projects / exim.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Cutthrough: Reflect 5xx recipient reject from target to originator
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH		 1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH		 6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08
JH		 24static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
059ec3d9
PH		 31 US"warn" };
32
4e88a19f
PH		 33/* For each verb, the conditions for which "message" or "log_message" are used
34are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35"accept", the FAIL case is used only after "endpass", but that is selected in
36the code. */
37
38static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
059ec3d9
PH		 47
48/* ACL condition and modifier codes - keep in step with the table that
71fafd95
PH		 49follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50down. */
059ec3d9 51
71fafd95
PH		 52enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
8523533c
TK		 55#ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57#endif
71fafd95 58 ACLC_CONDITION,
c3611384 59 ACLC_CONTINUE,
71fafd95 60 ACLC_CONTROL,
6a8f9482
TK		 61#ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63#endif
8523533c
TK		 64#ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66#endif
67 ACLC_DELAY,
68#ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
fb2274d4 70#endif
80a47a2c
TK		 71#ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
4840604e
TL		 74#endif
75#ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
8e669ac1 77#endif
71fafd95
PH		 78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
6ea85e9a 85 ACLC_LOG_REJECT_TARGET,
71fafd95 86 ACLC_LOGWRITE,
8523533c
TK		 87#ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89#endif
90 ACLC_MESSAGE,
91#ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93#endif
870f6ba8 94 ACLC_RATELIMIT,
8523533c
TK		 95 ACLC_RECIPIENTS,
96#ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98#endif
e7568d51 99 ACLC_REMOVE_HEADER,
71fafd95
PH		 100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
8523533c 103#ifdef WITH_CONTENT_SCAN
8e669ac1 104 ACLC_SPAM,
8523533c
TK		 105#endif
106#ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
65a7d8c3 108 ACLC_SPF_GUESS,
8523533c 109#endif
b0019c78 110 ACLC_UDPSEND,
8523533c 111 ACLC_VERIFY };
059ec3d9 112
c3611384
PH		 113/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114"message", "log_message", "log_reject_target", "logwrite", and "set" are
115modifiers that look like conditions but always return TRUE. They are used for
116their side effects. */
059ec3d9 117
9a26b6b2
PH		 118static uschar *conditions[] = {
119 US"acl",
71fafd95 120 US"add_header",
9a26b6b2 121 US"authenticated",
8523533c
TK		 122#ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124#endif
125 US"condition",
c3611384 126 US"continue",
8e669ac1 127 US"control",
6a8f9482
TK		 128#ifdef EXPERIMENTAL_DCC
129 US"dcc",
130#endif
8523533c
TK		 131#ifdef WITH_CONTENT_SCAN
132 US"decode",
133#endif
134 US"delay",
135#ifdef WITH_OLD_DEMIME
136 US"demime",
fb2274d4 137#endif
80a47a2c
TK		 138#ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
4840604e
TL		 141#endif
142#ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
8523533c 144#endif
6ea85e9a
PH		 145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
8523533c
TK		 154#ifdef WITH_CONTENT_SCAN
155 US"malware",
156#endif
157 US"message",
158#ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160#endif
870f6ba8 161 US"ratelimit",
8523533c
TK		 162 US"recipients",
163#ifdef WITH_CONTENT_SCAN
164 US"regex",
165#endif
e7568d51 166 US"remove_header",
8523533c
TK		 167 US"sender_domains", US"senders", US"set",
168#ifdef WITH_CONTENT_SCAN
169 US"spam",
170#endif
171#ifdef EXPERIMENTAL_SPF
172 US"spf",
65a7d8c3 173 US"spf_guess",
8523533c 174#endif
b0019c78 175 US"udpsend",
059ec3d9 176 US"verify" };
8e669ac1 177
c5fcb476 178
9a26b6b2
PH		 179/* Return values from decode_control(); keep in step with the table of names
180that follows! */
181
182enum {
c46782ef 183 CONTROL_AUTH_UNADVERTISED,
3c8b3577 184#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 185 CONTROL_BMI_RUN,
3c8b3577 186#endif
ed7f7860 187 CONTROL_DEBUG,
3c8b3577 188#ifndef DISABLE_DKIM
f7572e5a 189 CONTROL_DKIM_VERIFY,
3c8b3577
JH		 190#endif
191#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
3c8b3577 194#endif
13363eba 195 CONTROL_DSCP,
c46782ef
PH		 196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
e4bdf652 199 CONTROL_CUTTHROUGH_DELIVERY,
c46782ef
PH		 200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
3c8b3577 206#ifdef WITH_CONTENT_SCAN
9a26b6b2 207 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 208#endif
c46782ef
PH		 209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
8c5d388a 211#ifdef SUPPORT_I18N
3c8b3577
JH		 212 CONTROL_UTF8_DOWNCONVERT,
213#endif
cf8b11a5 214 CONTROL_NO_MULTILINE,
047bdd8c 215 CONTROL_NO_PIPELINING,
4c590bd1
PH		 216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
c46782ef 218};
9a26b6b2 219
8800895a
PH		 220/* ACL control names; keep in step with the table above! This list is used for
221turning ids into names. The actual list of recognized names is in the variable
222control_def controls_list[] below. The fact that there are two lists is a mess
223and should be tidied up. */
9a26b6b2
PH		 224
225static uschar *controls[] = {
c46782ef 226 US"allow_auth_unadvertised",
3c8b3577 227#ifdef EXPERIMENTAL_BRIGHTMAIL
9a26b6b2 228 US"bmi_run",
3c8b3577 229#endif
ed7f7860 230 US"debug",
3c8b3577 231#ifndef DISABLE_DKIM
80a47a2c 232 US"dkim_disable_verify",
3c8b3577
JH		 233#endif
234#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
3c8b3577 237#endif
13363eba 238 US"dscp",
c46782ef
PH		 239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
e4bdf652 242 US"cutthrough_delivery",
c46782ef
PH		 243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
3c8b3577 249#ifdef WITH_CONTENT_SCAN
9a26b6b2 250 US"no_mbox_unspool",
3c8b3577 251#endif
cf8b11a5
PH		 252 US"fakedefer",
253 US"fakereject",
8c5d388a 254#ifdef SUPPORT_I18N
3c8b3577
JH		 255 US"utf8_downconvert",
256#endif
aa6dc513 257 US"no_multiline_responses",
cf8b11a5 258 US"no_pipelining",
4c590bd1
PH		 259 US"no_delay_flush",
260 US"no_callout_flush"
c46782ef 261};
059ec3d9 262
047bdd8c 263/* Flags to indicate for which conditions/modifiers a string expansion is done
059ec3d9
PH		 264at the outer level. In the other cases, expansion already occurs in the
265checking functions. */
266
267static uschar cond_expand_at_top[] = {
7421ecab 268 FALSE, /* acl */
3e536984 269 TRUE, /* add_header */
059ec3d9 270 FALSE, /* authenticated */
8523533c
TK		 271#ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
8e669ac1 273#endif
059ec3d9 274 TRUE, /* condition */
c3611384 275 TRUE, /* continue */
059ec3d9 276 TRUE, /* control */
6a8f9482
TK		 277#ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279#endif
8523533c
TK		 280#ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282#endif
059ec3d9 283 TRUE, /* delay */
8523533c
TK		 284#ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
fb2274d4 286#endif
80a47a2c
TK		 287#ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
4840604e
TL		 290#endif
291#ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
8523533c 293#endif
059ec3d9
PH		 294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
6ea85e9a 301 TRUE, /* log_reject_target */
059ec3d9 302 TRUE, /* logwrite */
8523533c
TK		 303#ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305#endif
059ec3d9 306 TRUE, /* message */
8523533c
TK		 307#ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309#endif
870f6ba8 310 TRUE, /* ratelimit */
059ec3d9 311 FALSE, /* recipients */
8523533c
TK		 312#ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314#endif
e7568d51 315 TRUE, /* remove_header */
059ec3d9
PH		 316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
8523533c
TK		 319#ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321#endif
322#ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
65a7d8c3 324 TRUE, /* spf_guess */
8523533c 325#endif
b0019c78 326 TRUE, /* udpsend */
059ec3d9
PH		 327 TRUE /* verify */
328};
329
330/* Flags to identify the modifiers */
331
332static uschar cond_modifiers[] = {
333 FALSE, /* acl */
3e536984 334 TRUE, /* add_header */
059ec3d9 335 FALSE, /* authenticated */
8523533c
TK		 336#ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
8e669ac1 338#endif
059ec3d9 339 FALSE, /* condition */
c3611384 340 TRUE, /* continue */
059ec3d9 341 TRUE, /* control */
6a8f9482
TK		 342#ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344#endif
8523533c
TK		 345#ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347#endif
059ec3d9 348 TRUE, /* delay */
8523533c
TK		 349#ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
fb2274d4 351#endif
80a47a2c
TK		 352#ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
4840604e
TL		 355#endif
356#ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
8523533c 358#endif
059ec3d9
PH		 359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
6ea85e9a 366 TRUE, /* log_reject_target */
8523533c
TK		 367 TRUE, /* logwrite */
368#ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370#endif
059ec3d9 371 TRUE, /* message */
8523533c
TK		 372#ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374#endif
870f6ba8 375 FALSE, /* ratelimit */
059ec3d9 376 FALSE, /* recipients */
8523533c
TK		 377#ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379#endif
e7568d51 380 TRUE, /* remove_header */
059ec3d9
PH		 381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
8523533c
TK		 384#ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386#endif
387#ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
65a7d8c3 389 FALSE, /* spf_guess */
8523533c 390#endif
b0019c78 391 TRUE, /* udpsend */
059ec3d9
PH		 392 FALSE /* verify */
393};
394
c3611384 395/* Bit map vector of which conditions and modifiers are not allowed at certain
8f128379
PH		 396times. For each condition and modifier, there's a bitmap of dis-allowed times.
397For some, it is easier to specify the negation of a small number of allowed
398times. */
059ec3d9
PH		 399
400static unsigned int cond_forbids[] = {
401 0, /* acl */
8e669ac1 402
71fafd95 403 (unsigned int)
45b91596 404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
71fafd95 405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 406 #ifndef DISABLE_PRDR
fd98a5c6
JH		 407 (1<<ACL_WHERE_PRDR)|
408 #endif
45b91596 409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
67caae1f 410 (1<<ACL_WHERE_DKIM)|
45b91596 411 (1<<ACL_WHERE_NOTSMTP_START)),
71fafd95 412
45b91596
PH		 413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
8e669ac1 416
71fafd95 417 #ifdef EXPERIMENTAL_BRIGHTMAIL
3864bb8e 418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
8523533c
TK		 419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
8ccd00b1 421 #ifndef DISABLE_PRDR
fd98a5c6
JH		 422 (1<<ACL_WHERE_PRDR)|
423 #endif
8e669ac1 424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
8523533c
TK		 425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
45b91596
PH		 427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 429 #endif
8e669ac1 430
059ec3d9 431 0, /* condition */
8e669ac1 432
c3611384
PH		 433 0, /* continue */
434
059ec3d9 435 /* Certain types of control are always allowed, so we let it through
2f079f46 436 always and check in the control processing itself. */
8e669ac1 437
059ec3d9 438 0, /* control */
8e669ac1 439
6a8f9482
TK		 440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
fd98a5c6 442 ~((1<<ACL_WHERE_DATA)| /* dcc */
8ccd00b1 443 #ifndef DISABLE_PRDR
fd98a5c6 444 (1<<ACL_WHERE_PRDR)|
8ccd00b1 445 #endif
fd98a5c6 446 (1<<ACL_WHERE_NOTSMTP)),
6a8f9482
TK		 447 #endif
448
71fafd95 449 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
71fafd95 452 #endif
8523533c 453
8f128379 454 (1<<ACL_WHERE_NOTQUIT), /* delay */
8e669ac1 455
71fafd95 456 #ifdef WITH_OLD_DEMIME
2f079f46 457 (unsigned int)
fd98a5c6 458 ~((1<<ACL_WHERE_DATA)| /* demime */
8ccd00b1 459 #ifndef DISABLE_PRDR
fd98a5c6 460 (1<<ACL_WHERE_PRDR)|
8ccd00b1 461 #endif
fd98a5c6 462 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 463 #endif
8e669ac1 464
80a47a2c
TK		 465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
84330b7b 468
80a47a2c
TK		 469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
71fafd95 471 #endif
fb2274d4 472
4840604e
TL		 473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
379ba7d0
JH		 478 /* Explicit key lookups can be made in non-smtp ACLs so pass
479 always and check in the verify processing itself. */
480
481 0, /* dnslists */
059ec3d9 482
2f079f46 483 (unsigned int)
fd98a5c6 484 ~((1<<ACL_WHERE_RCPT) /* domains */
4f6ae5c3 485 |(1<<ACL_WHERE_VRFY)
8ccd00b1 486 #ifndef DISABLE_PRDR
fd98a5c6
JH		 487 |(1<<ACL_WHERE_PRDR)
488 #endif
489 ),
059ec3d9 490
45b91596
PH		 491 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
492 (1<<ACL_WHERE_CONNECT)|
493 (1<<ACL_WHERE_NOTSMTP_START)|
059ec3d9 494 (1<<ACL_WHERE_HELO),
8e669ac1 495
059ec3d9 496 0, /* endpass */
8e669ac1 497
45b91596
PH		 498 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
499 (1<<ACL_WHERE_NOTSMTP_START),
059ec3d9 500
2f079f46 501 (unsigned int)
fd98a5c6 502 ~((1<<ACL_WHERE_RCPT) /* local_parts */
4f6ae5c3 503 |(1<<ACL_WHERE_VRFY)
2e6afa4f 504 #ifndef DISABLE_PRDR
fd98a5c6
JH		 505 |(1<<ACL_WHERE_PRDR)
506 #endif
507 ),
059ec3d9
PH		 508
509 0, /* log_message */
8e669ac1 510
6ea85e9a
PH		 511 0, /* log_reject_target */
512
059ec3d9 513 0, /* logwrite */
8e669ac1 514
71fafd95 515 #ifdef WITH_CONTENT_SCAN
2f079f46 516 (unsigned int)
fd98a5c6 517 ~((1<<ACL_WHERE_DATA)| /* malware */
8ccd00b1 518 #ifndef DISABLE_PRDR
fd98a5c6 519 (1<<ACL_WHERE_PRDR)|
8ccd00b1 520 #endif
fd98a5c6 521 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 522 #endif
8523533c 523
059ec3d9
PH		 524 0, /* message */
525
71fafd95 526 #ifdef WITH_CONTENT_SCAN
2f079f46
PH		 527 (unsigned int)
528 ~(1<<ACL_WHERE_MIME), /* mime_regex */
71fafd95 529 #endif
8523533c 530
870f6ba8
TF		 531 0, /* ratelimit */
532
2f079f46
PH		 533 (unsigned int)
534 ~(1<<ACL_WHERE_RCPT), /* recipients */
059ec3d9 535
71fafd95 536 #ifdef WITH_CONTENT_SCAN
2f079f46 537 (unsigned int)
fd98a5c6 538 ~((1<<ACL_WHERE_DATA)| /* regex */
8ccd00b1 539 #ifndef DISABLE_PRDR
fd98a5c6 540 (1<<ACL_WHERE_PRDR)|
8ccd00b1 541 #endif
fd98a5c6 542 (1<<ACL_WHERE_NOTSMTP)|
2f079f46 543 (1<<ACL_WHERE_MIME)),
71fafd95 544 #endif
8523533c 545
e7568d51
TL		 546 (unsigned int)
547 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
548 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
8ccd00b1 549 #ifndef DISABLE_PRDR
fd98a5c6
JH		 550 (1<<ACL_WHERE_PRDR)|
551 #endif
e7568d51
TL		 552 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
553 (1<<ACL_WHERE_NOTSMTP_START)),
554
059ec3d9
PH		 555 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
556 (1<<ACL_WHERE_HELO)|
557 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
558 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
559 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
560
561 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
562 (1<<ACL_WHERE_HELO)|
563 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
564 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
565 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
566
567 0, /* set */
568
71fafd95 569 #ifdef WITH_CONTENT_SCAN
2f079f46 570 (unsigned int)
fd98a5c6 571 ~((1<<ACL_WHERE_DATA)| /* spam */
8ccd00b1 572 #ifndef DISABLE_PRDR
fd98a5c6 573 (1<<ACL_WHERE_PRDR)|
8ccd00b1 574 #endif
fd98a5c6 575 (1<<ACL_WHERE_NOTSMTP)),
71fafd95 576 #endif
8523533c 577
71fafd95 578 #ifdef EXPERIMENTAL_SPF
8523533c
TK		 579 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
580 (1<<ACL_WHERE_HELO)|
581 (1<<ACL_WHERE_MAILAUTH)|
582 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
45b91596
PH		 583 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
584 (1<<ACL_WHERE_NOTSMTP)|
585 (1<<ACL_WHERE_NOTSMTP_START),
65a7d8c3
NM		 586
587 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
588 (1<<ACL_WHERE_HELO)|
589 (1<<ACL_WHERE_MAILAUTH)|
590 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
591 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
592 (1<<ACL_WHERE_NOTSMTP)|
593 (1<<ACL_WHERE_NOTSMTP_START),
71fafd95 594 #endif
8523533c 595
b0019c78
TF		 596 0, /* udpsend */
597
059ec3d9
PH		 598 /* Certain types of verify are always allowed, so we let it through
599 always and check in the verify function itself */
600
601 0 /* verify */
059ec3d9
PH		 602};
603
604
c5fcb476
PH		 605/* Bit map vector of which controls are not allowed at certain times. For
606each control, there's a bitmap of dis-allowed times. For some, it is easier to
607specify the negation of a small number of allowed times. */
608
609static unsigned int control_forbids[] = {
c46782ef
PH		 610 (unsigned int)
611 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
612
3c8b3577 613#ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c 614 0, /* bmi_run */
3c8b3577 615#endif
c46782ef 616
ed7f7860
PP		 617 0, /* debug */
618
3c8b3577 619#ifndef DISABLE_DKIM
80a47a2c 620 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
3c8b3577 621# ifndef DISABLE_PRDR
fd98a5c6 622 (1<<ACL_WHERE_PRDR)|
3c8b3577 623# endif
f7572e5a 624 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 625#endif
f7572e5a 626
3c8b3577 627#ifdef EXPERIMENTAL_DMARC
4840604e
TL		 628 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
629 (1<<ACL_WHERE_NOTSMTP_START),
630 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
631 (1<<ACL_WHERE_NOTSMTP_START),
3c8b3577 632#endif
4840604e 633
13363eba
PP		 634 (1<<ACL_WHERE_NOTSMTP)|
635 (1<<ACL_WHERE_NOTSMTP_START)|
636 (1<<ACL_WHERE_NOTQUIT), /* dscp */
637
c5fcb476 638 0, /* error */
8e669ac1
PH		 639
640 (unsigned int)
c5fcb476 641 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
8e669ac1
PH		 642
643 (unsigned int)
c5fcb476 644 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
8e669ac1 645
e4bdf652
JH		 646 (unsigned int)
647 0, /* cutthrough_delivery */
648
45b91596
PH		 649 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
650 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1 651
45b91596
PH		 652 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
653 (1<<ACL_WHERE_NOTSMTP_START),
8e669ac1
PH		 654
655 (unsigned int)
c5fcb476
