Docs: Update DKIM section with RFC 8301 requirements
[exim.git] / src / src / acl.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
9242a7e8 5/* Copyright (c) University of Cambridge 1995 - 2017 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Code for handling Access Control Lists (ACLs) */
9
10#include "exim.h"
11
12
13/* Default callout timeout */
14
15#define CALLOUT_TIMEOUT_DEFAULT 30
16
17/* ACL verb codes - keep in step with the table of verbs that follows */
18
19enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22/* ACL verbs */
23
f9d04f08 24static uschar *verbs[] = {
f2ed27cf
JH
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32};
059ec3d9 33
4e88a19f
PH
34/* For each verb, the conditions for which "message" or "log_message" are used
35are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36"accept", the FAIL case is used only after "endpass", but that is selected in
37the code. */
38
39static int msgcond[] = {
f2ed27cf
JH
40 [ACL_ACCEPT] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
41 [ACL_DEFER] = (1<<OK),
42 [ACL_DENY] = (1<<OK),
43 [ACL_DISCARD] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
44 [ACL_DROP] = (1<<OK),
45 [ACL_REQUIRE] = (1<<FAIL) | (1<<FAIL_DROP),
46 [ACL_WARN] = (1<<OK)
4e88a19f 47 };
059ec3d9
PH
48
49/* ACL condition and modifier codes - keep in step with the table that
2d009132 50follows.
71fafd95 51down. */
059ec3d9 52
71fafd95
PH
53enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
8523533c
TK
56#ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58#endif
71fafd95 59 ACLC_CONDITION,
c3611384 60 ACLC_CONTINUE,
71fafd95 61 ACLC_CONTROL,
6a8f9482
TK
62#ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64#endif
8523533c
TK
65#ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67#endif
68 ACLC_DELAY,
80a47a2c
TK
69#ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
fb2274d4 72#endif
4840604e
TL
73#ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75#endif
71fafd95
PH
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
6ea85e9a 83 ACLC_LOG_REJECT_TARGET,
71fafd95 84 ACLC_LOGWRITE,
8523533c
TK
85#ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87#endif
88 ACLC_MESSAGE,
89#ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91#endif
b0b9dbb1 92 ACLC_QUEUE,
870f6ba8 93 ACLC_RATELIMIT,
8523533c
TK
94 ACLC_RECIPIENTS,
95#ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97#endif
e7568d51 98 ACLC_REMOVE_HEADER,
71fafd95
PH
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
8523533c 102#ifdef WITH_CONTENT_SCAN
8e669ac1 103 ACLC_SPAM,
8523533c 104#endif
7952eef9 105#ifdef SUPPORT_SPF
8523533c 106 ACLC_SPF,
65a7d8c3 107 ACLC_SPF_GUESS,
8523533c 108#endif
b0019c78 109 ACLC_UDPSEND,
8523533c 110 ACLC_VERIFY };
059ec3d9 111
c3611384 112/* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
b0b9dbb1 113"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
c3611384
PH
114modifiers that look like conditions but always return TRUE. They are used for
115their side effects. */
059ec3d9 116
2d009132
JH
117typedef struct condition_def {
118 uschar *name;
c5fcb476 119
2d009132 120/* Flag to indicate the condition/modifier has a string expansion done
059ec3d9
PH
121at the outer level. In the other cases, expansion already occurs in the
122checking functions. */
2d009132 123 BOOL expand_at_top:1;
059ec3d9 124
2d009132 125 BOOL is_modifier:1;
059ec3d9 126
2d009132
JH
127/* Bit map vector of which conditions and modifiers are not allowed at certain
128times. For each condition and modifier, there's a bitmap of dis-allowed times.
129For some, it is easier to specify the negation of a small number of allowed
130times. */
131 unsigned forbids;
132
133} condition_def;
134
135static condition_def conditions[] = {
f2ed27cf 136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
2d009132 137
f2ed27cf
JH
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
141 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
2d009132 142#ifndef DISABLE_PRDR
f2ed27cf 143 (1<<ACL_WHERE_PRDR)|
2d009132 144#endif
f2ed27cf
JH
145 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
146 (1<<ACL_WHERE_DKIM)|
147 (1<<ACL_WHERE_NOTSMTP_START)),
2d009132 148 },
059ec3d9 149
f2ed27cf
JH
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 (1<<ACL_WHERE_NOTSMTP)|
152 (1<<ACL_WHERE_NOTSMTP_START)|
153 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
2d009132 154 },
8523533c 155#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH
156 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
157 (1<<ACL_WHERE_AUTH)|
158 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
159 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
2d009132 160# ifndef DISABLE_PRDR
f2ed27cf 161 (1<<ACL_WHERE_PRDR)|
2d009132 162# endif
f2ed27cf
JH
163 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
164 (1<<ACL_WHERE_MAILAUTH)|
165 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
166 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
167 (1<<ACL_WHERE_NOTSMTP_START),
2d009132 168 },
8e669ac1 169#endif
f2ed27cf
JH
170 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
171 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
2d009132
JH
172
173 /* Certain types of control are always allowed, so we let it through
174 always and check in the control processing itself. */
f2ed27cf 175 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
2d009132 176
6a8f9482 177#ifdef EXPERIMENTAL_DCC
f2ed27cf
JH
178 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
179 (unsigned int)
180 ~((1<<ACL_WHERE_DATA)|
2d009132 181# ifndef DISABLE_PRDR
f2ed27cf 182 (1<<ACL_WHERE_PRDR)|
2d009132 183# endif
f2ed27cf 184 (1<<ACL_WHERE_NOTSMTP)),
2d009132 185 },
6a8f9482 186#endif
8523533c 187#ifdef WITH_CONTENT_SCAN
f2ed27cf 188 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
2d009132 189
8523533c 190#endif
f2ed27cf 191 [ACLC_DELAY] = { US"delay", TRUE, TRUE, (1<<ACL_WHERE_NOTQUIT) },
80a47a2c 192#ifndef DISABLE_DKIM
f2ed27cf
JH
193 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
194 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
fb2274d4 195#endif
4840604e 196#ifdef EXPERIMENTAL_DMARC
f2ed27cf 197 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DATA) },
4840604e 198#endif
059ec3d9 199
2d009132
JH
200 /* Explicit key lookups can be made in non-smtp ACLs so pass
201 always and check in the verify processing itself. */
f2ed27cf 202 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
c3611384 203
f2ed27cf
JH
204 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 (unsigned int)
206 ~((1<<ACL_WHERE_RCPT)
207 |(1<<ACL_WHERE_VRFY)
2d009132 208#ifndef DISABLE_PRDR
f2ed27cf 209 |(1<<ACL_WHERE_PRDR)
2d009132
JH
210#endif
211 ),
212 },
f2ed27cf
JH
213 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
214 (1<<ACL_WHERE_NOTSMTP)|
215 (1<<ACL_WHERE_CONNECT)|
216 (1<<ACL_WHERE_NOTSMTP_START)|
217 (1<<ACL_WHERE_HELO),
2d009132 218 },
8e669ac1 219
f2ed27cf 220 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
8e669ac1 221
f2ed27cf
JH
222 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
223 (1<<ACL_WHERE_NOTSMTP)|
224 (1<<ACL_WHERE_NOTSMTP_START),
2d009132 225 },
f2ed27cf
JH
226 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
227 (unsigned int)
228 ~((1<<ACL_WHERE_RCPT)
229 |(1<<ACL_WHERE_VRFY)
230#ifndef DISABLE_PRDR
231 |(1<<ACL_WHERE_PRDR)
232#endif
2d009132
JH
233 ),
234 },
6a8f9482 235
f2ed27cf
JH
236 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
237 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
238 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
8523533c 239
2d009132 240#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
241 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
242 (unsigned int)
243 ~((1<<ACL_WHERE_DATA)|
2d009132 244# ifndef DISABLE_PRDR
f2ed27cf 245 (1<<ACL_WHERE_PRDR)|
2d009132 246# endif
f2ed27cf 247 (1<<ACL_WHERE_NOTSMTP)),
2d009132
JH
248 },
249#endif
8e669ac1 250
f2ed27cf 251 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
2d009132 252#ifdef WITH_CONTENT_SCAN
f2ed27cf 253 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
2d009132 254#endif
84330b7b 255
f2ed27cf
JH
256 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
257 (1<<ACL_WHERE_NOTSMTP)|
2d009132 258#ifndef DISABLE_PRDR
f2ed27cf 259 (1<<ACL_WHERE_PRDR)|
2d009132 260#endif
f2ed27cf 261 (1<<ACL_WHERE_DATA),
2d009132 262 },
fb2274d4 263
f2ed27cf
JH
264 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
265 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~(1<<ACL_WHERE_RCPT) },
4840604e 266
2d009132 267#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
268 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
269 (unsigned int)
270 ~((1<<ACL_WHERE_DATA)|
2d009132 271# ifndef DISABLE_PRDR
f2ed27cf 272 (1<<ACL_WHERE_PRDR)|
2d009132 273# endif
f2ed27cf
JH
274 (1<<ACL_WHERE_NOTSMTP)|
275 (1<<ACL_WHERE_MIME)),
2d009132 276 },
379ba7d0 277
2d009132 278#endif
f2ed27cf
JH
279 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
280 (unsigned int)
281 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
282 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
2d009132 283#ifndef DISABLE_PRDR
f2ed27cf 284 (1<<ACL_WHERE_PRDR)|
2d009132 285#endif
f2ed27cf
JH
286 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
287 (1<<ACL_WHERE_NOTSMTP_START)),
2d009132 288 },
f2ed27cf
JH
289 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
290 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
291 (1<<ACL_WHERE_HELO)|
292 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
293 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
294 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
2d009132 295 },
f2ed27cf
JH
296 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
297 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
298 (1<<ACL_WHERE_HELO)|
299 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
300 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
301 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
2d009132 302 },
65a7d8c3 303
f2ed27cf 304 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
8523533c 305
2d009132 306#ifdef WITH_CONTENT_SCAN
f2ed27cf
JH
307 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
308 (unsigned int) ~((1<<ACL_WHERE_DATA)|
2d009132 309# ifndef DISABLE_PRDR
f2ed27cf 310 (1<<ACL_WHERE_PRDR)|
2d009132 311# endif
f2ed27cf 312 (1<<ACL_WHERE_NOTSMTP)),
2d009132
JH
313 },
314#endif
7952eef9 315#ifdef SUPPORT_SPF
f2ed27cf
JH
316 [ACLC_SPF] = { US"spf", TRUE, FALSE,
317 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
318 (1<<ACL_WHERE_HELO)|
319 (1<<ACL_WHERE_MAILAUTH)|
320 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
321 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
322 (1<<ACL_WHERE_NOTSMTP)|
323 (1<<ACL_WHERE_NOTSMTP_START),
2d009132 324 },
6e1a8743 325 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
f2ed27cf
JH
326 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
327 (1<<ACL_WHERE_HELO)|
328 (1<<ACL_WHERE_MAILAUTH)|
329 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
330 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
331 (1<<ACL_WHERE_NOTSMTP)|
332 (1<<ACL_WHERE_NOTSMTP_START),
2d009132
JH
333 },
334#endif
f2ed27cf 335 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
b0019c78 336
059ec3d9
PH
337 /* Certain types of verify are always allowed, so we let it through
338 always and check in the verify function itself */
f2ed27cf 339 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
059ec3d9
PH
340};
341
342
2d009132 343
d7bed771
JH
344/* Return values from decode_control(); used as index so keep in step
345with the controls_list table that follows! */
c46782ef 346
d7bed771
JH
347enum {
348 CONTROL_AUTH_UNADVERTISED,
3c8b3577 349#ifdef EXPERIMENTAL_BRIGHTMAIL
d7bed771 350 CONTROL_BMI_RUN,
3c8b3577 351#endif
d7bed771
JH
352 CONTROL_CASEFUL_LOCAL_PART,
353 CONTROL_CASELOWER_LOCAL_PART,
354 CONTROL_CUTTHROUGH_DELIVERY,
355 CONTROL_DEBUG,
3c8b3577 356#ifndef DISABLE_DKIM
d7bed771 357 CONTROL_DKIM_VERIFY,
3c8b3577 358#endif
3c8b3577 359#ifdef EXPERIMENTAL_DMARC
d7bed771
JH
360 CONTROL_DMARC_VERIFY,
361 CONTROL_DMARC_FORENSIC,
3c8b3577 362#endif
d7bed771
JH
363 CONTROL_DSCP,
364 CONTROL_ENFORCE_SYNC,
365 CONTROL_ERROR, /* pseudo-value for decode errors */
366 CONTROL_FAKEDEFER,
367 CONTROL_FAKEREJECT,
368 CONTROL_FREEZE,
4840604e 369
d7bed771
JH
370 CONTROL_NO_CALLOUT_FLUSH,
371 CONTROL_NO_DELAY_FLUSH,
372 CONTROL_NO_ENFORCE_SYNC,
3c8b3577 373#ifdef WITH_CONTENT_SCAN
d7bed771 374 CONTROL_NO_MBOX_UNSPOOL,
3c8b3577 375#endif
d7bed771
JH
376 CONTROL_NO_MULTILINE,
377 CONTROL_NO_PIPELINING,
8523533c 378
d7bed771
JH
379 CONTROL_QUEUE_ONLY,
380 CONTROL_SUBMISSION,
381 CONTROL_SUPPRESS_LOCAL_FIXUPS,
8c5d388a 382#ifdef SUPPORT_I18N
d7bed771 383 CONTROL_UTF8_DOWNCONVERT,
3c8b3577 384#endif
d7bed771 385};
3c8b3577 386
4c590bd1 387
c5fcb476 388
d7bed771
JH
389/* Structure listing various control arguments, with their characteristics.
