Expansions: new ${lheader:<name>}. Bug 2272
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08 24static uschar *verbs[] = {
f2ed27cf
JH
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32};
059ec3d9 33
4e88a19f
PH
34/* For each verb, the conditions for which "message" or "log_message" are used
35are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36"accept", the FAIL case is used only after "endpass", but that is selected in
37the code. */
38
39static int msgcond[] = {
e3a69b62
JH
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
4e88a19f 47 };
059ec3d9
PH
48
49/* ACL condition and modifier codes - keep in step with the table that
2d009132 50follows.
71fafd95 51down. */
059ec3d9 52
71fafd95
PH
53enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
8523533c
TK
56#ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58#endif
71fafd95 59 ACLC_CONDITION,
c3611384 60 ACLC_CONTINUE,
71fafd95 61 ACLC_CONTROL,
6a8f9482
TK
62#ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64#endif
8523533c
TK
65#ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67#endif
68 ACLC_DELAY,
80a47a2c
TK
69#ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
fb2274d4 72#endif
4840604e
TL
73#ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75#endif
71fafd95
PH
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
6ea85e9a 83 ACLC_LOG_REJECT_TARGET,
71fafd95 84 ACLC_LOGWRITE,
8523533c
TK
85#ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87#endif
88 ACLC_MESSAGE,
89#ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91#endif
b0b9dbb1 92 ACLC_QUEUE,
870f6ba8 93 ACLC_RATELIMIT,
8523533c
TK
94 ACLC_RECIPIENTS,
95#ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97#endif
e7568d51 98 ACLC_REMOVE_HEADER,
71fafd95
PH
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
8523533c 102#ifdef WITH_CONTENT_SCAN
8e669ac1 103 ACLC_SPAM,
8523533c 104#endif
7952eef9 105#ifdef SUPPORT_SPF
8523533c 106 ACLC_SPF,
65a7d8c3 107 ACLC_SPF_GUESS,
8523533c 108#endif
b0019c78 109 ACLC_UDPSEND,
8523533c 110 ACLC_VERIFY };
059ec3d9 111
c3611384 112/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 113"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH
114modifiers that look like conditions but always return TRUE. They are used for
115their side effects. */
059ec3d9 116
2d009132
JH
117typedef struct condition_def {
118 uschar *name;
c5fcb476 119
2d009132 120/* Flag to indicate the condition/modifier has a string expansion done
059ec3d9
PH
121at the outer level. In the other cases, expansion already occurs in the
122checking functions. */
2d009132 123 BOOL expand_at_top:1;
059ec3d9 124
2d009132 125 BOOL is_modifier:1;
059ec3d9 126
2d009132
JH
127/* Bit map vector of which conditions and modifiers are not allowed at certain
128times. For each condition and modifier, there's a bitmap of dis-allowed times.
129For some, it is easier to specify the negation of a small number of allowed
130times. */
131 unsigned forbids;
132
133} condition_def;
134
135static condition_def conditions[] = {
f2ed27cf 136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
2d009132 137
f2ed27cf
JH
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
e3a69b62
JH
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 142#ifndef DISABLE_PRDR
e3a69b62 143 ACL_BIT_PRDR |
2d009132 144#endif
e3a69b62
JH
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
2d009132 148 },
059ec3d9 149
f2ed27cf 150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
e3a69b62
JH
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
2d009132 153 },
8523533c 154#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf 155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
e3a69b62
JH
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
2d009132 159# ifndef DISABLE_PRDR
e3a69b62 160 ACL_BIT_PRDR |
2d009132 161# endif
e3a69b62
JH
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
2d009132 167 },
8e669ac1 168#endif
f2ed27cf
JH
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
2d009132
JH
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
f2ed27cf 174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
2d009132 175
6a8f9482 176#ifdef EXPERIMENTAL_DCC
f2ed27cf
JH
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
e3a69b62 179 ~(ACL_BIT_DATA |
2d009132 180# ifndef DISABLE_PRDR
e3a69b62 181 ACL_BIT_PRDR |
2d009132 182# endif
e3a69b62 183 ACL_BIT_NOTSMTP),
2d009132 184 },
6a8f9482 185#endif
8523533c 186#ifdef WITH_CONTENT_SCAN
e3a69b62 187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 188
8523533c 189#endif
e3a69b62 190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
80a47a2c 191#ifndef DISABLE_DKIM
e3a69b62
JH
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
fb2274d4 194#endif
4840604e 195#ifdef EXPERIMENTAL_DMARC
e3a69b62 196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
4840604e 197#endif
059ec3d9 198
2d009132
JH
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
f2ed27cf 201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
c3611384 202
f2ed27cf
JH
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
e3a69b62 205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
2d009132 206#ifndef DISABLE_PRDR
e3a69b62 207 |ACL_BIT_PRDR
2d009132
JH
208#endif
209 ),
210 },
f2ed27cf 211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
e3a69b62
JH
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
2d009132 214 },
8e669ac1 215
f2ed27cf 216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
8e669ac1 217
f2ed27cf 218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
e3a69b62 219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 220 },
f2ed27cf
JH
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
e3a69b62 223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
f2ed27cf 224#ifndef DISABLE_PRDR
e3a69b62 225 | ACL_BIT_PRDR
f2ed27cf 226#endif
2d009132
JH
227 ),
228 },
6a8f9482 229
f2ed27cf 230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
e3a69b62 231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
f2ed27cf 232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
8523533c 233
2d009132 234#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
e3a69b62 237 ~(ACL_BIT_DATA |
2d009132 238# ifndef DISABLE_PRDR
e3a69b62 239 ACL_BIT_PRDR |
2d009132 240# endif
e3a69b62 241 ACL_BIT_NOTSMTP),
2d009132
JH
242 },
243#endif
8e669ac1 244
f2ed27cf 245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
2d009132 246#ifdef WITH_CONTENT_SCAN
e3a69b62 247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
2d009132 248#endif
84330b7b 249
f2ed27cf 250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
e3a69b62 251 ACL_BIT_NOTSMTP |
2d009132 252#ifndef DISABLE_PRDR
e3a69b62 253 ACL_BIT_PRDR |
2d009132 254#endif
e3a69b62 255 ACL_BIT_DATA,
2d009132 256 },
fb2274d4 257
f2ed27cf 258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
e3a69b62 259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
4840604e 260
2d009132 261#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
e3a69b62 264 ~(ACL_BIT_DATA |
2d009132 265# ifndef DISABLE_PRDR
e3a69b62 266 ACL_BIT_PRDR |
2d009132 267# endif
e3a69b62
JH
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
2d009132 270 },
379ba7d0 271
2d009132 272#endif
f2ed27cf
JH
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
e3a69b62
JH
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
2d009132 277#ifndef DISABLE_PRDR
e3a69b62 278 ACL_BIT_PRDR |
2d009132 279#endif
e3a69b62
JH
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
2d009132 282 },
f2ed27cf 283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
e3a69b62
JH
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 289 },
f2ed27cf 290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
e3a69b62
JH
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
2d009132 296 },
65a7d8c3 297
f2ed27cf 298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
8523533c 299
2d009132 300#ifdef WITH_CONTENT_SCAN
f2ed27cf 301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
e3a69b62 302 (unsigned int) ~(ACL_BIT_DATA |
2d009132 303# ifndef DISABLE_PRDR
e3a69b62 304 ACL_BIT_PRDR |
2d009132 305# endif
e3a69b62 306 ACL_BIT_NOTSMTP),
2d009132
JH
307 },
308#endif
7952eef9 309#ifdef SUPPORT_SPF
f2ed27cf 310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
e3a69b62
JH
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132 316 },
6e1a8743 317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
e3a69b62
JH
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
2d009132
JH
323 },
324#endif
f2ed27cf 325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
b0019c78 326
059ec3d9
PH
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
f2ed27cf 329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
059ec3d9
PH
330};
331
332
2d009132 333
d7bed771
JH
334/* Return values from decode_control(); used as index so keep in step
335with the controls_list table that follows! */
c46782ef 336
d7bed771
JH
337enum {
338 CONTROL_AUTH_UNADVERTISED,
3c8b3577 339#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 340 CONTROL_BMI_RUN,
3c8b3577 341#endif
d7bed771
JH
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
3c8b3577 346#ifndef DISABLE_DKIM
d7bed771 347 CONTROL_DKIM_VERIFY,
3c8b3577 348#endif
3c8b3577 349#ifdef EXPERIMENTAL_DMARC
d7bed771
JH
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
3c8b3577 352#endif
d7bed771
JH
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
4840604e 359
d7bed771
JH
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 363#ifdef WITH_CONTENT_SCAN
d7bed771 364 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 365#endif
d7bed771
JH
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
8523533c 368
d7bed771
JH
369 CONTROL_QUEUE_ONLY,
370 CONTROL_SUBMISSION,
371 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 372#ifdef SUPPORT_I18N
d7bed771 373 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 374#endif
d7bed771 375};
3c8b3577 376
4c590bd1 377
c5fcb476 378
d7bed771
JH
379/* Structure listing various control arguments, with their characteristics.
380For each control, there's a bitmap of dis-allowed times. For some, it is easier
381to specify the negation of a small number of allowed times. */
059ec3d9
PH
382
383typedef struct control_def {
d7bed771
JH
384 uschar *name;
385 BOOL has_option; /* Has /option(s) following */
386 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH
387} control_def;
388
389static control_def controls_list[] = {
f2ed27cf
JH
390 /* name has_option forbids */
391[CONTROL_AUTH_UNADVERTISED] =
d7bed771 392 { US"allow_auth_unadvertised", FALSE,
f2ed27cf 393 (unsigned)
e3a69b62 394 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
d7bed771 395 },
8523533c 396#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH
397[CONTROL_BMI_RUN] =
398 { US"bmi_run", FALSE, 0 },
8523533c 399#endif
f2ed27cf 400[CONTROL_CASEFUL_LOCAL_PART] =
e3a69b62 401 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf 402[CONTROL_CASELOWER_LOCAL_PART] =
e3a69b62 403 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
f2ed27cf
JH
404[CONTROL_CUTTHROUGH_DELIVERY] =
405 { US"cutthrough_delivery", TRUE, 0 },
406[CONTROL_DEBUG] =
407 { US"debug", TRUE, 0 },
d7bed771 408
80a47a2c 409#ifndef DISABLE_DKIM
f2ed27cf 410[CONTROL_DKIM_VERIFY] =
d7bed771 411 { US"dkim_disable_verify", FALSE,
e3a69b62 412 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
d7bed771 413# ifndef DISABLE_PRDR
e3a69b62 414 ACL_BIT_PRDR |
d7bed771 415# endif
e3a69b62 416 ACL_BIT_NOTSMTP_START
d7bed771 417 },
f7572e5a 418#endif
d7bed771 419
4840604e 420#ifdef EXPERIMENTAL_DMARC
9904d08c 421[CONTROL_DMARC_VERIFY] =
d7bed771 422 { US"dmarc_disable_verify", FALSE,
e3a69b62 423 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 424 },
9904d08c 425[CONTROL_DMARC_FORENSIC] =
d7bed771 426 { US"dmarc_enable_forensic", FALSE,
e3a69b62 427 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
428 },
429#endif
430
f2ed27cf 431[CONTROL_DSCP] =
d7bed771 432 { US"dscp", TRUE,
e3a69b62 433 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
d7bed771 434 },
f2ed27cf 435[CONTROL_ENFORCE_SYNC] =
d7bed771 436 { US"enforce_sync", FALSE,
e3a69b62 437 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
438 },
439
440 /* Pseudo-value for decode errors */
f2ed27cf 441[CONTROL_ERROR] =
d7bed771
JH
442 { US"error", FALSE, 0 },
443
f2ed27cf 444[CONTROL_FAKEDEFER] =
d7bed771 445 { US"fakedefer", TRUE,
f2ed27cf 446 (unsigned)
e3a69b62
JH
447 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
448 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 449#ifndef DISABLE_PRDR
e3a69b62 450 ACL_BIT_PRDR |
d7bed771 451#endif
e3a69b62 452 ACL_BIT_MIME)
d7bed771 453 },
f2ed27cf 454[CONTROL_FAKEREJECT] =
d7bed771 455 { US"fakereject", TRUE,
f2ed27cf 456 (unsigned)
e3a69b62
JH
457 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
458 ACL_BIT_PREDATA | ACL_BIT_DATA |
d7bed771 459#ifndef DISABLE_PRDR
e3a69b62 460 ACL_BIT_PRDR |
d7bed771 461#endif
e3a69b62 462 ACL_BIT_MIME)
d7bed771 463 },
f2ed27cf 464[CONTROL_FREEZE] =
d7bed771 465 { US"freeze", TRUE,
f2ed27cf 466 (unsigned)
e3a69b62
JH
467 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
468 ACL_BIT_PREDATA | ACL_BIT_DATA |
469 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
470 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771
JH
471 },
472
f2ed27cf 473[CONTROL_NO_CALLOUT_FLUSH] =
d7bed771 474 { US"no_callout_flush", FALSE,
e3a69b62 475 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 476 },
f2ed27cf 477[CONTROL_NO_DELAY_FLUSH] =
d7bed771 478 { US"no_delay_flush", FALSE,
e3a69b62 479 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
480 },
481
f2ed27cf 482[CONTROL_NO_ENFORCE_SYNC] =
d7bed771 483 { US"no_enforce_sync", FALSE,
e3a69b62 484 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 485 },
8523533c 486#ifdef WITH_CONTENT_SCAN
f2ed27cf 487[CONTROL_NO_MBOX_UNSPOOL] =
d7bed771 488 { US"no_mbox_unspool", FALSE,
f2ed27cf 489 (unsigned)
e3a69b62
JH
490 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
491 ACL_BIT_PREDATA | ACL_BIT_DATA |
492 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
493 ACL_BIT_MIME)
d7bed771
JH
494 },
495#endif
f2ed27cf 496[CONTROL_NO_MULTILINE] =
d7bed771 497 { US"no_multiline_responses", FALSE,
e3a69b62 498 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771 499 },
f2ed27cf 500[CONTROL_NO_PIPELINING] =
d7bed771 501 { US"no_pipelining", FALSE,
e3a69b62 502 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
d7bed771
JH
503 },
504
f2ed27cf 505[CONTROL_QUEUE_ONLY] =
d7bed771 506 { US"queue_only", FALSE,
f2ed27cf 507 (unsigned)
e3a69b62
JH
508 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
509 ACL_BIT_PREDATA | ACL_BIT_DATA |
510 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
511 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
d7bed771 512 },
f2ed27cf 513[CONTROL_SUBMISSION] =
d7bed771 514 { US"submission", TRUE,
f2ed27cf 515 (unsigned)
e3a69b62 516 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
d7bed771 517 },
f2ed27cf 518[CONTROL_SUPPRESS_LOCAL_FIXUPS] =
d7bed771
JH
519 { US"suppress_local_fixups", FALSE,
520 (unsigned)
e3a69b62
JH
521 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
522 ACL_BIT_NOTSMTP_START)
d7bed771 523 },
8c5d388a 524#ifdef SUPPORT_I18N
f2ed27cf 525[CONTROL_UTF8_DOWNCONVERT] =
6741531c
JH
526 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
527 }
3c8b3577 528#endif
d7bed771 529};
059ec3d9 530
e5a9dba6
PH
531/* Support data structures for Client SMTP Authorization. acl_verify_csa()
532caches its result in a tree to avoid repeated DNS queries. The result is an
533integer code which is used as an index into the following tables of
534explanatory strings and verification return codes. */
535
536static tree_node *csa_cache = NULL;
537
538enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
539 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
540
541/* The acl_verify_csa() return code is translated into an acl_verify() return
542code using the following table. It is OK unless the client is definitely not
543authorized. This is because CSA is supposed to be optional for sending sites,
544so recipients should not be too strict about checking it - especially because
545DNS problems are quite likely to occur. It's possible to use $csa_status in
546further ACL conditions to distinguish ok, unknown, and defer if required, but
547the aim is to make the usual configuration simple. */
548
549static int csa_return_code[] = {
f2ed27cf
JH
550 [CSA_UNKNOWN] = OK,
551 [CSA_OK] = OK,
552 [CSA_DEFER_SRV] = OK,
553 [CSA_DEFER_ADDR] = OK,
554 [CSA_FAIL_EXPLICIT] = FAIL,
555 [CSA_FAIL_DOMAIN] = FAIL,
556 [CSA_FAIL_NOADDR] = FAIL,
557 [CSA_FAIL_MISMATCH] = FAIL
e5a9dba6
PH
558};
559
560static uschar *csa_status_string[] = {
f2ed27cf
JH
561 [CSA_UNKNOWN] = US"unknown",
562 [CSA_OK] = US"ok",
563 [CSA_DEFER_SRV] = US"defer",
564 [CSA_DEFER_ADDR] = US"defer",
565 [CSA_FAIL_EXPLICIT] = US"fail",
566 [CSA_FAIL_DOMAIN] = US"fail",
567 [CSA_FAIL_NOADDR] = US"fail",
568 [CSA_FAIL_MISMATCH] = US"fail"
e5a9dba6
PH
569};
570
571static uschar *csa_reason_string[] = {
f2ed27cf
JH
572 [CSA_UNKNOWN] = US"unknown",
573 [CSA_OK] = US"ok",
574 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
575 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
576 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
577 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
578 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
579 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
e5a9dba6
PH
580};
581
c99ce5c9
TF
582/* Options for the ratelimit condition. Note that there are two variants of
583the per_rcpt option, depending on the ACL that is used to measure the rate.
