
2799 Although this is accurate it turns out not to be useful for our purposes,
2800 especially when the first event after a long silence is the start of a spam
2801 run. A more useful model is that the rate for an isolated event should be the
2802 size of the event per the period size, ignoring the lack of events outside
2803 the current period and regardless of where the event falls in the period. So,
2804 if the interval was so long that the calculated rate is unhelpfully small, we
2805 re-intialize the rate. In the absence of higher-rate bursts, the condition
2806 below is true if the interval is greater than the period. */
2807
2808 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2809 }
2810
c99ce5c9
TF
2811/* Clients sending at the limit are considered to be over the limit.
2812This matters for edge cases such as a limit of zero, when the client
2813should be completely blocked. */
3348576f 2814
8f240103 2815rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2816
2817/* Update the state if the rate is low or if we are being strict. If we
2818are in leaky mode and the sender's rate is too high, we do not update
2819the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2820rate preventing them from getting any email through. If readonly is set,
2821neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2822
c99ce5c9 2823if ((rc == FAIL && leaky) || strict)
8f240103 2824 {
c99ce5c9 2825 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH
2826 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2827 }
2828else
2829 {
2830 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2831 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2832 }
2833
870f6ba8
TF
2834dbfn_close(dbm);
2835
c99ce5c9 2836/* Store the result in the tree for future reference. */
870f6ba8 2837
c99ce5c9
TF
2838t = store_get(sizeof(tree_node) + Ustrlen(key));
2839t->data.ptr = dbd;
2840Ustrcpy(t->name, key);
2841(void)tree_insertnode(anchor, t);
870f6ba8
TF
2842
2843/* We create the formatted version of the sender's rate very late in
2844order to ensure that it is done using the correct storage pool. */
2845
2846store_pool = old_pool;
2847sender_rate = string_sprintf("%.1f", dbd->rate);
2848
2849HDEBUG(D_acl)
2850 debug_printf("ratelimit computed rate %s\n", sender_rate);
2851
2852return rc;
2853}
2854
2855
2856
2857/*************************************************
b0019c78
TF
2858* The udpsend ACL modifier *
2859*************************************************/
2860
2861/* Called by acl_check_condition() below.
2862
2863Arguments:
2864 arg the option string for udpsend=
2865 log_msgptr for error messages
2866
2867Returns: OK - Completed.
2868 DEFER - Problem with DNS lookup.
2869 ERROR - Syntax error in options.
2870*/
2871
2872static int
55414b25 2873acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2874{
2875int sep = 0;
2876uschar *hostname;
2877uschar *portstr;
2878uschar *portend;
2879host_item *h;
2880int portnum;
b0019c78
TF
2881int len;
2882int r, s;
b1f8e4f8 2883uschar * errstr;
b0019c78
TF
2884
2885hostname = string_nextinlist(&arg, &sep, NULL, 0);
2886portstr = string_nextinlist(&arg, &sep, NULL, 0);
2887
2888if (hostname == NULL)
2889 {
217b0e56 2890 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2891 return ERROR;
2892 }
2893if (portstr == NULL)
2894 {
217b0e56 2895 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2896 return ERROR;
2897 }
2898if (arg == NULL)
2899 {
217b0e56 2900 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2901 return ERROR;
2902 }
2903portnum = Ustrtol(portstr, &portend, 10);
2904if (*portend != '\0')
2905 {
217b0e56 2906 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2907 return ERROR;
2908 }
2909
2910/* Make a single-item host list. */
2911h = store_get(sizeof(host_item));
2912memset(h, 0, sizeof(host_item));
2913h->name = hostname;
2914h->port = portnum;
2915h->mx = MX_NONE;
2916
2917if (string_is_ip_address(hostname, NULL))
2918 h->address = hostname, r = HOST_FOUND;
2919else
2920 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2921if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2922 {
217b0e56 2923 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2924 return DEFER;
2925 }
2926
2927HDEBUG(D_acl)
2928 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2929
b1f8e4f8
JH
2930r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2931 1, NULL, &errstr);
b0019c78 2932if (r < 0) goto defer;
27f9999e 2933len = Ustrlen(arg);
9cb1785a 2934r = send(s, arg, len, 0);
b1f8e4f8
JH
2935if (r < 0)
2936 {
2937 errstr = US strerror(errno);
2938 close(s);
2939 goto defer;
2940 }
2941close(s);
b0019c78
TF
2942if (r < len)
2943 {
2944 *log_msgptr =
2945 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2946 return DEFER;
2947 }
2948
2949HDEBUG(D_acl)
2950 debug_printf("udpsend %d bytes\n", r);
2951
2952return OK;
2953
2954defer:
b1f8e4f8 2955*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2956return DEFER;
2957}
2958
2959
2960
2961/*************************************************
059ec3d9
PH
2962* Handle conditions/modifiers on an ACL item *
2963*************************************************/
2964
2965/* Called from acl_check() below.