390For each control, there's a bitmap of dis-allowed times. For some, it is easier
391to specify the negation of a small number of allowed times. */
059ec3d9
PH
392
393typedef struct control_def {
d7bed771
JH
394 uschar *name;
395 BOOL has_option; /* Has /option(s) following */
396 unsigned forbids; /* bitmap of dis-allowed times */
059ec3d9
PH
397} control_def;
398
399static control_def controls_list[] = {
f2ed27cf
JH
400 /* name has_option forbids */
401[CONTROL_AUTH_UNADVERTISED] =
d7bed771 402 { US"allow_auth_unadvertised", FALSE,
f2ed27cf
JH
403 (unsigned)
404 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
d7bed771 405 },
8523533c 406#ifdef EXPERIMENTAL_BRIGHTMAIL
f2ed27cf
JH
407[CONTROL_BMI_RUN] =
408 { US"bmi_run", FALSE, 0 },
8523533c 409#endif
f2ed27cf 410[CONTROL_CASEFUL_LOCAL_PART] =
d7bed771 411 { US"caseful_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
f2ed27cf 412[CONTROL_CASELOWER_LOCAL_PART] =
d7bed771 413 { US"caselower_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
f2ed27cf
JH
414[CONTROL_CUTTHROUGH_DELIVERY] =
415 { US"cutthrough_delivery", TRUE, 0 },
416[CONTROL_DEBUG] =
417 { US"debug", TRUE, 0 },
d7bed771 418
80a47a2c 419#ifndef DISABLE_DKIM
f2ed27cf 420[CONTROL_DKIM_VERIFY] =
d7bed771 421 { US"dkim_disable_verify", FALSE,
f2ed27cf 422 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
d7bed771 423# ifndef DISABLE_PRDR
f2ed27cf 424 (1<<ACL_WHERE_PRDR)|
d7bed771 425# endif
f2ed27cf 426 (1<<ACL_WHERE_NOTSMTP_START)
d7bed771 427 },
f7572e5a 428#endif
d7bed771 429
4840604e 430#ifdef EXPERIMENTAL_DMARC
9904d08c 431[CONTROL_DMARC_VERIFY] =
d7bed771 432 { US"dmarc_disable_verify", FALSE,
f2ed27cf 433 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771 434 },
9904d08c 435[CONTROL_DMARC_FORENSIC] =
d7bed771 436 { US"dmarc_enable_forensic", FALSE,
f2ed27cf 437 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771
JH
438 },
439#endif
440
f2ed27cf 441[CONTROL_DSCP] =
d7bed771 442 { US"dscp", TRUE,
f2ed27cf 443 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
d7bed771 444 },
f2ed27cf 445[CONTROL_ENFORCE_SYNC] =
d7bed771 446 { US"enforce_sync", FALSE,
f2ed27cf 447 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771
JH
448 },
449
450 /* Pseudo-value for decode errors */
f2ed27cf 451[CONTROL_ERROR] =
d7bed771
JH
452 { US"error", FALSE, 0 },
453
f2ed27cf 454[CONTROL_FAKEDEFER] =
d7bed771 455 { US"fakedefer", TRUE,
f2ed27cf
JH
456 (unsigned)
457 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
458 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
d7bed771 459#ifndef DISABLE_PRDR
f2ed27cf 460 (1<<ACL_WHERE_PRDR)|
d7bed771 461#endif
f2ed27cf 462 (1<<ACL_WHERE_MIME))
d7bed771 463 },
f2ed27cf 464[CONTROL_FAKEREJECT] =
d7bed771 465 { US"fakereject", TRUE,
f2ed27cf
JH
466 (unsigned)
467 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
468 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
d7bed771 469#ifndef DISABLE_PRDR
f2ed27cf 470 (1<<ACL_WHERE_PRDR)|
d7bed771 471#endif
f2ed27cf 472 (1<<ACL_WHERE_MIME))
d7bed771 473 },
f2ed27cf 474[CONTROL_FREEZE] =
d7bed771 475 { US"freeze", TRUE,
f2ed27cf
JH
476 (unsigned)
477 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
478 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
479 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
480 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
d7bed771
JH
481 },
482
f2ed27cf 483[CONTROL_NO_CALLOUT_FLUSH] =
d7bed771 484 { US"no_callout_flush", FALSE,
f2ed27cf 485 (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
d7bed771 486 },
f2ed27cf 487[CONTROL_NO_DELAY_FLUSH] =
d7bed771 488 { US"no_delay_flush", FALSE,
f2ed27cf 489 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771
JH
490 },
491
f2ed27cf 492[CONTROL_NO_ENFORCE_SYNC] =
d7bed771 493 { US"no_enforce_sync", FALSE,
f2ed27cf 494 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771 495 },
8523533c 496#ifdef WITH_CONTENT_SCAN
f2ed27cf 497[CONTROL_NO_MBOX_UNSPOOL] =
d7bed771 498 { US"no_mbox_unspool", FALSE,
f2ed27cf
JH
499 (unsigned)
500 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
501 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
502 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
503 (1<<ACL_WHERE_MIME))
d7bed771
JH
504 },
505#endif
f2ed27cf 506[CONTROL_NO_MULTILINE] =
d7bed771 507 { US"no_multiline_responses", FALSE,
f2ed27cf 508 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771 509 },
f2ed27cf 510[CONTROL_NO_PIPELINING] =
d7bed771 511 { US"no_pipelining", FALSE,
f2ed27cf 512 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
d7bed771
JH
513 },
514
f2ed27cf 515[CONTROL_QUEUE_ONLY] =
d7bed771 516 { US"queue_only", FALSE,
f2ed27cf
JH
517 (unsigned)
518 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
519 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
520 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
521 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
d7bed771 522 },
f2ed27cf 523[CONTROL_SUBMISSION] =
d7bed771 524 { US"submission", TRUE,
f2ed27cf
JH
525 (unsigned)
526 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
d7bed771 527 },
f2ed27cf 528[CONTROL_SUPPRESS_LOCAL_FIXUPS] =
d7bed771
JH
529 { US"suppress_local_fixups", FALSE,
530 (unsigned)
531 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
532 (1<<ACL_WHERE_NOTSMTP_START))
533 },
8c5d388a 534#ifdef SUPPORT_I18N
f2ed27cf 535[CONTROL_UTF8_DOWNCONVERT] =
d7bed771 536 { US"utf8_downconvert", TRUE, 0 }
3c8b3577 537#endif
d7bed771 538};
059ec3d9 539
e5a9dba6
PH
540/* Support data structures for Client SMTP Authorization. acl_verify_csa()
541caches its result in a tree to avoid repeated DNS queries. The result is an
542integer code which is used as an index into the following tables of
543explanatory strings and verification return codes. */
544
545static tree_node *csa_cache = NULL;
546
547enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
548 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
549
550/* The acl_verify_csa() return code is translated into an acl_verify() return
551code using the following table. It is OK unless the client is definitely not
552authorized. This is because CSA is supposed to be optional for sending sites,
553so recipients should not be too strict about checking it - especially because
554DNS problems are quite likely to occur. It's possible to use $csa_status in
555further ACL conditions to distinguish ok, unknown, and defer if required, but
556the aim is to make the usual configuration simple. */
557
558static int csa_return_code[] = {
f2ed27cf
JH
559 [CSA_UNKNOWN] = OK,
560 [CSA_OK] = OK,
561 [CSA_DEFER_SRV] = OK,
562 [CSA_DEFER_ADDR] = OK,
563 [CSA_FAIL_EXPLICIT] = FAIL,
564 [CSA_FAIL_DOMAIN] = FAIL,
565 [CSA_FAIL_NOADDR] = FAIL,
566 [CSA_FAIL_MISMATCH] = FAIL
e5a9dba6
PH
567};
568
569static uschar *csa_status_string[] = {
f2ed27cf
JH
570 [CSA_UNKNOWN] = US"unknown",
571 [CSA_OK] = US"ok",
572 [CSA_DEFER_SRV] = US"defer",
573 [CSA_DEFER_ADDR] = US"defer",
574 [CSA_FAIL_EXPLICIT] = US"fail",
575 [CSA_FAIL_DOMAIN] = US"fail",
576 [CSA_FAIL_NOADDR] = US"fail",
577 [CSA_FAIL_MISMATCH] = US"fail"
e5a9dba6
PH
578};
579
580static uschar *csa_reason_string[] = {
f2ed27cf
JH
581 [CSA_UNKNOWN] = US"unknown",
582 [CSA_OK] = US"ok",
583 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
584 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
585 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
586 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
587 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
588 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
e5a9dba6
PH
589};
590
c99ce5c9
TF
591/* Options for the ratelimit condition. Note that there are two variants of
592the per_rcpt option, depending on the ACL that is used to measure the rate.
593However any ACL must be able to look up per_rcpt rates in /noupdate mode,
594so the two variants must have the same internal representation as well as
595the same configuration string. */
596
597enum {
598 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
599 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
600};
601
602#define RATE_SET(var,new) \
603 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
604
605static uschar *ratelimit_option_string[] = {
f2ed27cf
JH
606 [RATE_PER_WHAT] = US"?",
607 [RATE_PER_CLASH] = US"!",
608 [RATE_PER_ADDR] = US"per_addr",
609 [RATE_PER_BYTE] = US"per_byte",
610 [RATE_PER_CMD] = US"per_cmd",
611 [RATE_PER_CONN] = US"per_conn",
612 [RATE_PER_MAIL] = US"per_mail",
613 [RATE_PER_RCPT] = US"per_rcpt",
614 [RATE_PER_ALLRCPTS] = US"per_rcpt"
c99ce5c9
TF
615};
616
059ec3d9
PH
617/* Enable recursion between acl_check_internal() and acl_check_condition() */
618
e1d04f48 619static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
f60d98e8 620 uschar **);
059ec3d9
PH
621
622
623/*************************************************
d7bed771
JH
624* Find control in list *
625*************************************************/
626
627/* The lists are always in order, so binary chop can be used.
628
629Arguments:
630 name the control name to search for
631 ol the first entry in the control list
632 last one more than the offset of the last entry in the control list
633
634Returns: index of a control entry, or -1 if not found
635*/
636
637static int
638find_control(const uschar * name, control_def * ol, int last)
639{
640int first = 0;
641while (last > first)
642 {
643 int middle = (first + last)/2;
644 uschar * s = ol[middle].name;
645 int c = Ustrncmp(name, s, Ustrlen(s));
646 if (c == 0) return middle;
647 else if (c > 0) first = middle + 1;
648 else last = middle;
649 }
650return -1;
651}
652
653
654
655/*************************************************
2d009132
JH
656* Pick out condition from list *
657*************************************************/
658
659/* Use a binary chop method
660
661Arguments:
662 name name to find
663 list list of conditions
664 end size of list
665
666Returns: offset in list, or -1 if not found
667*/
668
669static int
670acl_checkcondition(uschar * name, condition_def * list, int end)
671{
672int start = 0;
673while (start < end)
674 {
675 int mid = (start + end)/2;
676 int c = Ustrcmp(name, list[mid].name);
677 if (c == 0) return mid;
678 if (c < 0) end = mid;
679 else start = mid + 1;
680 }
681return -1;
682}
683
684
685/*************************************************
059ec3d9
PH
686* Pick out name from list *
687*************************************************/
688
689/* Use a binary chop method
690
691Arguments:
692 name name to find
693 list list of names
694 end size of list
695
696Returns: offset in list, or -1 if not found
697*/
698
699static int
700acl_checkname(uschar *name, uschar **list, int end)
701{
702int start = 0;
703
704while (start < end)
705 {
706 int mid = (start + end)/2;
707 int c = Ustrcmp(name, list[mid]);
708 if (c == 0) return mid;
709 if (c < 0) end = mid; else start = mid + 1;
710 }
711
712return -1;
713}
714
715
716/*************************************************
717* Read and parse one ACL *
718*************************************************/
719
720/* This function is called both from readconf in order to parse the ACLs in the
721configuration file, and also when an ACL is encountered dynamically (e.g. as
722the result of an expansion). It is given a function to call in order to
723retrieve the lines of the ACL. This function handles skipping comments and
724blank lines (where relevant).
725
726Arguments:
727 func function to get next line of ACL
728 error where to put an error message
729
730Returns: pointer to ACL, or NULL
731 NULL can be legal (empty ACL); in this case error will be NULL
732*/
733
734acl_block *
735acl_read(uschar *(*func)(void), uschar **error)
736{
737acl_block *yield = NULL;
738acl_block **lastp = &yield;
739acl_block *this = NULL;
740acl_condition_block *cond;
741acl_condition_block **condp = NULL;
742uschar *s;
743
744*error = NULL;
745
746while ((s = (*func)()) != NULL)
747 {
748 int v, c;
749 BOOL negated = FALSE;
750 uschar *saveline = s;
751 uschar name[64];
752
753 /* Conditions (but not verbs) are allowed to be negated by an initial
754 exclamation mark. */
755
756 while (isspace(*s)) s++;
757 if (*s == '!')
758 {
759 negated = TRUE;
760 s++;
761 }
762
cf00dad6
PH
763 /* Read the name of a verb or a condition, or the start of a new ACL, which
764 can be started by a name, or by a macro definition. */
059ec3d9
PH
765
766 s = readconf_readname(name, sizeof(name), s);
b8dc3e4a 767 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
059ec3d9
PH
768
769 /* If a verb is unrecognized, it may be another condition or modifier that
770 continues the previous verb. */
771
2d009132 772 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
059ec3d9
PH
773 {
774 if (this == NULL)
775 {
4e167a8c
PH
776 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
777 saveline);
059ec3d9
PH
778 return NULL;
779 }
780 }
781
782 /* New verb */
783
784 else
785 {
786 if (negated)
787 {
788 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
789 return NULL;
790 }
791 this = store_get(sizeof(acl_block));
792 *lastp = this;
793 lastp = &(this->next);
794 this->next = NULL;
795 this->verb = v;
796 this->condition = NULL;
797 condp = &(this->condition);
798 if (*s == 0) continue; /* No condition on this line */
799 if (*s == '!')
800 {
801 negated = TRUE;
802 s++;
803 }
804 s = readconf_readname(name, sizeof(name), s); /* Condition name */
805 }
806
807 /* Handle a condition or modifier. */
808
2d009132 809 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
059ec3d9
PH
810 {
811 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
812 saveline);
813 return NULL;
814 }
815
816 /* The modifiers may not be negated */
817
2d009132 818 if (negated && conditions[c].is_modifier)
059ec3d9
PH
819 {
820 *error = string_sprintf("ACL error: negation is not allowed with "
2d009132 821 "\"%s\"", conditions[c].name);
059ec3d9
PH
822 return NULL;
823 }
824
825 /* ENDPASS may occur only with ACCEPT or DISCARD. */
826
827 if (c == ACLC_ENDPASS &&
828 this->verb != ACL_ACCEPT &&
829 this->verb != ACL_DISCARD)
830 {
831 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
2d009132 832 conditions[c].name, verbs[this->verb]);
059ec3d9
PH
833 return NULL;
834 }
835
836 cond = store_get(sizeof(acl_condition_block));
837 cond->next = NULL;
838 cond->type = c;
839 cond->u.negated = negated;
840
841 *condp = cond;
842 condp = &(cond->next);
843
844 /* The "set" modifier is different in that its argument is "name=value"
845 rather than just a value, and we can check the validity of the name, which
38a0a95f
PH
846 gives us a variable name to insert into the data block. The original ACL
847 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
848 extended to 20 of each type, but after that people successfully argued for
641cb756
PH
849 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
850 After that, we allow alphanumerics and underscores, but the first character
851 after c or m must be a digit or an underscore. This retains backwards
852 compatibility. */
059ec3d9
PH
853
854 if (c == ACLC_SET)
a79d8834
JH
855#ifndef DISABLE_DKIM
856 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
857 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
858 {
859 uschar * endptr = s+18;
860
861 if (isalnum(*endptr))
862 {
863 *error = string_sprintf("invalid variable name after \"set\" in ACL "
864 "modifier \"set %s\" "
865 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
866 s);
867 return NULL;
868 }
869 cond->u.varname = string_copyn(s, 18);
870 s = endptr;
871 while (isspace(*s)) s++;
872 }
873 else
874#endif
059ec3d9 875 {
47ca6d6c
PH
876 uschar *endptr;
877
38a0a95f
PH
878 if (Ustrncmp(s, "acl_c", 5) != 0 &&
879 Ustrncmp(s, "acl_m", 5) != 0)
47ca6d6c 880 {
38a0a95f
PH
881 *error = string_sprintf("invalid variable name after \"set\" in ACL "
882 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
883 return NULL;
47ca6d6c 884 }
38a0a95f
PH
885
886 endptr = s + 5;
641cb756
PH
887 if (!isdigit(*endptr) && *endptr != '_')
888 {
889 *error = string_sprintf("invalid variable name after \"set\" in ACL "
890 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
891 s);
892 return NULL;
893 }
894
38a0a95f 895 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
47ca6d6c 896 {
38a0a95f
PH
897 if (!isalnum(*endptr) && *endptr != '_')
898 {
899 *error = string_sprintf("invalid character \"%c\" in variable name "
900 "in ACL modifier \"set %s\"", *endptr, s);
901 return NULL;
902 }
903 endptr++;
47ca6d6c 904 }
47ca6d6c 905
38a0a95f 906 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
47ca6d6c 907 s = endptr;
059ec3d9
PH
908 while (isspace(*s)) s++;
909 }
910
911 /* For "set", we are now positioned for the data. For the others, only
912 "endpass" has no data */
913
914 if (c != ACLC_ENDPASS)
915 {
916 if (*s++ != '=')
917 {
918 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
2d009132 919 conditions[c].is_modifier ? US"modifier" : US"condition");
059ec3d9
PH
920 return NULL;
921 }
922 while (isspace(*s)) s++;
923 cond->arg = string_copy(s);
924 }
925 }
926
927return yield;
928}
929
930
931
932/*************************************************
71fafd95
PH
933* Set up added header line(s) *
934*************************************************/
935
936/* This function is called by the add_header modifier, and also from acl_warn()
937to implement the now-deprecated way of adding header lines using "message" on a
938"warn" verb. The argument is treated as a sequence of header lines which are
939added to a chain, provided there isn't an identical one already there.
