projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
TLS authenticator
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
5a66c31b 5/* Copyright (c) University of Cambridge 1995 - 2014 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef 183 CONTROL_AUTH_UNADVERTISED,
3c8b3577 184#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
3c8b3577 186#endif
ed7f7860 187 CONTROL_DEBUG,
3c8b3577 188#ifndef DISABLE_DKIM
f7572e5a 189 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 190#endif
191#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
3c8b3577 194#endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 206#ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 208#endif
c46782ef
PH		 209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
3c8b3577
JH		 211#ifdef EXPERIMENTAL_INTERNATIONAL
212 CONTROL_UTF8_DOWNCONVERT,
213#endif
cf8b11a5 214 CONTROL_NO_MULTILINE,
047bdd8c 215 CONTROL_NO_PIPELINING,
4c590bd1
PH		 216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
c46782ef 218};
9a26b6b2 219
8800895a
PH		 220/* ACL control names; keep in step with the table above! This list is used for
221turning ids into names. The actual list of recognized names is in the variable
222control_def controls_list[] below. The fact that there are two lists is a mess
223and should be tidied up. */
9a26b6b2
PH		 224
225static uschar *controls[] = {
c46782ef 226 US"allow_auth_unadvertised",
3c8b3577 227#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 228 US"bmi_run",
3c8b3577 229#endif
ed7f7860 230 US"debug",
3c8b3577 231#ifndef DISABLE_DKIM
80a47a2c 232 US"dkim_disable_verify",
3c8b3577
JH		 233#endif
234#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
3c8b3577 237#endif
13363eba 238 US"dscp",
c46782ef
PH		 239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
e4bdf652 242 US"cutthrough_delivery",
c46782ef
PH		 243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
3c8b3577 249#ifdef WITH_CONTENT_SCAN
9a26b6b2 250 US"no_mbox_unspool",
3c8b3577 251#endif
cf8b11a5
PH		 252 US"fakedefer",
253 US"fakereject",
3c8b3577
JH		 254#ifdef EXPERIMENTAL_INTERNATIONAL
255 US"utf8_downconvert",
256#endif
aa6dc513 257 US"no_multiline_responses",
cf8b11a5 258 US"no_pipelining",
4c590bd1
PH		 259 US"no_delay_flush",
260 US"no_callout_flush"
c46782ef 261};
059ec3d9 262
047bdd8c 263/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 264at the outer level. In the other cases, expansion already occurs in the
265checking functions. */
266
267static uschar cond_expand_at_top[] = {
7421ecab 268 FALSE, /* acl */
3e536984 269 TRUE, /* add_header */
059ec3d9 270 FALSE, /* authenticated */
8523533c
TK		 271#ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
8e669ac1 273#endif
059ec3d9 274 TRUE, /* condition */
c3611384 275 TRUE, /* continue */
059ec3d9 276 TRUE, /* control */
6a8f9482
TK		 277#ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279#endif
8523533c
TK		 280#ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282#endif
059ec3d9 283 TRUE, /* delay */
8523533c
TK		 284#ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
fb2274d4 286#endif
80a47a2c
TK		 287#ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
4840604e
TL		 290#endif
291#ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
8523533c 293#endif
059ec3d9
PH		 294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
6ea85e9a 301 TRUE, /* log_reject_target */
059ec3d9 302 TRUE, /* logwrite */
8523533c
TK		 303#ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305#endif
059ec3d9 306 TRUE, /* message */
8523533c
TK		 307#ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309#endif
870f6ba8 310 TRUE, /* ratelimit */
059ec3d9 311 FALSE, /* recipients */
8523533c
TK		 312#ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314#endif
e7568d51 315 TRUE, /* remove_header */
059ec3d9
PH		 316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
8523533c
TK		 319#ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321#endif
322#ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
65a7d8c3 324 TRUE, /* spf_guess */
8523533c 325#endif
b0019c78 326 TRUE, /* udpsend */
059ec3d9
PH		 327 TRUE /* verify */
328};
329
330/* Flags to identify the modifiers */
331
332static uschar cond_modifiers[] = {
333 FALSE, /* acl */
3e536984 334 TRUE, /* add_header */
059ec3d9 335 FALSE, /* authenticated */
8523533c
TK		 336#ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
8e669ac1 338#endif
059ec3d9 339 FALSE, /* condition */
c3611384 340 TRUE, /* continue */
059ec3d9 341 TRUE, /* control */
6a8f9482
TK		 342#ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344#endif
8523533c
TK		 345#ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347#endif
059ec3d9 348 TRUE, /* delay */
8523533c
TK		 349#ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
fb2274d4 351#endif
80a47a2c
TK		 352#ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
4840604e
TL		 355#endif
356#ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
8523533c 358#endif
059ec3d9
PH		 359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
6ea85e9a 366 TRUE, /* log_reject_target */
8523533c
TK		 367 TRUE, /* logwrite */
368#ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370#endif
059ec3d9 371 TRUE, /* message */
8523533c
TK		 372#ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374#endif
870f6ba8 375 FALSE, /* ratelimit */
059ec3d9 376 FALSE, /* recipients */
8523533c
TK		 377#ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379#endif
e7568d51 380 TRUE, /* remove_header */
059ec3d9
PH		 381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
8523533c
TK		 384#ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386#endif
387#ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
65a7d8c3 389 FALSE, /* spf_guess */
8523533c 390#endif
b0019c78 391 TRUE, /* udpsend */
059ec3d9
PH		 392 FALSE /* verify */
393};
394
c3611384 395/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 396times. For each condition and modifier, there's a bitmap of dis-allowed times.
397For some, it is easier to specify the negation of a small number of allowed
398times. */
059ec3d9
PH		 399
400static unsigned int cond_forbids[] = {
401 0, /* acl */
8e669ac1 402
71fafd95 403 (unsigned int)
45b91596 404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 406 #ifndef DISABLE_PRDR
fd98a5c6
JH		 407 (1<<ACL_WHERE_PRDR)|
408 #endif
45b91596 409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 410 (1<<ACL_WHERE_DKIM)|
45b91596 411 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 412
45b91596
PH		 413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 416
71fafd95 417 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 421 #ifndef DISABLE_PRDR
fd98a5c6
JH		 422 (1<<ACL_WHERE_PRDR)|
423 #endif
8e669ac1 424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 429 #endif
8e669ac1 430
059ec3d9 431 0, /* condition */
8e669ac1 432
c3611384
PH		 433 0, /* continue */
434
059ec3d9 435 /* Certain types of control are always allowed, so we let it through
2f079f46 436 always and check in the control processing itself. */
8e669ac1 437
059ec3d9 438 0, /* control */
8e669ac1 439
6a8f9482
TK		 440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
fd98a5c6 442 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 443 #ifndef DISABLE_PRDR
fd98a5c6 444 (1<<ACL_WHERE_PRDR)|
8ccd00b1 445 #endif
fd98a5c6 446 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 447 #endif
448
71fafd95 449 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 452 #endif
8523533c 453
8f128379 454 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 455
71fafd95 456 #ifdef WITH_OLD_DEMIME
2f079f46 457 (unsigned int)
fd98a5c6 458 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 459 #ifndef DISABLE_PRDR
fd98a5c6 460 (1<<ACL_WHERE_PRDR)|
8ccd00b1 461 #endif
fd98a5c6 462 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 463 #endif
8e669ac1 464
80a47a2c
TK		 465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 468
80a47a2c
TK		 469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 471 #endif
fb2274d4 472
4840604e
TL		 473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
45b91596
PH		 478 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
479 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 480
2f079f46 481 (unsigned int)
fd98a5c6 482 ~((1<<ACL_WHERE_RCPT) /* domains */
8ccd00b1 483 #ifndef DISABLE_PRDR
fd98a5c6
JH		 484 |(1<<ACL_WHERE_PRDR)
485 #endif
486 ),
059ec3d9 487
45b91596
PH		 488 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
489 (1<<ACL_WHERE_CONNECT)|
490 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 491 (1<<ACL_WHERE_HELO),
8e669ac1 492
059ec3d9 493 0, /* endpass */
8e669ac1 494
45b91596
PH		 495 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
496 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 497
2f079f46 498 (unsigned int)
fd98a5c6 499 ~((1<<ACL_WHERE_RCPT) /* local_parts */
2e6afa4f 500 #ifndef DISABLE_PRDR
fd98a5c6
JH		 501 |(1<<ACL_WHERE_PRDR)
502 #endif
503 ),
059ec3d9
PH		 504
505 0, /* log_message */
8e669ac1 506
6ea85e9a
PH		 507 0, /* log_reject_target */
508
059ec3d9 509 0, /* logwrite */
8e669ac1 510
71fafd95 511 #ifdef WITH_CONTENT_SCAN
2f079f46 512 (unsigned int)
fd98a5c6 513 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 514 #ifndef DISABLE_PRDR
fd98a5c6 515 (1<<ACL_WHERE_PRDR)|
8ccd00b1 516 #endif
fd98a5c6 517 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 518 #endif
8523533c 519
059ec3d9
PH		 520 0, /* message */
521
71fafd95 522 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 523 (unsigned int)
524 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 525 #endif
8523533c 526
870f6ba8
TF		 527 0, /* ratelimit */
528
2f079f46
PH		 529 (unsigned int)
530 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 531
71fafd95 532 #ifdef WITH_CONTENT_SCAN
2f079f46 533 (unsigned int)
fd98a5c6 534 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 535 #ifndef DISABLE_PRDR
fd98a5c6 536 (1<<ACL_WHERE_PRDR)|
8ccd00b1 537 #endif
fd98a5c6 538 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 539 (1<<ACL_WHERE_MIME)),
71fafd95 540 #endif
8523533c 541
e7568d51
TL		 542 (unsigned int)
543 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
544 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 545 #ifndef DISABLE_PRDR
fd98a5c6
JH		 546 (1<<ACL_WHERE_PRDR)|
547 #endif
e7568d51
TL		 548 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
549 (1<<ACL_WHERE_NOTSMTP_START)),
550
059ec3d9
PH		 551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
558 (1<<ACL_WHERE_HELO)|
559 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
560 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
561 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
562
563 0, /* set */
564
71fafd95 565 #ifdef WITH_CONTENT_SCAN
2f079f46 566 (unsigned int)
fd98a5c6 567 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 568 #ifndef DISABLE_PRDR
fd98a5c6 569 (1<<ACL_WHERE_PRDR)|
8ccd00b1 570 #endif
fd98a5c6 571 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 572 #endif
8523533c 573
71fafd95 574 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 575 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
576 (1<<ACL_WHERE_HELO)|
577 (1<<ACL_WHERE_MAILAUTH)|
578 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 579 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
580 (1<<ACL_WHERE_NOTSMTP)|
581 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 582
583 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
584 (1<<ACL_WHERE_HELO)|
585 (1<<ACL_WHERE_MAILAUTH)|
586 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
587 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
588 (1<<ACL_WHERE_NOTSMTP)|
589 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 590 #endif
8523533c 591
b0019c78
TF		 592 0, /* udpsend */
593
059ec3d9
PH		 594 /* Certain types of verify are always allowed, so we let it through
595 always and check in the verify function itself */
596
597 0 /* verify */
059ec3d9
PH		 598};
599
600
c5fcb476
PH		 601/* Bit map vector of which controls are not allowed at certain times. For
602each control, there's a bitmap of dis-allowed times. For some, it is easier to
603specify the negation of a small number of allowed times. */
604
605static unsigned int control_forbids[] = {
c46782ef
PH		 606 (unsigned int)
607 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
608
3c8b3577 609#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 610 0, /* bmi_run */
3c8b3577 611#endif
c46782ef 612
ed7f7860
PP		 613 0, /* debug */
614
3c8b3577 615#ifndef DISABLE_DKIM
80a47a2c 616 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 617# ifndef DISABLE_PRDR
fd98a5c6 618 (1<<ACL_WHERE_PRDR)|
3c8b3577 619# endif
f7572e5a 620 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 621#endif
f7572e5a 622
3c8b3577 623#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 624 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
625 (1<<ACL_WHERE_NOTSMTP_START),
626 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
627 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 628#endif
4840604e 629
13363eba
PP		 630 (1<<ACL_WHERE_NOTSMTP)|
631 (1<<ACL_WHERE_NOTSMTP_START)|
632 (1<<ACL_WHERE_NOTQUIT), /* dscp */
633
c5fcb476 634 0, /* error */
8e669ac1
PH		 635
636 (unsigned int)
c5fcb476 637 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 638
639 (unsigned int)
c5fcb476 640 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 641
e4bdf652
JH		 642 (unsigned int)
643 0, /* cutthrough_delivery */
644
45b91596
PH		 645 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
646 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 647
45b91596
PH		 648 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
649 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 650
651 (unsigned int)
c5fcb476
PH		 652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 656
657 (unsigned int)
c5fcb476
PH		 658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
659 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 660 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 661 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 662
663 (unsigned int)
c5fcb476 664 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 665 (1<<ACL_WHERE_PREDATA)),
8523533c 666
8800895a
PH		 667 (unsigned int)
668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 669 (1<<ACL_WHERE_PREDATA)|
670 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 671
3c8b3577 672#ifdef WITH_CONTENT_SCAN
8e669ac1 673 (unsigned int)
14d57970 674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 675 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 676 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 677 (1<<ACL_WHERE_MIME)),
3c8b3577 678#endif
a6c4ab60 679
29aba418
TF		 680 (unsigned int)
681 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
682 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 683#ifndef DISABLE_PRDR
fd98a5c6 684 (1<<ACL_WHERE_PRDR)|
3c8b3577 685#endif
29aba418
TF		 686 (1<<ACL_WHERE_MIME)),
687
8e669ac1 688 (unsigned int)
a6c4ab60 689 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 690 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 691#ifndef DISABLE_PRDR
fd98a5c6 692 (1<<ACL_WHERE_PRDR)|
3c8b3577 693#endif
e715ad22 694 (1<<ACL_WHERE_MIME)),
8523533c 695
3c8b3577
JH		 696#ifdef EXPERIMENTAL_INTERNATIONAL
697 0, /* utf8_downconvert */
698#endif
699
45b91596 700 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 701 (1<<ACL_WHERE_NOTSMTP_START),
702
703 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 704 (1<<ACL_WHERE_NOTSMTP_START),
705
706 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 707 (1<<ACL_WHERE_NOTSMTP_START),
708
709 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 710 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 711};
712
713/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 714
715typedef struct control_def {
716 uschar *name;
717 int value; /* CONTROL_xxx value */
059ec3d9
PH		 718 BOOL has_option; /* Has /option(s) following */
719} control_def;
720
721static control_def controls_list[] = {
3c8b3577 722 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 723#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 724 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 725#endif
3c8b3577 726 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 727#ifndef DISABLE_DKIM
3c8b3577 728 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 729#endif
730#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 731 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
732 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 733#endif
3c8b3577
JH		 734 { US"dscp", CONTROL_DSCP, TRUE },
735 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
736 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
737 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
738 { US"freeze", CONTROL_FREEZE, TRUE },
739 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
740 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
741 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
742 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
743 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
744 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 745#ifdef WITH_CONTENT_SCAN
3c8b3577 746 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 747#endif
3c8b3577
JH		 748 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
749 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
750 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 751 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577
JH		 752 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
753#ifdef EXPERIMENTAL_INTERNATIONAL
754 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
755#endif
059ec3d9
PH		 756 };
757
e5a9dba6
PH		 758/* Support data structures for Client SMTP Authorization. acl_verify_csa()
759caches its result in a tree to avoid repeated DNS queries. The result is an
760integer code which is used as an index into the following tables of
761explanatory strings and verification return codes. */
762
763static tree_node *csa_cache = NULL;
764
765enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
766 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
767
768/* The acl_verify_csa() return code is translated into an acl_verify() return
769code using the following table. It is OK unless the client is definitely not
770authorized. This is because CSA is supposed to be optional for sending sites,
771so recipients should not be too strict about checking it - especially because
772DNS problems are quite likely to occur. It's possible to use $csa_status in
773further ACL conditions to distinguish ok, unknown, and defer if required, but
774the aim is to make the usual configuration simple. */
775
776static int csa_return_code[] = {
777 OK, OK, OK, OK,
778 FAIL, FAIL, FAIL, FAIL
779};
780
781static uschar *csa_status_string[] = {
782 US"unknown", US"ok", US"defer", US"defer",
783 US"fail", US"fail", US"fail", US"fail"
784};
785
786static uschar *csa_reason_string[] = {
787 US"unknown",
788 US"ok",
789 US"deferred (SRV lookup failed)",
790 US"deferred (target address lookup failed)",
791 US"failed (explicit authorization required)",
792 US"failed (host name not authorized)",
793 US"failed (no authorized addresses)",
794 US"failed (client address mismatch)"
795};
796
c99ce5c9
TF		 797/* Options for the ratelimit condition. Note that there are two variants of
798the per_rcpt option, depending on the ACL that is used to measure the rate.