584However any ACL must be able to look up per_rcpt rates in /noupdate mode,
585so the two variants must have the same internal representation as well as
586the same configuration string. */
587
588enum {
589 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
590 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
591};
592
593#define RATE_SET(var,new) \
594 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
595
596static uschar *ratelimit_option_string[] = {
f2ed27cf
JH
597 [RATE_PER_WHAT] = US"?",
598 [RATE_PER_CLASH] = US"!",
599 [RATE_PER_ADDR] = US"per_addr",
600 [RATE_PER_BYTE] = US"per_byte",
601 [RATE_PER_CMD] = US"per_cmd",
602 [RATE_PER_CONN] = US"per_conn",
603 [RATE_PER_MAIL] = US"per_mail",
604 [RATE_PER_RCPT] = US"per_rcpt",
605 [RATE_PER_ALLRCPTS] = US"per_rcpt"
c99ce5c9
TF
606};
607
059ec3d9
PH
608/* Enable recursion between acl_check_internal() and acl_check_condition() */
609
e1d04f48 610static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
f60d98e8 611 uschar **);
059ec3d9
PH
612
613
614/*************************************************
d7bed771
JH
615* Find control in list *
616*************************************************/
617
618/* The lists are always in order, so binary chop can be used.
619
620Arguments:
621 name the control name to search for
622 ol the first entry in the control list
623 last one more than the offset of the last entry in the control list
624
625Returns: index of a control entry, or -1 if not found
626*/
627
628static int
629find_control(const uschar * name, control_def * ol, int last)
630{
631int first = 0;
632while (last > first)
633 {
634 int middle = (first + last)/2;
635 uschar * s = ol[middle].name;
636 int c = Ustrncmp(name, s, Ustrlen(s));
637 if (c == 0) return middle;
638 else if (c > 0) first = middle + 1;
639 else last = middle;
640 }
641return -1;
642}
643
644
645
646/*************************************************
2d009132
JH
647* Pick out condition from list *
648*************************************************/
649
650/* Use a binary chop method
651
652Arguments:
653 name name to find
654 list list of conditions
655 end size of list
656
657Returns: offset in list, or -1 if not found
658*/
659
660static int
661acl_checkcondition(uschar * name, condition_def * list, int end)
662{
663int start = 0;
664while (start < end)
665 {
666 int mid = (start + end)/2;
667 int c = Ustrcmp(name, list[mid].name);
668 if (c == 0) return mid;
669 if (c < 0) end = mid;
670 else start = mid + 1;
671 }
672return -1;
673}
674
675
676/*************************************************
059ec3d9
PH
677* Pick out name from list *
678*************************************************/
679
680/* Use a binary chop method
681
682Arguments:
683 name name to find
684 list list of names
685 end size of list
686
687Returns: offset in list, or -1 if not found
688*/
689
690static int
691acl_checkname(uschar *name, uschar **list, int end)
692{
693int start = 0;
694
695while (start < end)
696 {
697 int mid = (start + end)/2;
698 int c = Ustrcmp(name, list[mid]);
699 if (c == 0) return mid;
700 if (c < 0) end = mid; else start = mid + 1;
701 }
702
703return -1;
704}
705
706
707/*************************************************
708* Read and parse one ACL *
709*************************************************/
710
711/* This function is called both from readconf in order to parse the ACLs in the
712configuration file, and also when an ACL is encountered dynamically (e.g. as
713the result of an expansion). It is given a function to call in order to
714retrieve the lines of the ACL. This function handles skipping comments and
715blank lines (where relevant).
716
717Arguments:
718 func function to get next line of ACL
719 error where to put an error message
720
721Returns: pointer to ACL, or NULL
722 NULL can be legal (empty ACL); in this case error will be NULL
723*/
724
725acl_block *
726acl_read(uschar *(*func)(void), uschar **error)
727{
728acl_block *yield = NULL;
729acl_block **lastp = &yield;
730acl_block *this = NULL;
731acl_condition_block *cond;
732acl_condition_block **condp = NULL;
733uschar *s;
734
735*error = NULL;
736
737while ((s = (*func)()) != NULL)
738 {
739 int v, c;
740 BOOL negated = FALSE;
741 uschar *saveline = s;
742 uschar name[64];
743
744 /* Conditions (but not verbs) are allowed to be negated by an initial
745 exclamation mark. */
746
747 while (isspace(*s)) s++;
748 if (*s == '!')
749 {
750 negated = TRUE;
751 s++;
752 }
753
cf00dad6
PH
754 /* Read the name of a verb or a condition, or the start of a new ACL, which
755 can be started by a name, or by a macro definition. */
059ec3d9
PH
756
757 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 758 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
759
760 /* If a verb is unrecognized, it may be another condition or modifier that
761 continues the previous verb. */
762
2d009132 763 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
059ec3d9
PH
764 {
765 if (this == NULL)
766 {
4e167a8c
PH
767 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
768 saveline);
059ec3d9
PH
769 return NULL;
770 }
771 }
772
773 /* New verb */
774
775 else
776 {
777 if (negated)
778 {
779 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
780 return NULL;
781 }
782 this = store_get(sizeof(acl_block));
783 *lastp = this;
784 lastp = &(this->next);
785 this->next = NULL;
786 this->verb = v;
787 this->condition = NULL;
788 condp = &(this->condition);
789 if (*s == 0) continue; /* No condition on this line */
790 if (*s == '!')
791 {
792 negated = TRUE;
793 s++;
794 }
795 s = readconf_readname(name, sizeof(name), s); /* Condition name */
796 }
797
798 /* Handle a condition or modifier. */
799
2d009132 800 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
059ec3d9
PH
801 {
802 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
803 saveline);
804 return NULL;
805 }
806
807 /* The modifiers may not be negated */
808
2d009132 809 if (negated && conditions[c].is_modifier)
059ec3d9
PH
810 {
811 *error = string_sprintf("ACL error: negation is not allowed with "
2d009132 812 "\"%s\"", conditions[c].name);
059ec3d9
PH
813 return NULL;
814 }
815
816 /* ENDPASS may occur only with ACCEPT or DISCARD. */
817
818 if (c == ACLC_ENDPASS &&
819 this->verb != ACL_ACCEPT &&
820 this->verb != ACL_DISCARD)
821 {
822 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
2d009132 823 conditions[c].name, verbs[this->verb]);
059ec3d9
PH
824 return NULL;
825 }
826
827 cond = store_get(sizeof(acl_condition_block));
828 cond->next = NULL;
829 cond->type = c;
830 cond->u.negated = negated;
831
832 *condp = cond;
833 condp = &(cond->next);
834
835 /* The "set" modifier is different in that its argument is "name=value"
836 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
837 gives us a variable name to insert into the data block. The original ACL
838 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
839 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
840 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
841 After that, we allow alphanumerics and underscores, but the first character
842 after c or m must be a digit or an underscore. This retains backwards
843 compatibility. */
059ec3d9
PH
844
845 if (c == ACLC_SET)
a79d8834
JH
846#ifndef DISABLE_DKIM
847 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
848 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
849 {
850 uschar * endptr = s+18;
851
852 if (isalnum(*endptr))
853 {
854 *error = string_sprintf("invalid variable name after \"set\" in ACL "
855 "modifier \"set %s\" "
856 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
857 s);
858 return NULL;
859 }
860 cond->u.varname = string_copyn(s, 18);
861 s = endptr;
862 while (isspace(*s)) s++;
863 }
864 else
865#endif
059ec3d9 866 {
47ca6d6c
PH
867 uschar *endptr;
868
38a0a95f
PH
869 if (Ustrncmp(s, "acl_c", 5) != 0 &&
870 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 871 {
38a0a95f
PH
872 *error = string_sprintf("invalid variable name after \"set\" in ACL "
873 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
874 return NULL;
47ca6d6c 875 }
38a0a95f
PH
876
877 endptr = s + 5;
641cb756
PH
878 if (!isdigit(*endptr) && *endptr != '_')
879 {
880 *error = string_sprintf("invalid variable name after \"set\" in ACL "
881 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
882 s);
883 return NULL;
884 }
885
38a0a95f 886 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 887 {
38a0a95f
PH
888 if (!isalnum(*endptr) && *endptr != '_')
889 {
890 *error = string_sprintf("invalid character \"%c\" in variable name "
891 "in ACL modifier \"set %s\"", *endptr, s);
892 return NULL;
893 }
894 endptr++;
47ca6d6c 895 }
47ca6d6c 896
38a0a95f 897 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 898 s = endptr;
059ec3d9
PH
899 while (isspace(*s)) s++;
900 }
901
902 /* For "set", we are now positioned for the data. For the others, only
903 "endpass" has no data */
904
905 if (c != ACLC_ENDPASS)
906 {
907 if (*s++ != '=')
908 {
909 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
2d009132 910 conditions[c].is_modifier ? US"modifier" : US"condition");
059ec3d9
PH
911 return NULL;
912 }
913 while (isspace(*s)) s++;
914 cond->arg = string_copy(s);
915 }
916 }
917
918return yield;
919}
920
921
922
923/*************************************************
71fafd95
PH
924* Set up added header line(s) *
925*************************************************/
926
927/* This function is called by the add_header modifier, and also from acl_warn()
928to implement the now-deprecated way of adding header lines using "message" on a
929"warn" verb. The argument is treated as a sequence of header lines which are
930added to a chain, provided there isn't an identical one already there.