2966
2967Arguments:
2968 verb ACL verb
2969 cb ACL condition block - if NULL, result is OK
2970 where where called from
2971 addr the address being checked for RCPT, or NULL
2972 level the nesting level
2973 epp pointer to pass back TRUE if "endpass" encountered
2974 (applies only to "accept" and "discard")
2975 user_msgptr user message pointer
2976 log_msgptr log message pointer
2977 basic_errno pointer to where to put verify error
2978
2979Returns: OK - all conditions are met
2980 DISCARD - an "acl" condition returned DISCARD - only allowed
2981 for "accept" or "discard" verbs
2982 FAIL - at least one condition fails
2983 FAIL_DROP - an "acl" condition returned FAIL_DROP
2984 DEFER - can't tell at the moment (typically, lookup defer,
2985 but can be temporary callout problem)
2986 ERROR - ERROR from nested ACL or expansion failure or other
2987 error
2988*/
2989
2990static int
2991acl_check_condition(int verb, acl_condition_block *cb, int where,
2992 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2993 uschar **log_msgptr, int *basic_errno)
2994{
2995uschar *user_message = NULL;
2996uschar *log_message = NULL;
ed7f7860
PP
2997uschar *debug_tag = NULL;
2998uschar *debug_opts = NULL;
059ec3d9 2999int rc = OK;
8523533c 3000#ifdef WITH_CONTENT_SCAN
0f0c8159 3001int sep = -'/';
8523533c 3002#endif
059ec3d9
PH
3003
3004for (; cb != NULL; cb = cb->next)
3005 {
55414b25 3006 const uschar *arg;
8e669ac1 3007 int control_type;
059ec3d9
PH
3008
3009 /* The message and log_message items set up messages to be used in
3010 case of rejection. They are expanded later. */
3011
3012 if (cb->type == ACLC_MESSAGE)
3013 {
187bc588 3014 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH
3015 user_message = cb->arg;
3016 continue;
3017 }
3018
3019 if (cb->type == ACLC_LOG_MESSAGE)
3020 {
187bc588 3021 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH
3022 log_message = cb->arg;
3023 continue;
3024 }
3025
3026 /* The endpass "condition" just sets a flag to show it occurred. This is
3027 checked at compile time to be on an "accept" or "discard" item. */
3028
3029 if (cb->type == ACLC_ENDPASS)
3030 {
3031 *epp = TRUE;
3032 continue;
3033 }
3034
3035 /* For other conditions and modifiers, the argument is expanded now for some
3036 of them, but not for all, because expansion happens down in some lower level
3037 checking functions in some cases. */
3038
3039 if (cond_expand_at_top[cb->type])
3040 {
3041 arg = expand_string(cb->arg);
3042 if (arg == NULL)
3043 {
3044 if (expand_string_forcedfail) continue;
3045 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3046 cb->arg, expand_string_message);
3047 return search_find_defer? DEFER : ERROR;
3048 }
3049 }
3050 else arg = cb->arg;
3051
3052 /* Show condition, and expanded condition if it's different */
3053
3054 HDEBUG(D_acl)
3055 {
3056 int lhswidth = 0;
3057 debug_printf("check %s%s %n",
3058 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3059 conditions[cb->type], &lhswidth);
3060
3061 if (cb->type == ACLC_SET)
3062 {
38a0a95f
PH
3063 debug_printf("acl_%s ", cb->u.varname);
3064 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH
3065 }
3066
3067 debug_printf("= %s\n", cb->arg);
3068
3069 if (arg != cb->arg)
3070 debug_printf("%.*s= %s\n", lhswidth,
3071 US" ", CS arg);
3072 }
3073
3074 /* Check that this condition makes sense at this time */
3075
3076 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3077 {
3078 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3079 cond_modifiers[cb->type]? "use" : "test",
3080 conditions[cb->type], acl_wherenames[where]);
3081 return ERROR;
3082 }