940
941Argument: string of header lines
942Returns: nothing
943*/
944
945static void
55414b25 946setup_header(const uschar *hstring)
71fafd95 947{
55414b25 948const uschar *p, *q;
71fafd95
PH
949int hlen = Ustrlen(hstring);
950
b1b05573
JH
951/* Ignore any leading newlines */
952while (*hstring == '\n') hstring++, hlen--;
71fafd95 953
b1b05573 954/* An empty string does nothing; ensure exactly one final newline. */
71fafd95 955if (hlen <= 0) return;
96f5fe4c 956if (hstring[--hlen] != '\n') /* no newline */
55414b25 957 q = string_sprintf("%s\n", hstring);
96f5fe4c 958else if (hstring[hlen-1] == '\n') /* double newline */
55414b25
JH
959 {
960 uschar * s = string_copy(hstring);
961 while(s[--hlen] == '\n')
962 s[hlen+1] = '\0';
963 q = s;
964 }
965else
966 q = hstring;
71fafd95
PH
967
968/* Loop for multiple header lines, taking care about continuations */
969
55414b25 970for (p = q; *p != 0; )
71fafd95 971 {
55414b25
JH
972 const uschar *s;
973 uschar * hdr;
71fafd95
PH
974 int newtype = htype_add_bot;
975 header_line **hptr = &acl_added_headers;
976
977 /* Find next header line within the string */
978
979 for (;;)
980 {
96f5fe4c 981 q = Ustrchr(q, '\n'); /* we know there was a newline */
71fafd95
PH
982 if (*(++q) != ' ' && *q != '\t') break;
983 }
984
985 /* If the line starts with a colon, interpret the instruction for where to
986 add it. This temporarily sets up a new type. */
987
988 if (*p == ':')
989 {
990 if (strncmpic(p, US":after_received:", 16) == 0)
991 {
992 newtype = htype_add_rec;
993 p += 16;
994 }
995 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
996 {
997 newtype = htype_add_rfc;
998 p += 14;
999 }
1000 else if (strncmpic(p, US":at_start:", 10) == 0)
1001 {
1002 newtype = htype_add_top;
1003 p += 10;
1004 }
1005 else if (strncmpic(p, US":at_end:", 8) == 0)
1006 {
1007 newtype = htype_add_bot;
1008 p += 8;
1009 }
1010 while (*p == ' ' || *p == '\t') p++;
1011 }
1012
1013 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1014 to the front of it. */
1015
1016 for (s = p; s < q - 1; s++)
1017 {
1018 if (*s == ':' || !isgraph(*s)) break;
1019 }
1020
55414b25
JH
1021 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1022 hlen = Ustrlen(hdr);
71fafd95
PH
1023
1024 /* See if this line has already been added */
1025
1026 while (*hptr != NULL)
1027 {
55414b25 1028 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
71fafd95
PH
1029 hptr = &((*hptr)->next);
1030 }
1031
1032 /* Add if not previously present */
1033
1034 if (*hptr == NULL)
1035 {
1036 header_line *h = store_get(sizeof(header_line));
55414b25 1037 h->text = hdr;
71fafd95
PH
1038 h->next = NULL;
1039 h->type = newtype;
1040 h->slen = hlen;
1041 *hptr = h;
1042 hptr = &(h->next);
1043 }
1044
1045 /* Advance for next header line within the string */
1046
1047 p = q;
1048 }
1049}
1050
1051
1052
e7568d51 1053/*************************************************
362145b5
JH
1054* List the added header lines *
1055*************************************************/
1056uschar *
1057fn_hdrs_added(void)
1058{
acec9514 1059gstring * g = NULL;
362145b5
JH
1060header_line * h = acl_added_headers;
1061uschar * s;
1062uschar * cp;
362145b5
JH
1063
1064if (!h) return NULL;
1065
1066do
1067 {
1068 s = h->text;
1069 while ((cp = Ustrchr(s, '\n')) != NULL)
1070 {
1071 if (cp[1] == '\0') break;
1072
1073 /* contains embedded newline; needs doubling */
acec9514
JH
1074 g = string_catn(g, s, cp-s+1);
1075 g = string_catn(g, US"\n", 1);
362145b5
JH
1076 s = cp+1;
1077 }
1078 /* last bit of header */
1079
acec9514
JH
1080/*XXX could we use add_listele? */
1081 g = string_catn(g, s, cp-s+1); /* newline-sep list */
362145b5 1082 }
6d9cfc47 1083while((h = h->next));
362145b5 1084
acec9514
JH
1085g->s[g->ptr - 1] = '\0'; /* overwrite last newline */
1086return g->s;
362145b5
JH
1087}
1088
1089
1090/*************************************************
e7568d51
TL
1091* Set up removed header line(s) *
1092*************************************************/
1093
1094/* This function is called by the remove_header modifier. The argument is
1095treated as a sequence of header names which are added to a colon separated
1096list, provided there isn't an identical one already there.
1097
1098Argument: string of header names
1099Returns: nothing
1100*/
1101
1102static void
55414b25 1103setup_remove_header(const uschar *hnames)
e7568d51
TL
1104{
1105if (*hnames != 0)
55414b25
JH
1106 acl_removed_headers = acl_removed_headers
1107 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1108 : string_copy(hnames);
e7568d51
TL
1109}
1110
1111
71fafd95
PH
1112
1113/*************************************************
059ec3d9
PH
1114* Handle warnings *
1115*************************************************/
1116
1117/* This function is called when a WARN verb's conditions are true. It adds to
1118the message's headers, and/or writes information to the log. In each case, this
1119only happens once (per message for headers, per connection for log).
1120
71fafd95
PH
1121** NOTE: The header adding action using the "message" setting is historic, and
1122its use is now deprecated. The new add_header modifier should be used instead.
1123
059ec3d9
PH
1124Arguments:
1125 where ACL_WHERE_xxxx indicating which ACL this is
1126 user_message message for adding to headers
1127 log_message message for logging, if different
1128
1129Returns: nothing
1130*/
1131
1132static void
1133acl_warn(int where, uschar *user_message, uschar *log_message)
1134{
059ec3d9
PH
1135if (log_message != NULL && log_message != user_message)
1136 {
1137 uschar *text;
1138 string_item *logged;
1139
1140 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1141 string_printing(log_message));
1142
1143 /* If a sender verification has failed, and the log message is "sender verify
1144 failed", add the failure message. */
1145
1146 if (sender_verified_failed != NULL &&
1147 sender_verified_failed->message != NULL &&
1148 strcmpic(log_message, US"sender verify failed") == 0)
1149 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1150
9c7a242c
PH
1151 /* Search previously logged warnings. They are kept in malloc
1152 store so they can be freed at the start of a new message. */
059ec3d9
PH
1153
1154 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1155 if (Ustrcmp(logged->text, text) == 0) break;
1156
1157 if (logged == NULL)
1158 {
1159 int length = Ustrlen(text) + 1;
1160 log_write(0, LOG_MAIN, "%s", text);
1161 logged = store_malloc(sizeof(string_item) + length);
5903c6ff 1162 logged->text = US logged + sizeof(string_item);
059ec3d9
PH
1163 memcpy(logged->text, text, length);
1164 logged->next = acl_warn_logged;
1165 acl_warn_logged = logged;
1166 }
1167 }
1168
1169/* If there's no user message, we are done. */
1170
1171if (user_message == NULL) return;
1172
1173/* If this isn't a message ACL, we can't do anything with a user message.
1174Log an error. */
1175
1176if (where > ACL_WHERE_NOTSMTP)
1177 {
1178 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1179 "found in a non-message (%s) ACL: cannot specify header lines here: "
1180 "message ignored", acl_wherenames[where]);
1181 return;
1182 }
1183
71fafd95
PH
1184/* The code for setting up header lines is now abstracted into a separate
1185function so that it can be used for the add_header modifier as well. */
059ec3d9 1186
71fafd95 1187setup_header(user_message);
059ec3d9
PH
1188}
1189
1190
1191
1192/*************************************************
1193* Verify and check reverse DNS *
1194*************************************************/
1195
1196/* Called from acl_verify() below. We look up the host name(s) of the client IP
1197address if this has not yet been done. The host_name_lookup() function checks
1198that one of these names resolves to an address list that contains the client IP
1199address, so we don't actually have to do the check here.
1200
1201Arguments:
1202 user_msgptr pointer for user message
1203 log_msgptr pointer for log message
1204
1205Returns: OK verification condition succeeded
1206 FAIL verification failed
1207 DEFER there was a problem verifying
1208*/
1209
1210static int
1211acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1212{
1213int rc;
1214
1215user_msgptr = user_msgptr; /* stop compiler warning */
1216
1217/* Previous success */
1218
1219if (sender_host_name != NULL) return OK;
1220
1221/* Previous failure */
1222
1223if (host_lookup_failed)
1224 {
1225 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1226 return FAIL;
1227 }
1228
1229/* Need to do a lookup */
1230
1231HDEBUG(D_acl)
e1d04f48 1232 debug_printf_indent("looking up host name to force name/address consistency check\n");
059ec3d9
PH
1233
1234if ((rc = host_name_lookup()) != OK)
1235 {
1236 *log_msgptr = (rc == DEFER)?
1237 US"host lookup deferred for reverse lookup check"
1238 :
1239 string_sprintf("host lookup failed for reverse lookup check%s",
1240 host_lookup_msg);
1241 return rc; /* DEFER or FAIL */
1242 }
1243
1244host_build_sender_fullhost();
1245return OK;
1246}
1247
1248
1249
1250/*************************************************
e5a9dba6
PH
1251* Check client IP address matches CSA target *
1252*************************************************/
1253
1254/* Called from acl_verify_csa() below. This routine scans a section of a DNS
1255response for address records belonging to the CSA target hostname. The section
1256is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1257If one of the addresses matches the client's IP address, then the client is
1258authorized by CSA. If there are target IP addresses but none of them match
1259then the client is using an unauthorized IP address. If there are no target IP
1260addresses then the client cannot be using an authorized IP address. (This is
1261an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1262
1263Arguments:
1264 dnsa the DNS answer block
1265 dnss a DNS scan block for us to use
4c04137d 1266 reset option specifying what portion to scan, as described above
e5a9dba6
PH
1267 target the target hostname to use for matching RR names
1268
1269Returns: CSA_OK successfully authorized
1270 CSA_FAIL_MISMATCH addresses found but none matched
1271 CSA_FAIL_NOADDR no target addresses found
1272*/
1273
1274static int
1275acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1276 uschar *target)
1277{
1278dns_record *rr;
1279dns_address *da;
1280
1281BOOL target_found = FALSE;
1282
1283for (rr = dns_next_rr(dnsa, dnss, reset);
1284 rr != NULL;
1285 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1286 {
1287 /* Check this is an address RR for the target hostname. */
1288
1289 if (rr->type != T_A
1290 #if HAVE_IPV6
1291 && rr->type != T_AAAA
e5a9dba6
PH
1292 #endif
1293 ) continue;
1294
1295 if (strcmpic(target, rr->name) != 0) continue;
1296
1297 target_found = TRUE;
1298
1299 /* Turn the target address RR into a list of textual IP addresses and scan
1300 the list. There may be more than one if it is an A6 RR. */
1301
1302 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1303 {
1304 /* If the client IP address matches the target IP address, it's good! */
1305
e1d04f48 1306 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
e5a9dba6
PH
1307
1308 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1309 }
1310 }
1311
1312/* If we found some target addresses but none of them matched, the client is
1313using an unauthorized IP address, otherwise the target has no authorized IP
1314addresses. */
1315
1316if (target_found) return CSA_FAIL_MISMATCH;
1317else return CSA_FAIL_NOADDR;
1318}
1319
1320
1321
1322/*************************************************
1323* Verify Client SMTP Authorization *
1324*************************************************/
1325
1326/* Called from acl_verify() below. This routine calls dns_lookup_special()
1327to find the CSA SRV record corresponding to the domain argument, or
1328$sender_helo_name if no argument is provided. It then checks that the
1329client is authorized, and that its IP address corresponds to the SRV
1330target's address by calling acl_verify_csa_address() above. The address
1331should have been returned in the DNS response's ADDITIONAL section, but if
1332not we perform another DNS lookup to get it.
1333
1334Arguments:
1335 domain pointer to optional parameter following verify = csa
1336
1337Returns: CSA_UNKNOWN no valid CSA record found
1338 CSA_OK successfully authorized
1339 CSA_FAIL_* client is definitely not authorized
1340 CSA_DEFER_* there was a DNS problem
1341*/
1342
1343static int
55414b25 1344acl_verify_csa(const uschar *domain)
e5a9dba6
PH
1345{
1346tree_node *t;
55414b25 1347const uschar *found;
e5a9dba6
PH
1348int priority, weight, port;
1349dns_answer dnsa;
1350dns_scan dnss;
1351dns_record *rr;
1352int rc, type;
1353uschar target[256];
1354
1355/* Work out the domain we are using for the CSA lookup. The default is the
1356client's HELO domain. If the client has not said HELO, use its IP address
1357instead. If it's a local client (exim -bs), CSA isn't applicable. */
1358
1359while (isspace(*domain) && *domain != '\0') ++domain;
1360if (*domain == '\0') domain = sender_helo_name;
1361if (domain == NULL) domain = sender_host_address;
1362if (sender_host_address == NULL) return CSA_UNKNOWN;
1363
1364/* If we have an address literal, strip off the framing ready for turning it
1365into a domain. The framing consists of matched square brackets possibly
1366containing a keyword and a colon before the actual IP address. */
1367
1368if (domain[0] == '[')
1369 {
55414b25 1370 const uschar *start = Ustrchr(domain, ':');
e5a9dba6
PH
1371 if (start == NULL) start = domain;
1372 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1373 }
1374
1375/* Turn domains that look like bare IP addresses into domains in the reverse
1376DNS. This code also deals with address literals and $sender_host_address. It's
1377not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1378address literals, but it's probably the most friendly thing to do. This is an
1379extension to CSA, so we allow it to be turned off for proper conformance. */
1380
7e66e54d 1381if (string_is_ip_address(domain, NULL) != 0)
e5a9dba6
PH
1382 {
1383 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1384 dns_build_reverse(domain, target);
1385 domain = target;
1386 }
1387
1388/* Find out if we've already done the CSA check for this domain. If we have,
1389return the same result again. Otherwise build a new cached result structure
1390for this domain. The name is filled in now, and the value is filled in when
1391we return from this function. */
1392
1393t = tree_search(csa_cache, domain);
1394if (t != NULL) return t->data.val;
1395
1396t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1397Ustrcpy(t->name, domain);
1398(void)tree_insertnode(&csa_cache, t);
1399
1400/* Now we are ready to do the actual DNS lookup(s). */
1401
28e6ef29 1402found = domain;
e5a9dba6
PH
1403switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1404 {
1405 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1406
1407 default:
1408 return t->data.val = CSA_DEFER_SRV;
1409
1410 /* If we found nothing, the client's authorization is unknown. */
1411
1412 case DNS_NOMATCH:
1413 case DNS_NODATA:
1414 return t->data.val = CSA_UNKNOWN;
1415
1416 /* We got something! Go on to look at the reply in more detail. */
1417
1418 case DNS_SUCCEED:
1419 break;
1420 }
1421
1422/* Scan the reply for well-formed CSA SRV records. */
1423
1424for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
dd708fd7
JH
1425 rr;
1426 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
e5a9dba6 1427 {
dd708fd7 1428 const uschar * p = rr->data;
e5a9dba6
PH
1429
1430 /* Extract the numerical SRV fields (p is incremented) */
1431
e5a9dba6
PH
1432 GETSHORT(priority, p);
1433 GETSHORT(weight, p);
1434 GETSHORT(port, p);
1435
1436 DEBUG(D_acl)
e1d04f48 1437 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
e5a9dba6
PH
1438
1439 /* Check the CSA version number */
1440
1441 if (priority != 1) continue;
1442
1443 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1444 found by dns_special_lookup() is a parent of the one we asked for), we check
1445 the subdomain assertions in the port field. At the moment there's only one
1446 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1447 SRV records of their own. */
1448
1dc92d5a 1449 if (Ustrcmp(found, domain) != 0)
dd708fd7 1450 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
e5a9dba6
PH
1451
1452 /* This CSA SRV record refers directly to our domain, so we check the value
1453 in the weight field to work out the domain's authorization. 0 and 1 are
1454 unauthorized; 3 means the client is authorized but we can't check the IP
1455 address in order to authenticate it, so we treat it as unknown; values
1456 greater than 3 are undefined. */
1457
1458 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1459
1460 if (weight > 2) continue;
1461
1462 /* Weight == 2, which means the domain is authorized. We must check that the
1463 client's IP address is listed as one of the SRV target addresses. Save the
1464 target hostname then break to scan the additional data for its addresses. */
1465
1466 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1467 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1468
e1d04f48 1469 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
e5a9dba6
PH
1470
1471 break;
1472 }
1473
1474/* If we didn't break the loop then no appropriate records were found. */
1475
1476if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1477
1478/* Do not check addresses if the target is ".", in accordance with RFC 2782.