931
932Argument: string of header lines
933Returns: nothing
934*/
935
936static void
55414b25 937setup_header(const uschar *hstring)
71fafd95 938{
55414b25 939const uschar *p, *q;
71fafd95
PH
940int hlen = Ustrlen(hstring);
941
b1b05573
JH
942/* Ignore any leading newlines */
943while (*hstring == '\n') hstring++, hlen--;
71fafd95 944
b1b05573 945/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 946if (hlen <= 0) return;
96f5fe4c 947if (hstring[--hlen] != '\n') /* no newline */
55414b25 948 q = string_sprintf("%s\n", hstring);
96f5fe4c 949else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH
950 {
951 uschar * s = string_copy(hstring);
952 while(s[--hlen] == '\n')
953 s[hlen+1] = '\0';
954 q = s;
955 }
956else
957 q = hstring;
71fafd95
PH
958
959/* Loop for multiple header lines, taking care about continuations */
960
617d3932 961for (p = q; *p; p = q)
71fafd95 962 {
55414b25
JH
963 const uschar *s;
964 uschar * hdr;
71fafd95
PH
965 int newtype = htype_add_bot;
966 header_line **hptr = &acl_added_headers;
967
968 /* Find next header line within the string */
969
970 for (;;)
971 {
96f5fe4c 972 q = Ustrchr(q, '\n'); /* we know there was a newline */
617d3932 973 if (*++q != ' ' && *q != '\t') break;
71fafd95
PH
974 }
975
976 /* If the line starts with a colon, interpret the instruction for where to
977 add it. This temporarily sets up a new type. */
978
979 if (*p == ':')
980 {
981 if (strncmpic(p, US":after_received:", 16) == 0)
982 {
983 newtype = htype_add_rec;
984 p += 16;
985 }
986 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
987 {
988 newtype = htype_add_rfc;
989 p += 14;
990 }
991 else if (strncmpic(p, US":at_start:", 10) == 0)
992 {
993 newtype = htype_add_top;
994 p += 10;
995 }
996 else if (strncmpic(p, US":at_end:", 8) == 0)
997 {
998 newtype = htype_add_bot;
999 p += 8;
1000 }
1001 while (*p == ' ' || *p == '\t') p++;
1002 }
1003
1004 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1005 to the front of it. */
1006
1007 for (s = p; s < q - 1; s++)
71fafd95 1008 if (*s == ':' || !isgraph(*s)) break;
71fafd95 1009
617d3932 1010 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
55414b25 1011 hlen = Ustrlen(hdr);
71fafd95
PH
1012
1013 /* See if this line has already been added */
1014
617d3932 1015 while (*hptr)
71fafd95 1016 {
55414b25 1017 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
617d3932 1018 hptr = &(*hptr)->next;
71fafd95
PH
1019 }
1020
1021 /* Add if not previously present */
1022
617d3932 1023 if (!*hptr)
71fafd95
PH
1024 {
1025 header_line *h = store_get(sizeof(header_line));
55414b25 1026 h->text = hdr;
71fafd95
PH
1027 h->next = NULL;
1028 h->type = newtype;
1029 h->slen = hlen;
1030 *hptr = h;
617d3932 1031 hptr = &h->next;
71fafd95 1032 }
71fafd95
PH
1033 }
1034}
1035
1036
1037
e7568d51 1038/*************************************************
362145b5
JH
1039* List the added header lines *
1040*************************************************/
1041uschar *
1042fn_hdrs_added(void)
1043{
acec9514 1044gstring * g = NULL;
bce15b62 1045header_line * h;
362145b5 1046
bce15b62 1047for (h = acl_added_headers; h; h = h->next)
362145b5 1048 {
bce15b62
JH
1049 int i = h->slen;
1050 if (h->text[i-1] == '\n') i--;
1051 g = string_append_listele_n(g, '\n', h->text, i);
362145b5 1052 }
362145b5 1053
bce15b62 1054return g ? g->s : NULL;
362145b5
JH
1055}
1056
1057
1058/*************************************************
e7568d51
TL
1059* Set up removed header line(s) *
1060*************************************************/
1061
1062/* This function is called by the remove_header modifier. The argument is
1063treated as a sequence of header names which are added to a colon separated
1064list, provided there isn't an identical one already there.
1065
1066Argument: string of header names
1067Returns: nothing
1068*/
1069
1070static void
55414b25 1071setup_remove_header(const uschar *hnames)
e7568d51
TL
1072{
1073if (*hnames != 0)
55414b25
JH
1074 acl_removed_headers = acl_removed_headers
1075 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1076 : string_copy(hnames);
e7568d51
TL
1077}
1078
1079
71fafd95
PH
1080
1081/*************************************************
059ec3d9
PH
1082* Handle warnings *
1083*************************************************/
1084
1085/* This function is called when a WARN verb's conditions are true. It adds to
1086the message's headers, and/or writes information to the log. In each case, this
1087only happens once (per message for headers, per connection for log).
1088
71fafd95
PH
1089** NOTE: The header adding action using the "message" setting is historic, and
1090its use is now deprecated. The new add_header modifier should be used instead.
1091
059ec3d9
PH
1092Arguments:
1093 where ACL_WHERE_xxxx indicating which ACL this is
1094 user_message message for adding to headers
1095 log_message message for logging, if different
1096
1097Returns: nothing
1098*/
1099
1100static void
1101acl_warn(int where, uschar *user_message, uschar *log_message)
1102{
059ec3d9
PH
1103if (log_message != NULL && log_message != user_message)
1104 {
1105 uschar *text;
1106 string_item *logged;
1107
1108 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1109 string_printing(log_message));
1110
1111 /* If a sender verification has failed, and the log message is "sender verify
1112 failed", add the failure message. */
1113
1114 if (sender_verified_failed != NULL &&
1115 sender_verified_failed->message != NULL &&
1116 strcmpic(log_message, US"sender verify failed") == 0)
1117 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1118
9c7a242c
PH
1119 /* Search previously logged warnings. They are kept in malloc
1120 store so they can be freed at the start of a new message. */
059ec3d9
PH
1121
1122 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1123 if (Ustrcmp(logged->text, text) == 0) break;
1124
1125 if (logged == NULL)
1126 {
1127 int length = Ustrlen(text) + 1;
1128 log_write(0, LOG_MAIN, "%s", text);
1129 logged = store_malloc(sizeof(string_item) + length);
5903c6ff 1130 logged->text = US logged + sizeof(string_item);
059ec3d9
PH
1131 memcpy(logged->text, text, length);
1132 logged->next = acl_warn_logged;
1133 acl_warn_logged = logged;
1134 }
1135 }
1136
1137/* If there's no user message, we are done. */
1138
1139if (user_message == NULL) return;
1140
1141/* If this isn't a message ACL, we can't do anything with a user message.
1142Log an error. */
1143
1144if (where > ACL_WHERE_NOTSMTP)
1145 {
1146 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1147 "found in a non-message (%s) ACL: cannot specify header lines here: "
1148 "message ignored", acl_wherenames[where]);
1149 return;
1150 }
1151
71fafd95
PH
1152/* The code for setting up header lines is now abstracted into a separate
1153function so that it can be used for the add_header modifier as well. */
059ec3d9 1154
71fafd95 1155setup_header(user_message);
059ec3d9
PH
1156}
1157
1158
1159
1160/*************************************************
1161* Verify and check reverse DNS *
1162*************************************************/
1163
1164/* Called from acl_verify() below. We look up the host name(s) of the client IP
1165address if this has not yet been done. The host_name_lookup() function checks
1166that one of these names resolves to an address list that contains the client IP
1167address, so we don't actually have to do the check here.
1168
1169Arguments:
1170 user_msgptr pointer for user message
1171 log_msgptr pointer for log message
1172
1173Returns: OK verification condition succeeded
1174 FAIL verification failed
1175 DEFER there was a problem verifying
1176*/
1177
1178static int
1179acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1180{
1181int rc;
1182
1183user_msgptr = user_msgptr; /* stop compiler warning */
1184
1185/* Previous success */
1186
1187if (sender_host_name != NULL) return OK;
1188
1189/* Previous failure */
1190
1191if (host_lookup_failed)
1192 {
1193 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1194 return FAIL;
1195 }
1196
1197/* Need to do a lookup */
1198
1199HDEBUG(D_acl)
e1d04f48 1200 debug_printf_indent("looking up host name to force name/address consistency check\n");
059ec3d9
PH
1201
1202if ((rc = host_name_lookup()) != OK)
1203 {
1204 *log_msgptr = (rc == DEFER)?
1205 US"host lookup deferred for reverse lookup check"
1206 :
1207 string_sprintf("host lookup failed for reverse lookup check%s",
1208 host_lookup_msg);
1209 return rc; /* DEFER or FAIL */
1210 }
1211
1212host_build_sender_fullhost();
1213return OK;
1214}
1215
1216
1217
1218/*************************************************
e5a9dba6
PH
1219* Check client IP address matches CSA target *
1220*************************************************/
1221
1222/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1223response for address records belonging to the CSA target hostname. The section
1224is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1225If one of the addresses matches the client's IP address, then the client is
1226authorized by CSA. If there are target IP addresses but none of them match
1227then the client is using an unauthorized IP address. If there are no target IP
1228addresses then the client cannot be using an authorized IP address. (This is
1229an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1230
1231Arguments:
1232 dnsa the DNS answer block
1233 dnss a DNS scan block for us to use
4c04137d 1234 reset option specifying what portion to scan, as described above
e5a9dba6
PH
1235 target the target hostname to use for matching RR names
1236
1237Returns: CSA_OK successfully authorized
1238 CSA_FAIL_MISMATCH addresses found but none matched
1239 CSA_FAIL_NOADDR no target addresses found
1240*/
1241
1242static int
1243acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1244 uschar *target)
1245{
1246dns_record *rr;
1247dns_address *da;
1248
1249BOOL target_found = FALSE;
1250
1251for (rr = dns_next_rr(dnsa, dnss, reset);
1252 rr != NULL;
1253 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1254 {
1255 /* Check this is an address RR for the target hostname. */
1256
1257 if (rr->type != T_A
1258 #if HAVE_IPV6
1259 && rr->type != T_AAAA
e5a9dba6
PH
1260 #endif
1261 ) continue;
1262
1263 if (strcmpic(target, rr->name) != 0) continue;
1264
1265 target_found = TRUE;
1266
1267 /* Turn the target address RR into a list of textual IP addresses and scan
1268 the list. There may be more than one if it is an A6 RR. */
1269
1270 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1271 {
1272 /* If the client IP address matches the target IP address, it's good! */
1273
e1d04f48 1274 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
e5a9dba6
PH
1275
1276 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1277 }
1278 }
1279
1280/* If we found some target addresses but none of them matched, the client is
1281using an unauthorized IP address, otherwise the target has no authorized IP
1282addresses. */
1283
1284if (target_found) return CSA_FAIL_MISMATCH;
1285else return CSA_FAIL_NOADDR;
1286}
1287
1288
1289
1290/*************************************************
1291* Verify Client SMTP Authorization *
1292*************************************************/
1293
1294/* Called from acl_verify() below. This routine calls dns_lookup_special()
1295to find the CSA SRV record corresponding to the domain argument, or
1296$sender_helo_name if no argument is provided. It then checks that the
1297client is authorized, and that its IP address corresponds to the SRV
1298target's address by calling acl_verify_csa_address() above. The address
1299should have been returned in the DNS response's ADDITIONAL section, but if
1300not we perform another DNS lookup to get it.
1301
1302Arguments:
1303 domain pointer to optional parameter following verify = csa
1304
1305Returns: CSA_UNKNOWN no valid CSA record found
1306 CSA_OK successfully authorized
1307 CSA_FAIL_* client is definitely not authorized
1308 CSA_DEFER_* there was a DNS problem
1309*/
1310
1311static int
55414b25 1312acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1313{
1314tree_node *t;
55414b25 1315const uschar *found;
e5a9dba6
PH
1316int priority, weight, port;
1317dns_answer dnsa;
1318dns_scan dnss;
1319dns_record *rr;
1320int rc, type;
1321uschar target[256];
1322
1323/* Work out the domain we are using for the CSA lookup. The default is the
1324client's HELO domain. If the client has not said HELO, use its IP address
1325instead. If it's a local client (exim -bs), CSA isn't applicable. */
1326
1327while (isspace(*domain) && *domain != '\0') ++domain;
1328if (*domain == '\0') domain = sender_helo_name;
1329if (domain == NULL) domain = sender_host_address;
1330if (sender_host_address == NULL) return CSA_UNKNOWN;
1331
1332/* If we have an address literal, strip off the framing ready for turning it
1333into a domain. The framing consists of matched square brackets possibly
1334containing a keyword and a colon before the actual IP address. */
1335
1336if (domain[0] == '[')
1337 {
55414b25 1338 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1339 if (start == NULL) start = domain;
1340 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1341 }
1342
1343/* Turn domains that look like bare IP addresses into domains in the reverse
1344DNS. This code also deals with address literals and $sender_host_address. It's
1345not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1346address literals, but it's probably the most friendly thing to do. This is an
1347extension to CSA, so we allow it to be turned off for proper conformance. */
1348
7e66e54d 1349if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1350 {
1351 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1352 dns_build_reverse(domain, target);
1353 domain = target;
1354 }
1355
1356/* Find out if we've already done the CSA check for this domain. If we have,
1357return the same result again. Otherwise build a new cached result structure
1358for this domain. The name is filled in now, and the value is filled in when
1359we return from this function. */
1360
1361t = tree_search(csa_cache, domain);
1362if (t != NULL) return t->data.val;
1363
1364t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1365Ustrcpy(t->name, domain);
1366(void)tree_insertnode(&csa_cache, t);
1367
1368/* Now we are ready to do the actual DNS lookup(s). */
1369
28e6ef29 1370found = domain;
e5a9dba6
PH
1371switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1372 {
1373 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1374
1375 default:
1376 return t->data.val = CSA_DEFER_SRV;
1377
1378 /* If we found nothing, the client's authorization is unknown. */
1379
1380 case DNS_NOMATCH:
1381 case DNS_NODATA:
1382 return t->data.val = CSA_UNKNOWN;
1383
1384 /* We got something! Go on to look at the reply in more detail. */
1385
1386 case DNS_SUCCEED:
1387 break;
1388 }
1389
1390/* Scan the reply for well-formed CSA SRV records. */
1391
1392for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
dd708fd7
JH
1393 rr;
1394 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
e5a9dba6 1395 {
dd708fd7 1396 const uschar * p = rr->data;
e5a9dba6
PH
1397
1398 /* Extract the numerical SRV fields (p is incremented) */
1399
e5a9dba6
PH
1400 GETSHORT(priority, p);
1401 GETSHORT(weight, p);
1402 GETSHORT(port, p);
1403
1404 DEBUG(D_acl)
e1d04f48 1405 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
e5a9dba6
PH
1406
1407 /* Check the CSA version number */
1408
1409 if (priority != 1) continue;
1410
1411 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1412 found by dns_special_lookup() is a parent of the one we asked for), we check
1413 the subdomain assertions in the port field. At the moment there's only one
1414 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1415 SRV records of their own. */
1416
1dc92d5a 1417 if (Ustrcmp(found, domain) != 0)
dd708fd7 1418 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
e5a9dba6
PH
1419
1420 /* This CSA SRV record refers directly to our domain, so we check the value
1421 in the weight field to work out the domain's authorization. 0 and 1 are
1422 unauthorized; 3 means the client is authorized but we can't check the IP
1423 address in order to authenticate it, so we treat it as unknown; values
1424 greater than 3 are undefined. */
1425
1426 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1427
1428 if (weight > 2) continue;
1429
1430 /* Weight == 2, which means the domain is authorized. We must check that the
1431 client's IP address is listed as one of the SRV target addresses. Save the
1432 target hostname then break to scan the additional data for its addresses. */
1433
1434 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1435 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1436
e1d04f48 1437 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
e5a9dba6
PH
1438
1439 break;
1440 }
1441
1442/* If we didn't break the loop then no appropriate records were found. */
1443
1444if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1445
1446/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1447A target of "." indicates there are no valid addresses, so the client cannot
1448be authorized. (This is an odd configuration because weight=2 target=. is
1449equivalent to weight=1, but we check for it in order to keep load off the
1450root name servers.) Note that dn_expand() turns "." into "". */
1451
1452if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1453
1454/* Scan the additional section of the CSA SRV reply for addresses belonging
1455to the target. If the name server didn't return any additional data (e.g.