799However any ACL must be able to look up per_rcpt rates in /noupdate mode,
800so the two variants must have the same internal representation as well as
801the same configuration string. */
802
803enum {
804 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
805 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
806};
807
808#define RATE_SET(var,new) \
809 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
810
811static uschar *ratelimit_option_string[] = {
812 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
813 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
814};
815
059ec3d9
PH		 816/* Enable recursion between acl_check_internal() and acl_check_condition() */
817
55414b25 818static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 819 uschar **);
059ec3d9
PH		 820
821
822/*************************************************
823* Pick out name from list *
824*************************************************/
825
826/* Use a binary chop method
827
828Arguments:
829 name name to find
830 list list of names
831 end size of list
832
833Returns: offset in list, or -1 if not found
834*/
835
836static int
837acl_checkname(uschar *name, uschar **list, int end)
838{
839int start = 0;
840
841while (start < end)
842 {
843 int mid = (start + end)/2;
844 int c = Ustrcmp(name, list[mid]);
845 if (c == 0) return mid;
846 if (c < 0) end = mid; else start = mid + 1;
847 }
848
849return -1;
850}
851
852
853/*************************************************
854* Read and parse one ACL *
855*************************************************/
856
857/* This function is called both from readconf in order to parse the ACLs in the
858configuration file, and also when an ACL is encountered dynamically (e.g. as
859the result of an expansion). It is given a function to call in order to
860retrieve the lines of the ACL. This function handles skipping comments and
861blank lines (where relevant).
862
863Arguments:
864 func function to get next line of ACL
865 error where to put an error message
866
867Returns: pointer to ACL, or NULL
868 NULL can be legal (empty ACL); in this case error will be NULL
869*/
870
871acl_block *
872acl_read(uschar *(*func)(void), uschar **error)
873{
874acl_block *yield = NULL;
875acl_block **lastp = &yield;
876acl_block *this = NULL;
877acl_condition_block *cond;
878acl_condition_block **condp = NULL;
879uschar *s;
880
881*error = NULL;
882
883while ((s = (*func)()) != NULL)
884 {
885 int v, c;
886 BOOL negated = FALSE;
887 uschar *saveline = s;
888 uschar name[64];
889
890 /* Conditions (but not verbs) are allowed to be negated by an initial
891 exclamation mark. */
892
893 while (isspace(*s)) s++;
894 if (*s == '!')
895 {
896 negated = TRUE;
897 s++;
898 }
899
cf00dad6
PH		 900 /* Read the name of a verb or a condition, or the start of a new ACL, which
901 can be started by a name, or by a macro definition. */
059ec3d9
PH		 902
903 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 904 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 905
906 /* If a verb is unrecognized, it may be another condition or modifier that
907 continues the previous verb. */
908
909 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
910 if (v < 0)
911 {
912 if (this == NULL)
913 {
4e167a8c
PH		 914 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
915 saveline);
059ec3d9
PH		 916 return NULL;
917 }
918 }
919
920 /* New verb */
921
922 else
923 {
924 if (negated)
925 {
926 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
927 return NULL;
928 }
929 this = store_get(sizeof(acl_block));
930 *lastp = this;
931 lastp = &(this->next);
932 this->next = NULL;
933 this->verb = v;
934 this->condition = NULL;
935 condp = &(this->condition);
936 if (*s == 0) continue; /* No condition on this line */
937 if (*s == '!')
938 {
939 negated = TRUE;
940 s++;
941 }
942 s = readconf_readname(name, sizeof(name), s); /* Condition name */
943 }
944
945 /* Handle a condition or modifier. */
946
947 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
948 if (c < 0)
949 {
950 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
951 saveline);
952 return NULL;
953 }
954
955 /* The modifiers may not be negated */
956
957 if (negated && cond_modifiers[c])
958 {
959 *error = string_sprintf("ACL error: negation is not allowed with "
960 "\"%s\"", conditions[c]);
961 return NULL;
962 }
963
964 /* ENDPASS may occur only with ACCEPT or DISCARD. */
965
966 if (c == ACLC_ENDPASS &&
967 this->verb != ACL_ACCEPT &&
968 this->verb != ACL_DISCARD)
969 {
970 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
971 conditions[c], verbs[this->verb]);
972 return NULL;
973 }
974
975 cond = store_get(sizeof(acl_condition_block));
976 cond->next = NULL;
977 cond->type = c;
978 cond->u.negated = negated;
979
980 *condp = cond;
981 condp = &(cond->next);
982
983 /* The "set" modifier is different in that its argument is "name=value"
984 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 985 gives us a variable name to insert into the data block. The original ACL
986 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
987 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 988 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
989 After that, we allow alphanumerics and underscores, but the first character
990 after c or m must be a digit or an underscore. This retains backwards
991 compatibility. */
059ec3d9
PH		 992
993 if (c == ACLC_SET)
994 {
47ca6d6c
PH		 995 uschar *endptr;
996
38a0a95f
PH		 997 if (Ustrncmp(s, "acl_c", 5) != 0 &&
998 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 999 {
38a0a95f
PH		 1000 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1001 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1002 return NULL;
47ca6d6c 1003 }
38a0a95f
PH		 1004
1005 endptr = s + 5;
641cb756
PH		 1006 if (!isdigit(*endptr) && *endptr != '_')
1007 {
1008 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1009 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1010 s);
1011 return NULL;
1012 }
1013
38a0a95f 1014 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1015 {
38a0a95f
PH		 1016 if (!isalnum(*endptr) && *endptr != '_')
1017 {
1018 *error = string_sprintf("invalid character \"%c\" in variable name "
1019 "in ACL modifier \"set %s\"", *endptr, s);
1020 return NULL;
1021 }
1022 endptr++;
47ca6d6c 1023 }
47ca6d6c 1024
38a0a95f 1025 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1026 s = endptr;
059ec3d9
PH		 1027 while (isspace(*s)) s++;
1028 }
1029
1030 /* For "set", we are now positioned for the data. For the others, only
1031 "endpass" has no data */
1032
1033 if (c != ACLC_ENDPASS)
1034 {
1035 if (*s++ != '=')
1036 {
1037 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1038 cond_modifiers[c]? US"modifier" : US"condition");
1039 return NULL;
1040 }
1041 while (isspace(*s)) s++;
1042 cond->arg = string_copy(s);
1043 }
1044 }
1045
1046return yield;
1047}
1048
1049
1050
71fafd95
PH		 1051/*************************************************
1052* Set up added header line(s) *
1053*************************************************/
1054
1055/* This function is called by the add_header modifier, and also from acl_warn()
1056to implement the now-deprecated way of adding header lines using "message" on a
1057"warn" verb. The argument is treated as a sequence of header lines which are
1058added to a chain, provided there isn't an identical one already there.
1059
1060Argument: string of header lines
1061Returns: nothing
1062*/
1063
1064static void
55414b25 1065setup_header(const uschar *hstring)
71fafd95 1066{
55414b25 1067const uschar *p, *q;
71fafd95
PH		 1068int hlen = Ustrlen(hstring);
1069
b1b05573
JH		 1070/* Ignore any leading newlines */
1071while (*hstring == '\n') hstring++, hlen--;
71fafd95 1072
b1b05573 1073/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1074if (hlen <= 0) return;
55414b25
JH		 1075if (hstring[--hlen] != '\n')
1076 q = string_sprintf("%s\n", hstring);
1077else if (hstring[hlen-1] == '\n')
1078 {
1079 uschar * s = string_copy(hstring);
1080 while(s[--hlen] == '\n')
1081 s[hlen+1] = '\0';
1082 q = s;
1083 }
1084else
1085 q = hstring;
71fafd95
PH		 1086
1087/* Loop for multiple header lines, taking care about continuations */
1088
55414b25 1089for (p = q; *p != 0; )
71fafd95 1090 {
55414b25
JH		 1091 const uschar *s;
1092 uschar * hdr;
71fafd95
PH		 1093 int newtype = htype_add_bot;
1094 header_line **hptr = &acl_added_headers;
1095
1096 /* Find next header line within the string */
1097
1098 for (;;)
1099 {
1100 q = Ustrchr(q, '\n');
1101 if (*(++q) != ' ' && *q != '\t') break;
1102 }
1103
1104 /* If the line starts with a colon, interpret the instruction for where to
1105 add it. This temporarily sets up a new type. */
1106
1107 if (*p == ':')
1108 {
1109 if (strncmpic(p, US":after_received:", 16) == 0)
1110 {
1111 newtype = htype_add_rec;
1112 p += 16;
1113 }
1114 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1115 {
1116 newtype = htype_add_rfc;
1117 p += 14;
1118 }
1119 else if (strncmpic(p, US":at_start:", 10) == 0)
1120 {
1121 newtype = htype_add_top;
1122 p += 10;
1123 }
1124 else if (strncmpic(p, US":at_end:", 8) == 0)
1125 {
1126 newtype = htype_add_bot;
1127 p += 8;
1128 }
1129 while (*p == ' ' || *p == '\t') p++;
1130 }
1131
1132 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1133 to the front of it. */
1134
1135 for (s = p; s < q - 1; s++)
1136 {
1137 if (*s == ':' || !isgraph(*s)) break;
1138 }
1139
55414b25
JH		 1140 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1141 hlen = Ustrlen(hdr);
71fafd95
PH		 1142
1143 /* See if this line has already been added */
1144
1145 while (*hptr != NULL)
1146 {
55414b25 1147 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1148 hptr = &((*hptr)->next);
1149 }
1150
1151 /* Add if not previously present */
1152
1153 if (*hptr == NULL)
1154 {
1155 header_line *h = store_get(sizeof(header_line));
55414b25 1156 h->text = hdr;
71fafd95
PH		 1157 h->next = NULL;
1158 h->type = newtype;
1159 h->slen = hlen;
1160 *hptr = h;
1161 hptr = &(h->next);
1162 }
1163
1164 /* Advance for next header line within the string */
1165
1166 p = q;
1167 }
1168}
1169
1170
1171
362145b5
JH		 1172/*************************************************
1173* List the added header lines *
1174*************************************************/
1175uschar *
1176fn_hdrs_added(void)
1177{
1178uschar * ret = NULL;
1179header_line * h = acl_added_headers;
1180uschar * s;
1181uschar * cp;
1182int size = 0;
1183int ptr = 0;
1184
1185if (!h) return NULL;
1186
1187do
1188 {
1189 s = h->text;
1190 while ((cp = Ustrchr(s, '\n')) != NULL)
1191 {
1192 if (cp[1] == '\0') break;
1193
1194 /* contains embedded newline; needs doubling */
1195 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1196 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1197 s = cp+1;
1198 }
1199 /* last bit of header */
1200
1201 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1202 }
6d9cfc47 1203while((h = h->next));
362145b5
JH		 1204
1205ret[ptr-1] = '\0'; /* overwrite last newline */
1206return ret;
1207}
1208
1209
e7568d51
TL		 1210/*************************************************
1211* Set up removed header line(s) *
1212*************************************************/
1213
1214/* This function is called by the remove_header modifier. The argument is
1215treated as a sequence of header names which are added to a colon separated
1216list, provided there isn't an identical one already there.
1217
1218Argument: string of header names
1219Returns: nothing
1220*/
1221
1222static void
55414b25 1223setup_remove_header(const uschar *hnames)
e7568d51
TL		 1224{
1225if (*hnames != 0)
55414b25
JH		 1226 acl_removed_headers = acl_removed_headers
1227 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1228 : string_copy(hnames);
e7568d51
TL		 1229}
1230
1231
71fafd95 1232
059ec3d9
PH		 1233/*************************************************
1234* Handle warnings *
1235*************************************************/
1236
1237/* This function is called when a WARN verb's conditions are true. It adds to
1238the message's headers, and/or writes information to the log. In each case, this
1239only happens once (per message for headers, per connection for log).
1240
71fafd95
PH		 1241** NOTE: The header adding action using the "message" setting is historic, and
1242its use is now deprecated. The new add_header modifier should be used instead.
1243
059ec3d9
PH		 1244Arguments:
1245 where ACL_WHERE_xxxx indicating which ACL this is
1246 user_message message for adding to headers
1247 log_message message for logging, if different
1248
1249Returns: nothing
1250*/
1251
1252static void
1253acl_warn(int where, uschar *user_message, uschar *log_message)
1254{
059ec3d9
PH		 1255if (log_message != NULL && log_message != user_message)
1256 {
1257 uschar *text;
1258 string_item *logged;
1259
1260 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1261 string_printing(log_message));
1262
1263 /* If a sender verification has failed, and the log message is "sender verify
1264 failed", add the failure message. */
1265
1266 if (sender_verified_failed != NULL &&
1267 sender_verified_failed->message != NULL &&
1268 strcmpic(log_message, US"sender verify failed") == 0)
1269 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1270
9c7a242c
PH		 1271 /* Search previously logged warnings. They are kept in malloc
1272 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1273
1274 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1275 if (Ustrcmp(logged->text, text) == 0) break;
1276
1277 if (logged == NULL)
1278 {
1279 int length = Ustrlen(text) + 1;
1280 log_write(0, LOG_MAIN, "%s", text);
1281 logged = store_malloc(sizeof(string_item) + length);
1282 logged->text = (uschar *)logged + sizeof(string_item);
1283 memcpy(logged->text, text, length);
1284 logged->next = acl_warn_logged;
1285 acl_warn_logged = logged;
1286 }
1287 }
1288
1289/* If there's no user message, we are done. */
1290
1291if (user_message == NULL) return;
1292
1293/* If this isn't a message ACL, we can't do anything with a user message.
1294Log an error. */
1295
1296if (where > ACL_WHERE_NOTSMTP)
1297 {
1298 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1299 "found in a non-message (%s) ACL: cannot specify header lines here: "
1300 "message ignored", acl_wherenames[where]);
1301 return;
1302 }
1303
71fafd95
PH		 1304/* The code for setting up header lines is now abstracted into a separate
1305function so that it can be used for the add_header modifier as well. */
059ec3d9 1306
71fafd95 1307setup_header(user_message);
059ec3d9
PH		 1308}
1309
1310
1311
1312/*************************************************
1313* Verify and check reverse DNS *
1314*************************************************/
1315
1316/* Called from acl_verify() below. We look up the host name(s) of the client IP
1317address if this has not yet been done. The host_name_lookup() function checks
1318that one of these names resolves to an address list that contains the client IP
1319address, so we don't actually have to do the check here.
1320
1321Arguments:
1322 user_msgptr pointer for user message
1323 log_msgptr pointer for log message
1324
1325Returns: OK verification condition succeeded
1326 FAIL verification failed
1327 DEFER there was a problem verifying
1328*/
1329
1330static int
1331acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1332{
1333int rc;
1334
1335user_msgptr = user_msgptr; /* stop compiler warning */
1336
1337/* Previous success */
1338
1339if (sender_host_name != NULL) return OK;
1340
1341/* Previous failure */
1342
1343if (host_lookup_failed)
1344 {
1345 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1346 return FAIL;
1347 }
1348
1349/* Need to do a lookup */
1350
1351HDEBUG(D_acl)
1352 debug_printf("looking up host name to force name/address consistency check\n");
1353
1354if ((rc = host_name_lookup()) != OK)
1355 {
1356 *log_msgptr = (rc == DEFER)?
