tidying
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef SUPPORT_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
142 #ifndef DISABLE_PRDR
143 ACL_BIT_PRDR |
144 #endif
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
153 },
154 #ifdef EXPERIMENTAL_BRIGHTMAIL
155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
159 # ifndef DISABLE_PRDR
160 ACL_BIT_PRDR |
161 # endif
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
167 },
168 #endif
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
175
176 #ifdef EXPERIMENTAL_DCC
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
179 ~(ACL_BIT_DATA |
180 # ifndef DISABLE_PRDR
181 ACL_BIT_PRDR |
182 # endif
183 ACL_BIT_NOTSMTP),
184 },
185 #endif
186 #ifdef WITH_CONTENT_SCAN
187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
188
189 #endif
190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
191 #ifndef DISABLE_DKIM
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 #endif
195 #ifdef EXPERIMENTAL_DMARC
196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
197 #endif
198
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
202
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
206 #ifndef DISABLE_PRDR
207 |ACL_BIT_PRDR
208 #endif
209 ),
210 },
211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
214 },
215
216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
217
218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
220 },
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
224 #ifndef DISABLE_PRDR
225 | ACL_BIT_PRDR
226 #endif
227 ),
228 },
229
230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
233
234 #ifdef WITH_CONTENT_SCAN
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
237 ~(ACL_BIT_DATA |
238 # ifndef DISABLE_PRDR
239 ACL_BIT_PRDR |
240 # endif
241 ACL_BIT_NOTSMTP),
242 },
243 #endif
244
245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
248 #endif
249
250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
251 ACL_BIT_NOTSMTP |
252 #ifndef DISABLE_PRDR
253 ACL_BIT_PRDR |
254 #endif
255 ACL_BIT_DATA,
256 },
257
258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
260
261 #ifdef WITH_CONTENT_SCAN
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
264 ~(ACL_BIT_DATA |
265 # ifndef DISABLE_PRDR
266 ACL_BIT_PRDR |
267 # endif
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
270 },
271
272 #endif
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
277 #ifndef DISABLE_PRDR
278 ACL_BIT_PRDR |
279 #endif
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
282 },
283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
289 },
290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
296 },
297
298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
299
300 #ifdef WITH_CONTENT_SCAN
301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
302 (unsigned int) ~(ACL_BIT_DATA |
303 # ifndef DISABLE_PRDR
304 ACL_BIT_PRDR |
305 # endif
306 ACL_BIT_NOTSMTP),
307 },
308 #endif
309 #ifdef SUPPORT_SPF
310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
316 },
317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
323 },
324 #endif
325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
326
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
330 };
331
332
333
334 /* Return values from decode_control(); used as index so keep in step
335 with the controls_list table that follows! */
336
337 enum {
338 CONTROL_AUTH_UNADVERTISED,
339 #ifdef EXPERIMENTAL_BRIGHTMAIL
340 CONTROL_BMI_RUN,
341 #endif
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
346 #ifndef DISABLE_DKIM
347 CONTROL_DKIM_VERIFY,
348 #endif
349 #ifdef EXPERIMENTAL_DMARC
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
352 #endif
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
359
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
363 #ifdef WITH_CONTENT_SCAN
364 CONTROL_NO_MBOX_UNSPOOL,
365 #endif
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
368
369 CONTROL_QUEUE_ONLY,
370 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
371 CONTROL_REQUIRETLS,
372 #endif
373 CONTROL_SUBMISSION,
374 CONTROL_SUPPRESS_LOCAL_FIXUPS,
375 #ifdef SUPPORT_I18N
376 CONTROL_UTF8_DOWNCONVERT,
377 #endif
378 };
379
380
381
382 /* Structure listing various control arguments, with their characteristics.
383 For each control, there's a bitmap of dis-allowed times. For some, it is easier
384 to specify the negation of a small number of allowed times. */
385
386 typedef struct control_def {
387 uschar *name;
388 BOOL has_option; /* Has /option(s) following */
389 unsigned forbids; /* bitmap of dis-allowed times */
390 } control_def;
391
392 static control_def controls_list[] = {
393 /* name has_option forbids */
394 [CONTROL_AUTH_UNADVERTISED] =
395 { US"allow_auth_unadvertised", FALSE,
396 (unsigned)
397 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
398 },
399 #ifdef EXPERIMENTAL_BRIGHTMAIL
400 [CONTROL_BMI_RUN] =
401 { US"bmi_run", FALSE, 0 },
402 #endif
403 [CONTROL_CASEFUL_LOCAL_PART] =
404 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
405 [CONTROL_CASELOWER_LOCAL_PART] =
406 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
407 [CONTROL_CUTTHROUGH_DELIVERY] =
408 { US"cutthrough_delivery", TRUE, 0 },
409 [CONTROL_DEBUG] =
410 { US"debug", TRUE, 0 },
411
412 #ifndef DISABLE_DKIM
413 [CONTROL_DKIM_VERIFY] =
414 { US"dkim_disable_verify", FALSE,
415 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
416 # ifndef DISABLE_PRDR
417 ACL_BIT_PRDR |
418 # endif
419 ACL_BIT_NOTSMTP_START
420 },
421 #endif
422
423 #ifdef EXPERIMENTAL_DMARC
424 [CONTROL_DMARC_VERIFY] =
425 { US"dmarc_disable_verify", FALSE,
426 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
427 },
428 [CONTROL_DMARC_FORENSIC] =
429 { US"dmarc_enable_forensic", FALSE,
430 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
431 },
432 #endif
433
434 [CONTROL_DSCP] =
435 { US"dscp", TRUE,
436 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
437 },
438 [CONTROL_ENFORCE_SYNC] =
439 { US"enforce_sync", FALSE,
440 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
441 },
442
443 /* Pseudo-value for decode errors */
444 [CONTROL_ERROR] =
445 { US"error", FALSE, 0 },
446
447 [CONTROL_FAKEDEFER] =
448 { US"fakedefer", TRUE,
449 (unsigned)
450 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
451 ACL_BIT_PREDATA | ACL_BIT_DATA |
452 #ifndef DISABLE_PRDR
453 ACL_BIT_PRDR |
454 #endif
455 ACL_BIT_MIME)
456 },
457 [CONTROL_FAKEREJECT] =
458 { US"fakereject", TRUE,
459 (unsigned)
460 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
461 ACL_BIT_PREDATA | ACL_BIT_DATA |
462 #ifndef DISABLE_PRDR
463 ACL_BIT_PRDR |
464 #endif
465 ACL_BIT_MIME)
466 },
467 [CONTROL_FREEZE] =
468 { US"freeze", TRUE,
469 (unsigned)
470 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
471 ACL_BIT_PREDATA | ACL_BIT_DATA |
472 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
473 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
474 },
475
476 [CONTROL_NO_CALLOUT_FLUSH] =
477 { US"no_callout_flush", FALSE,
478 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
479 },
480 [CONTROL_NO_DELAY_FLUSH] =
481 { US"no_delay_flush", FALSE,
482 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
483 },
484
485 [CONTROL_NO_ENFORCE_SYNC] =
486 { US"no_enforce_sync", FALSE,
487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
488 },
489 #ifdef WITH_CONTENT_SCAN
490 [CONTROL_NO_MBOX_UNSPOOL] =
491 { US"no_mbox_unspool", FALSE,
492 (unsigned)
493 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
494 ACL_BIT_PREDATA | ACL_BIT_DATA |
495 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 ACL_BIT_MIME)
497 },
498 #endif
499 [CONTROL_NO_MULTILINE] =
500 { US"no_multiline_responses", FALSE,
501 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
502 },
503 [CONTROL_NO_PIPELINING] =
504 { US"no_pipelining", FALSE,
505 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
506 },
507
508 [CONTROL_QUEUE_ONLY] =
509 { US"queue_only", FALSE,
510 (unsigned)
511 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
512 ACL_BIT_PREDATA | ACL_BIT_DATA |
513 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
514 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
515 },
516
517
518 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
519 [CONTROL_REQUIRETLS] =
520 { US"requiretls", FALSE,
521 (unsigned)
522 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
523 ACL_BIT_DATA | ACL_BIT_MIME |
524 ACL_BIT_NOTSMTP)
525 },
526 #endif
527
528 [CONTROL_SUBMISSION] =
529 { US"submission", TRUE,
530 (unsigned)
531 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
532 },
533 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
534 { US"suppress_local_fixups", FALSE,
535 (unsigned)
536 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
537 ACL_BIT_NOTSMTP_START)
538 },
539 #ifdef SUPPORT_I18N
540 [CONTROL_UTF8_DOWNCONVERT] =
541 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
542 }
543 #endif
544 };
545
546 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
547 caches its result in a tree to avoid repeated DNS queries. The result is an
548 integer code which is used as an index into the following tables of
549 explanatory strings and verification return codes. */
550
551 static tree_node *csa_cache = NULL;
552
553 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
554 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
555
556 /* The acl_verify_csa() return code is translated into an acl_verify() return
557 code using the following table. It is OK unless the client is definitely not
558 authorized. This is because CSA is supposed to be optional for sending sites,
559 so recipients should not be too strict about checking it - especially because
560 DNS problems are quite likely to occur. It's possible to use $csa_status in
561 further ACL conditions to distinguish ok, unknown, and defer if required, but
562 the aim is to make the usual configuration simple. */
563
564 static int csa_return_code[] = {
565 [CSA_UNKNOWN] = OK,
566 [CSA_OK] = OK,
567 [CSA_DEFER_SRV] = OK,
568 [CSA_DEFER_ADDR] = OK,
569 [CSA_FAIL_EXPLICIT] = FAIL,
570 [CSA_FAIL_DOMAIN] = FAIL,
571 [CSA_FAIL_NOADDR] = FAIL,
572 [CSA_FAIL_MISMATCH] = FAIL
573 };
574
575 static uschar *csa_status_string[] = {
576 [CSA_UNKNOWN] = US"unknown",
577 [CSA_OK] = US"ok",
578 [CSA_DEFER_SRV] = US"defer",
579 [CSA_DEFER_ADDR] = US"defer",
580 [CSA_FAIL_EXPLICIT] = US"fail",
581 [CSA_FAIL_DOMAIN] = US"fail",
582 [CSA_FAIL_NOADDR] = US"fail",
583 [CSA_FAIL_MISMATCH] = US"fail"
584 };
585
586 static uschar *csa_reason_string[] = {
587 [CSA_UNKNOWN] = US"unknown",
588 [CSA_OK] = US"ok",
589 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
590 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
591 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
592 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
593 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
594 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
595 };
596
597 /* Options for the ratelimit condition. Note that there are two variants of
598 the per_rcpt option, depending on the ACL that is used to measure the rate.
599 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
600 so the two variants must have the same internal representation as well as
601 the same configuration string. */
602
603 enum {
604 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
605 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
606 };
607
608 #define RATE_SET(var,new) \
609 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
610
611 static uschar *ratelimit_option_string[] = {
612 [RATE_PER_WHAT] = US"?",
613 [RATE_PER_CLASH] = US"!",
614 [RATE_PER_ADDR] = US"per_addr",
615 [RATE_PER_BYTE] = US"per_byte",
616 [RATE_PER_CMD] = US"per_cmd",
617 [RATE_PER_CONN] = US"per_conn",
618 [RATE_PER_MAIL] = US"per_mail",
619 [RATE_PER_RCPT] = US"per_rcpt",
620 [RATE_PER_ALLRCPTS] = US"per_rcpt"
621 };
622
623 /* Enable recursion between acl_check_internal() and acl_check_condition() */
624
625 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
626 uschar **);
627
628
629 /*************************************************
630 * Find control in list *
631 *************************************************/
632
633 /* The lists are always in order, so binary chop can be used.