1456because it does not fully support SRV records), we need to do another lookup
1457to obtain the target addresses; otherwise we have a definitive result. */
1458
1459rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1460if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1461
1462/* The DNS lookup type corresponds to the IP version used by the client. */
1463
1464#if HAVE_IPV6
1465if (Ustrchr(sender_host_address, ':') != NULL)
1466 type = T_AAAA;
1467else
1468#endif /* HAVE_IPV6 */
1469 type = T_A;
1470
1471
4e0983dc 1472lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1473switch (dns_lookup(&dnsa, target, type, NULL))
1474 {
1475 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1476
1477 default:
cc00f4af 1478 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1479
1480 /* If the query succeeded, scan the addresses and return the result. */
1481
1482 case DNS_SUCCEED:
cc00f4af
JH
1483 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1484 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1485 /* else fall through */
e5a9dba6
PH
1486
1487 /* If the target has no IP addresses, the client cannot have an authorized
1488 IP address. However, if the target site uses A6 records (not AAAA records)
1489 we have to do yet another lookup in order to check them. */
1490
1491 case DNS_NOMATCH:
1492 case DNS_NODATA:
cc00f4af 1493 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1494 }
1495}
1496
1497
1498
1499/*************************************************
059ec3d9
PH
1500* Handle verification (address & other) *
1501*************************************************/
1502
89583014 1503enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd 1504 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
e3a69b62 1505 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
89583014
JH
1506 };
1507typedef struct {
1508 uschar * name;
1509 int value;
1510 unsigned where_allowed; /* bitmap */
1511 BOOL no_options; /* Never has /option(s) following */
1512 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1513 } verify_type_t;
1514static verify_type_t verify_type_list[] = {
f2ed27cf 1515 /* name value where no-opt opt-sep */
7e8360e6 1516 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
e3a69b62
JH
1517 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1518 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
89583014 1519 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
e3a69b62
JH
1520 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1521 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1522 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1523 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1524 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
89583014 1525 FALSE, 6 },
e3a69b62
JH
1526 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1527 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1528#ifdef EXPERIMENTAL_ARC
f48946eb 1529 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
e3a69b62 1530#endif
89583014
JH
1531 };
1532
1533
1534enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1535 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1536 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
57cc2785 1537 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
89583014
JH
1538 };
1539typedef struct {
1540 uschar * name;
1541 int value;
1542 int flag;
1543 BOOL has_option; /* Has =option(s) following */
1544 BOOL timeval; /* Has a time value */
1545 } callout_opt_t;
1546static callout_opt_t callout_opt_list[] = {
f2ed27cf 1547 /* name value flag has-opt has-time */
89583014
JH
1548 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1549 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1550 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1551 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1552 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1553 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1554 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1555 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1556 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1557 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1558 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
57cc2785 1559 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
89583014
JH
1560 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1561 };
1562
1563
1564
059ec3d9
PH
1565/* This function implements the "verify" condition. It is called when
1566encountered in any ACL, because some tests are almost always permitted. Some
1567just don't make sense, and always fail (for example, an attempt to test a host
1568lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1569
1570Arguments:
1571 where where called from
1572 addr the recipient address that the ACL is handling, or NULL
1573 arg the argument of "verify"
1574 user_msgptr pointer for user message
1575 log_msgptr pointer for log message
1576 basic_errno where to put verify errno
1577
1578Returns: OK verification condition succeeded
1579 FAIL verification failed
1580 DEFER there was a problem verifying
1581 ERROR syntax error
1582*/
1583
1584static int
55414b25 1585acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1586 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1587{
1588int sep = '/';
1589int callout = -1;
1590int callout_overall = -1;
4deaf07d 1591int callout_connect = -1;
059ec3d9
PH
1592int verify_options = 0;
1593int rc;
1594BOOL verify_header_sender = FALSE;
1595BOOL defer_ok = FALSE;
1596BOOL callout_defer_ok = FALSE;
1597BOOL no_details = FALSE;
eafd343b 1598BOOL success_on_redirect = FALSE;
059ec3d9
PH
1599address_item *sender_vaddr = NULL;
1600uschar *verify_sender_address = NULL;
1601uschar *pm_mailfrom = NULL;
1602uschar *se_mailfrom = NULL;
596875b3
PH
1603
1604/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1605an error if options are given for items that don't expect them.
596875b3
PH
1606*/
1607
1608uschar *slash = Ustrchr(arg, '/');
55414b25 1609const uschar *list = arg;
059ec3d9 1610uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1611verify_type_t * vp;
059ec3d9 1612
e3a69b62 1613if (!ss) goto BAD_VERIFY;
059ec3d9
PH
1614
1615/* Handle name/address consistency verification in a separate function. */
1616
89583014 1617for (vp= verify_type_list;
5903c6ff 1618 CS vp < CS verify_type_list + sizeof(verify_type_list);
89583014
JH
1619 vp++
1620 )
1621 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1622 : strcmpic (ss, vp->name) == 0)
1623 break;
5903c6ff 1624if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
89583014
JH
1625 goto BAD_VERIFY;
1626
e3a69b62 1627if (vp->no_options && slash)
059ec3d9 1628 {
89583014
JH
1629 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1630 "(this verify item has no options)", arg);
1631 return ERROR;
059ec3d9 1632 }
e3a69b62 1633if (!(vp->where_allowed & BIT(where)))
059ec3d9 1634 {
e3a69b62
JH
1635 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1636 vp->name, acl_wherenames[where]);
89583014 1637 return ERROR;
059ec3d9 1638 }
89583014 1639switch(vp->value)
596875b3 1640 {
89583014 1641 case VERIFY_REV_HOST_LKUP:
617d3932 1642 if (!sender_host_address) return OK;
7e8360e6 1643 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
617d3932 1644 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
7e8360e6
JH
1645 if (strcmpic(ss, US"defer_ok") == 0)
1646 return OK;
1647 return rc;
059ec3d9 1648
89583014
JH
1649 case VERIFY_CERT:
1650 /* TLS certificate verification is done at STARTTLS time; here we just
1651 test whether it was successful or not. (This is for optional verification; for
1652 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1653
3703d818
JH
1654 if (tls_in.certificate_verified) return OK;
1655 *user_msgptr = US"no verified certificate";
1656 return FAIL;
e5a9dba6 1657
89583014
JH
1658 case VERIFY_HELO:
1659 /* We can test the result of optional HELO verification that might have
1660 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1661
3703d818 1662 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
617d3932 1663 return helo_verified ? OK : FAIL;
059ec3d9 1664
89583014
JH
1665 case VERIFY_CSA:
1666 /* Do Client SMTP Authorization checks in a separate function, and turn the
1667 result code into user-friendly strings. */
1c41c9cc 1668
3703d818
JH
1669 rc = acl_verify_csa(list);
1670 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1671 csa_reason_string[rc]);
3703d818 1672 csa_status = csa_status_string[rc];
e1d04f48 1673 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
3703d818 1674 return csa_return_code[rc];
89583014 1675
617d3932
JH
1676#ifdef EXPERIMENTAL_ARC
1677 case VERIFY_ARC:
1678 { /* Do Authenticated Received Chain checks in a separate function. */
1679 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1680 int csep = 0;
1681 uschar * cond;
1682
1683 if (!(arc_state = acl_verify_arc())) return DEFER;
93c931f8
JH
1684 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1685 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
617d3932
JH
1686
1687 if (!condlist) condlist = US"none:pass";
1688 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1689 if (Ustrcmp(arc_state, cond) == 0) return OK;
1690 return FAIL;
1691 }
1692#endif
1693
89583014 1694 case VERIFY_HDR_SYNTAX:
db57e575 1695 /* Check that all relevant header lines have the correct 5322-syntax. If there is
89583014
JH
1696 a syntax error, we return details of the error to the sender if configured to
1697 send out full details. (But a "message" setting on the ACL can override, as
1698 always). */
1699
1700 rc = verify_check_headers(log_msgptr);
3703d818
JH
1701 if (rc != OK && *log_msgptr)
1702 if (smtp_return_error_details)
1703 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1704 else
1705 acl_verify_message = *log_msgptr;
89583014 1706 return rc;
059ec3d9 1707
770747fd
MFM
1708 case VERIFY_HDR_NAMES_ASCII:
1709 /* Check that all header names are true 7 bit strings
1710 See RFC 5322, 2.2. and RFC 6532, 3. */
1711
1712 rc = verify_check_header_names_ascii(log_msgptr);
617d3932 1713 if (rc != OK && smtp_return_error_details && *log_msgptr)
770747fd
MFM
1714 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1715 return rc;
1716
89583014
JH
1717 case VERIFY_NOT_BLIND:
1718 /* Check that no recipient of this message is "blind", that is, every envelope
1719 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1720
617d3932 1721 if ((rc = verify_check_notblind()) != OK)
89583014
JH
1722 {
1723 *log_msgptr = string_sprintf("bcc recipient detected");
1724 if (smtp_return_error_details)
1725 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1726 }
1727 return rc;
059ec3d9 1728
89583014
JH
1729 /* The remaining verification tests check recipient and sender addresses,
1730 either from the envelope or from the header. There are a number of
1731 slash-separated options that are common to all of them. */
059ec3d9 1732
89583014
JH
1733 case VERIFY_HDR_SNDR:
1734 verify_header_sender = TRUE;
1735 break;
059ec3d9 1736
89583014
JH
1737 case VERIFY_SNDR:
1738 /* In the case of a sender, this can optionally be followed by an address to use
1739 in place of the actual sender (rare special-case requirement). */
059ec3d9 1740 {
89583014
JH
1741 uschar *s = ss + 6;
1742 if (*s == 0)
1743 verify_sender_address = sender_address;
1744 else
1745 {
1746 while (isspace(*s)) s++;
1747 if (*s++ != '=') goto BAD_VERIFY;
1748 while (isspace(*s)) s++;
1749 verify_sender_address = string_copy(s);
1750 }
059ec3d9 1751 }
89583014
JH
1752 break;
1753
1754 case VERIFY_RCPT:
1755 break;
059ec3d9
PH
1756 }
1757
89583014
JH
1758
1759
596875b3
PH
1760/* Remaining items are optional; they apply to sender and recipient
1761verification, including "header sender" verification. */
059ec3d9
PH
1762
1763while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1764 != NULL)
1765 {
1766 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1767 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1768 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1769
1770 /* These two old options are left for backwards compatibility */
1771
1772 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1773 {
1774 callout_defer_ok = TRUE;
1775 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1776 }
1777
1778 else if (strcmpic(ss, US"check_postmaster") == 0)
1779 {
1780 pm_mailfrom = US"";
1781 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1782 }
1783
1784 /* The callout option has a number of sub-options, comma separated */
1785
1786 else if (strncmpic(ss, US"callout", 7) == 0)
1787 {
1788 callout = CALLOUT_TIMEOUT_DEFAULT;
1789 ss += 7;
1790 if (*ss != 0)
1791 {
1792 while (isspace(*ss)) ss++;
1793 if (*ss++ == '=')
1794 {
55414b25 1795 const uschar * sublist = ss;
059ec3d9
PH
1796 int optsep = ',';
1797 uschar *opt;
1798 uschar buffer[256];
55414b25 1799 while (isspace(*sublist)) sublist++;
8e669ac1 1800
57cc2785 1801 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
059ec3d9 1802 {
89583014 1803 callout_opt_t * op;
438257ba 1804 double period = 1.0F;
059ec3d9 1805
89583014 1806 for (op= callout_opt_list; op->name; op++)
438257ba 1807 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1808 break;
059ec3d9 1809
89583014
JH
1810 verify_options |= op->flag;
1811 if (op->has_option)
1812 {
438257ba 1813 opt += Ustrlen(op->name);
4deaf07d
PH
1814 while (isspace(*opt)) opt++;
1815 if (*opt++ != '=')
1816 {
1817 *log_msgptr = string_sprintf("'=' expected after "
89583014 1818 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1819 return ERROR;
1820 }
1821 while (isspace(*opt)) opt++;
89583014 1822 }
57cc2785 1823 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
89583014 1824 {
57cc2785
JH
1825 *log_msgptr = string_sprintf("bad time value in ACL condition "
1826 "\"verify %s\"", arg);
1827 return ERROR;
89583014
JH
1828 }
1829
1830 switch(op->value)
1831 {
1832 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1833 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1834 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1835 case CALLOUT_MAILFROM:
1836 if (!verify_header_sender)
1837 {
1838 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1839 "callout option only for verify=header_sender (detected in ACL "
1840 "condition \"%s\")", arg);
1841 return ERROR;
1842 }
1843 se_mailfrom = string_copy(opt);
1844 break;
1845 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1846 case CALLOUT_MAXWAIT: callout_overall = period; break;
1847 case CALLOUT_CONNECT: callout_connect = period; break;
1848 case CALLOUT_TIME: callout = period; break;
1849 }
059ec3d9
PH
1850 }
1851 }
1852 else
1853 {
1854 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1855 "ACL condition \"%s\"", arg);
1856 return ERROR;
1857 }
1858 }
1859 }
1860
1861 /* Option not recognized */
1862
1863 else
1864 {
1865 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1866 "condition \"verify %s\"", ss, arg);
1867 return ERROR;
1868 }
1869 }
1870
1871if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1872 (vopt_callout_recipsender|vopt_callout_recippmaster))
1873 {
1874 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1875 "for a recipient callout";
1876 return ERROR;
1877 }
1878
1879/* Handle sender-in-header verification. Default the user message to the log
1880message if giving out verification details. */
1881
1882if (verify_header_sender)
1883 {
8e669ac1 1884 int verrno;
2f682e45
JH
1885
1886 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1887 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1888 &verrno)) != OK)
8e669ac1 1889 {
fe5b5d0b
PH
1890 *basic_errno = verrno;
1891 if (smtp_return_error_details)
1892 {
2f682e45 1893 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH
1894 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1895 if (rc == DEFER) acl_temp_details = TRUE;
1896 }
8e669ac1 1897 }
059ec3d9
PH
1898 }
1899
1900/* Handle a sender address. The default is to verify *the* sender address, but
1901optionally a different address can be given, for special requirements. If the
1902address is empty, we are dealing with a bounce message that has no sender, so
1903we cannot do any checking. If the real sender address gets rewritten during
1904verification (e.g. DNS widening), set the flag to stop it being rewritten again
1905during message reception.