3083
3084 /* Run the appropriate test for each condition, or take the appropriate
3085 action for the remaining modifiers. */
3086
3087 switch(cb->type)
3088 {
71fafd95
PH
3089 case ACLC_ADD_HEADER:
3090 setup_header(arg);
3091 break;
3092
059ec3d9
PH
3093 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3094 "discard" verb. */
71fafd95 3095
059ec3d9 3096 case ACLC_ACL:
f60d98e8 3097 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH
3098 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3099 {
3100 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3101 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3102 verbs[verb]);
3103 return ERROR;
3104 }
059ec3d9
PH
3105 break;
3106
3107 case ACLC_AUTHENTICATED:
3108 rc = (sender_host_authenticated == NULL)? FAIL :
3109 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3110 TRUE, NULL);
3111 break;
3112
71fafd95 3113 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
3114 case ACLC_BMI_OPTIN:
3115 {
3116 int old_pool = store_pool;
3117 store_pool = POOL_PERM;
3118 bmi_current_optin = string_copy(arg);
3119 store_pool = old_pool;
3120 }
3121 break;
71fafd95 3122 #endif
8523533c 3123
059ec3d9 3124 case ACLC_CONDITION:
f3766eb5
NM
3125 /* The true/false parsing here should be kept in sync with that used in
3126 expand.c when dealing with ECOND_BOOL so that we don't have too many
3127 different definitions of what can be a boolean. */
51c7471d
JH
3128 if (*arg == '-'
3129 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3130 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
3131 rc = (Uatoi(arg) == 0)? FAIL : OK;
3132 else
3133 rc = (strcmpic(arg, US"no") == 0 ||
3134 strcmpic(arg, US"false") == 0)? FAIL :
3135 (strcmpic(arg, US"yes") == 0 ||
3136 strcmpic(arg, US"true") == 0)? OK : DEFER;
3137 if (rc == DEFER)
3138 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3139 break;
3140
c3611384
PH
3141 case ACLC_CONTINUE: /* Always succeeds */
3142 break;
3143
059ec3d9 3144 case ACLC_CONTROL:
c5fcb476 3145 {
55414b25
JH
3146 const uschar *p = NULL;
3147 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3148
55414b25 3149 /* Check if this control makes sense at this time */
f7572e5a 3150
55414b25
JH
3151 if ((control_forbids[control_type] & (1 << where)) != 0)
3152 {
3153 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3154 controls[control_type], acl_wherenames[where]);
3155 return ERROR;
3156 }
8800895a 3157
55414b25
JH
3158 switch(control_type)
3159 {
3160 case CONTROL_AUTH_UNADVERTISED:
3161 allow_auth_unadvertised = TRUE;
3162 break;
3163
3164 #ifdef EXPERIMENTAL_BRIGHTMAIL
3165 case CONTROL_BMI_RUN:
3166 bmi_run = 1;
3167 break;
3168 #endif
3169
3170 #ifndef DISABLE_DKIM
3171 case CONTROL_DKIM_VERIFY:
3172 dkim_disable_verify = TRUE;
3173 #ifdef EXPERIMENTAL_DMARC
3174 /* Since DKIM was blocked, skip DMARC too */
3175 dmarc_disable_verify = TRUE;
3176 dmarc_enable_forensic = FALSE;
3177 #endif
3178 break;
3179 #endif
3180
3181 #ifdef EXPERIMENTAL_DMARC
3182 case CONTROL_DMARC_VERIFY:
3183 dmarc_disable_verify = TRUE;
3184 break;
3185
3186 case CONTROL_DMARC_FORENSIC:
3187 dmarc_enable_forensic = TRUE;
3188 break;
3189 #endif
3190
3191 case CONTROL_DSCP:
3192 if (*p == '/')
3193 {
3194 int fd, af, level, optname, value;
3195 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3196 a socket; we can accept that, we'll just debug-log failures anyway. */
3197 fd = fileno(smtp_in);
3198 af = ip_get_address_family(fd);
3199 if (af < 0)
3200 {
3201 HDEBUG(D_acl)
3202 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3203 strerror(errno));
3204 break;
3205 }