634
635 Arguments:
636 name the control name to search for
637 ol the first entry in the control list
638 last one more than the offset of the last entry in the control list
639
640 Returns: index of a control entry, or -1 if not found
641 */
642
643 static int
644 find_control(const uschar * name, control_def * ol, int last)
645 {
646 int first = 0;
647 while (last > first)
648 {
649 int middle = (first + last)/2;
650 uschar * s = ol[middle].name;
651 int c = Ustrncmp(name, s, Ustrlen(s));
652 if (c == 0) return middle;
653 else if (c > 0) first = middle + 1;
654 else last = middle;
655 }
656 return -1;
657 }
658
659
660
661 /*************************************************
662 * Pick out condition from list *
663 *************************************************/
664
665 /* Use a binary chop method
666
667 Arguments:
668 name name to find
669 list list of conditions
670 end size of list
671
672 Returns: offset in list, or -1 if not found
673 */
674
675 static int
676 acl_checkcondition(uschar * name, condition_def * list, int end)
677 {
678 int start = 0;
679 while (start < end)
680 {
681 int mid = (start + end)/2;
682 int c = Ustrcmp(name, list[mid].name);
683 if (c == 0) return mid;
684 if (c < 0) end = mid;
685 else start = mid + 1;
686 }
687 return -1;
688 }
689
690
691 /*************************************************
692 * Pick out name from list *
693 *************************************************/
694
695 /* Use a binary chop method
696
697 Arguments:
698 name name to find
699 list list of names
700 end size of list
701
702 Returns: offset in list, or -1 if not found
703 */
704
705 static int
706 acl_checkname(uschar *name, uschar **list, int end)
707 {
708 int start = 0;
709
710 while (start < end)
711 {
712 int mid = (start + end)/2;
713 int c = Ustrcmp(name, list[mid]);
714 if (c == 0) return mid;
715 if (c < 0) end = mid; else start = mid + 1;
716 }
717
718 return -1;
719 }
720
721
722 /*************************************************
723 * Read and parse one ACL *
724 *************************************************/
725
726 /* This function is called both from readconf in order to parse the ACLs in the
727 configuration file, and also when an ACL is encountered dynamically (e.g. as
728 the result of an expansion). It is given a function to call in order to
729 retrieve the lines of the ACL. This function handles skipping comments and
730 blank lines (where relevant).
731
732 Arguments:
733 func function to get next line of ACL
734 error where to put an error message
735
736 Returns: pointer to ACL, or NULL
737 NULL can be legal (empty ACL); in this case error will be NULL
738 */
739
740 acl_block *
741 acl_read(uschar *(*func)(void), uschar **error)
742 {
743 acl_block *yield = NULL;
744 acl_block **lastp = &yield;
745 acl_block *this = NULL;
746 acl_condition_block *cond;
747 acl_condition_block **condp = NULL;
748 uschar *s;
749
750 *error = NULL;
751
752 while ((s = (*func)()) != NULL)
753 {
754 int v, c;
755 BOOL negated = FALSE;
756 uschar *saveline = s;
757 uschar name[64];
758
759 /* Conditions (but not verbs) are allowed to be negated by an initial
760 exclamation mark. */
761
762 while (isspace(*s)) s++;
763 if (*s == '!')
764 {
765 negated = TRUE;
766 s++;
767 }
768
769 /* Read the name of a verb or a condition, or the start of a new ACL, which
770 can be started by a name, or by a macro definition. */
771
772 s = readconf_readname(name, sizeof(name), s);
773 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
774
775 /* If a verb is unrecognized, it may be another condition or modifier that
776 continues the previous verb. */
777
778 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
779 {
780 if (this == NULL)
781 {
782 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
783 saveline);
784 return NULL;
785 }
786 }
787
788 /* New verb */
789
790 else
791 {
792 if (negated)
793 {
794 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
795 return NULL;
796 }
797 this = store_get(sizeof(acl_block));
798 *lastp = this;
799 lastp = &(this->next);
800 this->next = NULL;
801 this->verb = v;
802 this->condition = NULL;
803 condp = &(this->condition);
804 if (*s == 0) continue; /* No condition on this line */
805 if (*s == '!')
806 {
807 negated = TRUE;
808 s++;
809 }
810 s = readconf_readname(name, sizeof(name), s); /* Condition name */
811 }
812
813 /* Handle a condition or modifier. */
814
815 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
816 {
817 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
818 saveline);
819 return NULL;
820 }
821
822 /* The modifiers may not be negated */
823
824 if (negated && conditions[c].is_modifier)
825 {
826 *error = string_sprintf("ACL error: negation is not allowed with "
827 "\"%s\"", conditions[c].name);
828 return NULL;
829 }
830
831 /* ENDPASS may occur only with ACCEPT or DISCARD. */
832
833 if (c == ACLC_ENDPASS &&
834 this->verb != ACL_ACCEPT &&
835 this->verb != ACL_DISCARD)
836 {
837 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
838 conditions[c].name, verbs[this->verb]);
839 return NULL;
840 }
841
842 cond = store_get(sizeof(acl_condition_block));
843 cond->next = NULL;
844 cond->type = c;
845 cond->u.negated = negated;
846
847 *condp = cond;
848 condp = &(cond->next);
849
850 /* The "set" modifier is different in that its argument is "name=value"
851 rather than just a value, and we can check the validity of the name, which
852 gives us a variable name to insert into the data block. The original ACL
853 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
854 extended to 20 of each type, but after that people successfully argued for
855 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
856 After that, we allow alphanumerics and underscores, but the first character
857 after c or m must be a digit or an underscore. This retains backwards
858 compatibility. */
859
860 if (c == ACLC_SET)
861 #ifndef DISABLE_DKIM
862 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
863 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
864 {
865 uschar * endptr = s+18;
866
867 if (isalnum(*endptr))
868 {
869 *error = string_sprintf("invalid variable name after \"set\" in ACL "
870 "modifier \"set %s\" "
871 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
872 s);
873 return NULL;
874 }
875 cond->u.varname = string_copyn(s, 18);
876 s = endptr;
877 while (isspace(*s)) s++;
878 }
879 else
880 #endif
881 {
882 uschar *endptr;
883
884 if (Ustrncmp(s, "acl_c", 5) != 0 &&
885 Ustrncmp(s, "acl_m", 5) != 0)
886 {
887 *error = string_sprintf("invalid variable name after \"set\" in ACL "
888 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
889 return NULL;
890 }
891
892 endptr = s + 5;
893 if (!isdigit(*endptr) && *endptr != '_')
894 {
895 *error = string_sprintf("invalid variable name after \"set\" in ACL "
896 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
897 s);
898 return NULL;
899 }
900
901 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
902 {
903 if (!isalnum(*endptr) && *endptr != '_')
904 {
905 *error = string_sprintf("invalid character \"%c\" in variable name "
906 "in ACL modifier \"set %s\"", *endptr, s);
907 return NULL;
908 }
909 endptr++;
910 }
911
912 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
913 s = endptr;
914 while (isspace(*s)) s++;
915 }
916
917 /* For "set", we are now positioned for the data. For the others, only
918 "endpass" has no data */
919
920 if (c != ACLC_ENDPASS)
921 {
922 if (*s++ != '=')
923 {
924 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
925 conditions[c].is_modifier ? US"modifier" : US"condition");
926 return NULL;
927 }
928 while (isspace(*s)) s++;
929 cond->arg = string_copy(s);
930 }
931 }
932
933 return yield;
934 }
935
936
937
938 /*************************************************
939 * Set up added header line(s) *
940 *************************************************/
941
942 /* This function is called by the add_header modifier, and also from acl_warn()
943 to implement the now-deprecated way of adding header lines using "message" on a
944 "warn" verb. The argument is treated as a sequence of header lines which are
945 added to a chain, provided there isn't an identical one already there.
946
947 Argument: string of header lines
948 Returns: nothing
949 */
950
951 static void
952 setup_header(const uschar *hstring)
953 {
954 const uschar *p, *q;
955 int hlen = Ustrlen(hstring);
956
957 /* Ignore any leading newlines */
958 while (*hstring == '\n') hstring++, hlen--;
959
960 /* An empty string does nothing; ensure exactly one final newline. */
961 if (hlen <= 0) return;
962 if (hstring[--hlen] != '\n') /* no newline */
963 q = string_sprintf("%s\n", hstring);
964 else if (hstring[hlen-1] == '\n') /* double newline */
965 {
966 uschar * s = string_copy(hstring);
967 while(s[--hlen] == '\n')
968 s[hlen+1] = '\0';
969 q = s;
970 }
971 else
972 q = hstring;
973
974 /* Loop for multiple header lines, taking care about continuations */
975
976 for (p = q; *p; p = q)
977 {
978 const uschar *s;
979 uschar * hdr;
980 int newtype = htype_add_bot;
981 header_line **hptr = &acl_added_headers;
982
983 /* Find next header line within the string */
984
985 for (;;)
986 {
987 q = Ustrchr(q, '\n'); /* we know there was a newline */
988 if (*++q != ' ' && *q != '\t') break;
989 }
990
991 /* If the line starts with a colon, interpret the instruction for where to
992 add it. This temporarily sets up a new type. */
993
994 if (*p == ':')
995 {
996 if (strncmpic(p, US":after_received:", 16) == 0)
997 {
998 newtype = htype_add_rec;
999 p += 16;
1000 }
1001 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1002 {
1003 newtype = htype_add_rfc;
1004 p += 14;
1005 }
1006 else if (strncmpic(p, US":at_start:", 10) == 0)
1007 {
1008 newtype = htype_add_top;
1009 p += 10;
1010 }
1011 else if (strncmpic(p, US":at_end:", 8) == 0)
1012 {
1013 newtype = htype_add_bot;
1014 p += 8;
1015 }
1016 while (*p == ' ' || *p == '\t') p++;
1017 }
1018
1019 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1020 to the front of it. */
1021
1022 for (s = p; s < q - 1; s++)
1023 if (*s == ':' || !isgraph(*s)) break;
1024
1025 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1026 hlen = Ustrlen(hdr);
1027
1028 /* See if this line has already been added */
1029
1030 while (*hptr)
1031 {
1032 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1033 hptr = &(*hptr)->next;
1034 }
1035
1036 /* Add if not previously present */
1037
1038 if (!*hptr)
1039 {
1040 header_line *h = store_get(sizeof(header_line));
1041 h->text = hdr;
1042 h->next = NULL;
1043 h->type = newtype;
1044 h->slen = hlen;
1045 *hptr = h;
1046 hptr = &h->next;
1047 }
1048 }
1049 }
1050
1051
1052
1053 /*************************************************
1054 * List the added header lines *
1055 *************************************************/
1056 uschar *
1057 fn_hdrs_added(void)
1058 {
1059 gstring * g = NULL;
1060 header_line * h;
1061
1062 for (h = acl_added_headers; h; h = h->next)
1063 {
1064 int i = h->slen;
1065 if (h->text[i-1] == '\n') i--;
1066 g = string_append_listele_n(g, '\n', h->text, i);
1067 }
1068
1069 return g ? g->s : NULL;
1070 }
1071
1072
1073 /*************************************************
1074 * Set up removed header line(s) *
1075 *************************************************/
1076
1077 /* This function is called by the remove_header modifier. The argument is
1078 treated as a sequence of header names which are added to a colon separated
1079 list, provided there isn't an identical one already there.
1080
1081 Argument: string of header names
1082 Returns: nothing
1083 */
1084
1085 static void
1086 setup_remove_header(const uschar *hnames)
1087 {
1088 if (*hnames)
1089 acl_removed_headers = acl_removed_headers
1090 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1091 : string_copy(hnames);
1092 }
1093
1094
1095
1096 /*************************************************
1097 * Handle warnings *
1098 *************************************************/
1099
1100 /* This function is called when a WARN verb's conditions are true. It adds to
1101 the message's headers, and/or writes information to the log. In each case, this
1102 only happens once (per message for headers, per connection for log).