PH		 656 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
657 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 658 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 659 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 660
661 (unsigned int)
c5fcb476
PH		 662 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
663 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 664 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 665 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
8e669ac1
PH		 666
667 (unsigned int)
c5fcb476 668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
8e669ac1 669 (1<<ACL_WHERE_PREDATA)),
8523533c 670
8800895a
PH		 671 (unsigned int)
672 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
45b91596
PH		 673 (1<<ACL_WHERE_PREDATA)|
674 (1<<ACL_WHERE_NOTSMTP_START)),
8800895a 675
3c8b3577 676#ifdef WITH_CONTENT_SCAN
8e669ac1 677 (unsigned int)
14d57970 678 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
e715ad22 679 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
fd98a5c6 680 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
e715ad22 681 (1<<ACL_WHERE_MIME)),
3c8b3577 682#endif
a6c4ab60 683
29aba418
TF		 684 (unsigned int)
685 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
686 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 687#ifndef DISABLE_PRDR
fd98a5c6 688 (1<<ACL_WHERE_PRDR)|
3c8b3577 689#endif
29aba418
TF		 690 (1<<ACL_WHERE_MIME)),
691
8e669ac1 692 (unsigned int)
a6c4ab60 693 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
e715ad22 694 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
3c8b3577 695#ifndef DISABLE_PRDR
fd98a5c6 696 (1<<ACL_WHERE_PRDR)|
3c8b3577 697#endif
e715ad22 698 (1<<ACL_WHERE_MIME)),
8523533c 699
8c5d388a 700#ifdef SUPPORT_I18N
3c8b3577
JH		 701 0, /* utf8_downconvert */
702#endif
703
45b91596 704 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
cf8b11a5
PH		 705 (1<<ACL_WHERE_NOTSMTP_START),
706
707 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
047bdd8c
PH		 708 (1<<ACL_WHERE_NOTSMTP_START),
709
710 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
4c590bd1
PH		 711 (1<<ACL_WHERE_NOTSMTP_START),
712
713 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
45b91596 714 (1<<ACL_WHERE_NOTSMTP_START)
c5fcb476
PH		 715};
716
717/* Structure listing various control arguments, with their characteristics. */
059ec3d9
PH		 718
719typedef struct control_def {
720 uschar *name;
721 int value; /* CONTROL_xxx value */
059ec3d9
PH		 722 BOOL has_option; /* Has /option(s) following */
723} control_def;
724
725static control_def controls_list[] = {
3c8b3577 726 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
8523533c 727#ifdef EXPERIMENTAL_BRIGHTMAIL
3c8b3577 728 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
fb2274d4 729#endif
3c8b3577 730 { US"debug", CONTROL_DEBUG, TRUE },
80a47a2c 731#ifndef DISABLE_DKIM
3c8b3577 732 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
4840604e
TL		 733#endif
734#ifdef EXPERIMENTAL_DMARC
3c8b3577
JH		 735 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
736 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
8523533c 737#endif
3c8b3577
JH		 738 { US"dscp", CONTROL_DSCP, TRUE },
739 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
740 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
741 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
742 { US"freeze", CONTROL_FREEZE, TRUE },
743 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
744 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
745 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
746 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
747 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
748 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
8523533c 749#ifdef WITH_CONTENT_SCAN
3c8b3577 750 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
8523533c 751#endif
3c8b3577
JH		 752 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
753 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
754 { US"submission", CONTROL_SUBMISSION, TRUE },
e4bdf652 755 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
3c8b3577 756 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
8c5d388a 757#ifdef SUPPORT_I18N
3c8b3577
JH		 758 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
759#endif
059ec3d9
PH		 760 };
761
e5a9dba6
PH		 762/* Support data structures for Client SMTP Authorization. acl_verify_csa()
763caches its result in a tree to avoid repeated DNS queries. The result is an
764integer code which is used as an index into the following tables of
765explanatory strings and verification return codes. */
766
767static tree_node *csa_cache = NULL;
768
769enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
770 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
771
772/* The acl_verify_csa() return code is translated into an acl_verify() return
773code using the following table. It is OK unless the client is definitely not
774authorized. This is because CSA is supposed to be optional for sending sites,
775so recipients should not be too strict about checking it - especially because
776DNS problems are quite likely to occur. It's possible to use $csa_status in
777further ACL conditions to distinguish ok, unknown, and defer if required, but
778the aim is to make the usual configuration simple. */
779
780static int csa_return_code[] = {
781 OK, OK, OK, OK,
782 FAIL, FAIL, FAIL, FAIL
783};
784
785static uschar *csa_status_string[] = {
786 US"unknown", US"ok", US"defer", US"defer",
787 US"fail", US"fail", US"fail", US"fail"
788};
789
790static uschar *csa_reason_string[] = {
791 US"unknown",
792 US"ok",
793 US"deferred (SRV lookup failed)",
794 US"deferred (target address lookup failed)",
795 US"failed (explicit authorization required)",
796 US"failed (host name not authorized)",
797 US"failed (no authorized addresses)",
798 US"failed (client address mismatch)"
799};
800
c99ce5c9
TF		 801/* Options for the ratelimit condition. Note that there are two variants of
802the per_rcpt option, depending on the ACL that is used to measure the rate.
803However any ACL must be able to look up per_rcpt rates in /noupdate mode,
804so the two variants must have the same internal representation as well as
805the same configuration string. */
806
807enum {
808 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
809 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
810};
811
812#define RATE_SET(var,new) \
813 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
814
815static uschar *ratelimit_option_string[] = {
816 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
817 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
818};
819
059ec3d9
PH		 820/* Enable recursion between acl_check_internal() and acl_check_condition() */
821
55414b25 822static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
f60d98e8 823 uschar **);
059ec3d9
PH		 824
825
826/*************************************************
827* Pick out name from list *
828*************************************************/
829
830/* Use a binary chop method
831
832Arguments:
833 name name to find
834 list list of names
835 end size of list
836
837Returns: offset in list, or -1 if not found
838*/
839
840static int
841acl_checkname(uschar *name, uschar **list, int end)
842{
843int start = 0;
844
845while (start < end)
846 {
847 int mid = (start + end)/2;
848 int c = Ustrcmp(name, list[mid]);
849 if (c == 0) return mid;
850 if (c < 0) end = mid; else start = mid + 1;
851 }
852
853return -1;
854}
855
856
857/*************************************************
858* Read and parse one ACL *
859*************************************************/
860
861/* This function is called both from readconf in order to parse the ACLs in the
862configuration file, and also when an ACL is encountered dynamically (e.g. as
863the result of an expansion). It is given a function to call in order to
864retrieve the lines of the ACL. This function handles skipping comments and
865blank lines (where relevant).
866
867Arguments:
868 func function to get next line of ACL
869 error where to put an error message
870
871Returns: pointer to ACL, or NULL
872 NULL can be legal (empty ACL); in this case error will be NULL
873*/
874
875acl_block *
876acl_read(uschar *(*func)(void), uschar **error)
877{
878acl_block *yield = NULL;
879acl_block **lastp = &yield;
880acl_block *this = NULL;
881acl_condition_block *cond;
882acl_condition_block **condp = NULL;
883uschar *s;
884
885*error = NULL;
886
887while ((s = (*func)()) != NULL)
888 {
889 int v, c;
890 BOOL negated = FALSE;
891 uschar *saveline = s;
892 uschar name[64];
893
894 /* Conditions (but not verbs) are allowed to be negated by an initial
895 exclamation mark. */
896
897 while (isspace(*s)) s++;
898 if (*s == '!')
899 {
900 negated = TRUE;
901 s++;
902 }
903
cf00dad6
PH		 904 /* Read the name of a verb or a condition, or the start of a new ACL, which
905 can be started by a name, or by a macro definition. */
059ec3d9
PH		 906
907 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 908 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH		 909
910 /* If a verb is unrecognized, it may be another condition or modifier that
911 continues the previous verb. */
912
913 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
914 if (v < 0)
915 {
916 if (this == NULL)
917 {
4e167a8c
PH		 918 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
919 saveline);
059ec3d9
PH		 920 return NULL;
921 }
922 }
923
924 /* New verb */
925
926 else
927 {
928 if (negated)
929 {
930 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
931 return NULL;
932 }
933 this = store_get(sizeof(acl_block));
934 *lastp = this;
935 lastp = &(this->next);
936 this->next = NULL;
937 this->verb = v;
938 this->condition = NULL;
939 condp = &(this->condition);
940 if (*s == 0) continue; /* No condition on this line */
941 if (*s == '!')
942 {
943 negated = TRUE;
944 s++;
945 }
946 s = readconf_readname(name, sizeof(name), s); /* Condition name */
947 }
948
949 /* Handle a condition or modifier. */
950
951 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
952 if (c < 0)
953 {
954 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
955 saveline);
956 return NULL;
957 }
958
959 /* The modifiers may not be negated */
960
961 if (negated && cond_modifiers[c])
962 {
963 *error = string_sprintf("ACL error: negation is not allowed with "
964 "\"%s\"", conditions[c]);
965 return NULL;
966 }
967
968 /* ENDPASS may occur only with ACCEPT or DISCARD. */
969
970 if (c == ACLC_ENDPASS &&
971 this->verb != ACL_ACCEPT &&
972 this->verb != ACL_DISCARD)
973 {
974 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
975 conditions[c], verbs[this->verb]);
976 return NULL;
977 }
978
979 cond = store_get(sizeof(acl_condition_block));
980 cond->next = NULL;
981 cond->type = c;
982 cond->u.negated = negated;
983
984 *condp = cond;
985 condp = &(cond->next);
986
987 /* The "set" modifier is different in that its argument is "name=value"
988 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH		 989 gives us a variable name to insert into the data block. The original ACL
990 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
991 extended to 20 of each type, but after that people successfully argued for
641cb756
PH		 992 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
993 After that, we allow alphanumerics and underscores, but the first character
994 after c or m must be a digit or an underscore. This retains backwards
995 compatibility. */
059ec3d9
PH		 996
997 if (c == ACLC_SET)
998 {
47ca6d6c
PH		 999 uschar *endptr;
1000
38a0a95f
PH		 1001 if (Ustrncmp(s, "acl_c", 5) != 0 &&
1002 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 1003 {
38a0a95f
PH		 1004 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1005 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1006 return NULL;
47ca6d6c 1007 }
38a0a95f
PH		 1008
1009 endptr = s + 5;
641cb756
PH		 1010 if (!isdigit(*endptr) && *endptr != '_')
1011 {
1012 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1013 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1014 s);
1015 return NULL;
1016 }
1017
38a0a95f 1018 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 1019 {
38a0a95f
PH		 1020 if (!isalnum(*endptr) && *endptr != '_')
1021 {
1022 *error = string_sprintf("invalid character \"%c\" in variable name "
1023 "in ACL modifier \"set %s\"", *endptr, s);
1024 return NULL;
1025 }
1026 endptr++;
47ca6d6c 1027 }
47ca6d6c 1028
38a0a95f 1029 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 1030 s = endptr;
059ec3d9
PH		 1031 while (isspace(*s)) s++;
1032 }
1033
1034 /* For "set", we are now positioned for the data. For the others, only
1035 "endpass" has no data */
1036
1037 if (c != ACLC_ENDPASS)
1038 {
1039 if (*s++ != '=')
1040 {
1041 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1042 cond_modifiers[c]? US"modifier" : US"condition");
1043 return NULL;
1044 }
1045 while (isspace(*s)) s++;
1046 cond->arg = string_copy(s);
1047 }
1048 }
1049
1050return yield;
1051}
1052
1053
1054
71fafd95
PH		 1055/*************************************************
1056* Set up added header line(s) *
1057*************************************************/
1058
1059/* This function is called by the add_header modifier, and also from acl_warn()
1060to implement the now-deprecated way of adding header lines using "message" on a
1061"warn" verb. The argument is treated as a sequence of header lines which are
1062added to a chain, provided there isn't an identical one already there.
1063
1064Argument: string of header lines
1065Returns: nothing
1066*/
1067
1068static void
55414b25 1069setup_header(const uschar *hstring)
71fafd95 1070{
55414b25 1071const uschar *p, *q;
71fafd95
PH		 1072int hlen = Ustrlen(hstring);
1073
b1b05573
JH		 1074/* Ignore any leading newlines */
1075while (*hstring == '\n') hstring++, hlen--;
71fafd95 1076
b1b05573 1077/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 1078if (hlen <= 0) return;
55414b25
JH		 1079if (hstring[--hlen] != '\n')
1080 q = string_sprintf("%s\n", hstring);
1081else if (hstring[hlen-1] == '\n')
1082 {
1083 uschar * s = string_copy(hstring);
1084 while(s[--hlen] == '\n')
1085 s[hlen+1] = '\0';
1086 q = s;
1087 }
1088else
1089 q = hstring;
71fafd95
PH		 1090
1091/* Loop for multiple header lines, taking care about continuations */
1092
55414b25 1093for (p = q; *p != 0; )
71fafd95 1094 {
55414b25
JH		 1095 const uschar *s;
1096 uschar * hdr;
71fafd95
PH		 1097 int newtype = htype_add_bot;
1098 header_line **hptr = &acl_added_headers;
1099
1100 /* Find next header line within the string */
1101
1102 for (;;)
1103 {
1104 q = Ustrchr(q, '\n');
1105 if (*(++q) != ' ' && *q != '\t') break;
1106 }
1107
1108 /* If the line starts with a colon, interpret the instruction for where to
1109 add it. This temporarily sets up a new type. */
1110
1111 if (*p == ':')
1112 {
1113 if (strncmpic(p, US":after_received:", 16) == 0)
1114 {
1115 newtype = htype_add_rec;
1116 p += 16;
1117 }
1118 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1119 {
1120 newtype = htype_add_rfc;
1121 p += 14;
1122 }
1123 else if (strncmpic(p, US":at_start:", 10) == 0)
1124 {
1125 newtype = htype_add_top;
1126 p += 10;
1127 }
1128 else if (strncmpic(p, US":at_end:", 8) == 0)
1129 {
1130 newtype = htype_add_bot;
1131 p += 8;
1132 }
1133 while (*p == ' ' || *p == '\t') p++;
1134 }
1135
1136 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1137 to the front of it. */
1138
1139 for (s = p; s < q - 1; s++)
1140 {
1141 if (*s == ':' || !isgraph(*s)) break;
1142 }
1143
55414b25
JH		 1144 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1145 hlen = Ustrlen(hdr);
71fafd95
PH		 1146
1147 /* See if this line has already been added */
1148
1149 while (*hptr != NULL)
1150 {
55414b25 1151 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH		 1152 hptr = &((*hptr)->next);
1153 }
1154
1155 /* Add if not previously present */
1156
1157 if (*hptr == NULL)
1158 {
1159 header_line *h = store_get(sizeof(header_line));
55414b25 1160 h->text = hdr;
71fafd95
PH		 1161 h->next = NULL;
1162 h->type = newtype;
1163 h->slen = hlen;
1164 *hptr = h;
1165 hptr = &(h->next);
1166 }
1167
1168 /* Advance for next header line within the string */
1169
1170 p = q;
1171 }
1172}
1173
1174
1175
362145b5
JH		 1176/*************************************************
1177* List the added header lines *
1178*************************************************/
1179uschar *
1180fn_hdrs_added(void)
1181{
1182uschar * ret = NULL;
1183header_line * h = acl_added_headers;
1184uschar * s;
1185uschar * cp;
1186int size = 0;
1187int ptr = 0;
1188
1189if (!h) return NULL;
1190
1191do
1192 {
1193 s = h->text;
1194 while ((cp = Ustrchr(s, '\n')) != NULL)
1195 {
1196 if (cp[1] == '\0') break;
1197
1198 /* contains embedded newline; needs doubling */
1199 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
6d9cfc47 1200 ret = string_cat(ret, &size, &ptr, US"\n", 1);
362145b5
JH		 1201 s = cp+1;
1202 }
1203 /* last bit of header */
1204
1205 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1206 }
6d9cfc47 1207while((h = h->next));
362145b5
JH		 1208
1209ret[ptr-1] = '\0'; /* overwrite last newline */
1210return ret;
1211}
1212
1213
e7568d51
TL		 1214/*************************************************
1215* Set up removed header line(s) *
1216*************************************************/
1217
1218/* This function is called by the remove_header modifier. The argument is
1219treated as a sequence of header names which are added to a colon separated
1220list, provided there isn't an identical one already there.
1221
1222Argument: string of header names
1223Returns: nothing
1224*/
1225
1226static void
55414b25 1227setup_remove_header(const uschar *hnames)
e7568d51
TL		 1228{
1229if (*hnames != 0)
55414b25
JH		 1230 acl_removed_headers = acl_removed_headers
1231 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1232 : string_copy(hnames);
e7568d51
TL		 1233}
1234
1235
71fafd95 1236
059ec3d9
PH		 1237/*************************************************
1238* Handle warnings *
1239*************************************************/
1240
1241/* This function is called when a WARN verb's conditions are true. It adds to
1242the message's headers, and/or writes information to the log. In each case, this
1243only happens once (per message for headers, per connection for log).