3206 if (dscp_lookup(p+1, af, &level, &optname, &value))
3207 {
3208 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3209 {
3210 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3211 p+1, strerror(errno));
3212 }
3213 else
3214 {
3215 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3216 }
3217 }
3218 else
3219 {
3220 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3221 return ERROR;
3222 }
3223 }
3224 else
3225 {
3226 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3227 return ERROR;
3228 }
3229 break;
3230
3231 case CONTROL_ERROR:
3232 return ERROR;
3233
3234 case CONTROL_CASEFUL_LOCAL_PART:
3235 deliver_localpart = addr->cc_local_part;
3236 break;
3237
3238 case CONTROL_CASELOWER_LOCAL_PART:
3239 deliver_localpart = addr->lc_local_part;
3240 break;
3241
3242 case CONTROL_ENFORCE_SYNC:
3243 smtp_enforce_sync = TRUE;
3244 break;
3245
3246 case CONTROL_NO_ENFORCE_SYNC:
3247 smtp_enforce_sync = FALSE;
3248 break;
3249
3250 #ifdef WITH_CONTENT_SCAN
3251 case CONTROL_NO_MBOX_UNSPOOL:
3252 no_mbox_unspool = TRUE;
3253 break;
3254 #endif
3255
3256 case CONTROL_NO_MULTILINE:
3257 no_multiline_responses = TRUE;
3258 break;
3259
3260 case CONTROL_NO_PIPELINING:
3261 pipelining_enable = FALSE;
3262 break;
3263
3264 case CONTROL_NO_DELAY_FLUSH:
3265 disable_delay_flush = TRUE;
3266 break;
3267
3268 case CONTROL_NO_CALLOUT_FLUSH:
3269 disable_callout_flush = TRUE;
3270 break;
3271
3272 case CONTROL_FAKEREJECT:
3273 cancel_cutthrough_connection("fakereject");
3274 case CONTROL_FAKEDEFER:
3275 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3276 if (*p == '/')
3277 {
3278 const uschar *pp = p + 1;
3279 while (*pp != 0) pp++;
3280 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3281 p = pp;
3282 }
3283 else
3284 {
3285 /* Explicitly reset to default string */
3286 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3287 }
3288 break;
ed7f7860 3289
55414b25
JH
3290 case CONTROL_FREEZE:
3291 deliver_freeze = TRUE;
3292 deliver_frozen_at = time(NULL);
3293 freeze_tell = freeze_tell_config; /* Reset to configured value */
3294 if (Ustrncmp(p, "/no_tell", 8) == 0)
3295 {
3296 p += 8;
3297 freeze_tell = NULL;
3298 }
3299 if (*p != 0)
3300 {
3301 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3302 return ERROR;
3303 }
3304 cancel_cutthrough_connection("item frozen");
3305 break;
3306
3307 case CONTROL_QUEUE_ONLY:
3308 queue_only_policy = TRUE;
3309 cancel_cutthrough_connection("queueing forced");
3310 break;
3311
3312 case CONTROL_SUBMISSION:
3313 originator_name = US"";
3314 submission_mode = TRUE;
3315 while (*p == '/')
3316 {
3317 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3318 {
3319 p += 14;
3320 active_local_sender_retain = TRUE;
3321 active_local_from_check = FALSE;
3322 }
3323 else if (Ustrncmp(p, "/domain=", 8) == 0)
3324 {
3325 const uschar *pp = p + 8;
3326 while (*pp != 0 && *pp != '/') pp++;
3327 submission_domain = string_copyn(p+8, pp-p-8);
3328 p = pp;
3329 }
3330 /* The name= option must be last, because it swallows the rest of
3331 the string. */
3332 else if (Ustrncmp(p, "/name=", 6) == 0)
3333 {
3334 const uschar *pp = p + 6;
3335 while (*pp != 0) pp++;
3336 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3337 big_buffer, big_buffer_size));
3338 p = pp;
3339 }
3340 else break;
3341 }
3342 if (*p != 0)
3343 {
3344 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3345 return ERROR;
3346 }
3347 break;
e4bdf652 3348
55414b25
JH
3349 case CONTROL_DEBUG:
3350 while (*p == '/')
3351 {
3352 if (Ustrncmp(p, "/tag=", 5) == 0)
3353 {
3354 const uschar *pp = p + 5;
3355 while (*pp != '\0' && *pp != '/') pp++;
