Alex Kiernan's patch for a problem with libradius.
[exim.git] / src / src / acl.c
CommitLineData
b8dc3e4a 1/* $Cambridge: exim/src/src/acl.c,v 1.61 2006/06/27 15:07:18 ph10 Exp $ */
059ec3d9
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
d7d7b7b9 7/* Copyright (c) University of Cambridge 1995 - 2006 */
059ec3d9
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* Code for handling Access Control Lists (ACLs) */
11
12#include "exim.h"
13
14
15/* Default callout timeout */
16
17#define CALLOUT_TIMEOUT_DEFAULT 30
18
19/* ACL verb codes - keep in step with the table of verbs that follows */
20
21enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
22 ACL_WARN };
23
24/* ACL verbs */
25
26static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
28 US"warn" };
29
30/* For each verb, the condition for which "message" is used */
31
32static int msgcond[] = { FAIL, OK, OK, FAIL, OK, FAIL, OK };
33
34/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH
35follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
36down. */
059ec3d9 37
71fafd95
PH
38enum { ACLC_ACL,
39 ACLC_ADD_HEADER,
40 ACLC_AUTHENTICATED,
8523533c
TK
41#ifdef EXPERIMENTAL_BRIGHTMAIL
42 ACLC_BMI_OPTIN,
43#endif
71fafd95
PH
44 ACLC_CONDITION,
45 ACLC_CONTROL,
8523533c
TK
46#ifdef WITH_CONTENT_SCAN
47 ACLC_DECODE,
48#endif
49 ACLC_DELAY,
50#ifdef WITH_OLD_DEMIME
51 ACLC_DEMIME,
8e669ac1 52#endif
fb2274d4
TK
53#ifdef EXPERIMENTAL_DOMAINKEYS
54 ACLC_DK_DOMAIN_SOURCE,
55 ACLC_DK_POLICY,
56 ACLC_DK_SENDER_DOMAINS,
57 ACLC_DK_SENDER_LOCAL_PARTS,
58 ACLC_DK_SENDERS,
59 ACLC_DK_STATUS,
60#endif
71fafd95
PH
61 ACLC_DNSLISTS,
62 ACLC_DOMAINS,
63 ACLC_ENCRYPTED,
64 ACLC_ENDPASS,
65 ACLC_HOSTS,
66 ACLC_LOCAL_PARTS,
67 ACLC_LOG_MESSAGE,
68 ACLC_LOGWRITE,
8523533c
TK
69#ifdef WITH_CONTENT_SCAN
70 ACLC_MALWARE,
71#endif
72 ACLC_MESSAGE,
73#ifdef WITH_CONTENT_SCAN
74 ACLC_MIME_REGEX,
75#endif
870f6ba8 76 ACLC_RATELIMIT,
8523533c
TK
77 ACLC_RECIPIENTS,
78#ifdef WITH_CONTENT_SCAN
79 ACLC_REGEX,
80#endif
71fafd95
PH
81 ACLC_SENDER_DOMAINS,
82 ACLC_SENDERS,
83 ACLC_SET,
8523533c 84#ifdef WITH_CONTENT_SCAN
8e669ac1 85 ACLC_SPAM,
8523533c
TK
86#endif
87#ifdef EXPERIMENTAL_SPF
88 ACLC_SPF,
89#endif
90 ACLC_VERIFY };
059ec3d9
PH
91
92/* ACL conditions/modifiers: "delay", "control", "endpass", "message",
93"log_message", "logwrite", and "set" are modifiers that look like conditions
94but always return TRUE. They are used for their side effects. */
95
9a26b6b2
PH
96static uschar *conditions[] = {
97 US"acl",
71fafd95 98 US"add_header",
9a26b6b2 99 US"authenticated",
8523533c
TK
100#ifdef EXPERIMENTAL_BRIGHTMAIL
101 US"bmi_optin",
102#endif
103 US"condition",
8e669ac1 104 US"control",
8523533c
TK
105#ifdef WITH_CONTENT_SCAN
106 US"decode",
107#endif
108 US"delay",
109#ifdef WITH_OLD_DEMIME
110 US"demime",
111#endif
fb2274d4 112#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
113 US"dk_domain_source",
114 US"dk_policy",
115 US"dk_sender_domains",
116 US"dk_sender_local_parts",
117 US"dk_senders",
118 US"dk_status",
fb2274d4 119#endif
8523533c 120 US"dnslists", US"domains", US"encrypted",
059ec3d9 121 US"endpass", US"hosts", US"local_parts", US"log_message", US"logwrite",
8523533c
TK
122#ifdef WITH_CONTENT_SCAN
123 US"malware",
124#endif
125 US"message",
126#ifdef WITH_CONTENT_SCAN
127 US"mime_regex",
128#endif
870f6ba8 129 US"ratelimit",
8523533c
TK
130 US"recipients",
131#ifdef WITH_CONTENT_SCAN
132 US"regex",
133#endif
134 US"sender_domains", US"senders", US"set",
135#ifdef WITH_CONTENT_SCAN
136 US"spam",
137#endif
138#ifdef EXPERIMENTAL_SPF
139 US"spf",
140#endif
059ec3d9 141 US"verify" };
8e669ac1 142
c5fcb476 143
9a26b6b2
PH
144/* Return values from decode_control(); keep in step with the table of names
145that follows! */
146
147enum {
c46782ef
PH
148 CONTROL_AUTH_UNADVERTISED,
149 #ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 150 CONTROL_BMI_RUN,
c46782ef
PH
151 #endif
152 #ifdef EXPERIMENTAL_DOMAINKEYS
9a26b6b2 153 CONTROL_DK_VERIFY,
c46782ef
PH
154 #endif
155 CONTROL_ERROR,
156 CONTROL_CASEFUL_LOCAL_PART,
157 CONTROL_CASELOWER_LOCAL_PART,
158 CONTROL_ENFORCE_SYNC,
159 CONTROL_NO_ENFORCE_SYNC,
160 CONTROL_FREEZE,
161 CONTROL_QUEUE_ONLY,
162 CONTROL_SUBMISSION,
163 CONTROL_SUPPRESS_LOCAL_FIXUPS,
164 #ifdef WITH_CONTENT_SCAN
9a26b6b2 165 CONTROL_NO_MBOX_UNSPOOL,
c46782ef
PH
166 #endif
167 CONTROL_FAKEDEFER,
168 CONTROL_FAKEREJECT,
169 CONTROL_NO_MULTILINE
170};
9a26b6b2 171
8800895a
PH
172/* ACL control names; keep in step with the table above! This list is used for
173turning ids into names. The actual list of recognized names is in the variable
174control_def controls_list[] below. The fact that there are two lists is a mess
175and should be tidied up. */
9a26b6b2
PH
176
177static uschar *controls[] = {
c46782ef 178 US"allow_auth_unadvertised",
9a26b6b2
PH
179 #ifdef EXPERIMENTAL_BRIGHTMAIL
180 US"bmi_run",
181 #endif
182 #ifdef EXPERIMENTAL_DOMAINKEYS
183 US"dk_verify",
184 #endif
c46782ef
PH
185 US"error",
186 US"caseful_local_part",
187 US"caselower_local_part",
188 US"enforce_sync",
189 US"no_enforce_sync",
190 US"freeze",
191 US"queue_only",
192 US"submission",
193 US"suppress_local_fixups",
9a26b6b2
PH
194 #ifdef WITH_CONTENT_SCAN
195 US"no_mbox_unspool",
196 #endif
c46782ef
PH
197 US"no_multiline"
198};
059ec3d9
PH
199
200/* Flags to indicate for which conditions /modifiers a string expansion is done
201at the outer level. In the other cases, expansion already occurs in the
202checking functions. */
203
204static uschar cond_expand_at_top[] = {
205 TRUE, /* acl */
3e536984 206 TRUE, /* add_header */
059ec3d9 207 FALSE, /* authenticated */
8523533c
TK
208#ifdef EXPERIMENTAL_BRIGHTMAIL
209 TRUE, /* bmi_optin */
8e669ac1 210#endif
059ec3d9
PH
211 TRUE, /* condition */
212 TRUE, /* control */
8523533c
TK
213#ifdef WITH_CONTENT_SCAN
214 TRUE, /* decode */
215#endif
059ec3d9 216 TRUE, /* delay */
8523533c
TK
217#ifdef WITH_OLD_DEMIME
218 TRUE, /* demime */
219#endif
fb2274d4 220#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
221 TRUE, /* dk_domain_source */
222 TRUE, /* dk_policy */
223 TRUE, /* dk_sender_domains */
e715ad22 224 TRUE, /* dk_sender_local_parts */
7f45268c
PH
225 TRUE, /* dk_senders */
226 TRUE, /* dk_status */
fb2274d4 227#endif
059ec3d9
PH
228 TRUE, /* dnslists */
229 FALSE, /* domains */
230 FALSE, /* encrypted */
231 TRUE, /* endpass */
232 FALSE, /* hosts */
233 FALSE, /* local_parts */
234 TRUE, /* log_message */
235 TRUE, /* logwrite */
8523533c
TK
236#ifdef WITH_CONTENT_SCAN
237 TRUE, /* malware */
238#endif
059ec3d9 239 TRUE, /* message */
8523533c
TK
240#ifdef WITH_CONTENT_SCAN
241 TRUE, /* mime_regex */
242#endif
870f6ba8 243 TRUE, /* ratelimit */
059ec3d9 244 FALSE, /* recipients */
8523533c
TK
245#ifdef WITH_CONTENT_SCAN
246 TRUE, /* regex */
247#endif
059ec3d9
PH
248 FALSE, /* sender_domains */
249 FALSE, /* senders */
250 TRUE, /* set */
8523533c
TK
251#ifdef WITH_CONTENT_SCAN
252 TRUE, /* spam */
253#endif
254#ifdef EXPERIMENTAL_SPF
255 TRUE, /* spf */
256#endif
059ec3d9
PH
257 TRUE /* verify */
258};
259
260/* Flags to identify the modifiers */
261
262static uschar cond_modifiers[] = {
263 FALSE, /* acl */
3e536984 264 TRUE, /* add_header */
059ec3d9 265 FALSE, /* authenticated */
8523533c
TK
266#ifdef EXPERIMENTAL_BRIGHTMAIL
267 TRUE, /* bmi_optin */
8e669ac1 268#endif
059ec3d9
PH
269 FALSE, /* condition */
270 TRUE, /* control */
8523533c
TK
271#ifdef WITH_CONTENT_SCAN
272 FALSE, /* decode */
273#endif
059ec3d9 274 TRUE, /* delay */
8523533c
TK
275#ifdef WITH_OLD_DEMIME
276 FALSE, /* demime */
277#endif
fb2274d4 278#ifdef EXPERIMENTAL_DOMAINKEYS
7f45268c
PH
279 FALSE, /* dk_domain_source */
280 FALSE, /* dk_policy */
281 FALSE, /* dk_sender_domains */
e715ad22 282 FALSE, /* dk_sender_local_parts */
7f45268c
PH
283 FALSE, /* dk_senders */
284 FALSE, /* dk_status */
fb2274d4 285#endif
059ec3d9
PH
286 FALSE, /* dnslists */
287 FALSE, /* domains */
288 FALSE, /* encrypted */
289 TRUE, /* endpass */
290 FALSE, /* hosts */
291 FALSE, /* local_parts */
292 TRUE, /* log_message */
8523533c
TK
293 TRUE, /* logwrite */
294#ifdef WITH_CONTENT_SCAN
295 FALSE, /* malware */
296#endif
059ec3d9 297 TRUE, /* message */
8523533c
TK
298#ifdef WITH_CONTENT_SCAN
299 FALSE, /* mime_regex */
300#endif
870f6ba8 301 FALSE, /* ratelimit */
059ec3d9 302 FALSE, /* recipients */
8523533c
TK
303#ifdef WITH_CONTENT_SCAN
304 FALSE, /* regex */
305#endif
059ec3d9
PH
306 FALSE, /* sender_domains */
307 FALSE, /* senders */
308 TRUE, /* set */
8523533c
TK
309#ifdef WITH_CONTENT_SCAN
310 FALSE, /* spam */
311#endif
312#ifdef EXPERIMENTAL_SPF
313 FALSE, /* spf */
314#endif
059ec3d9
PH
315 FALSE /* verify */
316};
317
c5fcb476 318/* Bit map vector of which conditions are not allowed at certain times. For
2f079f46
PH
319each condition, there's a bitmap of dis-allowed times. For some, it is easier
320to specify the negation of a small number of allowed times. */
059ec3d9
PH
321
322static unsigned int cond_forbids[] = {
323 0, /* acl */
8e669ac1 324
71fafd95
PH
325 (unsigned int)
326 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
327 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
328 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)),
329
059ec3d9
PH
330 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* authenticated */
331 (1<<ACL_WHERE_HELO),
8e669ac1 332
71fafd95 333 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 334 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK
335 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
336 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8e669ac1 337 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK
338 (1<<ACL_WHERE_MAILAUTH)|
339 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
340 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA),
71fafd95 341 #endif
8e669ac1 342
059ec3d9 343 0, /* condition */
8e669ac1 344
059ec3d9 345 /* Certain types of control are always allowed, so we let it through
2f079f46 346 always and check in the control processing itself. */
8e669ac1 347
059ec3d9 348 0, /* control */
8e669ac1 349
71fafd95 350 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
351 (unsigned int)
352 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 353 #endif
8523533c 354
059ec3d9 355 0, /* delay */
8e669ac1 356
71fafd95 357 #ifdef WITH_OLD_DEMIME
2f079f46
PH
358 (unsigned int)
359 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* demime */
71fafd95 360 #endif
8e669ac1 361
71fafd95 362 #ifdef EXPERIMENTAL_DOMAINKEYS
2f079f46 363 (1<<ACL_WHERE_AUTH)| /* dk_domain_source */
fb2274d4
TK
364 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
365 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
366 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
367 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
368 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
369 (1<<ACL_WHERE_VRFY),
84330b7b 370
2f079f46 371 (1<<ACL_WHERE_AUTH)| /* dk_policy */
fb2274d4
TK
372 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
373 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
374 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
375 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
376 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
377 (1<<ACL_WHERE_VRFY),
84330b7b 378
2f079f46 379 (1<<ACL_WHERE_AUTH)| /* dk_sender_domains */
fb2274d4
TK
380 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
381 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
382 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
383 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
384 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
385 (1<<ACL_WHERE_VRFY),
84330b7b 386
2f079f46 387 (1<<ACL_WHERE_AUTH)| /* dk_sender_local_parts */
fb2274d4
TK
388 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
389 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
390 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
391 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
392 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
393 (1<<ACL_WHERE_VRFY),
84330b7b 394
2f079f46 395 (1<<ACL_WHERE_AUTH)| /* dk_senders */
fb2274d4
TK
396 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
397 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
398 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
399 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
400 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
401 (1<<ACL_WHERE_VRFY),
84330b7b 402
2f079f46 403 (1<<ACL_WHERE_AUTH)| /* dk_status */
fb2274d4
TK
404 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
405 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
406 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
407 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
408 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
409 (1<<ACL_WHERE_VRFY),
71fafd95 410 #endif
fb2274d4 411
059ec3d9
PH
412 (1<<ACL_WHERE_NOTSMTP), /* dnslists */
413
2f079f46
PH
414 (unsigned int)
415 ~(1<<ACL_WHERE_RCPT), /* domains */
059ec3d9
PH
416
417 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* encrypted */
418 (1<<ACL_WHERE_HELO),
8e669ac1 419
059ec3d9 420 0, /* endpass */
8e669ac1 421
059ec3d9
PH
422 (1<<ACL_WHERE_NOTSMTP), /* hosts */
423
2f079f46
PH
424 (unsigned int)
425 ~(1<<ACL_WHERE_RCPT), /* local_parts */
059ec3d9
PH
426
427 0, /* log_message */
8e669ac1 428
059ec3d9 429 0, /* logwrite */