1357 US"host lookup deferred for reverse lookup check"
1358 :
1359 string_sprintf("host lookup failed for reverse lookup check%s",
1360 host_lookup_msg);
1361 return rc; /* DEFER or FAIL */
1362 }
1363
1364host_build_sender_fullhost();
1365return OK;
1366}
1367
1368
1369
e5a9dba6
PH		 1370/*************************************************
1371* Check client IP address matches CSA target *
1372*************************************************/
1373
1374/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1375response for address records belonging to the CSA target hostname. The section
1376is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1377If one of the addresses matches the client's IP address, then the client is
1378authorized by CSA. If there are target IP addresses but none of them match
1379then the client is using an unauthorized IP address. If there are no target IP
1380addresses then the client cannot be using an authorized IP address. (This is
1381an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1382
1383Arguments:
1384 dnsa the DNS answer block
1385 dnss a DNS scan block for us to use
1386 reset option specifing what portion to scan, as described above
1387 target the target hostname to use for matching RR names
1388
1389Returns: CSA_OK successfully authorized
1390 CSA_FAIL_MISMATCH addresses found but none matched
1391 CSA_FAIL_NOADDR no target addresses found
1392*/
1393
1394static int
1395acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1396 uschar *target)
1397{
1398dns_record *rr;
1399dns_address *da;
1400
1401BOOL target_found = FALSE;
1402
1403for (rr = dns_next_rr(dnsa, dnss, reset);
1404 rr != NULL;
1405 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1406 {
1407 /* Check this is an address RR for the target hostname. */
1408
1409 if (rr->type != T_A
1410 #if HAVE_IPV6
1411 && rr->type != T_AAAA
e5a9dba6
PH		 1412 #endif
1413 ) continue;
1414
1415 if (strcmpic(target, rr->name) != 0) continue;
1416
1417 target_found = TRUE;
1418
1419 /* Turn the target address RR into a list of textual IP addresses and scan
1420 the list. There may be more than one if it is an A6 RR. */
1421
1422 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1423 {
1424 /* If the client IP address matches the target IP address, it's good! */
1425
1426 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1427
1428 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1429 }
1430 }
1431
1432/* If we found some target addresses but none of them matched, the client is
1433using an unauthorized IP address, otherwise the target has no authorized IP
1434addresses. */
1435
1436if (target_found) return CSA_FAIL_MISMATCH;
1437else return CSA_FAIL_NOADDR;
1438}
1439
1440
1441
1442/*************************************************
1443* Verify Client SMTP Authorization *
1444*************************************************/
1445
1446/* Called from acl_verify() below. This routine calls dns_lookup_special()
1447to find the CSA SRV record corresponding to the domain argument, or
1448$sender_helo_name if no argument is provided. It then checks that the
1449client is authorized, and that its IP address corresponds to the SRV
1450target's address by calling acl_verify_csa_address() above. The address
1451should have been returned in the DNS response's ADDITIONAL section, but if
1452not we perform another DNS lookup to get it.
1453
1454Arguments:
1455 domain pointer to optional parameter following verify = csa
1456
1457Returns: CSA_UNKNOWN no valid CSA record found
1458 CSA_OK successfully authorized
1459 CSA_FAIL_* client is definitely not authorized
1460 CSA_DEFER_* there was a DNS problem
1461*/
1462
1463static int
55414b25 1464acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1465{
1466tree_node *t;
55414b25
JH		 1467const uschar *found;
1468uschar *p;
e5a9dba6
PH		 1469int priority, weight, port;
1470dns_answer dnsa;
1471dns_scan dnss;
1472dns_record *rr;
1473int rc, type;
1474uschar target[256];
1475
1476/* Work out the domain we are using for the CSA lookup. The default is the
1477client's HELO domain. If the client has not said HELO, use its IP address
1478instead. If it's a local client (exim -bs), CSA isn't applicable. */
1479
1480while (isspace(*domain) && *domain != '\0') ++domain;
1481if (*domain == '\0') domain = sender_helo_name;
1482if (domain == NULL) domain = sender_host_address;
1483if (sender_host_address == NULL) return CSA_UNKNOWN;
1484
1485/* If we have an address literal, strip off the framing ready for turning it
1486into a domain. The framing consists of matched square brackets possibly
1487containing a keyword and a colon before the actual IP address. */
1488
1489if (domain[0] == '[')
1490 {
55414b25 1491 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1492 if (start == NULL) start = domain;
1493 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1494 }
1495
1496/* Turn domains that look like bare IP addresses into domains in the reverse
1497DNS. This code also deals with address literals and $sender_host_address. It's
1498not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1499address literals, but it's probably the most friendly thing to do. This is an
1500extension to CSA, so we allow it to be turned off for proper conformance. */
1501
7e66e54d 1502if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1503 {
1504 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1505 dns_build_reverse(domain, target);
1506 domain = target;
1507 }
1508
1509/* Find out if we've already done the CSA check for this domain. If we have,
1510return the same result again. Otherwise build a new cached result structure
1511for this domain. The name is filled in now, and the value is filled in when
1512we return from this function. */
1513
1514t = tree_search(csa_cache, domain);
1515if (t != NULL) return t->data.val;
1516
1517t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1518Ustrcpy(t->name, domain);
1519(void)tree_insertnode(&csa_cache, t);
1520
1521/* Now we are ready to do the actual DNS lookup(s). */
1522
28e6ef29 1523found = domain;
e5a9dba6
PH		 1524switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1525 {
1526 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1527
1528 default:
1529 return t->data.val = CSA_DEFER_SRV;
1530
1531 /* If we found nothing, the client's authorization is unknown. */
1532
1533 case DNS_NOMATCH:
1534 case DNS_NODATA:
1535 return t->data.val = CSA_UNKNOWN;
1536
1537 /* We got something! Go on to look at the reply in more detail. */
1538
1539 case DNS_SUCCEED:
1540 break;
1541 }
1542
1543/* Scan the reply for well-formed CSA SRV records. */
1544
1545for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1546 rr != NULL;
1547 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1548 {
1549 if (rr->type != T_SRV) continue;
1550
1551 /* Extract the numerical SRV fields (p is incremented) */
1552
1553 p = rr->data;
1554 GETSHORT(priority, p);
1555 GETSHORT(weight, p);
1556 GETSHORT(port, p);
1557
1558 DEBUG(D_acl)
1559 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1560
1561 /* Check the CSA version number */
1562
1563 if (priority != 1) continue;
1564
1565 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1566 found by dns_special_lookup() is a parent of the one we asked for), we check
1567 the subdomain assertions in the port field. At the moment there's only one
1568 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1569 SRV records of their own. */
1570
1dc92d5a 1571 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1572 {
1573 if (port & 1)
1574 return t->data.val = CSA_FAIL_EXPLICIT;
1575 else
1576 return t->data.val = CSA_UNKNOWN;
1577 }
1578
1579 /* This CSA SRV record refers directly to our domain, so we check the value
1580 in the weight field to work out the domain's authorization. 0 and 1 are
1581 unauthorized; 3 means the client is authorized but we can't check the IP
1582 address in order to authenticate it, so we treat it as unknown; values
1583 greater than 3 are undefined. */
1584
1585 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1586
1587 if (weight > 2) continue;
1588
1589 /* Weight == 2, which means the domain is authorized. We must check that the
1590 client's IP address is listed as one of the SRV target addresses. Save the
1591 target hostname then break to scan the additional data for its addresses. */
1592
1593 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1594 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1595
1596 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1597
1598 break;
1599 }
1600
1601/* If we didn't break the loop then no appropriate records were found. */
1602
1603if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1604
1605/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1606A target of "." indicates there are no valid addresses, so the client cannot
1607be authorized. (This is an odd configuration because weight=2 target=. is
1608equivalent to weight=1, but we check for it in order to keep load off the
1609root name servers.) Note that dn_expand() turns "." into "". */
1610
1611if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1612
1613/* Scan the additional section of the CSA SRV reply for addresses belonging
1614to the target. If the name server didn't return any additional data (e.g.
1615because it does not fully support SRV records), we need to do another lookup
1616to obtain the target addresses; otherwise we have a definitive result. */
1617
1618rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1619if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1620
1621/* The DNS lookup type corresponds to the IP version used by the client. */
1622
1623#if HAVE_IPV6
1624if (Ustrchr(sender_host_address, ':') != NULL)
1625 type = T_AAAA;
1626else
1627#endif /* HAVE_IPV6 */
1628 type = T_A;
1629
1630
4e0983dc 1631lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1632switch (dns_lookup(&dnsa, target, type, NULL))
1633 {
1634 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1635
1636 default:
cc00f4af 1637 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1638
1639 /* If the query succeeded, scan the addresses and return the result. */
1640
1641 case DNS_SUCCEED:
cc00f4af
JH		 1642 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1643 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1644 /* else fall through */
e5a9dba6
PH		 1645
1646 /* If the target has no IP addresses, the client cannot have an authorized
1647 IP address. However, if the target site uses A6 records (not AAAA records)
1648 we have to do yet another lookup in order to check them. */
1649
1650 case DNS_NOMATCH:
1651 case DNS_NODATA:
cc00f4af 1652 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1653 }
1654}
1655
1656
1657
059ec3d9
PH		 1658/*************************************************
1659* Handle verification (address & other) *
1660*************************************************/
1661
89583014 1662enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1663 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1664 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1665 };
1666typedef struct {
1667 uschar * name;
1668 int value;
1669 unsigned where_allowed; /* bitmap */
1670 BOOL no_options; /* Never has /option(s) following */
1671 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1672 } verify_type_t;
1673static verify_type_t verify_type_list[] = {
7e8360e6 1674 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1675 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1676 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1677 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1678 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1679 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1680 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1681 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1682 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1683 FALSE, 6 },
770747fd
MFM		 1684 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1685 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1686 };
1687
1688
1689enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1690 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1691 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1692 CALLOUT_TIME
1693 };
1694typedef struct {
1695 uschar * name;
1696 int value;
1697 int flag;
1698 BOOL has_option; /* Has =option(s) following */
1699 BOOL timeval; /* Has a time value */
1700 } callout_opt_t;
1701static callout_opt_t callout_opt_list[] = {
1702 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1703 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1704 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1705 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1706 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1707 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1708 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1709 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1710 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1711 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1712 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1713 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1714 };
1715
1716
1717
059ec3d9
PH		 1718/* This function implements the "verify" condition. It is called when
1719encountered in any ACL, because some tests are almost always permitted. Some
1720just don't make sense, and always fail (for example, an attempt to test a host
1721lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1722
1723Arguments:
1724 where where called from
1725 addr the recipient address that the ACL is handling, or NULL
1726 arg the argument of "verify"
1727 user_msgptr pointer for user message
1728 log_msgptr pointer for log message
1729 basic_errno where to put verify errno
1730
1731Returns: OK verification condition succeeded
1732 FAIL verification failed
1733 DEFER there was a problem verifying
1734 ERROR syntax error
1735*/
1736
1737static int
55414b25 1738acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1739 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1740{
1741int sep = '/';
1742int callout = -1;
1743int callout_overall = -1;
4deaf07d 1744int callout_connect = -1;
059ec3d9
PH		 1745int verify_options = 0;
1746int rc;
1747BOOL verify_header_sender = FALSE;
1748BOOL defer_ok = FALSE;
1749BOOL callout_defer_ok = FALSE;
1750BOOL no_details = FALSE;
eafd343b 1751BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1752address_item *sender_vaddr = NULL;
1753uschar *verify_sender_address = NULL;
1754uschar *pm_mailfrom = NULL;
1755uschar *se_mailfrom = NULL;
596875b3
PH		 1756
1757/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1758an error if options are given for items that don't expect them.
596875b3
PH		 1759*/
1760
1761uschar *slash = Ustrchr(arg, '/');
55414b25 1762const uschar *list = arg;
059ec3d9 1763uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1764verify_type_t * vp;
059ec3d9
PH		 1765
1766if (ss == NULL) goto BAD_VERIFY;
1767
1768/* Handle name/address consistency verification in a separate function. */
1769
89583014
JH		 1770for (vp= verify_type_list;
1771 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1772 vp++
1773 )
1774 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1775 : strcmpic (ss, vp->name) == 0)
1776 break;
1777if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1778 goto BAD_VERIFY;
1779
1780if (vp->no_options && slash != NULL)
059ec3d9 1781 {
89583014
JH		 1782 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1783 "(this verify item has no options)", arg);
1784 return ERROR;
059ec3d9 1785 }
89583014 1786if (!(vp->where_allowed & (1<<where)))
059ec3d9 1787 {
89583014
JH		 1788 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1789 return ERROR;
059ec3d9 1790 }
89583014 1791switch(vp->value)
596875b3 1792 {
89583014
JH		 1793 case VERIFY_REV_HOST_LKUP:
1794 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1795 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1796 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1797 if (strcmpic(ss, US"defer_ok") == 0)
1798 return OK;
1799 return rc;
059ec3d9 1800
89583014
JH		 1801 case VERIFY_CERT:
1802 /* TLS certificate verification is done at STARTTLS time; here we just
1803 test whether it was successful or not. (This is for optional verification; for
1804 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1805
817d9f57 1806 if (tls_in.certificate_verified) return OK;
89583014
JH		 1807 *user_msgptr = US"no verified certificate";
1808 return FAIL;
e5a9dba6 1809
89583014
JH		 1810 case VERIFY_HELO:
1811 /* We can test the result of optional HELO verification that might have
1812 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1813
89583014
JH		 1814 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1815 return helo_verified? OK : FAIL;
059ec3d9 1816
89583014
JH		 1817 case VERIFY_CSA:
1818 /* Do Client SMTP Authorization checks in a separate function, and turn the
1819 result code into user-friendly strings. */
1c41c9cc 1820
89583014
JH		 1821 rc = acl_verify_csa(list);
1822 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1823 csa_reason_string[rc]);
1824 csa_status = csa_status_string[rc];
1825 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1826 return csa_return_code[rc];
1827
1828 case VERIFY_HDR_SYNTAX:
1829 /* Check that all relevant header lines have the correct syntax. If there is
1830 a syntax error, we return details of the error to the sender if configured to
1831 send out full details. (But a "message" setting on the ACL can override, as
1832 always). */
1833
1834 rc = verify_check_headers(log_msgptr);
1835 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1c41c9cc 1836 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
89583014 1837 return rc;
059ec3d9 1838
770747fd
MFM		 1839 case VERIFY_HDR_NAMES_ASCII:
1840 /* Check that all header names are true 7 bit strings
1841 See RFC 5322, 2.2. and RFC 6532, 3. */
1842
1843 rc = verify_check_header_names_ascii(log_msgptr);
1844 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1845 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1846 return rc;
1847
89583014
JH		 1848 case VERIFY_NOT_BLIND:
1849 /* Check that no recipient of this message is "blind", that is, every envelope
1850 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1851
89583014
JH		 1852 rc = verify_check_notblind();
1853 if (rc != OK)
1854 {
1855 *log_msgptr = string_sprintf("bcc recipient detected");
1856 if (smtp_return_error_details)
1857 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1858 }
1859 return rc;
059ec3d9 1860
89583014
JH		 1861 /* The remaining verification tests check recipient and sender addresses,
1862 either from the envelope or from the header. There are a number of
1863 slash-separated options that are common to all of them. */
059ec3d9 1864
89583014
JH		 1865 case VERIFY_HDR_SNDR:
1866 verify_header_sender = TRUE;
1867 break;
059ec3d9 1868
89583014
JH		 1869 case VERIFY_SNDR:
1870 /* In the case of a sender, this can optionally be followed by an address to use
1871 in place of the actual sender (rare special-case requirement). */
059ec3d9 1872 {
89583014
JH		 1873 uschar *s = ss + 6;
1874 if (*s == 0)
1875 verify_sender_address = sender_address;
1876 else
1877 {
1878 while (isspace(*s)) s++;
1879 if (*s++ != '=') goto BAD_VERIFY;
1880 while (isspace(*s)) s++;
1881 verify_sender_address = string_copy(s);
1882 }
059ec3d9 1883 }
89583014
JH		 1884 break;
1885
1886 case VERIFY_RCPT:
1887 break;
059ec3d9
PH		 1888 }
1889
89583014
JH		 1890
1891
596875b3
PH		 1892/* Remaining items are optional; they apply to sender and recipient
1893verification, including "header sender" verification. */
059ec3d9
PH		 1894
1895while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1896 != NULL)
1897 {
1898 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1899 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1900 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1901
1902 /* These two old options are left for backwards compatibility */
1903
1904 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1905 {
1906 callout_defer_ok = TRUE;
1907 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1908 }
1909
1910 else if (strcmpic(ss, US"check_postmaster") == 0)
1911 {
1912 pm_mailfrom = US"";
1913 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1914 }
1915
1916 /* The callout option has a number of sub-options, comma separated */
1917
1918 else if (strncmpic(ss, US"callout", 7) == 0)
1919 {
1920 callout = CALLOUT_TIMEOUT_DEFAULT;
1921 ss += 7;
1922 if (*ss != 0)
1923 {
1924 while (isspace(*ss)) ss++;
1925 if (*ss++ == '=')
1926 {
55414b25 1927 const uschar * sublist = ss;
059ec3d9
PH		 1928 int optsep = ',';
1929 uschar *opt;
1930 uschar buffer[256];
55414b25 1931 while (isspace(*sublist)) sublist++;
8e669ac1 1932
55414b25 1933 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1934 != NULL)
1935 {
89583014 1936 callout_opt_t * op;
438257ba 1937 double period = 1.0F;
059ec3d9 1938
89583014 1939 for (op= callout_opt_list; op->name; op++)
438257ba 1940 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1941 break;
059ec3d9 1942
89583014
JH		 1943 verify_options |= op->flag;
1944 if (op->has_option)
1945 {
438257ba 1946 opt += Ustrlen(op->name);
4deaf07d
PH		 1947 while (isspace(*opt)) opt++;
1948 if (*opt++ != '=')
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after "
89583014 1951 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1952 return ERROR;
1953 }
1954 while (isspace(*opt)) opt++;
89583014
JH		 1955 }
1956 if (op->timeval)
1957 {
1958 period = readconf_readtime(opt, 0, FALSE);
1959 if (period < 0)
4deaf07d
PH		 1960 {
1961 *log_msgptr = string_sprintf("bad time value in ACL condition "
1962 "\"verify %s\"", arg);
1963 return ERROR;
1964 }
89583014
JH		 1965 }
1966
1967 switch(op->value)
1968 {
1969 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1970 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1971 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1972 case CALLOUT_MAILFROM:
1973 if (!verify_header_sender)
1974 {
1975 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1976 "callout option only for verify=header_sender (detected in ACL "
1977 "condition \"%s\")", arg);
1978 return ERROR;
1979 }
1980 se_mailfrom = string_copy(opt);
1981 break;
1982 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1983 case CALLOUT_MAXWAIT: callout_overall = period; break;
1984 case CALLOUT_CONNECT: callout_connect = period; break;
1985 case CALLOUT_TIME: callout = period; break;
1986 }
059ec3d9
PH		 1987 }
1988 }
1989 else
1990 {
1991 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1992 "ACL condition \"%s\"", arg);
1993 return ERROR;
1994 }
1995 }
1996 }
1997
1998 /* Option not recognized */
1999
2000 else
2001 {
2002 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2003 "condition \"verify %s\"", ss, arg);
2004 return ERROR;
2005 }
2006 }
2007
2008if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2009 (vopt_callout_recipsender|vopt_callout_recippmaster))
2010 {
2011 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2012 "for a recipient callout";
2013 return ERROR;
2014 }
2015
2016/* Handle sender-in-header verification. Default the user message to the log
2017message if giving out verification details. */
2018
2019if (verify_header_sender)
2020 {
8e669ac1 2021 int verrno;
059ec3d9 2022 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2023 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2024 &verrno);
2025 if (rc != OK)
8e669ac1 2026 {
fe5b5d0b
PH		 2027 *basic_errno = verrno;
2028 if (smtp_return_error_details)
2029 {
2030 if (*user_msgptr == NULL && *log_msgptr != NULL)
2031 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2032 if (rc == DEFER) acl_temp_details = TRUE;
2033 }
8e669ac1 2034 }
059ec3d9
PH		 2035 }
2036
2037/* Handle a sender address. The default is to verify *the* sender address, but
2038optionally a different address can be given, for special requirements. If the
2039address is empty, we are dealing with a bounce message that has no sender, so
2040we cannot do any checking. If the real sender address gets rewritten during
2041verification (e.g. DNS widening), set the flag to stop it being rewritten again
2042during message reception.