1479A target of "." indicates there are no valid addresses, so the client cannot
1480be authorized. (This is an odd configuration because weight=2 target=. is
1481equivalent to weight=1, but we check for it in order to keep load off the
1482root name servers.) Note that dn_expand() turns "." into "". */
1483
1484if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1485
1486/* Scan the additional section of the CSA SRV reply for addresses belonging
1487to the target. If the name server didn't return any additional data (e.g.
1488because it does not fully support SRV records), we need to do another lookup
1489to obtain the target addresses; otherwise we have a definitive result. */
1490
1491rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1492if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1493
1494/* The DNS lookup type corresponds to the IP version used by the client. */
1495
1496#if HAVE_IPV6
1497if (Ustrchr(sender_host_address, ':') != NULL)
1498 type = T_AAAA;
1499else
1500#endif /* HAVE_IPV6 */
1501 type = T_A;
1502
1503
4e0983dc 1504lookup_dnssec_authenticated = NULL;
e5a9dba6
PH
1505switch (dns_lookup(&dnsa, target, type, NULL))
1506 {
1507 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1508
1509 default:
cc00f4af 1510 return t->data.val = CSA_DEFER_ADDR;
e5a9dba6
PH
1511
1512 /* If the query succeeded, scan the addresses and return the result. */
1513
1514 case DNS_SUCCEED:
cc00f4af
JH
1515 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1516 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1517 /* else fall through */
e5a9dba6
PH
1518
1519 /* If the target has no IP addresses, the client cannot have an authorized
1520 IP address. However, if the target site uses A6 records (not AAAA records)
1521 we have to do yet another lookup in order to check them. */
1522
1523 case DNS_NOMATCH:
1524 case DNS_NODATA:
cc00f4af 1525 return t->data.val = CSA_FAIL_NOADDR;
e5a9dba6
PH
1526 }
1527}
1528
1529
1530
1531/*************************************************
059ec3d9
PH
1532* Handle verification (address & other) *
1533*************************************************/
1534
89583014 1535enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
770747fd
MFM
1536 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1537 VERIFY_HDR_NAMES_ASCII
89583014
JH
1538 };
1539typedef struct {
1540 uschar * name;
1541 int value;
1542 unsigned where_allowed; /* bitmap */
1543 BOOL no_options; /* Never has /option(s) following */
1544 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1545 } verify_type_t;
1546static verify_type_t verify_type_list[] = {
f2ed27cf 1547 /* name value where no-opt opt-sep */
7e8360e6 1548 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
89583014
JH
1549 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1550 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1551 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1552 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1553 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1554 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1555 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1556 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1557 FALSE, 6 },
770747fd
MFM
1558 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1559 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
89583014
JH
1560 };
1561
1562
1563enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1564 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1565 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
57cc2785 1566 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
89583014
JH
1567 };
1568typedef struct {
1569 uschar * name;
1570 int value;
1571 int flag;
1572 BOOL has_option; /* Has =option(s) following */
1573 BOOL timeval; /* Has a time value */
1574 } callout_opt_t;
1575static callout_opt_t callout_opt_list[] = {
f2ed27cf 1576 /* name value flag has-opt has-time */
89583014
JH
1577 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1578 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1579 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1580 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1581 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1582 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1583 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1584 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1585 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1586 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1587 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
57cc2785 1588 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
89583014
JH
1589 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1590 };
1591
1592
1593
059ec3d9
PH
1594/* This function implements the "verify" condition. It is called when
1595encountered in any ACL, because some tests are almost always permitted. Some
1596just don't make sense, and always fail (for example, an attempt to test a host
1597lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1598
1599Arguments:
1600 where where called from
1601 addr the recipient address that the ACL is handling, or NULL
1602 arg the argument of "verify"
1603 user_msgptr pointer for user message
1604 log_msgptr pointer for log message
1605 basic_errno where to put verify errno
1606
1607Returns: OK verification condition succeeded
1608 FAIL verification failed
1609 DEFER there was a problem verifying
1610 ERROR syntax error
1611*/
1612
1613static int
55414b25 1614acl_verify(int where, address_item *addr, const uschar *arg,
059ec3d9
PH
1615 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1616{
1617int sep = '/';
1618int callout = -1;
1619int callout_overall = -1;
4deaf07d 1620int callout_connect = -1;
059ec3d9
PH
1621int verify_options = 0;
1622int rc;
1623BOOL verify_header_sender = FALSE;
1624BOOL defer_ok = FALSE;
1625BOOL callout_defer_ok = FALSE;
1626BOOL no_details = FALSE;
eafd343b 1627BOOL success_on_redirect = FALSE;
059ec3d9
PH
1628address_item *sender_vaddr = NULL;
1629uschar *verify_sender_address = NULL;
1630uschar *pm_mailfrom = NULL;
1631uschar *se_mailfrom = NULL;
596875b3
PH
1632
1633/* Some of the verify items have slash-separated options; some do not. Diagnose
89583014 1634an error if options are given for items that don't expect them.
596875b3
PH
1635*/
1636
1637uschar *slash = Ustrchr(arg, '/');
55414b25 1638const uschar *list = arg;
059ec3d9 1639uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
89583014 1640verify_type_t * vp;
059ec3d9
PH
1641
1642if (ss == NULL) goto BAD_VERIFY;
1643
1644/* Handle name/address consistency verification in a separate function. */
1645
89583014 1646for (vp= verify_type_list;
5903c6ff 1647 CS vp < CS verify_type_list + sizeof(verify_type_list);
89583014
JH
1648 vp++
1649 )
1650 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1651 : strcmpic (ss, vp->name) == 0)
1652 break;
5903c6ff 1653if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
89583014
JH
1654 goto BAD_VERIFY;
1655
1656if (vp->no_options && slash != NULL)
059ec3d9 1657 {
89583014
JH
1658 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1659 "(this verify item has no options)", arg);
1660 return ERROR;
059ec3d9 1661 }
89583014 1662if (!(vp->where_allowed & (1<<where)))
059ec3d9 1663 {
89583014
JH
1664 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1665 return ERROR;
059ec3d9 1666 }
89583014 1667switch(vp->value)
596875b3 1668 {
89583014
JH
1669 case VERIFY_REV_HOST_LKUP:
1670 if (sender_host_address == NULL) return OK;
7e8360e6
JH
1671 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1672 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1673 if (strcmpic(ss, US"defer_ok") == 0)
1674 return OK;
1675 return rc;
059ec3d9 1676
89583014
JH
1677 case VERIFY_CERT:
1678 /* TLS certificate verification is done at STARTTLS time; here we just
1679 test whether it was successful or not. (This is for optional verification; for
1680 mandatory verification, the connection doesn't last this long.) */
e5a9dba6 1681
3703d818
JH
1682 if (tls_in.certificate_verified) return OK;
1683 *user_msgptr = US"no verified certificate";
1684 return FAIL;
e5a9dba6 1685
89583014
JH
1686 case VERIFY_HELO:
1687 /* We can test the result of optional HELO verification that might have
1688 occurred earlier. If not, we can attempt the verification now. */
059ec3d9 1689
3703d818
JH
1690 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1691 return helo_verified? OK : FAIL;
059ec3d9 1692
89583014
JH
1693 case VERIFY_CSA:
1694 /* Do Client SMTP Authorization checks in a separate function, and turn the
1695 result code into user-friendly strings. */
1c41c9cc 1696
3703d818
JH
1697 rc = acl_verify_csa(list);
1698 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
89583014 1699 csa_reason_string[rc]);
3703d818 1700 csa_status = csa_status_string[rc];
e1d04f48 1701 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
3703d818 1702 return csa_return_code[rc];
89583014
JH
1703
1704 case VERIFY_HDR_SYNTAX:
db57e575 1705 /* Check that all relevant header lines have the correct 5322-syntax. If there is
89583014
JH
1706 a syntax error, we return details of the error to the sender if configured to
1707 send out full details. (But a "message" setting on the ACL can override, as
1708 always). */
1709
1710 rc = verify_check_headers(log_msgptr);
3703d818
JH
1711 if (rc != OK && *log_msgptr)
1712 if (smtp_return_error_details)
1713 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1714 else
1715 acl_verify_message = *log_msgptr;
89583014 1716 return rc;
059ec3d9 1717
770747fd
MFM
1718 case VERIFY_HDR_NAMES_ASCII:
1719 /* Check that all header names are true 7 bit strings
1720 See RFC 5322, 2.2. and RFC 6532, 3. */
1721
1722 rc = verify_check_header_names_ascii(log_msgptr);
1723 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1724 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1725 return rc;
1726
89583014
JH
1727 case VERIFY_NOT_BLIND:
1728 /* Check that no recipient of this message is "blind", that is, every envelope
1729 recipient must be mentioned in either To: or Cc:. */
059ec3d9 1730
89583014
JH
1731 rc = verify_check_notblind();
1732 if (rc != OK)
1733 {
1734 *log_msgptr = string_sprintf("bcc recipient detected");
1735 if (smtp_return_error_details)
1736 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1737 }
1738 return rc;
059ec3d9 1739
89583014
JH
1740 /* The remaining verification tests check recipient and sender addresses,
1741 either from the envelope or from the header. There are a number of
1742 slash-separated options that are common to all of them. */
059ec3d9 1743
89583014
JH
1744 case VERIFY_HDR_SNDR:
1745 verify_header_sender = TRUE;
1746 break;
059ec3d9 1747
89583014
JH
1748 case VERIFY_SNDR:
1749 /* In the case of a sender, this can optionally be followed by an address to use
1750 in place of the actual sender (rare special-case requirement). */
059ec3d9 1751 {
89583014
JH
1752 uschar *s = ss + 6;
1753 if (*s == 0)
1754 verify_sender_address = sender_address;
1755 else
1756 {
1757 while (isspace(*s)) s++;
1758 if (*s++ != '=') goto BAD_VERIFY;
1759 while (isspace(*s)) s++;
1760 verify_sender_address = string_copy(s);
1761 }
059ec3d9 1762 }
89583014
JH
1763 break;
1764
1765 case VERIFY_RCPT:
1766 break;
059ec3d9
PH
1767 }
1768
89583014
JH
1769
1770
596875b3
PH
1771/* Remaining items are optional; they apply to sender and recipient
1772verification, including "header sender" verification. */
059ec3d9
PH
1773
1774while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1775 != NULL)
1776 {
1777 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1778 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
eafd343b 1779 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
059ec3d9
PH
1780
1781 /* These two old options are left for backwards compatibility */
1782
1783 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1784 {
1785 callout_defer_ok = TRUE;
1786 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1787 }
1788
1789 else if (strcmpic(ss, US"check_postmaster") == 0)
1790 {
1791 pm_mailfrom = US"";
1792 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1793 }
1794
1795 /* The callout option has a number of sub-options, comma separated */
1796
1797 else if (strncmpic(ss, US"callout", 7) == 0)
1798 {
1799 callout = CALLOUT_TIMEOUT_DEFAULT;
1800 ss += 7;
1801 if (*ss != 0)
1802 {
1803 while (isspace(*ss)) ss++;
1804 if (*ss++ == '=')
1805 {
55414b25 1806 const uschar * sublist = ss;
059ec3d9
PH
1807 int optsep = ',';
1808 uschar *opt;
1809 uschar buffer[256];
55414b25 1810 while (isspace(*sublist)) sublist++;
8e669ac1 1811
57cc2785 1812 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
059ec3d9 1813 {
89583014 1814 callout_opt_t * op;
438257ba 1815 double period = 1.0F;
059ec3d9 1816
89583014 1817 for (op= callout_opt_list; op->name; op++)
438257ba 1818 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
89583014 1819 break;
059ec3d9 1820
89583014
JH
1821 verify_options |= op->flag;
1822 if (op->has_option)
1823 {
438257ba 1824 opt += Ustrlen(op->name);
4deaf07d
PH
1825 while (isspace(*opt)) opt++;
1826 if (*opt++ != '=')
1827 {
1828 *log_msgptr = string_sprintf("'=' expected after "
89583014 1829 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
4deaf07d
PH
1830 return ERROR;
1831 }
1832 while (isspace(*opt)) opt++;
89583014 1833 }
57cc2785 1834 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
89583014 1835 {
57cc2785
JH
1836 *log_msgptr = string_sprintf("bad time value in ACL condition "
1837 "\"verify %s\"", arg);
1838 return ERROR;
89583014
JH
1839 }
1840
1841 switch(op->value)
1842 {
1843 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1844 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1845 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1846 case CALLOUT_MAILFROM:
1847 if (!verify_header_sender)
1848 {
1849 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1850 "callout option only for verify=header_sender (detected in ACL "
1851 "condition \"%s\")", arg);
1852 return ERROR;
1853 }
1854 se_mailfrom = string_copy(opt);
1855 break;
1856 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1857 case CALLOUT_MAXWAIT: callout_overall = period; break;
1858 case CALLOUT_CONNECT: callout_connect = period; break;
1859 case CALLOUT_TIME: callout = period; break;
1860 }
059ec3d9
PH
1861 }
1862 }
1863 else
1864 {
1865 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1866 "ACL condition \"%s\"", arg);
1867 return ERROR;
1868 }
1869 }
1870 }
1871
1872 /* Option not recognized */
1873
1874 else
1875 {
1876 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1877 "condition \"verify %s\"", ss, arg);
1878 return ERROR;
1879 }
1880 }
1881
1882if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1883 (vopt_callout_recipsender|vopt_callout_recippmaster))
1884 {
1885 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1886 "for a recipient callout";
1887 return ERROR;
1888 }
1889
1890/* Handle sender-in-header verification. Default the user message to the log
1891message if giving out verification details. */
1892
1893if (verify_header_sender)
1894 {
8e669ac1 1895 int verrno;
2f682e45
JH
1896
1897 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
fe5b5d0b 1898 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2f682e45 1899 &verrno)) != OK)
8e669ac1 1900 {
fe5b5d0b
PH
1901 *basic_errno = verrno;
1902 if (smtp_return_error_details)
1903 {
2f682e45 1904 if (!*user_msgptr && *log_msgptr)
fe5b5d0b
PH
1905 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1906 if (rc == DEFER) acl_temp_details = TRUE;
1907 }
8e669ac1 1908 }
059ec3d9
PH
1909 }
1910
1911/* Handle a sender address. The default is to verify *the* sender address, but
1912optionally a different address can be given, for special requirements. If the
1913address is empty, we are dealing with a bounce message that has no sender, so
1914we cannot do any checking. If the real sender address gets rewritten during
1915verification (e.g. DNS widening), set the flag to stop it being rewritten again
1916during message reception.