1103
1104 ** NOTE: The header adding action using the "message" setting is historic, and
1105 its use is now deprecated. The new add_header modifier should be used instead.
1106
1107 Arguments:
1108 where ACL_WHERE_xxxx indicating which ACL this is
1109 user_message message for adding to headers
1110 log_message message for logging, if different
1111
1112 Returns: nothing
1113 */
1114
1115 static void
1116 acl_warn(int where, uschar *user_message, uschar *log_message)
1117 {
1118 if (log_message != NULL && log_message != user_message)
1119 {
1120 uschar *text;
1121 string_item *logged;
1122
1123 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1124 string_printing(log_message));
1125
1126 /* If a sender verification has failed, and the log message is "sender verify
1127 failed", add the failure message. */
1128
1129 if (sender_verified_failed != NULL &&
1130 sender_verified_failed->message != NULL &&
1131 strcmpic(log_message, US"sender verify failed") == 0)
1132 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1133
1134 /* Search previously logged warnings. They are kept in malloc
1135 store so they can be freed at the start of a new message. */
1136
1137 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1138 if (Ustrcmp(logged->text, text) == 0) break;
1139
1140 if (logged == NULL)
1141 {
1142 int length = Ustrlen(text) + 1;
1143 log_write(0, LOG_MAIN, "%s", text);
1144 logged = store_malloc(sizeof(string_item) + length);
1145 logged->text = US logged + sizeof(string_item);
1146 memcpy(logged->text, text, length);
1147 logged->next = acl_warn_logged;
1148 acl_warn_logged = logged;
1149 }
1150 }
1151
1152 /* If there's no user message, we are done. */
1153
1154 if (user_message == NULL) return;
1155
1156 /* If this isn't a message ACL, we can't do anything with a user message.
1157 Log an error. */
1158
1159 if (where > ACL_WHERE_NOTSMTP)
1160 {
1161 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1162 "found in a non-message (%s) ACL: cannot specify header lines here: "
1163 "message ignored", acl_wherenames[where]);
1164 return;
1165 }
1166
1167 /* The code for setting up header lines is now abstracted into a separate
1168 function so that it can be used for the add_header modifier as well. */
1169
1170 setup_header(user_message);
1171 }
1172
1173
1174
1175 /*************************************************
1176 * Verify and check reverse DNS *
1177 *************************************************/
1178
1179 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1180 address if this has not yet been done. The host_name_lookup() function checks
1181 that one of these names resolves to an address list that contains the client IP
1182 address, so we don't actually have to do the check here.
1183
1184 Arguments:
1185 user_msgptr pointer for user message
1186 log_msgptr pointer for log message
1187
1188 Returns: OK verification condition succeeded
1189 FAIL verification failed
1190 DEFER there was a problem verifying
1191 */
1192
1193 static int
1194 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1195 {
1196 int rc;
1197
1198 user_msgptr = user_msgptr; /* stop compiler warning */
1199
1200 /* Previous success */
1201
1202 if (sender_host_name != NULL) return OK;
1203
1204 /* Previous failure */
1205
1206 if (host_lookup_failed)
1207 {
1208 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1209 return FAIL;
1210 }
1211
1212 /* Need to do a lookup */
1213
1214 HDEBUG(D_acl)
1215 debug_printf_indent("looking up host name to force name/address consistency check\n");
1216
1217 if ((rc = host_name_lookup()) != OK)
1218 {
1219 *log_msgptr = (rc == DEFER)?
1220 US"host lookup deferred for reverse lookup check"
1221 :
1222 string_sprintf("host lookup failed for reverse lookup check%s",
1223 host_lookup_msg);
1224 return rc; /* DEFER or FAIL */
1225 }
1226
1227 host_build_sender_fullhost();
1228 return OK;
1229 }
1230
1231
1232
1233 /*************************************************
1234 * Check client IP address matches CSA target *
1235 *************************************************/
1236
1237 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1238 response for address records belonging to the CSA target hostname. The section
1239 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1240 If one of the addresses matches the client's IP address, then the client is
1241 authorized by CSA. If there are target IP addresses but none of them match
1242 then the client is using an unauthorized IP address. If there are no target IP
1243 addresses then the client cannot be using an authorized IP address. (This is
1244 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1245
1246 Arguments:
1247 dnsa the DNS answer block
1248 dnss a DNS scan block for us to use
1249 reset option specifying what portion to scan, as described above
1250 target the target hostname to use for matching RR names
1251
1252 Returns: CSA_OK successfully authorized
1253 CSA_FAIL_MISMATCH addresses found but none matched
1254 CSA_FAIL_NOADDR no target addresses found
1255 */
1256
1257 static int
1258 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1259 uschar *target)
1260 {
1261 dns_record *rr;
1262 dns_address *da;
1263
1264 BOOL target_found = FALSE;
1265
1266 for (rr = dns_next_rr(dnsa, dnss, reset);
1267 rr != NULL;
1268 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1269 {
1270 /* Check this is an address RR for the target hostname. */
1271
1272 if (rr->type != T_A
1273 #if HAVE_IPV6
1274 && rr->type != T_AAAA
1275 #endif
1276 ) continue;
1277
1278 if (strcmpic(target, rr->name) != 0) continue;
1279
1280 target_found = TRUE;
1281
1282 /* Turn the target address RR into a list of textual IP addresses and scan
1283 the list. There may be more than one if it is an A6 RR. */
1284
1285 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1286 {
1287 /* If the client IP address matches the target IP address, it's good! */
1288
1289 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1290
1291 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1292 }
1293 }
1294
1295 /* If we found some target addresses but none of them matched, the client is
1296 using an unauthorized IP address, otherwise the target has no authorized IP
1297 addresses. */
1298
1299 if (target_found) return CSA_FAIL_MISMATCH;
1300 else return CSA_FAIL_NOADDR;
1301 }
1302
1303
1304
1305 /*************************************************
1306 * Verify Client SMTP Authorization *
1307 *************************************************/
1308
1309 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1310 to find the CSA SRV record corresponding to the domain argument, or
1311 $sender_helo_name if no argument is provided. It then checks that the
1312 client is authorized, and that its IP address corresponds to the SRV
1313 target's address by calling acl_verify_csa_address() above. The address
1314 should have been returned in the DNS response's ADDITIONAL section, but if
1315 not we perform another DNS lookup to get it.
1316
1317 Arguments:
1318 domain pointer to optional parameter following verify = csa
1319
1320 Returns: CSA_UNKNOWN no valid CSA record found
1321 CSA_OK successfully authorized
1322 CSA_FAIL_* client is definitely not authorized
1323 CSA_DEFER_* there was a DNS problem
1324 */
1325
1326 static int
1327 acl_verify_csa(const uschar *domain)
1328 {
1329 tree_node *t;
1330 const uschar *found;
1331 int priority, weight, port;
1332 dns_answer dnsa;
1333 dns_scan dnss;
1334 dns_record *rr;
1335 int rc, type;
1336 uschar target[256];
1337
1338 /* Work out the domain we are using for the CSA lookup. The default is the
1339 client's HELO domain. If the client has not said HELO, use its IP address
1340 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1341
1342 while (isspace(*domain) && *domain != '\0') ++domain;
1343 if (*domain == '\0') domain = sender_helo_name;
1344 if (domain == NULL) domain = sender_host_address;
1345 if (sender_host_address == NULL) return CSA_UNKNOWN;
1346
1347 /* If we have an address literal, strip off the framing ready for turning it
1348 into a domain. The framing consists of matched square brackets possibly
1349 containing a keyword and a colon before the actual IP address. */
1350
1351 if (domain[0] == '[')
1352 {
1353 const uschar *start = Ustrchr(domain, ':');
1354 if (start == NULL) start = domain;
1355 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1356 }
1357
1358 /* Turn domains that look like bare IP addresses into domains in the reverse
1359 DNS. This code also deals with address literals and $sender_host_address. It's
1360 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1361 address literals, but it's probably the most friendly thing to do. This is an
1362 extension to CSA, so we allow it to be turned off for proper conformance. */
1363
1364 if (string_is_ip_address(domain, NULL) != 0)
1365 {
1366 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1367 dns_build_reverse(domain, target);
1368 domain = target;
1369 }
1370
1371 /* Find out if we've already done the CSA check for this domain. If we have,
1372 return the same result again. Otherwise build a new cached result structure
1373 for this domain. The name is filled in now, and the value is filled in when
1374 we return from this function. */
1375
1376 t = tree_search(csa_cache, domain);
1377 if (t != NULL) return t->data.val;
1378
1379 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1380 Ustrcpy(t->name, domain);
1381 (void)tree_insertnode(&csa_cache, t);
1382
1383 /* Now we are ready to do the actual DNS lookup(s). */
1384
1385 found = domain;
1386 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1387 {
1388 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1389
1390 default:
1391 return t->data.val = CSA_DEFER_SRV;
1392
1393 /* If we found nothing, the client's authorization is unknown. */
1394
1395 case DNS_NOMATCH:
1396 case DNS_NODATA:
1397 return t->data.val = CSA_UNKNOWN;
1398
1399 /* We got something! Go on to look at the reply in more detail. */
1400
1401 case DNS_SUCCEED:
1402 break;
1403 }
1404
1405 /* Scan the reply for well-formed CSA SRV records. */
1406
1407 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1408 rr;
1409 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1410 {
1411 const uschar * p = rr->data;
1412
1413 /* Extract the numerical SRV fields (p is incremented) */
1414
1415 GETSHORT(priority, p);
1416 GETSHORT(weight, p);
1417 GETSHORT(port, p);
1418
1419 DEBUG(D_acl)
1420 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1421
1422 /* Check the CSA version number */
1423
1424 if (priority != 1) continue;
1425
1426 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1427 found by dns_special_lookup() is a parent of the one we asked for), we check
1428 the subdomain assertions in the port field. At the moment there's only one
1429 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1430 SRV records of their own. */
1431
1432 if (Ustrcmp(found, domain) != 0)
1433 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1434
1435 /* This CSA SRV record refers directly to our domain, so we check the value
1436 in the weight field to work out the domain's authorization. 0 and 1 are
1437 unauthorized; 3 means the client is authorized but we can't check the IP
1438 address in order to authenticate it, so we treat it as unknown; values
1439 greater than 3 are undefined. */
1440
1441 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1442
1443 if (weight > 2) continue;
1444
1445 /* Weight == 2, which means the domain is authorized. We must check that the
1446 client's IP address is listed as one of the SRV target addresses. Save the
1447 target hostname then break to scan the additional data for its addresses. */
1448
1449 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1450 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1451
1452 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1453
1454 break;
1455 }
1456
1457 /* If we didn't break the loop then no appropriate records were found. */
1458
1459 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1460
1461 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1462 A target of "." indicates there are no valid addresses, so the client cannot
1463 be authorized. (This is an odd configuration because weight=2 target=. is
1464 equivalent to weight=1, but we check for it in order to keep load off the
1465 root name servers.) Note that dn_expand() turns "." into "". */
1466
1467 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1468
1469 /* Scan the additional section of the CSA SRV reply for addresses belonging
1470 to the target. If the name server didn't return any additional data (e.g.