8e669ac1 430
71fafd95 431 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
432 (unsigned int)
433 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* malware */
71fafd95 434 #endif
8523533c 435
059ec3d9
PH
436 0, /* message */
437
71fafd95 438 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
439 (unsigned int)
440 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 441 #endif
8523533c 442
870f6ba8
TF
443 0, /* ratelimit */
444
2f079f46
PH
445 (unsigned int)
446 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 447
71fafd95 448 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
449 (unsigned int)
450 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* regex */
451 (1<<ACL_WHERE_MIME)),
71fafd95 452 #endif
8523533c 453
059ec3d9
PH
454 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
455 (1<<ACL_WHERE_HELO)|
456 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
457 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
458 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
459
460 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
461 (1<<ACL_WHERE_HELO)|
462 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
463 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
464 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
465
466 0, /* set */
467
71fafd95 468 #ifdef WITH_CONTENT_SCAN
2f079f46
PH
469 (unsigned int)
470 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* spam */
71fafd95 471 #endif
8523533c 472
71fafd95 473 #ifdef EXPERIMENTAL_SPF
8523533c
TK
474 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
475 (1<<ACL_WHERE_HELO)|
476 (1<<ACL_WHERE_MAILAUTH)|
477 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
478 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
71fafd95 479 #endif
8523533c 480
059ec3d9
PH
481 /* Certain types of verify are always allowed, so we let it through
482 always and check in the verify function itself */
483
484 0 /* verify */
059ec3d9
PH
485};
486
487
c5fcb476
PH
488/* Bit map vector of which controls are not allowed at certain times. For
489each control, there's a bitmap of dis-allowed times. For some, it is easier to
490specify the negation of a small number of allowed times. */
491
492static unsigned int control_forbids[] = {
c46782ef
PH
493 (unsigned int)
494 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
495
496 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 497 0, /* bmi_run */
c46782ef
PH
498 #endif
499
500 #ifdef EXPERIMENTAL_DOMAINKEYS
e715ad22 501 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), /* dk_verify */
c46782ef 502 #endif
3e11c26b 503
c5fcb476 504 0, /* error */
8e669ac1
PH
505
506 (unsigned int)
c5fcb476 507 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH
508
509 (unsigned int)
c5fcb476 510 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 511
c5fcb476 512 (1<<ACL_WHERE_NOTSMTP), /* enforce_sync */
8e669ac1 513
c5fcb476 514 (1<<ACL_WHERE_NOTSMTP), /* no_enforce_sync */
8e669ac1
PH
515
516 (unsigned int)
c5fcb476
PH
517 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
518 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 519 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
520
521 (unsigned int)
c5fcb476
PH
522 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
523 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
e715ad22 524 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH
525
526 (unsigned int)
c5fcb476 527 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 528 (1<<ACL_WHERE_PREDATA)),
8523533c 529
8800895a
PH
530 (unsigned int)
531 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
532 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_PREDATA)),
533
c46782ef 534 #ifdef WITH_CONTENT_SCAN
8e669ac1 535 (unsigned int)
14d57970 536 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22
TK
537 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
538 (1<<ACL_WHERE_MIME)),
c46782ef 539 #endif
a6c4ab60 540
8e669ac1 541 (unsigned int)
29aba418
TF
542 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
543 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
544 (1<<ACL_WHERE_MIME)),
545
546 (unsigned int)
a6c4ab60 547 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22
TK
548 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
549 (1<<ACL_WHERE_MIME)),
8523533c 550
c5fcb476
PH
551 (1<<ACL_WHERE_NOTSMTP) /* no_multiline */
552};
553
554/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH
555
556typedef struct control_def {
557 uschar *name;
558 int value; /* CONTROL_xxx value */
059ec3d9
PH
559 BOOL has_option; /* Has /option(s) following */
560} control_def;
561
562static control_def controls_list[] = {
c46782ef 563 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 564#ifdef EXPERIMENTAL_BRIGHTMAIL
c46782ef 565 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
8523533c 566#endif
fb2274d4 567#ifdef EXPERIMENTAL_DOMAINKEYS
c46782ef 568 { US"dk_verify", CONTROL_DK_VERIFY, FALSE },
fb2274d4 569#endif
c46782ef
PH
570 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
571 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
572 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
573 { US"freeze", CONTROL_FREEZE, TRUE },
574 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
575 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
576 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 577#ifdef WITH_CONTENT_SCAN
c46782ef 578 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 579#endif
c46782ef
PH
580 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
581 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
582 { US"submission", CONTROL_SUBMISSION, TRUE },
583 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE }
059ec3d9
PH
584 };
585
e5a9dba6
PH
586/* Support data structures for Client SMTP Authorization. acl_verify_csa()
587caches its result in a tree to avoid repeated DNS queries. The result is an
588integer code which is used as an index into the following tables of
589explanatory strings and verification return codes. */
590
591static tree_node *csa_cache = NULL;
592
593enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
594 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
595
596/* The acl_verify_csa() return code is translated into an acl_verify() return
597code using the following table. It is OK unless the client is definitely not
598authorized. This is because CSA is supposed to be optional for sending sites,
599so recipients should not be too strict about checking it - especially because
600DNS problems are quite likely to occur. It's possible to use $csa_status in
601further ACL conditions to distinguish ok, unknown, and defer if required, but
602the aim is to make the usual configuration simple. */
603
604static int csa_return_code[] = {
605 OK, OK, OK, OK,
606 FAIL, FAIL, FAIL, FAIL
607};
608
609static uschar *csa_status_string[] = {
610 US"unknown", US"ok", US"defer", US"defer",
611 US"fail", US"fail", US"fail", US"fail"
612};
613
614static uschar *csa_reason_string[] = {
615 US"unknown",
616 US"ok",
617 US"deferred (SRV lookup failed)",
618 US"deferred (target address lookup failed)",
619 US"failed (explicit authorization required)",
620 US"failed (host name not authorized)",
621 US"failed (no authorized addresses)",
622 US"failed (client address mismatch)"
623};
624
059ec3d9
PH
625/* Enable recursion between acl_check_internal() and acl_check_condition() */
626
627static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
628 uschar **);
629
630
631/*************************************************
632* Pick out name from list *
633*************************************************/
634
635/* Use a binary chop method
636
637Arguments:
638 name name to find
639 list list of names
640 end size of list
641
642Returns: offset in list, or -1 if not found
643*/
644
645static int
646acl_checkname(uschar *name, uschar **list, int end)
647{
648int start = 0;
649
650while (start < end)
651 {
652 int mid = (start + end)/2;
653 int c = Ustrcmp(name, list[mid]);
654 if (c == 0) return mid;
655 if (c < 0) end = mid; else start = mid + 1;
656 }
657
658return -1;
659}
660
661
662/*************************************************
663* Read and parse one ACL *
664*************************************************/
665
666/* This function is called both from readconf in order to parse the ACLs in the
667configuration file, and also when an ACL is encountered dynamically (e.g. as
668the result of an expansion). It is given a function to call in order to
669retrieve the lines of the ACL. This function handles skipping comments and
670blank lines (where relevant).
671
672Arguments:
673 func function to get next line of ACL
674 error where to put an error message
675
676Returns: pointer to ACL, or NULL
677 NULL can be legal (empty ACL); in this case error will be NULL
678*/
679
680acl_block *
681acl_read(uschar *(*func)(void), uschar **error)
682{
683acl_block *yield = NULL;
684acl_block **lastp = &yield;
685acl_block *this = NULL;
686acl_condition_block *cond;
687acl_condition_block **condp = NULL;
688uschar *s;
689
690*error = NULL;
691
692while ((s = (*func)()) != NULL)
693 {
694 int v, c;
695 BOOL negated = FALSE;
696 uschar *saveline = s;
697 uschar name[64];
698
699 /* Conditions (but not verbs) are allowed to be negated by an initial
700 exclamation mark. */
701
702 while (isspace(*s)) s++;
703 if (*s == '!')
704 {
705 negated = TRUE;
706 s++;
707 }
708
cf00dad6
PH
709 /* Read the name of a verb or a condition, or the start of a new ACL, which
710 can be started by a name, or by a macro definition. */
059ec3d9
PH
711
712 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 713 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
714
715 /* If a verb is unrecognized, it may be another condition or modifier that
716 continues the previous verb. */
717
718 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
719 if (v < 0)
720 {
721 if (this == NULL)
722 {
4e167a8c
PH
723 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
724 saveline);
059ec3d9
PH
725 return NULL;
726 }
727 }
728
729 /* New verb */
730
731 else
732 {
733 if (negated)
734 {
735 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
736 return NULL;
737 }
738 this = store_get(sizeof(acl_block));
739 *lastp = this;
740 lastp = &(this->next);
741 this->next = NULL;
742 this->verb = v;
743 this->condition = NULL;
744 condp = &(this->condition);
745 if (*s == 0) continue; /* No condition on this line */
746 if (*s == '!')
747 {
748 negated = TRUE;
749 s++;
750 }
751 s = readconf_readname(name, sizeof(name), s); /* Condition name */
752 }
753
754 /* Handle a condition or modifier. */
755
756 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
757 if (c < 0)
758 {
759 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
760 saveline);
761 return NULL;
762 }
763
764 /* The modifiers may not be negated */
765
766 if (negated && cond_modifiers[c])
767 {
768 *error = string_sprintf("ACL error: negation is not allowed with "
769 "\"%s\"", conditions[c]);
770 return NULL;
771 }
772
773 /* ENDPASS may occur only with ACCEPT or DISCARD. */
774
775 if (c == ACLC_ENDPASS &&
776 this->verb != ACL_ACCEPT &&
777 this->verb != ACL_DISCARD)
778 {
779 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
780 conditions[c], verbs[this->verb]);
781 return NULL;
782 }
783
784 cond = store_get(sizeof(acl_condition_block));
785 cond->next = NULL;
786 cond->type = c;
787 cond->u.negated = negated;
788
789 *condp = cond;
790 condp = &(cond->next);
791
792 /* The "set" modifier is different in that its argument is "name=value"
793 rather than just a value, and we can check the validity of the name, which
794 gives us a variable number to insert into the data block. */
795
796 if (c == ACLC_SET)
797 {
47ca6d6c
PH
798 int offset, max, n;
799 uschar *endptr;
800
801 if (Ustrncmp(s, "acl_", 4) != 0) goto BAD_ACL_VAR;
802 if (s[4] == 'c')
803 {
804 offset = 0;
805 max = ACL_CVARS;
806 }
807 else if (s[4] == 'm')
808 {
809 offset = ACL_CVARS;
810 max = ACL_MVARS;
811 }
812 else goto BAD_ACL_VAR;
813
814 n = Ustrtoul(s + 5, &endptr, 10);
815 if ((*endptr != 0 && *endptr != '=' && !isspace(*endptr)) || n >= max)
059ec3d9 816 {
47ca6d6c
PH
817 BAD_ACL_VAR:
818 *error = string_sprintf("syntax error or unrecognized name after "
819 "\"set\" in ACL modifier \"set %s\"", s);
059ec3d9
PH
820 return NULL;
821 }
822
47ca6d6c
PH
823 cond->u.varnumber = n + offset;
824 s = endptr;
059ec3d9
PH
825 while (isspace(*s)) s++;
826 }
827
828 /* For "set", we are now positioned for the data. For the others, only
829 "endpass" has no data */
830
831 if (c != ACLC_ENDPASS)
832 {
833 if (*s++ != '=')
834 {
835 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
836 cond_modifiers[c]? US"modifier" : US"condition");
837 return NULL;
838 }
839 while (isspace(*s)) s++;
840 cond->arg = string_copy(s);
841 }
842 }
843
844return yield;
845}
846
847
848
849/*************************************************
71fafd95
PH
850* Set up added header line(s) *
851*************************************************/
852
853/* This function is called by the add_header modifier, and also from acl_warn()
854to implement the now-deprecated way of adding header lines using "message" on a
855"warn" verb. The argument is treated as a sequence of header lines which are
856added to a chain, provided there isn't an identical one already there.