1244
71fafd95
PH		 1245** NOTE: The header adding action using the "message" setting is historic, and
1246its use is now deprecated. The new add_header modifier should be used instead.
1247
059ec3d9
PH		 1248Arguments:
1249 where ACL_WHERE_xxxx indicating which ACL this is
1250 user_message message for adding to headers
1251 log_message message for logging, if different
1252
1253Returns: nothing
1254*/
1255
1256static void
1257acl_warn(int where, uschar *user_message, uschar *log_message)
1258{
059ec3d9
PH		 1259if (log_message != NULL && log_message != user_message)
1260 {
1261 uschar *text;
1262 string_item *logged;
1263
1264 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1265 string_printing(log_message));
1266
1267 /* If a sender verification has failed, and the log message is "sender verify
1268 failed", add the failure message. */
1269
1270 if (sender_verified_failed != NULL &&
1271 sender_verified_failed->message != NULL &&
1272 strcmpic(log_message, US"sender verify failed") == 0)
1273 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1274
9c7a242c
PH		 1275 /* Search previously logged warnings. They are kept in malloc
1276 store so they can be freed at the start of a new message. */
059ec3d9
PH		 1277
1278 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1279 if (Ustrcmp(logged->text, text) == 0) break;
1280
1281 if (logged == NULL)
1282 {
1283 int length = Ustrlen(text) + 1;
1284 log_write(0, LOG_MAIN, "%s", text);
1285 logged = store_malloc(sizeof(string_item) + length);
1286 logged->text = (uschar *)logged + sizeof(string_item);
1287 memcpy(logged->text, text, length);
1288 logged->next = acl_warn_logged;
1289 acl_warn_logged = logged;
1290 }
1291 }
1292
1293/* If there's no user message, we are done. */
1294
1295if (user_message == NULL) return;
1296
1297/* If this isn't a message ACL, we can't do anything with a user message.
1298Log an error. */
1299
1300if (where > ACL_WHERE_NOTSMTP)
1301 {
1302 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1303 "found in a non-message (%s) ACL: cannot specify header lines here: "
1304 "message ignored", acl_wherenames[where]);
1305 return;
1306 }
1307
71fafd95
PH		 1308/* The code for setting up header lines is now abstracted into a separate
1309function so that it can be used for the add_header modifier as well. */
059ec3d9 1310
71fafd95 1311setup_header(user_message);
059ec3d9
PH		 1312}
1313
1314
1315
1316/*************************************************
1317* Verify and check reverse DNS *
1318*************************************************/
1319
1320/* Called from acl_verify() below. We look up the host name(s) of the client IP
1321address if this has not yet been done. The host_name_lookup() function checks
1322that one of these names resolves to an address list that contains the client IP
1323address, so we don't actually have to do the check here.
1324
1325Arguments:
1326 user_msgptr pointer for user message
1327 log_msgptr pointer for log message
1328
1329Returns: OK verification condition succeeded
1330 FAIL verification failed
1331 DEFER there was a problem verifying
1332*/
1333
1334static int
1335acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1336{
1337int rc;
1338
1339user_msgptr = user_msgptr; /* stop compiler warning */
1340
1341/* Previous success */
1342
1343if (sender_host_name != NULL) return OK;
1344
1345/* Previous failure */
1346
1347if (host_lookup_failed)
1348 {
1349 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1350 return FAIL;
1351 }
1352
1353/* Need to do a lookup */
1354
1355HDEBUG(D_acl)
1356 debug_printf("looking up host name to force name/address consistency check\n");
1357
1358if ((rc = host_name_lookup()) != OK)
1359 {
1360 *log_msgptr = (rc == DEFER)?
1361 US"host lookup deferred for reverse lookup check"
1362 :
1363 string_sprintf("host lookup failed for reverse lookup check%s",
1364 host_lookup_msg);
1365 return rc; /* DEFER or FAIL */
1366 }
1367
1368host_build_sender_fullhost();
1369return OK;
1370}
1371
1372
1373
e5a9dba6
PH		 1374/*************************************************
1375* Check client IP address matches CSA target *
1376*************************************************/
1377
1378/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1379response for address records belonging to the CSA target hostname. The section
1380is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1381If one of the addresses matches the client's IP address, then the client is
1382authorized by CSA. If there are target IP addresses but none of them match
1383then the client is using an unauthorized IP address. If there are no target IP
1384addresses then the client cannot be using an authorized IP address. (This is
1385an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1386
1387Arguments:
1388 dnsa the DNS answer block
1389 dnss a DNS scan block for us to use
1390 reset option specifing what portion to scan, as described above
1391 target the target hostname to use for matching RR names
1392
1393Returns: CSA_OK successfully authorized
1394 CSA_FAIL_MISMATCH addresses found but none matched
1395 CSA_FAIL_NOADDR no target addresses found
1396*/
1397
1398static int
1399acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1400 uschar *target)
1401{
1402dns_record *rr;
1403dns_address *da;
1404
1405BOOL target_found = FALSE;
1406
1407for (rr = dns_next_rr(dnsa, dnss, reset);
1408 rr != NULL;
1409 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1410 {
1411 /* Check this is an address RR for the target hostname. */
1412
1413 if (rr->type != T_A
1414 #if HAVE_IPV6
1415 && rr->type != T_AAAA
e5a9dba6
PH		 1416 #endif
1417 ) continue;
1418
1419 if (strcmpic(target, rr->name) != 0) continue;
1420
1421 target_found = TRUE;
1422
1423 /* Turn the target address RR into a list of textual IP addresses and scan
1424 the list. There may be more than one if it is an A6 RR. */
1425
1426 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1427 {
1428 /* If the client IP address matches the target IP address, it's good! */
1429
1430 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1431
1432 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1433 }
1434 }
1435
1436/* If we found some target addresses but none of them matched, the client is
1437using an unauthorized IP address, otherwise the target has no authorized IP
1438addresses. */
1439
1440if (target_found) return CSA_FAIL_MISMATCH;
1441else return CSA_FAIL_NOADDR;
1442}
1443
1444
1445
1446/*************************************************
1447* Verify Client SMTP Authorization *
1448*************************************************/
1449
1450/* Called from acl_verify() below. This routine calls dns_lookup_special()
1451to find the CSA SRV record corresponding to the domain argument, or
1452$sender_helo_name if no argument is provided. It then checks that the
1453client is authorized, and that its IP address corresponds to the SRV
1454target's address by calling acl_verify_csa_address() above. The address
1455should have been returned in the DNS response's ADDITIONAL section, but if
1456not we perform another DNS lookup to get it.
1457
1458Arguments:
1459 domain pointer to optional parameter following verify = csa
1460
1461Returns: CSA_UNKNOWN no valid CSA record found
1462 CSA_OK successfully authorized
1463 CSA_FAIL_* client is definitely not authorized
1464 CSA_DEFER_* there was a DNS problem
1465*/
1466
1467static int
55414b25 1468acl_verify_csa(const uschar *domain)
e5a9dba6
PH		 1469{
1470tree_node *t;
55414b25
JH		 1471const uschar *found;
1472uschar *p;
e5a9dba6
PH		 1473int priority, weight, port;
1474dns_answer dnsa;
1475dns_scan dnss;
1476dns_record *rr;
1477int rc, type;
1478uschar target[256];
1479
1480/* Work out the domain we are using for the CSA lookup. The default is the
1481client's HELO domain. If the client has not said HELO, use its IP address
1482instead. If it's a local client (exim -bs), CSA isn't applicable. */
1483
1484while (isspace(*domain) && *domain != '\0') ++domain;
1485if (*domain == '\0') domain = sender_helo_name;
1486if (domain == NULL) domain = sender_host_address;
1487if (sender_host_address == NULL) return CSA_UNKNOWN;
1488
1489/* If we have an address literal, strip off the framing ready for turning it
1490into a domain. The framing consists of matched square brackets possibly
1491containing a keyword and a colon before the actual IP address. */
1492
1493if (domain[0] == '[')
1494 {
55414b25 1495 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH		 1496 if (start == NULL) start = domain;
1497 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1498 }
1499
1500/* Turn domains that look like bare IP addresses into domains in the reverse
1501DNS. This code also deals with address literals and $sender_host_address. It's
1502not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1503address literals, but it's probably the most friendly thing to do. This is an
1504extension to CSA, so we allow it to be turned off for proper conformance. */
1505
7e66e54d 1506if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH		 1507 {
1508 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1509 dns_build_reverse(domain, target);
1510 domain = target;
1511 }
1512
1513/* Find out if we've already done the CSA check for this domain. If we have,
1514return the same result again. Otherwise build a new cached result structure
1515for this domain. The name is filled in now, and the value is filled in when
1516we return from this function. */
1517
1518t = tree_search(csa_cache, domain);
1519if (t != NULL) return t->data.val;
1520
1521t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1522Ustrcpy(t->name, domain);
1523(void)tree_insertnode(&csa_cache, t);
1524
1525/* Now we are ready to do the actual DNS lookup(s). */
1526
28e6ef29 1527found = domain;
e5a9dba6
PH		 1528switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1529 {
1530 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1531
1532 default:
1533 return t->data.val = CSA_DEFER_SRV;
1534
1535 /* If we found nothing, the client's authorization is unknown. */
1536
1537 case DNS_NOMATCH:
1538 case DNS_NODATA:
1539 return t->data.val = CSA_UNKNOWN;
1540
1541 /* We got something! Go on to look at the reply in more detail. */
1542
1543 case DNS_SUCCEED:
1544 break;
1545 }
1546
1547/* Scan the reply for well-formed CSA SRV records. */
1548
1549for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1550 rr != NULL;
1551 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1552 {
1553 if (rr->type != T_SRV) continue;
1554
1555 /* Extract the numerical SRV fields (p is incremented) */
1556
1557 p = rr->data;
1558 GETSHORT(priority, p);
1559 GETSHORT(weight, p);
1560 GETSHORT(port, p);
1561
1562 DEBUG(D_acl)
1563 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1564
1565 /* Check the CSA version number */
1566
1567 if (priority != 1) continue;
1568
1569 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1570 found by dns_special_lookup() is a parent of the one we asked for), we check
1571 the subdomain assertions in the port field. At the moment there's only one
1572 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1573 SRV records of their own. */
1574
1dc92d5a 1575 if (Ustrcmp(found, domain) != 0)
e5a9dba6
PH		 1576 {
1577 if (port & 1)
1578 return t->data.val = CSA_FAIL_EXPLICIT;
1579 else
1580 return t->data.val = CSA_UNKNOWN;
1581 }
1582
1583 /* This CSA SRV record refers directly to our domain, so we check the value
1584 in the weight field to work out the domain's authorization. 0 and 1 are
1585 unauthorized; 3 means the client is authorized but we can't check the IP
1586 address in order to authenticate it, so we treat it as unknown; values
1587 greater than 3 are undefined. */
1588
1589 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1590
1591 if (weight > 2) continue;
1592
1593 /* Weight == 2, which means the domain is authorized. We must check that the
1594 client's IP address is listed as one of the SRV target addresses. Save the
1595 target hostname then break to scan the additional data for its addresses. */
1596
1597 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1598 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1599
1600 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1601
1602 break;
1603 }
1604
1605/* If we didn't break the loop then no appropriate records were found. */
1606
1607if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1608
1609/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1610A target of "." indicates there are no valid addresses, so the client cannot
1611be authorized. (This is an odd configuration because weight=2 target=. is
1612equivalent to weight=1, but we check for it in order to keep load off the
1613root name servers.) Note that dn_expand() turns "." into "". */
1614
1615if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1616
1617/* Scan the additional section of the CSA SRV reply for addresses belonging
1618to the target. If the name server didn't return any additional data (e.g.
1619because it does not fully support SRV records), we need to do another lookup
1620to obtain the target addresses; otherwise we have a definitive result. */
1621
1622rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1623if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1624
1625/* The DNS lookup type corresponds to the IP version used by the client. */
1626
1627#if HAVE_IPV6
1628if (Ustrchr(sender_host_address, ':') != NULL)
1629 type = T_AAAA;
1630else
1631#endif /* HAVE_IPV6 */
1632 type = T_A;
1633
1634
4e0983dc 1635lookup_dnssec_authenticated = NULL;
e5a9dba6
PH		 1636switch (dns_lookup(&dnsa, target, type, NULL))
1637 {
1638 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1639
1640 default:
cc00f4af 1641 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH		 1642
1643 /* If the query succeeded, scan the addresses and return the result. */
1644
1645 case DNS_SUCCEED:
cc00f4af
JH		 1646 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1647 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1648 /* else fall through */
e5a9dba6
PH		 1649
1650 /* If the target has no IP addresses, the client cannot have an authorized
1651 IP address. However, if the target site uses A6 records (not AAAA records)
1652 we have to do yet another lookup in order to check them. */
1653
1654 case DNS_NOMATCH:
1655 case DNS_NODATA:
cc00f4af 1656 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH		 1657 }
1658}
1659
1660
1661
059ec3d9
PH		 1662/*************************************************
1663* Handle verification (address & other) *
1664*************************************************/
1665
89583014 1666enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM		 1667 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1668 VERIFY_HDR_NAMES_ASCII
89583014
JH		 1669 };
1670typedef struct {
1671 uschar * name;
1672 int value;
1673 unsigned where_allowed; /* bitmap */
1674 BOOL no_options; /* Never has /option(s) following */
1675 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1676 } verify_type_t;
1677static verify_type_t verify_type_list[] = {
7e8360e6 1678 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH		 1679 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1680 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1681 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1682 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1683 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1684 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1685 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1686 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1687 FALSE, 6 },
770747fd
MFM		 1688 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1689 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH		 1690 };
1691
1692
1693enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1694 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1695 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1696 CALLOUT_TIME
1697 };
1698typedef struct {
1699 uschar * name;
1700 int value;
1701 int flag;
1702 BOOL has_option; /* Has =option(s) following */
1703 BOOL timeval; /* Has a time value */
1704 } callout_opt_t;
1705static callout_opt_t callout_opt_list[] = {
1706 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1707 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1708 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1709 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1710 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1711 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1712 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1713 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1714 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1715 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1716 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1717 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1718 };
1719
1720
1721
059ec3d9
PH		 1722/* This function implements the "verify" condition. It is called when
1723encountered in any ACL, because some tests are almost always permitted. Some
1724just don't make sense, and always fail (for example, an attempt to test a host
1725lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1726
1727Arguments:
1728 where where called from
1729 addr the recipient address that the ACL is handling, or NULL
1730 arg the argument of "verify"
1731 user_msgptr pointer for user message
1732 log_msgptr pointer for log message
1733 basic_errno where to put verify errno
1734
1735Returns: OK verification condition succeeded
1736 FAIL verification failed
1737 DEFER there was a problem verifying
1738 ERROR syntax error
1739*/
1740
1741static int
55414b25 1742acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH		 1743 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1744{
1745int sep = '/';
1746int callout = -1;
1747int callout_overall = -1;
4deaf07d 1748int callout_connect = -1;
059ec3d9
PH		 1749int verify_options = 0;
1750int rc;
1751BOOL verify_header_sender = FALSE;
1752BOOL defer_ok = FALSE;
1753BOOL callout_defer_ok = FALSE;
1754BOOL no_details = FALSE;
eafd343b 1755BOOL success_on_redirect = FALSE;
059ec3d9
PH		 1756address_item *sender_vaddr = NULL;
1757uschar *verify_sender_address = NULL;
1758uschar *pm_mailfrom = NULL;
1759uschar *se_mailfrom = NULL;
596875b3
PH		 1760
1761/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1762an error if options are given for items that don't expect them.