1471 because it does not fully support SRV records), we need to do another lookup
1472 to obtain the target addresses; otherwise we have a definitive result. */
1473
1474 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1475 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1476
1477 /* The DNS lookup type corresponds to the IP version used by the client. */
1478
1479 #if HAVE_IPV6
1480 if (Ustrchr(sender_host_address, ':') != NULL)
1481 type = T_AAAA;
1482 else
1483 #endif /* HAVE_IPV6 */
1484 type = T_A;
1485
1486
1487 lookup_dnssec_authenticated = NULL;
1488 switch (dns_lookup(&dnsa, target, type, NULL))
1489 {
1490 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1491
1492 default:
1493 return t->data.val = CSA_DEFER_ADDR;
1494
1495 /* If the query succeeded, scan the addresses and return the result. */
1496
1497 case DNS_SUCCEED:
1498 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1499 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1500 /* else fall through */
1501
1502 /* If the target has no IP addresses, the client cannot have an authorized
1503 IP address. However, if the target site uses A6 records (not AAAA records)
1504 we have to do yet another lookup in order to check them. */
1505
1506 case DNS_NOMATCH:
1507 case DNS_NODATA:
1508 return t->data.val = CSA_FAIL_NOADDR;
1509 }
1510 }
1511
1512
1513
1514 /*************************************************
1515 * Handle verification (address & other) *
1516 *************************************************/
1517
1518 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1519 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1520 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1521 };
1522 typedef struct {
1523 uschar * name;
1524 int value;
1525 unsigned where_allowed; /* bitmap */
1526 BOOL no_options; /* Never has /option(s) following */
1527 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1528 } verify_type_t;
1529 static verify_type_t verify_type_list[] = {
1530 /* name value where no-opt opt-sep */
1531 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1532 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1533 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1534 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1535 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1536 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1537 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1538 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1539 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1540 FALSE, 6 },
1541 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1542 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1543 #ifdef EXPERIMENTAL_ARC
1544 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1545 #endif
1546 };
1547
1548
1549 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1550 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1551 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1552 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1553 };
1554 typedef struct {
1555 uschar * name;
1556 int value;
1557 int flag;
1558 BOOL has_option; /* Has =option(s) following */
1559 BOOL timeval; /* Has a time value */
1560 } callout_opt_t;
1561 static callout_opt_t callout_opt_list[] = {
1562 /* name value flag has-opt has-time */
1563 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1564 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1565 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1566 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1567 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1568 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1569 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1570 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1571 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1572 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1573 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1574 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1575 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1576 };
1577
1578
1579
1580 /* This function implements the "verify" condition. It is called when
1581 encountered in any ACL, because some tests are almost always permitted. Some
1582 just don't make sense, and always fail (for example, an attempt to test a host
1583 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1584
1585 Arguments:
1586 where where called from
1587 addr the recipient address that the ACL is handling, or NULL
1588 arg the argument of "verify"
1589 user_msgptr pointer for user message
1590 log_msgptr pointer for log message
1591 basic_errno where to put verify errno
1592
1593 Returns: OK verification condition succeeded
1594 FAIL verification failed
1595 DEFER there was a problem verifying
1596 ERROR syntax error
1597 */
1598
1599 static int
1600 acl_verify(int where, address_item *addr, const uschar *arg,
1601 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1602 {
1603 int sep = '/';
1604 int callout = -1;
1605 int callout_overall = -1;
1606 int callout_connect = -1;
1607 int verify_options = 0;
1608 int rc;
1609 BOOL verify_header_sender = FALSE;
1610 BOOL defer_ok = FALSE;
1611 BOOL callout_defer_ok = FALSE;
1612 BOOL no_details = FALSE;
1613 BOOL success_on_redirect = FALSE;
1614 address_item *sender_vaddr = NULL;
1615 uschar *verify_sender_address = NULL;
1616 uschar *pm_mailfrom = NULL;
1617 uschar *se_mailfrom = NULL;
1618
1619 /* Some of the verify items have slash-separated options; some do not. Diagnose
1620 an error if options are given for items that don't expect them.
1621 */
1622
1623 uschar *slash = Ustrchr(arg, '/');
1624 const uschar *list = arg;
1625 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1626 verify_type_t * vp;
1627
1628 if (!ss) goto BAD_VERIFY;
1629
1630 /* Handle name/address consistency verification in a separate function. */
1631
1632 for (vp= verify_type_list;
1633 CS vp < CS verify_type_list + sizeof(verify_type_list);
1634 vp++
1635 )
1636 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1637 : strcmpic (ss, vp->name) == 0)
1638 break;
1639 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1640 goto BAD_VERIFY;
1641
1642 if (vp->no_options && slash)
1643 {
1644 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1645 "(this verify item has no options)", arg);
1646 return ERROR;
1647 }
1648 if (!(vp->where_allowed & BIT(where)))
1649 {
1650 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1651 vp->name, acl_wherenames[where]);
1652 return ERROR;
1653 }
1654 switch(vp->value)
1655 {
1656 case VERIFY_REV_HOST_LKUP:
1657 if (!sender_host_address) return OK;
1658 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1659 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1660 if (strcmpic(ss, US"defer_ok") == 0)
1661 return OK;
1662 return rc;
1663
1664 case VERIFY_CERT:
1665 /* TLS certificate verification is done at STARTTLS time; here we just
1666 test whether it was successful or not. (This is for optional verification; for
1667 mandatory verification, the connection doesn't last this long.) */
1668
1669 if (tls_in.certificate_verified) return OK;
1670 *user_msgptr = US"no verified certificate";
1671 return FAIL;
1672
1673 case VERIFY_HELO:
1674 /* We can test the result of optional HELO verification that might have
1675 occurred earlier. If not, we can attempt the verification now. */
1676
1677 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1678 return f.helo_verified ? OK : FAIL;
1679
1680 case VERIFY_CSA:
1681 /* Do Client SMTP Authorization checks in a separate function, and turn the
1682 result code into user-friendly strings. */
1683
1684 rc = acl_verify_csa(list);
1685 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1686 csa_reason_string[rc]);
1687 csa_status = csa_status_string[rc];
1688 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1689 return csa_return_code[rc];
1690
1691 #ifdef EXPERIMENTAL_ARC
1692 case VERIFY_ARC:
1693 { /* Do Authenticated Received Chain checks in a separate function. */
1694 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1695 int csep = 0;
1696 uschar * cond;
1697
1698 if (!(arc_state = acl_verify_arc())) return DEFER;
1699 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1700 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1701
1702 if (!condlist) condlist = US"none:pass";
1703 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1704 if (Ustrcmp(arc_state, cond) == 0) return OK;
1705 return FAIL;
1706 }
1707 #endif
1708
1709 case VERIFY_HDR_SYNTAX:
1710 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1711 a syntax error, we return details of the error to the sender if configured to
1712 send out full details. (But a "message" setting on the ACL can override, as
1713 always). */
1714
1715 rc = verify_check_headers(log_msgptr);
1716 if (rc != OK && *log_msgptr)
1717 if (smtp_return_error_details)
1718 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1719 else
1720 acl_verify_message = *log_msgptr;
1721 return rc;
1722
1723 case VERIFY_HDR_NAMES_ASCII:
1724 /* Check that all header names are true 7 bit strings
1725 See RFC 5322, 2.2. and RFC 6532, 3. */
1726
1727 rc = verify_check_header_names_ascii(log_msgptr);
1728 if (rc != OK && smtp_return_error_details && *log_msgptr)
1729 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1730 return rc;
1731
1732 case VERIFY_NOT_BLIND:
1733 /* Check that no recipient of this message is "blind", that is, every envelope
1734 recipient must be mentioned in either To: or Cc:. */
1735
1736 if ((rc = verify_check_notblind()) != OK)
1737 {
1738 *log_msgptr = string_sprintf("bcc recipient detected");
1739 if (smtp_return_error_details)
1740 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1741 }
1742 return rc;
1743
1744 /* The remaining verification tests check recipient and sender addresses,
1745 either from the envelope or from the header. There are a number of
1746 slash-separated options that are common to all of them. */
1747
1748 case VERIFY_HDR_SNDR:
1749 verify_header_sender = TRUE;
1750 break;
1751
1752 case VERIFY_SNDR:
1753 /* In the case of a sender, this can optionally be followed by an address to use
1754 in place of the actual sender (rare special-case requirement). */
1755 {
1756 uschar *s = ss + 6;
1757 if (*s == 0)
1758 verify_sender_address = sender_address;
1759 else
1760 {
1761 while (isspace(*s)) s++;
1762 if (*s++ != '=') goto BAD_VERIFY;
1763 while (isspace(*s)) s++;
1764 verify_sender_address = string_copy(s);
1765 }
1766 }
1767 break;
1768
1769 case VERIFY_RCPT:
1770 break;
1771 }
1772
1773
1774
1775 /* Remaining items are optional; they apply to sender and recipient
1776 verification, including "header sender" verification. */
1777
1778 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1779 != NULL)
1780 {
1781 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1782 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1783 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1784
1785 /* These two old options are left for backwards compatibility */
1786
1787 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1788 {
1789 callout_defer_ok = TRUE;
1790 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1791 }
1792
1793 else if (strcmpic(ss, US"check_postmaster") == 0)
1794 {
1795 pm_mailfrom = US"";
1796 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1797 }
1798
1799 /* The callout option has a number of sub-options, comma separated */
1800
1801 else if (strncmpic(ss, US"callout", 7) == 0)
1802 {
1803 callout = CALLOUT_TIMEOUT_DEFAULT;
1804 ss += 7;
1805 if (*ss != 0)
1806 {
1807 while (isspace(*ss)) ss++;
1808 if (*ss++ == '=')
1809 {
1810 const uschar * sublist = ss;
1811 int optsep = ',';
1812 uschar *opt;
1813 uschar buffer[256];
1814 while (isspace(*sublist)) sublist++;
1815
1816 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1817 {
1818 callout_opt_t * op;
1819 double period = 1.0F;
1820
1821 for (op= callout_opt_list; op->name; op++)
1822 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1823 break;
1824
1825 verify_options |= op->flag;
1826 if (op->has_option)
1827 {
1828 opt += Ustrlen(op->name);
1829 while (isspace(*opt)) opt++;
1830 if (*opt++ != '=')
1831 {
1832 *log_msgptr = string_sprintf("'=' expected after "
1833 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1834 return ERROR;
1835 }
1836 while (isspace(*opt)) opt++;
1837 }
1838 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1839 {
1840 *log_msgptr = string_sprintf("bad time value in ACL condition "
1841 "\"verify %s\"", arg);
1842 return ERROR;
1843 }
1844
1845 switch(op->value)
1846 {
1847 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1848 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1849 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1850 case CALLOUT_MAILFROM:
1851 if (!verify_header_sender)
1852 {
1853 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1854 "callout option only for verify=header_sender (detected in ACL "
1855 "condition \"%s\")", arg);
1856 return ERROR;
1857 }
1858 se_mailfrom = string_copy(opt);
1859 break;
1860 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1861 case CALLOUT_MAXWAIT: callout_overall = period; break;
1862 case CALLOUT_CONNECT: callout_connect = period; break;
1863 case CALLOUT_TIME: callout = period; break;
1864 }
1865 }
1866 }
1867 else
1868 {
1869 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1870 "ACL condition \"%s\"", arg);
1871 return ERROR;
1872 }
1873 }
1874 }
1875
1876 /* Option not recognized */
1877
1878 else
1879 {
1880 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1881 "condition \"verify %s\"", ss, arg);
1882 return ERROR;
1883 }
1884 }
1885
1886 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1887 (vopt_callout_recipsender|vopt_callout_recippmaster))
1888 {
1889 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1890 "for a recipient callout";
1891 return ERROR;
1892 }
1893
1894 /* Handle sender-in-header verification. Default the user message to the log
1895 message if giving out verification details. */
1896
1897 if (verify_header_sender)
1898 {
1899 int verrno;
1900
1901 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1902 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1903 &verrno)) != OK)
1904 {
1905 *basic_errno = verrno;
1906 if (smtp_return_error_details)
1907 {
1908 if (!*user_msgptr && *log_msgptr)
1909 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1910 if (rc == DEFER) f.acl_temp_details = TRUE;
1911 }
1912 }
1913 }
1914
1915 /* Handle a sender address. The default is to verify *the* sender address, but
1916 optionally a different address can be given, for special requirements. If the
1917 address is empty, we are dealing with a bounce message that has no sender, so
1918 we cannot do any checking. If the real sender address gets rewritten during
1919 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1920 during message reception.