2043
2044A list of verified "sender" addresses is kept to try to avoid doing to much
2045work repetitively when there are multiple recipients in a message and they all
2046require sender verification. However, when callouts are involved, it gets too
2047complicated because different recipients may require different callout options.
2048Therefore, we always do a full sender verify when any kind of callout is
2049specified. Caching elsewhere, for instance in the DNS resolver and in the
2050callout handling, should ensure that this is not terribly inefficient. */
2051
2052else if (verify_sender_address != NULL)
2053 {
2054 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2055 != 0)
2056 {
2057 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2058 "sender verify callout";
2059 return ERROR;
2060 }
2061
2062 sender_vaddr = verify_checked_sender(verify_sender_address);
2063 if (sender_vaddr != NULL && /* Previously checked */
2064 callout <= 0) /* No callout needed this time */
2065 {
2066 /* If the "routed" flag is set, it means that routing worked before, so
2067 this check can give OK (the saved return code value, if set, belongs to a
2068 callout that was done previously). If the "routed" flag is not set, routing
2069 must have failed, so we use the saved return code. */
2070
2071 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2072 {
2073 rc = sender_vaddr->special_action;
2074 *basic_errno = sender_vaddr->basic_errno;
2075 }
2076 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2077 }
2078
2079 /* Do a new verification, and cache the result. The cache is used to avoid
2080 verifying the sender multiple times for multiple RCPTs when callouts are not
2081 specified (see comments above).
2082
2083 The cache is also used on failure to give details in response to the first
2084 RCPT that gets bounced for this reason. However, this can be suppressed by
2085 the no_details option, which sets the flag that says "this detail has already
2086 been sent". The cache normally contains just one address, but there may be
2087 more in esoteric circumstances. */
2088
2089 else
2090 {
2091 BOOL routed = TRUE;
2a3eea10 2092 uschar *save_address_data = deliver_address_data;
8e669ac1 2093
059ec3d9 2094 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
f358d5e0 2095#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH		 2096 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2097 {
2098 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2099 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2100 }
f358d5e0 2101#endif
059ec3d9
PH		 2102 if (no_details) setflag(sender_vaddr, af_sverify_told);
2103 if (verify_sender_address[0] != 0)
2104 {
2105 /* If this is the real sender address, save the unrewritten version
2106 for use later in receive. Otherwise, set a flag so that rewriting the
2107 sender in verify_address() does not update sender_address. */
2108
2109 if (verify_sender_address == sender_address)
2110 sender_address_unrewritten = sender_address;
2111 else
2112 verify_options |= vopt_fake_sender;
2113
eafd343b
TK		 2114 if (success_on_redirect)
2115 verify_options |= vopt_success_on_redirect;
2116
059ec3d9
PH		 2117 /* The recipient, qualify, and expn options are never set in
2118 verify_options. */
2119
2120 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2121 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2122
2123 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2124
2125 if (rc == OK)
2126 {
2127 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2128 {
2129 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2130 verify_sender_address, sender_vaddr->address);
2131 }
2132 else
2133 {
2134 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2135 verify_sender_address);
2136 }
2137 }
2138 else *basic_errno = sender_vaddr->basic_errno;
2139 }
2140 else rc = OK; /* Null sender */
2141
2142 /* Cache the result code */
2143
2144 if (routed) setflag(sender_vaddr, af_verify_routed);
2145 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2146 sender_vaddr->special_action = rc;
2147 sender_vaddr->next = sender_verified_list;
2148 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2149
2150 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2151 the sender verification. */
8e669ac1 2152
2a3eea10 2153 deliver_address_data = save_address_data;
059ec3d9 2154 }
8e669ac1 2155
2a3eea10
PH		 2156 /* Put the sender address_data value into $sender_address_data */
2157
d43cbe25 2158 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2159 }
2160
2161/* A recipient address just gets a straightforward verify; again we must handle
2162the DEFER overrides. */
2163
2164else
2165 {
2166 address_item addr2;
2167
eafd343b
TK		 2168 if (success_on_redirect)
2169 verify_options |= vopt_success_on_redirect;
2170
059ec3d9
PH		 2171 /* We must use a copy of the address for verification, because it might
2172 get rewritten. */
2173
2174 addr2 = *addr;
2175 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2176 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2177 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2178
42855d71 2179 *basic_errno = addr2.basic_errno;
059ec3d9 2180 *log_msgptr = addr2.message;
8e669ac1 2181 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2182 addr2.user_message : addr2.message;
42855d71
PH		 2183
2184 /* Allow details for temporary error if the address is so flagged. */
2185 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2186
2187 /* Make $address_data visible */
d43cbe25 2188 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2189 }
2190
2191/* We have a result from the relevant test. Handle defer overrides first. */
2192
2193if (rc == DEFER && (defer_ok ||
2194 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2195 {
2196 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2197 defer_ok? "defer_ok" : "callout_defer_ok");
2198 rc = OK;
2199 }
2200
2201/* If we've failed a sender, set up a recipient message, and point
2202sender_verified_failed to the address item that actually failed. */
2203
2204if (rc != OK && verify_sender_address != NULL)
2205 {
2206 if (rc != DEFER)
059ec3d9 2207 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2208 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2209 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2210 else
2211 {
2212 *log_msgptr = US"Could not complete sender verify callout";
2213 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2214 *log_msgptr;
2215 }
2216
2217 sender_verified_failed = sender_vaddr;
2218 }
2219
2220/* Verifying an address messes up the values of $domain and $local_part,
2221so reset them before returning if this is a RCPT ACL. */
2222
2223if (addr != NULL)
2224 {
2225 deliver_domain = addr->domain;
2226 deliver_localpart = addr->local_part;
2227 }
2228return rc;
2229
2230/* Syntax errors in the verify argument come here. */
2231
2232BAD_VERIFY:
2233*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2234 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2235 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2236 "\"verify %s\"", arg);
2237return ERROR;
2238}
2239
2240
2241
2242
2243/*************************************************
2244* Check argument for control= modifier *
2245*************************************************/
2246
2247/* Called from acl_check_condition() below
2248
2249Arguments:
2250 arg the argument string for control=
2251 pptr set to point to the terminating character
2252 where which ACL we are in
2253 log_msgptr for error messages
2254
2255Returns: CONTROL_xxx value
2256*/
2257
2258static int
55414b25 2259decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2260{
2261int len;
2262control_def *d;
2263
2264for (d = controls_list;
2265 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2266 d++)
2267 {
2268 len = Ustrlen(d->name);
2269 if (Ustrncmp(d->name, arg, len) == 0) break;
2270 }
2271
2272if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2273 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2274 {
2275 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2276 return CONTROL_ERROR;
2277 }
2278
059ec3d9
PH		 2279*pptr = arg + len;
2280return d->value;
2281}
2282
2283
2284
c99ce5c9
TF		 2285
2286/*************************************************
2287* Return a ratelimit error *
2288*************************************************/
2289
2290/* Called from acl_ratelimit() below
2291
2292Arguments:
2293 log_msgptr for error messages
2294 format format string
2295 ... supplementary arguments
2296 ss ratelimit option name
2297 where ACL_WHERE_xxxx indicating which ACL this is
2298
2299Returns: ERROR
2300*/
2301
2302static int
2303ratelimit_error(uschar **log_msgptr, const char *format, ...)
2304{
2305va_list ap;
2306uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2307va_start(ap, format);
2308if (!string_vformat(buffer, sizeof(buffer), format, ap))
2309 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2310 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2311va_end(ap);
2312*log_msgptr = string_sprintf(
2313 "error in arguments to \"ratelimit\" condition: %s", buffer);
2314return ERROR;
2315}
2316
2317
2318
2319
870f6ba8
TF		 2320/*************************************************
2321* Handle rate limiting *
2322*************************************************/
2323
2324/* Called by acl_check_condition() below to calculate the result
2325of the ACL ratelimit condition.
2326
2327Note that the return value might be slightly unexpected: if the
2328sender's rate is above the limit then the result is OK. This is
2329similar to the dnslists condition, and is so that you can write
2330ACL clauses like: defer ratelimit = 15 / 1h
2331
2332Arguments:
2333 arg the option string for ratelimit=
90fc3069 2334 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2335 log_msgptr for error messages
2336
2337Returns: OK - Sender's rate is above limit
2338 FAIL - Sender's rate is below limit
2339 DEFER - Problem opening ratelimit database
2340 ERROR - Syntax error in options.
2341*/
2342
2343static int
55414b25 2344acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2345{
c99ce5c9 2346double limit, period, count;
8f240103
PH		 2347uschar *ss;
2348uschar *key = NULL;
c99ce5c9 2349uschar *unique = NULL;
870f6ba8 2350int sep = '/';
c99ce5c9
TF		 2351BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2352BOOL noupdate = FALSE, badacl = FALSE;
2353int mode = RATE_PER_WHAT;
870f6ba8
TF		 2354int old_pool, rc;
2355tree_node **anchor, *t;
2356open_db dbblock, *dbm;
c99ce5c9 2357int dbdb_size;
870f6ba8 2358dbdata_ratelimit *dbd;
c99ce5c9 2359dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2360struct timeval tv;
2361
2362/* Parse the first two options and record their values in expansion
2363variables. These variables allow the configuration to have informative
2364error messages based on rate limits obtained from a table lookup. */
2365
c99ce5c9 2366/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2367size, which must be greater than or equal to zero. Zero is useful for
2368rate measurement as opposed to rate limiting. */
2369
2370sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2371if (sender_rate_limit == NULL)
288644dd 2372 {
870f6ba8 2373 limit = -1.0;
288644dd
JH		 2374 ss = NULL; /* compiler quietening */
2375 }
870f6ba8
TF		 2376else
2377 {
2378 limit = Ustrtod(sender_rate_limit, &ss);
2379 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2380 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2381 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2382 }
c99ce5c9
TF		 2383if (limit < 0.0 || *ss != '\0')
2384 return ratelimit_error(log_msgptr,
2385 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2386
c99ce5c9 2387/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2388constant. This must be strictly greater than zero, because zero leads to
2389run-time division errors. */
2390
2391sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2392if (sender_rate_period == NULL) period = -1.0;
2393else period = readconf_readtime(sender_rate_period, 0, FALSE);
2394if (period <= 0.0)
c99ce5c9
TF		 2395 return ratelimit_error(log_msgptr,
2396 "\"%s\" is not a time value", sender_rate_period);
2397
2398/* By default we are counting one of something, but the per_rcpt,
2399per_byte, and count options can change this. */
2400
2401count = 1.0;
870f6ba8 2402
c99ce5c9 2403/* Parse the other options. */
870f6ba8
TF		 2404
2405while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2406 != NULL)
2407 {
2408 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2409 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2410 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2411 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2412 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2413 else if (strcmpic(ss, US"per_conn") == 0)
2414 {
2415 RATE_SET(mode, PER_CONN);
2416 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2417 badacl = TRUE;
2418 }
2419 else if (strcmpic(ss, US"per_mail") == 0)
2420 {
2421 RATE_SET(mode, PER_MAIL);
2422 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2423 }
2424 else if (strcmpic(ss, US"per_rcpt") == 0)
2425 {
2426 /* If we are running in the RCPT ACL, then we'll count the recipients
2427 one by one, but if we are running when we have accumulated the whole
2428 list then we'll add them all in one batch. */
2429 if (where == ACL_WHERE_RCPT)
2430 RATE_SET(mode, PER_RCPT);
2431 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2432 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2433 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2434 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2435 }
2436 else if (strcmpic(ss, US"per_byte") == 0)
2437 {
2438 /* If we have not yet received the message data and there was no SIZE
2439 declaration on the MAIL comand, then it's safe to just use a value of
2440 zero and let the recorded rate decay as if nothing happened. */
2441 RATE_SET(mode, PER_MAIL);
2442 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2443 else count = message_size < 0 ? 0.0 : (double)message_size;
2444 }
2445 else if (strcmpic(ss, US"per_addr") == 0)
2446 {
2447 RATE_SET(mode, PER_RCPT);
438257ba 2448 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2449 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2450 }
2451 else if (strncmpic(ss, US"count=", 6) == 0)
2452 {
2453 uschar *e;
2454 count = Ustrtod(ss+6, &e);
2455 if (count < 0.0 || *e != '\0')
2456 return ratelimit_error(log_msgptr,
2457 "\"%s\" is not a positive number", ss);
2458 }
2459 else if (strncmpic(ss, US"unique=", 7) == 0)
2460 unique = string_copy(ss + 7);
2461 else if (key == NULL)
2462 key = string_copy(ss);
2463 else
2464 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2465 }
2466
c99ce5c9
TF		 2467/* Sanity check. When the badacl flag is set the update mode must either
2468be readonly (which is the default if it is omitted) or, for backwards
2469compatibility, a combination of noupdate and strict or leaky. */
2470
2471if (mode == RATE_PER_CLASH)
2472 return ratelimit_error(log_msgptr, "conflicting per_* options");
2473if (leaky + strict + readonly > 1)
2474 return ratelimit_error(log_msgptr, "conflicting update modes");
2475if (badacl && (leaky || strict) && !noupdate)
2476 return ratelimit_error(log_msgptr,
2477 "\"%s\" must not have /leaky or /strict option in %s ACL",
2478 ratelimit_option_string[mode], acl_wherenames[where]);
2479
2480/* Set the default values of any unset options. In readonly mode we
2481perform the rate computation without any increment so that its value
2482decays to eventually allow over-limit senders through. */
2483
2484if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2485if (badacl) readonly = TRUE;
2486if (readonly) count = 0.0;
2487if (!strict && !readonly) leaky = TRUE;
2488if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2489
8f240103
PH		 2490/* Create the lookup key. If there is no explicit key, use sender_host_address.