596875b3
PH		 1763*/
1764
1765uschar *slash = Ustrchr(arg, '/');
55414b25 1766const uschar *list = arg;
059ec3d9 1767uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1768verify_type_t * vp;
059ec3d9
PH		 1769
1770if (ss == NULL) goto BAD_VERIFY;
1771
1772/* Handle name/address consistency verification in a separate function. */
1773
89583014
JH		 1774for (vp= verify_type_list;
1775 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1776 vp++
1777 )
1778 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1779 : strcmpic (ss, vp->name) == 0)
1780 break;
1781if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1782 goto BAD_VERIFY;
1783
1784if (vp->no_options && slash != NULL)
059ec3d9 1785 {
89583014
JH		 1786 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1787 "(this verify item has no options)", arg);
1788 return ERROR;
059ec3d9 1789 }
89583014 1790if (!(vp->where_allowed & (1<<where)))
059ec3d9 1791 {
89583014
JH		 1792 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1793 return ERROR;
059ec3d9 1794 }
89583014 1795switch(vp->value)
596875b3 1796 {
89583014
JH		 1797 case VERIFY_REV_HOST_LKUP:
1798 if (sender_host_address == NULL) return OK;
7e8360e6
JH		 1799 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1800 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1801 if (strcmpic(ss, US"defer_ok") == 0)
1802 return OK;
1803 return rc;
059ec3d9 1804
89583014
JH		 1805 case VERIFY_CERT:
1806 /* TLS certificate verification is done at STARTTLS time; here we just
1807 test whether it was successful or not. (This is for optional verification; for
1808 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1809
3703d818
JH		 1810 if (tls_in.certificate_verified) return OK;
1811 *user_msgptr = US"no verified certificate";
1812 return FAIL;
e5a9dba6 1813
89583014
JH		 1814 case VERIFY_HELO:
1815 /* We can test the result of optional HELO verification that might have
1816 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1817
3703d818
JH		 1818 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1819 return helo_verified? OK : FAIL;
059ec3d9 1820
89583014
JH		 1821 case VERIFY_CSA:
1822 /* Do Client SMTP Authorization checks in a separate function, and turn the
1823 result code into user-friendly strings. */
1c41c9cc 1824
3703d818
JH		 1825 rc = acl_verify_csa(list);
1826 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1827 csa_reason_string[rc]);
3703d818
JH		 1828 csa_status = csa_status_string[rc];
1829 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1830 return csa_return_code[rc];
89583014
JH		 1831
1832 case VERIFY_HDR_SYNTAX:
1833 /* Check that all relevant header lines have the correct syntax. If there is
1834 a syntax error, we return details of the error to the sender if configured to
1835 send out full details. (But a "message" setting on the ACL can override, as
1836 always). */
1837
1838 rc = verify_check_headers(log_msgptr);
3703d818
JH		 1839 if (rc != OK && *log_msgptr)
1840 if (smtp_return_error_details)
1841 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1842 else
1843 acl_verify_message = *log_msgptr;
89583014 1844 return rc;
059ec3d9 1845
770747fd
MFM		 1846 case VERIFY_HDR_NAMES_ASCII:
1847 /* Check that all header names are true 7 bit strings
1848 See RFC 5322, 2.2. and RFC 6532, 3. */
1849
1850 rc = verify_check_header_names_ascii(log_msgptr);
1851 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1852 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1853 return rc;
1854
89583014
JH		 1855 case VERIFY_NOT_BLIND:
1856 /* Check that no recipient of this message is "blind", that is, every envelope
1857 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1858
89583014
JH		 1859 rc = verify_check_notblind();
1860 if (rc != OK)
1861 {
1862 *log_msgptr = string_sprintf("bcc recipient detected");
1863 if (smtp_return_error_details)
1864 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1865 }
1866 return rc;
059ec3d9 1867
89583014
JH		 1868 /* The remaining verification tests check recipient and sender addresses,
1869 either from the envelope or from the header. There are a number of
1870 slash-separated options that are common to all of them. */
059ec3d9 1871
89583014
JH		 1872 case VERIFY_HDR_SNDR:
1873 verify_header_sender = TRUE;
1874 break;
059ec3d9 1875
89583014
JH		 1876 case VERIFY_SNDR:
1877 /* In the case of a sender, this can optionally be followed by an address to use
1878 in place of the actual sender (rare special-case requirement). */
059ec3d9 1879 {
89583014
JH		 1880 uschar *s = ss + 6;
1881 if (*s == 0)
1882 verify_sender_address = sender_address;
1883 else
1884 {
1885 while (isspace(*s)) s++;
1886 if (*s++ != '=') goto BAD_VERIFY;
1887 while (isspace(*s)) s++;
1888 verify_sender_address = string_copy(s);
1889 }
059ec3d9 1890 }
89583014
JH		 1891 break;
1892
1893 case VERIFY_RCPT:
1894 break;
059ec3d9
PH		 1895 }
1896
89583014
JH		 1897
1898
596875b3
PH		 1899/* Remaining items are optional; they apply to sender and recipient
1900verification, including "header sender" verification. */
059ec3d9
PH		 1901
1902while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1903 != NULL)
1904 {
1905 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1906 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1907 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH		 1908
1909 /* These two old options are left for backwards compatibility */
1910
1911 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1912 {
1913 callout_defer_ok = TRUE;
1914 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1915 }
1916
1917 else if (strcmpic(ss, US"check_postmaster") == 0)
1918 {
1919 pm_mailfrom = US"";
1920 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1921 }
1922
1923 /* The callout option has a number of sub-options, comma separated */
1924
1925 else if (strncmpic(ss, US"callout", 7) == 0)
1926 {
1927 callout = CALLOUT_TIMEOUT_DEFAULT;
1928 ss += 7;
1929 if (*ss != 0)
1930 {
1931 while (isspace(*ss)) ss++;
1932 if (*ss++ == '=')
1933 {
55414b25 1934 const uschar * sublist = ss;
059ec3d9
PH		 1935 int optsep = ',';
1936 uschar *opt;
1937 uschar buffer[256];
55414b25 1938 while (isspace(*sublist)) sublist++;
8e669ac1 1939
55414b25 1940 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
059ec3d9
PH		 1941 != NULL)
1942 {
89583014 1943 callout_opt_t * op;
438257ba 1944 double period = 1.0F;
059ec3d9 1945
89583014 1946 for (op= callout_opt_list; op->name; op++)
438257ba 1947 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1948 break;
059ec3d9 1949
89583014
JH		 1950 verify_options |= op->flag;
1951 if (op->has_option)
1952 {
438257ba 1953 opt += Ustrlen(op->name);
4deaf07d
PH		 1954 while (isspace(*opt)) opt++;
1955 if (*opt++ != '=')
1956 {
1957 *log_msgptr = string_sprintf("'=' expected after "
89583014 1958 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH		 1959 return ERROR;
1960 }
1961 while (isspace(*opt)) opt++;
89583014
JH		 1962 }
1963 if (op->timeval)
1964 {
1965 period = readconf_readtime(opt, 0, FALSE);
1966 if (period < 0)
4deaf07d
PH		 1967 {
1968 *log_msgptr = string_sprintf("bad time value in ACL condition "
1969 "\"verify %s\"", arg);
1970 return ERROR;
1971 }
89583014
JH		 1972 }
1973
1974 switch(op->value)
1975 {
1976 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1977 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1978 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1979 case CALLOUT_MAILFROM:
1980 if (!verify_header_sender)
1981 {
1982 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1983 "callout option only for verify=header_sender (detected in ACL "
1984 "condition \"%s\")", arg);
1985 return ERROR;
1986 }
1987 se_mailfrom = string_copy(opt);
1988 break;
1989 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1990 case CALLOUT_MAXWAIT: callout_overall = period; break;
1991 case CALLOUT_CONNECT: callout_connect = period; break;
1992 case CALLOUT_TIME: callout = period; break;
1993 }
059ec3d9
PH		 1994 }
1995 }
1996 else
1997 {
1998 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1999 "ACL condition \"%s\"", arg);
2000 return ERROR;
2001 }
2002 }
2003 }
2004
2005 /* Option not recognized */
2006
2007 else
2008 {
2009 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2010 "condition \"verify %s\"", ss, arg);
2011 return ERROR;
2012 }
2013 }
2014
2015if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2016 (vopt_callout_recipsender|vopt_callout_recippmaster))
2017 {
2018 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2019 "for a recipient callout";
2020 return ERROR;
2021 }
2022
2023/* Handle sender-in-header verification. Default the user message to the log
2024message if giving out verification details. */
2025
2026if (verify_header_sender)
2027 {
8e669ac1 2028 int verrno;
059ec3d9 2029 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b
PH		 2030 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2031 &verrno);
2032 if (rc != OK)
8e669ac1 2033 {
fe5b5d0b
PH		 2034 *basic_errno = verrno;
2035 if (smtp_return_error_details)
2036 {
2037 if (*user_msgptr == NULL && *log_msgptr != NULL)
2038 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2039 if (rc == DEFER) acl_temp_details = TRUE;
2040 }
8e669ac1 2041 }
059ec3d9
PH		 2042 }
2043
2044/* Handle a sender address. The default is to verify *the* sender address, but
2045optionally a different address can be given, for special requirements. If the
2046address is empty, we are dealing with a bounce message that has no sender, so
2047we cannot do any checking. If the real sender address gets rewritten during
2048verification (e.g. DNS widening), set the flag to stop it being rewritten again
2049during message reception.
2050
2051A list of verified "sender" addresses is kept to try to avoid doing to much
2052work repetitively when there are multiple recipients in a message and they all
2053require sender verification. However, when callouts are involved, it gets too
2054complicated because different recipients may require different callout options.
2055Therefore, we always do a full sender verify when any kind of callout is
2056specified. Caching elsewhere, for instance in the DNS resolver and in the
2057callout handling, should ensure that this is not terribly inefficient. */
2058
2059else if (verify_sender_address != NULL)
2060 {
2061 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2062 != 0)
2063 {
2064 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2065 "sender verify callout";
2066 return ERROR;
2067 }
2068
2069 sender_vaddr = verify_checked_sender(verify_sender_address);
2070 if (sender_vaddr != NULL && /* Previously checked */
2071 callout <= 0) /* No callout needed this time */
2072 {
2073 /* If the "routed" flag is set, it means that routing worked before, so
2074 this check can give OK (the saved return code value, if set, belongs to a
2075 callout that was done previously). If the "routed" flag is not set, routing
2076 must have failed, so we use the saved return code. */
2077
2078 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2079 {
2080 rc = sender_vaddr->special_action;
2081 *basic_errno = sender_vaddr->basic_errno;
2082 }
2083 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2084 }
2085
2086 /* Do a new verification, and cache the result. The cache is used to avoid
2087 verifying the sender multiple times for multiple RCPTs when callouts are not
2088 specified (see comments above).
2089
2090 The cache is also used on failure to give details in response to the first
2091 RCPT that gets bounced for this reason. However, this can be suppressed by
2092 the no_details option, which sets the flag that says "this detail has already
2093 been sent". The cache normally contains just one address, but there may be
2094 more in esoteric circumstances. */
2095
2096 else
2097 {
2098 BOOL routed = TRUE;
2a3eea10 2099 uschar *save_address_data = deliver_address_data;
8e669ac1 2100
059ec3d9 2101 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 2102#ifdef SUPPORT_I18N
3c8b3577
JH		 2103 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2104 {
2105 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2106 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2107 }
f358d5e0 2108#endif
059ec3d9
PH		 2109 if (no_details) setflag(sender_vaddr, af_sverify_told);
2110 if (verify_sender_address[0] != 0)
2111 {
2112 /* If this is the real sender address, save the unrewritten version
2113 for use later in receive. Otherwise, set a flag so that rewriting the
2114 sender in verify_address() does not update sender_address. */
2115
2116 if (verify_sender_address == sender_address)
2117 sender_address_unrewritten = sender_address;
2118 else
2119 verify_options |= vopt_fake_sender;
2120
eafd343b
TK		 2121 if (success_on_redirect)
2122 verify_options |= vopt_success_on_redirect;
2123
059ec3d9
PH		 2124 /* The recipient, qualify, and expn options are never set in
2125 verify_options. */
2126
2127 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 2128 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9
PH		 2129
2130 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2131
2132 if (rc == OK)
2133 {
2134 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2135 {
2136 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2137 verify_sender_address, sender_vaddr->address);
2138 }
2139 else
2140 {
2141 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2142 verify_sender_address);
2143 }
2144 }
2145 else *basic_errno = sender_vaddr->basic_errno;
2146 }
2147 else rc = OK; /* Null sender */
2148
2149 /* Cache the result code */
2150
2151 if (routed) setflag(sender_vaddr, af_verify_routed);
2152 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2153 sender_vaddr->special_action = rc;
2154 sender_vaddr->next = sender_verified_list;
2155 sender_verified_list = sender_vaddr;
8e669ac1
PH		 2156
2157 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2158 the sender verification. */
8e669ac1 2159
2a3eea10 2160 deliver_address_data = save_address_data;
059ec3d9 2161 }
8e669ac1 2162
2a3eea10
PH		 2163 /* Put the sender address_data value into $sender_address_data */
2164
d43cbe25 2165 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH		 2166 }
2167
2168/* A recipient address just gets a straightforward verify; again we must handle
2169the DEFER overrides. */
2170
2171else
2172 {
2173 address_item addr2;
2174
eafd343b
TK		 2175 if (success_on_redirect)
2176 verify_options |= vopt_success_on_redirect;
2177
059ec3d9
PH		 2178 /* We must use a copy of the address for verification, because it might
2179 get rewritten. */
2180
2181 addr2 = *addr;
2182 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2183 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
059ec3d9 2184 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
8e669ac1 2185
42855d71 2186 *basic_errno = addr2.basic_errno;
059ec3d9 2187 *log_msgptr = addr2.message;
8e669ac1 2188 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2189 addr2.user_message : addr2.message;
42855d71
PH		 2190
2191 /* Allow details for temporary error if the address is so flagged. */
2192 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH		 2193
2194 /* Make $address_data visible */
d43cbe25 2195 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH		 2196 }
2197
2198/* We have a result from the relevant test. Handle defer overrides first. */
2199
2200if (rc == DEFER && (defer_ok ||
2201 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2202 {
2203 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2204 defer_ok? "defer_ok" : "callout_defer_ok");
2205 rc = OK;
2206 }
2207
2208/* If we've failed a sender, set up a recipient message, and point
2209sender_verified_failed to the address item that actually failed. */
2210
2211if (rc != OK && verify_sender_address != NULL)
2212 {
2213 if (rc != DEFER)
059ec3d9 2214 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2215 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2216 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH		 2217 else
2218 {
2219 *log_msgptr = US"Could not complete sender verify callout";
2220 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2221 *log_msgptr;
2222 }
2223
2224 sender_verified_failed = sender_vaddr;
2225 }
2226
2227/* Verifying an address messes up the values of $domain and $local_part,
2228so reset them before returning if this is a RCPT ACL. */
2229
2230if (addr != NULL)
2231 {
2232 deliver_domain = addr->domain;
2233 deliver_localpart = addr->local_part;
2234 }
2235return rc;
2236
2237/* Syntax errors in the verify argument come here. */
2238
2239BAD_VERIFY:
2240*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM		 2241 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2242 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH		 2243 "\"verify %s\"", arg);
2244return ERROR;
2245}
2246
2247
2248
2249
2250/*************************************************
2251* Check argument for control= modifier *
2252*************************************************/
2253
2254/* Called from acl_check_condition() below
2255
2256Arguments:
2257 arg the argument string for control=
2258 pptr set to point to the terminating character
2259 where which ACL we are in
2260 log_msgptr for error messages
2261
2262Returns: CONTROL_xxx value
2263*/
2264
2265static int
55414b25 2266decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9
PH		 2267{
2268int len;
2269control_def *d;
2270
2271for (d = controls_list;
2272 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2273 d++)
2274 {
2275 len = Ustrlen(d->name);
2276 if (Ustrncmp(d->name, arg, len) == 0) break;
2277 }
2278
2279if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2280 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2281 {
2282 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2283 return CONTROL_ERROR;
2284 }
2285
059ec3d9
PH		 2286*pptr = arg + len;
2287return d->value;
2288}
2289
2290
2291
c99ce5c9
TF		 2292
2293/*************************************************
2294* Return a ratelimit error *
2295*************************************************/
2296
2297/* Called from acl_ratelimit() below
2298
2299Arguments:
2300 log_msgptr for error messages
2301 format format string
2302 ... supplementary arguments
2303 ss ratelimit option name
2304 where ACL_WHERE_xxxx indicating which ACL this is
2305
2306Returns: ERROR
2307*/
2308
2309static int
2310ratelimit_error(uschar **log_msgptr, const char *format, ...)
2311{
2312va_list ap;
2313uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2314va_start(ap, format);
2315if (!string_vformat(buffer, sizeof(buffer), format, ap))
2316 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2317 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF		 2318va_end(ap);
2319*log_msgptr = string_sprintf(
2320 "error in arguments to \"ratelimit\" condition: %s", buffer);
2321return ERROR;
2322}
2323
2324
2325
2326
870f6ba8
TF		 2327/*************************************************
2328* Handle rate limiting *
2329*************************************************/
2330
2331/* Called by acl_check_condition() below to calculate the result
2332of the ACL ratelimit condition.
2333
2334Note that the return value might be slightly unexpected: if the
2335sender's rate is above the limit then the result is OK. This is
2336similar to the dnslists condition, and is so that you can write
2337ACL clauses like: defer ratelimit = 15 / 1h
2338
2339Arguments:
2340 arg the option string for ratelimit=
90fc3069 2341 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF		 2342 log_msgptr for error messages