1921
1922 A list of verified "sender" addresses is kept to try to avoid doing to much
1923 work repetitively when there are multiple recipients in a message and they all
1924 require sender verification. However, when callouts are involved, it gets too
1925 complicated because different recipients may require different callout options.
1926 Therefore, we always do a full sender verify when any kind of callout is
1927 specified. Caching elsewhere, for instance in the DNS resolver and in the
1928 callout handling, should ensure that this is not terribly inefficient. */
1929
1930 else if (verify_sender_address)
1931 {
1932 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1933 {
1934 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1935 "sender verify callout";
1936 return ERROR;
1937 }
1938
1939 sender_vaddr = verify_checked_sender(verify_sender_address);
1940 if (sender_vaddr != NULL && /* Previously checked */
1941 callout <= 0) /* No callout needed this time */
1942 {
1943 /* If the "routed" flag is set, it means that routing worked before, so
1944 this check can give OK (the saved return code value, if set, belongs to a
1945 callout that was done previously). If the "routed" flag is not set, routing
1946 must have failed, so we use the saved return code. */
1947
1948 if (testflag(sender_vaddr, af_verify_routed))
1949 rc = OK;
1950 else
1951 {
1952 rc = sender_vaddr->special_action;
1953 *basic_errno = sender_vaddr->basic_errno;
1954 }
1955 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1956 }
1957
1958 /* Do a new verification, and cache the result. The cache is used to avoid
1959 verifying the sender multiple times for multiple RCPTs when callouts are not
1960 specified (see comments above).
1961
1962 The cache is also used on failure to give details in response to the first
1963 RCPT that gets bounced for this reason. However, this can be suppressed by
1964 the no_details option, which sets the flag that says "this detail has already
1965 been sent". The cache normally contains just one address, but there may be
1966 more in esoteric circumstances. */
1967
1968 else
1969 {
1970 BOOL routed = TRUE;
1971 uschar *save_address_data = deliver_address_data;
1972
1973 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1974 #ifdef SUPPORT_I18N
1975 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1976 {
1977 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1978 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1979 }
1980 #endif
1981 if (no_details) setflag(sender_vaddr, af_sverify_told);
1982 if (verify_sender_address[0] != 0)
1983 {
1984 /* If this is the real sender address, save the unrewritten version
1985 for use later in receive. Otherwise, set a flag so that rewriting the
1986 sender in verify_address() does not update sender_address. */
1987
1988 if (verify_sender_address == sender_address)
1989 sender_address_unrewritten = sender_address;
1990 else
1991 verify_options |= vopt_fake_sender;
1992
1993 if (success_on_redirect)
1994 verify_options |= vopt_success_on_redirect;
1995
1996 /* The recipient, qualify, and expn options are never set in
1997 verify_options. */
1998
1999 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2000 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2001
2002 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2003
2004 if (rc != OK)
2005 *basic_errno = sender_vaddr->basic_errno;
2006 else
2007 DEBUG(D_acl)
2008 {
2009 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2010 debug_printf_indent("sender %s verified ok as %s\n",
2011 verify_sender_address, sender_vaddr->address);
2012 else
2013 debug_printf_indent("sender %s verified ok\n",
2014 verify_sender_address);
2015 }
2016 }
2017 else
2018 rc = OK; /* Null sender */
2019
2020 /* Cache the result code */
2021
2022 if (routed) setflag(sender_vaddr, af_verify_routed);
2023 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2024 sender_vaddr->special_action = rc;
2025 sender_vaddr->next = sender_verified_list;
2026 sender_verified_list = sender_vaddr;
2027
2028 /* Restore the recipient address data, which might have been clobbered by
2029 the sender verification. */
2030
2031 deliver_address_data = save_address_data;
2032 }
2033
2034 /* Put the sender address_data value into $sender_address_data */
2035
2036 sender_address_data = sender_vaddr->prop.address_data;
2037 }
2038
2039 /* A recipient address just gets a straightforward verify; again we must handle
2040 the DEFER overrides. */
2041
2042 else
2043 {
2044 address_item addr2;
2045
2046 if (success_on_redirect)
2047 verify_options |= vopt_success_on_redirect;
2048
2049 /* We must use a copy of the address for verification, because it might
2050 get rewritten. */
2051
2052 addr2 = *addr;
2053 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2054 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2055 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2056
2057 *basic_errno = addr2.basic_errno;
2058 *log_msgptr = addr2.message;
2059 *user_msgptr = (addr2.user_message != NULL)?
2060 addr2.user_message : addr2.message;
2061
2062 /* Allow details for temporary error if the address is so flagged. */
2063 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2064
2065 /* Make $address_data visible */
2066 deliver_address_data = addr2.prop.address_data;
2067 }
2068
2069 /* We have a result from the relevant test. Handle defer overrides first. */
2070
2071 if (rc == DEFER && (defer_ok ||
2072 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2073 {
2074 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2075 defer_ok? "defer_ok" : "callout_defer_ok");
2076 rc = OK;
2077 }
2078
2079 /* If we've failed a sender, set up a recipient message, and point
2080 sender_verified_failed to the address item that actually failed. */
2081
2082 if (rc != OK && verify_sender_address != NULL)
2083 {
2084 if (rc != DEFER)
2085 *log_msgptr = *user_msgptr = US"Sender verify failed";
2086 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2087 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2088 else
2089 {
2090 *log_msgptr = US"Could not complete sender verify callout";
2091 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2092 *log_msgptr;
2093 }
2094
2095 sender_verified_failed = sender_vaddr;
2096 }
2097
2098 /* Verifying an address messes up the values of $domain and $local_part,
2099 so reset them before returning if this is a RCPT ACL. */
2100
2101 if (addr != NULL)
2102 {
2103 deliver_domain = addr->domain;
2104 deliver_localpart = addr->local_part;
2105 }
2106 return rc;
2107
2108 /* Syntax errors in the verify argument come here. */
2109
2110 BAD_VERIFY:
2111 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2112 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2113 "or \"reverse_host_lookup\" at start of ACL condition "
2114 "\"verify %s\"", arg);
2115 return ERROR;
2116 }
2117
2118
2119
2120
2121 /*************************************************
2122 * Check argument for control= modifier *
2123 *************************************************/
2124
2125 /* Called from acl_check_condition() below
2126
2127 Arguments:
2128 arg the argument string for control=
2129 pptr set to point to the terminating character
2130 where which ACL we are in
2131 log_msgptr for error messages
2132
2133 Returns: CONTROL_xxx value
2134 */
2135
2136 static int
2137 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2138 {
2139 int idx, len;
2140 control_def * d;
2141
2142 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2143 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2144 && (!d->has_option || arg[len] != '/')
2145 ) )
2146 {
2147 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2148 return CONTROL_ERROR;
2149 }
2150
2151 *pptr = arg + len;
2152 return idx;
2153 }
2154
2155
2156
2157
2158 /*************************************************
2159 * Return a ratelimit error *
2160 *************************************************/
2161
2162 /* Called from acl_ratelimit() below
2163
2164 Arguments:
2165 log_msgptr for error messages
2166 format format string
2167 ... supplementary arguments
2168
2169 Returns: ERROR
2170 */
2171
2172 static int
2173 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2174 {
2175 va_list ap;
2176 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2177 va_start(ap, format);
2178 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2179 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2180 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2181 va_end(ap);
2182 *log_msgptr = string_sprintf(
2183 "error in arguments to \"ratelimit\" condition: %s", buffer);
2184 return ERROR;
2185 }
2186
2187
2188
2189
2190 /*************************************************
2191 * Handle rate limiting *
2192 *************************************************/
2193
2194 /* Called by acl_check_condition() below to calculate the result
2195 of the ACL ratelimit condition.
2196
2197 Note that the return value might be slightly unexpected: if the
2198 sender's rate is above the limit then the result is OK. This is
2199 similar to the dnslists condition, and is so that you can write
2200 ACL clauses like: defer ratelimit = 15 / 1h
2201
2202 Arguments:
2203 arg the option string for ratelimit=
2204 where ACL_WHERE_xxxx indicating which ACL this is
2205 log_msgptr for error messages
2206
2207 Returns: OK - Sender's rate is above limit
2208 FAIL - Sender's rate is below limit
2209 DEFER - Problem opening ratelimit database
2210 ERROR - Syntax error in options.
2211 */
2212
2213 static int
2214 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2215 {
2216 double limit, period, count;
2217 uschar *ss;
2218 uschar *key = NULL;
2219 uschar *unique = NULL;
2220 int sep = '/';
2221 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2222 BOOL noupdate = FALSE, badacl = FALSE;
2223 int mode = RATE_PER_WHAT;
2224 int old_pool, rc;
2225 tree_node **anchor, *t;
2226 open_db dbblock, *dbm;
2227 int dbdb_size;
2228 dbdata_ratelimit *dbd;
2229 dbdata_ratelimit_unique *dbdb;
2230 struct timeval tv;
2231
2232 /* Parse the first two options and record their values in expansion
2233 variables. These variables allow the configuration to have informative
2234 error messages based on rate limits obtained from a table lookup. */
2235
2236 /* First is the maximum number of messages per period / maximum burst
2237 size, which must be greater than or equal to zero. Zero is useful for
2238 rate measurement as opposed to rate limiting. */
2239
2240 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2241 return ratelimit_error(log_msgptr, "sender rate limit not set");
2242
2243 limit = Ustrtod(sender_rate_limit, &ss);
2244 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2245 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2246 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2247
2248 if (limit < 0.0 || *ss != '\0')
2249 return ratelimit_error(log_msgptr,
2250 "\"%s\" is not a positive number", sender_rate_limit);
2251
2252 /* Second is the rate measurement period / exponential smoothing time
2253 constant. This must be strictly greater than zero, because zero leads to
2254 run-time division errors. */
2255
2256 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2257 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2258 if (period <= 0.0)
2259 return ratelimit_error(log_msgptr,
2260 "\"%s\" is not a time value", sender_rate_period);
2261
2262 /* By default we are counting one of something, but the per_rcpt,
2263 per_byte, and count options can change this. */
2264
2265 count = 1.0;
2266
2267 /* Parse the other options. */
2268
2269 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
2270 {
2271 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2272 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2273 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2274 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2275 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2276 else if (strcmpic(ss, US"per_conn") == 0)
2277 {
2278 RATE_SET(mode, PER_CONN);
2279 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2280 badacl = TRUE;
2281 }
2282 else if (strcmpic(ss, US"per_mail") == 0)
2283 {
2284 RATE_SET(mode, PER_MAIL);
2285 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2286 }
2287 else if (strcmpic(ss, US"per_rcpt") == 0)
2288 {
2289 /* If we are running in the RCPT ACL, then we'll count the recipients
2290 one by one, but if we are running when we have accumulated the whole
2291 list then we'll add them all in one batch. */
2292 if (where == ACL_WHERE_RCPT)
2293 RATE_SET(mode, PER_RCPT);
2294 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2295 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2296 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2297 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2298 }
2299 else if (strcmpic(ss, US"per_byte") == 0)
2300 {
2301 /* If we have not yet received the message data and there was no SIZE
2302 declaration on the MAIL command, then it's safe to just use a value of
2303 zero and let the recorded rate decay as if nothing happened. */
2304 RATE_SET(mode, PER_MAIL);
2305 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2306 else count = message_size < 0 ? 0.0 : (double)message_size;
2307 }
2308 else if (strcmpic(ss, US"per_addr") == 0)
2309 {
2310 RATE_SET(mode, PER_RCPT);
2311 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2312 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2313 }
2314 else if (strncmpic(ss, US"count=", 6) == 0)
2315 {
2316 uschar *e;
2317 count = Ustrtod(ss+6, &e);
2318 if (count < 0.0 || *e != '\0')
2319 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2320 }
2321 else if (strncmpic(ss, US"unique=", 7) == 0)
2322 unique = string_copy(ss + 7);
2323 else if (!key)
2324 key = string_copy(ss);
2325 else
2326 key = string_sprintf("%s/%s", key, ss);
2327 }
2328
2329 /* Sanity check. When the badacl flag is set the update mode must either
2330 be readonly (which is the default if it is omitted) or, for backwards
2331 compatibility, a combination of noupdate and strict or leaky. */
2332
2333 if (mode == RATE_PER_CLASH)
2334 return ratelimit_error(log_msgptr, "conflicting per_* options");
2335 if (leaky + strict + readonly > 1)
2336 return ratelimit_error(log_msgptr, "conflicting update modes");
2337 if (badacl && (leaky || strict) && !noupdate)
2338 return ratelimit_error(log_msgptr,
2339 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2340 ratelimit_option_string[mode], acl_wherenames[where]);
2341
2342 /* Set the default values of any unset options. In readonly mode we
2343 perform the rate computation without any increment so that its value
2344 decays to eventually allow over-limit senders through. */
2345
2346 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2347 if (badacl) readonly = TRUE;
2348 if (readonly) count = 0.0;
2349 if (!strict && !readonly) leaky = TRUE;
2350 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2351
2352 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2353 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2354 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2355 are added to the key because they alter the meaning of the stored data. */
2356
2357 if (!key)
2358 key = !sender_host_address ? US"" : sender_host_address;
2359
2360 key = string_sprintf("%s/%s/%s%s",
2361 sender_rate_period,
2362 ratelimit_option_string[mode],
2363 unique == NULL ? "" : "unique/",
2364 key);
2365
2366 HDEBUG(D_acl)
2367 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2368
2369 /* See if we have already computed the rate by looking in the relevant tree.