857
858Argument: string of header lines
859Returns: nothing
860*/
861
862static void
863setup_header(uschar *hstring)
864{
865uschar *p, *q;
866int hlen = Ustrlen(hstring);
867
868/* An empty string does nothing; otherwise add a final newline if necessary. */
869
870if (hlen <= 0) return;
871if (hstring[hlen-1] != '\n') hstring = string_sprintf("%s\n", hstring);
872
873/* Loop for multiple header lines, taking care about continuations */
874
875for (p = q = hstring; *p != 0; )
876 {
877 uschar *s;
878 int newtype = htype_add_bot;
879 header_line **hptr = &acl_added_headers;
880
881 /* Find next header line within the string */
882
883 for (;;)
884 {
885 q = Ustrchr(q, '\n');
886 if (*(++q) != ' ' && *q != '\t') break;
887 }
888
889 /* If the line starts with a colon, interpret the instruction for where to
890 add it. This temporarily sets up a new type. */
891
892 if (*p == ':')
893 {
894 if (strncmpic(p, US":after_received:", 16) == 0)
895 {
896 newtype = htype_add_rec;
897 p += 16;
898 }
899 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
900 {
901 newtype = htype_add_rfc;
902 p += 14;
903 }
904 else if (strncmpic(p, US":at_start:", 10) == 0)
905 {
906 newtype = htype_add_top;
907 p += 10;
908 }
909 else if (strncmpic(p, US":at_end:", 8) == 0)
910 {
911 newtype = htype_add_bot;
912 p += 8;
913 }
914 while (*p == ' ' || *p == '\t') p++;
915 }
916
917 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
918 to the front of it. */
919
920 for (s = p; s < q - 1; s++)
921 {
922 if (*s == ':' || !isgraph(*s)) break;
923 }
924
925 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
926 hlen = Ustrlen(s);
927
928 /* See if this line has already been added */
929
930 while (*hptr != NULL)
931 {
932 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
933 hptr = &((*hptr)->next);
934 }
935
936 /* Add if not previously present */
937
938 if (*hptr == NULL)
939 {
940 header_line *h = store_get(sizeof(header_line));
941 h->text = s;
942 h->next = NULL;
943 h->type = newtype;
944 h->slen = hlen;
945 *hptr = h;
946 hptr = &(h->next);
947 }
948
949 /* Advance for next header line within the string */
950
951 p = q;
952 }
953}
954
955
956
957
958/*************************************************
059ec3d9
PH
959* Handle warnings *
960*************************************************/
961
962/* This function is called when a WARN verb's conditions are true. It adds to
963the message's headers, and/or writes information to the log. In each case, this
964only happens once (per message for headers, per connection for log).
965
71fafd95
PH
966** NOTE: The header adding action using the "message" setting is historic, and
967its use is now deprecated. The new add_header modifier should be used instead.
968
059ec3d9
PH
969Arguments:
970 where ACL_WHERE_xxxx indicating which ACL this is
971 user_message message for adding to headers
972 log_message message for logging, if different
973
974Returns: nothing
975*/
976
977static void
978acl_warn(int where, uschar *user_message, uschar *log_message)
979{
059ec3d9
PH
980if (log_message != NULL && log_message != user_message)
981 {
982 uschar *text;
983 string_item *logged;
984
985 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
986 string_printing(log_message));
987
988 /* If a sender verification has failed, and the log message is "sender verify
989 failed", add the failure message. */
990
991 if (sender_verified_failed != NULL &&
992 sender_verified_failed->message != NULL &&
993 strcmpic(log_message, US"sender verify failed") == 0)
994 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
995
9c7a242c
PH
996 /* Search previously logged warnings. They are kept in malloc
997 store so they can be freed at the start of a new message. */
059ec3d9
PH
998
999 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1000 if (Ustrcmp(logged->text, text) == 0) break;
1001
1002 if (logged == NULL)
1003 {
1004 int length = Ustrlen(text) + 1;
1005 log_write(0, LOG_MAIN, "%s", text);
1006 logged = store_malloc(sizeof(string_item) + length);
1007 logged->text = (uschar *)logged + sizeof(string_item);
1008 memcpy(logged->text, text, length);
1009 logged->next = acl_warn_logged;
1010 acl_warn_logged = logged;
1011 }
1012 }
1013
1014/* If there's no user message, we are done. */
1015
1016if (user_message == NULL) return;
1017
1018/* If this isn't a message ACL, we can't do anything with a user message.
1019Log an error. */
1020
1021if (where > ACL_WHERE_NOTSMTP)
1022 {
1023 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1024 "found in a non-message (%s) ACL: cannot specify header lines here: "
1025 "message ignored", acl_wherenames[where]);
1026 return;
1027 }
1028
71fafd95
PH
1029/* The code for setting up header lines is now abstracted into a separate
1030function so that it can be used for the add_header modifier as well. */
059ec3d9 1031
71fafd95 1032setup_header(user_message);
059ec3d9
PH
1033}
1034
1035
1036
1037/*************************************************
1038* Verify and check reverse DNS *
1039*************************************************/
1040
1041/* Called from acl_verify() below. We look up the host name(s) of the client IP
1042address if this has not yet been done. The host_name_lookup() function checks
1043that one of these names resolves to an address list that contains the client IP
1044address, so we don't actually have to do the check here.
1045
1046Arguments:
1047 user_msgptr pointer for user message
1048 log_msgptr pointer for log message
1049
1050Returns: OK verification condition succeeded
1051 FAIL verification failed
1052 DEFER there was a problem verifying
1053*/
1054
1055static int
1056acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1057{
1058int rc;
1059
1060user_msgptr = user_msgptr; /* stop compiler warning */
1061
1062/* Previous success */
1063
1064if (sender_host_name != NULL) return OK;
1065
1066/* Previous failure */
1067
1068if (host_lookup_failed)
1069 {
1070 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1071 return FAIL;
1072 }
1073
1074/* Need to do a lookup */
1075
1076HDEBUG(D_acl)
1077 debug_printf("looking up host name to force name/address consistency check\n");
1078
1079if ((rc = host_name_lookup()) != OK)
1080 {
1081 *log_msgptr = (rc == DEFER)?
1082 US"host lookup deferred for reverse lookup check"
1083 :
1084 string_sprintf("host lookup failed for reverse lookup check%s",
1085 host_lookup_msg);
1086 return rc; /* DEFER or FAIL */
1087 }
1088
1089host_build_sender_fullhost();
1090return OK;
1091}
1092
1093
1094
1095/*************************************************
e5a9dba6
PH
1096* Check client IP address matches CSA target *
1097*************************************************/
1098
1099/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1100response for address records belonging to the CSA target hostname. The section
1101is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1102If one of the addresses matches the client's IP address, then the client is
1103authorized by CSA. If there are target IP addresses but none of them match
1104then the client is using an unauthorized IP address. If there are no target IP
1105addresses then the client cannot be using an authorized IP address. (This is
1106an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1107
1108Arguments:
1109 dnsa the DNS answer block
1110 dnss a DNS scan block for us to use
1111 reset option specifing what portion to scan, as described above
1112 target the target hostname to use for matching RR names
1113
1114Returns: CSA_OK successfully authorized
1115 CSA_FAIL_MISMATCH addresses found but none matched
1116 CSA_FAIL_NOADDR no target addresses found
1117*/
1118
1119static int
1120acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1121 uschar *target)
1122{
1123dns_record *rr;
1124dns_address *da;
1125
1126BOOL target_found = FALSE;
1127
1128for (rr = dns_next_rr(dnsa, dnss, reset);
1129 rr != NULL;
1130 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1131 {
1132 /* Check this is an address RR for the target hostname. */
1133
1134 if (rr->type != T_A
1135 #if HAVE_IPV6
1136 && rr->type != T_AAAA
1137 #ifdef SUPPORT_A6
1138 && rr->type != T_A6
1139 #endif
1140 #endif
1141 ) continue;
1142
1143 if (strcmpic(target, rr->name) != 0) continue;
1144
1145 target_found = TRUE;
1146
1147 /* Turn the target address RR into a list of textual IP addresses and scan
1148 the list. There may be more than one if it is an A6 RR. */
1149
1150 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1151 {
1152 /* If the client IP address matches the target IP address, it's good! */
1153
1154 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1155
1156 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1157 }
1158 }
1159
1160/* If we found some target addresses but none of them matched, the client is
1161using an unauthorized IP address, otherwise the target has no authorized IP
1162addresses. */
1163
1164if (target_found) return CSA_FAIL_MISMATCH;
1165else return CSA_FAIL_NOADDR;
1166}
1167
1168
1169
1170/*************************************************
1171* Verify Client SMTP Authorization *
1172*************************************************/
1173
1174/* Called from acl_verify() below. This routine calls dns_lookup_special()
1175to find the CSA SRV record corresponding to the domain argument, or
1176$sender_helo_name if no argument is provided. It then checks that the
1177client is authorized, and that its IP address corresponds to the SRV
1178target's address by calling acl_verify_csa_address() above. The address
1179should have been returned in the DNS response's ADDITIONAL section, but if
1180not we perform another DNS lookup to get it.
1181
1182Arguments:
1183 domain pointer to optional parameter following verify = csa
1184
1185Returns: CSA_UNKNOWN no valid CSA record found
1186 CSA_OK successfully authorized
1187 CSA_FAIL_* client is definitely not authorized
1188 CSA_DEFER_* there was a DNS problem
1189*/
1190
1191static int
1192acl_verify_csa(uschar *domain)
1193{
1194tree_node *t;
1195uschar *found, *p;
1196int priority, weight, port;
1197dns_answer dnsa;
1198dns_scan dnss;
1199dns_record *rr;
1200int rc, type;
1201uschar target[256];
1202
1203/* Work out the domain we are using for the CSA lookup. The default is the
1204client's HELO domain. If the client has not said HELO, use its IP address
1205instead. If it's a local client (exim -bs), CSA isn't applicable. */
1206
1207while (isspace(*domain) && *domain != '\0') ++domain;
1208if (*domain == '\0') domain = sender_helo_name;
1209if (domain == NULL) domain = sender_host_address;
1210if (sender_host_address == NULL) return CSA_UNKNOWN;
1211
1212/* If we have an address literal, strip off the framing ready for turning it
1213into a domain. The framing consists of matched square brackets possibly
1214containing a keyword and a colon before the actual IP address. */
1215
1216if (domain[0] == '[')
1217 {
1218 uschar *start = Ustrchr(domain, ':');
1219 if (start == NULL) start = domain;
1220 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1221 }
1222
1223/* Turn domains that look like bare IP addresses into domains in the reverse
1224DNS. This code also deals with address literals and $sender_host_address. It's
1225not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1226address literals, but it's probably the most friendly thing to do. This is an
1227extension to CSA, so we allow it to be turned off for proper conformance. */
1228
7e66e54d 1229if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1230 {
1231 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1232 dns_build_reverse(domain, target);
1233 domain = target;
1234 }
1235
1236/* Find out if we've already done the CSA check for this domain. If we have,
1237return the same result again. Otherwise build a new cached result structure
1238for this domain. The name is filled in now, and the value is filled in when
1239we return from this function. */
1240
1241t = tree_search(csa_cache, domain);
1242if (t != NULL) return t->data.val;
1243
1244t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1245Ustrcpy(t->name, domain);
1246(void)tree_insertnode(&csa_cache, t);
1247
1248/* Now we are ready to do the actual DNS lookup(s). */
1249
28e6ef29 1250found = domain;
e5a9dba6
PH
1251switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1252 {
1253 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1254
1255 default:
1256 return t->data.val = CSA_DEFER_SRV;
1257
1258 /* If we found nothing, the client's authorization is unknown. */
1259
1260 case DNS_NOMATCH:
1261 case DNS_NODATA:
1262 return t->data.val = CSA_UNKNOWN;
1263
1264 /* We got something! Go on to look at the reply in more detail. */
1265
1266 case DNS_SUCCEED:
1267 break;
1268 }
1269
1270/* Scan the reply for well-formed CSA SRV records. */
1271
1272for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1273 rr != NULL;
1274 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1275 {
1276 if (rr->type != T_SRV) continue;
1277
1278 /* Extract the numerical SRV fields (p is incremented) */
1279
1280 p = rr->data;
1281 GETSHORT(priority, p);
1282 GETSHORT(weight, p);
1283 GETSHORT(port, p);
1284
1285 DEBUG(D_acl)
1286 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1287
1288 /* Check the CSA version number */
1289
1290 if (priority != 1) continue;
1291
1292 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1293 found by dns_special_lookup() is a parent of the one we asked for), we check
1294 the subdomain assertions in the port field. At the moment there's only one
1295 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1296 SRV records of their own. */
1297
1298 if (found != domain)
1299 {
1300 if (port & 1)
1301 return t->data.val = CSA_FAIL_EXPLICIT;
1302 else
1303 return t->data.val = CSA_UNKNOWN;
1304 }
1305
1306 /* This CSA SRV record refers directly to our domain, so we check the value
1307 in the weight field to work out the domain's authorization. 0 and 1 are
1308 unauthorized; 3 means the client is authorized but we can't check the IP
1309 address in order to authenticate it, so we treat it as unknown; values
1310 greater than 3 are undefined. */
1311
1312 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1313
1314 if (weight > 2) continue;
1315
1316 /* Weight == 2, which means the domain is authorized. We must check that the
1317 client's IP address is listed as one of the SRV target addresses. Save the
1318 target hostname then break to scan the additional data for its addresses. */
1319
1320 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1321 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1322
1323 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1324
1325 break;
1326 }
1327
1328/* If we didn't break the loop then no appropriate records were found. */
1329
1330if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1331
1332/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1333A target of "." indicates there are no valid addresses, so the client cannot
1334be authorized. (This is an odd configuration because weight=2 target=. is
1335equivalent to weight=1, but we check for it in order to keep load off the
1336root name servers.) Note that dn_expand() turns "." into "". */
1337
1338if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1339
1340/* Scan the additional section of the CSA SRV reply for addresses belonging
1341to the target. If the name server didn't return any additional data (e.g.