1917
1918A list of verified "sender" addresses is kept to try to avoid doing to much
1919work repetitively when there are multiple recipients in a message and they all
1920require sender verification. However, when callouts are involved, it gets too
1921complicated because different recipients may require different callout options.
1922Therefore, we always do a full sender verify when any kind of callout is
1923specified. Caching elsewhere, for instance in the DNS resolver and in the
1924callout handling, should ensure that this is not terribly inefficient. */
1925
2f682e45 1926else if (verify_sender_address)
059ec3d9 1927 {
2f682e45 1928 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
059ec3d9
PH
1929 {
1930 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1931 "sender verify callout";
1932 return ERROR;
1933 }
1934
1935 sender_vaddr = verify_checked_sender(verify_sender_address);
1936 if (sender_vaddr != NULL && /* Previously checked */
1937 callout <= 0) /* No callout needed this time */
1938 {
1939 /* If the "routed" flag is set, it means that routing worked before, so
1940 this check can give OK (the saved return code value, if set, belongs to a
1941 callout that was done previously). If the "routed" flag is not set, routing
1942 must have failed, so we use the saved return code. */
1943
2f682e45
JH
1944 if (testflag(sender_vaddr, af_verify_routed))
1945 rc = OK;
1946 else
059ec3d9
PH
1947 {
1948 rc = sender_vaddr->special_action;
1949 *basic_errno = sender_vaddr->basic_errno;
1950 }
e1d04f48 1951 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
059ec3d9
PH
1952 }
1953
1954 /* Do a new verification, and cache the result. The cache is used to avoid
1955 verifying the sender multiple times for multiple RCPTs when callouts are not
1956 specified (see comments above).
1957
1958 The cache is also used on failure to give details in response to the first
1959 RCPT that gets bounced for this reason. However, this can be suppressed by
1960 the no_details option, which sets the flag that says "this detail has already
1961 been sent". The cache normally contains just one address, but there may be
1962 more in esoteric circumstances. */
1963
1964 else
1965 {
1966 BOOL routed = TRUE;
2a3eea10 1967 uschar *save_address_data = deliver_address_data;
8e669ac1 1968
059ec3d9 1969 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
8c5d388a 1970#ifdef SUPPORT_I18N
3c8b3577
JH
1971 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1972 {
1973 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1974 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1975 }
f358d5e0 1976#endif
059ec3d9
PH
1977 if (no_details) setflag(sender_vaddr, af_sverify_told);
1978 if (verify_sender_address[0] != 0)
1979 {
1980 /* If this is the real sender address, save the unrewritten version
1981 for use later in receive. Otherwise, set a flag so that rewriting the
1982 sender in verify_address() does not update sender_address. */
1983
1984 if (verify_sender_address == sender_address)
1985 sender_address_unrewritten = sender_address;
1986 else
1987 verify_options |= vopt_fake_sender;
1988
eafd343b
TK
1989 if (success_on_redirect)
1990 verify_options |= vopt_success_on_redirect;
1991
059ec3d9
PH
1992 /* The recipient, qualify, and expn options are never set in
1993 verify_options. */
1994
1995 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
4deaf07d 1996 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
059ec3d9 1997
e1d04f48 1998 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
059ec3d9 1999
2f682e45
JH
2000 if (rc != OK)
2001 *basic_errno = sender_vaddr->basic_errno;
2002 else
2003 DEBUG(D_acl)
2004 {
2005 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
e1d04f48 2006 debug_printf_indent("sender %s verified ok as %s\n",
2f682e45
JH
2007 verify_sender_address, sender_vaddr->address);
2008 else
e1d04f48 2009 debug_printf_indent("sender %s verified ok\n",
2f682e45
JH
2010 verify_sender_address);
2011 }
059ec3d9 2012 }
2f682e45
JH
2013 else
2014 rc = OK; /* Null sender */
059ec3d9
PH
2015
2016 /* Cache the result code */
2017
2018 if (routed) setflag(sender_vaddr, af_verify_routed);
2019 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2020 sender_vaddr->special_action = rc;
2021 sender_vaddr->next = sender_verified_list;
2022 sender_verified_list = sender_vaddr;
8e669ac1
PH
2023
2024 /* Restore the recipient address data, which might have been clobbered by
2a3eea10 2025 the sender verification. */
8e669ac1 2026
2a3eea10 2027 deliver_address_data = save_address_data;
059ec3d9 2028 }
8e669ac1 2029
2a3eea10
PH
2030 /* Put the sender address_data value into $sender_address_data */
2031
d43cbe25 2032 sender_address_data = sender_vaddr->prop.address_data;
059ec3d9
PH
2033 }
2034
2035/* A recipient address just gets a straightforward verify; again we must handle
2036the DEFER overrides. */
2037
2038else
2039 {
2040 address_item addr2;
2041
eafd343b
TK
2042 if (success_on_redirect)
2043 verify_options |= vopt_success_on_redirect;
2044
059ec3d9
PH
2045 /* We must use a copy of the address for verification, because it might
2046 get rewritten. */
2047
2048 addr2 = *addr;
2049 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
4deaf07d 2050 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
e1d04f48 2051 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
8e669ac1 2052
42855d71 2053 *basic_errno = addr2.basic_errno;
059ec3d9 2054 *log_msgptr = addr2.message;
8e669ac1 2055 *user_msgptr = (addr2.user_message != NULL)?
6729cf78 2056 addr2.user_message : addr2.message;
42855d71
PH
2057
2058 /* Allow details for temporary error if the address is so flagged. */
2059 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
059ec3d9
PH
2060
2061 /* Make $address_data visible */
d43cbe25 2062 deliver_address_data = addr2.prop.address_data;
059ec3d9
PH
2063 }
2064
2065/* We have a result from the relevant test. Handle defer overrides first. */
2066
2067if (rc == DEFER && (defer_ok ||
2068 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2069 {
e1d04f48 2070 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
059ec3d9
PH
2071 defer_ok? "defer_ok" : "callout_defer_ok");
2072 rc = OK;
2073 }
2074
2075/* If we've failed a sender, set up a recipient message, and point
2076sender_verified_failed to the address item that actually failed. */
2077
2078if (rc != OK && verify_sender_address != NULL)
2079 {
2080 if (rc != DEFER)
059ec3d9 2081 *log_msgptr = *user_msgptr = US"Sender verify failed";
059ec3d9 2082 else if (*basic_errno != ERRNO_CALLOUTDEFER)
059ec3d9 2083 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
059ec3d9
PH
2084 else
2085 {
2086 *log_msgptr = US"Could not complete sender verify callout";
2087 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2088 *log_msgptr;
2089 }
2090
2091 sender_verified_failed = sender_vaddr;
2092 }
2093
2094/* Verifying an address messes up the values of $domain and $local_part,
2095so reset them before returning if this is a RCPT ACL. */
2096
2097if (addr != NULL)
2098 {
2099 deliver_domain = addr->domain;
2100 deliver_localpart = addr->local_part;
2101 }
2102return rc;
2103
2104/* Syntax errors in the verify argument come here. */
2105
2106BAD_VERIFY:
2107*log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
770747fd
MFM
2108 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2109 "or \"reverse_host_lookup\" at start of ACL condition "
059ec3d9
PH
2110 "\"verify %s\"", arg);
2111return ERROR;
2112}
2113
2114
2115
2116
2117/*************************************************
2118* Check argument for control= modifier *
2119*************************************************/
2120
2121/* Called from acl_check_condition() below
2122
2123Arguments:
2124 arg the argument string for control=
2125 pptr set to point to the terminating character
2126 where which ACL we are in
2127 log_msgptr for error messages
2128
2129Returns: CONTROL_xxx value
2130*/
2131
2132static int
55414b25 2133decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
059ec3d9 2134{
d7bed771
JH
2135int idx, len;
2136control_def * d;
059ec3d9 2137
d7bed771
JH
2138if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2139 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2140 && (!d->has_option || arg[len] != '/')
2141 ) )
059ec3d9
PH
2142 {
2143 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2144 return CONTROL_ERROR;
2145 }
2146
059ec3d9 2147*pptr = arg + len;
d7bed771 2148return idx;
059ec3d9
PH
2149}
2150
2151
2152
c99ce5c9
TF
2153
2154/*************************************************
2155* Return a ratelimit error *
2156*************************************************/
2157
2158/* Called from acl_ratelimit() below
2159
2160Arguments:
2161 log_msgptr for error messages
2162 format format string
2163 ... supplementary arguments
2164 ss ratelimit option name
2165 where ACL_WHERE_xxxx indicating which ACL this is
2166
2167Returns: ERROR
2168*/
2169
2170static int
2171ratelimit_error(uschar **log_msgptr, const char *format, ...)
2172{
2173va_list ap;
2174uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2175va_start(ap, format);
2176if (!string_vformat(buffer, sizeof(buffer), format, ap))
2177 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
ef840681 2178 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
c99ce5c9
TF
2179va_end(ap);
2180*log_msgptr = string_sprintf(
2181 "error in arguments to \"ratelimit\" condition: %s", buffer);
2182return ERROR;
2183}
2184
2185
2186
2187
059ec3d9 2188/*************************************************
870f6ba8
TF
2189* Handle rate limiting *
2190*************************************************/
2191
2192/* Called by acl_check_condition() below to calculate the result
2193of the ACL ratelimit condition.
2194
2195Note that the return value might be slightly unexpected: if the
2196sender's rate is above the limit then the result is OK. This is
2197similar to the dnslists condition, and is so that you can write
2198ACL clauses like: defer ratelimit = 15 / 1h
2199
2200Arguments:
2201 arg the option string for ratelimit=
90fc3069 2202 where ACL_WHERE_xxxx indicating which ACL this is
870f6ba8
TF
2203 log_msgptr for error messages
2204
2205Returns: OK - Sender's rate is above limit
2206 FAIL - Sender's rate is below limit
2207 DEFER - Problem opening ratelimit database
2208 ERROR - Syntax error in options.
2209*/
2210
2211static int
55414b25 2212acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
870f6ba8 2213{
c99ce5c9 2214double limit, period, count;
8f240103
PH
2215uschar *ss;
2216uschar *key = NULL;
c99ce5c9 2217uschar *unique = NULL;
870f6ba8 2218int sep = '/';
c99ce5c9
TF
2219BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2220BOOL noupdate = FALSE, badacl = FALSE;
2221int mode = RATE_PER_WHAT;
870f6ba8
TF
2222int old_pool, rc;
2223tree_node **anchor, *t;
2224open_db dbblock, *dbm;
c99ce5c9 2225int dbdb_size;
870f6ba8 2226dbdata_ratelimit *dbd;
c99ce5c9 2227dbdata_ratelimit_unique *dbdb;
870f6ba8
TF
2228struct timeval tv;
2229
2230/* Parse the first two options and record their values in expansion
2231variables. These variables allow the configuration to have informative
2232error messages based on rate limits obtained from a table lookup. */
2233
c99ce5c9 2234/* First is the maximum number of messages per period / maximum burst
870f6ba8
TF
2235size, which must be greater than or equal to zero. Zero is useful for
2236rate measurement as opposed to rate limiting. */
2237
2238sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2239if (sender_rate_limit == NULL)
96f5fe4c
JH
2240 return ratelimit_error(log_msgptr, "sender rate limit not set");
2241
2242limit = Ustrtod(sender_rate_limit, &ss);
2243if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2244else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2245else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2246
c99ce5c9
TF
2247if (limit < 0.0 || *ss != '\0')
2248 return ratelimit_error(log_msgptr,
2249 "\"%s\" is not a positive number", sender_rate_limit);
870f6ba8 2250
c99ce5c9 2251/* Second is the rate measurement period / exponential smoothing time
870f6ba8
TF
2252constant. This must be strictly greater than zero, because zero leads to
2253run-time division errors. */
2254
2255sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2256if (sender_rate_period == NULL) period = -1.0;
2257else period = readconf_readtime(sender_rate_period, 0, FALSE);
2258if (period <= 0.0)
c99ce5c9
TF
2259 return ratelimit_error(log_msgptr,
2260 "\"%s\" is not a time value", sender_rate_period);
2261
2262/* By default we are counting one of something, but the per_rcpt,
2263per_byte, and count options can change this. */
2264
2265count = 1.0;
870f6ba8 2266
c99ce5c9 2267/* Parse the other options. */
870f6ba8
TF
2268
2269while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2270 != NULL)
2271 {
2272 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2273 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
8f240103 2274 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
c99ce5c9
TF
2275 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2276 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2277 else if (strcmpic(ss, US"per_conn") == 0)
2278 {
2279 RATE_SET(mode, PER_CONN);
2280 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2281 badacl = TRUE;
2282 }
2283 else if (strcmpic(ss, US"per_mail") == 0)
2284 {
2285 RATE_SET(mode, PER_MAIL);
2286 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2287 }
2288 else if (strcmpic(ss, US"per_rcpt") == 0)
2289 {
2290 /* If we are running in the RCPT ACL, then we'll count the recipients
2291 one by one, but if we are running when we have accumulated the whole
2292 list then we'll add them all in one batch. */
2293 if (where == ACL_WHERE_RCPT)
2294 RATE_SET(mode, PER_RCPT);
2295 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2296 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2297 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2298 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2299 }
2300 else if (strcmpic(ss, US"per_byte") == 0)
2301 {
2302 /* If we have not yet received the message data and there was no SIZE
4c04137d 2303 declaration on the MAIL command, then it's safe to just use a value of
c99ce5c9
TF
2304 zero and let the recorded rate decay as if nothing happened. */
2305 RATE_SET(mode, PER_MAIL);
2306 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2307 else count = message_size < 0 ? 0.0 : (double)message_size;
2308 }
2309 else if (strcmpic(ss, US"per_addr") == 0)
2310 {
2311 RATE_SET(mode, PER_RCPT);
438257ba 2312 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
c99ce5c9
TF
2313 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2314 }
2315 else if (strncmpic(ss, US"count=", 6) == 0)
2316 {
2317 uschar *e;
2318 count = Ustrtod(ss+6, &e);
2319 if (count < 0.0 || *e != '\0')
2320 return ratelimit_error(log_msgptr,
2321 "\"%s\" is not a positive number", ss);
2322 }
2323 else if (strncmpic(ss, US"unique=", 7) == 0)
2324 unique = string_copy(ss + 7);
2325 else if (key == NULL)
2326 key = string_copy(ss);
2327 else
2328 key = string_sprintf("%s/%s", key, ss);
870f6ba8
TF
2329 }
2330
c99ce5c9
TF
2331/* Sanity check. When the badacl flag is set the update mode must either
2332be readonly (which is the default if it is omitted) or, for backwards
2333compatibility, a combination of noupdate and strict or leaky. */
2334
2335if (mode == RATE_PER_CLASH)
2336 return ratelimit_error(log_msgptr, "conflicting per_* options");
2337if (leaky + strict + readonly > 1)
2338 return ratelimit_error(log_msgptr, "conflicting update modes");
2339if (badacl && (leaky || strict) && !noupdate)
2340 return ratelimit_error(log_msgptr,
2341 "\"%s\" must not have /leaky or /strict option in %s ACL",
2342 ratelimit_option_string[mode], acl_wherenames[where]);
2343
2344/* Set the default values of any unset options. In readonly mode we
2345perform the rate computation without any increment so that its value
2346decays to eventually allow over-limit senders through. */
2347
2348if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2349if (badacl) readonly = TRUE;
2350if (readonly) count = 0.0;
2351if (!strict && !readonly) leaky = TRUE;
2352if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
870f6ba8 2353
8f240103
PH
2354/* Create the lookup key. If there is no explicit key, use sender_host_address.