2491If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2492omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2493are added to the key because they alter the meaning of the stored data. */
2494
2495if (key == NULL)
2496 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2497
c99ce5c9 2498key = string_sprintf("%s/%s/%s%s",
8f240103 2499 sender_rate_period,
c99ce5c9
TF		 2500 ratelimit_option_string[mode],
2501 unique == NULL ? "" : "unique/",
8f240103 2502 key);
870f6ba8 2503
c99ce5c9
TF		 2504HDEBUG(D_acl)
2505 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2506
8f240103
PH		 2507/* See if we have already computed the rate by looking in the relevant tree.
2508For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2509pool so that they survive across resets. In readonly mode we only remember the
2510result for the rest of this command in case a later command changes it. After
2511this bit of logic the code is independent of the per_* mode. */
870f6ba8 2512
870f6ba8
TF		 2513old_pool = store_pool;
2514
c99ce5c9
TF		 2515if (readonly)
2516 anchor = &ratelimiters_cmd;
2517else switch(mode) {
2518case RATE_PER_CONN:
870f6ba8
TF		 2519 anchor = &ratelimiters_conn;
2520 store_pool = POOL_PERM;
c99ce5c9
TF		 2521 break;
2522case RATE_PER_BYTE:
2523case RATE_PER_MAIL:
2524case RATE_PER_ALLRCPTS:
870f6ba8 2525 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2526 break;
2527case RATE_PER_ADDR:
2528case RATE_PER_CMD:
2529case RATE_PER_RCPT:
fe0dab11 2530 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2531 break;
2532default:
3399bb60 2533 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2534 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2535 "internal ACL error: unknown ratelimit mode %d", mode);
2536 break;
2537}
870f6ba8 2538
c99ce5c9
TF		 2539t = tree_search(*anchor, key);
2540if (t != NULL)
870f6ba8
TF		 2541 {
2542 dbd = t->data.ptr;
2543 /* The following few lines duplicate some of the code below. */
8f240103 2544 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2545 store_pool = old_pool;
2546 sender_rate = string_sprintf("%.1f", dbd->rate);
2547 HDEBUG(D_acl)
2548 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2549 return rc;
2550 }
2551
c99ce5c9
TF		 2552/* We aren't using a pre-computed rate, so get a previously recorded rate
2553from the database, which will be updated and written back if required. */
870f6ba8
TF		 2554
2555dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2556if (dbm == NULL)
2557 {
2558 store_pool = old_pool;
2559 sender_rate = NULL;
2560 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2561 *log_msgptr = US"ratelimit database not available";
2562 return DEFER;
2563 }
c99ce5c9
TF		 2564dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2565dbd = NULL;
870f6ba8
TF		 2566
2567gettimeofday(&tv, NULL);
2568
c99ce5c9
TF		 2569if (dbdb != NULL)
2570 {
2571 /* Locate the basic ratelimit block inside the DB data. */
2572 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2573 dbd = &dbdb->dbd;
2574
2575 /* Forget the old Bloom filter if it is too old, so that we count each
2576 repeating event once per period. We don't simply clear and re-use the old
2577 filter because we want its size to change if the limit changes. Note that
2578 we keep the dbd pointer for copying the rate into the new data block. */
2579
2580 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2581 {
2582 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2583 dbdb = NULL;
2584 }
2585
2586 /* Sanity check. */
2587
2588 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2589 {
2590 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2591 dbdb = NULL;
2592 }
2593 }
2594
2595/* Allocate a new data block if the database lookup failed
2596or the Bloom filter passed its age limit. */
2597
2598if (dbdb == NULL)
2599 {
2600 if (unique == NULL)
2601 {
2602 /* No Bloom filter. This basic ratelimit block is initialized below. */
2603 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2604 dbdb_size = sizeof(*dbd);
2605 dbdb = store_get(dbdb_size);
2606 }
2607 else
2608 {
2609 int extra;
2610 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2611
2612 /* See the long comment below for an explanation of the magic number 2.
2613 The filter has a minimum size in case the rate limit is very small;
2614 this is determined by the definition of dbdata_ratelimit_unique. */
2615
2616 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2617 if (extra < 0) extra = 0;
2618 dbdb_size = sizeof(*dbdb) + extra;
2619 dbdb = store_get(dbdb_size);
2620 dbdb->bloom_epoch = tv.tv_sec;
2621 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2622 memset(dbdb->bloom, 0, dbdb->bloom_size);
2623
2624 /* Preserve any basic ratelimit data (which is our longer-term memory)
2625 by copying it from the discarded block. */
2626
2627 if (dbd != NULL)
2628 {
2629 dbdb->dbd = *dbd;
2630 dbd = &dbdb->dbd;
2631 }
2632 }
2633 }
2634
2635/* If we are counting unique events, find out if this event is new or not.
2636If the client repeats the event during the current period then it should be
2637counted. We skip this code in readonly mode for efficiency, because any
2638changes to the filter will be discarded and because count is already set to
2639zero. */
2640
2641if (unique != NULL && !readonly)
2642 {
2643 /* We identify unique events using a Bloom filter. (You can find my
2644 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2645 With the per_addr option, an "event" is a recipient address, though the
2646 user can use the unique option to define their own events. We only count
2647 an event if we have not seen it before.
2648
2649 We size the filter according to the rate limit, which (in leaky mode)
2650 is the limit on the population of the filter. We allow 16 bits of space
2651 per entry (see the construction code above) and we set (up to) 8 of them
2652 when inserting an element (see the loop below). The probability of a false
2653 positive (an event we have not seen before but which we fail to count) is
2654
2655 size = limit * 16
2656 numhash = 8
2657 allzero = exp(-numhash * pop / size)
2658 = exp(-0.5 * pop / limit)
2659 fpr = pow(1 - allzero, numhash)
2660
2661 For senders at the limit the fpr is 0.06% or 1 in 1700
2662 and for senders at half the limit it is 0.0006% or 1 in 170000
2663
2664 In strict mode the Bloom filter can fill up beyond the normal limit, in
2665 which case the false positive rate will rise. This means that the
2666 measured rate for very fast senders can bogusly drop off after a while.
2667
2668 At twice the limit, the fpr is 2.5% or 1 in 40
2669 At four times the limit, it is 31% or 1 in 3.2
2670
2671 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2672 decay below the limit, and if this is more than one then the Bloom filter
2673 will be discarded before the decay gets that far. The false positive rate
2674 at this threshold is 9.3% or 1 in 10.7. */
2675
2676 BOOL seen;
2677 unsigned n, hash, hinc;
2678 uschar md5sum[16];
2679 md5 md5info;
2680
2681 /* Instead of using eight independent hash values, we combine two values
2682 using the formula h1 + n * h2. This does not harm the Bloom filter's
2683 performance, and means the amount of hash we need is independent of the
2684 number of bits we set in the filter. */
2685
2686 md5_start(&md5info);
2687 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2688 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2689 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2690
2691 /* Scan the bits corresponding to this event. A zero bit means we have
2692 not seen it before. Ensure all bits are set to record this event. */
2693
2694 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2695
2696 seen = TRUE;
2697 for (n = 0; n < 8; n++, hash += hinc)
2698 {
2699 int bit = 1 << (hash % 8);
2700 int byte = (hash / 8) % dbdb->bloom_size;
2701 if ((dbdb->bloom[byte] & bit) == 0)
2702 {
2703 dbdb->bloom[byte] |= bit;
2704 seen = FALSE;
2705 }
2706 }
2707
2708 /* If this event has occurred before, do not count it. */
2709
2710 if (seen)
2711 {
2712 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2713 count = 0.0;
2714 }
2715 else
2716 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2717 }
2718
2719/* If there was no previous ratelimit data block for this key, initialize
2720the new one, otherwise update the block from the database. The initial rate
2721is what would be computed by the code below for an infinite interval. */
2722
870f6ba8
TF		 2723if (dbd == NULL)
2724 {
c99ce5c9
TF		 2725 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2726 dbd = &dbdb->dbd;
870f6ba8
TF		 2727 dbd->time_stamp = tv.tv_sec;
2728 dbd->time_usec = tv.tv_usec;
c99ce5c9 2729 dbd->rate = count;
870f6ba8
TF		 2730 }
2731else
2732 {
2733 /* The smoothed rate is computed using an exponentially weighted moving
2734 average adjusted for variable sampling intervals. The standard EWMA for
2735 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2736 where f() is the measured value and f'() is the smoothed value.
2737
2738 Old data decays out of the smoothed value exponentially, such that data n
2739 samples old is multiplied by a^n. The exponential decay time constant p
2740 is defined such that data p samples old is multiplied by 1/e, which means
2741 that a = exp(-1/p). We can maintain the same time constant for a variable
2742 sampling interval i by using a = exp(-i/p).
2743
2744 The rate we are measuring is messages per period, suitable for directly
2745 comparing with the limit. The average rate between now and the previous
2746 message is period / interval, which we feed into the EWMA as the sample.
2747
2748 It turns out that the number of messages required for the smoothed rate
2749 to reach the limit when they are sent in a burst is equal to the limit.
2750 This can be seen by analysing the value of the smoothed rate after N
2751 messages sent at even intervals. Let k = (1 - a) * p/i
2752
2753 rate_1 = (1 - a) * p/i + a * rate_0
2754 = k + a * rate_0
2755 rate_2 = k + a * rate_1
2756 = k + a * k + a^2 * rate_0
2757 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2758 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2759 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2760 = rate_0 * a^N + p/i * (1 - a^N)
2761
2762 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2763
2764 rate_N = p/i + (rate_0 - p/i) * a^N
2765 a^N = (rate_N - p/i) / (rate_0 - p/i)
2766 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2767 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2768
2769 Numerical analysis of the above equation, setting the computed rate to
2770 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2771 rates, p/i, the number of messages N = limit. So limit serves as both the
2772 maximum rate measured in messages per period, and the maximum number of
2773 messages that can be sent in a fast burst. */
2774
2775 double this_time = (double)tv.tv_sec
2776 + (double)tv.tv_usec / 1000000.0;
2777 double prev_time = (double)dbd->time_stamp
2778 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2779
2780 /* We must avoid division by zero, and deal gracefully with the clock going
2781 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2782 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2783
e5d5a95f
TF		 2784 double interval = this_time - prev_time <= 0.0 ? 1e-9
2785 : this_time - prev_time;
2786
2787 double i_over_p = interval / period;
2788 double a = exp(-i_over_p);
870f6ba8 2789
c99ce5c9
TF		 2790 /* Combine the instantaneous rate (period / interval) with the previous rate
2791 using the smoothing factor a. In order to measure sized events, multiply the
2792 instantaneous rate by the count of bytes or recipients etc. */
2793
870f6ba8
TF		 2794 dbd->time_stamp = tv.tv_sec;
2795 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2796 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2797
2798 /* When events are very widely spaced the computed rate tends towards zero.
2799 Although this is accurate it turns out not to be useful for our purposes,
2800 especially when the first event after a long silence is the start of a spam
2801 run. A more useful model is that the rate for an isolated event should be the
2802 size of the event per the period size, ignoring the lack of events outside
2803 the current period and regardless of where the event falls in the period. So,
2804 if the interval was so long that the calculated rate is unhelpfully small, we
2805 re-intialize the rate. In the absence of higher-rate bursts, the condition
2806 below is true if the interval is greater than the period. */
2807
2808 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2809 }
2810
c99ce5c9
TF		 2811/* Clients sending at the limit are considered to be over the limit.
2812This matters for edge cases such as a limit of zero, when the client
2813should be completely blocked. */
3348576f 2814
8f240103 2815rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2816
2817/* Update the state if the rate is low or if we are being strict. If we
2818are in leaky mode and the sender's rate is too high, we do not update
2819the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2820rate preventing them from getting any email through. If readonly is set,
2821neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2822
c99ce5c9 2823if ((rc == FAIL && leaky) || strict)
8f240103 2824 {
c99ce5c9 2825 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2826 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2827 }
2828else
2829 {
2830 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2831 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2832 }
2833
870f6ba8
TF		 2834dbfn_close(dbm);
2835
c99ce5c9 2836/* Store the result in the tree for future reference. */
870f6ba8 2837
c99ce5c9
TF		 2838t = store_get(sizeof(tree_node) + Ustrlen(key));
2839t->data.ptr = dbd;
2840Ustrcpy(t->name, key);
2841(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2842
2843/* We create the formatted version of the sender's rate very late in
2844order to ensure that it is done using the correct storage pool. */
2845
2846store_pool = old_pool;
2847sender_rate = string_sprintf("%.1f", dbd->rate);
2848
2849HDEBUG(D_acl)
2850 debug_printf("ratelimit computed rate %s\n", sender_rate);
2851
2852return rc;
2853}
2854
2855
2856
b0019c78
TF		 2857/*************************************************
2858* The udpsend ACL modifier *
2859*************************************************/
2860
2861/* Called by acl_check_condition() below.
2862
2863Arguments:
2864 arg the option string for udpsend=
2865 log_msgptr for error messages
2866
2867Returns: OK - Completed.
2868 DEFER - Problem with DNS lookup.
2869 ERROR - Syntax error in options.
2870*/
2871
2872static int
55414b25 2873acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2874{
2875int sep = 0;
2876uschar *hostname;
2877uschar *portstr;
2878uschar *portend;
2879host_item *h;
2880int portnum;
b0019c78
TF		 2881int len;
2882int r, s;
b1f8e4f8 2883uschar * errstr;
b0019c78
TF		 2884
2885hostname = string_nextinlist(&arg, &sep, NULL, 0);
2886portstr = string_nextinlist(&arg, &sep, NULL, 0);
2887
2888if (hostname == NULL)
2889 {
217b0e56 2890 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2891 return ERROR;
2892 }
2893if (portstr == NULL)
2894 {
217b0e56 2895 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2896 return ERROR;
2897 }
2898if (arg == NULL)
2899 {
217b0e56 2900 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2901 return ERROR;
2902 }
2903portnum = Ustrtol(portstr, &portend, 10);
2904if (*portend != '\0')
2905 {
217b0e56 2906 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2907 return ERROR;
2908 }
2909
2910/* Make a single-item host list. */
2911h = store_get(sizeof(host_item));
2912memset(h, 0, sizeof(host_item));
2913h->name = hostname;
2914h->port = portnum;
2915h->mx = MX_NONE;
2916
2917if (string_is_ip_address(hostname, NULL))
2918 h->address = hostname, r = HOST_FOUND;
2919else
2920 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2921if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2922 {
217b0e56 2923 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2924 return DEFER;
2925 }
2926
2927HDEBUG(D_acl)
2928 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2929
b1f8e4f8
JH		 2930r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2931 1, NULL, &errstr);
b0019c78 2932if (r < 0) goto defer;
27f9999e 2933len = Ustrlen(arg);
9cb1785a 2934r = send(s, arg, len, 0);
b1f8e4f8
JH		 2935if (r < 0)
2936 {
2937 errstr = US strerror(errno);
2938 close(s);
2939 goto defer;
2940 }
2941close(s);
b0019c78
TF		 2942if (r < len)
2943 {
2944 *log_msgptr =
2945 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2946 return DEFER;
2947 }
2948
2949HDEBUG(D_acl)
2950 debug_printf("udpsend %d bytes\n", r);
2951
2952return OK;
2953
2954defer:
b1f8e4f8 2955*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2956return DEFER;
2957}
2958
2959
2960
059ec3d9
PH		 2961/*************************************************
2962* Handle conditions/modifiers on an ACL item *
2963*************************************************/
2964
2965/* Called from acl_check() below.