1342because it does not fully support SRV records), we need to do another lookup
1343to obtain the target addresses; otherwise we have a definitive result. */
1344
1345rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1346if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1347
1348/* The DNS lookup type corresponds to the IP version used by the client. */
1349
1350#if HAVE_IPV6
1351if (Ustrchr(sender_host_address, ':') != NULL)
1352 type = T_AAAA;
1353else
1354#endif /* HAVE_IPV6 */
1355 type = T_A;
1356
1357
1358#if HAVE_IPV6 && defined(SUPPORT_A6)
1359DNS_LOOKUP_AGAIN:
1360#endif
1361
1362switch (dns_lookup(&dnsa, target, type, NULL))
1363 {
1364 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1365
1366 default:
1367 return t->data.val = CSA_DEFER_ADDR;
1368
1369 /* If the query succeeded, scan the addresses and return the result. */
1370
1371 case DNS_SUCCEED:
1372 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1373 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1374 /* else fall through */
1375
1376 /* If the target has no IP addresses, the client cannot have an authorized
1377 IP address. However, if the target site uses A6 records (not AAAA records)
1378 we have to do yet another lookup in order to check them. */
1379
1380 case DNS_NOMATCH:
1381 case DNS_NODATA:
1382
1383 #if HAVE_IPV6 && defined(SUPPORT_A6)
1384 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1385 #endif
1386
1387 return t->data.val = CSA_FAIL_NOADDR;
1388 }
1389}
1390
1391
1392
1393/*************************************************
059ec3d9
PH
1394* Handle verification (address & other) *
1395*************************************************/
1396
1397/* This function implements the "verify" condition. It is called when
1398encountered in any ACL, because some tests are almost always permitted. Some
1399just don't make sense, and always fail (for example, an attempt to test a host
1400lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1401
1402Arguments:
1403 where where called from
1404 addr the recipient address that the ACL is handling, or NULL
1405 arg the argument of "verify"
1406 user_msgptr pointer for user message
1407 log_msgptr pointer for log message
1408 basic_errno where to put verify errno
1409
1410Returns: OK verification condition succeeded
1411 FAIL verification failed
1412 DEFER there was a problem verifying
1413 ERROR syntax error
1414*/
1415
1416static int
1417acl_verify(int where, address_item *addr, uschar *arg,
1418 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1419{
1420int sep = '/';
1421int callout = -1;
1422int callout_overall = -1;
4deaf07d 1423int callout_connect = -1;
059ec3d9
PH
1424int verify_options = 0;
1425int rc;
1426BOOL verify_header_sender = FALSE;
1427BOOL defer_ok = FALSE;
1428BOOL callout_defer_ok = FALSE;
1429BOOL no_details = FALSE;
eafd343b 1430BOOL success_on_redirect = FALSE;
059ec3d9
PH
1431address_item *sender_vaddr = NULL;
1432uschar *verify_sender_address = NULL;
1433uschar *pm_mailfrom = NULL;
1434uschar *se_mailfrom = NULL;
596875b3
PH
1435
1436/* Some of the verify items have slash-separated options; some do not. Diagnose
1437an error if options are given for items that don't expect them. This code has
1438now got very message. Refactoring to use a table would be a good idea one day.
1439*/
1440
1441uschar *slash = Ustrchr(arg, '/');
059ec3d9
PH
1442uschar *list = arg;
1443uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1444
1445if (ss == NULL) goto BAD_VERIFY;
1446
1447/* Handle name/address consistency verification in a separate function. */
1448
1449if (strcmpic(ss, US"reverse_host_lookup") == 0)
1450 {
596875b3 1451 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1452 if (sender_host_address == NULL) return OK;
1453 return acl_verify_reverse(user_msgptr, log_msgptr);
1454 }
1455
1456/* TLS certificate verification is done at STARTTLS time; here we just
1457test whether it was successful or not. (This is for optional verification; for
1458mandatory verification, the connection doesn't last this long.) */
1459
1460if (strcmpic(ss, US"certificate") == 0)
1461 {
596875b3 1462 if (slash != NULL) goto NO_OPTIONS;
059ec3d9
PH
1463 if (tls_certificate_verified) return OK;
1464 *user_msgptr = US"no verified certificate";
1465 return FAIL;
1466 }
1467
d7b47fd0
PH
1468/* We can test the result of optional HELO verification that might have
1469occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1470
596875b3
PH
1471if (strcmpic(ss, US"helo") == 0)
1472 {
1473 if (slash != NULL) goto NO_OPTIONS;
0154e85a
TF
1474 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1475 return helo_verified? OK : FAIL;
596875b3 1476 }
059ec3d9 1477
e5a9dba6
PH
1478/* Do Client SMTP Authorization checks in a separate function, and turn the
1479result code into user-friendly strings. */
1480
1481if (strcmpic(ss, US"csa") == 0)
1482 {
1483 rc = acl_verify_csa(list);
1484 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1485 csa_reason_string[rc]);
1486 csa_status = csa_status_string[rc];
1487 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1488 return csa_return_code[rc];
1489 }
1490
596875b3
PH
1491/* Check that all relevant header lines have the correct syntax. If there is
1492a syntax error, we return details of the error to the sender if configured to
1493send out full details. (But a "message" setting on the ACL can override, as
1494always). */
059ec3d9 1495
596875b3 1496if (strcmpic(ss, US"header_syntax") == 0)
059ec3d9 1497 {
596875b3 1498 if (slash != NULL) goto NO_OPTIONS;
1c41c9cc 1499 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
596875b3
PH
1500 rc = verify_check_headers(log_msgptr);
1501 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1502 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1503 return rc;
1504 }
059ec3d9 1505
1c41c9cc
PH
1506/* Check that no recipient of this message is "blind", that is, every envelope
1507recipient must be mentioned in either To: or Cc:. */
1508
1509if (strcmpic(ss, US"not_blind") == 0)
1510 {
1511 if (slash != NULL) goto NO_OPTIONS;
1512 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
1513 rc = verify_check_notblind();
1514 if (rc != OK)
1515 {
1516 *log_msgptr = string_sprintf("bcc recipient detected");
1517 if (smtp_return_error_details)
1518 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1519 }
1520 return rc;
1521 }
059ec3d9 1522
596875b3
PH
1523/* The remaining verification tests check recipient and sender addresses,
1524either from the envelope or from the header. There are a number of
1525slash-separated options that are common to all of them. */
059ec3d9 1526
059ec3d9 1527
596875b3
PH
1528/* Check that there is at least one verifiable sender address in the relevant
1529header lines. This can be followed by callout and defer options, just like
1530sender and recipient. */
059ec3d9 1531
596875b3
PH
1532if (strcmpic(ss, US"header_sender") == 0)
1533 {
1c41c9cc 1534 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
596875b3 1535 verify_header_sender = TRUE;
059ec3d9
PH
1536 }
1537
1538/* Otherwise, first item in verify argument must be "sender" or "recipient".
1539In the case of a sender, this can optionally be followed by an address to use
1540in place of the actual sender (rare special-case requirement). */
1541
1542else if (strncmpic(ss, US"sender", 6) == 0)
1543 {
1544 uschar *s = ss + 6;
1545 if (where > ACL_WHERE_NOTSMTP)
1546 {
1547 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1548 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1549 acl_wherenames[where]);
1550 return ERROR;
1551 }
1552 if (*s == 0)
1553 verify_sender_address = sender_address;
1554 else
1555 {
1556 while (isspace(*s)) s++;
1557 if (*s++ != '=') goto BAD_VERIFY;
1558 while (isspace(*s)) s++;
1559 verify_sender_address = string_copy(s);
1560 }
1561 }
1562else
1563 {
1564 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1565 if (addr == NULL)
1566 {
1567 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1568 "(only possible for RCPT)", acl_wherenames[where]);
1569 return ERROR;
1570 }
1571 }
1572
596875b3
PH
1573/* Remaining items are optional; they apply to sender and recipient
1574verification, including "header sender" verification. */
059ec3d9
PH
1575
1576while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1577 != NULL)
1578 {
1579 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1580 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1581 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1582
1583 /* These two old options are left for backwards compatibility */
1584
1585 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1586 {
1587 callout_defer_ok = TRUE;
1588 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1589 }
1590
1591 else if (strcmpic(ss, US"check_postmaster") == 0)
1592 {
1593 pm_mailfrom = US"";
1594 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1595 }
1596
1597 /* The callout option has a number of sub-options, comma separated */
1598
1599 else if (strncmpic(ss, US"callout", 7) == 0)
1600 {
1601 callout = CALLOUT_TIMEOUT_DEFAULT;
1602 ss += 7;
1603 if (*ss != 0)
1604 {
1605 while (isspace(*ss)) ss++;
1606 if (*ss++ == '=')
1607 {
1608 int optsep = ',';
1609 uschar *opt;
1610 uschar buffer[256];
1611 while (isspace(*ss)) ss++;
8e669ac1
PH
1612
1613 /* This callout option handling code has become a mess as new options
1614 have been added in an ad hoc manner. It should be tidied up into some
4deaf07d 1615 kind of table-driven thing. */
8e669ac1 1616
059ec3d9
PH
1617 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1618 != NULL)
1619 {
1620 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1621 else if (strcmpic(opt, US"no_cache") == 0)
1622 verify_options |= vopt_callout_no_cache;
1623 else if (strcmpic(opt, US"random") == 0)
1624 verify_options |= vopt_callout_random;
1625 else if (strcmpic(opt, US"use_sender") == 0)
1626 verify_options |= vopt_callout_recipsender;
1627 else if (strcmpic(opt, US"use_postmaster") == 0)
1628 verify_options |= vopt_callout_recippmaster;
1629 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
2a4be8f9
PH
1630 else if (strcmpic(opt, US"fullpostmaster") == 0)
1631 {
1632 pm_mailfrom = US"";
1633 verify_options |= vopt_callout_fullpm;
1634 }
059ec3d9
PH
1635
1636 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1637 {
1638 if (!verify_header_sender)
1639 {
1640 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1641 "callout option only for verify=header_sender (detected in ACL "
1642 "condition \"%s\")", arg);
1643 return ERROR;
1644 }
1645 opt += 8;
1646 while (isspace(*opt)) opt++;
1647 if (*opt++ != '=')
1648 {
1649 *log_msgptr = string_sprintf("'=' expected after "
1650 "\"mailfrom\" in ACL condition \"%s\"", arg);
1651 return ERROR;
1652 }
1653 while (isspace(*opt)) opt++;
1654 se_mailfrom = string_copy(opt);
1655 }
1656
1657 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1658 {
1659 opt += 19;
1660 while (isspace(*opt)) opt++;
1661 if (*opt++ != '=')
1662 {
1663 *log_msgptr = string_sprintf("'=' expected after "
1664 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1665 return ERROR;
1666 }
1667 while (isspace(*opt)) opt++;
1668 pm_mailfrom = string_copy(opt);
1669 }
1670
1671 else if (strncmpic(opt, US"maxwait", 7) == 0)
1672 {
1673 opt += 7;
1674 while (isspace(*opt)) opt++;
1675 if (*opt++ != '=')
1676 {
1677 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1678 "ACL condition \"%s\"", arg);
1679 return ERROR;
1680 }
1681 while (isspace(*opt)) opt++;
1682 callout_overall = readconf_readtime(opt, 0, FALSE);
1683 if (callout_overall < 0)
1684 {
1685 *log_msgptr = string_sprintf("bad time value in ACL condition "
1686 "\"verify %s\"", arg);
1687 return ERROR;
1688 }
1689 }
4deaf07d
PH
1690 else if (strncmpic(opt, US"connect", 7) == 0)
1691 {
1692 opt += 7;
1693 while (isspace(*opt)) opt++;
1694 if (*opt++ != '=')
1695 {
1696 *log_msgptr = string_sprintf("'=' expected after "
1697 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1698 return ERROR;
1699 }
1700 while (isspace(*opt)) opt++;
1701 callout_connect = readconf_readtime(opt, 0, FALSE);
1702 if (callout_connect < 0)
1703 {
1704 *log_msgptr = string_sprintf("bad time value in ACL condition "
1705 "\"verify %s\"", arg);
1706 return ERROR;
1707 }
1708 }
059ec3d9
PH
1709 else /* Plain time is callout connect/command timeout */
1710 {
1711 callout = readconf_readtime(opt, 0, FALSE);
1712 if (callout < 0)
1713 {
1714 *log_msgptr = string_sprintf("bad time value in ACL condition "
1715 "\"verify %s\"", arg);
1716 return ERROR;
1717 }
1718 }
1719 }
1720 }
1721 else
1722 {
1723 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1724 "ACL condition \"%s\"", arg);
1725 return ERROR;
1726 }
1727 }
1728 }
1729
1730 /* Option not recognized */
1731
1732 else
1733 {
1734 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1735 "condition \"verify %s\"", ss, arg);
1736 return ERROR;
1737 }
1738 }
1739
1740if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1741 (vopt_callout_recipsender|vopt_callout_recippmaster))
1742 {
1743 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1744 "for a recipient callout";
1745 return ERROR;
1746 }
1747
1748/* Handle sender-in-header verification. Default the user message to the log
1749message if giving out verification details. */
1750
1751if (verify_header_sender)
1752 {
8e669ac1 1753 int verrno;
059ec3d9 1754 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH
1755 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1756 &verrno);
1757 if (rc != OK)
8e669ac1 1758 {
fe5b5d0b
PH
1759 *basic_errno = verrno;
1760 if (smtp_return_error_details)
1761 {
1762 if (*user_msgptr == NULL && *log_msgptr != NULL)
1763 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1764 if (rc == DEFER) acl_temp_details = TRUE;
1765 }
8e669ac1 1766 }
059ec3d9
PH
1767 }
1768
1769/* Handle a sender address. The default is to verify *the* sender address, but
1770optionally a different address can be given, for special requirements. If the
1771address is empty, we are dealing with a bounce message that has no sender, so
1772we cannot do any checking. If the real sender address gets rewritten during
1773verification (e.g. DNS widening), set the flag to stop it being rewritten again
1774during message reception.
1775
1776A list of verified "sender" addresses is kept to try to avoid doing to much
1777work repetitively when there are multiple recipients in a message and they all
1778require sender verification. However, when callouts are involved, it gets too
1779complicated because different recipients may require different callout options.
1780Therefore, we always do a full sender verify when any kind of callout is
1781specified. Caching elsewhere, for instance in the DNS resolver and in the
1782callout handling, should ensure that this is not terribly inefficient. */
1783
1784else if (verify_sender_address != NULL)
1785 {
1786 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1787 != 0)
1788 {
1789 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1790 "sender verify callout";
1791 return ERROR;
1792 }
1793
1794 sender_vaddr = verify_checked_sender(verify_sender_address);
1795 if (sender_vaddr != NULL && /* Previously checked */
1796 callout <= 0) /* No callout needed this time */
1797 {
1798 /* If the "routed" flag is set, it means that routing worked before, so
1799 this check can give OK (the saved return code value, if set, belongs to a
1800 callout that was done previously). If the "routed" flag is not set, routing
1801 must have failed, so we use the saved return code. */
1802
1803 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1804 {
1805 rc = sender_vaddr->special_action;
1806 *basic_errno = sender_vaddr->basic_errno;
1807 }
1808 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1809 }
1810
1811 /* Do a new verification, and cache the result. The cache is used to avoid
1812 verifying the sender multiple times for multiple RCPTs when callouts are not
1813 specified (see comments above).