2355If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2356omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2357are added to the key because they alter the meaning of the stored data. */
2358
2359if (key == NULL)
2360 key = (sender_host_address == NULL)? US"" : sender_host_address;
870f6ba8 2361
c99ce5c9 2362key = string_sprintf("%s/%s/%s%s",
8f240103 2363 sender_rate_period,
c99ce5c9
TF
2364 ratelimit_option_string[mode],
2365 unique == NULL ? "" : "unique/",
8f240103 2366 key);
870f6ba8 2367
c99ce5c9 2368HDEBUG(D_acl)
e1d04f48 2369 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
870f6ba8 2370
8f240103
PH
2371/* See if we have already computed the rate by looking in the relevant tree.
2372For per-connection rate limiting, store tree nodes and dbdata in the permanent
c99ce5c9
TF
2373pool so that they survive across resets. In readonly mode we only remember the
2374result for the rest of this command in case a later command changes it. After
2375this bit of logic the code is independent of the per_* mode. */
870f6ba8 2376
870f6ba8
TF
2377old_pool = store_pool;
2378
c99ce5c9
TF
2379if (readonly)
2380 anchor = &ratelimiters_cmd;
2381else switch(mode) {
2382case RATE_PER_CONN:
870f6ba8
TF
2383 anchor = &ratelimiters_conn;
2384 store_pool = POOL_PERM;
c99ce5c9
TF
2385 break;
2386case RATE_PER_BYTE:
2387case RATE_PER_MAIL:
2388case RATE_PER_ALLRCPTS:
870f6ba8 2389 anchor = &ratelimiters_mail;
c99ce5c9
TF
2390 break;
2391case RATE_PER_ADDR:
2392case RATE_PER_CMD:
2393case RATE_PER_RCPT:
fe0dab11 2394 anchor = &ratelimiters_cmd;
c99ce5c9
TF
2395 break;
2396default:
3399bb60 2397 anchor = NULL; /* silence an "unused" complaint */
c99ce5c9
TF
2398 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2399 "internal ACL error: unknown ratelimit mode %d", mode);
2400 break;
2401}
870f6ba8 2402
c99ce5c9
TF
2403t = tree_search(*anchor, key);
2404if (t != NULL)
870f6ba8
TF
2405 {
2406 dbd = t->data.ptr;
2407 /* The following few lines duplicate some of the code below. */
8f240103 2408 rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2409 store_pool = old_pool;
2410 sender_rate = string_sprintf("%.1f", dbd->rate);
2411 HDEBUG(D_acl)
e1d04f48 2412 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
870f6ba8
TF
2413 return rc;
2414 }
2415
c99ce5c9
TF
2416/* We aren't using a pre-computed rate, so get a previously recorded rate
2417from the database, which will be updated and written back if required. */
870f6ba8 2418
0a6c178c 2419if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
870f6ba8
TF
2420 {
2421 store_pool = old_pool;
2422 sender_rate = NULL;
e1d04f48 2423 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
870f6ba8
TF
2424 *log_msgptr = US"ratelimit database not available";
2425 return DEFER;
2426 }
c99ce5c9
TF
2427dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2428dbd = NULL;
870f6ba8
TF
2429
2430gettimeofday(&tv, NULL);
2431
c99ce5c9
TF
2432if (dbdb != NULL)
2433 {
2434 /* Locate the basic ratelimit block inside the DB data. */
e1d04f48 2435 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
c99ce5c9
TF
2436 dbd = &dbdb->dbd;
2437
2438 /* Forget the old Bloom filter if it is too old, so that we count each
2439 repeating event once per period. We don't simply clear and re-use the old
2440 filter because we want its size to change if the limit changes. Note that
2441 we keep the dbd pointer for copying the rate into the new data block. */
2442
2443 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2444 {
e1d04f48 2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
c99ce5c9
TF
2446 dbdb = NULL;
2447 }
2448
2449 /* Sanity check. */
2450
2451 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2452 {
e1d04f48 2453 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
c99ce5c9
TF
2454 dbdb = NULL;
2455 }
2456 }
2457
2458/* Allocate a new data block if the database lookup failed
2459or the Bloom filter passed its age limit. */
2460
2461if (dbdb == NULL)
2462 {
2463 if (unique == NULL)
2464 {
2465 /* No Bloom filter. This basic ratelimit block is initialized below. */
e1d04f48 2466 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
c99ce5c9
TF
2467 dbdb_size = sizeof(*dbd);
2468 dbdb = store_get(dbdb_size);
2469 }
2470 else
2471 {
2472 int extra;
e1d04f48 2473 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
c99ce5c9
TF
2474
2475 /* See the long comment below for an explanation of the magic number 2.
2476 The filter has a minimum size in case the rate limit is very small;
2477 this is determined by the definition of dbdata_ratelimit_unique. */
2478
2479 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2480 if (extra < 0) extra = 0;
2481 dbdb_size = sizeof(*dbdb) + extra;
2482 dbdb = store_get(dbdb_size);
2483 dbdb->bloom_epoch = tv.tv_sec;
2484 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2485 memset(dbdb->bloom, 0, dbdb->bloom_size);
2486
2487 /* Preserve any basic ratelimit data (which is our longer-term memory)
2488 by copying it from the discarded block. */
2489
2490 if (dbd != NULL)
2491 {
2492 dbdb->dbd = *dbd;
2493 dbd = &dbdb->dbd;
2494 }
2495 }
2496 }
2497
2498/* If we are counting unique events, find out if this event is new or not.
2499If the client repeats the event during the current period then it should be
2500counted. We skip this code in readonly mode for efficiency, because any
2501changes to the filter will be discarded and because count is already set to
2502zero. */
2503
2504if (unique != NULL && !readonly)
2505 {
2506 /* We identify unique events using a Bloom filter. (You can find my
2507 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2508 With the per_addr option, an "event" is a recipient address, though the
2509 user can use the unique option to define their own events. We only count
2510 an event if we have not seen it before.
2511
2512 We size the filter according to the rate limit, which (in leaky mode)
2513 is the limit on the population of the filter. We allow 16 bits of space
2514 per entry (see the construction code above) and we set (up to) 8 of them
2515 when inserting an element (see the loop below). The probability of a false
2516 positive (an event we have not seen before but which we fail to count) is
2517
2518 size = limit * 16
2519 numhash = 8
2520 allzero = exp(-numhash * pop / size)
2521 = exp(-0.5 * pop / limit)
2522 fpr = pow(1 - allzero, numhash)
2523
2524 For senders at the limit the fpr is 0.06% or 1 in 1700
2525 and for senders at half the limit it is 0.0006% or 1 in 170000
2526
2527 In strict mode the Bloom filter can fill up beyond the normal limit, in
2528 which case the false positive rate will rise. This means that the
2529 measured rate for very fast senders can bogusly drop off after a while.
2530
2531 At twice the limit, the fpr is 2.5% or 1 in 40
2532 At four times the limit, it is 31% or 1 in 3.2
2533
2534 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2535 decay below the limit, and if this is more than one then the Bloom filter
2536 will be discarded before the decay gets that far. The false positive rate
2537 at this threshold is 9.3% or 1 in 10.7. */
2538
2539 BOOL seen;
2540 unsigned n, hash, hinc;
2541 uschar md5sum[16];
2542 md5 md5info;
2543
2544 /* Instead of using eight independent hash values, we combine two values
2545 using the formula h1 + n * h2. This does not harm the Bloom filter's
2546 performance, and means the amount of hash we need is independent of the
2547 number of bits we set in the filter. */
2548
2549 md5_start(&md5info);
2550 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2551 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2552 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2553
2554 /* Scan the bits corresponding to this event. A zero bit means we have
2555 not seen it before. Ensure all bits are set to record this event. */
2556
e1d04f48 2557 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
c99ce5c9
TF
2558
2559 seen = TRUE;
2560 for (n = 0; n < 8; n++, hash += hinc)
2561 {
2562 int bit = 1 << (hash % 8);
2563 int byte = (hash / 8) % dbdb->bloom_size;
2564 if ((dbdb->bloom[byte] & bit) == 0)
2565 {
2566 dbdb->bloom[byte] |= bit;
2567 seen = FALSE;
2568 }
2569 }
2570
2571 /* If this event has occurred before, do not count it. */
2572
2573 if (seen)
2574 {
e1d04f48 2575 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
c99ce5c9
TF
2576 count = 0.0;
2577 }
2578 else
e1d04f48 2579 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
c99ce5c9
TF
2580 }
2581
2582/* If there was no previous ratelimit data block for this key, initialize
2583the new one, otherwise update the block from the database. The initial rate
2584is what would be computed by the code below for an infinite interval. */
2585
870f6ba8
TF
2586if (dbd == NULL)
2587 {
e1d04f48 2588 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
c99ce5c9 2589 dbd = &dbdb->dbd;
870f6ba8
TF
2590 dbd->time_stamp = tv.tv_sec;
2591 dbd->time_usec = tv.tv_usec;
c99ce5c9 2592 dbd->rate = count;
870f6ba8
TF
2593 }
2594else
2595 {
2596 /* The smoothed rate is computed using an exponentially weighted moving
2597 average adjusted for variable sampling intervals. The standard EWMA for
2598 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2599 where f() is the measured value and f'() is the smoothed value.
2600
2601 Old data decays out of the smoothed value exponentially, such that data n
2602 samples old is multiplied by a^n. The exponential decay time constant p
2603 is defined such that data p samples old is multiplied by 1/e, which means
2604 that a = exp(-1/p). We can maintain the same time constant for a variable
2605 sampling interval i by using a = exp(-i/p).
2606
2607 The rate we are measuring is messages per period, suitable for directly
2608 comparing with the limit. The average rate between now and the previous
2609 message is period / interval, which we feed into the EWMA as the sample.
2610
2611 It turns out that the number of messages required for the smoothed rate
2612 to reach the limit when they are sent in a burst is equal to the limit.
2613 This can be seen by analysing the value of the smoothed rate after N
2614 messages sent at even intervals. Let k = (1 - a) * p/i
2615
2616 rate_1 = (1 - a) * p/i + a * rate_0
2617 = k + a * rate_0
2618 rate_2 = k + a * rate_1
2619 = k + a * k + a^2 * rate_0
2620 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2621 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2622 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2623 = rate_0 * a^N + p/i * (1 - a^N)
2624
2625 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2626
2627 rate_N = p/i + (rate_0 - p/i) * a^N
2628 a^N = (rate_N - p/i) / (rate_0 - p/i)
2629 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2630 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2631
2632 Numerical analysis of the above equation, setting the computed rate to
2633 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2634 rates, p/i, the number of messages N = limit. So limit serves as both the
2635 maximum rate measured in messages per period, and the maximum number of
2636 messages that can be sent in a fast burst. */
2637
2638 double this_time = (double)tv.tv_sec
2639 + (double)tv.tv_usec / 1000000.0;
2640 double prev_time = (double)dbd->time_stamp
2641 + (double)dbd->time_usec / 1000000.0;
870f6ba8
TF
2642
2643 /* We must avoid division by zero, and deal gracefully with the clock going
2644 backwards. If we blunder ahead when time is in reverse then the computed
e5d5a95f 2645 rate will be bogus. To be safe we clamp interval to a very small number. */
870f6ba8 2646
e5d5a95f
TF
2647 double interval = this_time - prev_time <= 0.0 ? 1e-9
2648 : this_time - prev_time;
2649
2650 double i_over_p = interval / period;
2651 double a = exp(-i_over_p);
870f6ba8 2652
c99ce5c9
TF
2653 /* Combine the instantaneous rate (period / interval) with the previous rate
2654 using the smoothing factor a. In order to measure sized events, multiply the
2655 instantaneous rate by the count of bytes or recipients etc. */
2656
870f6ba8
TF
2657 dbd->time_stamp = tv.tv_sec;
2658 dbd->time_usec = tv.tv_usec;
c99ce5c9
TF
2659 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2660
2661 /* When events are very widely spaced the computed rate tends towards zero.
2662 Although this is accurate it turns out not to be useful for our purposes,
2663 especially when the first event after a long silence is the start of a spam
2664 run. A more useful model is that the rate for an isolated event should be the
2665 size of the event per the period size, ignoring the lack of events outside
2666 the current period and regardless of where the event falls in the period. So,
2667 if the interval was so long that the calculated rate is unhelpfully small, we
4c04137d 2668 re-initialize the rate. In the absence of higher-rate bursts, the condition
c99ce5c9
TF
2669 below is true if the interval is greater than the period. */
2670
2671 if (dbd->rate < count) dbd->rate = count;
870f6ba8
TF
2672 }
2673
c99ce5c9
TF
2674/* Clients sending at the limit are considered to be over the limit.
2675This matters for edge cases such as a limit of zero, when the client
2676should be completely blocked. */
3348576f 2677
8f240103 2678rc = (dbd->rate < limit)? FAIL : OK;
870f6ba8
TF
2679
2680/* Update the state if the rate is low or if we are being strict. If we
2681are in leaky mode and the sender's rate is too high, we do not update
2682the recorded rate in order to avoid an over-aggressive sender's retry
c99ce5c9
TF
2683rate preventing them from getting any email through. If readonly is set,
2684neither leaky nor strict are set, so we do not do any updates. */
870f6ba8 2685
c99ce5c9 2686if ((rc == FAIL && leaky) || strict)
8f240103 2687 {
c99ce5c9 2688 dbfn_write(dbm, key, dbdb, dbdb_size);
e1d04f48 2689 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
8f240103
PH
2690 }
2691else
2692 {
e1d04f48 2693 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
c99ce5c9 2694 readonly? "readonly mode" : "over the limit, but leaky");
8f240103
PH
2695 }
2696
870f6ba8
TF
2697dbfn_close(dbm);
2698
c99ce5c9 2699/* Store the result in the tree for future reference. */
870f6ba8 2700
c99ce5c9
TF
2701t = store_get(sizeof(tree_node) + Ustrlen(key));
2702t->data.ptr = dbd;
2703Ustrcpy(t->name, key);
2704(void)tree_insertnode(anchor, t);
870f6ba8
TF
2705
2706/* We create the formatted version of the sender's rate very late in
2707order to ensure that it is done using the correct storage pool. */
2708
2709store_pool = old_pool;
2710sender_rate = string_sprintf("%.1f", dbd->rate);
2711
2712HDEBUG(D_acl)
e1d04f48 2713 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
870f6ba8
TF
2714
2715return rc;
2716}
2717
2718
2719
2720/*************************************************
b0019c78
TF
2721* The udpsend ACL modifier *
2722*************************************************/
2723
2724/* Called by acl_check_condition() below.