2966
2967Arguments:
2968 verb ACL verb
2969 cb ACL condition block - if NULL, result is OK
2970 where where called from
2971 addr the address being checked for RCPT, or NULL
2972 level the nesting level
2973 epp pointer to pass back TRUE if "endpass" encountered
2974 (applies only to "accept" and "discard")
2975 user_msgptr user message pointer
2976 log_msgptr log message pointer
2977 basic_errno pointer to where to put verify error
2978
2979Returns: OK - all conditions are met
2980 DISCARD - an "acl" condition returned DISCARD - only allowed
2981 for "accept" or "discard" verbs
2982 FAIL - at least one condition fails
2983 FAIL_DROP - an "acl" condition returned FAIL_DROP
2984 DEFER - can't tell at the moment (typically, lookup defer,
2985 but can be temporary callout problem)
2986 ERROR - ERROR from nested ACL or expansion failure or other
2987 error
2988*/
2989
2990static int
2991acl_check_condition(int verb, acl_condition_block *cb, int where,
2992 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2993 uschar **log_msgptr, int *basic_errno)
2994{
2995uschar *user_message = NULL;
2996uschar *log_message = NULL;
ed7f7860
PP		 2997uschar *debug_tag = NULL;
2998uschar *debug_opts = NULL;
059ec3d9 2999int rc = OK;
8523533c 3000#ifdef WITH_CONTENT_SCAN
0f0c8159 3001int sep = -'/';
8523533c 3002#endif
059ec3d9
PH		 3003
3004for (; cb != NULL; cb = cb->next)
3005 {
55414b25 3006 const uschar *arg;
8e669ac1 3007 int control_type;
059ec3d9
PH		 3008
3009 /* The message and log_message items set up messages to be used in
3010 case of rejection. They are expanded later. */
3011
3012 if (cb->type == ACLC_MESSAGE)
3013 {
187bc588 3014 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3015 user_message = cb->arg;
3016 continue;
3017 }
3018
3019 if (cb->type == ACLC_LOG_MESSAGE)
3020 {
187bc588 3021 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3022 log_message = cb->arg;
3023 continue;
3024 }
3025
3026 /* The endpass "condition" just sets a flag to show it occurred. This is
3027 checked at compile time to be on an "accept" or "discard" item. */
3028
3029 if (cb->type == ACLC_ENDPASS)
3030 {
3031 *epp = TRUE;
3032 continue;
3033 }
3034
3035 /* For other conditions and modifiers, the argument is expanded now for some
3036 of them, but not for all, because expansion happens down in some lower level
3037 checking functions in some cases. */
3038
3039 if (cond_expand_at_top[cb->type])
3040 {
3041 arg = expand_string(cb->arg);
3042 if (arg == NULL)
3043 {
3044 if (expand_string_forcedfail) continue;
3045 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3046 cb->arg, expand_string_message);
3047 return search_find_defer? DEFER : ERROR;
3048 }
3049 }
3050 else arg = cb->arg;
3051
3052 /* Show condition, and expanded condition if it's different */
3053
3054 HDEBUG(D_acl)
3055 {
3056 int lhswidth = 0;
3057 debug_printf("check %s%s %n",
3058 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3059 conditions[cb->type], &lhswidth);
3060
3061 if (cb->type == ACLC_SET)
3062 {
38a0a95f
PH		 3063 debug_printf("acl_%s ", cb->u.varname);
3064 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3065 }
3066
3067 debug_printf("= %s\n", cb->arg);
3068
3069 if (arg != cb->arg)
3070 debug_printf("%.*s= %s\n", lhswidth,
3071 US" ", CS arg);
3072 }
3073
3074 /* Check that this condition makes sense at this time */
3075
3076 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3077 {
3078 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3079 cond_modifiers[cb->type]? "use" : "test",
3080 conditions[cb->type], acl_wherenames[where]);
3081 return ERROR;
3082 }
3083
3084 /* Run the appropriate test for each condition, or take the appropriate
3085 action for the remaining modifiers. */
3086
3087 switch(cb->type)
3088 {
71fafd95
PH		 3089 case ACLC_ADD_HEADER:
3090 setup_header(arg);
3091 break;
3092
059ec3d9
PH		 3093 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3094 "discard" verb. */
71fafd95 3095
059ec3d9 3096 case ACLC_ACL:
f60d98e8 3097 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3098 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3099 {
3100 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3101 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3102 verbs[verb]);
3103 return ERROR;
3104 }
059ec3d9
PH		 3105 break;
3106
3107 case ACLC_AUTHENTICATED:
3108 rc = (sender_host_authenticated == NULL)? FAIL :
3109 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3110 TRUE, NULL);
3111 break;
3112
71fafd95 3113 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3114 case ACLC_BMI_OPTIN:
3115 {
3116 int old_pool = store_pool;
3117 store_pool = POOL_PERM;
3118 bmi_current_optin = string_copy(arg);
3119 store_pool = old_pool;
3120 }
3121 break;
71fafd95 3122 #endif
8523533c 3123
059ec3d9 3124 case ACLC_CONDITION:
f3766eb5
NM		 3125 /* The true/false parsing here should be kept in sync with that used in
3126 expand.c when dealing with ECOND_BOOL so that we don't have too many
3127 different definitions of what can be a boolean. */
51c7471d
JH		 3128 if (*arg == '-'
3129 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3130 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3131 rc = (Uatoi(arg) == 0)? FAIL : OK;
3132 else
3133 rc = (strcmpic(arg, US"no") == 0 ||
3134 strcmpic(arg, US"false") == 0)? FAIL :
3135 (strcmpic(arg, US"yes") == 0 ||
3136 strcmpic(arg, US"true") == 0)? OK : DEFER;
3137 if (rc == DEFER)
3138 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3139 break;
3140
c3611384
PH		 3141 case ACLC_CONTINUE: /* Always succeeds */
3142 break;
3143
059ec3d9 3144 case ACLC_CONTROL:
c5fcb476 3145 {
55414b25
JH		 3146 const uschar *p = NULL;
3147 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3148
55414b25 3149 /* Check if this control makes sense at this time */
f7572e5a 3150
55414b25
JH		 3151 if ((control_forbids[control_type] & (1 << where)) != 0)
3152 {
3153 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3154 controls[control_type], acl_wherenames[where]);
3155 return ERROR;
3156 }
8800895a 3157
55414b25
JH		 3158 switch(control_type)
3159 {
3160 case CONTROL_AUTH_UNADVERTISED:
3161 allow_auth_unadvertised = TRUE;
3162 break;
3163
3164 #ifdef EXPERIMENTAL_BRIGHTMAIL
3165 case CONTROL_BMI_RUN:
3166 bmi_run = 1;
3167 break;
3168 #endif
3169
3170 #ifndef DISABLE_DKIM
3171 case CONTROL_DKIM_VERIFY:
3172 dkim_disable_verify = TRUE;
3173 #ifdef EXPERIMENTAL_DMARC
3174 /* Since DKIM was blocked, skip DMARC too */
3175 dmarc_disable_verify = TRUE;
3176 dmarc_enable_forensic = FALSE;
3177 #endif
3178 break;
3179 #endif
3180
3181 #ifdef EXPERIMENTAL_DMARC
3182 case CONTROL_DMARC_VERIFY:
3183 dmarc_disable_verify = TRUE;
3184 break;
3185
3186 case CONTROL_DMARC_FORENSIC:
3187 dmarc_enable_forensic = TRUE;
3188 break;
3189 #endif
3190
3191 case CONTROL_DSCP:
3192 if (*p == '/')
3193 {
3194 int fd, af, level, optname, value;
3195 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3196 a socket; we can accept that, we'll just debug-log failures anyway. */
3197 fd = fileno(smtp_in);
3198 af = ip_get_address_family(fd);
3199 if (af < 0)
3200 {
3201 HDEBUG(D_acl)
3202 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3203 strerror(errno));
3204 break;
3205 }
3206 if (dscp_lookup(p+1, af, &level, &optname, &value))
3207 {
3208 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3209 {
3210 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3211 p+1, strerror(errno));
3212 }
3213 else
3214 {
3215 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3216 }
3217 }
3218 else
3219 {
3220 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3221 return ERROR;
3222 }
3223 }
3224 else
3225 {
3226 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3227 return ERROR;
3228 }
3229 break;
3230
3231 case CONTROL_ERROR:
3232 return ERROR;
3233
3234 case CONTROL_CASEFUL_LOCAL_PART:
3235 deliver_localpart = addr->cc_local_part;
3236 break;
3237
3238 case CONTROL_CASELOWER_LOCAL_PART:
3239 deliver_localpart = addr->lc_local_part;
3240 break;
3241
3242 case CONTROL_ENFORCE_SYNC:
3243 smtp_enforce_sync = TRUE;
3244 break;
3245
3246 case CONTROL_NO_ENFORCE_SYNC:
3247 smtp_enforce_sync = FALSE;
3248 break;
3249
3250 #ifdef WITH_CONTENT_SCAN
3251 case CONTROL_NO_MBOX_UNSPOOL:
3252 no_mbox_unspool = TRUE;
3253 break;
3254 #endif
3255
3256 case CONTROL_NO_MULTILINE:
3257 no_multiline_responses = TRUE;
3258 break;
3259
3260 case CONTROL_NO_PIPELINING:
3261 pipelining_enable = FALSE;
3262 break;
3263
3264 case CONTROL_NO_DELAY_FLUSH:
3265 disable_delay_flush = TRUE;
3266 break;
3267
3268 case CONTROL_NO_CALLOUT_FLUSH:
3269 disable_callout_flush = TRUE;
3270 break;
3271
3272 case CONTROL_FAKEREJECT:
3273 cancel_cutthrough_connection("fakereject");
3274 case CONTROL_FAKEDEFER:
3275 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3276 if (*p == '/')
3277 {
3278 const uschar *pp = p + 1;
3279 while (*pp != 0) pp++;
3280 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3281 p = pp;
3282 }
3283 else
3284 {
3285 /* Explicitly reset to default string */
3286 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3287 }
3288 break;
ed7f7860 3289
55414b25
JH		 3290 case CONTROL_FREEZE:
3291 deliver_freeze = TRUE;
3292 deliver_frozen_at = time(NULL);
3293 freeze_tell = freeze_tell_config; /* Reset to configured value */
3294 if (Ustrncmp(p, "/no_tell", 8) == 0)
3295 {
3296 p += 8;
3297 freeze_tell = NULL;
3298 }
3299 if (*p != 0)
3300 {
3301 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3302 return ERROR;
3303 }
3304 cancel_cutthrough_connection("item frozen");
3305 break;
3306
3307 case CONTROL_QUEUE_ONLY:
3308 queue_only_policy = TRUE;
3309 cancel_cutthrough_connection("queueing forced");
3310 break;
3311
3312 case CONTROL_SUBMISSION:
3313 originator_name = US"";
3314 submission_mode = TRUE;
3315 while (*p == '/')
3316 {
3317 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3318 {
3319 p += 14;
3320 active_local_sender_retain = TRUE;
3321 active_local_from_check = FALSE;
3322 }
3323 else if (Ustrncmp(p, "/domain=", 8) == 0)
3324 {
3325 const uschar *pp = p + 8;
3326 while (*pp != 0 && *pp != '/') pp++;
3327 submission_domain = string_copyn(p+8, pp-p-8);
3328 p = pp;
3329 }
3330 /* The name= option must be last, because it swallows the rest of
3331 the string. */
3332 else if (Ustrncmp(p, "/name=", 6) == 0)
3333 {
3334 const uschar *pp = p + 6;
3335 while (*pp != 0) pp++;
3336 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3337 big_buffer, big_buffer_size));
3338 p = pp;
3339 }
3340 else break;
3341 }
3342 if (*p != 0)
3343 {
3344 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3345 return ERROR;
3346 }
3347 break;
e4bdf652 3348
55414b25
JH		 3349 case CONTROL_DEBUG:
3350 while (*p == '/')
3351 {
3352 if (Ustrncmp(p, "/tag=", 5) == 0)
3353 {
3354 const uschar *pp = p + 5;
3355 while (*pp != '\0' && *pp != '/') pp++;
3356 debug_tag = string_copyn(p+5, pp-p-5);
3357 p = pp;
3358 }
3359 else if (Ustrncmp(p, "/opts=", 6) == 0)
3360 {
3361 const uschar *pp = p + 6;
3362 while (*pp != '\0' && *pp != '/') pp++;
3363 debug_opts = string_copyn(p+6, pp-p-6);
3364 p = pp;
3365 }
3366 }
3367 debug_logging_activate(debug_tag, debug_opts);
3368 break;
3369
3370 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3371 suppress_local_fixups = TRUE;
3372 break;
3373
3374 case CONTROL_CUTTHROUGH_DELIVERY:
3375 if (prdr_requested)
3376 /* Too hard to think about for now. We might in future cutthrough
3377 the case where both sides handle prdr and this-node prdr acl
3378 is "accept" */
93a6fce2 3379 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3380 else
3381 {
55414b25
JH		 3382 if (deliver_freeze)
3383 *log_msgptr = US"frozen";
3384 else if (queue_only_policy)
3385 *log_msgptr = US"queue-only";
3386 else if (fake_response == FAIL)
3387 *log_msgptr = US"fakereject";
3388 else
3389 {
3390 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3391 break;
3392 }
3393 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3394 arg, *log_msgptr);
5032d1cf 3395 }
55414b25 3396 return ERROR;
3c8b3577
JH		 3397
3398 #ifdef EXPERIMENTAL_INTERNATIONAL
3399 case CONTROL_UTF8_DOWNCONVERT:
3400 if (*p == '/')
3401 {
921dfc11
JH		 3402 if (p[1] == '1')
3403 {
3404 message_utf8_downconvert = 1;
3405 addr->prop.utf8_downcvt = TRUE;
3406 addr->prop.utf8_downcvt_maybe = FALSE;
3407 p += 2;
3408 break;
3409 }
3410 if (p[1] == '0')
3411 {
3412 message_utf8_downconvert = 0;
3413 addr->prop.utf8_downcvt = FALSE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 p += 2;
3416 break;
3417 }
3c8b3577 3418 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3419 {
3420 message_utf8_downconvert = -1;
3421 addr->prop.utf8_downcvt = FALSE;
3422 addr->prop.utf8_downcvt_maybe = TRUE;
3423 p += 3;
3424 break;
3425 }
3c8b3577
JH		 3426 *log_msgptr = US"bad option value for control=utf8_downconvert";
3427 }
3428 else
3429 {
921dfc11
JH		 3430 message_utf8_downconvert = 1;
3431 addr->prop.utf8_downcvt = TRUE;
3432 addr->prop.utf8_downcvt_maybe = FALSE;
3433 break;
3c8b3577
JH		 3434 }
3435 return ERROR;
3436 #endif
3437
9171d434 3438 }
55414b25 3439 break;
059ec3d9 3440 }
059ec3d9 3441
6a8f9482
TK		 3442 #ifdef EXPERIMENTAL_DCC
3443 case ACLC_DCC:
3444 {
3445 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3446 const uschar * list = arg;
3447 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3448 /* Run the dcc backend. */
3449 rc = dcc_process(&ss);
3450 /* Modify return code based upon the existance of options. */
3c8b3577 3451 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3452 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3453 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3454 }
3455 break;
3456 #endif
3457
71fafd95 3458 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3459 case ACLC_DECODE:
3460 rc = mime_decode(&arg);
3461 break;
71fafd95 3462 #endif
8523533c 3463
059ec3d9
PH		 3464 case ACLC_DELAY:
3465 {
3466 int delay = readconf_readtime(arg, 0, FALSE);
3467 if (delay < 0)
3468 {
3469 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3470 "modifier: \"%s\" is not a time value", arg);
3471 return ERROR;
3472 }
3473 else
3474 {
3475 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3476 delay);
3477 if (host_checking)
3478 {
3479 HDEBUG(D_acl)
3480 debug_printf("delay skipped in -bh checking mode\n");
3481 }
010c2d14
PH		 3482
3483 /* It appears to be impossible to detect that a TCP/IP connection has
3484 gone away without reading from it. This means that we cannot shorten
3485 the delay below if the client goes away, because we cannot discover
3486 that the client has closed its end of the connection. (The connection
3487 is actually in a half-closed state, waiting for the server to close its
3488 end.) It would be nice to be able to detect this state, so that the
3489 Exim process is not held up unnecessarily. However, it seems that we
3490 can't. The poll() function does not do the right thing, and in any case
3491 it is not always available.