2343
2344Returns: OK - Sender's rate is above limit
2345 FAIL - Sender's rate is below limit
2346 DEFER - Problem opening ratelimit database
2347 ERROR - Syntax error in options.
2348*/
2349
2350static int
55414b25 2351acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2352{
c99ce5c9 2353double limit, period, count;
8f240103
PH		 2354uschar *ss;
2355uschar *key = NULL;
c99ce5c9 2356uschar *unique = NULL;
870f6ba8 2357int sep = '/';
c99ce5c9
TF		 2358BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2359BOOL noupdate = FALSE, badacl = FALSE;
2360int mode = RATE_PER_WHAT;
870f6ba8
TF		 2361int old_pool, rc;
2362tree_node **anchor, *t;
2363open_db dbblock, *dbm;
c99ce5c9 2364int dbdb_size;
870f6ba8 2365dbdata_ratelimit *dbd;
c99ce5c9 2366dbdata_ratelimit_unique *dbdb;
870f6ba8
TF		 2367struct timeval tv;
2368
2369/* Parse the first two options and record their values in expansion
2370variables. These variables allow the configuration to have informative
2371error messages based on rate limits obtained from a table lookup. */
2372
c99ce5c9 2373/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF		 2374size, which must be greater than or equal to zero. Zero is useful for
2375rate measurement as opposed to rate limiting. */
2376
2377sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2378if (sender_rate_limit == NULL)
288644dd 2379 {
870f6ba8 2380 limit = -1.0;
288644dd
JH		 2381 ss = NULL; /* compiler quietening */
2382 }
870f6ba8
TF		 2383else
2384 {
2385 limit = Ustrtod(sender_rate_limit, &ss);
2386 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2387 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2388 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2389 }
c99ce5c9
TF		 2390if (limit < 0.0 || *ss != '\0')
2391 return ratelimit_error(log_msgptr,
2392 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2393
c99ce5c9 2394/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF		 2395constant. This must be strictly greater than zero, because zero leads to
2396run-time division errors. */
2397
2398sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2399if (sender_rate_period == NULL) period = -1.0;
2400else period = readconf_readtime(sender_rate_period, 0, FALSE);
2401if (period <= 0.0)
c99ce5c9
TF		 2402 return ratelimit_error(log_msgptr,
2403 "\"%s\" is not a time value", sender_rate_period);
2404
2405/* By default we are counting one of something, but the per_rcpt,
2406per_byte, and count options can change this. */
2407
2408count = 1.0;
870f6ba8 2409
c99ce5c9 2410/* Parse the other options. */
870f6ba8
TF		 2411
2412while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2413 != NULL)
2414 {
2415 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2416 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2417 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF		 2418 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2419 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2420 else if (strcmpic(ss, US"per_conn") == 0)
2421 {
2422 RATE_SET(mode, PER_CONN);
2423 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2424 badacl = TRUE;
2425 }
2426 else if (strcmpic(ss, US"per_mail") == 0)
2427 {
2428 RATE_SET(mode, PER_MAIL);
2429 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2430 }
2431 else if (strcmpic(ss, US"per_rcpt") == 0)
2432 {
2433 /* If we are running in the RCPT ACL, then we'll count the recipients
2434 one by one, but if we are running when we have accumulated the whole
2435 list then we'll add them all in one batch. */
2436 if (where == ACL_WHERE_RCPT)
2437 RATE_SET(mode, PER_RCPT);
2438 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2439 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2440 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2441 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2442 }
2443 else if (strcmpic(ss, US"per_byte") == 0)
2444 {
2445 /* If we have not yet received the message data and there was no SIZE
2446 declaration on the MAIL comand, then it's safe to just use a value of
2447 zero and let the recorded rate decay as if nothing happened. */
2448 RATE_SET(mode, PER_MAIL);
2449 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2450 else count = message_size < 0 ? 0.0 : (double)message_size;
2451 }
2452 else if (strcmpic(ss, US"per_addr") == 0)
2453 {
2454 RATE_SET(mode, PER_RCPT);
438257ba 2455 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF		 2456 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2457 }
2458 else if (strncmpic(ss, US"count=", 6) == 0)
2459 {
2460 uschar *e;
2461 count = Ustrtod(ss+6, &e);
2462 if (count < 0.0 || *e != '\0')
2463 return ratelimit_error(log_msgptr,
2464 "\"%s\" is not a positive number", ss);
2465 }
2466 else if (strncmpic(ss, US"unique=", 7) == 0)
2467 unique = string_copy(ss + 7);
2468 else if (key == NULL)
2469 key = string_copy(ss);
2470 else
2471 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF		 2472 }
2473
c99ce5c9
TF		 2474/* Sanity check. When the badacl flag is set the update mode must either
2475be readonly (which is the default if it is omitted) or, for backwards
2476compatibility, a combination of noupdate and strict or leaky. */
2477
2478if (mode == RATE_PER_CLASH)
2479 return ratelimit_error(log_msgptr, "conflicting per_* options");
2480if (leaky + strict + readonly > 1)
2481 return ratelimit_error(log_msgptr, "conflicting update modes");
2482if (badacl && (leaky || strict) && !noupdate)
2483 return ratelimit_error(log_msgptr,
2484 "\"%s\" must not have /leaky or /strict option in %s ACL",
2485 ratelimit_option_string[mode], acl_wherenames[where]);
2486
2487/* Set the default values of any unset options. In readonly mode we
2488perform the rate computation without any increment so that its value
2489decays to eventually allow over-limit senders through. */
2490
2491if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2492if (badacl) readonly = TRUE;
2493if (readonly) count = 0.0;
2494if (!strict && !readonly) leaky = TRUE;
2495if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2496
8f240103
PH		 2497/* Create the lookup key. If there is no explicit key, use sender_host_address.
2498If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2499omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2500are added to the key because they alter the meaning of the stored data. */
2501
2502if (key == NULL)
2503 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2504
c99ce5c9 2505key = string_sprintf("%s/%s/%s%s",
8f240103 2506 sender_rate_period,
c99ce5c9
TF		 2507 ratelimit_option_string[mode],
2508 unique == NULL ? "" : "unique/",
8f240103 2509 key);
870f6ba8 2510
c99ce5c9
TF		 2511HDEBUG(D_acl)
2512 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2513
8f240103
PH		 2514/* See if we have already computed the rate by looking in the relevant tree.
2515For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF		 2516pool so that they survive across resets. In readonly mode we only remember the
2517result for the rest of this command in case a later command changes it. After
2518this bit of logic the code is independent of the per_* mode. */
870f6ba8 2519
870f6ba8
TF		 2520old_pool = store_pool;
2521
c99ce5c9
TF		 2522if (readonly)
2523 anchor = &ratelimiters_cmd;
2524else switch(mode) {
2525case RATE_PER_CONN:
870f6ba8
TF		 2526 anchor = &ratelimiters_conn;
2527 store_pool = POOL_PERM;
c99ce5c9
TF		 2528 break;
2529case RATE_PER_BYTE:
2530case RATE_PER_MAIL:
2531case RATE_PER_ALLRCPTS:
870f6ba8 2532 anchor = &ratelimiters_mail;
c99ce5c9
TF		 2533 break;
2534case RATE_PER_ADDR:
2535case RATE_PER_CMD:
2536case RATE_PER_RCPT:
fe0dab11 2537 anchor = &ratelimiters_cmd;
c99ce5c9
TF		 2538 break;
2539default:
3399bb60 2540 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF		 2541 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2542 "internal ACL error: unknown ratelimit mode %d", mode);
2543 break;
2544}
870f6ba8 2545
c99ce5c9
TF		 2546t = tree_search(*anchor, key);
2547if (t != NULL)
870f6ba8
TF		 2548 {
2549 dbd = t->data.ptr;
2550 /* The following few lines duplicate some of the code below. */
8f240103 2551 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2552 store_pool = old_pool;
2553 sender_rate = string_sprintf("%.1f", dbd->rate);
2554 HDEBUG(D_acl)
2555 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2556 return rc;
2557 }
2558
c99ce5c9
TF		 2559/* We aren't using a pre-computed rate, so get a previously recorded rate
2560from the database, which will be updated and written back if required. */
870f6ba8
TF		 2561
2562dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2563if (dbm == NULL)
2564 {
2565 store_pool = old_pool;
2566 sender_rate = NULL;
2567 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2568 *log_msgptr = US"ratelimit database not available";
2569 return DEFER;
2570 }
c99ce5c9
TF		 2571dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2572dbd = NULL;
870f6ba8
TF		 2573
2574gettimeofday(&tv, NULL);
2575
c99ce5c9
TF		 2576if (dbdb != NULL)
2577 {
2578 /* Locate the basic ratelimit block inside the DB data. */
2579 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2580 dbd = &dbdb->dbd;
2581
2582 /* Forget the old Bloom filter if it is too old, so that we count each
2583 repeating event once per period. We don't simply clear and re-use the old
2584 filter because we want its size to change if the limit changes. Note that
2585 we keep the dbd pointer for copying the rate into the new data block. */
2586
2587 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2588 {
2589 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2590 dbdb = NULL;
2591 }
2592
2593 /* Sanity check. */
2594
2595 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2596 {
2597 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2598 dbdb = NULL;
2599 }
2600 }
2601
2602/* Allocate a new data block if the database lookup failed
2603or the Bloom filter passed its age limit. */
2604
2605if (dbdb == NULL)
2606 {
2607 if (unique == NULL)
2608 {
2609 /* No Bloom filter. This basic ratelimit block is initialized below. */
2610 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2611 dbdb_size = sizeof(*dbd);
2612 dbdb = store_get(dbdb_size);
2613 }
2614 else
2615 {
2616 int extra;
2617 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2618
2619 /* See the long comment below for an explanation of the magic number 2.
2620 The filter has a minimum size in case the rate limit is very small;
2621 this is determined by the definition of dbdata_ratelimit_unique. */
2622
2623 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2624 if (extra < 0) extra = 0;
2625 dbdb_size = sizeof(*dbdb) + extra;
2626 dbdb = store_get(dbdb_size);
2627 dbdb->bloom_epoch = tv.tv_sec;
2628 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2629 memset(dbdb->bloom, 0, dbdb->bloom_size);
2630
2631 /* Preserve any basic ratelimit data (which is our longer-term memory)
2632 by copying it from the discarded block. */
2633
2634 if (dbd != NULL)
2635 {
2636 dbdb->dbd = *dbd;
2637 dbd = &dbdb->dbd;
2638 }
2639 }
2640 }
2641
2642/* If we are counting unique events, find out if this event is new or not.
2643If the client repeats the event during the current period then it should be
2644counted. We skip this code in readonly mode for efficiency, because any
2645changes to the filter will be discarded and because count is already set to
2646zero. */
2647
2648if (unique != NULL && !readonly)
2649 {
2650 /* We identify unique events using a Bloom filter. (You can find my
2651 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2652 With the per_addr option, an "event" is a recipient address, though the
2653 user can use the unique option to define their own events. We only count
2654 an event if we have not seen it before.
2655
2656 We size the filter according to the rate limit, which (in leaky mode)
2657 is the limit on the population of the filter. We allow 16 bits of space
2658 per entry (see the construction code above) and we set (up to) 8 of them
2659 when inserting an element (see the loop below). The probability of a false
2660 positive (an event we have not seen before but which we fail to count) is
2661
2662 size = limit * 16
2663 numhash = 8
2664 allzero = exp(-numhash * pop / size)
2665 = exp(-0.5 * pop / limit)
2666 fpr = pow(1 - allzero, numhash)
2667
2668 For senders at the limit the fpr is 0.06% or 1 in 1700
2669 and for senders at half the limit it is 0.0006% or 1 in 170000
2670
2671 In strict mode the Bloom filter can fill up beyond the normal limit, in
2672 which case the false positive rate will rise. This means that the
2673 measured rate for very fast senders can bogusly drop off after a while.
2674
2675 At twice the limit, the fpr is 2.5% or 1 in 40
2676 At four times the limit, it is 31% or 1 in 3.2
2677
2678 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2679 decay below the limit, and if this is more than one then the Bloom filter
2680 will be discarded before the decay gets that far. The false positive rate
2681 at this threshold is 9.3% or 1 in 10.7. */
2682
2683 BOOL seen;
2684 unsigned n, hash, hinc;
2685 uschar md5sum[16];
2686 md5 md5info;
2687
2688 /* Instead of using eight independent hash values, we combine two values
2689 using the formula h1 + n * h2. This does not harm the Bloom filter's
2690 performance, and means the amount of hash we need is independent of the
2691 number of bits we set in the filter. */
2692
2693 md5_start(&md5info);
2694 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2695 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2696 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2697
2698 /* Scan the bits corresponding to this event. A zero bit means we have
2699 not seen it before. Ensure all bits are set to record this event. */
2700
2701 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2702
2703 seen = TRUE;
2704 for (n = 0; n < 8; n++, hash += hinc)
2705 {
2706 int bit = 1 << (hash % 8);
2707 int byte = (hash / 8) % dbdb->bloom_size;
2708 if ((dbdb->bloom[byte] & bit) == 0)
2709 {
2710 dbdb->bloom[byte] |= bit;
2711 seen = FALSE;
2712 }
2713 }
2714
2715 /* If this event has occurred before, do not count it. */
2716
2717 if (seen)
2718 {
2719 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2720 count = 0.0;
2721 }
2722 else
2723 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2724 }
2725
2726/* If there was no previous ratelimit data block for this key, initialize
2727the new one, otherwise update the block from the database. The initial rate
2728is what would be computed by the code below for an infinite interval. */
2729
870f6ba8
TF		 2730if (dbd == NULL)
2731 {
c99ce5c9
TF		 2732 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2733 dbd = &dbdb->dbd;
870f6ba8
TF		 2734 dbd->time_stamp = tv.tv_sec;
2735 dbd->time_usec = tv.tv_usec;
c99ce5c9 2736 dbd->rate = count;
870f6ba8
TF		 2737 }
2738else
2739 {
2740 /* The smoothed rate is computed using an exponentially weighted moving
2741 average adjusted for variable sampling intervals. The standard EWMA for
2742 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2743 where f() is the measured value and f'() is the smoothed value.
2744
2745 Old data decays out of the smoothed value exponentially, such that data n
2746 samples old is multiplied by a^n. The exponential decay time constant p
2747 is defined such that data p samples old is multiplied by 1/e, which means
2748 that a = exp(-1/p). We can maintain the same time constant for a variable
2749 sampling interval i by using a = exp(-i/p).
2750
2751 The rate we are measuring is messages per period, suitable for directly
2752 comparing with the limit. The average rate between now and the previous
2753 message is period / interval, which we feed into the EWMA as the sample.
2754
2755 It turns out that the number of messages required for the smoothed rate
2756 to reach the limit when they are sent in a burst is equal to the limit.
2757 This can be seen by analysing the value of the smoothed rate after N
2758 messages sent at even intervals. Let k = (1 - a) * p/i
2759
2760 rate_1 = (1 - a) * p/i + a * rate_0
2761 = k + a * rate_0
2762 rate_2 = k + a * rate_1
2763 = k + a * k + a^2 * rate_0
2764 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2765 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2766 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2767 = rate_0 * a^N + p/i * (1 - a^N)
2768
2769 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2770
2771 rate_N = p/i + (rate_0 - p/i) * a^N
2772 a^N = (rate_N - p/i) / (rate_0 - p/i)
2773 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2774 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2775
2776 Numerical analysis of the above equation, setting the computed rate to
2777 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2778 rates, p/i, the number of messages N = limit. So limit serves as both the
2779 maximum rate measured in messages per period, and the maximum number of
2780 messages that can be sent in a fast burst. */
2781
2782 double this_time = (double)tv.tv_sec
2783 + (double)tv.tv_usec / 1000000.0;
2784 double prev_time = (double)dbd->time_stamp
2785 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF		 2786
2787 /* We must avoid division by zero, and deal gracefully with the clock going
2788 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2789 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2790
e5d5a95f
TF		 2791 double interval = this_time - prev_time <= 0.0 ? 1e-9
2792 : this_time - prev_time;
2793
2794 double i_over_p = interval / period;
2795 double a = exp(-i_over_p);
870f6ba8 2796
c99ce5c9
TF		 2797 /* Combine the instantaneous rate (period / interval) with the previous rate
2798 using the smoothing factor a. In order to measure sized events, multiply the
2799 instantaneous rate by the count of bytes or recipients etc. */
2800
870f6ba8
TF		 2801 dbd->time_stamp = tv.tv_sec;
2802 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF		 2803 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2804
2805 /* When events are very widely spaced the computed rate tends towards zero.
2806 Although this is accurate it turns out not to be useful for our purposes,
2807 especially when the first event after a long silence is the start of a spam
2808 run. A more useful model is that the rate for an isolated event should be the
2809 size of the event per the period size, ignoring the lack of events outside
2810 the current period and regardless of where the event falls in the period. So,
2811 if the interval was so long that the calculated rate is unhelpfully small, we
2812 re-intialize the rate. In the absence of higher-rate bursts, the condition
2813 below is true if the interval is greater than the period. */
2814
2815 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF		 2816 }
2817
c99ce5c9
TF		 2818/* Clients sending at the limit are considered to be over the limit.
2819This matters for edge cases such as a limit of zero, when the client
2820should be completely blocked. */
3348576f 2821
8f240103 2822rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF		 2823
2824/* Update the state if the rate is low or if we are being strict. If we
2825are in leaky mode and the sender's rate is too high, we do not update
2826the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF		 2827rate preventing them from getting any email through. If readonly is set,
2828neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2829
c99ce5c9 2830if ((rc == FAIL && leaky) || strict)
8f240103 2831 {
c99ce5c9 2832 dbfn_write(dbm, key, dbdb, dbdb_size);
8f240103
PH		 2833 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2834 }
2835else
2836 {
2837 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
c99ce5c9 2838 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH		 2839 }
2840
870f6ba8
TF		 2841dbfn_close(dbm);
2842
c99ce5c9 2843/* Store the result in the tree for future reference. */
870f6ba8 2844
c99ce5c9
TF		 2845t = store_get(sizeof(tree_node) + Ustrlen(key));
2846t->data.ptr = dbd;
2847Ustrcpy(t->name, key);
2848(void)tree_insertnode(anchor, t);
870f6ba8
TF		 2849
2850/* We create the formatted version of the sender's rate very late in
2851order to ensure that it is done using the correct storage pool. */
2852
2853store_pool = old_pool;
2854sender_rate = string_sprintf("%.1f", dbd->rate);
2855
2856HDEBUG(D_acl)
2857 debug_printf("ratelimit computed rate %s\n", sender_rate);
2858
2859return rc;
2860}
2861
2862
2863
b0019c78
TF		 2864/*************************************************
2865* The udpsend ACL modifier *
2866*************************************************/
2867
2868/* Called by acl_check_condition() below.
2869
2870Arguments:
2871 arg the option string for udpsend=
2872 log_msgptr for error messages
2873
2874Returns: OK - Completed.
2875 DEFER - Problem with DNS lookup.
2876 ERROR - Syntax error in options.
2877*/
2878
2879static int
55414b25 2880acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF		 2881{
2882int sep = 0;
2883uschar *hostname;
2884uschar *portstr;
2885uschar *portend;
2886host_item *h;
2887int portnum;
b0019c78
TF		 2888int len;
2889int r, s;
b1f8e4f8 2890uschar * errstr;
b0019c78
TF		 2891
2892hostname = string_nextinlist(&arg, &sep, NULL, 0);
2893portstr = string_nextinlist(&arg, &sep, NULL, 0);
2894
2895if (hostname == NULL)
2896 {
217b0e56 2897 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF		 2898 return ERROR;
2899 }
2900if (portstr == NULL)
2901 {
217b0e56 2902 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF		 2903 return ERROR;
2904 }
2905if (arg == NULL)
2906 {
217b0e56 2907 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF		 2908 return ERROR;
2909 }
2910portnum = Ustrtol(portstr, &portend, 10);
2911if (*portend != '\0')
2912 {
217b0e56 2913 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF		 2914 return ERROR;
2915 }
2916
2917/* Make a single-item host list. */
2918h = store_get(sizeof(host_item));
2919memset(h, 0, sizeof(host_item));
2920h->name = hostname;
2921h->port = portnum;
2922h->mx = MX_NONE;
2923
2924if (string_is_ip_address(hostname, NULL))
2925 h->address = hostname, r = HOST_FOUND;
2926else
2927 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2928if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2929 {
217b0e56 2930 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF		 2931 return DEFER;
2932 }
2933
2934HDEBUG(D_acl)
2935 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2936
b1f8e4f8
JH		 2937r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2938 1, NULL, &errstr);
b0019c78 2939if (r < 0) goto defer;
27f9999e 2940len = Ustrlen(arg);
9cb1785a 2941r = send(s, arg, len, 0);
b1f8e4f8
JH		 2942if (r < 0)
2943 {
2944 errstr = US strerror(errno);
2945 close(s);
2946 goto defer;
2947 }
2948close(s);
b0019c78
TF		 2949if (r < len)
2950 {
2951 *log_msgptr =
2952 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2953 return DEFER;
2954 }
2955
2956HDEBUG(D_acl)
2957 debug_printf("udpsend %d bytes\n", r);
2958
2959return OK;
2960
2961defer:
b1f8e4f8 2962*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF		 2963return DEFER;
2964}
2965
2966
2967
059ec3d9
PH		 2968/*************************************************
2969* Handle conditions/modifiers on an ACL item *
2970*************************************************/
2971
2972/* Called from acl_check() below.