3356 debug_tag = string_copyn(p+5, pp-p-5);
3357 p = pp;
3358 }
3359 else if (Ustrncmp(p, "/opts=", 6) == 0)
3360 {
3361 const uschar *pp = p + 6;
3362 while (*pp != '\0' && *pp != '/') pp++;
3363 debug_opts = string_copyn(p+6, pp-p-6);
3364 p = pp;
3365 }
3366 }
3367 debug_logging_activate(debug_tag, debug_opts);
3368 break;
3369
3370 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3371 suppress_local_fixups = TRUE;
3372 break;
3373
3374 case CONTROL_CUTTHROUGH_DELIVERY:
3375 if (prdr_requested)
3376 /* Too hard to think about for now. We might in future cutthrough
3377 the case where both sides handle prdr and this-node prdr acl
3378 is "accept" */
93a6fce2 3379 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH
3380 else
3381 {
55414b25
JH
3382 if (deliver_freeze)
3383 *log_msgptr = US"frozen";
3384 else if (queue_only_policy)
3385 *log_msgptr = US"queue-only";
3386 else if (fake_response == FAIL)
3387 *log_msgptr = US"fakereject";
3388 else
3389 {
3390 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3391 break;
3392 }
3393 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3394 arg, *log_msgptr);
5032d1cf 3395 }
55414b25 3396 return ERROR;
3c8b3577
JH
3397
3398 #ifdef EXPERIMENTAL_INTERNATIONAL
3399 case CONTROL_UTF8_DOWNCONVERT:
3400 if (*p == '/')
3401 {
921dfc11
JH
3402 if (p[1] == '1')
3403 {
3404 message_utf8_downconvert = 1;
3405 addr->prop.utf8_downcvt = TRUE;
3406 addr->prop.utf8_downcvt_maybe = FALSE;
3407 p += 2;
3408 break;
3409 }
3410 if (p[1] == '0')
3411 {
3412 message_utf8_downconvert = 0;
3413 addr->prop.utf8_downcvt = FALSE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 p += 2;
3416 break;
3417 }
3c8b3577 3418 if (p[1] == '-' && p[2] == '1')
921dfc11
JH
3419 {
3420 message_utf8_downconvert = -1;
3421 addr->prop.utf8_downcvt = FALSE;
3422 addr->prop.utf8_downcvt_maybe = TRUE;
3423 p += 3;
3424 break;
3425 }
3c8b3577
JH
3426 *log_msgptr = US"bad option value for control=utf8_downconvert";
3427 }
3428 else
3429 {
921dfc11
JH
3430 message_utf8_downconvert = 1;
3431 addr->prop.utf8_downcvt = TRUE;
3432 addr->prop.utf8_downcvt_maybe = FALSE;
3433 break;
3c8b3577
JH
3434 }
3435 return ERROR;
3436 #endif
3437
9171d434 3438 }
55414b25 3439 break;
059ec3d9 3440 }
059ec3d9 3441
6a8f9482
TK
3442 #ifdef EXPERIMENTAL_DCC
3443 case ACLC_DCC:
3444 {
3445 /* Seperate the regular expression and any optional parameters. */
55414b25
JH
3446 const uschar * list = arg;
3447 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3448 /* Run the dcc backend. */
3449 rc = dcc_process(&ss);
3450 /* Modify return code based upon the existance of options. */
3c8b3577 3451 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3452 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3453 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3454 }
3455 break;
3456 #endif
3457
71fafd95 3458 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3459 case ACLC_DECODE:
3460 rc = mime_decode(&arg);
3461 break;
71fafd95 3462 #endif
8523533c 3463
059ec3d9
PH
3464 case ACLC_DELAY:
3465 {
3466 int delay = readconf_readtime(arg, 0, FALSE);
3467 if (delay < 0)
3468 {
3469 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3470 "modifier: \"%s\" is not a time value", arg);
3471 return ERROR;
3472 }
3473 else
3474 {
3475 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3476 delay);
3477 if (host_checking)
3478 {
3479 HDEBUG(D_acl)
3480 debug_printf("delay skipped in -bh checking mode\n");
3481 }
010c2d14 3482
ae9d18bc
JH
3483 /* NOTE 1: Remember that we may be
3484 dealing with stdin/stdout here, in addition to TCP/IP connections.