3492
047bdd8c 3493 NOTE 1: If ever this state of affairs changes, remember that we may be
010c2d14 3494 dealing with stdin/stdout here, in addition to TCP/IP connections.
047bdd8c
PH		 3495 Also, delays may be specified for non-SMTP input, where smtp_out and
3496 smtp_in will be NULL. Whatever is done must work in all cases.
3497
3498 NOTE 2: The added feature of flushing the output before a delay must
3499 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3500 */
010c2d14 3501
8e669ac1 3502 else
86b8287f 3503 {
14f4a80d 3504 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
86b8287f 3505 while (delay > 0) delay = sleep(delay);
8e669ac1 3506 }
059ec3d9
PH		 3507 }
3508 }
3509 break;
3510
71fafd95 3511 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3512 case ACLC_DEMIME:
3513 rc = demime(&arg);
3514 break;
71fafd95 3515 #endif
8523533c 3516
80a47a2c
TK		 3517 #ifndef DISABLE_DKIM
3518 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3519 if (dkim_cur_signer != NULL)
3520 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3521 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3522 else
80a47a2c 3523 rc = FAIL;
71fafd95
PH		 3524 break;
3525
80a47a2c
TK		 3526 case ACLC_DKIM_STATUS:
3527 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3528 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3529 break;
3530 #endif
fb2274d4 3531
4840604e
TL		 3532 #ifdef EXPERIMENTAL_DMARC
3533 case ACLC_DMARC_STATUS:
4a8ce2d8 3534 if (!dmarc_has_been_checked)
4840604e 3535 dmarc_process();
4a8ce2d8 3536 dmarc_has_been_checked = TRUE;
4840604e
TL		 3537 /* used long way of dmarc_exim_expand_query() in case we need more
3538 * view into the process in the future. */
3539 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3540 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3541 break;
3542 #endif
3543
059ec3d9
PH		 3544 case ACLC_DNSLISTS:
3545 rc = verify_check_dnsbl(&arg);
3546 break;
3547
3548 case ACLC_DOMAINS:
3549 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3550 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3551 break;
3552
3553 /* The value in tls_cipher is the full cipher name, for example,
3554 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3555 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3556 what may in practice come out of the SSL library - which at the time of
3557 writing is poorly documented. */
3558
3559 case ACLC_ENCRYPTED:
817d9f57 3560 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3561 {
3562 uschar *endcipher = NULL;
817d9f57
JH		 3563 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3564 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3565 {
3566 endcipher = Ustrchr(++cipher, ':');
3567 if (endcipher != NULL) *endcipher = 0;
3568 }
3569 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3570 if (endcipher != NULL) *endcipher = ':';
3571 }
3572 break;
3573
3574 /* Use verify_check_this_host() instead of verify_check_host() so that
3575 we can pass over &host_data to catch any looked up data. Once it has been
3576 set, it retains its value so that it's still there if another ACL verb
3577 comes through here and uses the cache. However, we must put it into
3578 permanent store in case it is also expected to be used in a subsequent
3579 message in the same SMTP connection. */
3580
3581 case ACLC_HOSTS:
3582 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3583 (sender_host_address == NULL)? US"" : sender_host_address,
3584 CUSS &host_data);
4a452c43
JH		 3585 if (rc == DEFER) *log_msgptr = search_error_message;
3586 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3587 break;
3588
3589 case ACLC_LOCAL_PARTS:
3590 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3591 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3592 CUSS &deliver_localpart_data);
059ec3d9
PH		 3593 break;
3594
6ea85e9a
PH		 3595 case ACLC_LOG_REJECT_TARGET:
3596 {
3597 int logbits = 0;
3598 int sep = 0;
55414b25 3599 const uschar *s = arg;
6ea85e9a 3600 uschar *ss;
4a452c43 3601 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3602 {
3603 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3604 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3605 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3606 else
3607 {
3608 logbits |= LOG_MAIN|LOG_REJECT;
3609 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3610 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3611 }
3612 }
3613 log_reject_target = logbits;
3614 }
3615 break;
3616
059ec3d9
PH		 3617 case ACLC_LOGWRITE:
3618 {
3619 int logbits = 0;
55414b25 3620 const uschar *s = arg;
059ec3d9
PH		 3621 if (*s == ':')
3622 {
3623 s++;
3624 while (*s != ':')
3625 {
3626 if (Ustrncmp(s, "main", 4) == 0)
3627 { logbits |= LOG_MAIN; s += 4; }
3628 else if (Ustrncmp(s, "panic", 5) == 0)
3629 { logbits |= LOG_PANIC; s += 5; }
3630 else if (Ustrncmp(s, "reject", 6) == 0)
3631 { logbits |= LOG_REJECT; s += 6; }
3632 else
3633 {
3634 logbits = LOG_MAIN|LOG_PANIC;
3635 s = string_sprintf(":unknown log name in \"%s\" in "
3636 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3637 }
3638 if (*s == ',') s++;
3639 }
3640 s++;
3641 }
3642 while (isspace(*s)) s++;
6ea85e9a
PH		 3643
3644
059ec3d9
PH		 3645 if (logbits == 0) logbits = LOG_MAIN;
3646 log_write(0, logbits, "%s", string_printing(s));
3647 }
3648 break;
8e669ac1 3649
71fafd95 3650 #ifdef WITH_CONTENT_SCAN
0f0c8159 3651 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3652 {
6ea85e9a 3653 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3654 const uschar * list = arg;
3655 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3656 uschar *opt;
3657 BOOL defer_ok = FALSE;
3658 int timeout = 0;
3659
55414b25 3660 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3661 if (strcmpic(opt, US"defer_ok") == 0)
3662 defer_ok = TRUE;
3663 else if ( strncmpic(opt, US"tmo=", 4) == 0
3664 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3665 )
3666 {
3667 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3668 return ERROR;
3669 }
3670
3671 rc = malware(ss, timeout);
3672 if (rc == DEFER && defer_ok)
3673 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3674 }
3675 break;
3676
3677 case ACLC_MIME_REGEX:
71fafd95 3678 rc = mime_regex(&arg);
8523533c 3679 break;
71fafd95 3680 #endif
059ec3d9 3681
870f6ba8 3682 case ACLC_RATELIMIT:
90fc3069 3683 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3684 break;
3685
059ec3d9 3686 case ACLC_RECIPIENTS:
55414b25
JH		 3687 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3688 CUSS &recipient_data);
059ec3d9
PH		 3689 break;
3690
71fafd95
PH		 3691 #ifdef WITH_CONTENT_SCAN
3692 case ACLC_REGEX:
3693 rc = regex(&arg);
8523533c 3694 break;
71fafd95 3695 #endif
8523533c 3696
e7568d51
TL		 3697 case ACLC_REMOVE_HEADER:
3698 setup_remove_header(arg);
3699 break;
3700
059ec3d9
PH		 3701 case ACLC_SENDER_DOMAINS:
3702 {
3703 uschar *sdomain;
3704 sdomain = Ustrrchr(sender_address, '@');
3705 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3706 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3707 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3708 }
3709 break;
3710
3711 case ACLC_SENDERS:
55414b25
JH		 3712 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3713 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3714 break;
3715
3716 /* Connection variables must persist forever */
3717
3718 case ACLC_SET:
3719 {
3720 int old_pool = store_pool;
38a0a95f
PH		 3721 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3722 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3723 store_pool = old_pool;
3724 }
3725 break;
3726
71fafd95 3727 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3728 case ACLC_SPAM:
3729 {
3730 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3731 const uschar * list = arg;
3732 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3733 /* Run the spam backend. */
55414b25 3734 rc = spam(CUSS &ss);
8523533c 3735 /* Modify return code based upon the existance of options. */
55414b25 3736 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3737 != NULL) {
3738 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3739 {
3740 /* FAIL so that the message is passed to the next ACL */
3741 rc = FAIL;
3742 }
3743 }
3744 }
3745 break;
71fafd95 3746 #endif
8523533c 3747
71fafd95 3748 #ifdef EXPERIMENTAL_SPF
8523533c 3749 case ACLC_SPF:
65a7d8c3
NM		 3750 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3751 break;
3752 case ACLC_SPF_GUESS:
3753 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3754 break;
71fafd95 3755 #endif
8523533c 3756
b0019c78
TF		 3757 case ACLC_UDPSEND:
3758 rc = acl_udpsend(arg, log_msgptr);
3759 break;
3760
059ec3d9
PH		 3761 /* If the verb is WARN, discard any user message from verification, because
3762 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3763 only from explicit "message" modifiers. However, put the user message into
3764 $acl_verify_message so it can be used in subsequent conditions or modifiers
3765 (until something changes it). */
059ec3d9
PH		 3766
3767 case ACLC_VERIFY:
3768 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 3769 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3770 if (verb == ACL_WARN) *user_msgptr = NULL;
3771 break;
3772
3773 default:
3774 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3775 "condition %d", cb->type);
3776 break;
3777 }
3778
3779 /* If a condition was negated, invert OK/FAIL. */
3780
3781 if (!cond_modifiers[cb->type] && cb->u.negated)
3782 {
3783 if (rc == OK) rc = FAIL;
3784 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3785 }
3786
3787 if (rc != OK) break; /* Conditions loop */
3788 }
3789
3790
3791/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3792handle the values of these modifiers. If there isn't a log message set, we make
3793it the same as the user message.
059ec3d9
PH		 3794
3795"message" is a user message that will be included in an SMTP response. Unless
3796it is empty, it overrides any previously set user message.
3797
3798"log_message" is a non-user message, and it adds to any existing non-user
3799message that is already set.
3800
4e88a19f
PH		 3801Most verbs have but a single return for which the messages are relevant, but
3802for "discard", it's useful to have the log message both when it succeeds and
3803when it fails. For "accept", the message is used in the OK case if there is no
3804"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3805present. */
059ec3d9 3806
4e88a19f
PH		 3807if (*epp && rc == OK) user_message = NULL;
3808
3809if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3810 {
3811 uschar *expmessage;
4e88a19f
PH		 3812 uschar *old_user_msgptr = *user_msgptr;
3813 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3814
3815 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3816 nested ACLs) are always discarded. This also happens for acceptance verbs
3817 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3818 However, the value of an existing message is available in $acl_verify_message
3819 during expansions. */
3820
4e88a19f
PH		 3821 if (verb == ACL_WARN ||
3822 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3823 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3824
3825 if (user_message != NULL)
3826 {
3827 acl_verify_message = old_user_msgptr;
3828 expmessage = expand_string(user_message);
3829 if (expmessage == NULL)
3830 {
3831 if (!expand_string_forcedfail)
3832 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3833 user_message, expand_string_message);
3834 }
3835 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3836 }
3837
3838 if (log_message != NULL)
3839 {
3840 acl_verify_message = old_log_msgptr;
3841 expmessage = expand_string(log_message);
3842 if (expmessage == NULL)
3843 {
3844 if (!expand_string_forcedfail)
3845 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3846 log_message, expand_string_message);
3847 }
3848 else if (expmessage[0] != 0)
3849 {
3850 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3851 string_sprintf("%s: %s", expmessage, *log_msgptr);
3852 }
3853 }
3854
3855 /* If no log message, default it to the user message */
3856
3857 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3858 }
3859
3860acl_verify_message = NULL;
3861return rc;
3862}
3863
3864
3865
3866
3867
3868/*************************************************
3869* Get line from a literal ACL *
3870*************************************************/
3871
3872/* This function is passed to acl_read() in order to extract individual lines
3873of a literal ACL, which we access via static pointers. We can destroy the
3874contents because this is called only once (the compiled ACL is remembered).
3875
3876This code is intended to treat the data in the same way as lines in the main
3877Exim configuration file. That is:
3878
3879 . Leading spaces are ignored.
3880
3881 . A \ at the end of a line is a continuation - trailing spaces after the \
3882 are permitted (this is because I don't believe in making invisible things
3883 significant). Leading spaces on the continued part of a line are ignored.
3884
3885 . Physical lines starting (significantly) with # are totally ignored, and
3886 may appear within a sequence of backslash-continued lines.
3887
3888 . Blank lines are ignored, but will end a sequence of continuations.
3889
3890Arguments: none
3891Returns: a pointer to the next line
3892*/
3893
3894
3895static uschar *acl_text; /* Current pointer in the text */
3896static uschar *acl_text_end; /* Points one past the terminating '0' */
3897
3898
3899static uschar *
3900acl_getline(void)
3901{
3902uschar *yield;
3903
3904/* This loop handles leading blank lines and comments. */
3905
3906for(;;)
3907 {
3908 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3909 if (*acl_text == 0) return NULL; /* No more data */
3910 yield = acl_text; /* Potential data line */
3911
3912 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3913
3914 /* If we hit the end before a newline, we have the whole logical line. If
3915 it's a comment, there's no more data to be given. Otherwise, yield it. */
3916
3917 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3918
3919 /* After reaching a newline, end this loop if the physical line does not
3920 start with '#'. If it does, it's a comment, and the loop continues. */
3921
3922 if (*yield != '#') break;
3923 }
3924
3925/* This loop handles continuations. We know we have some real data, ending in
3926newline. See if there is a continuation marker at the end (ignoring trailing
3927white space). We know that *yield is not white space, so no need to test for
3928cont > yield in the backwards scanning loop. */
3929
3930for(;;)
3931 {
3932 uschar *cont;
3933 for (cont = acl_text - 1; isspace(*cont); cont--);
3934
3935 /* If no continuation follows, we are done. Mark the end of the line and
3936 return it. */
3937
3938 if (*cont != '\\')
3939 {
3940 *acl_text++ = 0;
3941 return yield;
3942 }
3943
3944 /* We have encountered a continuation. Skip over whitespace at the start of
3945 the next line, and indeed the whole of the next line or lines if they are
3946 comment lines. */
3947
3948 for (;;)
3949 {
3950 while (*(++acl_text) == ' ' || *acl_text == '\t');
3951 if (*acl_text != '#') break;
3952 while (*(++acl_text) != 0 && *acl_text != '\n');
3953 }
3954
3955 /* We have the start of a continuation line. Move all the rest of the data
3956 to join onto the previous line, and then find its end. If the end is not a
3957 newline, we are done. Otherwise loop to look for another continuation. */
3958
3959 memmove(cont, acl_text, acl_text_end - acl_text);
3960 acl_text_end -= acl_text - cont;
3961 acl_text = cont;
3962 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3963 if (*acl_text == 0) return yield;
3964 }
3965
3966/* Control does not reach here */
3967}
3968
3969
3970
3971
3972
3973/*************************************************
3974* Check access using an ACL *
3975*************************************************/
3976
3977/* This function is called from address_check. It may recurse via
3978acl_check_condition() - hence the use of a level to stop looping. The ACL is
3979passed as a string which is expanded. A forced failure implies no access check
3980is required. If the result is a single word, it is taken as the name of an ACL
3981which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3982text, complete with newlines, and parsed as such. In both cases, the ACL check
3983is then run. This function uses an auxiliary function for acl_read() to call
3984for reading individual lines of a literal ACL. This is acl_getline(), which
3985appears immediately above.
3986
3987Arguments:
3988 where where called from
3989 addr address item when called from RCPT; otherwise NULL
3990 s the input string; NULL is the same as an empty ACL => DENY
3991 level the nesting level
3992 user_msgptr where to put a user error (for SMTP response)
3993 log_msgptr where to put a logging message (not for SMTP response)
3994
3995Returns: OK access is granted
3996 DISCARD access is apparently granted...
3997 FAIL access is denied
3998 FAIL_DROP access is denied; drop the connection
3999 DEFER can't tell at the moment
4000 ERROR disaster
4001*/
4002
4003static int
4004acl_check_internal(int where, address_item *addr, uschar *s, int level,
4005 uschar **user_msgptr, uschar **log_msgptr)
4006{
4007int fd = -1;
4008acl_block *acl = NULL;
4009uschar *acl_name = US"inline ACL";
4010uschar *ss;
4011
4012/* Catch configuration loops */
4013
4014if (level > 20)
4015 {
4016 *log_msgptr = US"ACL nested too deep: possible loop";
4017 return ERROR;
4018 }
4019
4020if (s == NULL)
4021 {
4022 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4023 return FAIL;
4024 }
4025
4026/* At top level, we expand the incoming string. At lower levels, it has already
4027been expanded as part of condition processing. */
4028
4029if (level == 0)
4030 {
4031 ss = expand_string(s);
4032 if (ss == NULL)
4033 {
4034 if (expand_string_forcedfail) return OK;
4035 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4036 expand_string_message);
4037 return ERROR;
4038 }
4039 }
4040else ss = s;
4041
4042while (isspace(*ss))ss++;
4043
4044/* If we can't find a named ACL, the default is to parse it as an inline one.