1906
1907A list of verified "sender" addresses is kept to try to avoid doing to much
1908work repetitively when there are multiple recipients in a message and they all
1909require sender verification. However, when callouts are involved, it gets too
1910complicated because different recipients may require different callout options.
1911Therefore, we always do a full sender verify when any kind of callout is
1912specified. Caching elsewhere, for instance in the DNS resolver and in the
1913callout handling, should ensure that this is not terribly inefficient. */
1914
2f682e45 1915else if (verify_sender_address)
059ec3d9 1916 {
2f682e45 1917 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH
1918 {
1919 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1920 "sender verify callout";
1921 return ERROR;
1922 }
1923
1924 sender_vaddr = verify_checked_sender(verify_sender_address);
1925 if (sender_vaddr != NULL && /* Previously checked */
1926 callout <= 0) /* No callout needed this time */
1927 {
1928 /* If the "routed" flag is set, it means that routing worked before, so
1929 this check can give OK (the saved return code value, if set, belongs to a
1930 callout that was done previously). If the "routed" flag is not set, routing
1931 must have failed, so we use the saved return code. */
1932
2f682e45
JH
1933 if (testflag(sender_vaddr, af_verify_routed))
1934 rc = OK;
1935 else
059ec3d9
PH
1936 {
1937 rc = sender_vaddr->special_action;
1938 *basic_errno = sender_vaddr->basic_errno;
1939 }
e1d04f48 1940 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
059ec3d9
PH
1941 }
1942
1943 /* Do a new verification, and cache the result. The cache is used to avoid
1944 verifying the sender multiple times for multiple RCPTs when callouts are not
1945 specified (see comments above).
1946
1947 The cache is also used on failure to give details in response to the first
1948 RCPT that gets bounced for this reason. However, this can be suppressed by
1949 the no_details option, which sets the flag that says "this detail has already
1950 been sent". The cache normally contains just one address, but there may be
1951 more in esoteric circumstances. */
1952
1953 else
1954 {
1955 BOOL routed = TRUE;
2a3eea10 1956 uschar *save_address_data = deliver_address_data;
8e669ac1 1957
059ec3d9 1958 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 1959#ifdef SUPPORT_I18N
3c8b3577
JH
1960 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1961 {
1962 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1963 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1964 }
f358d5e0 1965#endif
059ec3d9
PH
1966 if (no_details) setflag(sender_vaddr, af_sverify_told);
1967 if (verify_sender_address[0] != 0)
1968 {
1969 /* If this is the real sender address, save the unrewritten version
1970 for use later in receive. Otherwise, set a flag so that rewriting the
1971 sender in verify_address() does not update sender_address. */
1972
1973 if (verify_sender_address == sender_address)
1974 sender_address_unrewritten = sender_address;
1975 else
1976 verify_options |= vopt_fake_sender;
1977
eafd343b
TK
1978 if (success_on_redirect)
1979 verify_options |= vopt_success_on_redirect;
1980
059ec3d9
PH
1981 /* The recipient, qualify, and expn options are never set in
1982 verify_options. */
1983
1984 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1985 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9 1986
e1d04f48 1987 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
059ec3d9 1988
2f682e45
JH
1989 if (rc != OK)
1990 *basic_errno = sender_vaddr->basic_errno;
1991 else
1992 DEBUG(D_acl)
1993 {
1994 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
e1d04f48 1995 debug_printf_indent("sender %s verified ok as %s\n",
2f682e45
JH
1996 verify_sender_address, sender_vaddr->address);
1997 else
e1d04f48 1998 debug_printf_indent("sender %s verified ok\n",
2f682e45
JH
1999 verify_sender_address);
2000 }
059ec3d9 2001 }
2f682e45
JH
2002 else
2003 rc = OK; /* Null sender */
059ec3d9
PH
2004
2005 /* Cache the result code */
2006
2007 if (routed) setflag(sender_vaddr, af_verify_routed);
2008 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2009 sender_vaddr->special_action = rc;
2010 sender_vaddr->next = sender_verified_list;
2011 sender_verified_list = sender_vaddr;
8e669ac1
PH
2012
2013 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2014 the sender verification. */
8e669ac1 2015
2a3eea10 2016 deliver_address_data = save_address_data;
059ec3d9 2017 }
8e669ac1 2018
2a3eea10
PH
2019 /* Put the sender address_data value into $sender_address_data */
2020
d43cbe25 2021 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2022 }
2023
2024/* A recipient address just gets a straightforward verify; again we must handle
2025the DEFER overrides. */
2026
2027else
2028 {
2029 address_item addr2;
2030
eafd343b
TK
2031 if (success_on_redirect)
2032 verify_options |= vopt_success_on_redirect;
2033
059ec3d9
PH
2034 /* We must use a copy of the address for verification, because it might
2035 get rewritten. */
2036
2037 addr2 = *addr;
2038 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2039 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
e1d04f48 2040 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
8e669ac1 2041
42855d71 2042 *basic_errno = addr2.basic_errno;
059ec3d9 2043 *log_msgptr = addr2.message;
8e669ac1 2044 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2045 addr2.user_message : addr2.message;
42855d71
PH
2046
2047 /* Allow details for temporary error if the address is so flagged. */
2048 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
2049
2050 /* Make $address_data visible */
d43cbe25 2051 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2052 }
2053
2054/* We have a result from the relevant test. Handle defer overrides first. */
2055
2056if (rc == DEFER && (defer_ok ||
2057 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2058 {
e1d04f48 2059 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
059ec3d9
PH
2060 defer_ok? "defer_ok" : "callout_defer_ok");
2061 rc = OK;
2062 }
2063
2064/* If we've failed a sender, set up a recipient message, and point
2065sender_verified_failed to the address item that actually failed. */
2066
2067if (rc != OK && verify_sender_address != NULL)
2068 {
2069 if (rc != DEFER)
059ec3d9 2070 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2071 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2072 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2073 else
2074 {
2075 *log_msgptr = US"Could not complete sender verify callout";
2076 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2077 *log_msgptr;
2078 }
2079
2080 sender_verified_failed = sender_vaddr;
2081 }
2082
2083/* Verifying an address messes up the values of $domain and $local_part,
2084so reset them before returning if this is a RCPT ACL. */
2085
2086if (addr != NULL)
2087 {
2088 deliver_domain = addr->domain;
2089 deliver_localpart = addr->local_part;
2090 }
2091return rc;
2092
2093/* Syntax errors in the verify argument come here. */
2094
2095BAD_VERIFY:
2096*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2097 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2098 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2099 "\"verify %s\"", arg);
2100return ERROR;
2101}
2102
2103
2104
2105
2106/*************************************************
2107* Check argument for control= modifier *
2108*************************************************/
2109
2110/* Called from acl_check_condition() below
2111
2112Arguments:
2113 arg the argument string for control=
2114 pptr set to point to the terminating character
2115 where which ACL we are in
2116 log_msgptr for error messages
2117
2118Returns: CONTROL_xxx value
2119*/
2120
2121static int
55414b25 2122decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2123{
d7bed771
JH
2124int idx, len;
2125control_def * d;
059ec3d9 2126
d7bed771
JH
2127if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2128 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2129 && (!d->has_option || arg[len] != '/')
2130 ) )
059ec3d9
PH
2131 {
2132 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2133 return CONTROL_ERROR;
2134 }
2135
059ec3d9 2136*pptr = arg + len;
d7bed771 2137return idx;
059ec3d9
PH
2138}
2139
2140
2141
c99ce5c9
TF
2142
2143/*************************************************
2144* Return a ratelimit error *
2145*************************************************/
2146
2147/* Called from acl_ratelimit() below
2148
2149Arguments:
2150 log_msgptr for error messages
2151 format format string
2152 ... supplementary arguments
2153 ss ratelimit option name
2154 where ACL_WHERE_xxxx indicating which ACL this is
2155
2156Returns: ERROR
2157*/
2158
2159static int
2160ratelimit_error(uschar **log_msgptr, const char *format, ...)
2161{
2162va_list ap;
2163uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2164va_start(ap, format);
2165if (!string_vformat(buffer, sizeof(buffer), format, ap))
2166 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2167 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2168va_end(ap);
2169*log_msgptr = string_sprintf(
2170 "error in arguments to \"ratelimit\" condition: %s", buffer);
2171return ERROR;
2172}
2173
2174
2175
2176
059ec3d9 2177/*************************************************
870f6ba8
TF
2178* Handle rate limiting *
2179*************************************************/
2180
2181/* Called by acl_check_condition() below to calculate the result
2182of the ACL ratelimit condition.
2183
2184Note that the return value might be slightly unexpected: if the
2185sender's rate is above the limit then the result is OK. This is
2186similar to the dnslists condition, and is so that you can write
2187ACL clauses like: defer ratelimit = 15 / 1h
2188
2189Arguments:
2190 arg the option string for ratelimit=
90fc3069 2191 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2192 log_msgptr for error messages
2193
2194Returns: OK - Sender's rate is above limit
2195 FAIL - Sender's rate is below limit
2196 DEFER - Problem opening ratelimit database
2197 ERROR - Syntax error in options.
2198*/
2199
2200static int
55414b25 2201acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2202{
c99ce5c9 2203double limit, period, count;
8f240103
PH
2204uschar *ss;
2205uschar *key = NULL;
c99ce5c9 2206uschar *unique = NULL;
870f6ba8 2207int sep = '/';
c99ce5c9
TF
2208BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2209BOOL noupdate = FALSE, badacl = FALSE;
2210int mode = RATE_PER_WHAT;
870f6ba8
TF
2211int old_pool, rc;
2212tree_node **anchor, *t;
2213open_db dbblock, *dbm;
c99ce5c9 2214int dbdb_size;
870f6ba8 2215dbdata_ratelimit *dbd;
c99ce5c9 2216dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2217struct timeval tv;
2218
2219/* Parse the first two options and record their values in expansion
2220variables. These variables allow the configuration to have informative
2221error messages based on rate limits obtained from a table lookup. */
2222
c99ce5c9 2223/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2224size, which must be greater than or equal to zero. Zero is useful for
2225rate measurement as opposed to rate limiting. */
2226
65a32f85 2227if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
96f5fe4c
JH
2228 return ratelimit_error(log_msgptr, "sender rate limit not set");
2229
2230limit = Ustrtod(sender_rate_limit, &ss);
2231if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2232else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2233else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2234
c99ce5c9
TF
2235if (limit < 0.0 || *ss != '\0')
2236 return ratelimit_error(log_msgptr,
2237 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2238
c99ce5c9 2239/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2240constant. This must be strictly greater than zero, because zero leads to
2241run-time division errors. */
2242
65a32f85
JH
2243period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2244 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
870f6ba8 2245if (period <= 0.0)
c99ce5c9
TF
2246 return ratelimit_error(log_msgptr,
2247 "\"%s\" is not a time value", sender_rate_period);
2248
2249/* By default we are counting one of something, but the per_rcpt,
2250per_byte, and count options can change this. */
2251
2252count = 1.0;
870f6ba8 2253
c99ce5c9 2254/* Parse the other options. */
870f6ba8 2255
65a32f85 2256while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
870f6ba8
TF
2257 {
2258 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2259 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2260 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2261 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2262 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2263 else if (strcmpic(ss, US"per_conn") == 0)
2264 {
2265 RATE_SET(mode, PER_CONN);
2266 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2267 badacl = TRUE;
2268 }
2269 else if (strcmpic(ss, US"per_mail") == 0)
2270 {
2271 RATE_SET(mode, PER_MAIL);
2272 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2273 }
2274 else if (strcmpic(ss, US"per_rcpt") == 0)
2275 {
2276 /* If we are running in the RCPT ACL, then we'll count the recipients
2277 one by one, but if we are running when we have accumulated the whole
2278 list then we'll add them all in one batch. */
2279 if (where == ACL_WHERE_RCPT)
2280 RATE_SET(mode, PER_RCPT);
2281 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2282 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2283 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2284 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2285 }
2286 else if (strcmpic(ss, US"per_byte") == 0)
2287 {
2288 /* If we have not yet received the message data and there was no SIZE
4c04137d 2289 declaration on the MAIL command, then it's safe to just use a value of
c99ce5c9
TF
2290 zero and let the recorded rate decay as if nothing happened. */
2291 RATE_SET(mode, PER_MAIL);
2292 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
65a32f85 2293 else count = message_size < 0 ? 0.0 : (double)message_size;
c99ce5c9
TF
2294 }
2295 else if (strcmpic(ss, US"per_addr") == 0)
2296 {
2297 RATE_SET(mode, PER_RCPT);
438257ba 2298 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
65a32f85 2299 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
c99ce5c9
TF
2300 }
2301 else if (strncmpic(ss, US"count=", 6) == 0)
2302 {
2303 uschar *e;
2304 count = Ustrtod(ss+6, &e);
2305 if (count < 0.0 || *e != '\0')
65a32f85 2306 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
c99ce5c9
TF
2307 }
2308 else if (strncmpic(ss, US"unique=", 7) == 0)
2309 unique = string_copy(ss + 7);
65a32f85 2310 else if (!key)
c99ce5c9
TF
2311 key = string_copy(ss);
2312 else
2313 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2314 }
2315
c99ce5c9
TF
2316/* Sanity check. When the badacl flag is set the update mode must either
2317be readonly (which is the default if it is omitted) or, for backwards
2318compatibility, a combination of noupdate and strict or leaky. */
2319
2320if (mode == RATE_PER_CLASH)
2321 return ratelimit_error(log_msgptr, "conflicting per_* options");
2322if (leaky + strict + readonly > 1)
2323 return ratelimit_error(log_msgptr, "conflicting update modes");
2324if (badacl && (leaky || strict) && !noupdate)
2325 return ratelimit_error(log_msgptr,
bfe6da19 2326 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
c99ce5c9
TF
2327 ratelimit_option_string[mode], acl_wherenames[where]);
2328
2329/* Set the default values of any unset options. In readonly mode we
2330perform the rate computation without any increment so that its value
2331decays to eventually allow over-limit senders through. */
2332
2333if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2334if (badacl) readonly = TRUE;
2335if (readonly) count = 0.0;
2336if (!strict && !readonly) leaky = TRUE;
2337if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2338
8f240103
PH
2339/* Create the lookup key. If there is no explicit key, use sender_host_address.