3485 Also, delays may be specified for non-SMTP input, where smtp_out and
3486 smtp_in will be NULL. Whatever is done must work in all cases.
3487
3488 NOTE 2: The added feature of flushing the output before a delay must
3489 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3490 */
3491
3492 else
3493 {
3494 if (smtp_out != NULL && !disable_delay_flush)
3495 mac_smtp_fflush();
3496
3497#if !defined(NO_POLL_H) && defined (_GNU_SOURCE)
3498 {
3499 struct pollfd p;
3500 nfds_t n = 0;
3501 if (smtp_out)
3502 {
3503 p.fd = fileno(smtp_out);
3504 p.events = POLLRDHUP;
3505 n = 1;
3506 }
3507 if (poll(&p, n, delay*1000) > 0)
3508 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3509 }
3510#else
010c2d14
PH
3511 /* It appears to be impossible to detect that a TCP/IP connection has
3512 gone away without reading from it. This means that we cannot shorten
3513 the delay below if the client goes away, because we cannot discover
3514 that the client has closed its end of the connection. (The connection
3515 is actually in a half-closed state, waiting for the server to close its
3516 end.) It would be nice to be able to detect this state, so that the
3517 Exim process is not held up unnecessarily. However, it seems that we
3518 can't. The poll() function does not do the right thing, and in any case
3519 it is not always available.
047bdd8c 3520 */
010c2d14 3521
86b8287f 3522 while (delay > 0) delay = sleep(delay);
ae9d18bc 3523#endif
8e669ac1 3524 }
059ec3d9
PH
3525 }
3526 }
3527 break;
3528
71fafd95 3529 #ifdef WITH_OLD_DEMIME
8523533c
TK
3530 case ACLC_DEMIME:
3531 rc = demime(&arg);
3532 break;
71fafd95 3533 #endif
8523533c 3534
80a47a2c
TK
3535 #ifndef DISABLE_DKIM
3536 case ACLC_DKIM_SIGNER:
9e5d6b55
TK
3537 if (dkim_cur_signer != NULL)
3538 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3539 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3540 else
80a47a2c 3541 rc = FAIL;
71fafd95
PH
3542 break;
3543
80a47a2c
TK
3544 case ACLC_DKIM_STATUS:
3545 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3546 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3547 break;
3548 #endif
fb2274d4 3549
4840604e
TL
3550 #ifdef EXPERIMENTAL_DMARC
3551 case ACLC_DMARC_STATUS:
4a8ce2d8 3552 if (!dmarc_has_been_checked)
4840604e 3553 dmarc_process();
4a8ce2d8 3554 dmarc_has_been_checked = TRUE;
4840604e
TL
3555 /* used long way of dmarc_exim_expand_query() in case we need more
3556 * view into the process in the future. */
3557 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3558 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3559 break;
3560 #endif
3561
059ec3d9
PH
3562 case ACLC_DNSLISTS:
3563 rc = verify_check_dnsbl(&arg);
3564 break;
3565
3566 case ACLC_DOMAINS:
3567 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3568 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3569 break;
3570
3571 /* The value in tls_cipher is the full cipher name, for example,
3572 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3573 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3574 what may in practice come out of the SSL library - which at the time of
3575 writing is poorly documented. */
3576
3577 case ACLC_ENCRYPTED:
817d9f57 3578 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3579 {
3580 uschar *endcipher = NULL;
817d9f57
JH
3581 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3582 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3583 {
3584 endcipher = Ustrchr(++cipher, ':');
3585 if (endcipher != NULL) *endcipher = 0;
3586 }
3587 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3588 if (endcipher != NULL) *endcipher = ':';
3589 }
3590 break;
3591
3592 /* Use verify_check_this_host() instead of verify_check_host() so that
3593 we can pass over &host_data to catch any looked up data. Once it has been
3594 set, it retains its value so that it's still there if another ACL verb
3595 comes through here and uses the cache. However, we must put it into
3596 permanent store in case it is also expected to be used in a subsequent