2973
2974Arguments:
2975 verb ACL verb
2976 cb ACL condition block - if NULL, result is OK
2977 where where called from
2978 addr the address being checked for RCPT, or NULL
2979 level the nesting level
2980 epp pointer to pass back TRUE if "endpass" encountered
2981 (applies only to "accept" and "discard")
2982 user_msgptr user message pointer
2983 log_msgptr log message pointer
2984 basic_errno pointer to where to put verify error
2985
2986Returns: OK - all conditions are met
2987 DISCARD - an "acl" condition returned DISCARD - only allowed
2988 for "accept" or "discard" verbs
2989 FAIL - at least one condition fails
2990 FAIL_DROP - an "acl" condition returned FAIL_DROP
2991 DEFER - can't tell at the moment (typically, lookup defer,
2992 but can be temporary callout problem)
2993 ERROR - ERROR from nested ACL or expansion failure or other
2994 error
2995*/
2996
2997static int
2998acl_check_condition(int verb, acl_condition_block *cb, int where,
2999 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
3000 uschar **log_msgptr, int *basic_errno)
3001{
3002uschar *user_message = NULL;
3003uschar *log_message = NULL;
ed7f7860
PP		 3004uschar *debug_tag = NULL;
3005uschar *debug_opts = NULL;
059ec3d9 3006int rc = OK;
8523533c 3007#ifdef WITH_CONTENT_SCAN
0f0c8159 3008int sep = -'/';
8523533c 3009#endif
059ec3d9
PH		 3010
3011for (; cb != NULL; cb = cb->next)
3012 {
55414b25 3013 const uschar *arg;
8e669ac1 3014 int control_type;
059ec3d9
PH		 3015
3016 /* The message and log_message items set up messages to be used in
3017 case of rejection. They are expanded later. */
3018
3019 if (cb->type == ACLC_MESSAGE)
3020 {
187bc588 3021 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
059ec3d9
PH		 3022 user_message = cb->arg;
3023 continue;
3024 }
3025
3026 if (cb->type == ACLC_LOG_MESSAGE)
3027 {
187bc588 3028 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
059ec3d9
PH		 3029 log_message = cb->arg;
3030 continue;
3031 }
3032
3033 /* The endpass "condition" just sets a flag to show it occurred. This is
3034 checked at compile time to be on an "accept" or "discard" item. */
3035
3036 if (cb->type == ACLC_ENDPASS)
3037 {
3038 *epp = TRUE;
3039 continue;
3040 }
3041
3042 /* For other conditions and modifiers, the argument is expanded now for some
3043 of them, but not for all, because expansion happens down in some lower level
3044 checking functions in some cases. */
3045
3046 if (cond_expand_at_top[cb->type])
3047 {
3048 arg = expand_string(cb->arg);
3049 if (arg == NULL)
3050 {
3051 if (expand_string_forcedfail) continue;
3052 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3053 cb->arg, expand_string_message);
3054 return search_find_defer? DEFER : ERROR;
3055 }
3056 }
3057 else arg = cb->arg;
3058
3059 /* Show condition, and expanded condition if it's different */
3060
3061 HDEBUG(D_acl)
3062 {
3063 int lhswidth = 0;
3064 debug_printf("check %s%s %n",
3065 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3066 conditions[cb->type], &lhswidth);
3067
3068 if (cb->type == ACLC_SET)
3069 {
38a0a95f
PH		 3070 debug_printf("acl_%s ", cb->u.varname);
3071 lhswidth += 5 + Ustrlen(cb->u.varname);
059ec3d9
PH		 3072 }
3073
3074 debug_printf("= %s\n", cb->arg);
3075
3076 if (arg != cb->arg)
3077 debug_printf("%.*s= %s\n", lhswidth,
3078 US" ", CS arg);
3079 }
3080
3081 /* Check that this condition makes sense at this time */
3082
3083 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3084 {
3085 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3086 cond_modifiers[cb->type]? "use" : "test",
3087 conditions[cb->type], acl_wherenames[where]);
3088 return ERROR;
3089 }
3090
3091 /* Run the appropriate test for each condition, or take the appropriate
3092 action for the remaining modifiers. */
3093
3094 switch(cb->type)
3095 {
71fafd95
PH		 3096 case ACLC_ADD_HEADER:
3097 setup_header(arg);
3098 break;
3099
059ec3d9
PH		 3100 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3101 "discard" verb. */
71fafd95 3102
059ec3d9 3103 case ACLC_ACL:
f60d98e8 3104 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
7421ecab
JH		 3105 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3106 {
3107 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3108 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3109 verbs[verb]);
3110 return ERROR;
3111 }
059ec3d9
PH		 3112 break;
3113
3114 case ACLC_AUTHENTICATED:
3115 rc = (sender_host_authenticated == NULL)? FAIL :
3116 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3117 TRUE, NULL);
3118 break;
3119
71fafd95 3120 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK		 3121 case ACLC_BMI_OPTIN:
3122 {
3123 int old_pool = store_pool;
3124 store_pool = POOL_PERM;
3125 bmi_current_optin = string_copy(arg);
3126 store_pool = old_pool;
3127 }
3128 break;
71fafd95 3129 #endif
8523533c 3130
059ec3d9 3131 case ACLC_CONDITION:
f3766eb5
NM		 3132 /* The true/false parsing here should be kept in sync with that used in
3133 expand.c when dealing with ECOND_BOOL so that we don't have too many
3134 different definitions of what can be a boolean. */
51c7471d
JH		 3135 if (*arg == '-'
3136 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3137 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH		 3138 rc = (Uatoi(arg) == 0)? FAIL : OK;
3139 else
3140 rc = (strcmpic(arg, US"no") == 0 ||
3141 strcmpic(arg, US"false") == 0)? FAIL :
3142 (strcmpic(arg, US"yes") == 0 ||
3143 strcmpic(arg, US"true") == 0)? OK : DEFER;
3144 if (rc == DEFER)
3145 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3146 break;
3147
c3611384
PH		 3148 case ACLC_CONTINUE: /* Always succeeds */
3149 break;
3150
059ec3d9 3151 case ACLC_CONTROL:
c5fcb476 3152 {
55414b25
JH		 3153 const uschar *p = NULL;
3154 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3155
55414b25 3156 /* Check if this control makes sense at this time */
f7572e5a 3157
55414b25
JH		 3158 if ((control_forbids[control_type] & (1 << where)) != 0)
3159 {
3160 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3161 controls[control_type], acl_wherenames[where]);
3162 return ERROR;
3163 }
8800895a 3164
55414b25
JH		 3165 switch(control_type)
3166 {
3167 case CONTROL_AUTH_UNADVERTISED:
3168 allow_auth_unadvertised = TRUE;
3169 break;
3170
3171 #ifdef EXPERIMENTAL_BRIGHTMAIL
3172 case CONTROL_BMI_RUN:
3173 bmi_run = 1;
3174 break;
3175 #endif
3176
3177 #ifndef DISABLE_DKIM
3178 case CONTROL_DKIM_VERIFY:
3179 dkim_disable_verify = TRUE;
3180 #ifdef EXPERIMENTAL_DMARC
3181 /* Since DKIM was blocked, skip DMARC too */
3182 dmarc_disable_verify = TRUE;
3183 dmarc_enable_forensic = FALSE;
3184 #endif
3185 break;
3186 #endif
3187
3188 #ifdef EXPERIMENTAL_DMARC
3189 case CONTROL_DMARC_VERIFY:
3190 dmarc_disable_verify = TRUE;
3191 break;
3192
3193 case CONTROL_DMARC_FORENSIC:
3194 dmarc_enable_forensic = TRUE;
3195 break;
3196 #endif
3197
3198 case CONTROL_DSCP:
3199 if (*p == '/')
3200 {
3201 int fd, af, level, optname, value;
3202 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3203 a socket; we can accept that, we'll just debug-log failures anyway. */
3204 fd = fileno(smtp_in);
3205 af = ip_get_address_family(fd);
3206 if (af < 0)
3207 {
3208 HDEBUG(D_acl)
3209 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3210 strerror(errno));
3211 break;
3212 }
3213 if (dscp_lookup(p+1, af, &level, &optname, &value))
3214 {
3215 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3216 {
3217 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3218 p+1, strerror(errno));
3219 }
3220 else
3221 {
3222 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3223 }
3224 }
3225 else
3226 {
3227 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3228 return ERROR;
3229 }
3230 }
3231 else
3232 {
3233 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3234 return ERROR;
3235 }
3236 break;
3237
3238 case CONTROL_ERROR:
3239 return ERROR;
3240
3241 case CONTROL_CASEFUL_LOCAL_PART:
3242 deliver_localpart = addr->cc_local_part;
3243 break;
3244
3245 case CONTROL_CASELOWER_LOCAL_PART:
3246 deliver_localpart = addr->lc_local_part;
3247 break;
3248
3249 case CONTROL_ENFORCE_SYNC:
3250 smtp_enforce_sync = TRUE;
3251 break;
3252
3253 case CONTROL_NO_ENFORCE_SYNC:
3254 smtp_enforce_sync = FALSE;
3255 break;
3256
3257 #ifdef WITH_CONTENT_SCAN
3258 case CONTROL_NO_MBOX_UNSPOOL:
3259 no_mbox_unspool = TRUE;
3260 break;
3261 #endif
3262
3263 case CONTROL_NO_MULTILINE:
3264 no_multiline_responses = TRUE;
3265 break;
3266
3267 case CONTROL_NO_PIPELINING:
3268 pipelining_enable = FALSE;
3269 break;
3270
3271 case CONTROL_NO_DELAY_FLUSH:
3272 disable_delay_flush = TRUE;
3273 break;
3274
3275 case CONTROL_NO_CALLOUT_FLUSH:
3276 disable_callout_flush = TRUE;
3277 break;
3278
3279 case CONTROL_FAKEREJECT:
3280 cancel_cutthrough_connection("fakereject");
3281 case CONTROL_FAKEDEFER:
3282 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3283 if (*p == '/')
3284 {
3285 const uschar *pp = p + 1;
3286 while (*pp != 0) pp++;
3287 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3288 p = pp;
3289 }
3290 else
3291 {
3292 /* Explicitly reset to default string */
3293 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3294 }
3295 break;
ed7f7860 3296
55414b25
JH		 3297 case CONTROL_FREEZE:
3298 deliver_freeze = TRUE;
3299 deliver_frozen_at = time(NULL);
3300 freeze_tell = freeze_tell_config; /* Reset to configured value */
3301 if (Ustrncmp(p, "/no_tell", 8) == 0)
3302 {
3303 p += 8;
3304 freeze_tell = NULL;
3305 }
3306 if (*p != 0)
3307 {
3308 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3309 return ERROR;
3310 }
3311 cancel_cutthrough_connection("item frozen");
3312 break;
3313
3314 case CONTROL_QUEUE_ONLY:
3315 queue_only_policy = TRUE;
3316 cancel_cutthrough_connection("queueing forced");
3317 break;
3318
3319 case CONTROL_SUBMISSION:
3320 originator_name = US"";
3321 submission_mode = TRUE;
3322 while (*p == '/')
3323 {
3324 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3325 {
3326 p += 14;
3327 active_local_sender_retain = TRUE;
3328 active_local_from_check = FALSE;
3329 }
3330 else if (Ustrncmp(p, "/domain=", 8) == 0)
3331 {
3332 const uschar *pp = p + 8;
3333 while (*pp != 0 && *pp != '/') pp++;
3334 submission_domain = string_copyn(p+8, pp-p-8);
3335 p = pp;
3336 }
3337 /* The name= option must be last, because it swallows the rest of
3338 the string. */
3339 else if (Ustrncmp(p, "/name=", 6) == 0)
3340 {
3341 const uschar *pp = p + 6;
3342 while (*pp != 0) pp++;
3343 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3344 big_buffer, big_buffer_size));
3345 p = pp;
3346 }
3347 else break;
3348 }
3349 if (*p != 0)
3350 {
3351 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3352 return ERROR;
3353 }
3354 break;
e4bdf652 3355
55414b25
JH		 3356 case CONTROL_DEBUG:
3357 while (*p == '/')
3358 {
3359 if (Ustrncmp(p, "/tag=", 5) == 0)
3360 {
3361 const uschar *pp = p + 5;
3362 while (*pp != '\0' && *pp != '/') pp++;
3363 debug_tag = string_copyn(p+5, pp-p-5);
3364 p = pp;
3365 }
3366 else if (Ustrncmp(p, "/opts=", 6) == 0)
3367 {
3368 const uschar *pp = p + 6;
3369 while (*pp != '\0' && *pp != '/') pp++;
3370 debug_opts = string_copyn(p+6, pp-p-6);
3371 p = pp;
3372 }
3373 }
3374 debug_logging_activate(debug_tag, debug_opts);
3375 break;
3376
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 suppress_local_fixups = TRUE;
3379 break;
3380
3381 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3382#ifndef DISABLE_PRDR
55414b25 3383 if (prdr_requested)
a2b89db1
PP		 3384#else
3385 if (0)
3386#endif
55414b25
JH		 3387 /* Too hard to think about for now. We might in future cutthrough
3388 the case where both sides handle prdr and this-node prdr acl
3389 is "accept" */
93a6fce2 3390 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH		 3391 else
3392 {
55414b25
JH		 3393 if (deliver_freeze)
3394 *log_msgptr = US"frozen";
3395 else if (queue_only_policy)
3396 *log_msgptr = US"queue-only";
3397 else if (fake_response == FAIL)
3398 *log_msgptr = US"fakereject";
3399 else
3400 {
3401 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3402 break;
3403 }
3404 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3405 arg, *log_msgptr);
5032d1cf 3406 }
55414b25 3407 return ERROR;
3c8b3577 3408
8c5d388a 3409#ifdef SUPPORT_I18N
3c8b3577
JH		 3410 case CONTROL_UTF8_DOWNCONVERT:
3411 if (*p == '/')
3412 {
921dfc11
JH		 3413 if (p[1] == '1')
3414 {
3415 message_utf8_downconvert = 1;
3416 addr->prop.utf8_downcvt = TRUE;
3417 addr->prop.utf8_downcvt_maybe = FALSE;
3418 p += 2;
3419 break;
3420 }
3421 if (p[1] == '0')
3422 {
3423 message_utf8_downconvert = 0;
3424 addr->prop.utf8_downcvt = FALSE;
3425 addr->prop.utf8_downcvt_maybe = FALSE;
3426 p += 2;
3427 break;
3428 }
3c8b3577 3429 if (p[1] == '-' && p[2] == '1')
921dfc11
JH		 3430 {
3431 message_utf8_downconvert = -1;
3432 addr->prop.utf8_downcvt = FALSE;
3433 addr->prop.utf8_downcvt_maybe = TRUE;
3434 p += 3;
3435 break;
3436 }
3c8b3577
JH		 3437 *log_msgptr = US"bad option value for control=utf8_downconvert";
3438 }
3439 else
3440 {
921dfc11
JH		 3441 message_utf8_downconvert = 1;
3442 addr->prop.utf8_downcvt = TRUE;
3443 addr->prop.utf8_downcvt_maybe = FALSE;
3444 break;
3c8b3577
JH		 3445 }
3446 return ERROR;
8c5d388a 3447#endif
3c8b3577 3448
9171d434 3449 }
55414b25 3450 break;
059ec3d9 3451 }
059ec3d9 3452
6a8f9482
TK		 3453 #ifdef EXPERIMENTAL_DCC
3454 case ACLC_DCC:
3455 {
3456 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3457 const uschar * list = arg;
3458 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK		 3459 /* Run the dcc backend. */
3460 rc = dcc_process(&ss);
3461 /* Modify return code based upon the existance of options. */
3c8b3577 3462 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3463 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3464 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK		 3465 }
3466 break;
3467 #endif
3468
71fafd95 3469 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3470 case ACLC_DECODE:
3471 rc = mime_decode(&arg);
3472 break;
71fafd95 3473 #endif
8523533c 3474
059ec3d9
PH		 3475 case ACLC_DELAY:
3476 {
3477 int delay = readconf_readtime(arg, 0, FALSE);
3478 if (delay < 0)
3479 {
3480 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3481 "modifier: \"%s\" is not a time value", arg);
3482 return ERROR;
3483 }
3484 else
3485 {
3486 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3487 delay);
3488 if (host_checking)
3489 {
3490 HDEBUG(D_acl)
3491 debug_printf("delay skipped in -bh checking mode\n");
3492 }
010c2d14 3493
ae9d18bc
JH		 3494 /* NOTE 1: Remember that we may be
3495 dealing with stdin/stdout here, in addition to TCP/IP connections.
3496 Also, delays may be specified for non-SMTP input, where smtp_out and
3497 smtp_in will be NULL. Whatever is done must work in all cases.