2725
2726Arguments:
2727 arg the option string for udpsend=
2728 log_msgptr for error messages
2729
2730Returns: OK - Completed.
2731 DEFER - Problem with DNS lookup.
2732 ERROR - Syntax error in options.
2733*/
2734
2735static int
55414b25 2736acl_udpsend(const uschar *arg, uschar **log_msgptr)
b0019c78
TF
2737{
2738int sep = 0;
2739uschar *hostname;
2740uschar *portstr;
2741uschar *portend;
2742host_item *h;
2743int portnum;
b0019c78
TF
2744int len;
2745int r, s;
b1f8e4f8 2746uschar * errstr;
b0019c78
TF
2747
2748hostname = string_nextinlist(&arg, &sep, NULL, 0);
2749portstr = string_nextinlist(&arg, &sep, NULL, 0);
2750
f5d25c2b 2751if (!hostname)
b0019c78 2752 {
217b0e56 2753 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
b0019c78
TF
2754 return ERROR;
2755 }
f5d25c2b 2756if (!portstr)
b0019c78 2757 {
217b0e56 2758 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
b0019c78
TF
2759 return ERROR;
2760 }
f5d25c2b 2761if (!arg)
b0019c78 2762 {
217b0e56 2763 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
b0019c78
TF
2764 return ERROR;
2765 }
2766portnum = Ustrtol(portstr, &portend, 10);
2767if (*portend != '\0')
2768 {
217b0e56 2769 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
b0019c78
TF
2770 return ERROR;
2771 }
2772
2773/* Make a single-item host list. */
2774h = store_get(sizeof(host_item));
2775memset(h, 0, sizeof(host_item));
2776h->name = hostname;
2777h->port = portnum;
2778h->mx = MX_NONE;
2779
2780if (string_is_ip_address(hostname, NULL))
2781 h->address = hostname, r = HOST_FOUND;
2782else
2783 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2784if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2785 {
217b0e56 2786 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
b0019c78
TF
2787 return DEFER;
2788 }
2789
2790HDEBUG(D_acl)
e1d04f48 2791 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
b0019c78 2792
4a5cbaff 2793/*XXX this could better use sendto */
b1f8e4f8 2794r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
4a5cbaff 2795 1, NULL, &errstr, NULL);
b0019c78 2796if (r < 0) goto defer;
27f9999e 2797len = Ustrlen(arg);
9cb1785a 2798r = send(s, arg, len, 0);
b1f8e4f8
JH
2799if (r < 0)
2800 {
2801 errstr = US strerror(errno);
2802 close(s);
2803 goto defer;
2804 }
2805close(s);
b0019c78
TF
2806if (r < len)
2807 {
2808 *log_msgptr =
2809 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2810 return DEFER;
2811 }
2812
2813HDEBUG(D_acl)
e1d04f48 2814 debug_printf_indent("udpsend %d bytes\n", r);
b0019c78
TF
2815
2816return OK;
2817
2818defer:
b1f8e4f8 2819*log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
b0019c78
TF
2820return DEFER;
2821}
2822
2823
2824
2825/*************************************************
059ec3d9
PH
2826* Handle conditions/modifiers on an ACL item *
2827*************************************************/
2828
2829/* Called from acl_check() below.
2830
2831Arguments:
2832 verb ACL verb
2833 cb ACL condition block - if NULL, result is OK
2834 where where called from
2835 addr the address being checked for RCPT, or NULL
2836 level the nesting level
2837 epp pointer to pass back TRUE if "endpass" encountered
2838 (applies only to "accept" and "discard")
2839 user_msgptr user message pointer
2840 log_msgptr log message pointer
2841 basic_errno pointer to where to put verify error
2842
2843Returns: OK - all conditions are met
2844 DISCARD - an "acl" condition returned DISCARD - only allowed
2845 for "accept" or "discard" verbs
2846 FAIL - at least one condition fails
2847 FAIL_DROP - an "acl" condition returned FAIL_DROP
2848 DEFER - can't tell at the moment (typically, lookup defer,
2849 but can be temporary callout problem)
2850 ERROR - ERROR from nested ACL or expansion failure or other
2851 error
2852*/
2853
2854static int
2855acl_check_condition(int verb, acl_condition_block *cb, int where,
2856 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2857 uschar **log_msgptr, int *basic_errno)
2858{
2859uschar *user_message = NULL;
2860uschar *log_message = NULL;
059ec3d9 2861int rc = OK;
8523533c 2862#ifdef WITH_CONTENT_SCAN
0f0c8159 2863int sep = -'/';
8523533c 2864#endif
059ec3d9
PH
2865
2866for (; cb != NULL; cb = cb->next)
2867 {
55414b25 2868 const uschar *arg;
8e669ac1 2869 int control_type;
059ec3d9
PH
2870
2871 /* The message and log_message items set up messages to be used in
2872 case of rejection. They are expanded later. */
2873
2874 if (cb->type == ACLC_MESSAGE)
2875 {
e1d04f48 2876 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
059ec3d9
PH
2877 user_message = cb->arg;
2878 continue;
2879 }
2880
2881 if (cb->type == ACLC_LOG_MESSAGE)
2882 {
e1d04f48 2883 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
059ec3d9
PH
2884 log_message = cb->arg;
2885 continue;
2886 }
2887
2888 /* The endpass "condition" just sets a flag to show it occurred. This is
2889 checked at compile time to be on an "accept" or "discard" item. */
2890
2891 if (cb->type == ACLC_ENDPASS)
2892 {
2893 *epp = TRUE;
2894 continue;
2895 }
2896
2897 /* For other conditions and modifiers, the argument is expanded now for some
2898 of them, but not for all, because expansion happens down in some lower level
2899 checking functions in some cases. */
2900
560e71cc
JH
2901 if (!conditions[cb->type].expand_at_top)
2902 arg = cb->arg;
2903 else if (!(arg = expand_string(cb->arg)))
059ec3d9 2904 {
560e71cc
JH
2905 if (expand_string_forcedfail) continue;
2906 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2907 cb->arg, expand_string_message);
2908 return search_find_defer ? DEFER : ERROR;
059ec3d9 2909 }
059ec3d9
PH
2910
2911 /* Show condition, and expanded condition if it's different */
2912
2913 HDEBUG(D_acl)
2914 {
2915 int lhswidth = 0;
e1d04f48 2916 debug_printf_indent("check %s%s %n",
2d009132
JH
2917 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2918 conditions[cb->type].name, &lhswidth);
059ec3d9
PH
2919
2920 if (cb->type == ACLC_SET)
2921 {
a79d8834
JH
2922#ifndef DISABLE_DKIM
2923 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2924 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2925 {
2926 debug_printf("%s ", cb->u.varname);
2927 lhswidth += 19;
2928 }
2929 else
2930#endif
2931 {
2932 debug_printf("acl_%s ", cb->u.varname);
2933 lhswidth += 5 + Ustrlen(cb->u.varname);
2934 }
059ec3d9
PH
2935 }
2936
2937 debug_printf("= %s\n", cb->arg);
2938
2939 if (arg != cb->arg)
2940 debug_printf("%.*s= %s\n", lhswidth,
2941 US" ", CS arg);
2942 }
2943
2944 /* Check that this condition makes sense at this time */
2945
2d009132 2946 if ((conditions[cb->type].forbids & (1 << where)) != 0)
059ec3d9
PH
2947 {
2948 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2d009132
JH
2949 conditions[cb->type].is_modifier ? "use" : "test",
2950 conditions[cb->type].name, acl_wherenames[where]);
059ec3d9
PH
2951 return ERROR;
2952 }
2953
2954 /* Run the appropriate test for each condition, or take the appropriate
2955 action for the remaining modifiers. */
2956
2957 switch(cb->type)
2958 {
71fafd95
PH
2959 case ACLC_ADD_HEADER:
2960 setup_header(arg);
2961 break;
2962
059ec3d9
PH
2963 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2964 "discard" verb. */
71fafd95 2965
059ec3d9 2966 case ACLC_ACL:
e1d04f48 2967 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
7421ecab
JH
2968 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2969 {
2970 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2971 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2972 verbs[verb]);
2973 return ERROR;
2974 }
059ec3d9
PH
2975 break;
2976
2977 case ACLC_AUTHENTICATED:
2978 rc = (sender_host_authenticated == NULL)? FAIL :
2979 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2980 TRUE, NULL);
2981 break;
2982
71fafd95 2983 #ifdef EXPERIMENTAL_BRIGHTMAIL
8523533c
TK
2984 case ACLC_BMI_OPTIN:
2985 {
2986 int old_pool = store_pool;
2987 store_pool = POOL_PERM;
2988 bmi_current_optin = string_copy(arg);
2989 store_pool = old_pool;
2990 }
2991 break;
71fafd95 2992 #endif
8523533c 2993
059ec3d9 2994 case ACLC_CONDITION:
f3766eb5
NM
2995 /* The true/false parsing here should be kept in sync with that used in
2996 expand.c when dealing with ECOND_BOOL so that we don't have too many
2997 different definitions of what can be a boolean. */
51c7471d
JH
2998 if (*arg == '-'
2999 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3000 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
059ec3d9
PH
3001 rc = (Uatoi(arg) == 0)? FAIL : OK;
3002 else
3003 rc = (strcmpic(arg, US"no") == 0 ||
3004 strcmpic(arg, US"false") == 0)? FAIL :
3005 (strcmpic(arg, US"yes") == 0 ||
3006 strcmpic(arg, US"true") == 0)? OK : DEFER;
3007 if (rc == DEFER)
3008 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3009 break;
3010
c3611384
PH
3011 case ACLC_CONTINUE: /* Always succeeds */
3012 break;
3013
059ec3d9 3014 case ACLC_CONTROL:
c5fcb476 3015 {
55414b25
JH
3016 const uschar *p = NULL;
3017 control_type = decode_control(arg, &p, where, log_msgptr);
4840604e 3018
55414b25 3019 /* Check if this control makes sense at this time */
f7572e5a 3020
d7bed771 3021 if (controls_list[control_type].forbids & (1 << where))
55414b25
JH
3022 {
3023 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
d7bed771 3024 controls_list[control_type].name, acl_wherenames[where]);
55414b25
JH
3025 return ERROR;
3026 }
8800895a 3027
55414b25
JH
3028 switch(control_type)
3029 {
3030 case CONTROL_AUTH_UNADVERTISED:
3031 allow_auth_unadvertised = TRUE;
3032 break;
3033
3034 #ifdef EXPERIMENTAL_BRIGHTMAIL
3035 case CONTROL_BMI_RUN:
3036 bmi_run = 1;
3037 break;
3038 #endif
3039
3040 #ifndef DISABLE_DKIM
3041 case CONTROL_DKIM_VERIFY:
3042 dkim_disable_verify = TRUE;
3043 #ifdef EXPERIMENTAL_DMARC
3044 /* Since DKIM was blocked, skip DMARC too */
3045 dmarc_disable_verify = TRUE;
3046 dmarc_enable_forensic = FALSE;
3047 #endif
3048 break;
3049 #endif
3050
3051 #ifdef EXPERIMENTAL_DMARC
3052 case CONTROL_DMARC_VERIFY:
3053 dmarc_disable_verify = TRUE;
3054 break;
3055
3056 case CONTROL_DMARC_FORENSIC:
3057 dmarc_enable_forensic = TRUE;
3058 break;
3059 #endif
3060
3061 case CONTROL_DSCP:
3062 if (*p == '/')
3063 {
3064 int fd, af, level, optname, value;
3065 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3066 a socket; we can accept that, we'll just debug-log failures anyway. */
3067 fd = fileno(smtp_in);
3068 af = ip_get_address_family(fd);
3069 if (af < 0)
3070 {
3071 HDEBUG(D_acl)
e1d04f48 3072 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
55414b25
JH
3073 strerror(errno));
3074 break;
3075 }
3076 if (dscp_lookup(p+1, af, &level, &optname, &value))
3077 {
3078 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3079 {
e1d04f48 3080 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
55414b25
JH
3081 p+1, strerror(errno));
3082 }
3083 else
3084 {
e1d04f48 3085 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
55414b25
JH
3086 }
3087 }
3088 else
3089 {
3090 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3091 return ERROR;
3092 }
3093 }
3094 else
3095 {
3096 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3097 return ERROR;
3098 }
3099 break;
3100
3101 case CONTROL_ERROR:
3102 return ERROR;
3103
3104 case CONTROL_CASEFUL_LOCAL_PART:
3105 deliver_localpart = addr->cc_local_part;
3106 break;
3107
3108 case CONTROL_CASELOWER_LOCAL_PART:
3109 deliver_localpart = addr->lc_local_part;
3110 break;
3111
3112 case CONTROL_ENFORCE_SYNC:
3113 smtp_enforce_sync = TRUE;
3114 break;
3115
3116 case CONTROL_NO_ENFORCE_SYNC:
3117 smtp_enforce_sync = FALSE;
3118 break;
3119
3120 #ifdef WITH_CONTENT_SCAN
3121 case CONTROL_NO_MBOX_UNSPOOL:
3122 no_mbox_unspool = TRUE;
3123 break;
3124 #endif
3125
3126 case CONTROL_NO_MULTILINE:
3127 no_multiline_responses = TRUE;
3128 break;
3129
3130 case CONTROL_NO_PIPELINING:
3131 pipelining_enable = FALSE;
3132 break;
3133
3134 case CONTROL_NO_DELAY_FLUSH:
3135 disable_delay_flush = TRUE;
3136 break;
3137
3138 case CONTROL_NO_CALLOUT_FLUSH:
3139 disable_callout_flush = TRUE;
3140 break;
3141
3142 case CONTROL_FAKEREJECT:
57cc2785 3143 cancel_cutthrough_connection(TRUE, US"fakereject");
55414b25
JH
3144 case CONTROL_FAKEDEFER:
3145 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3146 if (*p == '/')
3147 {
3148 const uschar *pp = p + 1;
3149 while (*pp != 0) pp++;
3150 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3151 p = pp;
3152 }
3153 else
3154 {
3155 /* Explicitly reset to default string */
3156 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3157 }
3158 break;
ed7f7860 3159
55414b25
JH
3160 case CONTROL_FREEZE:
3161 deliver_freeze = TRUE;
3162 deliver_frozen_at = time(NULL);
3163 freeze_tell = freeze_tell_config; /* Reset to configured value */
3164 if (Ustrncmp(p, "/no_tell", 8) == 0)
3165 {
3166 p += 8;
3167 freeze_tell = NULL;
3168 }
3169 if (*p != 0)
3170 {
3171 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3172 return ERROR;
3173 }
57cc2785 3174 cancel_cutthrough_connection(TRUE, US"item frozen");
55414b25
JH
3175 break;
3176
3177 case CONTROL_QUEUE_ONLY:
3178 queue_only_policy = TRUE;
57cc2785 3179 cancel_cutthrough_connection(TRUE, US"queueing forced");
55414b25
JH
3180 break;
3181
3182 case CONTROL_SUBMISSION:
3183 originator_name = US"";
3184 submission_mode = TRUE;
3185 while (*p == '/')
3186 {
3187 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3188 {
3189 p += 14;
3190 active_local_sender_retain = TRUE;
3191 active_local_from_check = FALSE;
3192 }
3193 else if (Ustrncmp(p, "/domain=", 8) == 0)
3194 {
3195 const uschar *pp = p + 8;
3196 while (*pp != 0 && *pp != '/') pp++;
3197 submission_domain = string_copyn(p+8, pp-p-8);
3198 p = pp;
3199 }