2370 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2371 pool so that they survive across resets. In readonly mode we only remember the
2372 result for the rest of this command in case a later command changes it. After
2373 this bit of logic the code is independent of the per_* mode. */
2374
2375 old_pool = store_pool;
2376
2377 if (readonly)
2378 anchor = &ratelimiters_cmd;
2379 else switch(mode)
2380 {
2381 case RATE_PER_CONN:
2382 anchor = &ratelimiters_conn;
2383 store_pool = POOL_PERM;
2384 break;
2385 case RATE_PER_BYTE:
2386 case RATE_PER_MAIL:
2387 case RATE_PER_ALLRCPTS:
2388 anchor = &ratelimiters_mail;
2389 break;
2390 case RATE_PER_ADDR:
2391 case RATE_PER_CMD:
2392 case RATE_PER_RCPT:
2393 anchor = &ratelimiters_cmd;
2394 break;
2395 default:
2396 anchor = NULL; /* silence an "unused" complaint */
2397 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2398 "internal ACL error: unknown ratelimit mode %d", mode);
2399 break;
2400 }
2401
2402 if ((t = tree_search(*anchor, key)))
2403 {
2404 dbd = t->data.ptr;
2405 /* The following few lines duplicate some of the code below. */
2406 rc = (dbd->rate < limit)? FAIL : OK;
2407 store_pool = old_pool;
2408 sender_rate = string_sprintf("%.1f", dbd->rate);
2409 HDEBUG(D_acl)
2410 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2411 return rc;
2412 }
2413
2414 /* We aren't using a pre-computed rate, so get a previously recorded rate
2415 from the database, which will be updated and written back if required. */
2416
2417 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2418 {
2419 store_pool = old_pool;
2420 sender_rate = NULL;
2421 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2422 *log_msgptr = US"ratelimit database not available";
2423 return DEFER;
2424 }
2425 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2426 dbd = NULL;
2427
2428 gettimeofday(&tv, NULL);
2429
2430 if (dbdb)
2431 {
2432 /* Locate the basic ratelimit block inside the DB data. */
2433 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2434 dbd = &dbdb->dbd;
2435
2436 /* Forget the old Bloom filter if it is too old, so that we count each
2437 repeating event once per period. We don't simply clear and re-use the old
2438 filter because we want its size to change if the limit changes. Note that
2439 we keep the dbd pointer for copying the rate into the new data block. */
2440
2441 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2442 {
2443 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2444 dbdb = NULL;
2445 }
2446
2447 /* Sanity check. */
2448
2449 if(unique && dbdb_size < sizeof(*dbdb))
2450 {
2451 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2452 dbdb = NULL;
2453 }
2454 }
2455
2456 /* Allocate a new data block if the database lookup failed
2457 or the Bloom filter passed its age limit. */
2458
2459 if (!dbdb)
2460 {
2461 if (!unique)
2462 {
2463 /* No Bloom filter. This basic ratelimit block is initialized below. */
2464 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2465 dbdb_size = sizeof(*dbd);
2466 dbdb = store_get(dbdb_size);
2467 }
2468 else
2469 {
2470 int extra;
2471 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2472
2473 /* See the long comment below for an explanation of the magic number 2.
2474 The filter has a minimum size in case the rate limit is very small;
2475 this is determined by the definition of dbdata_ratelimit_unique. */
2476
2477 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2478 if (extra < 0) extra = 0;
2479 dbdb_size = sizeof(*dbdb) + extra;
2480 dbdb = store_get(dbdb_size);
2481 dbdb->bloom_epoch = tv.tv_sec;
2482 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2483 memset(dbdb->bloom, 0, dbdb->bloom_size);
2484
2485 /* Preserve any basic ratelimit data (which is our longer-term memory)
2486 by copying it from the discarded block. */
2487
2488 if (dbd)
2489 {
2490 dbdb->dbd = *dbd;
2491 dbd = &dbdb->dbd;
2492 }
2493 }
2494 }
2495
2496 /* If we are counting unique events, find out if this event is new or not.
2497 If the client repeats the event during the current period then it should be
2498 counted. We skip this code in readonly mode for efficiency, because any
2499 changes to the filter will be discarded and because count is already set to
2500 zero. */
2501
2502 if (unique && !readonly)
2503 {
2504 /* We identify unique events using a Bloom filter. (You can find my
2505 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2506 With the per_addr option, an "event" is a recipient address, though the
2507 user can use the unique option to define their own events. We only count
2508 an event if we have not seen it before.
2509
2510 We size the filter according to the rate limit, which (in leaky mode)
2511 is the limit on the population of the filter. We allow 16 bits of space
2512 per entry (see the construction code above) and we set (up to) 8 of them
2513 when inserting an element (see the loop below). The probability of a false
2514 positive (an event we have not seen before but which we fail to count) is
2515
2516 size = limit * 16
2517 numhash = 8
2518 allzero = exp(-numhash * pop / size)
2519 = exp(-0.5 * pop / limit)
2520 fpr = pow(1 - allzero, numhash)
2521
2522 For senders at the limit the fpr is 0.06% or 1 in 1700
2523 and for senders at half the limit it is 0.0006% or 1 in 170000
2524
2525 In strict mode the Bloom filter can fill up beyond the normal limit, in
2526 which case the false positive rate will rise. This means that the
2527 measured rate for very fast senders can bogusly drop off after a while.
2528
2529 At twice the limit, the fpr is 2.5% or 1 in 40
2530 At four times the limit, it is 31% or 1 in 3.2
2531
2532 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2533 decay below the limit, and if this is more than one then the Bloom filter
2534 will be discarded before the decay gets that far. The false positive rate
2535 at this threshold is 9.3% or 1 in 10.7. */
2536
2537 BOOL seen;
2538 unsigned n, hash, hinc;
2539 uschar md5sum[16];
2540 md5 md5info;
2541
2542 /* Instead of using eight independent hash values, we combine two values
2543 using the formula h1 + n * h2. This does not harm the Bloom filter's
2544 performance, and means the amount of hash we need is independent of the
2545 number of bits we set in the filter. */
2546
2547 md5_start(&md5info);
2548 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2549 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2550 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2551
2552 /* Scan the bits corresponding to this event. A zero bit means we have
2553 not seen it before. Ensure all bits are set to record this event. */
2554
2555 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2556
2557 seen = TRUE;
2558 for (n = 0; n < 8; n++, hash += hinc)
2559 {
2560 int bit = 1 << (hash % 8);
2561 int byte = (hash / 8) % dbdb->bloom_size;
2562 if ((dbdb->bloom[byte] & bit) == 0)
2563 {
2564 dbdb->bloom[byte] |= bit;
2565 seen = FALSE;
2566 }
2567 }
2568
2569 /* If this event has occurred before, do not count it. */
2570
2571 if (seen)
2572 {
2573 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2574 count = 0.0;
2575 }
2576 else
2577 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2578 }
2579
2580 /* If there was no previous ratelimit data block for this key, initialize
2581 the new one, otherwise update the block from the database. The initial rate
2582 is what would be computed by the code below for an infinite interval. */
2583
2584 if (!dbd)
2585 {
2586 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2587 dbd = &dbdb->dbd;
2588 dbd->time_stamp = tv.tv_sec;
2589 dbd->time_usec = tv.tv_usec;
2590 dbd->rate = count;
2591 }
2592 else
2593 {
2594 /* The smoothed rate is computed using an exponentially weighted moving
2595 average adjusted for variable sampling intervals. The standard EWMA for
2596 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2597 where f() is the measured value and f'() is the smoothed value.
2598
2599 Old data decays out of the smoothed value exponentially, such that data n
2600 samples old is multiplied by a^n. The exponential decay time constant p
2601 is defined such that data p samples old is multiplied by 1/e, which means
2602 that a = exp(-1/p). We can maintain the same time constant for a variable
2603 sampling interval i by using a = exp(-i/p).
2604
2605 The rate we are measuring is messages per period, suitable for directly
2606 comparing with the limit. The average rate between now and the previous
2607 message is period / interval, which we feed into the EWMA as the sample.
2608
2609 It turns out that the number of messages required for the smoothed rate
2610 to reach the limit when they are sent in a burst is equal to the limit.
2611 This can be seen by analysing the value of the smoothed rate after N
2612 messages sent at even intervals. Let k = (1 - a) * p/i
2613
2614 rate_1 = (1 - a) * p/i + a * rate_0
2615 = k + a * rate_0
2616 rate_2 = k + a * rate_1
2617 = k + a * k + a^2 * rate_0
2618 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2619 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2620 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2621 = rate_0 * a^N + p/i * (1 - a^N)
2622
2623 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2624
2625 rate_N = p/i + (rate_0 - p/i) * a^N
2626 a^N = (rate_N - p/i) / (rate_0 - p/i)
2627 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2628 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2629
2630 Numerical analysis of the above equation, setting the computed rate to
2631 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2632 rates, p/i, the number of messages N = limit. So limit serves as both the
2633 maximum rate measured in messages per period, and the maximum number of
2634 messages that can be sent in a fast burst. */
2635
2636 double this_time = (double)tv.tv_sec
2637 + (double)tv.tv_usec / 1000000.0;
2638 double prev_time = (double)dbd->time_stamp
2639 + (double)dbd->time_usec / 1000000.0;
2640
2641 /* We must avoid division by zero, and deal gracefully with the clock going
2642 backwards. If we blunder ahead when time is in reverse then the computed
2643 rate will be bogus. To be safe we clamp interval to a very small number. */
2644
2645 double interval = this_time - prev_time <= 0.0 ? 1e-9
2646 : this_time - prev_time;
2647
2648 double i_over_p = interval / period;
2649 double a = exp(-i_over_p);
2650
2651 /* Combine the instantaneous rate (period / interval) with the previous rate
2652 using the smoothing factor a. In order to measure sized events, multiply the
2653 instantaneous rate by the count of bytes or recipients etc. */
2654
2655 dbd->time_stamp = tv.tv_sec;
2656 dbd->time_usec = tv.tv_usec;
2657 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2658
2659 /* When events are very widely spaced the computed rate tends towards zero.