3498
3499 NOTE 2: The added feature of flushing the output before a delay must
3500 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3501 */
3502
3503 else
3504 {
3505 if (smtp_out != NULL && !disable_delay_flush)
3506 mac_smtp_fflush();
3507
861a7c51 3508#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH		 3509 {
3510 struct pollfd p;
3511 nfds_t n = 0;
3512 if (smtp_out)
3513 {
3514 p.fd = fileno(smtp_out);
3515 p.events = POLLRDHUP;
3516 n = 1;
3517 }
3518 if (poll(&p, n, delay*1000) > 0)
3519 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3520 }
3521#else
010c2d14
PH		 3522 /* It appears to be impossible to detect that a TCP/IP connection has
3523 gone away without reading from it. This means that we cannot shorten
3524 the delay below if the client goes away, because we cannot discover
3525 that the client has closed its end of the connection. (The connection
3526 is actually in a half-closed state, waiting for the server to close its
3527 end.) It would be nice to be able to detect this state, so that the
3528 Exim process is not held up unnecessarily. However, it seems that we
3529 can't. The poll() function does not do the right thing, and in any case
3530 it is not always available.
047bdd8c 3531 */
010c2d14 3532
86b8287f 3533 while (delay > 0) delay = sleep(delay);
ae9d18bc 3534#endif
8e669ac1 3535 }
059ec3d9
PH		 3536 }
3537 }
3538 break;
3539
71fafd95 3540 #ifdef WITH_OLD_DEMIME
8523533c
TK		 3541 case ACLC_DEMIME:
3542 rc = demime(&arg);
3543 break;
71fafd95 3544 #endif
8523533c 3545
80a47a2c
TK		 3546 #ifndef DISABLE_DKIM
3547 case ACLC_DKIM_SIGNER:
9e5d6b55
TK		 3548 if (dkim_cur_signer != NULL)
3549 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3550 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3551 else
80a47a2c 3552 rc = FAIL;
71fafd95
PH		 3553 break;
3554
80a47a2c
TK		 3555 case ACLC_DKIM_STATUS:
3556 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3557 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH		 3558 break;
3559 #endif
fb2274d4 3560
4840604e
TL		 3561 #ifdef EXPERIMENTAL_DMARC
3562 case ACLC_DMARC_STATUS:
4a8ce2d8 3563 if (!dmarc_has_been_checked)
4840604e 3564 dmarc_process();
4a8ce2d8 3565 dmarc_has_been_checked = TRUE;
4840604e
TL		 3566 /* used long way of dmarc_exim_expand_query() in case we need more
3567 * view into the process in the future. */
3568 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3569 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3570 break;
3571 #endif
3572
059ec3d9 3573 case ACLC_DNSLISTS:
379ba7d0 3574 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH		 3575 break;
3576
3577 case ACLC_DOMAINS:
3578 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3579 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH		 3580 break;
3581
3582 /* The value in tls_cipher is the full cipher name, for example,
3583 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3584 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3585 what may in practice come out of the SSL library - which at the time of
3586 writing is poorly documented. */
3587
3588 case ACLC_ENCRYPTED:
817d9f57 3589 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH		 3590 {
3591 uschar *endcipher = NULL;
817d9f57
JH		 3592 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3593 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH		 3594 {
3595 endcipher = Ustrchr(++cipher, ':');
3596 if (endcipher != NULL) *endcipher = 0;
3597 }
3598 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3599 if (endcipher != NULL) *endcipher = ':';
3600 }
3601 break;
3602
3603 /* Use verify_check_this_host() instead of verify_check_host() so that
3604 we can pass over &host_data to catch any looked up data. Once it has been
3605 set, it retains its value so that it's still there if another ACL verb
3606 comes through here and uses the cache. However, we must put it into
3607 permanent store in case it is also expected to be used in a subsequent
3608 message in the same SMTP connection. */
3609
3610 case ACLC_HOSTS:
3611 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH		 3612 (sender_host_address == NULL)? US"" : sender_host_address,
3613 CUSS &host_data);
4a452c43
JH		 3614 if (rc == DEFER) *log_msgptr = search_error_message;
3615 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH		 3616 break;
3617
3618 case ACLC_LOCAL_PARTS:
3619 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3620 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3621 CUSS &deliver_localpart_data);
059ec3d9
PH		 3622 break;
3623
6ea85e9a
PH		 3624 case ACLC_LOG_REJECT_TARGET:
3625 {
3626 int logbits = 0;
3627 int sep = 0;
55414b25 3628 const uschar *s = arg;
6ea85e9a 3629 uschar *ss;
4a452c43 3630 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH		 3631 {
3632 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3633 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3634 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3635 else
3636 {
3637 logbits |= LOG_MAIN|LOG_REJECT;
3638 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3639 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3640 }
3641 }
3642 log_reject_target = logbits;
3643 }
3644 break;
3645
059ec3d9
PH		 3646 case ACLC_LOGWRITE:
3647 {
3648 int logbits = 0;
55414b25 3649 const uschar *s = arg;
059ec3d9
PH		 3650 if (*s == ':')
3651 {
3652 s++;
3653 while (*s != ':')
3654 {
3655 if (Ustrncmp(s, "main", 4) == 0)
3656 { logbits |= LOG_MAIN; s += 4; }
3657 else if (Ustrncmp(s, "panic", 5) == 0)
3658 { logbits |= LOG_PANIC; s += 5; }
3659 else if (Ustrncmp(s, "reject", 6) == 0)
3660 { logbits |= LOG_REJECT; s += 6; }
3661 else
3662 {
3663 logbits = LOG_MAIN|LOG_PANIC;
3664 s = string_sprintf(":unknown log name in \"%s\" in "
3665 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3666 }
3667 if (*s == ',') s++;
3668 }
3669 s++;
3670 }
3671 while (isspace(*s)) s++;
6ea85e9a
PH		 3672
3673
059ec3d9
PH		 3674 if (logbits == 0) logbits = LOG_MAIN;
3675 log_write(0, logbits, "%s", string_printing(s));
3676 }
3677 break;
8e669ac1 3678
71fafd95 3679 #ifdef WITH_CONTENT_SCAN
0f0c8159 3680 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3681 {
6ea85e9a 3682 /* Separate the regular expression and any optional parameters. */
55414b25
JH		 3683 const uschar * list = arg;
3684 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH		 3685 uschar *opt;
3686 BOOL defer_ok = FALSE;
3687 int timeout = 0;
3688
55414b25 3689 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH		 3690 if (strcmpic(opt, US"defer_ok") == 0)
3691 defer_ok = TRUE;
3692 else if ( strncmpic(opt, US"tmo=", 4) == 0
3693 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3694 )
3695 {
3696 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3697 return ERROR;
3698 }
3699
3700 rc = malware(ss, timeout);
3701 if (rc == DEFER && defer_ok)
3702 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK		 3703 }
3704 break;
3705
3706 case ACLC_MIME_REGEX:
71fafd95 3707 rc = mime_regex(&arg);
8523533c 3708 break;
71fafd95 3709 #endif
059ec3d9 3710
870f6ba8 3711 case ACLC_RATELIMIT:
90fc3069 3712 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF		 3713 break;
3714
059ec3d9 3715 case ACLC_RECIPIENTS:
55414b25
JH		 3716 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3717 CUSS &recipient_data);
059ec3d9
PH		 3718 break;
3719
71fafd95
PH		 3720 #ifdef WITH_CONTENT_SCAN
3721 case ACLC_REGEX:
3722 rc = regex(&arg);
8523533c 3723 break;
71fafd95 3724 #endif
8523533c 3725
e7568d51
TL		 3726 case ACLC_REMOVE_HEADER:
3727 setup_remove_header(arg);
3728 break;
3729
059ec3d9
PH		 3730 case ACLC_SENDER_DOMAINS:
3731 {
3732 uschar *sdomain;
3733 sdomain = Ustrrchr(sender_address, '@');
3734 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3735 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3736 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3737 }
3738 break;
3739
3740 case ACLC_SENDERS:
55414b25
JH		 3741 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3742 sender_address_cache, -1, 0, CUSS &sender_data);
059ec3d9
PH		 3743 break;
3744
3745 /* Connection variables must persist forever */
3746
3747 case ACLC_SET:
3748 {
3749 int old_pool = store_pool;
5ef5dd52 3750 if ( cb->u.varname[0] == 'c'
0cbf2b82 3751#ifndef DISABLE_EVENT
5ef5dd52
JB		 3752 || event_name /* An event is being delivered */
3753#endif
3754 )
3755 store_pool = POOL_PERM;
38a0a95f 3756 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
059ec3d9
PH		 3757 store_pool = old_pool;
3758 }
3759 break;
3760
71fafd95 3761 #ifdef WITH_CONTENT_SCAN
8523533c
TK		 3762 case ACLC_SPAM:
3763 {
3764 /* Seperate the regular expression and any optional parameters. */
55414b25
JH		 3765 const uschar * list = arg;
3766 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
8523533c 3767 /* Run the spam backend. */
55414b25 3768 rc = spam(CUSS &ss);
8523533c 3769 /* Modify return code based upon the existance of options. */
55414b25 3770 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
8523533c
TK		 3771 != NULL) {
3772 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3773 {
3774 /* FAIL so that the message is passed to the next ACL */
3775 rc = FAIL;
3776 }
3777 }
3778 }
3779 break;
71fafd95 3780 #endif
8523533c 3781
71fafd95 3782 #ifdef EXPERIMENTAL_SPF
8523533c 3783 case ACLC_SPF:
65a7d8c3
NM		 3784 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3785 break;
3786 case ACLC_SPF_GUESS:
3787 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
8523533c 3788 break;
71fafd95 3789 #endif
8523533c 3790
b0019c78
TF		 3791 case ACLC_UDPSEND:
3792 rc = acl_udpsend(arg, log_msgptr);
3793 break;
3794
059ec3d9
PH		 3795 /* If the verb is WARN, discard any user message from verification, because
3796 such messages are SMTP responses, not header additions. The latter come
475fe28a
PH		 3797 only from explicit "message" modifiers. However, put the user message into
3798 $acl_verify_message so it can be used in subsequent conditions or modifiers
3799 (until something changes it). */
059ec3d9
PH		 3800
3801 case ACLC_VERIFY:
3802 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3703d818
JH		 3803 if (*user_msgptr)
3804 acl_verify_message = *user_msgptr;
059ec3d9
PH		 3805 if (verb == ACL_WARN) *user_msgptr = NULL;
3806 break;
3807
3808 default:
3809 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3810 "condition %d", cb->type);
3811 break;
3812 }
3813
3814 /* If a condition was negated, invert OK/FAIL. */
3815
3816 if (!cond_modifiers[cb->type] && cb->u.negated)
3817 {
3818 if (rc == OK) rc = FAIL;
3819 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3820 }
3821
3822 if (rc != OK) break; /* Conditions loop */
3823 }
3824
3825
3826/* If the result is the one for which "message" and/or "log_message" are used,
4e88a19f
PH		 3827handle the values of these modifiers. If there isn't a log message set, we make
3828it the same as the user message.
059ec3d9
PH		 3829
3830"message" is a user message that will be included in an SMTP response. Unless
3831it is empty, it overrides any previously set user message.
3832
3833"log_message" is a non-user message, and it adds to any existing non-user
3834message that is already set.
3835
4e88a19f
PH		 3836Most verbs have but a single return for which the messages are relevant, but
3837for "discard", it's useful to have the log message both when it succeeds and
3838when it fails. For "accept", the message is used in the OK case if there is no
3839"endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3840present. */
059ec3d9 3841
4e88a19f
PH		 3842if (*epp && rc == OK) user_message = NULL;
3843
3844if (((1<<rc) & msgcond[verb]) != 0)
059ec3d9
PH		 3845 {
3846 uschar *expmessage;
4e88a19f
PH		 3847 uschar *old_user_msgptr = *user_msgptr;
3848 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
059ec3d9
PH		 3849
3850 /* If the verb is "warn", messages generated by conditions (verification or
4e88a19f
PH		 3851 nested ACLs) are always discarded. This also happens for acceptance verbs
3852 when they actually do accept. Only messages specified at this level are used.
059ec3d9
PH		 3853 However, the value of an existing message is available in $acl_verify_message
3854 during expansions. */
3855
4e88a19f
PH		 3856 if (verb == ACL_WARN ||
3857 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3858 *log_msgptr = *user_msgptr = NULL;
059ec3d9
PH		 3859
3860 if (user_message != NULL)
3861 {
3862 acl_verify_message = old_user_msgptr;
3863 expmessage = expand_string(user_message);
3864 if (expmessage == NULL)
3865 {
3866 if (!expand_string_forcedfail)
3867 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3868 user_message, expand_string_message);
3869 }
3870 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3871 }
3872
3873 if (log_message != NULL)
3874 {
3875 acl_verify_message = old_log_msgptr;
3876 expmessage = expand_string(log_message);
3877 if (expmessage == NULL)
3878 {
3879 if (!expand_string_forcedfail)
3880 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3881 log_message, expand_string_message);
3882 }
3883 else if (expmessage[0] != 0)
3884 {
3885 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3886 string_sprintf("%s: %s", expmessage, *log_msgptr);
3887 }
3888 }
3889
3890 /* If no log message, default it to the user message */
3891
3892 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3893 }
3894
3895acl_verify_message = NULL;
3896return rc;
3897}
3898
3899
3900
3901
3902
3903/*************************************************
3904* Get line from a literal ACL *
3905*************************************************/
3906
3907/* This function is passed to acl_read() in order to extract individual lines
3908of a literal ACL, which we access via static pointers. We can destroy the
3909contents because this is called only once (the compiled ACL is remembered).
3910
3911This code is intended to treat the data in the same way as lines in the main
3912Exim configuration file. That is:
3913
3914 . Leading spaces are ignored.
3915
3916 . A \ at the end of a line is a continuation - trailing spaces after the \
3917 are permitted (this is because I don't believe in making invisible things
3918 significant). Leading spaces on the continued part of a line are ignored.
3919
3920 . Physical lines starting (significantly) with # are totally ignored, and
3921 may appear within a sequence of backslash-continued lines.
3922
3923 . Blank lines are ignored, but will end a sequence of continuations.
3924
3925Arguments: none
3926Returns: a pointer to the next line
3927*/
3928
3929
3930static uschar *acl_text; /* Current pointer in the text */
3931static uschar *acl_text_end; /* Points one past the terminating '0' */
3932
3933
3934static uschar *
3935acl_getline(void)
3936{
3937uschar *yield;
3938
3939/* This loop handles leading blank lines and comments. */
3940
3941for(;;)
3942 {
3943 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3944 if (*acl_text == 0) return NULL; /* No more data */
3945 yield = acl_text; /* Potential data line */
3946
3947 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3948
3949 /* If we hit the end before a newline, we have the whole logical line. If
3950 it's a comment, there's no more data to be given. Otherwise, yield it. */
3951
3952 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3953
3954 /* After reaching a newline, end this loop if the physical line does not
3955 start with '#'. If it does, it's a comment, and the loop continues. */
3956
3957 if (*yield != '#') break;
3958 }
3959
3960/* This loop handles continuations. We know we have some real data, ending in
3961newline. See if there is a continuation marker at the end (ignoring trailing
3962white space). We know that *yield is not white space, so no need to test for
3963cont > yield in the backwards scanning loop. */
3964
3965for(;;)
3966 {
3967 uschar *cont;
3968 for (cont = acl_text - 1; isspace(*cont); cont--);
3969
3970 /* If no continuation follows, we are done. Mark the end of the line and
3971 return it. */
3972
3973 if (*cont != '\\')
3974 {
3975 *acl_text++ = 0;
3976 return yield;
3977 }
3978
3979 /* We have encountered a continuation. Skip over whitespace at the start of
3980 the next line, and indeed the whole of the next line or lines if they are
3981 comment lines. */
3982
3983 for (;;)
3984 {
3985 while (*(++acl_text) == ' ' || *acl_text == '\t');
3986 if (*acl_text != '#') break;
3987 while (*(++acl_text) != 0 && *acl_text != '\n');
3988 }
3989
3990 /* We have the start of a continuation line. Move all the rest of the data
3991 to join onto the previous line, and then find its end. If the end is not a
3992 newline, we are done. Otherwise loop to look for another continuation. */
3993
3994 memmove(cont, acl_text, acl_text_end - acl_text);
3995 acl_text_end -= acl_text - cont;
3996 acl_text = cont;
3997 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3998 if (*acl_text == 0) return yield;
3999 }
4000
4001/* Control does not reach here */
4002}
4003
4004
4005
4006
4007
4008/*************************************************
4009* Check access using an ACL *
4010*************************************************/
4011
4012/* This function is called from address_check. It may recurse via
4013acl_check_condition() - hence the use of a level to stop looping. The ACL is
4014passed as a string which is expanded. A forced failure implies no access check
4015is required. If the result is a single word, it is taken as the name of an ACL
4016which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4017text, complete with newlines, and parsed as such. In both cases, the ACL check
4018is then run. This function uses an auxiliary function for acl_read() to call
4019for reading individual lines of a literal ACL. This is acl_getline(), which
4020appears immediately above.
4021
4022Arguments:
4023 where where called from
4024 addr address item when called from RCPT; otherwise NULL
4025 s the input string; NULL is the same as an empty ACL => DENY
4026 level the nesting level
4027 user_msgptr where to put a user error (for SMTP response)
4028 log_msgptr where to put a logging message (not for SMTP response)
4029
4030Returns: OK access is granted
4031 DISCARD access is apparently granted...
4032 FAIL access is denied
4033 FAIL_DROP access is denied; drop the connection
4034 DEFER can't tell at the moment
4035 ERROR disaster
4036*/
4037
4038static int
4039acl_check_internal(int where, address_item *addr, uschar *s, int level,
4040 uschar **user_msgptr, uschar **log_msgptr)
4041{
4042int fd = -1;
4043acl_block *acl = NULL;
4044uschar *acl_name = US"inline ACL";
4045uschar *ss;
4046
4047/* Catch configuration loops */
4048
4049if (level > 20)
4050 {
4051 *log_msgptr = US"ACL nested too deep: possible loop";
4052 return ERROR;
4053 }
4054
4055if (s == NULL)
4056 {
4057 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4058 return FAIL;
4059 }
4060
4061/* At top level, we expand the incoming string. At lower levels, it has already
4062been expanded as part of condition processing. */
4063
4064if (level == 0)
4065 {
4066 ss = expand_string(s);
4067 if (ss == NULL)
4068 {
4069 if (expand_string_forcedfail) return OK;
4070 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4071 expand_string_message);
4072 return ERROR;
4073 }
4074 }
4075else ss = s;
4076
4077while (isspace(*ss))ss++;
4078
4079/* If we can't find a named ACL, the default is to parse it as an inline one.