3200 /* The name= option must be last, because it swallows the rest of
3201 the string. */
3202 else if (Ustrncmp(p, "/name=", 6) == 0)
3203 {
3204 const uschar *pp = p + 6;
3205 while (*pp != 0) pp++;
3206 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3207 big_buffer, big_buffer_size));
3208 p = pp;
3209 }
3210 else break;
3211 }
3212 if (*p != 0)
3213 {
3214 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3215 return ERROR;
3216 }
3217 break;
e4bdf652 3218
55414b25 3219 case CONTROL_DEBUG:
55414b25 3220 {
b0d68adc
JH
3221 uschar * debug_tag = NULL;
3222 uschar * debug_opts = NULL;
3223 BOOL kill = FALSE;
3224
3225 while (*p == '/')
55414b25 3226 {
b0d68adc
JH
3227 const uschar * pp = p+1;
3228 if (Ustrncmp(pp, "tag=", 4) == 0)
3229 {
3230 for (pp += 4; *pp && *pp != '/';) pp++;
3231 debug_tag = string_copyn(p+5, pp-p-5);
3232 }
3233 else if (Ustrncmp(pp, "opts=", 5) == 0)
3234 {
3235 for (pp += 5; *pp && *pp != '/';) pp++;
3236 debug_opts = string_copyn(p+6, pp-p-6);
3237 }
3238 else if (Ustrncmp(pp, "kill", 4) == 0)
3239 {
3240 for (pp += 4; *pp && *pp != '/';) pp++;
3241 kill = TRUE;
3242 }
3243 else
3244 while (*pp && *pp != '/') pp++;
55414b25
JH
3245 p = pp;
3246 }
b0d68adc
JH
3247
3248 if (kill)
3249 debug_logging_stop();
3250 else
3251 debug_logging_activate(debug_tag, debug_opts);
55414b25 3252 }
55414b25
JH
3253 break;
3254
3255 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3256 suppress_local_fixups = TRUE;
3257 break;
3258
3259 case CONTROL_CUTTHROUGH_DELIVERY:
a2b89db1 3260#ifndef DISABLE_PRDR
55414b25 3261 if (prdr_requested)
a2b89db1
PP
3262#else
3263 if (0)
3264#endif
55414b25
JH
3265 /* Too hard to think about for now. We might in future cutthrough
3266 the case where both sides handle prdr and this-node prdr acl
3267 is "accept" */
93a6fce2 3268 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
5032d1cf
JH
3269 else
3270 {
55414b25
JH
3271 if (deliver_freeze)
3272 *log_msgptr = US"frozen";
3273 else if (queue_only_policy)
3274 *log_msgptr = US"queue-only";
3275 else if (fake_response == FAIL)
3276 *log_msgptr = US"fakereject";
3277 else
3278 {
ff5929e3
JH
3279 if (rcpt_count == 1)
3280 {
3281 cutthrough.delivery = TRUE;
3282 while (*p == '/')
3283 {
3284 const uschar * pp = p+1;
3285 if (Ustrncmp(pp, "defer=", 6) == 0)
3286 {
3287 pp += 6;
3288 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3289 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3290 }
3291 else
3292 while (*pp && *pp != '/') pp++;
3293 p = pp;
3294 }
3295 }
55414b25
JH
3296 break;
3297 }
3298 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3299 arg, *log_msgptr);
5032d1cf 3300 }
55414b25 3301 return ERROR;
3c8b3577 3302
8c5d388a 3303#ifdef SUPPORT_I18N
3c8b3577
JH
3304 case CONTROL_UTF8_DOWNCONVERT:
3305 if (*p == '/')
3306 {
921dfc11
JH
3307 if (p[1] == '1')
3308 {
3309 message_utf8_downconvert = 1;
3310 addr->prop.utf8_downcvt = TRUE;
3311 addr->prop.utf8_downcvt_maybe = FALSE;
3312 p += 2;
3313 break;
3314 }
3315 if (p[1] == '0')
3316 {
3317 message_utf8_downconvert = 0;
3318 addr->prop.utf8_downcvt = FALSE;
3319 addr->prop.utf8_downcvt_maybe = FALSE;
3320 p += 2;
3321 break;
3322 }
3c8b3577 3323 if (p[1] == '-' && p[2] == '1')
921dfc11
JH
3324 {
3325 message_utf8_downconvert = -1;
3326 addr->prop.utf8_downcvt = FALSE;
3327 addr->prop.utf8_downcvt_maybe = TRUE;
3328 p += 3;
3329 break;
3330 }
3c8b3577
JH
3331 *log_msgptr = US"bad option value for control=utf8_downconvert";
3332 }
3333 else
3334 {
921dfc11
JH
3335 message_utf8_downconvert = 1;
3336 addr->prop.utf8_downcvt = TRUE;
3337 addr->prop.utf8_downcvt_maybe = FALSE;
3338 break;
3c8b3577
JH
3339 }
3340 return ERROR;
8c5d388a 3341#endif
3c8b3577 3342
9171d434 3343 }
55414b25 3344 break;
059ec3d9 3345 }
059ec3d9 3346
6a8f9482
TK
3347 #ifdef EXPERIMENTAL_DCC
3348 case ACLC_DCC:
3349 {
4c04137d 3350 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3351 const uschar * list = arg;
3352 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
6a8f9482
TK
3353 /* Run the dcc backend. */
3354 rc = dcc_process(&ss);
4c04137d 3355 /* Modify return code based upon the existence of options. */
3c8b3577 3356 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
6a8f9482 3357 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3c8b3577 3358 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
6a8f9482
TK
3359 }
3360 break;
3361 #endif
3362
71fafd95 3363 #ifdef WITH_CONTENT_SCAN
8523533c
TK
3364 case ACLC_DECODE:
3365 rc = mime_decode(&arg);
3366 break;
71fafd95 3367 #endif
8523533c 3368
059ec3d9
PH
3369 case ACLC_DELAY:
3370 {
3371 int delay = readconf_readtime(arg, 0, FALSE);
3372 if (delay < 0)
3373 {
3374 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3375 "modifier: \"%s\" is not a time value", arg);
3376 return ERROR;
3377 }
3378 else
3379 {
e1d04f48 3380 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
059ec3d9
PH
3381 delay);
3382 if (host_checking)
3383 {
3384 HDEBUG(D_acl)
e1d04f48 3385 debug_printf_indent("delay skipped in -bh checking mode\n");
059ec3d9 3386 }
010c2d14 3387
ae9d18bc
JH
3388 /* NOTE 1: Remember that we may be
3389 dealing with stdin/stdout here, in addition to TCP/IP connections.
3390 Also, delays may be specified for non-SMTP input, where smtp_out and
3391 smtp_in will be NULL. Whatever is done must work in all cases.
3392
3393 NOTE 2: The added feature of flushing the output before a delay must
3394 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3395 */
3396
3397 else
3398 {
3399 if (smtp_out != NULL && !disable_delay_flush)
3400 mac_smtp_fflush();
3401
861a7c51 3402#if !defined(NO_POLL_H) && defined (POLLRDHUP)
ae9d18bc
JH
3403 {
3404 struct pollfd p;
3405 nfds_t n = 0;
3406 if (smtp_out)
3407 {
3408 p.fd = fileno(smtp_out);
3409 p.events = POLLRDHUP;
3410 n = 1;
3411 }
3412 if (poll(&p, n, delay*1000) > 0)
e1d04f48 3413 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
ae9d18bc
JH
3414 }
3415#else
010c2d14
PH
3416 /* It appears to be impossible to detect that a TCP/IP connection has
3417 gone away without reading from it. This means that we cannot shorten
3418 the delay below if the client goes away, because we cannot discover
3419 that the client has closed its end of the connection. (The connection
3420 is actually in a half-closed state, waiting for the server to close its
3421 end.) It would be nice to be able to detect this state, so that the
3422 Exim process is not held up unnecessarily. However, it seems that we
3423 can't. The poll() function does not do the right thing, and in any case
3424 it is not always available.
047bdd8c 3425 */
010c2d14 3426
86b8287f 3427 while (delay > 0) delay = sleep(delay);
ae9d18bc 3428#endif
8e669ac1 3429 }
059ec3d9
PH
3430 }
3431 }
3432 break;
3433
80a47a2c
TK
3434 #ifndef DISABLE_DKIM
3435 case ACLC_DKIM_SIGNER:
a79d8834 3436 if (dkim_cur_signer)
9e5d6b55 3437 rc = match_isinlist(dkim_cur_signer,
80a47a2c 3438 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
80a47a2c 3439 else
b0b9dbb1 3440 rc = FAIL;
71fafd95
PH
3441 break;
3442
80a47a2c 3443 case ACLC_DKIM_STATUS:
a79d8834 3444 rc = match_isinlist(dkim_verify_status,
80a47a2c 3445 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
71fafd95
PH
3446 break;
3447 #endif
fb2274d4 3448
4840604e
TL
3449 #ifdef EXPERIMENTAL_DMARC
3450 case ACLC_DMARC_STATUS:
4a8ce2d8 3451 if (!dmarc_has_been_checked)
4840604e 3452 dmarc_process();
4a8ce2d8 3453 dmarc_has_been_checked = TRUE;
4840604e
TL
3454 /* used long way of dmarc_exim_expand_query() in case we need more
3455 * view into the process in the future. */
3456 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3457 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3458 break;
3459 #endif
3460
059ec3d9 3461 case ACLC_DNSLISTS:
379ba7d0 3462 rc = verify_check_dnsbl(where, &arg, log_msgptr);
059ec3d9
PH
3463 break;
3464
3465 case ACLC_DOMAINS:
3466 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
55414b25 3467 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
059ec3d9
PH
3468 break;
3469
3470 /* The value in tls_cipher is the full cipher name, for example,
3471 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3472 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3473 what may in practice come out of the SSL library - which at the time of
3474 writing is poorly documented. */
3475
3476 case ACLC_ENCRYPTED:
817d9f57 3477 if (tls_in.cipher == NULL) rc = FAIL; else
059ec3d9
PH
3478 {
3479 uschar *endcipher = NULL;
817d9f57
JH
3480 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3481 if (cipher == NULL) cipher = tls_in.cipher; else
059ec3d9
PH
3482 {
3483 endcipher = Ustrchr(++cipher, ':');
3484 if (endcipher != NULL) *endcipher = 0;
3485 }
3486 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3487 if (endcipher != NULL) *endcipher = ':';
3488 }
3489 break;
3490
3491 /* Use verify_check_this_host() instead of verify_check_host() so that
3492 we can pass over &host_data to catch any looked up data. Once it has been
3493 set, it retains its value so that it's still there if another ACL verb
3494 comes through here and uses the cache. However, we must put it into
3495 permanent store in case it is also expected to be used in a subsequent
3496 message in the same SMTP connection. */
3497
3498 case ACLC_HOSTS:
3499 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
55414b25
JH
3500 (sender_host_address == NULL)? US"" : sender_host_address,
3501 CUSS &host_data);
4a452c43
JH
3502 if (rc == DEFER) *log_msgptr = search_error_message;
3503 if (host_data) host_data = string_copy_malloc(host_data);
059ec3d9
PH
3504 break;
3505
3506 case ACLC_LOCAL_PARTS:
3507 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3508 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
55414b25 3509 CUSS &deliver_localpart_data);
059ec3d9
PH
3510 break;
3511
6ea85e9a
PH
3512 case ACLC_LOG_REJECT_TARGET:
3513 {
3514 int logbits = 0;
3515 int sep = 0;
55414b25 3516 const uschar *s = arg;
6ea85e9a 3517 uschar *ss;
4a452c43 3518 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
6ea85e9a
PH
3519 {
3520 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3521 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3522 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3523 else
3524 {
3525 logbits |= LOG_MAIN|LOG_REJECT;
3526 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3527 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3528 }
3529 }
3530 log_reject_target = logbits;
3531 }
3532 break;
3533
059ec3d9
PH
3534 case ACLC_LOGWRITE:
3535 {
3536 int logbits = 0;
55414b25 3537 const uschar *s = arg;
059ec3d9
PH
3538 if (*s == ':')
3539 {
3540 s++;
3541 while (*s != ':')
3542 {
3543 if (Ustrncmp(s, "main", 4) == 0)
3544 { logbits |= LOG_MAIN; s += 4; }
3545 else if (Ustrncmp(s, "panic", 5) == 0)
3546 { logbits |= LOG_PANIC; s += 5; }
3547 else if (Ustrncmp(s, "reject", 6) == 0)
3548 { logbits |= LOG_REJECT; s += 6; }
3549 else
3550 {
3551 logbits = LOG_MAIN|LOG_PANIC;
3552 s = string_sprintf(":unknown log name in \"%s\" in "
3553 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3554 }
3555 if (*s == ',') s++;
3556 }
3557 s++;
3558 }
3559 while (isspace(*s)) s++;
6ea85e9a
PH
3560
3561
059ec3d9
PH
3562 if (logbits == 0) logbits = LOG_MAIN;
3563 log_write(0, logbits, "%s", string_printing(s));
3564 }
3565 break;
8e669ac1 3566
71fafd95 3567 #ifdef WITH_CONTENT_SCAN
0f0c8159 3568 case ACLC_MALWARE: /* Run the malware backend. */
8523533c 3569 {
6ea85e9a 3570 /* Separate the regular expression and any optional parameters. */
55414b25
JH
3571 const uschar * list = arg;
3572 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
0f0c8159
JH
3573 uschar *opt;
3574 BOOL defer_ok = FALSE;
3575 int timeout = 0;
3576
55414b25 3577 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
0f0c8159
JH
3578 if (strcmpic(opt, US"defer_ok") == 0)
3579 defer_ok = TRUE;
3580 else if ( strncmpic(opt, US"tmo=", 4) == 0
3581 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3582 )
3583 {
3584 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3585 return ERROR;
3586 }
3587
3588 rc = malware(ss, timeout);
3589 if (rc == DEFER && defer_ok)
3590 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
8523533c
TK
3591 }
3592 break;
3593
3594 case ACLC_MIME_REGEX:
71fafd95 3595 rc = mime_regex(&arg);
8523533c 3596 break;
71fafd95 3597 #endif
059ec3d9 3598
b0b9dbb1 3599 case ACLC_QUEUE:
944e8b37
JH
3600 if (Ustrchr(arg, '/'))
3601 {
3602 *log_msgptr = string_sprintf(
3603 "Directory separator not permitted in queue name: '%s'", arg);
3604 return ERROR;
3605 }
b0b9dbb1
JH
3606 queue_name = string_copy_malloc(arg);
3607 break;
3608
870f6ba8 3609 case ACLC_RATELIMIT:
90fc3069 3610 rc = acl_ratelimit(arg, where, log_msgptr);
870f6ba8
TF
3611 break;
3612
059ec3d9 3613 case ACLC_RECIPIENTS:
36d295f1 3614 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
55414b25 3615 CUSS &recipient_data);
059ec3d9
PH
3616 break;
3617
71fafd95
PH
3618 #ifdef WITH_CONTENT_SCAN
3619 case ACLC_REGEX:
3620 rc = regex(&arg);
8523533c 3621 break;
71fafd95 3622 #endif
8523533c 3623
e7568d51
TL
3624 case ACLC_REMOVE_HEADER:
3625 setup_remove_header(arg);
3626 break;
3627
059ec3d9
PH
3628 case ACLC_SENDER_DOMAINS:
3629 {
3630 uschar *sdomain;
3631 sdomain = Ustrrchr(sender_address, '@');
f7ae7462 3632 sdomain = sdomain ? sdomain + 1 : US"";
059ec3d9
PH
3633 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3634 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3635 }
3636 break;
3637
3638 case ACLC_SENDERS:
36d295f1 3639 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
55414b25 3640 sender_address_cache, -1, 0, CUSS &sender_data);