2340If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2341omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2342are added to the key because they alter the meaning of the stored data. */
2343
65a32f85
JH
2344if (!key)
2345 key = !sender_host_address ? US"" : sender_host_address;
870f6ba8 2346
c99ce5c9 2347key = string_sprintf("%s/%s/%s%s",
8f240103 2348 sender_rate_period,
c99ce5c9
TF
2349 ratelimit_option_string[mode],
2350 unique == NULL ? "" : "unique/",
8f240103 2351 key);
870f6ba8 2352
c99ce5c9 2353HDEBUG(D_acl)
e1d04f48 2354 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2355
8f240103
PH
2356/* See if we have already computed the rate by looking in the relevant tree.
2357For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2358pool so that they survive across resets. In readonly mode we only remember the
2359result for the rest of this command in case a later command changes it. After
2360this bit of logic the code is independent of the per_* mode. */
870f6ba8 2361
870f6ba8
TF
2362old_pool = store_pool;
2363
c99ce5c9
TF
2364if (readonly)
2365 anchor = &ratelimiters_cmd;
65a32f85
JH
2366else switch(mode)
2367 {
2368 case RATE_PER_CONN:
2369 anchor = &ratelimiters_conn;
2370 store_pool = POOL_PERM;
2371 break;
2372 case RATE_PER_BYTE:
2373 case RATE_PER_MAIL:
2374 case RATE_PER_ALLRCPTS:
2375 anchor = &ratelimiters_mail;
2376 break;
2377 case RATE_PER_ADDR:
2378 case RATE_PER_CMD:
2379 case RATE_PER_RCPT:
2380 anchor = &ratelimiters_cmd;
2381 break;
2382 default:
2383 anchor = NULL; /* silence an "unused" complaint */
2384 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2385 "internal ACL error: unknown ratelimit mode %d", mode);
2386 break;
2387 }
870f6ba8 2388
65a32f85 2389if ((t = tree_search(*anchor, key)))
870f6ba8
TF
2390 {
2391 dbd = t->data.ptr;
2392 /* The following few lines duplicate some of the code below. */
8f240103 2393 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2394 store_pool = old_pool;
2395 sender_rate = string_sprintf("%.1f", dbd->rate);
2396 HDEBUG(D_acl)
e1d04f48 2397 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
870f6ba8
TF
2398 return rc;
2399 }
2400
c99ce5c9
TF
2401/* We aren't using a pre-computed rate, so get a previously recorded rate
2402from the database, which will be updated and written back if required. */
870f6ba8 2403
0a6c178c 2404if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
870f6ba8
TF
2405 {
2406 store_pool = old_pool;
2407 sender_rate = NULL;
e1d04f48 2408 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
870f6ba8
TF
2409 *log_msgptr = US"ratelimit database not available";
2410 return DEFER;
2411 }
c99ce5c9
TF
2412dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2413dbd = NULL;
870f6ba8
TF
2414
2415gettimeofday(&tv, NULL);
2416
65a32f85 2417if (dbdb)
c99ce5c9
TF
2418 {
2419 /* Locate the basic ratelimit block inside the DB data. */
e1d04f48 2420 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
c99ce5c9
TF
2421 dbd = &dbdb->dbd;
2422
2423 /* Forget the old Bloom filter if it is too old, so that we count each
2424 repeating event once per period. We don't simply clear and re-use the old
2425 filter because we want its size to change if the limit changes. Note that
2426 we keep the dbd pointer for copying the rate into the new data block. */
2427
65a32f85 2428 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
c99ce5c9 2429 {
e1d04f48 2430 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
c99ce5c9
TF
2431 dbdb = NULL;
2432 }
2433
2434 /* Sanity check. */
2435
65a32f85 2436 if(unique && dbdb_size < sizeof(*dbdb))
c99ce5c9 2437 {
e1d04f48 2438 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
c99ce5c9
TF
2439 dbdb = NULL;
2440 }
2441 }
2442
2443/* Allocate a new data block if the database lookup failed
2444or the Bloom filter passed its age limit. */
2445
65a32f85 2446if (!dbdb)
c99ce5c9 2447 {
65a32f85 2448 if (!unique)
c99ce5c9
TF
2449 {
2450 /* No Bloom filter. This basic ratelimit block is initialized below. */
e1d04f48 2451 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
c99ce5c9
TF
2452 dbdb_size = sizeof(*dbd);
2453 dbdb = store_get(dbdb_size);
2454 }
2455 else
2456 {
2457 int extra;
e1d04f48 2458 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
c99ce5c9
TF
2459
2460 /* See the long comment below for an explanation of the magic number 2.
2461 The filter has a minimum size in case the rate limit is very small;
2462 this is determined by the definition of dbdata_ratelimit_unique. */
2463
2464 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2465 if (extra < 0) extra = 0;
2466 dbdb_size = sizeof(*dbdb) + extra;
2467 dbdb = store_get(dbdb_size);
2468 dbdb->bloom_epoch = tv.tv_sec;
2469 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2470 memset(dbdb->bloom, 0, dbdb->bloom_size);
2471
2472 /* Preserve any basic ratelimit data (which is our longer-term memory)
2473 by copying it from the discarded block. */
2474
65a32f85 2475 if (dbd)
c99ce5c9
TF
2476 {
2477 dbdb->dbd = *dbd;
2478 dbd = &dbdb->dbd;
2479 }
2480 }
2481 }
2482
2483/* If we are counting unique events, find out if this event is new or not.
2484If the client repeats the event during the current period then it should be
2485counted. We skip this code in readonly mode for efficiency, because any
2486changes to the filter will be discarded and because count is already set to
2487zero. */
2488
65a32f85 2489if (unique && !readonly)
c99ce5c9
TF
2490 {
2491 /* We identify unique events using a Bloom filter. (You can find my
2492 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2493 With the per_addr option, an "event" is a recipient address, though the
2494 user can use the unique option to define their own events. We only count
2495 an event if we have not seen it before.
2496
2497 We size the filter according to the rate limit, which (in leaky mode)
2498 is the limit on the population of the filter. We allow 16 bits of space
2499 per entry (see the construction code above) and we set (up to) 8 of them
2500 when inserting an element (see the loop below). The probability of a false
2501 positive (an event we have not seen before but which we fail to count) is
2502
2503 size = limit * 16
2504 numhash = 8
2505 allzero = exp(-numhash * pop / size)
2506 = exp(-0.5 * pop / limit)
2507 fpr = pow(1 - allzero, numhash)
2508
2509 For senders at the limit the fpr is 0.06% or 1 in 1700
2510 and for senders at half the limit it is 0.0006% or 1 in 170000
2511
2512 In strict mode the Bloom filter can fill up beyond the normal limit, in
2513 which case the false positive rate will rise. This means that the
2514 measured rate for very fast senders can bogusly drop off after a while.
2515
2516 At twice the limit, the fpr is 2.5% or 1 in 40
2517 At four times the limit, it is 31% or 1 in 3.2
2518
2519 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2520 decay below the limit, and if this is more than one then the Bloom filter
2521 will be discarded before the decay gets that far. The false positive rate
2522 at this threshold is 9.3% or 1 in 10.7. */
2523
2524 BOOL seen;
2525 unsigned n, hash, hinc;
2526 uschar md5sum[16];
2527 md5 md5info;
2528
2529 /* Instead of using eight independent hash values, we combine two values
2530 using the formula h1 + n * h2. This does not harm the Bloom filter's
2531 performance, and means the amount of hash we need is independent of the
2532 number of bits we set in the filter. */
2533
2534 md5_start(&md5info);
2535 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2536 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2537 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2538
2539 /* Scan the bits corresponding to this event. A zero bit means we have
2540 not seen it before. Ensure all bits are set to record this event. */
2541
e1d04f48 2542 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
c99ce5c9
TF
2543
2544 seen = TRUE;
2545 for (n = 0; n < 8; n++, hash += hinc)
2546 {
2547 int bit = 1 << (hash % 8);
2548 int byte = (hash / 8) % dbdb->bloom_size;
2549 if ((dbdb->bloom[byte] & bit) == 0)
2550 {
2551 dbdb->bloom[byte] |= bit;
2552 seen = FALSE;
2553 }
2554 }
2555
2556 /* If this event has occurred before, do not count it. */
2557
2558 if (seen)
2559 {
e1d04f48 2560 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
c99ce5c9
TF
2561 count = 0.0;
2562 }
2563 else
e1d04f48 2564 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
c99ce5c9
TF
2565 }
2566
2567/* If there was no previous ratelimit data block for this key, initialize
2568the new one, otherwise update the block from the database. The initial rate
2569is what would be computed by the code below for an infinite interval. */
2570
65a32f85 2571if (!dbd)
870f6ba8 2572 {
e1d04f48 2573 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
c99ce5c9 2574 dbd = &dbdb->dbd;
870f6ba8
TF
2575 dbd->time_stamp = tv.tv_sec;
2576 dbd->time_usec = tv.tv_usec;
c99ce5c9 2577 dbd->rate = count;
870f6ba8
TF
2578 }
2579else
2580 {
2581 /* The smoothed rate is computed using an exponentially weighted moving
2582 average adjusted for variable sampling intervals. The standard EWMA for
2583 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2584 where f() is the measured value and f'() is the smoothed value.
2585
2586 Old data decays out of the smoothed value exponentially, such that data n
2587 samples old is multiplied by a^n. The exponential decay time constant p
2588 is defined such that data p samples old is multiplied by 1/e, which means
2589 that a = exp(-1/p). We can maintain the same time constant for a variable
2590 sampling interval i by using a = exp(-i/p).
2591
2592 The rate we are measuring is messages per period, suitable for directly
2593 comparing with the limit. The average rate between now and the previous
2594 message is period / interval, which we feed into the EWMA as the sample.
2595
2596 It turns out that the number of messages required for the smoothed rate
2597 to reach the limit when they are sent in a burst is equal to the limit.
2598 This can be seen by analysing the value of the smoothed rate after N
2599 messages sent at even intervals. Let k = (1 - a) * p/i
2600
2601 rate_1 = (1 - a) * p/i + a * rate_0
2602 = k + a * rate_0
2603 rate_2 = k + a * rate_1
2604 = k + a * k + a^2 * rate_0
2605 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2606 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2607 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2608 = rate_0 * a^N + p/i * (1 - a^N)
2609
2610 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2611
2612 rate_N = p/i + (rate_0 - p/i) * a^N
2613 a^N = (rate_N - p/i) / (rate_0 - p/i)
2614 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2615 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2616
2617 Numerical analysis of the above equation, setting the computed rate to
2618 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2619 rates, p/i, the number of messages N = limit. So limit serves as both the
2620 maximum rate measured in messages per period, and the maximum number of
2621 messages that can be sent in a fast burst. */
2622
2623 double this_time = (double)tv.tv_sec
2624 + (double)tv.tv_usec / 1000000.0;
2625 double prev_time = (double)dbd->time_stamp
2626 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2627
2628 /* We must avoid division by zero, and deal gracefully with the clock going
2629 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2630 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2631
e5d5a95f
TF
2632 double interval = this_time - prev_time <= 0.0 ? 1e-9
2633 : this_time - prev_time;
2634
2635 double i_over_p = interval / period;
2636 double a = exp(-i_over_p);
870f6ba8 2637
c99ce5c9
TF
2638 /* Combine the instantaneous rate (period / interval) with the previous rate
2639 using the smoothing factor a. In order to measure sized events, multiply the
2640 instantaneous rate by the count of bytes or recipients etc. */
2641
870f6ba8
TF
2642 dbd->time_stamp = tv.tv_sec;
2643 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2644 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2645
2646 /* When events are very widely spaced the computed rate tends towards zero.
2647 Although this is accurate it turns out not to be useful for our purposes,
2648 especially when the first event after a long silence is the start of a spam
2649 run. A more useful model is that the rate for an isolated event should be the
2650 size of the event per the period size, ignoring the lack of events outside
2651 the current period and regardless of where the event falls in the period. So,
2652 if the interval was so long that the calculated rate is unhelpfully small, we
4c04137d 2653 re-initialize the rate. In the absence of higher-rate bursts, the condition
c99ce5c9
TF
2654 below is true if the interval is greater than the period. */
2655
2656 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2657 }
2658
c99ce5c9
TF
2659/* Clients sending at the limit are considered to be over the limit.
2660This matters for edge cases such as a limit of zero, when the client
2661should be completely blocked. */
3348576f 2662
65a32f85 2663rc = dbd->rate < limit ? FAIL : OK;
870f6ba8
TF
2664
2665/* Update the state if the rate is low or if we are being strict. If we
2666are in leaky mode and the sender's rate is too high, we do not update
2667the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2668rate preventing them from getting any email through. If readonly is set,
2669neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2670
c99ce5c9 2671if ((rc == FAIL && leaky) || strict)
8f240103 2672 {
c99ce5c9 2673 dbfn_write(dbm, key, dbdb, dbdb_size);
e1d04f48 2674 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
8f240103
PH
2675 }
2676else
2677 {
e1d04f48 2678 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
c99ce5c9 2679 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2680 }
2681
870f6ba8
TF
2682dbfn_close(dbm);
2683
c99ce5c9 2684/* Store the result in the tree for future reference. */
870f6ba8 2685
c99ce5c9
TF
2686t = store_get(sizeof(tree_node) + Ustrlen(key));
2687t->data.ptr = dbd;
2688Ustrcpy(t->name, key);
2689(void)tree_insertnode(anchor, t);
870f6ba8
TF
2690
2691/* We create the formatted version of the sender's rate very late in
2692order to ensure that it is done using the correct storage pool. */
2693
2694store_pool = old_pool;
2695sender_rate = string_sprintf("%.1f", dbd->rate);
2696
2697HDEBUG(D_acl)
e1d04f48 2698 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
870f6ba8
TF
2699
2700return rc;
2701}
2702
2703
2704
2705/*************************************************
b0019c78
TF
2706* The udpsend ACL modifier *
2707*************************************************/
2708
2709/* Called by acl_check_condition() below.