2660 Although this is accurate it turns out not to be useful for our purposes,
2661 especially when the first event after a long silence is the start of a spam
2662 run. A more useful model is that the rate for an isolated event should be the
2663 size of the event per the period size, ignoring the lack of events outside
2664 the current period and regardless of where the event falls in the period. So,
2665 if the interval was so long that the calculated rate is unhelpfully small, we
2666 re-initialize the rate. In the absence of higher-rate bursts, the condition
2667 below is true if the interval is greater than the period. */
2668
2669 if (dbd->rate < count) dbd->rate = count;
2670 }
2671
2672 /* Clients sending at the limit are considered to be over the limit.
2673 This matters for edge cases such as a limit of zero, when the client
2674 should be completely blocked. */
2675
2676 rc = dbd->rate < limit ? FAIL : OK;
2677
2678 /* Update the state if the rate is low or if we are being strict. If we
2679 are in leaky mode and the sender's rate is too high, we do not update
2680 the recorded rate in order to avoid an over-aggressive sender's retry
2681 rate preventing them from getting any email through. If readonly is set,
2682 neither leaky nor strict are set, so we do not do any updates. */
2683
2684 if ((rc == FAIL && leaky) || strict)
2685 {
2686 dbfn_write(dbm, key, dbdb, dbdb_size);
2687 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2688 }
2689 else
2690 {
2691 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2692 readonly? "readonly mode" : "over the limit, but leaky");
2693 }
2694
2695 dbfn_close(dbm);
2696
2697 /* Store the result in the tree for future reference. */
2698
2699 t = store_get(sizeof(tree_node) + Ustrlen(key));
2700 t->data.ptr = dbd;
2701 Ustrcpy(t->name, key);
2702 (void)tree_insertnode(anchor, t);
2703
2704 /* We create the formatted version of the sender's rate very late in
2705 order to ensure that it is done using the correct storage pool. */
2706
2707 store_pool = old_pool;
2708 sender_rate = string_sprintf("%.1f", dbd->rate);
2709
2710 HDEBUG(D_acl)
2711 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2712
2713 return rc;
2714 }
2715
2716
2717
2718 /*************************************************
2719 * The udpsend ACL modifier *
2720 *************************************************/
2721
2722 /* Called by acl_check_condition() below.
2723
2724 Arguments:
2725 arg the option string for udpsend=
2726 log_msgptr for error messages
2727
2728 Returns: OK - Completed.
2729 DEFER - Problem with DNS lookup.
2730 ERROR - Syntax error in options.
2731 */
2732
2733 static int
2734 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2735 {
2736 int sep = 0;
2737 uschar *hostname;
2738 uschar *portstr;
2739 uschar *portend;
2740 host_item *h;
2741 int portnum;
2742 int len;
2743 int r, s;
2744 uschar * errstr;
2745
2746 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2747 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2748
2749 if (!hostname)
2750 {
2751 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2752 return ERROR;
2753 }
2754 if (!portstr)
2755 {
2756 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2757 return ERROR;
2758 }
2759 if (!arg)
2760 {
2761 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2762 return ERROR;
2763 }
2764 portnum = Ustrtol(portstr, &portend, 10);
2765 if (*portend != '\0')
2766 {
2767 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2768 return ERROR;
2769 }
2770
2771 /* Make a single-item host list. */
2772 h = store_get(sizeof(host_item));
2773 memset(h, 0, sizeof(host_item));
2774 h->name = hostname;
2775 h->port = portnum;
2776 h->mx = MX_NONE;
2777
2778 if (string_is_ip_address(hostname, NULL))
2779 h->address = hostname, r = HOST_FOUND;
2780 else
2781 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2782 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2783 {
2784 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2785 return DEFER;
2786 }
2787
2788 HDEBUG(D_acl)
2789 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2790
2791 /*XXX this could better use sendto */
2792 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2793 1, NULL, &errstr, NULL);
2794 if (r < 0) goto defer;
2795 len = Ustrlen(arg);
2796 r = send(s, arg, len, 0);
2797 if (r < 0)
2798 {
2799 errstr = US strerror(errno);
2800 close(s);
2801 goto defer;
2802 }
2803 close(s);
2804 if (r < len)
2805 {
2806 *log_msgptr =
2807 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2808 return DEFER;
2809 }
2810
2811 HDEBUG(D_acl)
2812 debug_printf_indent("udpsend %d bytes\n", r);
2813
2814 return OK;
2815
2816 defer:
2817 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2818 return DEFER;
2819 }
2820
2821
2822
2823 /*************************************************
2824 * Handle conditions/modifiers on an ACL item *
2825 *************************************************/
2826
2827 /* Called from acl_check() below.
2828
2829 Arguments:
2830 verb ACL verb
2831 cb ACL condition block - if NULL, result is OK
2832 where where called from
2833 addr the address being checked for RCPT, or NULL
2834 level the nesting level
2835 epp pointer to pass back TRUE if "endpass" encountered
2836 (applies only to "accept" and "discard")
2837 user_msgptr user message pointer
2838 log_msgptr log message pointer
2839 basic_errno pointer to where to put verify error
2840
2841 Returns: OK - all conditions are met
2842 DISCARD - an "acl" condition returned DISCARD - only allowed
2843 for "accept" or "discard" verbs
2844 FAIL - at least one condition fails
2845 FAIL_DROP - an "acl" condition returned FAIL_DROP
2846 DEFER - can't tell at the moment (typically, lookup defer,
2847 but can be temporary callout problem)
2848 ERROR - ERROR from nested ACL or expansion failure or other
2849 error
2850 */
2851
2852 static int
2853 acl_check_condition(int verb, acl_condition_block *cb, int where,
2854 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2855 uschar **log_msgptr, int *basic_errno)
2856 {
2857 uschar *user_message = NULL;
2858 uschar *log_message = NULL;
2859 int rc = OK;
2860 #ifdef WITH_CONTENT_SCAN
2861 int sep = -'/';
2862 #endif
2863
2864 for (; cb; cb = cb->next)
2865 {
2866 const uschar *arg;
2867 int control_type;
2868
2869 /* The message and log_message items set up messages to be used in
2870 case of rejection. They are expanded later. */
2871
2872 if (cb->type == ACLC_MESSAGE)
2873 {
2874 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2875 user_message = cb->arg;
2876 continue;
2877 }
2878
2879 if (cb->type == ACLC_LOG_MESSAGE)
2880 {
2881 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2882 log_message = cb->arg;
2883 continue;
2884 }
2885
2886 /* The endpass "condition" just sets a flag to show it occurred. This is
2887 checked at compile time to be on an "accept" or "discard" item. */
2888
2889 if (cb->type == ACLC_ENDPASS)
2890 {
2891 *epp = TRUE;
2892 continue;
2893 }
2894
2895 /* For other conditions and modifiers, the argument is expanded now for some
2896 of them, but not for all, because expansion happens down in some lower level
2897 checking functions in some cases. */
2898
2899 if (!conditions[cb->type].expand_at_top)
2900 arg = cb->arg;
2901 else if (!(arg = expand_string(cb->arg)))
2902 {
2903 if (f.expand_string_forcedfail) continue;
2904 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2905 cb->arg, expand_string_message);
2906 return f.search_find_defer ? DEFER : ERROR;
2907 }
2908
2909 /* Show condition, and expanded condition if it's different */
2910
2911 HDEBUG(D_acl)
2912 {
2913 int lhswidth = 0;
2914 debug_printf_indent("check %s%s %n",
2915 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2916 conditions[cb->type].name, &lhswidth);
2917
2918 if (cb->type == ACLC_SET)
2919 {
2920 #ifndef DISABLE_DKIM
2921 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2922 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2923 {
2924 debug_printf("%s ", cb->u.varname);
2925 lhswidth += 19;
2926 }
2927 else
2928 #endif
2929 {
2930 debug_printf("acl_%s ", cb->u.varname);
2931 lhswidth += 5 + Ustrlen(cb->u.varname);
2932 }
2933 }
2934
2935 debug_printf("= %s\n", cb->arg);
2936
2937 if (arg != cb->arg)
2938 debug_printf("%.*s= %s\n", lhswidth,
2939 US" ", CS arg);
2940 }
2941
2942 /* Check that this condition makes sense at this time */
2943
2944 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2945 {
2946 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2947 conditions[cb->type].is_modifier ? "use" : "test",
2948 conditions[cb->type].name, acl_wherenames[where]);
2949 return ERROR;
2950 }
2951
2952 /* Run the appropriate test for each condition, or take the appropriate
2953 action for the remaining modifiers. */
2954
2955 switch(cb->type)
2956 {
2957 case ACLC_ADD_HEADER:
2958 setup_header(arg);
2959 break;
2960
2961 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2962 "discard" verb. */
2963
2964 case ACLC_ACL:
2965 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2966 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2967 {
2968 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2969 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2970 verbs[verb]);
2971 return ERROR;
2972 }
2973 break;
2974
2975 case ACLC_AUTHENTICATED:
2976 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2977 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2978 break;
2979
2980 #ifdef EXPERIMENTAL_BRIGHTMAIL
2981 case ACLC_BMI_OPTIN:
2982 {
2983 int old_pool = store_pool;
2984 store_pool = POOL_PERM;
2985 bmi_current_optin = string_copy(arg);
2986 store_pool = old_pool;
2987 }
2988 break;
2989 #endif
2990
2991 case ACLC_CONDITION:
2992 /* The true/false parsing here should be kept in sync with that used in
2993 expand.c when dealing with ECOND_BOOL so that we don't have too many
2994 different definitions of what can be a boolean. */
2995 if (*arg == '-'
2996 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2997 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2998 rc = (Uatoi(arg) == 0)? FAIL : OK;
2999 else
3000 rc = (strcmpic(arg, US"no") == 0 ||
3001 strcmpic(arg, US"false") == 0)? FAIL :
3002 (strcmpic(arg, US"yes") == 0 ||
3003 strcmpic(arg, US"true") == 0)? OK : DEFER;
3004 if (rc == DEFER)
3005 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3006 break;
3007
3008 case ACLC_CONTINUE: /* Always succeeds */
3009 break;
3010
3011 case ACLC_CONTROL:
3012 {
3013 const uschar *p = NULL;
3014 control_type = decode_control(arg, &p, where, log_msgptr);
3015
3016 /* Check if this control makes sense at this time */
3017
3018 if (controls_list[control_type].forbids & (1 << where))
3019 {
3020 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3021 controls_list[control_type].name, acl_wherenames[where]);
3022 return ERROR;
3023 }
3024
3025 switch(control_type)
3026 {
3027 case CONTROL_AUTH_UNADVERTISED:
3028 f.allow_auth_unadvertised = TRUE;
3029 break;
3030
3031 #ifdef EXPERIMENTAL_BRIGHTMAIL
3032 case CONTROL_BMI_RUN:
3033 bmi_run = 1;
3034 break;
3035 #endif
3036
3037 #ifndef DISABLE_DKIM