1814
1815 The cache is also used on failure to give details in response to the first
1816 RCPT that gets bounced for this reason. However, this can be suppressed by
1817 the no_details option, which sets the flag that says "this detail has already
1818 been sent". The cache normally contains just one address, but there may be
1819 more in esoteric circumstances. */
1820
1821 else
1822 {
1823 BOOL routed = TRUE;
2a3eea10 1824 uschar *save_address_data = deliver_address_data;
8e669ac1 1825
059ec3d9
PH
1826 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1827 if (no_details) setflag(sender_vaddr, af_sverify_told);
1828 if (verify_sender_address[0] != 0)
1829 {
1830 /* If this is the real sender address, save the unrewritten version
1831 for use later in receive. Otherwise, set a flag so that rewriting the
1832 sender in verify_address() does not update sender_address. */
1833
1834 if (verify_sender_address == sender_address)
1835 sender_address_unrewritten = sender_address;
1836 else
1837 verify_options |= vopt_fake_sender;
1838
eafd343b
TK
1839 if (success_on_redirect)
1840 verify_options |= vopt_success_on_redirect;
1841
059ec3d9
PH
1842 /* The recipient, qualify, and expn options are never set in
1843 verify_options. */
1844
1845 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1846 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH
1847
1848 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1849
1850 if (rc == OK)
1851 {
1852 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1853 {
1854 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1855 verify_sender_address, sender_vaddr->address);
1856 }
1857 else
1858 {
1859 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1860 verify_sender_address);
1861 }
1862 }
1863 else *basic_errno = sender_vaddr->basic_errno;
1864 }
1865 else rc = OK; /* Null sender */
1866
1867 /* Cache the result code */
1868
1869 if (routed) setflag(sender_vaddr, af_verify_routed);
1870 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1871 sender_vaddr->special_action = rc;
1872 sender_vaddr->next = sender_verified_list;
1873 sender_verified_list = sender_vaddr;
8e669ac1
PH
1874
1875 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 1876 the sender verification. */
8e669ac1 1877
2a3eea10 1878 deliver_address_data = save_address_data;
059ec3d9 1879 }
8e669ac1 1880
2a3eea10
PH
1881 /* Put the sender address_data value into $sender_address_data */
1882
8e669ac1 1883 sender_address_data = sender_vaddr->p.address_data;
059ec3d9
PH
1884 }
1885
1886/* A recipient address just gets a straightforward verify; again we must handle
1887the DEFER overrides. */
1888
1889else
1890 {
1891 address_item addr2;
1892
eafd343b
TK
1893 if (success_on_redirect)
1894 verify_options |= vopt_success_on_redirect;
1895
059ec3d9
PH
1896 /* We must use a copy of the address for verification, because it might
1897 get rewritten. */
1898
1899 addr2 = *addr;
1900 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 1901 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 1902 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 1903
059ec3d9 1904 *log_msgptr = addr2.message;
8e669ac1 1905 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 1906 addr2.user_message : addr2.message;
059ec3d9
PH
1907 *basic_errno = addr2.basic_errno;
1908
1909 /* Make $address_data visible */
1910 deliver_address_data = addr2.p.address_data;
1911 }
1912
1913/* We have a result from the relevant test. Handle defer overrides first. */
1914
1915if (rc == DEFER && (defer_ok ||
1916 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1917 {
1918 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1919 defer_ok? "defer_ok" : "callout_defer_ok");
1920 rc = OK;
1921 }
1922
1923/* If we've failed a sender, set up a recipient message, and point
1924sender_verified_failed to the address item that actually failed. */
1925
1926if (rc != OK && verify_sender_address != NULL)
1927 {
1928 if (rc != DEFER)
1929 {
1930 *log_msgptr = *user_msgptr = US"Sender verify failed";
1931 }
1932 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1933 {
1934 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1935 }
1936 else
1937 {
1938 *log_msgptr = US"Could not complete sender verify callout";
1939 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1940 *log_msgptr;
1941 }
1942
1943 sender_verified_failed = sender_vaddr;
1944 }
1945
1946/* Verifying an address messes up the values of $domain and $local_part,
1947so reset them before returning if this is a RCPT ACL. */
1948
1949if (addr != NULL)
1950 {
1951 deliver_domain = addr->domain;
1952 deliver_localpart = addr->local_part;
1953 }
1954return rc;
1955
1956/* Syntax errors in the verify argument come here. */
1957
1958BAD_VERIFY:
1959*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
596875b3
PH
1960 "\"helo\", \"header_syntax\", \"header_sender\" or "
1961 "\"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
1962 "\"verify %s\"", arg);
1963return ERROR;
596875b3
PH
1964
1965/* Options supplied when not allowed come here */
1966
1967NO_OPTIONS:
1968*log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1969 "(this verify item has no options)", arg);
1970return ERROR;
1c41c9cc
PH
1971
1972/* Calls in the wrong ACL come here */
1973
1974WRONG_ACL:
1975*log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
1976 "(only possible in ACL for DATA)", acl_wherenames[where]);
1977return ERROR;
059ec3d9
PH
1978}
1979
1980
1981
1982
1983/*************************************************
1984* Check argument for control= modifier *
1985*************************************************/
1986
1987/* Called from acl_check_condition() below
1988
1989Arguments:
1990 arg the argument string for control=
1991 pptr set to point to the terminating character
1992 where which ACL we are in
1993 log_msgptr for error messages
1994
1995Returns: CONTROL_xxx value
1996*/
1997
1998static int
1999decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2000{
2001int len;
2002control_def *d;
2003
2004for (d = controls_list;
2005 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2006 d++)
2007 {
2008 len = Ustrlen(d->name);
2009 if (Ustrncmp(d->name, arg, len) == 0) break;
2010 }
2011
2012if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2013 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2014 {
2015 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2016 return CONTROL_ERROR;
2017 }
2018
059ec3d9
PH
2019*pptr = arg + len;
2020return d->value;
2021}
2022
2023
2024
2025/*************************************************
870f6ba8
TF
2026* Handle rate limiting *
2027*************************************************/
2028
2029/* Called by acl_check_condition() below to calculate the result
2030of the ACL ratelimit condition.
2031
2032Note that the return value might be slightly unexpected: if the
2033sender's rate is above the limit then the result is OK. This is
2034similar to the dnslists condition, and is so that you can write
2035ACL clauses like: defer ratelimit = 15 / 1h
2036
2037Arguments:
2038 arg the option string for ratelimit=
90fc3069 2039 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2040 log_msgptr for error messages
2041
2042Returns: OK - Sender's rate is above limit
2043 FAIL - Sender's rate is below limit
2044 DEFER - Problem opening ratelimit database
2045 ERROR - Syntax error in options.
2046*/
2047
2048static int
90fc3069 2049acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
870f6ba8
TF
2050{
2051double limit, period;
f3dcf4a2 2052uschar *ss, *key;
870f6ba8
TF
2053int sep = '/';
2054BOOL have_key = FALSE, leaky = FALSE, strict = FALSE;
2055BOOL per_byte = FALSE, per_cmd = FALSE, per_conn = FALSE, per_mail = FALSE;
2056int old_pool, rc;
2057tree_node **anchor, *t;
2058open_db dbblock, *dbm;
2059dbdata_ratelimit *dbd;
2060struct timeval tv;
2061
2062/* Parse the first two options and record their values in expansion
2063variables. These variables allow the configuration to have informative
2064error messages based on rate limits obtained from a table lookup. */
2065
2066/* First is the maximum number of messages per period and maximum burst
2067size, which must be greater than or equal to zero. Zero is useful for
2068rate measurement as opposed to rate limiting. */
2069
2070sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2071if (sender_rate_limit == NULL)
2072 limit = -1.0;
2073else
2074 {
2075 limit = Ustrtod(sender_rate_limit, &ss);
2076 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2077 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2078 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2079 }
2080if (limit < 0.0 || *ss != 0)
2081 {
2082 *log_msgptr = string_sprintf("syntax error in argument for "
2083 "\"ratelimit\" condition: \"%s\" is not a positive number",
2084 sender_rate_limit);
2085 return ERROR;
2086 }
2087
f3dcf4a2
TF
2088/* We use the rest of the argument list following the limit as the
2089lookup key, because it doesn't make sense to use the same stored data
2090if the period or options are different. */
2091
2092key = arg;
2093
870f6ba8
TF
2094/* Second is the rate measurement period and exponential smoothing time
2095constant. This must be strictly greater than zero, because zero leads to
2096run-time division errors. */
2097
2098sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2099if (sender_rate_period == NULL) period = -1.0;
2100else period = readconf_readtime(sender_rate_period, 0, FALSE);
2101if (period <= 0.0)
2102 {
2103 *log_msgptr = string_sprintf("syntax error in argument for "
2104 "\"ratelimit\" condition: \"%s\" is not a time value",
2105 sender_rate_period);
2106 return ERROR;
2107 }
2108
2109/* Parse the other options. Should we check if the per_* options are being
2110used in ACLs where they don't make sense, e.g. per_mail in the connect ACL? */
2111
2112while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2113 != NULL)
2114 {
2115 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2116 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2117 else if (strcmpic(ss, US"per_byte") == 0) per_byte = TRUE;
2118 else if (strcmpic(ss, US"per_cmd") == 0) per_cmd = TRUE;
2119 else if (strcmpic(ss, US"per_conn") == 0) per_conn = TRUE;
2120 else if (strcmpic(ss, US"per_mail") == 0) per_mail = TRUE;
2121 else if (strcmpic(ss, US"per_rcpt") == 0) per_cmd = TRUE; /* alias */
2122 else have_key = TRUE;
2123 }
2124if (leaky + strict > 1 || per_byte + per_cmd + per_conn + per_mail > 1)
2125 {
2126 *log_msgptr = US"conflicting options for \"ratelimit\" condition";
2127 return ERROR;
2128 }
2129
2130/* Default option values */
2131if (!strict) leaky = TRUE;
2132if (!per_byte && !per_cmd && !per_conn) per_mail = TRUE;
2133
f3dcf4a2 2134/* If there is no explicit key, use the sender_host_address. If there is no
870f6ba8
TF
2135sender_host_address (e.g. -bs or acl_not_smtp) then we simply omit it. */
2136
2137if (!have_key && sender_host_address != NULL)
2138 key = string_sprintf("%s / %s", key, sender_host_address);
2139
2140HDEBUG(D_acl) debug_printf("ratelimit condition limit=%.0f period=%.0f key=%s\n",
2141 limit, period, key);
2142
fe0dab11 2143/* See if we have already computed the rate by looking in the relevant tree. For
870f6ba8
TF
2144per-connection rate limiting, store tree nodes and dbdata in the permanent pool
2145so that they survive across resets. */
2146
2147anchor = NULL;
2148old_pool = store_pool;
2149
2150if (per_conn)
2151 {
2152 anchor = &ratelimiters_conn;
2153 store_pool = POOL_PERM;
2154 }
fe0dab11 2155else if (per_mail || per_byte)
870f6ba8 2156 anchor = &ratelimiters_mail;
fe0dab11
TF
2157else if (per_cmd)
2158 anchor = &ratelimiters_cmd;
870f6ba8
TF
2159
2160if (anchor != NULL && (t = tree_search(*anchor, key)) != NULL)
2161 {
2162 dbd = t->data.ptr;
2163 /* The following few lines duplicate some of the code below. */
3348576f
TF
2164 if (dbd->rate < limit) rc = FAIL;
2165 else rc = OK;
870f6ba8
TF
2166 store_pool = old_pool;
2167 sender_rate = string_sprintf("%.1f", dbd->rate);
2168 HDEBUG(D_acl)
2169 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2170 return rc;
2171 }
2172
2173/* We aren't using a pre-computed rate, so get a previously recorded
2174rate from the database, update it, and write it back. If there's no
2175previous rate for this key, create one. */
2176
2177dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2178if (dbm == NULL)
2179 {
2180 store_pool = old_pool;
2181 sender_rate = NULL;
2182 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2183 *log_msgptr = US"ratelimit database not available";
2184 return DEFER;
2185 }
2186dbd = dbfn_read(dbm, key);
2187
2188gettimeofday(&tv, NULL);
2189
2190if (dbd == NULL)
2191 {
2192 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's data\n");
2193 dbd = store_get(sizeof(dbdata_ratelimit));
2194 dbd->time_stamp = tv.tv_sec;
2195 dbd->time_usec = tv.tv_usec;
2196 dbd->rate = 0.0;
2197 }
2198else
2199 {
2200 /* The smoothed rate is computed using an exponentially weighted moving
2201 average adjusted for variable sampling intervals. The standard EWMA for
2202 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2203 where f() is the measured value and f'() is the smoothed value.
2204
2205 Old data decays out of the smoothed value exponentially, such that data n
2206 samples old is multiplied by a^n. The exponential decay time constant p
2207 is defined such that data p samples old is multiplied by 1/e, which means
2208 that a = exp(-1/p). We can maintain the same time constant for a variable
2209 sampling interval i by using a = exp(-i/p).
2210
2211 The rate we are measuring is messages per period, suitable for directly
2212 comparing with the limit. The average rate between now and the previous
2213 message is period / interval, which we feed into the EWMA as the sample.
2214
2215 It turns out that the number of messages required for the smoothed rate
2216 to reach the limit when they are sent in a burst is equal to the limit.