4080(Unless it begins with a slash; non-existent files give rise to an error.) */
4081
4082acl_text = ss;
4083
4084/* Handle the case of a string that does not contain any spaces. Look for a
4085named ACL among those read from the configuration, or a previously read file.
4086It is possible that the pointer to the ACL is NULL if the configuration
4087contains a name with no data. If not found, and the text begins with '/',
4088read an ACL from a file, and save it so it can be re-used. */
4089
4090if (Ustrchr(ss, ' ') == NULL)
4091 {
4092 tree_node *t = tree_search(acl_anchor, ss);
4093 if (t != NULL)
4094 {
4095 acl = (acl_block *)(t->data.ptr);
4096 if (acl == NULL)
4097 {
4098 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4099 return FAIL;
4100 }
4101 acl_name = string_sprintf("ACL \"%s\"", ss);
4102 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4103 }
4104
4105 else if (*ss == '/')
4106 {
4107 struct stat statbuf;
4108 fd = Uopen(ss, O_RDONLY, 0);
4109 if (fd < 0)
4110 {
4111 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4112 strerror(errno));
4113 return ERROR;
4114 }
4115
4116 if (fstat(fd, &statbuf) != 0)
4117 {
4118 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4119 strerror(errno));
4120 return ERROR;
4121 }
4122
4123 acl_text = store_get(statbuf.st_size + 1);
4124 acl_text_end = acl_text + statbuf.st_size + 1;
4125
4126 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4127 {
4128 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4129 ss, strerror(errno));
4130 return ERROR;
4131 }
4132 acl_text[statbuf.st_size] = 0;
f1e894f3 4133 (void)close(fd);
059ec3d9
PH		 4134
4135 acl_name = string_sprintf("ACL \"%s\"", ss);
4136 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4137 }
4138 }
4139
4140/* Parse an ACL that is still in text form. If it came from a file, remember it
4141in the ACL tree, having read it into the POOL_PERM store pool so that it
4142persists between multiple messages. */
4143
4144if (acl == NULL)
4145 {
4146 int old_pool = store_pool;
4147 if (fd >= 0) store_pool = POOL_PERM;
4148 acl = acl_read(acl_getline, log_msgptr);
4149 store_pool = old_pool;
4150 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4151 if (fd >= 0)
4152 {
4153 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4154 Ustrcpy(t->name, ss);
4155 t->data.ptr = acl;
4156 (void)tree_insertnode(&acl_anchor, t);
4157 }
4158 }
4159
4160/* Now we have an ACL to use. It's possible it may be NULL. */
4161
4162while (acl != NULL)
4163 {
4164 int cond;
4165 int basic_errno = 0;
4166 BOOL endpass_seen = FALSE;
82c0c8ea
JH		 4167 BOOL acl_quit_check = level == 0
4168 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
059ec3d9
PH		 4169
4170 *log_msgptr = *user_msgptr = NULL;
4171 acl_temp_details = FALSE;
4172
059ec3d9
PH		 4173 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4174
4175 /* Clear out any search error message from a previous check before testing
4176 this condition. */
4177
4178 search_error_message = NULL;
4179 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4180 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4181
4182 /* Handle special returns: DEFER causes a return except on a WARN verb;
4183 ERROR always causes a return. */
4184
4185 switch (cond)
4186 {
4187 case DEFER:
6968512f 4188 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4189 if (basic_errno != ERRNO_CALLOUTDEFER)
4190 {
4191 if (search_error_message != NULL && *search_error_message != 0)
4192 *log_msgptr = search_error_message;
4193 if (smtp_return_error_details) acl_temp_details = TRUE;
4194 }
4195 else
4196 {
4197 acl_temp_details = TRUE;
4198 }
4199 if (acl->verb != ACL_WARN) return DEFER;
4200 break;
4201
4202 default: /* Paranoia */
4203 case ERROR:
6968512f 4204 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4205 return ERROR;
4206
4207 case OK:
6968512f
JH		 4208 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4209 verbs[acl->verb], acl_name);
059ec3d9
PH		 4210 break;
4211
4212 case FAIL:
6968512f 4213 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
059ec3d9
PH		 4214 break;
4215
4216 /* DISCARD and DROP can happen only from a nested ACL condition, and
4217 DISCARD can happen only for an "accept" or "discard" verb. */
4218
4219 case DISCARD:
6968512f
JH		 4220 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4221 verbs[acl->verb], acl_name);
059ec3d9
PH		 4222 break;
4223
4224 case FAIL_DROP:
6968512f
JH		 4225 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4226 verbs[acl->verb], acl_name);
059ec3d9
PH		 4227 break;
4228 }
4229
4230 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4231 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4232 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4233
4234 switch(acl->verb)
4235 {
4236 case ACL_ACCEPT:
a7538db1
JH		 4237 if (cond == OK || cond == DISCARD)
4238 {
4239 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4240 return cond;
4241 }
059ec3d9
PH		 4242 if (endpass_seen)
4243 {
4244 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4245 return cond;
4246 }
4247 break;
4248
4249 case ACL_DEFER:
4250 if (cond == OK)
4251 {
a7538db1 4252 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
82c0c8ea 4253 if (acl_quit_check) goto badquit;
059ec3d9
PH		 4254 acl_temp_details = TRUE;
4255 return DEFER;
4256 }
4257 break;
4258
4259 case ACL_DENY:
a7538db1
JH		 4260 if (cond == OK)
4261 {
4262 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
82c0c8ea 4263 if (acl_quit_check) goto badquit;
a7538db1
JH		 4264 return FAIL;
4265 }
059ec3d9
PH		 4266 break;
4267
4268 case ACL_DISCARD:
a7538db1
JH		 4269 if (cond == OK || cond == DISCARD)
4270 {
4271 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
82c0c8ea 4272 if (acl_quit_check) goto badquit;
a7538db1
JH		 4273 return DISCARD;
4274 }
059ec3d9
PH		 4275 if (endpass_seen)
4276 {
4277 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4278 return cond;
4279 }
4280 break;
4281
4282 case ACL_DROP:
a7538db1
JH		 4283 if (cond == OK)
4284 {
4285 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
82c0c8ea 4286 if (acl_quit_check) goto badquit;
a7538db1
JH		 4287 return FAIL_DROP;
4288 }
059ec3d9
PH		 4289 break;
4290
4291 case ACL_REQUIRE:
a7538db1
JH		 4292 if (cond != OK)
4293 {
4294 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
82c0c8ea 4295 if (acl_quit_check) goto badquit;
a7538db1
JH		 4296 return cond;
4297 }
059ec3d9
PH		 4298 break;
4299
4300 case ACL_WARN:
4301 if (cond == OK)
4302 acl_warn(where, *user_msgptr, *log_msgptr);
6c6d6e48 4303 else if (cond == DEFER && LOGGING(acl_warn_skipped))
9c7a242c
PH		 4304 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4305 "condition test deferred%s%s", host_and_ident(TRUE),
4306 (*log_msgptr == NULL)? US"" : US": ",
4307 (*log_msgptr == NULL)? US"" : *log_msgptr);
059ec3d9
PH		 4308 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4309 break;
4310
4311 default:
4312 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4313 acl->verb);
4314 break;
4315 }
4316
4317 /* Pass to the next ACL item */
4318
4319 acl = acl->next;
4320 }
4321
4322/* We have reached the end of the ACL. This is an implicit DENY. */
4323
4324HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4325return FAIL;
82c0c8ea
JH		 4326
4327badquit:
4328 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4329 "('%s' verb used incorrectly)", verbs[acl->verb]);
4330 return ERROR;
059ec3d9
PH		 4331}
4332
4333
333eea9c
JH		 4334
4335
4336/* Same args as acl_check_internal() above, but the string s is
4337the name of an ACL followed optionally by up to 9 space-separated arguments.
4338The name and args are separately expanded. Args go into $acl_arg globals. */
f60d98e8 4339static int
55414b25 4340acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
333eea9c
JH		 4341 uschar **user_msgptr, uschar **log_msgptr)
4342{
4343uschar * tmp;
bef3ea7f 4344uschar * tmp_arg[9]; /* must match acl_arg[] */
ef21c07d
JH		 4345uschar * sav_arg[9]; /* must match acl_arg[] */
4346int sav_narg;
333eea9c 4347uschar * name;
bef3ea7f 4348int i;
ef21c07d 4349int ret;
333eea9c
JH		 4350
4351if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4352 goto bad;
4353
bef3ea7f 4354for (i = 0; i < 9; i++)
333eea9c
JH		 4355 {
4356 while (*s && isspace(*s)) s++;
4357 if (!*s) break;
bef3ea7f 4358 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
333eea9c
JH		 4359 {
4360 tmp = name;
4361 goto bad;
4362 }
4363 }
ef21c07d
JH		 4364
4365sav_narg = acl_narg;
bef3ea7f 4366acl_narg = i;
ef21c07d
JH		 4367for (i = 0; i < acl_narg; i++)
4368 {
4369 sav_arg[i] = acl_arg[i];
4370 acl_arg[i] = tmp_arg[i];
4371 }
4372while (i < 9)
4373 {
4374 sav_arg[i] = acl_arg[i];
4375 acl_arg[i++] = NULL;
4376 }
4377
4378ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
333eea9c 4379
ef21c07d
JH		 4380acl_narg = sav_narg;
4381for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4382return ret;
333eea9c
JH		 4383
4384bad:
4385if (expand_string_forcedfail) return ERROR;
4386*log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4387 tmp, expand_string_message);
4388return search_find_defer?DEFER:ERROR;
4389}
4390
4391
4392
059ec3d9
PH		 4393/*************************************************
4394* Check access using an ACL *
4395*************************************************/
4396
faa05a93
JH		 4397/* Alternate interface for ACL, used by expansions */
4398int
05caaeaa 4399acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
faa05a93 4400{
faa05a93
JH		 4401address_item adb;
4402address_item *addr = NULL;
4403
4404*user_msgptr = *log_msgptr = NULL;
4405sender_verified_failed = NULL;
4406ratelimiters_cmd = NULL;
4407log_reject_target = LOG_MAIN|LOG_REJECT;
4408
4409if (where == ACL_WHERE_RCPT)
4410 {
4411 adb = address_defaults;
4412 addr = &adb;
05caaeaa
JH		 4413 addr->address = expand_string(US"$local_part@$domain");
4414 addr->domain = deliver_domain;
4415 addr->local_part = deliver_localpart;
4416 addr->cc_local_part = deliver_localpart;
4417 addr->lc_local_part = deliver_localpart;
faa05a93
JH		 4418 }
4419
4420return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4421}
4422
4423
4424
059ec3d9
PH		 4425/* This is the external interface for ACL checks. It sets up an address and the
4426expansions for $domain and $local_part when called after RCPT, then calls
4427acl_check_internal() to do the actual work.
4428
4429Arguments:
4430 where ACL_WHERE_xxxx indicating where called from
64ffc24f 4431 recipient RCPT address for RCPT check, else NULL
059ec3d9
PH		 4432 s the input string; NULL is the same as an empty ACL => DENY
4433 user_msgptr where to put a user error (for SMTP response)
4434 log_msgptr where to put a logging message (not for SMTP response)
4435
4436Returns: OK access is granted by an ACCEPT verb
4437 DISCARD access is granted by a DISCARD verb
4438 FAIL access is denied
4439 FAIL_DROP access is denied; drop the connection
4440 DEFER can't tell at the moment
4441 ERROR disaster
4442*/
faa05a93 4443int acl_where = ACL_WHERE_UNKNOWN;
059ec3d9
PH		 4444
4445int
64ffc24f 4446acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
059ec3d9
PH		 4447 uschar **log_msgptr)
4448{
4449int rc;
4450address_item adb;
64ffc24f 4451address_item *addr = NULL;
059ec3d9
PH		 4452
4453*user_msgptr = *log_msgptr = NULL;
4454sender_verified_failed = NULL;
fe0dab11 4455ratelimiters_cmd = NULL;
6ea85e9a 4456log_reject_target = LOG_MAIN|LOG_REJECT;
059ec3d9 4457
8ccd00b1 4458#ifndef DISABLE_PRDR
4f6ae5c3 4459if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
fd98a5c6 4460#else
4f6ae5c3 4461if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
fd98a5c6 4462#endif
059ec3d9
PH		 4463 {
4464 adb = address_defaults;
4465 addr = &adb;
64ffc24f 4466 addr->address = recipient;
059ec3d9
PH		 4467 if (deliver_split_address(addr) == DEFER)
4468 {
4469 *log_msgptr = US"defer in percent_hack_domains check";
4470 return DEFER;
4471 }
8c5d388a 4472#ifdef SUPPORT_I18N
3c8b3577
JH		 4473 if ((addr->prop.utf8_msg = message_smtputf8))
4474 {
4475 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4476 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4477 }
9bfc60eb 4478#endif
059ec3d9
PH		 4479 deliver_domain = addr->domain;
4480 deliver_localpart = addr->local_part;
4481 }
059ec3d9 4482
faa05a93 4483acl_where = where;
059ec3d9 4484rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
faa05a93 4485acl_where = ACL_WHERE_UNKNOWN;
059ec3d9 4486
817d9f57
JH		 4487/* Cutthrough - if requested,
4488and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4489and rcpt acl returned accept,
4490and first recipient (cancel on any subsequents)
e4bdf652 4491open one now and run it up to RCPT acceptance.
f9334a28
JH		 4492A failed verify should cancel cutthrough request,
4493and will pass the fail to the originator.
817d9f57 4494Initial implementation: dual-write to spool.
e4bdf652
JH		 4495Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4496
4497Cease cutthrough copy on rxd final dot; do not send one.
4498
4499On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4500
4501On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4502perm-rejected, reflect that to the original sender - and dump the spooled copy.
4503If temp-reject, close the conn (and keep the spooled copy).
4504If conn-failure, no action (and keep the spooled copy).
e4bdf652
JH		 4505*/
4506switch (where)
4507{
4508case ACL_WHERE_RCPT:
8ccd00b1 4509#ifndef DISABLE_PRDR
fd98a5c6
JH		 4510case ACL_WHERE_PRDR:
4511#endif
59eaad2b
JH		 4512 if (host_checking_callout) /* -bhc mode */
4513 cancel_cutthrough_connection("host-checking mode");
4514 else if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
f9334a28 4515 rc = open_cutthrough_connection(addr);
e4bdf652
JH		 4516 break;
4517
4518case ACL_WHERE_PREDATA:
59eaad2b 4519 if (rc == OK)
e4bdf652
JH		 4520 cutthrough_predata();
4521 else
2e5b33cd 4522 cancel_cutthrough_connection("predata acl not ok");
e4bdf652
JH		 4523 break;
4524
4525case ACL_WHERE_QUIT:
4526case ACL_WHERE_NOTQUIT:
2e5b33cd 4527 cancel_cutthrough_connection("quit or notquit");
e4bdf652
JH		 4528 break;
4529
4530default:
4531 break;
4532}
4533
64ffc24f
PH		 4534deliver_domain = deliver_localpart = deliver_address_data =
4535 sender_address_data = NULL;
059ec3d9
PH		 4536
4537/* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4538ACL, which is really in the middle of an SMTP command. */
4539
4540if (rc == DISCARD)
4541 {
4542 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4543 {
4544 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4545 "ACL", acl_wherenames[where]);
4546 return ERROR;
4547 }
4548 return DISCARD;
4549 }
4550
4551/* A DROP response is not permitted from MAILAUTH */
4552
4553if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4554 {
4555 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4556 "ACL", acl_wherenames[where]);
4557 return ERROR;
4558 }
4559
4e88a19f
PH		 4560/* Before giving a response, take a look at the length of any user message, and
4561split it up into multiple lines if possible. */
059ec3d9 4562
e28326d8
PH		 4563*user_msgptr = string_split_message(*user_msgptr);
4564if (fake_response != OK)
4565 fake_response_text = string_split_message(fake_response_text);
059ec3d9
PH		 4566
4567return rc;
4568}
4569
38a0a95f 4570
38a0a95f
PH		 4571/*************************************************
4572* Create ACL variable *
4573*************************************************/
4574
4575/* Create an ACL variable or reuse an existing one. ACL variables are in a
4576binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4577
4578Argument:
4579 name pointer to the variable's name, starting with c or m
4580
4581Returns the pointer to variable's tree node
4582*/
4583
4584tree_node *
4585acl_var_create(uschar *name)
4586{
4587tree_node *node, **root;
4588root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4589node = tree_search(*root, name);
4590if (node == NULL)
4591 {
4592 node = store_get(sizeof(tree_node) + Ustrlen(name));
4593 Ustrcpy(node->name, name);
4594 (void)tree_insertnode(root, node);
4595 }
4596node->data.ptr = NULL;
4597return node;
4598}
4599
4600
4601
4602/*************************************************
4603* Write an ACL variable in spool format *
4604*************************************************/
4605
4606/* This function is used as a callback for tree_walk when writing variables to
4607the spool file. To retain spool file compatibility, what is written is -aclc or
4608-aclm followed by the rest of the name and the data length, space separated,
4609then the value itself, starting on a new line, and terminated by an additional
4610newline. When we had only numbered ACL variables, the first line might look
4611like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4612acl_cfoo.
4613
4614Arguments:
4615 name of the variable
4616 value of the variable
4617 ctx FILE pointer (as a void pointer)
4618
4619Returns: nothing
4620*/
4621
4622void
4623acl_var_write(uschar *name, uschar *value, void *ctx)
4624{
4625FILE *f = (FILE *)ctx;
4626fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4627}
4628
9171d434
JH		 4629/* vi: aw ai sw=2
4630*/
059ec3d9 4631/* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.