3597 message in the same SMTP connection. */
3598
3599 case ACLC_HOSTS:
3600 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH
3601 (sender_host_address == NULL)? US"" : sender_host_address,
3602 CUSS &host_data);
4a452c43
JH
3603 if (rc == DEFER) *log_msgptr = search_error_message;
3604 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH
3605 break;
3606
3607 case ACLC_LOCAL_PARTS:
3608 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3609 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3610 CUSS &deliver_localpart_data);
059ec3d9
PH
3611 break;
3612
6ea85e9a
PH
3613 case ACLC_LOG_REJECT_TARGET:
3614 {
3615 int logbits = 0;
3616 int sep = 0;
55414b25 3617 const uschar *s = arg;
6ea85e9a 3618 uschar *ss;
4a452c43 3619 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH
3620 {
3621 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3622 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3623 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3624 else
3625 {
3626 logbits |= LOG_MAIN|LOG_REJECT;
3627 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3628 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3629 }
3630 }
3631 log_reject_target = logbits;
3632 }
3633 break;
3634
059ec3d9
PH
3635 case ACLC_LOGWRITE:
3636 {
3637 int logbits = 0;
55414b25 3638 const uschar *s = arg;
059ec3d9
PH
3639 if (*s == ':')
3640 {
3641 s++;
3642 while (*s != ':')
3643 {
3644 if (Ustrncmp(s, "main", 4) == 0)
3645 { logbits |= LOG_MAIN; s += 4; }
3646 else if (Ustrncmp(s, "panic", 5) == 0)
3647 { logbits |= LOG_PANIC; s += 5; }
3648 else if (Ustrncmp(s, "reject", 6) == 0)
3649 { logbits |= LOG_REJECT; s += 6; }
3650 else
3651 {
3652 logbits = LOG_MAIN|LOG_PANIC;
3653 s = string_sprintf(":unknown log name in \"%s\" in "
3654 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3655 }
3656 if (*s == ',') s++;
3657 }
3658 s++;
3659 }
3660 while (isspace(*s)) s++;
6ea85e9a
PH
3661
3662
059ec3d9
PH
3663 if (logbits == 0) logbits = LOG_MAIN;
3664 log_write(0, logbits, "%s", string_printing(s));
3665 }
3666 break;
8e669ac1 3667
71fafd95 3668 #ifdef WITH_CONTENT_SCAN
0f0c8159 3669 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3670 {
6ea85e9a 3671 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3672 const uschar * list = arg;
3673 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH
3674 uschar *opt;
3675 BOOL defer_ok = FALSE;
3676 int timeout = 0;
3677
55414b25 3678 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH
3679 if (strcmpic(opt, US"defer_ok") == 0)
3680 defer_ok = TRUE;
3681 else if ( strncmpic(opt, US"tmo=", 4) == 0
3682 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3683 )
3684 {
3685 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3686 return ERROR;
3687 }
3688
3689 rc = malware(ss, timeout);
3690 if (rc == DEFER && defer_ok)
3691 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK
3692 }
3693 break;
3694
3695 case ACLC_MIME_REGEX:
71fafd95 3696 rc = mime_regex(&arg);
8523533c 3697 break;
71fafd95 3698 #endif
059ec3d9 3699
870f6ba8 3700 case ACLC_RATELIMIT:
90fc3069 3701 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF
3702 break;
3703
059ec3d9 3704 case ACLC_RECIPIENTS:
55414b25
JH
3705 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3706 CUSS &recipient_data);
059ec3d9
PH
3707 break;
3708
71fafd95
PH
3709 #ifdef WITH_CONTENT_SCAN
3710 case ACLC_REGEX:
3711 rc = regex(&arg);
8523533c 3712 break;
71fafd95 3713 #endif
8523533c 3714
e7568d51
TL
3715 case ACLC_REMOVE_HEADER:
3716 setup_remove_header(arg);
3717 break;
3718
059ec3d9
PH
3719 case ACLC_SENDER_DOMAINS:
3720 {
3721 uschar *sdomain;
3722 sdomain = Ustrrchr(sender_address, '@');
3723 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3724 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3725 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3726 }
3727 break;
3728
3729 case ACLC_SENDERS:
55414b25
JH
3730 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3731 sender_address_cache, -1, 0, CUSS &sender_data);