3038 case CONTROL_DKIM_VERIFY:
3039 f.dkim_disable_verify = TRUE;
3040 #ifdef EXPERIMENTAL_DMARC
3041 /* Since DKIM was blocked, skip DMARC too */
3042 f.dmarc_disable_verify = TRUE;
3043 f.dmarc_enable_forensic = FALSE;
3044 #endif
3045 break;
3046 #endif
3047
3048 #ifdef EXPERIMENTAL_DMARC
3049 case CONTROL_DMARC_VERIFY:
3050 f.dmarc_disable_verify = TRUE;
3051 break;
3052
3053 case CONTROL_DMARC_FORENSIC:
3054 f.dmarc_enable_forensic = TRUE;
3055 break;
3056 #endif
3057
3058 case CONTROL_DSCP:
3059 if (*p == '/')
3060 {
3061 int fd, af, level, optname, value;
3062 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3063 a socket; we can accept that, we'll just debug-log failures anyway. */
3064 fd = fileno(smtp_in);
3065 af = ip_get_address_family(fd);
3066 if (af < 0)
3067 {
3068 HDEBUG(D_acl)
3069 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3070 strerror(errno));
3071 break;
3072 }
3073 if (dscp_lookup(p+1, af, &level, &optname, &value))
3074 {
3075 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3076 {
3077 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3078 p+1, strerror(errno));
3079 }
3080 else
3081 {
3082 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3083 }
3084 }
3085 else
3086 {
3087 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3088 return ERROR;
3089 }
3090 }
3091 else
3092 {
3093 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3094 return ERROR;
3095 }
3096 break;
3097
3098 case CONTROL_ERROR:
3099 return ERROR;
3100
3101 case CONTROL_CASEFUL_LOCAL_PART:
3102 deliver_localpart = addr->cc_local_part;
3103 break;
3104
3105 case CONTROL_CASELOWER_LOCAL_PART:
3106 deliver_localpart = addr->lc_local_part;
3107 break;
3108
3109 case CONTROL_ENFORCE_SYNC:
3110 smtp_enforce_sync = TRUE;
3111 break;
3112
3113 case CONTROL_NO_ENFORCE_SYNC:
3114 smtp_enforce_sync = FALSE;
3115 break;
3116
3117 #ifdef WITH_CONTENT_SCAN
3118 case CONTROL_NO_MBOX_UNSPOOL:
3119 f.no_mbox_unspool = TRUE;
3120 break;
3121 #endif
3122
3123 case CONTROL_NO_MULTILINE:
3124 f.no_multiline_responses = TRUE;
3125 break;
3126
3127 case CONTROL_NO_PIPELINING:
3128 f.pipelining_enable = FALSE;
3129 break;
3130
3131 case CONTROL_NO_DELAY_FLUSH:
3132 f.disable_delay_flush = TRUE;
3133 break;
3134
3135 case CONTROL_NO_CALLOUT_FLUSH:
3136 f.disable_callout_flush = TRUE;
3137 break;
3138
3139 case CONTROL_FAKEREJECT:
3140 cancel_cutthrough_connection(TRUE, US"fakereject");
3141 case CONTROL_FAKEDEFER:
3142 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3143 if (*p == '/')
3144 {
3145 const uschar *pp = p + 1;
3146 while (*pp != 0) pp++;
3147 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3148 p = pp;
3149 }
3150 else
3151 {
3152 /* Explicitly reset to default string */
3153 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3154 }
3155 break;
3156
3157 case CONTROL_FREEZE:
3158 f.deliver_freeze = TRUE;
3159 deliver_frozen_at = time(NULL);
3160 freeze_tell = freeze_tell_config; /* Reset to configured value */
3161 if (Ustrncmp(p, "/no_tell", 8) == 0)
3162 {
3163 p += 8;
3164 freeze_tell = NULL;
3165 }
3166 if (*p != 0)
3167 {
3168 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3169 return ERROR;
3170 }
3171 cancel_cutthrough_connection(TRUE, US"item frozen");
3172 break;
3173
3174 case CONTROL_QUEUE_ONLY:
3175 f.queue_only_policy = TRUE;
3176 cancel_cutthrough_connection(TRUE, US"queueing forced");
3177 break;
3178
3179 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
3180 case CONTROL_REQUIRETLS:
3181 tls_requiretls |= REQUIRETLS_MSG;
3182 break;
3183 #endif
3184 case CONTROL_SUBMISSION:
3185 originator_name = US"";
3186 f.submission_mode = TRUE;
3187 while (*p == '/')
3188 {
3189 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3190 {
3191 p += 14;
3192 f.active_local_sender_retain = TRUE;
3193 f.active_local_from_check = FALSE;
3194 }
3195 else if (Ustrncmp(p, "/domain=", 8) == 0)
3196 {
3197 const uschar *pp = p + 8;
3198 while (*pp != 0 && *pp != '/') pp++;
3199 submission_domain = string_copyn(p+8, pp-p-8);
3200 p = pp;
3201 }
3202 /* The name= option must be last, because it swallows the rest of
3203 the string. */
3204 else if (Ustrncmp(p, "/name=", 6) == 0)
3205 {
3206 const uschar *pp = p + 6;
3207 while (*pp != 0) pp++;
3208 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3209 big_buffer, big_buffer_size));
3210 p = pp;
3211 }
3212 else break;
3213 }
3214 if (*p != 0)
3215 {
3216 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3217 return ERROR;
3218 }
3219 break;
3220
3221 case CONTROL_DEBUG:
3222 {
3223 uschar * debug_tag = NULL;
3224 uschar * debug_opts = NULL;
3225 BOOL kill = FALSE;
3226
3227 while (*p == '/')
3228 {
3229 const uschar * pp = p+1;
3230 if (Ustrncmp(pp, "tag=", 4) == 0)
3231 {
3232 for (pp += 4; *pp && *pp != '/';) pp++;
3233 debug_tag = string_copyn(p+5, pp-p-5);
3234 }
3235 else if (Ustrncmp(pp, "opts=", 5) == 0)
3236 {
3237 for (pp += 5; *pp && *pp != '/';) pp++;
3238 debug_opts = string_copyn(p+6, pp-p-6);
3239 }
3240 else if (Ustrncmp(pp, "kill", 4) == 0)
3241 {
3242 for (pp += 4; *pp && *pp != '/';) pp++;
3243 kill = TRUE;
3244 }
3245 else
3246 while (*pp && *pp != '/') pp++;
3247 p = pp;
3248 }
3249
3250 if (kill)
3251 debug_logging_stop();
3252 else
3253 debug_logging_activate(debug_tag, debug_opts);
3254 }
3255 break;
3256
3257 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3258 f.suppress_local_fixups = TRUE;
3259 break;
3260
3261 case CONTROL_CUTTHROUGH_DELIVERY:
3262 {
3263 uschar * ignored = NULL;
3264 #ifndef DISABLE_PRDR
3265 if (prdr_requested)
3266 #else
3267 if (0)
3268 #endif
3269 /* Too hard to think about for now. We might in future cutthrough
3270 the case where both sides handle prdr and this-node prdr acl
3271 is "accept" */
3272 ignored = US"PRDR active";
3273 else
3274 {
3275 if (f.deliver_freeze)
3276 ignored = US"frozen";
3277 else if (f.queue_only_policy)
3278 ignored = US"queue-only";
3279 else if (fake_response == FAIL)
3280 ignored = US"fakereject";
3281 else
3282 {
3283 if (rcpt_count == 1)
3284 {
3285 cutthrough.delivery = TRUE; /* control accepted */
3286 while (*p == '/')
3287 {
3288 const uschar * pp = p+1;
3289 if (Ustrncmp(pp, "defer=", 6) == 0)
3290 {
3291 pp += 6;
3292 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3293 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3294 }
3295 else
3296 while (*pp && *pp != '/') pp++;
3297 p = pp;
3298 }
3299 }
3300 else
3301 ignored = US"nonfirst rcpt";
3302 }
3303 }
3304 DEBUG(D_acl) if (ignored)
3305 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3306 }
3307 break;
3308
3309 #ifdef SUPPORT_I18N
3310 case CONTROL_UTF8_DOWNCONVERT:
3311 if (*p == '/')
3312 {
3313 if (p[1] == '1')
3314 {
3315 message_utf8_downconvert = 1;
3316 addr->prop.utf8_downcvt = TRUE;
3317 addr->prop.utf8_downcvt_maybe = FALSE;
3318 p += 2;
3319 break;
3320 }
3321 if (p[1] == '0')
3322 {
3323 message_utf8_downconvert = 0;
3324 addr->prop.utf8_downcvt = FALSE;
3325 addr->prop.utf8_downcvt_maybe = FALSE;
3326 p += 2;
3327 break;
3328 }
3329 if (p[1] == '-' && p[2] == '1')
3330 {
3331 message_utf8_downconvert = -1;
3332 addr->prop.utf8_downcvt = FALSE;
3333 addr->prop.utf8_downcvt_maybe = TRUE;
3334 p += 3;
3335 break;
3336 }
3337 *log_msgptr = US"bad option value for control=utf8_downconvert";
3338 }
3339 else
3340 {
3341 message_utf8_downconvert = 1;
3342 addr->prop.utf8_downcvt = TRUE;
3343 addr->prop.utf8_downcvt_maybe = FALSE;
3344 break;
3345 }
3346 return ERROR;
3347 #endif
3348
3349 }
3350 break;
3351 }
3352
3353 #ifdef EXPERIMENTAL_DCC
3354 case ACLC_DCC:
3355 {
3356 /* Separate the regular expression and any optional parameters. */
3357 const uschar * list = arg;
3358 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3359 /* Run the dcc backend. */
3360 rc = dcc_process(&ss);
3361 /* Modify return code based upon the existence of options. */
3362 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3363 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3364 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3365 }
3366 break;
3367 #endif
3368
3369 #ifdef WITH_CONTENT_SCAN
3370 case ACLC_DECODE:
3371 rc = mime_decode(&arg);
3372 break;
3373 #endif
3374
3375 case ACLC_DELAY:
3376 {
3377 int delay = readconf_readtime(arg, 0, FALSE);
3378 if (delay < 0)
3379 {
3380 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3381 "modifier: \"%s\" is not a time value", arg);
3382 return ERROR;
3383 }
3384 else
3385 {
3386 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3387 delay);
3388 if (host_checking)
3389 {
3390 HDEBUG(D_acl)
3391 debug_printf_indent("delay skipped in -bh checking mode\n");
3392 }
3393
3394 /* NOTE 1: Remember that we may be
3395 dealing with stdin/stdout here, in addition to TCP/IP connections.
3396 Also, delays may be specified for non-SMTP input, where smtp_out and
3397 smtp_in will be NULL. Whatever is done must work in all cases.
3398
3399 NOTE 2: The added feature of flushing the output before a delay must
3400 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3401 */
3402
3403 else
3404 {
3405 if (smtp_out && !f.disable_delay_flush)
3406 mac_smtp_fflush();
3407
3408 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3409 {
3410 struct pollfd p;
3411 nfds_t n = 0;
3412 if (smtp_out)
3413 {
3414 p.fd = fileno(smtp_out);
3415 p.events = POLLRDHUP;
3416 n = 1;
3417 }
3418 if (poll(&p, n, delay*1000) > 0)
3419 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3420 }
3421 #else
3422 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3423 TCP/IP connection has gone away without reading from it. This means
3424 that we cannot shorten the delay below if the client goes away,
3425 because we cannot discover that the client has closed its end of the
3426 connection. (The connection is actually in a half-closed state,
3427 waiting for the server to close its end.) It would be nice to be able
3428 to detect this state, so that the Exim process is not held up
3429 unnecessarily. However, it seems that we can't. The poll() function
3430 does not do the right thing, and in any case it is not always
3431 available. */
3432
3433 while (delay > 0) delay = sleep(delay);
3434 #endif
3435 }
3436 }
3437 }
3438 break;
3439
3440 #ifndef DISABLE_DKIM
3441 case ACLC_DKIM_SIGNER:
3442 if (dkim_cur_signer)
3443 rc = match_isinlist(dkim_cur_signer,
3444 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3445 else
3446 rc = FAIL;
3447 break;
3448
3449 case ACLC_DKIM_STATUS:
3450 rc = match_isinlist(dkim_verify_status,
3451 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3452 break;
3453 #endif
3454
3455 #ifdef EXPERIMENTAL_DMARC
3456 case ACLC_DMARC_STATUS:
3457 if (!f.dmarc_has_been_checked)
3458 dmarc_process();
3459 f.dmarc_has_been_checked = TRUE;
3460 /* used long way of dmarc_exim_expand_query() in case we need more
3461 * view into the process in the future. */
3462 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3463 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3464 break;
3465 #endif
3466
3467 case ACLC_DNSLISTS:
3468 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3469 break;
3470
3471 case ACLC_DOM