2217 This can be seen by analysing the value of the smoothed rate after N
2218 messages sent at even intervals. Let k = (1 - a) * p/i
2219
2220 rate_1 = (1 - a) * p/i + a * rate_0
2221 = k + a * rate_0
2222 rate_2 = k + a * rate_1
2223 = k + a * k + a^2 * rate_0
2224 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2225 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2226 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2227 = rate_0 * a^N + p/i * (1 - a^N)
2228
2229 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2230
2231 rate_N = p/i + (rate_0 - p/i) * a^N
2232 a^N = (rate_N - p/i) / (rate_0 - p/i)
2233 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2234 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2235
2236 Numerical analysis of the above equation, setting the computed rate to
2237 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2238 rates, p/i, the number of messages N = limit. So limit serves as both the
2239 maximum rate measured in messages per period, and the maximum number of
2240 messages that can be sent in a fast burst. */
2241
2242 double this_time = (double)tv.tv_sec
2243 + (double)tv.tv_usec / 1000000.0;
2244 double prev_time = (double)dbd->time_stamp
2245 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2246
2247 /* We must avoid division by zero, and deal gracefully with the clock going
2248 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2249 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2250
e5d5a95f
TF
2251 double interval = this_time - prev_time <= 0.0 ? 1e-9
2252 : this_time - prev_time;
2253
2254 double i_over_p = interval / period;
2255 double a = exp(-i_over_p);
870f6ba8
TF
2256
2257 dbd->time_stamp = tv.tv_sec;
2258 dbd->time_usec = tv.tv_usec;
2259
2260 /* If we are measuring the rate in bytes per period, multiply the
2261 measured rate by the message size. If we don't know the message size
2262 then it's safe to just use a value of zero and let the recorded rate
2263 decay as if nothing happened. */
2264
2265 if (per_byte)
2266 dbd->rate = (message_size < 0 ? 0.0 : (double)message_size)
2267 * (1 - a) / i_over_p + a * dbd->rate;
90fc3069
TF
2268 else if (per_cmd && where == ACL_WHERE_NOTSMTP)
2269 dbd->rate = (double)recipients_count
2270 * (1 - a) / i_over_p + a * dbd->rate;
870f6ba8
TF
2271 else
2272 dbd->rate = (1 - a) / i_over_p + a * dbd->rate;
2273 }
2274
3348576f
TF
2275/* Clients sending at the limit are considered to be over the limit. This
2276matters for edge cases such the first message sent by a client (which gets
2277the initial rate of 0.0) when the rate limit is zero (i.e. the client should
2278be completely blocked). */
2279
2280if (dbd->rate < limit) rc = FAIL;
2281 else rc = OK;
870f6ba8
TF
2282
2283/* Update the state if the rate is low or if we are being strict. If we
2284are in leaky mode and the sender's rate is too high, we do not update
2285the recorded rate in order to avoid an over-aggressive sender's retry
2286rate preventing them from getting any email through. */
2287
2288if (rc == FAIL || !leaky)
2289 dbfn_write(dbm, key, dbd, sizeof(dbdata_ratelimit));
2290dbfn_close(dbm);
2291
2292/* Store the result in the tree for future reference, if necessary. */
2293
2294if (anchor != NULL)
2295 {
2296 t = store_get(sizeof(tree_node) + Ustrlen(key));
2297 t->data.ptr = dbd;
2298 Ustrcpy(t->name, key);
2299 (void)tree_insertnode(anchor, t);
2300 }
2301
2302/* We create the formatted version of the sender's rate very late in
2303order to ensure that it is done using the correct storage pool. */
2304
2305store_pool = old_pool;
2306sender_rate = string_sprintf("%.1f", dbd->rate);
2307
2308HDEBUG(D_acl)
2309 debug_printf("ratelimit computed rate %s\n", sender_rate);
2310
2311return rc;
2312}
2313
2314
2315
2316/*************************************************
059ec3d9
PH
2317* Handle conditions/modifiers on an ACL item *
2318*************************************************/
2319
2320/* Called from acl_check() below.
2321
2322Arguments:
2323 verb ACL verb
2324 cb ACL condition block - if NULL, result is OK
2325 where where called from
2326 addr the address being checked for RCPT, or NULL
2327 level the nesting level
2328 epp pointer to pass back TRUE if "endpass" encountered
2329 (applies only to "accept" and "discard")
2330 user_msgptr user message pointer
2331 log_msgptr log message pointer
2332 basic_errno pointer to where to put verify error
2333
2334Returns: OK - all conditions are met
2335 DISCARD - an "acl" condition returned DISCARD - only allowed
2336 for "accept" or "discard" verbs
2337 FAIL - at least one condition fails
2338 FAIL_DROP - an "acl" condition returned FAIL_DROP
2339 DEFER - can't tell at the moment (typically, lookup defer,
2340 but can be temporary callout problem)
2341 ERROR - ERROR from nested ACL or expansion failure or other
2342 error
2343*/
2344
2345static int
2346acl_check_condition(int verb, acl_condition_block *cb, int where,
2347 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2348 uschar **log_msgptr, int *basic_errno)
2349{
2350uschar *user_message = NULL;
2351uschar *log_message = NULL;
2352uschar *p;
2353int rc = OK;
8523533c
TK
2354#ifdef WITH_CONTENT_SCAN
2355int sep = '/';
2356#endif
059ec3d9
PH
2357
2358for (; cb != NULL; cb = cb->next)
2359 {
2360 uschar *arg;
8e669ac1 2361 int control_type;
059ec3d9
PH
2362
2363 /* The message and log_message items set up messages to be used in
2364 case of rejection. They are expanded later. */
2365
2366 if (cb->type == ACLC_MESSAGE)
2367 {
2368 user_message = cb->arg;
2369 continue;
2370 }
2371
2372 if (cb->type == ACLC_LOG_MESSAGE)
2373 {
2374 log_message = cb->arg;
2375 continue;
2376 }
2377
2378 /* The endpass "condition" just sets a flag to show it occurred. This is
2379 checked at compile time to be on an "accept" or "discard" item. */
2380
2381 if (cb->type == ACLC_ENDPASS)
2382 {
2383 *epp = TRUE;
2384 continue;
2385 }
2386
2387 /* For other conditions and modifiers, the argument is expanded now for some
2388 of them, but not for all, because expansion happens down in some lower level
2389 checking functions in some cases. */
2390
2391 if (cond_expand_at_top[cb->type])
2392 {
2393 arg = expand_string(cb->arg);
2394 if (arg == NULL)
2395 {
2396 if (expand_string_forcedfail) continue;
2397 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2398 cb->arg, expand_string_message);
2399 return search_find_defer? DEFER : ERROR;
2400 }
2401 }
2402 else arg = cb->arg;
2403
2404 /* Show condition, and expanded condition if it's different */
2405
2406 HDEBUG(D_acl)
2407 {
2408 int lhswidth = 0;
2409 debug_printf("check %s%s %n",
2410 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2411 conditions[cb->type], &lhswidth);
2412
2413 if (cb->type == ACLC_SET)
2414 {
2415 int n = cb->u.varnumber;
47ca6d6c
PH
2416 int t = (n < ACL_CVARS)? 'c' : 'm';
2417 if (n >= ACL_CVARS) n -= ACL_CVARS;
059ec3d9
PH
2418 debug_printf("acl_%c%d ", t, n);
2419 lhswidth += 7;
2420 }
2421
2422 debug_printf("= %s\n", cb->arg);
2423
2424 if (arg != cb->arg)
2425 debug_printf("%.*s= %s\n", lhswidth,
2426 US" ", CS arg);
2427 }
2428
2429 /* Check that this condition makes sense at this time */
2430
2431 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2432 {
2433 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2434 cond_modifiers[cb->type]? "use" : "test",
2435 conditions[cb->type], acl_wherenames[where]);
2436 return ERROR;
2437 }
2438
2439 /* Run the appropriate test for each condition, or take the appropriate
2440 action for the remaining modifiers. */
2441
2442 switch(cb->type)
2443 {
71fafd95
PH
2444 case ACLC_ADD_HEADER:
2445 setup_header(arg);
2446 break;
2447
059ec3d9
PH
2448 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2449 "discard" verb. */
71fafd95 2450
059ec3d9
PH
2451 case ACLC_ACL:
2452 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
2453 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2454 {
2455 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2456 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2457 verbs[verb]);
2458 return ERROR;
2459 }
2460 break;
2461
2462 case ACLC_AUTHENTICATED:
2463 rc = (sender_host_authenticated == NULL)? FAIL :
2464 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2465 TRUE, NULL);
2466 break;
2467
71fafd95 2468 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2469 case ACLC_BMI_OPTIN:
2470 {
2471 int old_pool = store_pool;
2472 store_pool = POOL_PERM;
2473 bmi_current_optin = string_copy(arg);
2474 store_pool = old_pool;
2475 }
2476 break;
71fafd95 2477 #endif
8523533c 2478
059ec3d9
PH
2479 case ACLC_CONDITION:
2480 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2481 rc = (Uatoi(arg) == 0)? FAIL : OK;
2482 else
2483 rc = (strcmpic(arg, US"no") == 0 ||
2484 strcmpic(arg, US"false") == 0)? FAIL :
2485 (strcmpic(arg, US"yes") == 0 ||
2486 strcmpic(arg, US"true") == 0)? OK : DEFER;
2487 if (rc == DEFER)
2488 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2489 break;
2490
2491 case ACLC_CONTROL:
c5fcb476
PH
2492 control_type = decode_control(arg, &p, where, log_msgptr);
2493
8523533c 2494 /* Check if this control makes sense at this time */
c5fcb476
PH
2495
2496 if ((control_forbids[control_type] & (1 << where)) != 0)
2497 {
2498 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2499 controls[control_type], acl_wherenames[where]);
2500 return ERROR;
8e669ac1 2501 }
c5fcb476
PH
2502
2503 switch(control_type)
059ec3d9 2504 {
c46782ef
PH
2505 case CONTROL_AUTH_UNADVERTISED:
2506 allow_auth_unadvertised = TRUE;
2507 break;
2508
2509 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2510 case CONTROL_BMI_RUN:
2511 bmi_run = 1;
2512 break;
c46782ef
PH
2513 #endif
2514
2515 #ifdef EXPERIMENTAL_DOMAINKEYS
fb2274d4
TK
2516 case CONTROL_DK_VERIFY:
2517 dk_do_verify = 1;
2518 break;
c46782ef
PH
2519 #endif
2520
059ec3d9
PH
2521 case CONTROL_ERROR:
2522 return ERROR;
2523
2524 case CONTROL_CASEFUL_LOCAL_PART:
2525 deliver_localpart = addr->cc_local_part;
2526 break;
2527
2528 case CONTROL_CASELOWER_LOCAL_PART:
2529 deliver_localpart = addr->lc_local_part;
2530 break;
2531
2532 case CONTROL_ENFORCE_SYNC:
2533 smtp_enforce_sync = TRUE;
2534 break;
2535
2536 case CONTROL_NO_ENFORCE_SYNC:
2537 smtp_enforce_sync = FALSE;
2538 break;
2539
c46782ef 2540 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2541 case CONTROL_NO_MBOX_UNSPOOL:
2542 no_mbox_unspool = TRUE;
2543 break;
c46782ef 2544 #endif
8523533c 2545
059ec3d9
PH
2546 case CONTROL_NO_MULTILINE:
2547 no_multiline_responses = TRUE;
2548 break;
2549
29aba418 2550 case CONTROL_FAKEDEFER:
8523533c 2551 case CONTROL_FAKEREJECT:
29aba418 2552 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
8523533c 2553 if (*p == '/')
8e669ac1 2554 {
8523533c 2555 uschar *pp = p + 1;
8e669ac1 2556 while (*pp != 0) pp++;
29aba418 2557 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
8523533c
TK
2558 p = pp;
2559 }
2560 else
2561 {
2562 /* Explicitly reset to default string */
29aba418 2563 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
8523533c
TK
2564 }
2565 break;
8523533c 2566
059ec3d9
PH
2567 case CONTROL_FREEZE:
2568 deliver_freeze = TRUE;
2569 deliver_frozen_at = time(NULL);
6a3f1455
PH
2570 freeze_tell = freeze_tell_config; /* Reset to configured value */
2571 if (Ustrncmp(p, "/no_tell", 8) == 0)
2572 {
2573 p += 8;
2574 freeze_tell = NULL;
2575 }
2576 if (*p != 0)
2577 {
2578 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2579 return ERROR;
2580 }
059ec3d9
PH
2581 break;
2582
2583 case CONTROL_QUEUE_ONLY:
2584 queue_only_policy = TRUE;
2585 break;
2586
2587 case CONTROL_SUBMISSION:
87ba3f5f 2588 originator_name = US"";
059ec3d9 2589 submission_mode = TRUE;
69358f02 2590 while (*p == '/')
8e669ac1 2591 {
69358f02
PH
2592 if (Ustrncmp(p, "/sender_retain", 14) == 0)
2593 {
2594 p += 14;
2595 active_local_sender_retain = TRUE;
8e669ac1
PH
2596 active_local_from_check = FALSE;
2597 }
69358f02
PH
2598 else if (Ustrncmp(p, "/domain=", 8) == 0)
2599 {
2600 uschar *pp = p + 8;
8e669ac1 2601 while (*pp != 0 && *pp != '/') pp++;
87ba3f5f
PH
2602 submission_domain = string_copyn(p+8, pp-p-8);
2603 p = pp;
2604 }
8857ccfd
PH
2605 /* The name= option must be last, because it swallows the rest of
2606 the string. */
87ba3f5f
PH
2607 else if (Ustrncmp(p, "/name=", 6) == 0)
2608 {
2609 uschar *pp = p + 6;
8857ccfd 2610 while (*pp != 0) pp++;
2fe1a124 2611 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
87ba3f5f 2612 big_buffer, big_buffer_size));
8e669ac1 2613 p = pp;
69358f02 2614 }
8e669ac1
PH
2615 else break;
2616 }
69358f02 2617 if (*p != 0)
059ec3d9 2618 {
69358f02 2619 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
059ec3d9
PH
2620 return ERROR;
2621 }
2622 break;
8800895a
PH
2623
2624 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
2625 suppress_local_fixups = TRUE;
2626 break;
059ec3d9
PH
2627 }
2628 break;
2629
71fafd95 2630 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2631 case ACLC_DECODE:
2632 rc = mime_decode(&arg);
2633 break;
71fafd95 2634 #endif
8523533c 2635
059ec3d9
PH
2636 case ACLC_DELAY:
2637 {
2638 int delay = readconf_readtime(arg, 0, FALSE);
2639 if (delay < 0)
2640 {
2641 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
2642 "modifier: \"%s\" is not a time value", arg);
2643 return ERROR;
2644 }
2645 else
2646 {
2647 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
2648 delay);
2649 if (host_checking)
2650 {
2651 HDEBUG(D_acl)
2652 debug_printf("delay skipped in -bh checking mode\n");
2653 }
010c2d14
PH
2654
2655 /* It appears to be impossible to detect that a TCP/IP connection has
2656 gone away without reading from it. This means that we cannot shorten
2657 the delay below if the client goes away, because we cannot discover
2658 that the client has closed its end of the connection. (The connection
2659 is actually in a half-closed state, waiting for the server to close its
2660 end.) It would be nice to be able to detect this state, so that the
2661 Exim process is not held up unnecessarily. However, it seems that we
2662 can't. The poll() function does not do the right thing, and in any case
2663 it is not always available.
2664
2665 NOTE: If ever this state of affairs changes, remember that we may be
2666 dealing with stdin/stdout here, in addition to TCP/IP connections.