4045(Unless it begins with a slash; non-existent files give rise to an error.) */
4046
4047acl_text = ss;
4048
4049/* Handle the case of a string that does not contain any spaces. Look for a
4050named ACL among those read from the configuration, or a previously read file.
4051It is possible that the pointer to the ACL is NULL if the configuration
4052contains a name with no data. If not found, and the text begins with '/',
4053read an ACL from a file, and save it so it can be re-used. */
4054
4055if (Ustrchr(ss, ' ') == NULL)
4056 {
4057 tree_node *t = tree_search(acl_anchor, ss);
4058 if (t != NULL)
4059 {
4060 acl = (acl_block *)(t->data.ptr);
4061 if (acl == NULL)
4062 {
4063 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4064 return FAIL;
4065 }
4066 acl_name = string_sprintf("ACL \"%s\"", ss);
4067 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4068 }
4069
4070 else if (*ss == '/')
4071 {
4072 struct stat statbuf;
4073 fd = Uopen(ss, O_RDONLY, 0);
4074 if (fd < 0)
4075 {
4076 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4077 strerror(errno));
4078 return ERROR;
4079 }
4080
4081 if (fstat(fd, &statbuf) != 0)
4082 {
4083 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4084 strerror(errno));
4085 return ERROR;
4086 }
4087
4088 acl_text = store_get(statbuf.st_size + 1);
4089 acl_text_end = acl_text + statbuf.st_size + 1;
4090
4091 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4092 {
4093 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4094 ss, strerror(errno));
4095 return ERROR;
4096 }
4097 acl_text[statbuf.st_size] = 0;
f1e894f3 4098 (void)close(fd);
059ec3d9
PH		 4099
4100 acl_name = string_sprintf("ACL \"%s\"", ss);
4101 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4102 }
4103 }
4104
4105/* Parse an ACL that is still in text form. If it came from a file, remember it
4106in the ACL tree, having read it into the POOL_PERM store pool so that it
4107persists between multiple messages. */
4108
4109if (acl == NULL)
4110 {
4111 int old_pool = store_pool;
4112 if (fd >= 0) store_pool = POOL_PERM;
4113 acl = acl_read(acl_getline, log_msgptr);
4114 store_pool = old_pool;
4115 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4116 if (fd >= 0)
4117 {
4118 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4119 Ustrcpy(t->name, ss);
4120 t->data.ptr = acl;
4121 (void)tree_insertnode(&acl_anchor, t);
4122 }
4123 }
4124
4125/* Now we have an ACL to use. It's possible it may be NULL. */
4126
4127while (acl != NULL)
4128 {
4129 int cond;
4130 int basic_errno = 0;
4131 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4132 BOOL acl_quit_check = level == 0
4133 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4134
4135 *log_msgptr = *user_msgptr = NULL;
4136 acl_temp_details = FALSE;
4137
059ec3d9
PH		 4138 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4139
4140 /* Clear out any search error message from a previous check before testing
4141 this condition. */
4142
4143 search_error_message = NULL;
4144 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4145 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4146
4147 /* Handle special returns: DEFER causes a return except on a WARN verb;
4148 ERROR always causes a return. */
4149
4150 switch (cond)
4151 {
4152 case DEFER:
6968512f 4153 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4154 if (basic_errno != ERRNO_CALLOUTDEFER)
4155 {
4156 if (search_error_message != NULL && *search_error_message != 0)
4157 *log_msgptr = search_error_message;
4158 if (smtp_return_error_details) acl_temp_details = TRUE;
4159 }
4160 else
4161 {
4162 acl_temp_details = TRUE;
4163 }
4164 if (acl->verb != ACL_WARN) return DEFER;
4165 break;
4166
4167 default: /* Paranoia */
4168 case ERROR:
6968512f 4169 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4170 return ERROR;
4171
4172 case OK:
6968512f
JH		 4173 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4174 verbs[acl->verb], acl_name);
059ec3d9
PH		 4175 break;
4176
4177 case FAIL:
6968512f 4178 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4179 break;
4180
4181 /* DISCARD and DROP can happen only from a nested ACL condition, and
4182 DISCARD can happen only for an "accept" or "discard" verb. */
4183
4184 case DISCARD:
6968512f
JH		 4185 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4186 verbs[acl->verb], acl_name);
059ec3d9
PH		 4187 break;
4188
4189 case FAIL_DROP:
6968512f
JH		 4190 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4191 verbs[acl->verb], acl_name);
059ec3d9
PH		 4192 break;
4193 }
4194
4195 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4196 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4197 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4198
4199 switch(acl->verb)
4200 {
4201 case ACL_ACCEPT:
a7538db1
JH		 4202 if (cond == OK || cond == DISCARD)
4203 {
4204 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4205 return cond;
4206 }
059ec3d9
PH		 4207 if (endpass_seen)
4208 {
4209 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4210 return cond;
4211 }
4212 break;
4213
4214 case ACL_DEFER:
4215 if (cond == OK)
4216 {
a7538db1 4217 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4218 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4219 acl_temp_details = TRUE;
4220 return DEFER;
4221 }
4222 break;
4223
4224 case ACL_DENY:
a7538db1
JH		 4225 if (cond == OK)
4226 {
4227 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4228 if (acl_quit_check) goto badquit;
a7538db1
JH		 4229 return FAIL;
4230 }
059ec3d9
PH		 4231 break;
4232
4233 case ACL_DISCARD:
a7538db1
JH		 4234 if (cond == OK || cond == DISCARD)
4235 {
4236 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4237 if (acl_quit_check) goto badquit;
a7538db1
JH		 4238 return DISCARD;
4239 }
059ec3d9
PH		 4240 if (endpass_seen)
4241 {
4242 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4243 return cond;
4244 }
4245 break;
4246
4247 case ACL_DROP:
a7538db1
JH		 4248 if (cond == OK)
4249 {
4250 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4251 if (acl_quit_check) goto badquit;
a7538db1
JH		 4252 return FAIL_DROP;
4253 }
059ec3d9
PH		 4254 break;
4255
4256 case ACL_REQUIRE:
a7538db1
JH		 4257 if (cond != OK)
4258 {
4259 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4260 if (acl_quit_check) goto badquit;
a7538db1
JH		 4261 return cond;
4262 }
059ec3d9
PH		 4263 break;
4264
4265 case ACL_WARN:
4266 if (cond == OK)
4267 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 4268 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH		 4269 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4270 "condition test deferred%s%s", host_and_ident(TRUE),
4271 (*log_msgptr == NULL)? US"" : US": ",
4272 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4273 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4274 break;
4275
4276 default:
4277 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4278 acl->verb);
4279 break;
4280 }
4281
4282 /* Pass to the next ACL item */
4283
4284 acl = acl->next;
4285 }
4286
4287/* We have reached the end of the ACL. This is an implicit DENY. */
4288
4289HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4290return FAIL;
82c0c8ea
JH		 4291
4292badquit:
4293 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4294 "('%s' verb used incorrectly)", verbs[acl->verb]);
4295 return ERROR;
059ec3d9
PH		 4296}
4297
4298
333eea9c
JH		 4299
4300
4301/* Same args as acl_check_internal() above, but the string s is
4302the name of an ACL followed optionally by up to 9 space-separated arguments.
4303The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4304static int
55414b25 4305acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4306 uschar **user_msgptr, uschar **log_msgptr)
4307{
4308uschar * tmp;
bef3ea7f 4309uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4310uschar * sav_arg[9]; /* must match acl_arg[] */
4311int sav_narg;
333eea9c 4312uschar * name;
bef3ea7f 4313int i;
ef21c07d 4314int ret;
333eea9c
JH		 4315
4316if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4317 goto bad;
4318
bef3ea7f 4319for (i = 0; i < 9; i++)
333eea9c
JH		 4320 {
4321 while (*s && isspace(*s)) s++;
4322 if (!*s) break;
bef3ea7f 4323 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4324 {
4325 tmp = name;
4326 goto bad;
4327 }
4328 }
ef21c07d
JH		 4329
4330sav_narg = acl_narg;
bef3ea7f 4331acl_narg = i;
ef21c07d
JH		 4332for (i = 0; i < acl_narg; i++)
4333 {
4334 sav_arg[i] = acl_arg[i];
4335 acl_arg[i] = tmp_arg[i];
4336 }
4337while (i < 9)
4338 {
4339 sav_arg[i] = acl_arg[i];
4340 acl_arg[i++] = NULL;
4341 }
4342
4343ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4344
ef21c07d
JH		 4345acl_narg = sav_narg;
4346for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4347return ret;
333eea9c
JH		 4348
4349bad:
4350if (expand_string_forcedfail) return ERROR;
4351*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4352 tmp, expand_string_message);
4353return search_find_defer?DEFER:ERROR;
4354}
4355
4356
4357
059ec3d9
PH		 4358/*************************************************
4359* Check access using an ACL *
4360*************************************************/
4361
faa05a93
JH		 4362/* Alternate interface for ACL, used by expansions */
4363int
05caaeaa 4364acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4365{
faa05a93
JH		 4366address_item adb;
4367address_item *addr = NULL;
4368
4369*user_msgptr = *log_msgptr = NULL;
4370sender_verified_failed = NULL;
4371ratelimiters_cmd = NULL;
4372log_reject_target = LOG_MAIN|LOG_REJECT;
4373
4374if (where == ACL_WHERE_RCPT)
4375 {
4376 adb = address_defaults;
4377 addr = &adb;
05caaeaa
JH		 4378 addr->address = expand_string(US"$local_part@$domain");
4379 addr->domain = deliver_domain;
4380 addr->local_part = deliver_localpart;
4381 addr->cc_local_part = deliver_localpart;
4382 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4383 }
4384
4385return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4386}
4387
4388
4389
059ec3d9
PH		 4390/* This is the external interface for ACL checks. It sets up an address and the
4391expansions for $domain and $local_part when called after RCPT, then calls
4392acl_check_internal() to do the actual work.
4393
4394Arguments:
4395 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4396 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4397 s the input string; NULL is the same as an empty ACL => DENY
4398 user_msgptr where to put a user error (for SMTP response)
4399 log_msgptr where to put a logging message (not for SMTP response)
4400
4401Returns: OK access is granted by an ACCEPT verb
4402 DISCARD access is granted by a DISCARD verb
4403 FAIL access is denied
4404 FAIL_DROP access is denied; drop the connection
4405 DEFER can't tell at the moment
4406 ERROR disaster
4407*/
faa05a93 4408int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4409
4410int
64ffc24f 4411acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4412 uschar **log_msgptr)
4413{
4414int rc;
4415address_item adb;
64ffc24f 4416address_item *addr = NULL;
059ec3d9
PH		 4417
4418*user_msgptr = *log_msgptr = NULL;
4419sender_verified_failed = NULL;
fe0dab11 4420ratelimiters_cmd = NULL;
6ea85e9a 4421log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4422
8ccd00b1 4423#ifndef DISABLE_PRDR
5032d1cf 4424if (where == ACL_WHERE_RCPT || where == ACL_WHERE_PRDR)
fd98a5c6 4425#else
5032d1cf 4426if (where == ACL_WHERE_RCPT)
fd98a5c6 4427#endif
059ec3d9
PH		 4428 {
4429 adb = address_defaults;
4430 addr = &adb;
64ffc24f 4431 addr->address = recipient;
059ec3d9
PH		 4432 if (deliver_split_address(addr) == DEFER)
4433 {
4434 *log_msgptr = US"defer in percent_hack_domains check";
4435 return DEFER;
4436 }
9bfc60eb 4437#ifdef EXPERIMENTAL_INTERNATIONAL
3c8b3577
JH		 4438 if ((addr->prop.utf8_msg = message_smtputf8))
4439 {
4440 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4441 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4442 }
9bfc60eb 4443#endif
059ec3d9
PH		 4444 deliver_domain = addr->domain;
4445 deliver_localpart = addr->local_part;
4446 }
059ec3d9 4447
faa05a93 4448acl_where = where;
059ec3d9 4449rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4450acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4451
817d9f57
JH		 4452/* Cutthrough - if requested,
4453and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4454and rcpt acl returned accept,
4455and first recipient (cancel on any subsequents)
e4bdf652 4456open one now and run it up to RCPT acceptance.
e4bdf652 4457A failed verify should cancel cutthrough request.
e4bdf652 4458
817d9f57 4459Initial implementation: dual-write to spool.
e4bdf652
JH		 4460Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4461
4462Cease cutthrough copy on rxd final dot; do not send one.
4463
4464On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4465
4466On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4467perm-rejected, reflect that to the original sender - and dump the spooled copy.
4468If temp-reject, close the conn (and keep the spooled copy).
4469If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4470*/
4471switch (where)
4472{
4473case ACL_WHERE_RCPT:
8ccd00b1 4474#ifndef DISABLE_PRDR
fd98a5c6
JH		 4475case ACL_WHERE_PRDR:
4476#endif
5032d1cf 4477 if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
e4bdf652
JH		 4478 open_cutthrough_connection(addr);
4479 break;
4480
4481case ACL_WHERE_PREDATA:
4482 if( rc == OK )
4483 cutthrough_predata();
4484 else
2e5b33cd 4485 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4486 break;
4487
4488case ACL_WHERE_QUIT:
4489case ACL_WHERE_NOTQUIT:
2e5b33cd 4490 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4491 break;
4492
4493default:
4494 break;
4495}
4496
64ffc24f
PH		 4497deliver_domain = deliver_localpart = deliver_address_data =
4498 sender_address_data = NULL;
059ec3d9
PH		 4499
4500/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4501ACL, which is really in the middle of an SMTP command. */
4502
4503if (rc == DISCARD)
4504 {
4505 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4506 {
4507 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4508 "ACL", acl_wherenames[where]);
4509 return ERROR;
4510 }
4511 return DISCARD;
4512 }
4513
4514/* A DROP response is not permitted from MAILAUTH */
4515
4516if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4517 {
4518 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4519 "ACL", acl_wherenames[where]);
4520 return ERROR;
4521 }
4522
4e88a19f
PH		 4523/* Before giving a response, take a look at the length of any user message, and
4524split it up into multiple lines if possible. */
059ec3d9 4525
e28326d8
PH		 4526*user_msgptr = string_split_message(*user_msgptr);
4527if (fake_response != OK)
4528 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4529
4530return rc;
4531}
4532
38a0a95f 4533
38a0a95f
PH		 4534/*************************************************
4535* Create ACL variable *
4536*************************************************/
4537
4538/* Create an ACL variable or reuse an existing one. ACL variables are in a
4539binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4540
4541Argument:
4542 name pointer to the variable's name, starting with c or m
4543
4544Returns the pointer to variable's tree node
4545*/
4546
4547tree_node *
4548acl_var_create(uschar *name)
4549{
4550tree_node *node, **root;
4551root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4552node = tree_search(*root, name);
4553if (node == NULL)
4554 {
4555 node = store_get(sizeof(tree_node) + Ustrlen(name));
4556 Ustrcpy(node->name, name);
4557 (void)tree_insertnode(root, node);
4558 }
4559node->data.ptr = NULL;
4560return node;
4561}
4562
4563
4564
4565/*************************************************
4566* Write an ACL variable in spool format *
4567*************************************************/
4568
4569/* This function is used as a callback for tree_walk when writing variables to
4570the spool file. To retain spool file compatibility, what is written is -aclc or
4571-aclm followed by the rest of the name and the data length, space separated,
4572then the value itself, starting on a new line, and terminated by an additional
4573newline. When we had only numbered ACL variables, the first line might look
4574like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4575acl_cfoo.
4576
4577Arguments:
4578 name of the variable
4579 value of the variable
4580 ctx FILE pointer (as a void pointer)
4581
4582Returns: nothing
4583*/
4584
4585void
4586acl_var_write(uschar *name, uschar *value, void *ctx)
4587{
4588FILE *f = (FILE *)ctx;
4589fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4590}
4591
9171d434
JH		 4592/* vi: aw ai sw=2
4593*/
059ec3d9 4594/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.