2710
2711Arguments:
2712 arg the option string for udpsend=
2713 log_msgptr for error messages
2714
2715Returns: OK - Completed.
2716 DEFER - Problem with DNS lookup.
2717 ERROR - Syntax error in options.
2718*/
2719
2720static int
55414b25 2721acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2722{
2723int sep = 0;
2724uschar *hostname;
2725uschar *portstr;
2726uschar *portend;
2727host_item *h;
2728int portnum;
b0019c78
TF
2729int len;
2730int r, s;
b1f8e4f8 2731uschar * errstr;
b0019c78
TF
2732
2733hostname = string_nextinlist(&arg, &sep, NULL, 0);
2734portstr = string_nextinlist(&arg, &sep, NULL, 0);
2735
f5d25c2b 2736if (!hostname)
b0019c78 2737 {
217b0e56 2738 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2739 return ERROR;
2740 }
f5d25c2b 2741if (!portstr)
b0019c78 2742 {
217b0e56 2743 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2744 return ERROR;
2745 }
f5d25c2b 2746if (!arg)
b0019c78 2747 {
217b0e56 2748 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2749 return ERROR;
2750 }
2751portnum = Ustrtol(portstr, &portend, 10);
2752if (*portend != '\0')
2753 {
217b0e56 2754 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2755 return ERROR;
2756 }
2757
2758/* Make a single-item host list. */
2759h = store_get(sizeof(host_item));
2760memset(h, 0, sizeof(host_item));
2761h->name = hostname;
2762h->port = portnum;
2763h->mx = MX_NONE;
2764
2765if (string_is_ip_address(hostname, NULL))
2766 h->address = hostname, r = HOST_FOUND;
2767else
2768 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2769if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2770 {
217b0e56 2771 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2772 return DEFER;
2773 }
2774
2775HDEBUG(D_acl)
e1d04f48 2776 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
b0019c78 2777
4a5cbaff 2778/*XXX this could better use sendto */
b1f8e4f8 2779r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
4a5cbaff 2780 1, NULL, &errstr, NULL);
b0019c78 2781if (r < 0) goto defer;
27f9999e 2782len = Ustrlen(arg);
9cb1785a 2783r = send(s, arg, len, 0);
b1f8e4f8
JH
2784if (r < 0)
2785 {
2786 errstr = US strerror(errno);
2787 close(s);
2788 goto defer;
2789 }
2790close(s);
b0019c78
TF
2791if (r < len)
2792 {
2793 *log_msgptr =
2794 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2795 return DEFER;
2796 }
2797
2798HDEBUG(D_acl)
e1d04f48 2799 debug_printf_indent("udpsend %d bytes\n", r);
b0019c78
TF
2800
2801return OK;
2802
2803defer:
b1f8e4f8 2804*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2805return DEFER;
2806}
2807
2808
2809
2810/*************************************************
059ec3d9
PH
2811* Handle conditions/modifiers on an ACL item *
2812*************************************************/
2813
2814/* Called from acl_check() below.
2815
2816Arguments:
2817 verb ACL verb
2818 cb ACL condition block - if NULL, result is OK
2819 where where called from
2820 addr the address being checked for RCPT, or NULL
2821 level the nesting level
2822 epp pointer to pass back TRUE if "endpass" encountered
2823 (applies only to "accept" and "discard")
2824 user_msgptr user message pointer
2825 log_msgptr log message pointer
2826 basic_errno pointer to where to put verify error
2827
2828Returns: OK - all conditions are met
2829 DISCARD - an "acl" condition returned DISCARD - only allowed
2830 for "accept" or "discard" verbs
2831 FAIL - at least one condition fails
2832 FAIL_DROP - an "acl" condition returned FAIL_DROP
2833 DEFER - can't tell at the moment (typically, lookup defer,
2834 but can be temporary callout problem)
2835 ERROR - ERROR from nested ACL or expansion failure or other
2836 error
2837*/
2838
2839static int
2840acl_check_condition(int verb, acl_condition_block *cb, int where,
2841 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2842 uschar **log_msgptr, int *basic_errno)
2843{
2844uschar *user_message = NULL;
2845uschar *log_message = NULL;
059ec3d9 2846int rc = OK;
8523533c 2847#ifdef WITH_CONTENT_SCAN
0f0c8159 2848int sep = -'/';
8523533c 2849#endif
059ec3d9 2850
bce15b62 2851for (; cb; cb = cb->next)
059ec3d9 2852 {
55414b25 2853 const uschar *arg;
8e669ac1 2854 int control_type;
059ec3d9
PH
2855
2856 /* The message and log_message items set up messages to be used in
2857 case of rejection. They are expanded later. */
2858
2859 if (cb->type == ACLC_MESSAGE)
2860 {
e1d04f48 2861 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
059ec3d9
PH
2862 user_message = cb->arg;
2863 continue;
2864 }
2865
2866 if (cb->type == ACLC_LOG_MESSAGE)
2867 {
e1d04f48 2868 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
059ec3d9
PH
2869 log_message = cb->arg;
2870 continue;
2871 }
2872
2873 /* The endpass "condition" just sets a flag to show it occurred. This is
2874 checked at compile time to be on an "accept" or "discard" item. */
2875
2876 if (cb->type == ACLC_ENDPASS)
2877 {
2878 *epp = TRUE;
2879 continue;
2880 }
2881
2882 /* For other conditions and modifiers, the argument is expanded now for some
2883 of them, but not for all, because expansion happens down in some lower level
2884 checking functions in some cases. */
2885
560e71cc
JH
2886 if (!conditions[cb->type].expand_at_top)
2887 arg = cb->arg;
2888 else if (!(arg = expand_string(cb->arg)))
059ec3d9 2889 {
560e71cc
JH
2890 if (expand_string_forcedfail) continue;
2891 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2892 cb->arg, expand_string_message);
2893 return search_find_defer ? DEFER : ERROR;
059ec3d9 2894 }
059ec3d9
PH
2895
2896 /* Show condition, and expanded condition if it's different */
2897
2898 HDEBUG(D_acl)
2899 {
2900 int lhswidth = 0;
e1d04f48 2901 debug_printf_indent("check %s%s %n",
2d009132
JH
2902 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2903 conditions[cb->type].name, &lhswidth);
059ec3d9
PH
2904
2905 if (cb->type == ACLC_SET)
2906 {
a79d8834
JH
2907#ifndef DISABLE_DKIM
2908 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2909 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2910 {
2911 debug_printf("%s ", cb->u.varname);
2912 lhswidth += 19;
2913 }
2914 else
2915#endif
2916 {
2917 debug_printf("acl_%s ", cb->u.varname);
2918 lhswidth += 5 + Ustrlen(cb->u.varname);
2919 }
059ec3d9
PH
2920 }
2921
2922 debug_printf("= %s\n", cb->arg);
2923
2924 if (arg != cb->arg)
2925 debug_printf("%.*s= %s\n", lhswidth,
2926 US" ", CS arg);
2927 }
2928
2929 /* Check that this condition makes sense at this time */
2930
2d009132 2931 if ((conditions[cb->type].forbids & (1 << where)) != 0)
059ec3d9
PH
2932 {
2933 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2d009132
JH
2934 conditions[cb->type].is_modifier ? "use" : "test",
2935 conditions[cb->type].name, acl_wherenames[where]);
059ec3d9
PH
2936 return ERROR;
2937 }
2938
2939 /* Run the appropriate test for each condition, or take the appropriate
2940 action for the remaining modifiers. */
2941
2942 switch(cb->type)
2943 {
71fafd95
PH
2944 case ACLC_ADD_HEADER:
2945 setup_header(arg);
2946 break;
2947
059ec3d9
PH
2948 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2949 "discard" verb. */
71fafd95 2950
059ec3d9 2951 case ACLC_ACL:
e1d04f48 2952 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
7421ecab
JH
2953 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2954 {
2955 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2956 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2957 verbs[verb]);
2958 return ERROR;
2959 }
059ec3d9
PH
2960 break;
2961
2962 case ACLC_AUTHENTICATED:
c44ff8be
JH
2963 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2964 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
059ec3d9
PH
2965 break;
2966
71fafd95 2967 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2968 case ACLC_BMI_OPTIN:
2969 {
2970 int old_pool = store_pool;
2971 store_pool = POOL_PERM;
2972 bmi_current_optin = string_copy(arg);
2973 store_pool = old_pool;
2974 }
2975 break;
71fafd95 2976 #endif
8523533c 2977
059ec3d9 2978 case ACLC_CONDITION:
f3766eb5
NM
2979 /* The true/false parsing here should be kept in sync with that used in
2980 expand.c when dealing with ECOND_BOOL so that we don't have too many
2981 different definitions of what can be a boolean. */
51c7471d
JH
2982 if (*arg == '-'
2983 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2984 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
2985 rc = (Uatoi(arg) == 0)? FAIL : OK;
2986 else
2987 rc = (strcmpic(arg, US"no") == 0 ||
2988 strcmpic(arg, US"false") == 0)? FAIL :
2989 (strcmpic(arg, US"yes") == 0 ||
2990 strcmpic(arg, US"true") == 0)? OK : DEFER;
2991 if (rc == DEFER)
2992 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2993 break;
2994
c3611384
PH
2995 case ACLC_CONTINUE: /* Always succeeds */
2996 break;
2997
059ec3d9 2998 case ACLC_CONTROL:
c5fcb476 2999 {
55414b25
JH
3000 const uschar *p = NULL;
3001 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3002
55414b25 3003 /* Check if this control makes sense at this time */
f7572e5a 3004
d7bed771 3005 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH
3006 {
3007 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3008 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH
3009 return ERROR;
3010 }
8800895a 3011
55414b25
JH
3012 switch(control_type)
3013 {
3014 case CONTROL_AUTH_UNADVERTISED:
3015 allow_auth_unadvertised = TRUE;
3016 break;
3017
3018 #ifdef EXPERIMENTAL_BRIGHTMAIL
3019 case CONTROL_BMI_RUN:
3020 bmi_run = 1;
3021 break;
3022 #endif
3023
3024 #ifndef DISABLE_DKIM
3025 case CONTROL_DKIM_VERIFY:
3026 dkim_disable_verify = TRUE;
3027 #ifdef EXPERIMENTAL_DMARC
3028 /* Since DKIM was blocked, skip DMARC too */
3029 dmarc_disable_verify = TRUE;
3030 dmarc_enable_forensic = FALSE;
3031 #endif
3032 break;
3033 #endif
3034
3035 #ifdef EXPERIMENTAL_DMARC
3036 case CONTROL_DMARC_VERIFY:
3037 dmarc_disable_verify = TRUE;
3038 break;
3039
3040 case CONTROL_DMARC_FORENSIC:
3041 dmarc_enable_forensic = TRUE;
3042 break;
3043 #endif
3044
3045 case CONTROL_DSCP:
3046 if (*p == '/')
3047 {
3048 int fd, af, level, optname, value;
3049 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3050 a socket; we can accept that, we'll just debug-log failures anyway. */
3051 fd = fileno(smtp_in);
3052 af = ip_get_address_family(fd);
3053 if (af < 0)
3054 {
3055 HDEBUG(D_acl)
e1d04f48 3056 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
55414b25
JH
3057 strerror(errno));
3058 break;
3059 }
3060 if (dscp_lookup(p+1, af, &level, &optname, &value))
3061 {
3062 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3063 {
e1d04f48 3064 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
55414b25
JH
3065 p+1, strerror(errno));
3066 }
3067 else
3068 {
e1d04f48 3069 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
55414b25
JH
3070 }
3071 }
3072 else
3073 {
3074 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3075 return ERROR;
3076 }
3077 }
3078 else
3079 {
3080 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3081 return ERROR;
3082 }
3083 break;
3084
3085 case CONTROL_ERROR:
3086 return ERROR;
3087
3088 case CONTROL_CASEFUL_LOCAL_PART:
3089 deliver_localpart = addr->cc_local_part;
3090 break;
3091
3092 case CONTROL_CASELOWER_LOCAL_PART:
3093 deliver_localpart = addr->lc_local_part;
3094 break;
3095
3096 case CONTROL_ENFORCE_SYNC:
3097 smtp_enforce_sync = TRUE;
3098 break;
3099
3100 case CONTROL_NO_ENFORCE_SYNC:
3101 smtp_enforce_sync = FALSE;
3102 break;
3103
3104 #ifdef WITH_CONTENT_SCAN
3105 case CONTROL_NO_MBOX_UNSPOOL:
3106 no_mbox_unspool = TRUE;
3107 break;
3108 #endif
3109
3110 case CONTROL_NO_MULTILINE:
3111 no_multiline_responses = TRUE;
3112 break;
3113
3114 case CONTROL_NO_PIPELINING:
3115 pipelining_enable = FALSE;
3116 break;
3117
3118 case CONTROL_NO_DELAY_FLUSH:
3119 disable_delay_flush = TRUE;
3120 break;
3121
3122 case CONTROL_NO_CALLOUT_FLUSH:
3123 disable_callout_flush = TRUE;
3124 break;
3125
3126 case CONTROL_FAKEREJECT:
57cc2785 3127 cancel_cutthrough_connection(TRUE, US"fakereject");
55414b25
JH
3128 case CONTROL_FAKEDEFER:
3129 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3130 if (*p == '/')
3131 {
3132 const uschar *pp = p + 1;
3133 while (*pp != 0) pp++;
3134 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3135 p = pp;
3136 }
3137 else
3138 {
3139 /* Explicitly reset to default string */
3140 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3141 }
3142 break;
ed7f7860 3143
55414b25
JH
3144 case CONTROL_FREEZE:
3145 deliver_freeze = TRUE;
3146 deliver_frozen_at = time(NULL);
3147 freeze_tell = freeze_tell_config; /* Reset to configured value */
3148 if (Ustrncmp(p, "/no_tell", 8) == 0)
3149 {
3150 p += 8;
3151 freeze_tell = NULL;
3152 }
3153 if (*p != 0)
3154 {
3155 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3156 return ERROR;
3157 }
57cc2785 3158 cancel_cutthrough_connection(TRUE, US"item frozen");
55414b25
JH
3159 break;
3160
3161 case CONTROL_QUEUE_ONLY:
3162 queue_only_policy = TRUE;