2667 Whatever is done must work in both cases. To detected the stdin/stdout
2668 case, check for smtp_in or smtp_out being NULL. */
2669
8e669ac1 2670 else
86b8287f
PH
2671 {
2672 while (delay > 0) delay = sleep(delay);
8e669ac1 2673 }
059ec3d9
PH
2674 }
2675 }
2676 break;
2677
71fafd95 2678 #ifdef WITH_OLD_DEMIME
8523533c
TK
2679 case ACLC_DEMIME:
2680 rc = demime(&arg);
2681 break;
71fafd95 2682 #endif
8523533c 2683
71fafd95
PH
2684 #ifdef EXPERIMENTAL_DOMAINKEYS
2685 case ACLC_DK_DOMAIN_SOURCE:
fb2274d4
TK
2686 if (dk_verify_block == NULL) { rc = FAIL; break; };
2687 /* check header source of domain against given string */
2688 switch (dk_verify_block->address_source) {
2689 case DK_EXIM_ADDRESS_FROM_FROM:
2690 rc = match_isinlist(US"from", &arg, 0, NULL,
2691 NULL, MCL_STRING, TRUE, NULL);
2692 break;
2693 case DK_EXIM_ADDRESS_FROM_SENDER:
2694 rc = match_isinlist(US"sender", &arg, 0, NULL,
2695 NULL, MCL_STRING, TRUE, NULL);
2696 break;
2697 case DK_EXIM_ADDRESS_NONE:
2698 rc = match_isinlist(US"none", &arg, 0, NULL,
2699 NULL, MCL_STRING, TRUE, NULL);
2700 break;
71fafd95
PH
2701 }
2702 break;
2703
2704 case ACLC_DK_POLICY:
fb2274d4
TK
2705 if (dk_verify_block == NULL) { rc = FAIL; break; };
2706 /* check policy against given string, default FAIL */
2707 rc = FAIL;
2708 if (dk_verify_block->signsall)
2709 rc = match_isinlist(US"signsall", &arg, 0, NULL,
2710 NULL, MCL_STRING, TRUE, NULL);
2711 if (dk_verify_block->testing)
2712 rc = match_isinlist(US"testing", &arg, 0, NULL,
2713 NULL, MCL_STRING, TRUE, NULL);
71fafd95
PH
2714 break;
2715
2716 case ACLC_DK_SENDER_DOMAINS:
fb2274d4
TK
2717 if (dk_verify_block == NULL) { rc = FAIL; break; };
2718 if (dk_verify_block->domain != NULL)
2719 rc = match_isinlist(dk_verify_block->domain, &arg, 0, &domainlist_anchor,
2720 NULL, MCL_DOMAIN, TRUE, NULL);
2721 else rc = FAIL;
71fafd95
PH
2722 break;
2723
2724 case ACLC_DK_SENDER_LOCAL_PARTS:
fb2274d4
TK
2725 if (dk_verify_block == NULL) { rc = FAIL; break; };
2726 if (dk_verify_block->local_part != NULL)
2727 rc = match_isinlist(dk_verify_block->local_part, &arg, 0, &localpartlist_anchor,
2728 NULL, MCL_LOCALPART, TRUE, NULL);
2729 else rc = FAIL;
71fafd95
PH
2730 break;
2731
2732 case ACLC_DK_SENDERS:
fb2274d4
TK
2733 if (dk_verify_block == NULL) { rc = FAIL; break; };
2734 if (dk_verify_block->address != NULL)
2735 rc = match_address_list(dk_verify_block->address, TRUE, TRUE, &arg, NULL, -1, 0, NULL);
2736 else rc = FAIL;
71fafd95
PH
2737 break;
2738
2739 case ACLC_DK_STATUS:
fb2274d4
TK
2740 if (dk_verify_block == NULL) { rc = FAIL; break; };
2741 if (dk_verify_block->result > 0) {
2742 switch(dk_verify_block->result) {
2743 case DK_EXIM_RESULT_BAD_FORMAT:
2744 rc = match_isinlist(US"bad format", &arg, 0, NULL,
2745 NULL, MCL_STRING, TRUE, NULL);
2746 break;
2747 case DK_EXIM_RESULT_NO_KEY:
2748 rc = match_isinlist(US"no key", &arg, 0, NULL,
2749 NULL, MCL_STRING, TRUE, NULL);
2750 break;
2751 case DK_EXIM_RESULT_NO_SIGNATURE:
2752 rc = match_isinlist(US"no signature", &arg, 0, NULL,
2753 NULL, MCL_STRING, TRUE, NULL);
2754 break;
2755 case DK_EXIM_RESULT_REVOKED:
2756 rc = match_isinlist(US"revoked", &arg, 0, NULL,
2757 NULL, MCL_STRING, TRUE, NULL);
2758 break;
2759 case DK_EXIM_RESULT_NON_PARTICIPANT:
2760 rc = match_isinlist(US"non-participant", &arg, 0, NULL,
2761 NULL, MCL_STRING, TRUE, NULL);
2762 break;
2763 case DK_EXIM_RESULT_GOOD:
2764 rc = match_isinlist(US"good", &arg, 0, NULL,
2765 NULL, MCL_STRING, TRUE, NULL);
2766 break;
2767 case DK_EXIM_RESULT_BAD:
2768 rc = match_isinlist(US"bad", &arg, 0, NULL,
2769 NULL, MCL_STRING, TRUE, NULL);
2770 break;
71fafd95 2771 }
fb2274d4 2772 }
71fafd95
PH
2773 break;
2774 #endif
fb2274d4 2775
059ec3d9
PH
2776 case ACLC_DNSLISTS:
2777 rc = verify_check_dnsbl(&arg);
2778 break;
2779
2780 case ACLC_DOMAINS:
2781 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
2782 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
2783 break;
2784
2785 /* The value in tls_cipher is the full cipher name, for example,
2786 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
2787 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
2788 what may in practice come out of the SSL library - which at the time of
2789 writing is poorly documented. */
2790
2791 case ACLC_ENCRYPTED:
2792 if (tls_cipher == NULL) rc = FAIL; else
2793 {
2794 uschar *endcipher = NULL;
2795 uschar *cipher = Ustrchr(tls_cipher, ':');
2796 if (cipher == NULL) cipher = tls_cipher; else
2797 {
2798 endcipher = Ustrchr(++cipher, ':');
2799 if (endcipher != NULL) *endcipher = 0;
2800 }
2801 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
2802 if (endcipher != NULL) *endcipher = ':';
2803 }
2804 break;
2805
2806 /* Use verify_check_this_host() instead of verify_check_host() so that
2807 we can pass over &host_data to catch any looked up data. Once it has been
2808 set, it retains its value so that it's still there if another ACL verb
2809 comes through here and uses the cache. However, we must put it into
2810 permanent store in case it is also expected to be used in a subsequent
2811 message in the same SMTP connection. */
2812
2813 case ACLC_HOSTS:
2814 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
2815 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
2816 if (host_data != NULL) host_data = string_copy_malloc(host_data);
2817 break;
2818
2819 case ACLC_LOCAL_PARTS:
2820 rc = match_isinlist(addr->cc_local_part, &arg, 0,
2821 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
2822 &deliver_localpart_data);
2823 break;
2824
2825 case ACLC_LOGWRITE:
2826 {
2827 int logbits = 0;
2828 uschar *s = arg;
2829 if (*s == ':')
2830 {
2831 s++;
2832 while (*s != ':')
2833 {
2834 if (Ustrncmp(s, "main", 4) == 0)
2835 { logbits |= LOG_MAIN; s += 4; }
2836 else if (Ustrncmp(s, "panic", 5) == 0)
2837 { logbits |= LOG_PANIC; s += 5; }
2838 else if (Ustrncmp(s, "reject", 6) == 0)
2839 { logbits |= LOG_REJECT; s += 6; }
2840 else
2841 {
2842 logbits = LOG_MAIN|LOG_PANIC;
2843 s = string_sprintf(":unknown log name in \"%s\" in "
2844 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
2845 }
2846 if (*s == ',') s++;
2847 }
2848 s++;
2849 }
2850 while (isspace(*s)) s++;
2851 if (logbits == 0) logbits = LOG_MAIN;
2852 log_write(0, logbits, "%s", string_printing(s));
2853 }
2854 break;
8e669ac1 2855
71fafd95 2856 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2857 case ACLC_MALWARE:
2858 {
2859 /* Seperate the regular expression and any optional parameters. */
2860 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2861 /* Run the malware backend. */
2862 rc = malware(&ss);
2863 /* Modify return code based upon the existance of options. */
2864 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2865 != NULL) {
2866 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2867 {
2868 /* FAIL so that the message is passed to the next ACL */
2869 rc = FAIL;
2870 }
2871 }
2872 }
2873 break;
2874
2875 case ACLC_MIME_REGEX:
71fafd95 2876 rc = mime_regex(&arg);
8523533c 2877 break;
71fafd95 2878 #endif
059ec3d9 2879
870f6ba8 2880 case ACLC_RATELIMIT:
90fc3069 2881 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF
2882 break;
2883
059ec3d9
PH
2884 case ACLC_RECIPIENTS:
2885 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
2886 &recipient_data);
2887 break;
2888
71fafd95
PH
2889 #ifdef WITH_CONTENT_SCAN
2890 case ACLC_REGEX:
2891 rc = regex(&arg);
8523533c 2892 break;
71fafd95 2893 #endif
8523533c 2894
059ec3d9
PH
2895 case ACLC_SENDER_DOMAINS:
2896 {
2897 uschar *sdomain;
2898 sdomain = Ustrrchr(sender_address, '@');
2899 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
2900 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
2901 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
2902 }
2903 break;
2904
2905 case ACLC_SENDERS:
2906 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
2907 sender_address_cache, -1, 0, &sender_data);
2908 break;
2909
2910 /* Connection variables must persist forever */
2911
2912 case ACLC_SET:
2913 {
2914 int old_pool = store_pool;
47ca6d6c 2915 if (cb->u.varnumber < ACL_CVARS) store_pool = POOL_PERM;
059ec3d9
PH
2916 acl_var[cb->u.varnumber] = string_copy(arg);
2917 store_pool = old_pool;
2918 }
2919 break;
2920
71fafd95 2921 #ifdef WITH_CONTENT_SCAN
8523533c
TK
2922 case ACLC_SPAM:
2923 {
2924 /* Seperate the regular expression and any optional parameters. */
2925 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2926 /* Run the spam backend. */
2927 rc = spam(&ss);
2928 /* Modify return code based upon the existance of options. */
2929 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2930 != NULL) {
2931 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2932 {
2933 /* FAIL so that the message is passed to the next ACL */
2934 rc = FAIL;
2935 }
2936 }
2937 }
2938 break;
71fafd95 2939 #endif
8523533c 2940
71fafd95 2941 #ifdef EXPERIMENTAL_SPF
8523533c
TK
2942 case ACLC_SPF:
2943 rc = spf_process(&arg, sender_address);
2944 break;
71fafd95 2945 #endif
8523533c 2946
059ec3d9
PH
2947 /* If the verb is WARN, discard any user message from verification, because
2948 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH
2949 only from explicit "message" modifiers. However, put the user message into
2950 $acl_verify_message so it can be used in subsequent conditions or modifiers
2951 (until something changes it). */
059ec3d9
PH
2952
2953 case ACLC_VERIFY:
2954 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
475fe28a 2955 acl_verify_message = *user_msgptr;
059ec3d9
PH
2956 if (verb == ACL_WARN) *user_msgptr = NULL;
2957 break;
2958
2959 default:
2960 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
2961 "condition %d", cb->type);
2962 break;
2963 }
2964
2965 /* If a condition was negated, invert OK/FAIL. */
2966
2967 if (!cond_modifiers[cb->type] && cb->u.negated)
2968 {
2969 if (rc == OK) rc = FAIL;
2970 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
2971 }
2972
2973 if (rc != OK) break; /* Conditions loop */
2974 }
2975
2976
2977/* If the result is the one for which "message" and/or "log_message" are used,
2978handle the values of these options. Most verbs have but a single return for
2979which the messages are relevant, but for "discard", it's useful to have the log
2980message both when it succeeds and when it fails. Also, for an "accept" that
2981appears in a QUIT ACL, we want to handle the user message. Since only "accept"
2982and "warn" are permitted in that ACL, we don't need to test the verb.
2983
2984These modifiers act in different ways:
2985
2986"message" is a user message that will be included in an SMTP response. Unless
2987it is empty, it overrides any previously set user message.
2988
2989"log_message" is a non-user message, and it adds to any existing non-user
2990message that is already set.
2991
2992If there isn't a log message set, we make it the same as the user message. */
2993
2994if (((rc == FAIL_DROP)? FAIL : rc) == msgcond[verb] ||
2995 (verb == ACL_DISCARD && rc == OK) ||
2996 (where == ACL_WHERE_QUIT))
2997 {
2998 uschar *expmessage;
2999
3000 /* If the verb is "warn", messages generated by conditions (verification or
3001 nested ACLs) are discarded. Only messages specified at this level are used.
3002 However, the value of an existing message is available in $acl_verify_message
3003 during expansions. */
3004
3005 uschar *old_user_msgptr = *user_msgptr;
3006 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3007
3008 if (verb == ACL_WARN) *log_msgptr = *user_msgptr = NULL;
3009
3010 if (user_message != NULL)
3011 {
3012 acl_verify_message = old_user_msgptr;
3013 expmessage = expand_string(user_message);
3014 if (expmessage == NULL)
3015 {
3016 if (!expand_string_forcedfail)
3017 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3018 user_message, expand_string_message);
3019 }
3020 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3021 }
3022
3023 if (log_message != NULL)
3024 {
3025 acl_verify_message = old_log_msgptr;
3026 expmessage = expand_string(log_message);
3027 if (expmessage == NULL)
3028 {
3029 if (!expand_string_forcedfail)
3030 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3031 log_message, expand_string_message);
3032 }
3033 else if (expmessage[0] != 0)
3034 {
3035 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3036 string_sprintf("%s: %s", expmessage, *log_msgptr);
3037 }
3038 }
3039
3040 /* If no log message, default it to the user message */
3041
3042 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3043 }
3044
3045acl_verify_message = NULL;
3046return rc;
3047}
3048
3049
3050
3051
3052
3053/*************************************************
3054* Get line from a literal ACL *
3055*************************************************/
3056
3057/* This function is passed to acl_read() in order to extract individual lines
3058of a literal ACL, which we access via static pointers. We can destroy the
3059contents because this is called only once (the compiled ACL is remembered).
3060
3061This code is intended to treat the data in the same way as lines in the main
3062Exim configuration file. That is:
3063
3064 . Leading spaces are ignored.
3065
3066 . A \ at the end of a line is a continuation - trailing spaces after the \
3067 are permitted (this is because I don't believe in making invisible things
3068 significant). Leading spaces on the continued part of a line are ignored.
3069
3070 . Physical lines starting (significantly) with # are totally ignored, and
3071 may appear within a sequence of backslash-continued lines.
3072
3073 . Blank lines are ignored, but will end a sequence of continuations.
3074
3075Arguments: none
3076Returns: a pointer to the next line
3077*/
3078
3079
3080static uschar *acl_text; /* Current pointer in the text */
3081static uschar *acl_text_end; /* Points one past the terminating '0' */
3082
3083
3084static uschar *
3085acl_getline(void)
3086{
3087uschar *yield;
3088
3089/* This loop handles leading blank lines and comments. */
3090
3091for(;;)
3092 {
3093 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3094 if (*acl_text == 0) return NULL; /* No more data */
3095 yield = acl_text; /* Potential data line */
3096
3097 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3098
3099 /* If we hit the end before a newline, we have the whole logical line. If
3100 it's a comment, there's no more data to be given. Otherwise, yield it. */
3101
3102 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3103
3104 /* After reaching a newline, end this loop if the physical line does not
3105 start with '#'. If it does, it's a comment, and the loop continues. */
3106
3107 if (*yield != '#') break;
3108 }
3109
3110/* This loop handles continuations. We know we have some real data, ending in
3111newline. See if there is a continuation marker at the end (ignoring trailing
3112white space). We know that *yield is not white space, so no need to test for
3113cont > yield in the backwards scanning loop. */
3114
3115for(;;)
3116 {
3117 uschar *cont;
3118 for (cont = acl_text - 1; isspace(*cont); cont--);
3119
3120 /* If no continuation follows, we are done. Mark the end of the line and
3121 return it. */
3122
3123 if (*cont != '\\')
3124 {
3125 *acl_text++ = 0;
3126 return yield;
3127 }
3128
3129 /* We have encountered a continuation. Skip over whitespace at the start of
3130 the next line, and indeed the whole of the next line or lines if they are
3131 comment lines. */
3132
3133 for (;;)
3134 {
3135 while (*(++acl_text) == ' ' || *acl_text == '\t');
3136 if (*acl_text != '#') break;
3137 while (*(++acl_text) != 0 && *acl_text != '\n');
3138 }
3139
3140 /* We have the start of a continuation line. Move all the rest of the data
3141 to join onto the previous line, and then find its end. If the end is not a
3142 newline, we are done. Otherwise loop to look for another continuation. */
3143
3144 memmove(cont, acl_text, acl_text_end - acl_text);
3145 acl_text_end -= acl_text - cont;
3146 acl_text = cont;
3147 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3148 if (*acl_text == 0) return yield;
3149 }
3150
3151/* Control does not reach here */
3152}
3153
3154
3155
3156
3157
3158/*************************************************
3159* Check access using an ACL *
3160*************************************************/
3161
3162/* This function is called from address_check. It may recurse via
3163acl_check_condition() - hence the use of a level to stop looping. The ACL is
3164passed as a string which is expanded. A forced failure implies no access check
3165is required. If the result is a single word, it is taken as the name of an ACL
3166which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3167text, complete with newlines, and parsed as such. In both cases, the ACL check
3168is then run. This function uses an auxiliary function for acl_read() to call
3169for reading individual lines of a literal ACL. This is acl_getline(), which
3170appears immediately above.
3171
3172Arguments:
3173 where where called from
3174 addr address item when called from RCPT; otherwise NULL
3175 s the input string; NULL is the same as an empty ACL => DENY
3176 level the nesting level
3177 user_msgptr where to put a user error (for SMTP response)
3178 log_msgptr where to put a logging message (not for SMTP response)
3179
3180Returns: OK access is granted
3181 DISCARD access is apparently granted...
3182 FAIL access is denied
3183 FAIL_DROP access is denied; drop the connection
3184 DEFER can't tell at the moment
3185 ERROR disaster
3186*/
3187
3188static int
3189acl_check_internal(int where, address_item *addr, uschar *s, int level,
3190 uschar **user_msgptr, uschar **log_msgptr)
3191{
3192int fd = -1;
3193acl_block *acl = NULL;
3194uschar *acl_name = US"inline ACL";
3195uschar *ss;
3196
3197/* Catch configuration loops */
3198
3199if (level > 20)
3200 {
3201 *log_msgptr = US"ACL nested too deep: possible loop";
3202 return ERROR;
3203 }
3204
3205if (s == NULL)
3206 {
3207 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3208 return FAIL;
3209 }
3210
3211/* At top level, we expand the incoming string. At lower levels, it has already
3212been expanded as part of condition processing. */
3213
3214if (level == 0)
3215 {
3216 ss = expand_string(s);
3217 if (ss == NULL)
3218 {
3219 if (expand_string_forcedfail) return OK;
3220 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3221 expand_string_message);
3222 return ERROR;
3223 }
3224 }
3225else ss = s;
3226
3227while (isspace(*ss))ss++;
3228
3229/* If we can't find a named ACL, the default is to parse it as an inline one.
3230(Unless it begins with a slash; non-existent files give rise to an error.) */
3231
3232acl_text = ss;
3233
3234/* Handle the case of a string that does not contain any spaces. Look for a
3235named ACL among those read from the configuration, or a previously read file.
3236It is possible that the pointer to the ACL is NULL if the configuration
3237contains a name with no data. If not found, and the text begins with '/',
3238read an ACL from a file, and save it so it can be re-used. */
3239
3240if (Ustrchr(ss, ' ') == NULL)
3241 {
3242 tree_node *t = tree_search(acl_anchor, ss);
3243 if (t != NULL)
3244 {
3245 acl = (acl_block *)(t->data.ptr);
3246 if (acl == NULL)
3247 {
3248 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3249 return FAIL;
3250 }
3251 acl_name = string_sprintf("ACL \"%s\"", ss);
3252 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3253 }
3254
3255 else if (*ss == '/')
3256 {
3257 struct stat statbuf;
3258 fd = Uopen(ss, O_RDONLY, 0);
3259 if (fd < 0)
3260 {
3261 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3262 strerror(errno));
3263 return ERROR;
3264 }
3265
3266 if (fstat(fd, &statbuf) != 0)
3267 {
3268 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3269 strerror(errno));
3270 return ERROR;
3271 }
3272
3273 acl_text = store_get(statbuf.st_size + 1);
3274 acl_text_end = acl_text + statbuf.st_size + 1;
3275
3276 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3277 {
3278 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3279 ss, strerror(errno));
3280 return ERROR;
3281 }
3282 acl_text[statbuf.st_size] = 0;
f1e894f3 3283 (void)close(fd);
059ec3d9
PH
3284
3285 acl_name = string_sprintf("ACL \"%s\"", ss);
3286 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3287 }
3288 }
3289
3290/* Parse an ACL that is still in text form. If it came from a file, remember it
3291in the ACL tree, having read it into the POOL_PERM store pool so that it
3292persists between multiple messages. */
3293
3294if (acl == NULL)
3295 {
3296 int old_pool = store_pool;
3297 if (fd >= 0) store_pool = POOL_PERM;
3298 acl = acl_read(acl_getline, log_msgptr);
3299 store_pool = old_pool;
3300 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3301 if (fd >= 0)
3302 {
3303 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3304 Ustrcpy(t->name, ss);
3305 t->data.ptr = acl;
3306 (void)tree_insertnode(&acl_anchor, t);
3307 }
3308 }
3309
3310/* Now we have an ACL to use. It's possible it may be NULL. */
3311
3312while (acl != NULL)
3313 {
3314 int cond;
3315 int basic_errno = 0;
3316 BOOL endpass_seen = FALSE;
3317
3318 *log_msgptr = *user_msgptr = NULL;
3319 acl_temp_details = FALSE;
3320
3321 if (where == ACL_WHERE_QUIT &&
3322 acl->verb != ACL_ACCEPT &&
3323 acl->verb != ACL_WARN)
3324 {
3325 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT ACL",
3326 verbs[acl->verb]);
3327 return ERROR;
3328 }
3329
3330 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3331
3332 /* Clear out any search error message from a previous check before testing
3333 this condition. */
3334
3335 search_error_message = NULL;
3336 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3337 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3338
3339 /* Handle special returns: DEFER causes a return except on a WARN verb;
3340 ERROR always causes a return. */
3341
3342 switch (cond)
3343 {
3344 case DEFER:
3345 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
3346 if (basic_errno != ERRNO_CALLOUTDEFER)
3347 {
3348 if (search_error_message != NULL && *search_error_message != 0)
3349 *log_msgptr = search_error_message;
3350 if (smtp_return_error_details) acl_temp_details = TRUE;
3351 }
3352 else
3353 {
3354 acl_temp_details = TRUE;
3355 }
3356 if (acl->verb != ACL_WARN) return DEFER;
3357 break;
3358
3359 default: /* Paranoia */
3360 case ERROR:
3361 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
3362 return ERROR;
3363
3364 case OK:
3365 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
3366 verbs[acl->verb]);
3367 break;
3368
3369 case FAIL:
3370 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
3371 break;
3372
3373 /* DISCARD and DROP can happen only from a nested ACL condition, and
3374 DISCARD can happen only for an "accept" or "discard" verb. */
3375
3376 case DISCARD:
3377 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
3378 verbs[acl->verb]);
3379 break;
3380
3381 case FAIL_DROP:
3382 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
3383 verbs[acl->verb]);
3384 break;
3385 }
3386
3387 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3388 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3389 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3390
3391 switch(acl->verb)
3392 {
3393 case ACL_ACCEPT:
3394 if (cond == OK || cond == DISCARD) return cond;
3395 if (endpass_seen)
3396 {
3397 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3398 return cond;
3399 }
3400 break;
3401
3402 case ACL_DEFER:
3403 if (cond == OK)
3404 {
3405 acl_temp_details = TRUE;
3406 return DEFER;
3407 }
3408 break;
3409
3410 case ACL_DENY:
3411 if (cond == OK) return FAIL;
3412 break;
3413
3414 case ACL_DISCARD:
3415 if (cond == OK || cond == DISCARD) return DISCARD;
3416 if (endpass_seen)
3417 {
3418 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
3419 return cond;
3420 }
3421 break;
3422
3423 case ACL_DROP:
3424 if (cond == OK) return FAIL_DROP;
3425 break;
3426
3427 case ACL_REQUIRE:
3428 if (cond != OK) return cond;
3429 break;
3430
3431 case ACL_WARN:
3432 if (cond == OK)
3433 acl_warn(where, *user_msgptr, *log_msgptr);
49826d12 3434 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
9c7a242c
PH
3435 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
3436 "condition test deferred%s%s", host_and_ident(TRUE),
3437 (*log_msgptr == NULL)? US"" : US": ",
3438 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH
3439 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
3440 break;
3441
3442 default:
3443 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
3444 acl->verb);
3445 break;
3446 }
3447
3448 /* Pass to the next ACL item */
3449
3450 acl = acl->next;
3451 }
3452
3453/* We have reached the end of the ACL. This is an implicit DENY. */
3454
3455HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
3456return FAIL;
3457}
3458
3459
3460/*************************************************
3461* Check access using an ACL *
3462*************************************************/
3463
3464/* This is the external interface for ACL checks. It sets up an address and the
3465expansions for $domain and $local_part when called after RCPT, then calls
3466acl_check_internal() to do the actual work.
3467
3468Arguments:
3469 where ACL_WHERE_xxxx indicating where called from
64ffc24f 3470 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH
3471 s the input string; NULL is the same as an empty ACL => DENY
3472 user_msgptr where to put a user error (for SMTP response)
3473 log_msgptr where to put a logging message (not for SMTP response)
3474
3475Returns: OK access is granted by an ACCEPT verb
3476 DISCARD access is granted by a DISCARD verb
3477 FAIL access is denied
3478 FAIL_DROP access is denied; drop the connection
3479 DEFER can't tell at the moment
3480 ERROR disaster
3481*/
3482
3483int
64ffc24f 3484acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH
3485 uschar **log_msgptr)
3486{
3487int rc;
3488address_item adb;
64ffc24f 3489address_item *addr = NULL;
059ec3d9
PH
3490
3491*user_msgptr = *log_msgptr = NULL;
3492sender_verified_failed = NULL;
fe0dab11 3493ratelimiters_cmd = NULL;
059ec3d9
PH
3494
3495if (where == ACL_WHERE_RCPT)
3496 {
3497 adb = address_defaults;
3498 addr = &adb;
64ffc24f 3499 addr->address = recipient;
059ec3d9
PH
3500 if (deliver_split_address(addr) == DEFER)
3501 {
3502 *log_msgptr = US"defer in percent_hack_domains check";
3503 return DEFER;
3504 }
3505 deliver_domain = addr->domain;
3506 deliver_localpart = addr->local_part;
3507 }
059ec3d9
PH
3508
3509rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
3510
64ffc24f
PH
3511deliver_domain = deliver_localpart = deliver_address_data =
3512 sender_address_data = NULL;
059ec3d9
PH
3513
3514/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
3515ACL, which is really in the middle of an SMTP command. */
3516
3517if (rc == DISCARD)
3518 {
3519 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
3520 {
3521 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
3522 "ACL", acl_wherenames[where]);
3523 return ERROR;
3524 }
3525 return DISCARD;
3526 }
3527
3528/* A DROP response is not permitted from MAILAUTH */
3529
3530if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
3531 {
3532 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
3533 "ACL", acl_wherenames[where]);
3534 return ERROR;
3535 }
3536
3537/* Before giving an error response, take a look at the length of any user
3538message, and split it up into multiple lines if possible. */
3539
3540if (rc != OK && *user_msgptr != NULL && Ustrlen(*user_msgptr) > 75)
3541 {
3542 uschar *s = *user_msgptr = string_copy(*user_msgptr);
3543 uschar *ss = s;
3544
3545 for (;;)
3546 {
3547 int i = 0;
3548 while (i < 75 && *ss != 0 && *ss != '\n') ss++, i++;
3549 if (*ss == 0) break;
3550 if (*ss == '\n')
3551 s = ++ss;
3552 else
3553 {
3554 uschar *t = ss + 1;
3555 uschar *tt = NULL;
3556 while (--t > s + 35)
3557 {
3558 if (*t == ' ')
3559 {
3560 if (t[-1] == ':') { tt = t; break; }
3561 if (tt == NULL) tt = t;
3562 }
3563 }
3564
3565 if (tt == NULL) /* Can't split behind - try ahead */
3566 {
3567 t = ss + 1;
3568 while (*t != 0)
3569 {
3570 if (*t == ' ' || *t == '\n')
3571 { tt = t; break; }
3572 t++;
3573 }
3574 }
3575
3576 if (tt == NULL) break; /* Can't find anywhere to split */
3577 *tt = '\n';
3578 s = ss = tt+1;
3579 }
3580 }
3581 }
3582
3583return rc;
3584}
3585
3586/* End of acl.c */