57cc2785 3163 cancel_cutthrough_connection(TRUE, US"queueing forced");
55414b25
JH
3164 break;
3165
3166 case CONTROL_SUBMISSION:
3167 originator_name = US"";
3168 submission_mode = TRUE;
3169 while (*p == '/')
3170 {
3171 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3172 {
3173 p += 14;
3174 active_local_sender_retain = TRUE;
3175 active_local_from_check = FALSE;
3176 }
3177 else if (Ustrncmp(p, "/domain=", 8) == 0)
3178 {
3179 const uschar *pp = p + 8;
3180 while (*pp != 0 && *pp != '/') pp++;
3181 submission_domain = string_copyn(p+8, pp-p-8);
3182 p = pp;
3183 }
3184 /* The name= option must be last, because it swallows the rest of
3185 the string. */
3186 else if (Ustrncmp(p, "/name=", 6) == 0)
3187 {
3188 const uschar *pp = p + 6;
3189 while (*pp != 0) pp++;
3190 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3191 big_buffer, big_buffer_size));
3192 p = pp;
3193 }
3194 else break;
3195 }
3196 if (*p != 0)
3197 {
3198 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3199 return ERROR;
3200 }
3201 break;
e4bdf652 3202
55414b25 3203 case CONTROL_DEBUG:
55414b25 3204 {
b0d68adc
JH
3205 uschar * debug_tag = NULL;
3206 uschar * debug_opts = NULL;
3207 BOOL kill = FALSE;
3208
3209 while (*p == '/')
55414b25 3210 {
b0d68adc
JH
3211 const uschar * pp = p+1;
3212 if (Ustrncmp(pp, "tag=", 4) == 0)
3213 {
3214 for (pp += 4; *pp && *pp != '/';) pp++;
3215 debug_tag = string_copyn(p+5, pp-p-5);
3216 }
3217 else if (Ustrncmp(pp, "opts=", 5) == 0)
3218 {
3219 for (pp += 5; *pp && *pp != '/';) pp++;
3220 debug_opts = string_copyn(p+6, pp-p-6);
3221 }
3222 else if (Ustrncmp(pp, "kill", 4) == 0)
3223 {
3224 for (pp += 4; *pp && *pp != '/';) pp++;
3225 kill = TRUE;
3226 }
3227 else
3228 while (*pp && *pp != '/') pp++;
55414b25
JH
3229 p = pp;
3230 }
b0d68adc
JH
3231
3232 if (kill)
3233 debug_logging_stop();
3234 else
3235 debug_logging_activate(debug_tag, debug_opts);
55414b25 3236 }
55414b25
JH
3237 break;
3238
3239 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3240 suppress_local_fixups = TRUE;
3241 break;
3242
3243 case CONTROL_CUTTHROUGH_DELIVERY:
051d5efa
JH
3244 {
3245 uschar * ignored = NULL;
a2b89db1 3246#ifndef DISABLE_PRDR
55414b25 3247 if (prdr_requested)
a2b89db1
PP
3248#else
3249 if (0)
3250#endif
55414b25
JH
3251 /* Too hard to think about for now. We might in future cutthrough
3252 the case where both sides handle prdr and this-node prdr acl
3253 is "accept" */
051d5efa 3254 ignored = US"PRDR active";
5032d1cf
JH
3255 else
3256 {
55414b25 3257 if (deliver_freeze)
051d5efa 3258 ignored = US"frozen";
55414b25 3259 else if (queue_only_policy)
051d5efa 3260 ignored = US"queue-only";
55414b25 3261 else if (fake_response == FAIL)
051d5efa 3262 ignored = US"fakereject";
55414b25
JH
3263 else
3264 {
ff5929e3
JH
3265 if (rcpt_count == 1)
3266 {
051d5efa 3267 cutthrough.delivery = TRUE; /* control accepted */
ff5929e3
JH
3268 while (*p == '/')
3269 {
3270 const uschar * pp = p+1;
3271 if (Ustrncmp(pp, "defer=", 6) == 0)
3272 {
3273 pp += 6;
3274 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3275 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3276 }
3277 else
3278 while (*pp && *pp != '/') pp++;
3279 p = pp;
3280 }
3281 }
06fdb9f7 3282 else
051d5efa 3283 ignored = US"nonfirst rcpt";
55414b25 3284 }
5032d1cf 3285 }
051d5efa
JH
3286 DEBUG(D_acl) if (ignored)
3287 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3288 }
3289 break;
3c8b3577 3290
8c5d388a 3291#ifdef SUPPORT_I18N
3c8b3577
JH
3292 case CONTROL_UTF8_DOWNCONVERT:
3293 if (*p == '/')
3294 {
921dfc11
JH
3295 if (p[1] == '1')
3296 {
3297 message_utf8_downconvert = 1;
3298 addr->prop.utf8_downcvt = TRUE;
3299 addr->prop.utf8_downcvt_maybe = FALSE;
3300 p += 2;
3301 break;
3302 }
3303 if (p[1] == '0')
3304 {
3305 message_utf8_downconvert = 0;
3306 addr->prop.utf8_downcvt = FALSE;
3307 addr->prop.utf8_downcvt_maybe = FALSE;
3308 p += 2;
3309 break;
3310 }
3c8b3577 3311 if (p[1] == '-' && p[2] == '1')
921dfc11
JH
3312 {
3313 message_utf8_downconvert = -1;
3314 addr->prop.utf8_downcvt = FALSE;
3315 addr->prop.utf8_downcvt_maybe = TRUE;
3316 p += 3;
3317 break;
3318 }
3c8b3577
JH
3319 *log_msgptr = US"bad option value for control=utf8_downconvert";
3320 }
3321 else
3322 {
921dfc11
JH
3323 message_utf8_downconvert = 1;
3324 addr->prop.utf8_downcvt = TRUE;
3325 addr->prop.utf8_downcvt_maybe = FALSE;
3326 break;
3c8b3577
JH
3327 }
3328 return ERROR;
8c5d388a 3329#endif
3c8b3577 3330
9171d434 3331 }
55414b25 3332 break;
059ec3d9 3333 }
059ec3d9 3334
6a8f9482
TK
3335 #ifdef EXPERIMENTAL_DCC
3336 case ACLC_DCC:
3337 {
4c04137d 3338 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3339 const uschar * list = arg;
3340 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3341 /* Run the dcc backend. */
3342 rc = dcc_process(&ss);
4c04137d 3343 /* Modify return code based upon the existence of options. */
3c8b3577 3344 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3345 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3346 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3347 }
3348 break;
3349 #endif
3350
71fafd95 3351 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3352 case ACLC_DECODE:
3353 rc = mime_decode(&arg);
3354 break;
71fafd95 3355 #endif
8523533c 3356
059ec3d9
PH
3357 case ACLC_DELAY:
3358 {
3359 int delay = readconf_readtime(arg, 0, FALSE);
3360 if (delay < 0)
3361 {
3362 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3363 "modifier: \"%s\" is not a time value", arg);
3364 return ERROR;
3365 }
3366 else
3367 {
e1d04f48 3368 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
059ec3d9
PH
3369 delay);
3370 if (host_checking)
3371 {
3372 HDEBUG(D_acl)
e1d04f48 3373 debug_printf_indent("delay skipped in -bh checking mode\n");
059ec3d9 3374 }
010c2d14 3375
ae9d18bc
JH
3376 /* NOTE 1: Remember that we may be
3377 dealing with stdin/stdout here, in addition to TCP/IP connections.
3378 Also, delays may be specified for non-SMTP input, where smtp_out and
3379 smtp_in will be NULL. Whatever is done must work in all cases.
3380
3381 NOTE 2: The added feature of flushing the output before a delay must
3382 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3383 */
3384
3385 else
3386 {
3387 if (smtp_out != NULL && !disable_delay_flush)
3388 mac_smtp_fflush();
3389
861a7c51 3390#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH
3391 {
3392 struct pollfd p;
3393 nfds_t n = 0;
3394 if (smtp_out)
3395 {
3396 p.fd = fileno(smtp_out);
3397 p.events = POLLRDHUP;
3398 n = 1;
3399 }
3400 if (poll(&p, n, delay*1000) > 0)
e1d04f48 3401 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
ae9d18bc
JH
3402 }
3403#else
010c2d14
PH
3404 /* It appears to be impossible to detect that a TCP/IP connection has
3405 gone away without reading from it. This means that we cannot shorten
3406 the delay below if the client goes away, because we cannot discover
3407 that the client has closed its end of the connection. (The connection
3408 is actually in a half-closed state, waiting for the server to close its
3409 end.) It would be nice to be able to detect this state, so that the
3410 Exim process is not held up unnecessarily. However, it seems that we
3411 can't. The poll() function does not do the right thing, and in any case
3412 it is not always available.
047bdd8c 3413 */
010c2d14 3414
86b8287f 3415 while (delay > 0) delay = sleep(delay);
ae9d18bc 3416#endif
8e669ac1 3417 }
059ec3d9
PH
3418 }
3419 }
3420 break;
3421
80a47a2c
TK
3422 #ifndef DISABLE_DKIM
3423 case ACLC_DKIM_SIGNER:
a79d8834 3424 if (dkim_cur_signer)
9e5d6b55 3425 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3426 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3427 else
b0b9dbb1 3428 rc = FAIL;
71fafd95
PH
3429 break;
3430
80a47a2c 3431 case ACLC_DKIM_STATUS:
a79d8834 3432 rc = match_isinlist(dkim_verify_status,
80a47a2c 3433 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3434 break;
3435 #endif
fb2274d4 3436
4840604e
TL
3437 #ifdef EXPERIMENTAL_DMARC
3438 case ACLC_DMARC_STATUS:
4a8ce2d8 3439 if (!dmarc_has_been_checked)
4840604e 3440 dmarc_process();
4a8ce2d8 3441 dmarc_has_been_checked = TRUE;
4840604e
TL
3442 /* used long way of dmarc_exim_expand_query() in case we need more
3443 * view into the process in the future. */
3444 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3445 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3446 break;
3447 #endif
3448
059ec3d9 3449 case ACLC_DNSLISTS:
379ba7d0 3450 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH
3451 break;
3452
3453 case ACLC_DOMAINS:
3454 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3455 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3456 break;
3457
3458 /* The value in tls_cipher is the full cipher name, for example,
3459 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3460 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3461 what may in practice come out of the SSL library - which at the time of
3462 writing is poorly documented. */
3463
3464 case ACLC_ENCRYPTED:
817d9f57 3465 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3466 {
3467 uschar *endcipher = NULL;
817d9f57
JH
3468 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3469 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3470 {
3471 endcipher = Ustrchr(++cipher, ':');
3472 if (endcipher != NULL) *endcipher = 0;
3473 }
3474 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3475 if (endcipher != NULL) *endcipher = ':';
3476 }
3477 break;
3478
3479 /* Use verify_check_this_host() instead of verify_check_host() so that
3480 we can pass over &host_data to catch any looked up data. Once it has been
3481 set, it retains its value so that it's still there if another ACL verb
3482 comes through here and uses the cache. However, we must put it into
3483 permanent store in case it is also expected to be used in a subsequent
3484 message in the same SMTP connection. */
3485
3486 case ACLC_HOSTS:
3487 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH
3488 (sender_host_address == NULL)? US"" : sender_host_address,
3489 CUSS &host_data);
4a452c43
JH
3490 if (rc == DEFER) *log_msgptr = search_error_message;
3491 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH
3492 break;
3493
3494 case ACLC_LOCAL_PARTS:
3495 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3496 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3497 CUSS &deliver_localpart_data);
059ec3d9
PH
3498 break;
3499
6ea85e9a
PH
3500 case ACLC_LOG_REJECT_TARGET:
3501 {
3502 int logbits = 0;
3503 int sep = 0;
55414b25 3504 const uschar *s = arg;
6ea85e9a 3505 uschar *ss;
4a452c43 3506 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH
3507 {
3508 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3509 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3510 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3511 else
3512 {
3513 logbits |= LOG_MAIN|LOG_REJECT;
3514 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3515 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3516 }
3517 }
3518 log_reject_target = logbits;
3519 }
3520 break;
3521
059ec3d9
PH
3522 case ACLC_LOGWRITE:
3523 {
3524 int logbits = 0;
55414b25 3525 const uschar *s = arg;
059ec3d9
PH
3526 if (*s == ':')
3527 {
3528 s++;
3529 while (*s != ':')
3530 {
3531 if (Ustrncmp(s, "main", 4) == 0)
3532 { logbits |= LOG_MAIN; s += 4; }
3533 else if (Ustrncmp(s, "panic", 5) == 0)
3534 { logbits |= LOG_PANIC; s += 5; }
3535 else if (Ustrncmp(s, "reject", 6) == 0)
3536 { logbits |= LOG_REJECT; s += 6; }
3537 else
3538 {
3539 logbits = LOG_MAIN|LOG_PANIC;
3540 s = string_sprintf(":unknown log name in \"%s\" in "
3541 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3542 }
3543 if (*s == ',') s++;
3544 }
3545 s++;
3546 }
3547 while (isspace(*s)) s++;
6ea85e9a
PH
3548
3549
059ec3d9
PH
3550 if (logbits == 0) logbits = LOG_MAIN;
3551 log_write(0, logbits, "%s", string_printing(s));
3552 }
3553 break;
8e669ac1 3554
71fafd95 3555 #ifdef WITH_CONTENT_SCAN
0f0c8159 3556 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3557 {
6ea85e9a 3558 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3559 const uschar * list = arg;
3560 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH
3561 uschar *opt;
3562 BOOL defer_ok = FALSE;
3563 int timeout = 0;
3564
55414b25 3565 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH
3566 if (strcmpic(opt, US"defer_ok") == 0)
3567 defer_ok = TRUE;
3568 else if ( strncmpic(opt, US"tmo=", 4) == 0
3569 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3570 )
3571 {
3572 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3573 return ERROR;
3574 }
3575
3576 rc = malware(ss, timeout);
3577 if (rc == DEFER && defer_ok)
3578 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK
3579 }
3580 break;
3581
3582 case ACLC_MIME_REGEX:
71fafd95 3583 rc = mime_regex(&arg);
8523533c 3584 break;
71fafd95 3585 #endif
059ec3d9 3586
b0b9dbb1 3587 case ACLC_QUEUE: