Taint: fix parsing of ACL ratelimit condition
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef SUPPORT_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef SUPPORT_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. Do not invent new modifier names that result in one name
116 being the prefix of another; the binary-search in the list will go wrong. */
117
118 typedef struct condition_def {
119 uschar *name;
120
121 /* Flag to indicate the condition/modifier has a string expansion done
122 at the outer level. In the other cases, expansion already occurs in the
123 checking functions. */
124 BOOL expand_at_top:1;
125
126 BOOL is_modifier:1;
127
128 /* Bit map vector of which conditions and modifiers are not allowed at certain
129 times. For each condition and modifier, there's a bitmap of dis-allowed times.
130 For some, it is easier to specify the negation of a small number of allowed
131 times. */
132 unsigned forbids;
133
134 } condition_def;
135
136 static condition_def conditions[] = {
137 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
138
139 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
140 (unsigned int)
141 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
142 ACL_BIT_PREDATA | ACL_BIT_DATA |
143 #ifndef DISABLE_PRDR
144 ACL_BIT_PRDR |
145 #endif
146 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
147 ACL_BIT_DKIM |
148 ACL_BIT_NOTSMTP_START),
149 },
150
151 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
152 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
153 ACL_BIT_CONNECT | ACL_BIT_HELO,
154 },
155 #ifdef EXPERIMENTAL_BRIGHTMAIL
156 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
157 ACL_BIT_AUTH |
158 ACL_BIT_CONNECT | ACL_BIT_HELO |
159 ACL_BIT_DATA | ACL_BIT_MIME |
160 # ifndef DISABLE_PRDR
161 ACL_BIT_PRDR |
162 # endif
163 ACL_BIT_ETRN | ACL_BIT_EXPN |
164 ACL_BIT_MAILAUTH |
165 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
166 ACL_BIT_VRFY | ACL_BIT_PREDATA |
167 ACL_BIT_NOTSMTP_START,
168 },
169 #endif
170 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
171 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
172
173 /* Certain types of control are always allowed, so we let it through
174 always and check in the control processing itself. */
175 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
176
177 #ifdef EXPERIMENTAL_DCC
178 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
179 (unsigned int)
180 ~(ACL_BIT_DATA |
181 # ifndef DISABLE_PRDR
182 ACL_BIT_PRDR |
183 # endif
184 ACL_BIT_NOTSMTP),
185 },
186 #endif
187 #ifdef WITH_CONTENT_SCAN
188 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
189
190 #endif
191 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
192 #ifndef DISABLE_DKIM
193 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
195 #endif
196 #ifdef SUPPORT_DMARC
197 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
198 #endif
199
200 /* Explicit key lookups can be made in non-smtp ACLs so pass
201 always and check in the verify processing itself. */
202 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
203
204 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 (unsigned int)
206 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
207 #ifndef DISABLE_PRDR
208 |ACL_BIT_PRDR
209 #endif
210 ),
211 },
212 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
213 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
214 ACL_BIT_HELO,
215 },
216
217 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
218
219 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
220 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
221 },
222 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
223 (unsigned int)
224 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
225 #ifndef DISABLE_PRDR
226 | ACL_BIT_PRDR
227 #endif
228 ),
229 },
230
231 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
232 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
233 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
234
235 #ifdef WITH_CONTENT_SCAN
236 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
237 (unsigned int)
238 ~(ACL_BIT_DATA |
239 # ifndef DISABLE_PRDR
240 ACL_BIT_PRDR |
241 # endif
242 ACL_BIT_NOTSMTP),
243 },
244 #endif
245
246 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
247 #ifdef WITH_CONTENT_SCAN
248 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
249 #endif
250
251 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
252 ACL_BIT_NOTSMTP |
253 #ifndef DISABLE_PRDR
254 ACL_BIT_PRDR |
255 #endif
256 ACL_BIT_DATA,
257 },
258
259 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
260 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
261
262 #ifdef WITH_CONTENT_SCAN
263 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
264 (unsigned int)
265 ~(ACL_BIT_DATA |
266 # ifndef DISABLE_PRDR
267 ACL_BIT_PRDR |
268 # endif
269 ACL_BIT_NOTSMTP |
270 ACL_BIT_MIME),
271 },
272
273 #endif
274 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
275 (unsigned int)
276 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
277 ACL_BIT_PREDATA | ACL_BIT_DATA |
278 #ifndef DISABLE_PRDR
279 ACL_BIT_PRDR |
280 #endif
281 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
282 ACL_BIT_NOTSMTP_START),
283 },
284 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
285 ACL_BIT_AUTH | ACL_BIT_CONNECT |
286 ACL_BIT_HELO |
287 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
288 ACL_BIT_ETRN | ACL_BIT_EXPN |
289 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
290 },
291 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
292 ACL_BIT_AUTH | ACL_BIT_CONNECT |
293 ACL_BIT_HELO |
294 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
295 ACL_BIT_ETRN | ACL_BIT_EXPN |
296 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
297 },
298
299 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
300
301 #ifdef WITH_CONTENT_SCAN
302 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
303 (unsigned int) ~(ACL_BIT_DATA |
304 # ifndef DISABLE_PRDR
305 ACL_BIT_PRDR |
306 # endif
307 ACL_BIT_NOTSMTP),
308 },
309 #endif
310 #ifdef SUPPORT_SPF
311 [ACLC_SPF] = { US"spf", TRUE, FALSE,
312 ACL_BIT_AUTH | ACL_BIT_CONNECT |
313 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
314 ACL_BIT_ETRN | ACL_BIT_EXPN |
315 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
316 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
317 },
318 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
319 ACL_BIT_AUTH | ACL_BIT_CONNECT |
320 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
321 ACL_BIT_ETRN | ACL_BIT_EXPN |
322 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
323 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
324 },
325 #endif
326 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
327
328 /* Certain types of verify are always allowed, so we let it through
329 always and check in the verify function itself */
330 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
331 };
332
333
334
335 /* Return values from decode_control(); used as index so keep in step
336 with the controls_list table that follows! */
337
338 enum {
339 CONTROL_AUTH_UNADVERTISED,
340 #ifdef EXPERIMENTAL_BRIGHTMAIL
341 CONTROL_BMI_RUN,
342 #endif
343 CONTROL_CASEFUL_LOCAL_PART,
344 CONTROL_CASELOWER_LOCAL_PART,
345 CONTROL_CUTTHROUGH_DELIVERY,
346 CONTROL_DEBUG,
347 #ifndef DISABLE_DKIM
348 CONTROL_DKIM_VERIFY,
349 #endif
350 #ifdef SUPPORT_DMARC
351 CONTROL_DMARC_VERIFY,
352 CONTROL_DMARC_FORENSIC,
353 #endif
354 CONTROL_DSCP,
355 CONTROL_ENFORCE_SYNC,
356 CONTROL_ERROR, /* pseudo-value for decode errors */
357 CONTROL_FAKEDEFER,
358 CONTROL_FAKEREJECT,
359 CONTROL_FREEZE,
360
361 CONTROL_NO_CALLOUT_FLUSH,
362 CONTROL_NO_DELAY_FLUSH,
363 CONTROL_NO_ENFORCE_SYNC,
364 #ifdef WITH_CONTENT_SCAN
365 CONTROL_NO_MBOX_UNSPOOL,
366 #endif
367 CONTROL_NO_MULTILINE,
368 CONTROL_NO_PIPELINING,
369
370 CONTROL_QUEUE,
371 CONTROL_SUBMISSION,
372 CONTROL_SUPPRESS_LOCAL_FIXUPS,
373 #ifdef SUPPORT_I18N
374 CONTROL_UTF8_DOWNCONVERT,
375 #endif
376 };
377
378
379
380 /* Structure listing various control arguments, with their characteristics.
381 For each control, there's a bitmap of dis-allowed times. For some, it is easier
382 to specify the negation of a small number of allowed times. */
383
384 typedef struct control_def {
385 uschar *name;
386 BOOL has_option; /* Has /option(s) following */
387 unsigned forbids; /* bitmap of dis-allowed times */
388 } control_def;
389
390 static control_def controls_list[] = {
391 /* name has_option forbids */
392 [CONTROL_AUTH_UNADVERTISED] =
393 { US"allow_auth_unadvertised", FALSE,
394 (unsigned)
395 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
396 },
397 #ifdef EXPERIMENTAL_BRIGHTMAIL
398 [CONTROL_BMI_RUN] =
399 { US"bmi_run", FALSE, 0 },
400 #endif
401 [CONTROL_CASEFUL_LOCAL_PART] =
402 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
403 [CONTROL_CASELOWER_LOCAL_PART] =
404 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
405 [CONTROL_CUTTHROUGH_DELIVERY] =
406 { US"cutthrough_delivery", TRUE, 0 },
407 [CONTROL_DEBUG] =
408 { US"debug", TRUE, 0 },
409
410 #ifndef DISABLE_DKIM
411 [CONTROL_DKIM_VERIFY] =
412 { US"dkim_disable_verify", FALSE,
413 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
414 # ifndef DISABLE_PRDR
415 ACL_BIT_PRDR |
416 # endif
417 ACL_BIT_NOTSMTP_START
418 },
419 #endif
420
421 #ifdef SUPPORT_DMARC
422 [CONTROL_DMARC_VERIFY] =
423 { US"dmarc_disable_verify", FALSE,
424 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
425 },
426 [CONTROL_DMARC_FORENSIC] =
427 { US"dmarc_enable_forensic", FALSE,
428 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
429 },
430 #endif
431
432 [CONTROL_DSCP] =
433 { US"dscp", TRUE,
434 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
435 },
436 [CONTROL_ENFORCE_SYNC] =
437 { US"enforce_sync", FALSE,
438 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
439 },
440
441 /* Pseudo-value for decode errors */
442 [CONTROL_ERROR] =
443 { US"error", FALSE, 0 },
444
445 [CONTROL_FAKEDEFER] =
446 { US"fakedefer", TRUE,
447 (unsigned)
448 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
449 ACL_BIT_PREDATA | ACL_BIT_DATA |
450 #ifndef DISABLE_PRDR
451 ACL_BIT_PRDR |
452 #endif
453 ACL_BIT_MIME)
454 },
455 [CONTROL_FAKEREJECT] =
456 { US"fakereject", TRUE,
457 (unsigned)
458 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
459 ACL_BIT_PREDATA | ACL_BIT_DATA |
460 #ifndef DISABLE_PRDR
461 ACL_BIT_PRDR |
462 #endif
463 ACL_BIT_MIME)
464 },
465 [CONTROL_FREEZE] =
466 { US"freeze", TRUE,
467 (unsigned)
468 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
469 ACL_BIT_PREDATA | ACL_BIT_DATA |
470 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
471 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
472 },
473
474 [CONTROL_NO_CALLOUT_FLUSH] =
475 { US"no_callout_flush", FALSE,
476 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
477 },
478 [CONTROL_NO_DELAY_FLUSH] =
479 { US"no_delay_flush", FALSE,
480 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
481 },
482
483 [CONTROL_NO_ENFORCE_SYNC] =
484 { US"no_enforce_sync", FALSE,
485 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
486 },
487 #ifdef WITH_CONTENT_SCAN
488 [CONTROL_NO_MBOX_UNSPOOL] =
489 { US"no_mbox_unspool", FALSE,
490 (unsigned)
491 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
492 ACL_BIT_PREDATA | ACL_BIT_DATA |
493 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
494 ACL_BIT_MIME)
495 },
496 #endif
497 [CONTROL_NO_MULTILINE] =
498 { US"no_multiline_responses", FALSE,
499 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
500 },
501 [CONTROL_NO_PIPELINING] =
502 { US"no_pipelining", FALSE,
503 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
504 },
505
506 [CONTROL_QUEUE] =
507 { US"queue", TRUE,
508 (unsigned)
509 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
510 ACL_BIT_PREDATA | ACL_BIT_DATA |
511 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
512 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
513 },
514
515 [CONTROL_SUBMISSION] =
516 { US"submission", TRUE,
517 (unsigned)
518 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
519 },
520 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
521 { US"suppress_local_fixups", FALSE,
522 (unsigned)
523 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
524 ACL_BIT_NOTSMTP_START)
525 },
526 #ifdef SUPPORT_I18N
527 [CONTROL_UTF8_DOWNCONVERT] =
528 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
529 }
530 #endif
531 };
532
533 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
534 caches its result in a tree to avoid repeated DNS queries. The result is an
535 integer code which is used as an index into the following tables of
536 explanatory strings and verification return codes. */
537
538 static tree_node *csa_cache = NULL;
539
540 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
541 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
542
543 /* The acl_verify_csa() return code is translated into an acl_verify() return
544 code using the following table. It is OK unless the client is definitely not
545 authorized. This is because CSA is supposed to be optional for sending sites,
546 so recipients should not be too strict about checking it - especially because
547 DNS problems are quite likely to occur. It's possible to use $csa_status in
548 further ACL conditions to distinguish ok, unknown, and defer if required, but
549 the aim is to make the usual configuration simple. */
550
551 static int csa_return_code[] = {
552 [CSA_UNKNOWN] = OK,
553 [CSA_OK] = OK,
554 [CSA_DEFER_SRV] = OK,
555 [CSA_DEFER_ADDR] = OK,
556 [CSA_FAIL_EXPLICIT] = FAIL,
557 [CSA_FAIL_DOMAIN] = FAIL,
558 [CSA_FAIL_NOADDR] = FAIL,
559 [CSA_FAIL_MISMATCH] = FAIL
560 };
561
562 static uschar *csa_status_string[] = {
563 [CSA_UNKNOWN] = US"unknown",
564 [CSA_OK] = US"ok",
565 [CSA_DEFER_SRV] = US"defer",
566 [CSA_DEFER_ADDR] = US"defer",
567 [CSA_FAIL_EXPLICIT] = US"fail",
568 [CSA_FAIL_DOMAIN] = US"fail",
569 [CSA_FAIL_NOADDR] = US"fail",
570 [CSA_FAIL_MISMATCH] = US"fail"
571 };
572
573 static uschar *csa_reason_string[] = {
574 [CSA_UNKNOWN] = US"unknown",
575 [CSA_OK] = US"ok",
576 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
577 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
578 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
579 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
580 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
581 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
582 };
583
584 /* Options for the ratelimit condition. Note that there are two variants of
585 the per_rcpt option, depending on the ACL that is used to measure the rate.
586 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
587 so the two variants must have the same internal representation as well as
588 the same configuration string. */
589
590 enum {
591 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
592 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
593 };
594
595 #define RATE_SET(var,new) \
596 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
597
598 static uschar *ratelimit_option_string[] = {
599 [RATE_PER_WHAT] = US"?",
600 [RATE_PER_CLASH] = US"!",
601 [RATE_PER_ADDR] = US"per_addr",
602 [RATE_PER_BYTE] = US"per_byte",
603 [RATE_PER_CMD] = US"per_cmd",
604 [RATE_PER_CONN] = US"per_conn",
605 [RATE_PER_MAIL] = US"per_mail",
606 [RATE_PER_RCPT] = US"per_rcpt",
607 [RATE_PER_ALLRCPTS] = US"per_rcpt"
608 };
609
610 /* Enable recursion between acl_check_internal() and acl_check_condition() */
611
612 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
613 uschar **);
614
615
616 /*************************************************
617 * Find control in list *
618 *************************************************/
619
620 /* The lists are always in order, so binary chop can be used.
621
622 Arguments:
623 name the control name to search for
624 ol the first entry in the control list
625 last one more than the offset of the last entry in the control list
626
627 Returns: index of a control entry, or -1 if not found
628 */
629
630 static int
631 find_control(const uschar * name, control_def * ol, int last)
632 {
633 for (int first = 0; last > first; )
634 {
635 int middle = (first + last)/2;
636 uschar * s = ol[middle].name;
637 int c = Ustrncmp(name, s, Ustrlen(s));
638 if (c == 0) return middle;
639 else if (c > 0) first = middle + 1;
640 else last = middle;
641 }
642 return -1;
643 }
644
645
646
647 /*************************************************
648 * Pick out condition from list *
649 *************************************************/
650
651 /* Use a binary chop method
652
653 Arguments:
654 name name to find
655 list list of conditions
656 end size of list
657
658 Returns: offset in list, or -1 if not found
659 */
660
661 static int
662 acl_checkcondition(uschar * name, condition_def * list, int end)
663 {
664 for (int start = 0; start < end; )
665 {
666 int mid = (start + end)/2;
667 int c = Ustrcmp(name, list[mid].name);
668 if (c == 0) return mid;
669 if (c < 0) end = mid;
670 else start = mid + 1;
671 }
672 return -1;
673 }
674
675
676 /*************************************************
677 * Pick out name from list *
678 *************************************************/
679
680 /* Use a binary chop method
681
682 Arguments:
683 name name to find
684 list list of names
685 end size of list
686
687 Returns: offset in list, or -1 if not found
688 */
689
690 static int
691 acl_checkname(uschar *name, uschar **list, int end)
692 {
693 for (int start = 0; start < end; )
694 {
695 int mid = (start + end)/2;
696 int c = Ustrcmp(name, list[mid]);
697 if (c == 0) return mid;
698 if (c < 0) end = mid; else start = mid + 1;
699 }
700
701 return -1;
702 }
703
704
705 /*************************************************
706 * Read and parse one ACL *
707 *************************************************/
708
709 /* This function is called both from readconf in order to parse the ACLs in the
710 configuration file, and also when an ACL is encountered dynamically (e.g. as
711 the result of an expansion). It is given a function to call in order to
712 retrieve the lines of the ACL. This function handles skipping comments and
713 blank lines (where relevant).
714
715 Arguments:
716 func function to get next line of ACL
717 error where to put an error message
718
719 Returns: pointer to ACL, or NULL
720 NULL can be legal (empty ACL); in this case error will be NULL
721 */
722
723 acl_block *
724 acl_read(uschar *(*func)(void), uschar **error)
725 {
726 acl_block *yield = NULL;
727 acl_block **lastp = &yield;
728 acl_block *this = NULL;
729 acl_condition_block *cond;
730 acl_condition_block **condp = NULL;
731 uschar * s;
732
733 *error = NULL;
734
735 while ((s = (*func)()))
736 {
737 int v, c;
738 BOOL negated = FALSE;
739 uschar *saveline = s;
740 uschar name[64];
741
742 /* Conditions (but not verbs) are allowed to be negated by an initial
743 exclamation mark. */
744
745 if (Uskip_whitespace(&s) == '!')
746 {
747 negated = TRUE;
748 s++;
749 }
750
751 /* Read the name of a verb or a condition, or the start of a new ACL, which
752 can be started by a name, or by a macro definition. */
753
754 s = readconf_readname(name, sizeof(name), s);
755 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
756
757 /* If a verb is unrecognized, it may be another condition or modifier that
758 continues the previous verb. */
759
760 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
761 {
762 if (!this)
763 {
764 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
765 saveline);
766 return NULL;
767 }
768 }
769
770 /* New verb */
771
772 else
773 {
774 if (negated)
775 {
776 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
777 return NULL;
778 }
779 this = store_get(sizeof(acl_block), FALSE);
780 *lastp = this;
781 lastp = &(this->next);
782 this->next = NULL;
783 this->condition = NULL;
784 this->verb = v;
785 this->srcline = config_lineno; /* for debug output */
786 this->srcfile = config_filename; /**/
787 condp = &(this->condition);
788 if (*s == 0) continue; /* No condition on this line */
789 if (*s == '!')
790 {
791 negated = TRUE;
792 s++;
793 }
794 s = readconf_readname(name, sizeof(name), s); /* Condition name */
795 }
796
797 /* Handle a condition or modifier. */
798
799 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
800 {
801 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
802 saveline);
803 return NULL;
804 }
805
806 /* The modifiers may not be negated */
807
808 if (negated && conditions[c].is_modifier)
809 {
810 *error = string_sprintf("ACL error: negation is not allowed with "
811 "\"%s\"", conditions[c].name);
812 return NULL;
813 }
814
815 /* ENDPASS may occur only with ACCEPT or DISCARD. */
816
817 if (c == ACLC_ENDPASS &&
818 this->verb != ACL_ACCEPT &&
819 this->verb != ACL_DISCARD)
820 {
821 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
822 conditions[c].name, verbs[this->verb]);
823 return NULL;
824 }
825
826 cond = store_get(sizeof(acl_condition_block), FALSE);
827 cond->next = NULL;
828 cond->type = c;
829 cond->u.negated = negated;
830
831 *condp = cond;
832 condp = &(cond->next);
833
834 /* The "set" modifier is different in that its argument is "name=value"
835 rather than just a value, and we can check the validity of the name, which
836 gives us a variable name to insert into the data block. The original ACL
837 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
838 extended to 20 of each type, but after that people successfully argued for
839 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
840 After that, we allow alphanumerics and underscores, but the first character
841 after c or m must be a digit or an underscore. This retains backwards
842 compatibility. */
843
844 if (c == ACLC_SET)
845 #ifndef DISABLE_DKIM
846 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
847 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
848 {
849 uschar * endptr = s+18;
850
851 if (isalnum(*endptr))
852 {
853 *error = string_sprintf("invalid variable name after \"set\" in ACL "
854 "modifier \"set %s\" "
855 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
856 s);
857 return NULL;
858 }
859 cond->u.varname = string_copyn(s, 18);
860 s = endptr;
861 Uskip_whitespace(&s);
862 }
863 else
864 #endif
865 {
866 uschar *endptr;
867
868 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
869 {
870 *error = string_sprintf("invalid variable name after \"set\" in ACL "
871 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
872 return NULL;
873 }
874
875 endptr = s + 5;
876 if (!isdigit(*endptr) && *endptr != '_')
877 {
878 *error = string_sprintf("invalid variable name after \"set\" in ACL "
879 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
880 s);
881 return NULL;
882 }
883
884 while (*endptr && *endptr != '=' && !isspace(*endptr))
885 {
886 if (!isalnum(*endptr) && *endptr != '_')
887 {
888 *error = string_sprintf("invalid character \"%c\" in variable name "
889 "in ACL modifier \"set %s\"", *endptr, s);
890 return NULL;
891 }
892 endptr++;
893 }
894
895 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
896 s = endptr;
897 Uskip_whitespace(&s);
898 }
899
900 /* For "set", we are now positioned for the data. For the others, only
901 "endpass" has no data */
902
903 if (c != ACLC_ENDPASS)
904 {
905 if (*s++ != '=')
906 {
907 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
908 conditions[c].is_modifier ? US"modifier" : US"condition");
909 return NULL;
910 }
911 Uskip_whitespace(&s);
912 cond->arg = string_copy(s);
913 }
914 }
915
916 return yield;
917 }
918
919
920
921 /*************************************************
922 * Set up added header line(s) *
923 *************************************************/
924
925 /* This function is called by the add_header modifier, and also from acl_warn()
926 to implement the now-deprecated way of adding header lines using "message" on a
927 "warn" verb. The argument is treated as a sequence of header lines which are
928 added to a chain, provided there isn't an identical one already there.
929
930 Argument: string of header lines
931 Returns: nothing
932 */
933
934 static void
935 setup_header(const uschar *hstring)
936 {
937 const uschar *p, *q;
938 int hlen = Ustrlen(hstring);
939
940 /* Ignore any leading newlines */
941 while (*hstring == '\n') hstring++, hlen--;
942
943 /* An empty string does nothing; ensure exactly one final newline. */
944 if (hlen <= 0) return;
945 if (hstring[--hlen] != '\n') /* no newline */
946 q = string_sprintf("%s\n", hstring);
947 else if (hstring[hlen-1] == '\n') /* double newline */
948 {
949 uschar * s = string_copy(hstring);
950 while(s[--hlen] == '\n')
951 s[hlen+1] = '\0';
952 q = s;
953 }
954 else
955 q = hstring;
956
957 /* Loop for multiple header lines, taking care about continuations */
958
959 for (p = q; *p; p = q)
960 {
961 const uschar *s;
962 uschar * hdr;
963 int newtype = htype_add_bot;
964 header_line **hptr = &acl_added_headers;
965
966 /* Find next header line within the string */
967
968 for (;;)
969 {
970 q = Ustrchr(q, '\n'); /* we know there was a newline */
971 if (*++q != ' ' && *q != '\t') break;
972 }
973
974 /* If the line starts with a colon, interpret the instruction for where to
975 add it. This temporarily sets up a new type. */
976
977 if (*p == ':')
978 {
979 if (strncmpic(p, US":after_received:", 16) == 0)
980 {
981 newtype = htype_add_rec;
982 p += 16;
983 }
984 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
985 {
986 newtype = htype_add_rfc;
987 p += 14;
988 }
989 else if (strncmpic(p, US":at_start:", 10) == 0)
990 {
991 newtype = htype_add_top;
992 p += 10;
993 }
994 else if (strncmpic(p, US":at_end:", 8) == 0)
995 {
996 newtype = htype_add_bot;
997 p += 8;
998 }
999 while (*p == ' ' || *p == '\t') p++;
1000 }
1001
1002 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1003 to the front of it. */
1004
1005 for (s = p; s < q - 1; s++)
1006 if (*s == ':' || !isgraph(*s)) break;
1007
1008 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1009 hlen = Ustrlen(hdr);
1010
1011 /* See if this line has already been added */
1012
1013 while (*hptr)
1014 {
1015 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1016 hptr = &(*hptr)->next;
1017 }
1018
1019 /* Add if not previously present */
1020
1021 if (!*hptr)
1022 {
1023 /* The header_line struct itself is not tainted, though it points to
1024 possibly tainted data. */
1025 header_line * h = store_get(sizeof(header_line), FALSE);
1026 h->text = hdr;
1027 h->next = NULL;
1028 h->type = newtype;
1029 h->slen = hlen;
1030 *hptr = h;
1031 hptr = &h->next;
1032 }
1033 }
1034 }
1035
1036
1037
1038 /*************************************************
1039 * List the added header lines *
1040 *************************************************/
1041 uschar *
1042 fn_hdrs_added(void)
1043 {
1044 gstring * g = NULL;
1045
1046 for (header_line * h = acl_added_headers; h; h = h->next)
1047 {
1048 int i = h->slen;
1049 if (h->text[i-1] == '\n') i--;
1050 g = string_append_listele_n(g, '\n', h->text, i);
1051 }
1052
1053 return g ? g->s : NULL;
1054 }
1055
1056
1057 /*************************************************
1058 * Set up removed header line(s) *
1059 *************************************************/
1060
1061 /* This function is called by the remove_header modifier. The argument is
1062 treated as a sequence of header names which are added to a colon separated
1063 list, provided there isn't an identical one already there.
1064
1065 Argument: string of header names
1066 Returns: nothing
1067 */
1068
1069 static void
1070 setup_remove_header(const uschar *hnames)
1071 {
1072 if (*hnames)
1073 acl_removed_headers = acl_removed_headers
1074 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1075 : string_copy(hnames);
1076 }
1077
1078
1079
1080 /*************************************************
1081 * Handle warnings *
1082 *************************************************/
1083
1084 /* This function is called when a WARN verb's conditions are true. It adds to
1085 the message's headers, and/or writes information to the log. In each case, this
1086 only happens once (per message for headers, per connection for log).
1087
1088 ** NOTE: The header adding action using the "message" setting is historic, and
1089 its use is now deprecated. The new add_header modifier should be used instead.
1090
1091 Arguments:
1092 where ACL_WHERE_xxxx indicating which ACL this is
1093 user_message message for adding to headers
1094 log_message message for logging, if different
1095
1096 Returns: nothing
1097 */
1098
1099 static void
1100 acl_warn(int where, uschar *user_message, uschar *log_message)
1101 {
1102 if (log_message != NULL && log_message != user_message)
1103 {
1104 uschar *text;
1105 string_item *logged;
1106
1107 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1108 string_printing(log_message));
1109
1110 /* If a sender verification has failed, and the log message is "sender verify
1111 failed", add the failure message. */
1112
1113 if (sender_verified_failed != NULL &&
1114 sender_verified_failed->message != NULL &&
1115 strcmpic(log_message, US"sender verify failed") == 0)
1116 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1117
1118 /* Search previously logged warnings. They are kept in malloc
1119 store so they can be freed at the start of a new message. */
1120
1121 for (logged = acl_warn_logged; logged; logged = logged->next)
1122 if (Ustrcmp(logged->text, text) == 0) break;
1123
1124 if (!logged)
1125 {
1126 int length = Ustrlen(text) + 1;
1127 log_write(0, LOG_MAIN, "%s", text);
1128 logged = store_malloc(sizeof(string_item) + length);
1129 logged->text = US logged + sizeof(string_item);
1130 memcpy(logged->text, text, length);
1131 logged->next = acl_warn_logged;
1132 acl_warn_logged = logged;
1133 }
1134 }
1135
1136 /* If there's no user message, we are done. */
1137
1138 if (!user_message) return;
1139
1140 /* If this isn't a message ACL, we can't do anything with a user message.
1141 Log an error. */
1142
1143 if (where > ACL_WHERE_NOTSMTP)
1144 {
1145 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1146 "found in a non-message (%s) ACL: cannot specify header lines here: "
1147 "message ignored", acl_wherenames[where]);
1148 return;
1149 }
1150
1151 /* The code for setting up header lines is now abstracted into a separate
1152 function so that it can be used for the add_header modifier as well. */
1153
1154 setup_header(user_message);
1155 }
1156
1157
1158
1159 /*************************************************
1160 * Verify and check reverse DNS *
1161 *************************************************/
1162
1163 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1164 address if this has not yet been done. The host_name_lookup() function checks
1165 that one of these names resolves to an address list that contains the client IP
1166 address, so we don't actually have to do the check here.
1167
1168 Arguments:
1169 user_msgptr pointer for user message
1170 log_msgptr pointer for log message
1171
1172 Returns: OK verification condition succeeded
1173 FAIL verification failed
1174 DEFER there was a problem verifying
1175 */
1176
1177 static int
1178 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1179 {
1180 int rc;
1181
1182 user_msgptr = user_msgptr; /* stop compiler warning */
1183
1184 /* Previous success */
1185
1186 if (sender_host_name != NULL) return OK;
1187
1188 /* Previous failure */
1189
1190 if (host_lookup_failed)
1191 {
1192 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1193 return FAIL;
1194 }
1195
1196 /* Need to do a lookup */
1197
1198 HDEBUG(D_acl)
1199 debug_printf_indent("looking up host name to force name/address consistency check\n");
1200
1201 if ((rc = host_name_lookup()) != OK)
1202 {
1203 *log_msgptr = rc == DEFER
1204 ? US"host lookup deferred for reverse lookup check"
1205 : string_sprintf("host lookup failed for reverse lookup check%s",
1206 host_lookup_msg);
1207 return rc; /* DEFER or FAIL */
1208 }
1209
1210 host_build_sender_fullhost();
1211 return OK;
1212 }
1213
1214
1215
1216 /*************************************************
1217 * Check client IP address matches CSA target *
1218 *************************************************/
1219
1220 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1221 response for address records belonging to the CSA target hostname. The section
1222 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1223 If one of the addresses matches the client's IP address, then the client is
1224 authorized by CSA. If there are target IP addresses but none of them match
1225 then the client is using an unauthorized IP address. If there are no target IP
1226 addresses then the client cannot be using an authorized IP address. (This is
1227 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1228
1229 Arguments:
1230 dnsa the DNS answer block
1231 dnss a DNS scan block for us to use
1232 reset option specifying what portion to scan, as described above
1233 target the target hostname to use for matching RR names
1234
1235 Returns: CSA_OK successfully authorized
1236 CSA_FAIL_MISMATCH addresses found but none matched
1237 CSA_FAIL_NOADDR no target addresses found
1238 */
1239
1240 static int
1241 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1242 uschar *target)
1243 {
1244 int rc = CSA_FAIL_NOADDR;
1245
1246 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1247 rr;
1248 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1249 {
1250 /* Check this is an address RR for the target hostname. */
1251
1252 if (rr->type != T_A
1253 #if HAVE_IPV6
1254 && rr->type != T_AAAA
1255 #endif
1256 ) continue;
1257
1258 if (strcmpic(target, rr->name) != 0) continue;
1259
1260 rc = CSA_FAIL_MISMATCH;
1261
1262 /* Turn the target address RR into a list of textual IP addresses and scan
1263 the list. There may be more than one if it is an A6 RR. */
1264
1265 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1266 {
1267 /* If the client IP address matches the target IP address, it's good! */
1268
1269 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1270
1271 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1272 }
1273 }
1274
1275 /* If we found some target addresses but none of them matched, the client is
1276 using an unauthorized IP address, otherwise the target has no authorized IP
1277 addresses. */
1278
1279 return rc;
1280 }
1281
1282
1283
1284 /*************************************************
1285 * Verify Client SMTP Authorization *
1286 *************************************************/
1287
1288 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1289 to find the CSA SRV record corresponding to the domain argument, or
1290 $sender_helo_name if no argument is provided. It then checks that the
1291 client is authorized, and that its IP address corresponds to the SRV
1292 target's address by calling acl_verify_csa_address() above. The address
1293 should have been returned in the DNS response's ADDITIONAL section, but if
1294 not we perform another DNS lookup to get it.
1295
1296 Arguments:
1297 domain pointer to optional parameter following verify = csa
1298
1299 Returns: CSA_UNKNOWN no valid CSA record found
1300 CSA_OK successfully authorized
1301 CSA_FAIL_* client is definitely not authorized
1302 CSA_DEFER_* there was a DNS problem
1303 */
1304
1305 static int
1306 acl_verify_csa(const uschar *domain)
1307 {
1308 tree_node *t;
1309 const uschar *found;
1310 int priority, weight, port;
1311 dns_answer * dnsa = store_get_dns_answer();
1312 dns_scan dnss;
1313 dns_record *rr;
1314 int rc, type;
1315 uschar target[256];
1316
1317 /* Work out the domain we are using for the CSA lookup. The default is the
1318 client's HELO domain. If the client has not said HELO, use its IP address
1319 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1320
1321 while (isspace(*domain) && *domain != '\0') ++domain;
1322 if (*domain == '\0') domain = sender_helo_name;
1323 if (domain == NULL) domain = sender_host_address;
1324 if (sender_host_address == NULL) return CSA_UNKNOWN;
1325
1326 /* If we have an address literal, strip off the framing ready for turning it
1327 into a domain. The framing consists of matched square brackets possibly
1328 containing a keyword and a colon before the actual IP address. */
1329
1330 if (domain[0] == '[')
1331 {
1332 const uschar *start = Ustrchr(domain, ':');
1333 if (start == NULL) start = domain;
1334 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1335 }
1336
1337 /* Turn domains that look like bare IP addresses into domains in the reverse
1338 DNS. This code also deals with address literals and $sender_host_address. It's
1339 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1340 address literals, but it's probably the most friendly thing to do. This is an
1341 extension to CSA, so we allow it to be turned off for proper conformance. */
1342
1343 if (string_is_ip_address(domain, NULL) != 0)
1344 {
1345 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1346 domain = dns_build_reverse(domain);
1347 }
1348
1349 /* Find out if we've already done the CSA check for this domain. If we have,
1350 return the same result again. Otherwise build a new cached result structure
1351 for this domain. The name is filled in now, and the value is filled in when
1352 we return from this function. */
1353
1354 t = tree_search(csa_cache, domain);
1355 if (t != NULL) return t->data.val;
1356
1357 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
1358 Ustrcpy(t->name, domain);
1359 (void)tree_insertnode(&csa_cache, t);
1360
1361 /* Now we are ready to do the actual DNS lookup(s). */
1362
1363 found = domain;
1364 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1365 {
1366 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1367
1368 default:
1369 return t->data.val = CSA_DEFER_SRV;
1370
1371 /* If we found nothing, the client's authorization is unknown. */
1372
1373 case DNS_NOMATCH:
1374 case DNS_NODATA:
1375 return t->data.val = CSA_UNKNOWN;
1376
1377 /* We got something! Go on to look at the reply in more detail. */
1378
1379 case DNS_SUCCEED:
1380 break;
1381 }
1382
1383 /* Scan the reply for well-formed CSA SRV records. */
1384
1385 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1386 rr;
1387 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1388 {
1389 const uschar * p = rr->data;
1390
1391 /* Extract the numerical SRV fields (p is incremented) */
1392
1393 GETSHORT(priority, p);
1394 GETSHORT(weight, p);
1395 GETSHORT(port, p);
1396
1397 DEBUG(D_acl)
1398 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1399
1400 /* Check the CSA version number */
1401
1402 if (priority != 1) continue;
1403
1404 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1405 found by dns_special_lookup() is a parent of the one we asked for), we check
1406 the subdomain assertions in the port field. At the moment there's only one
1407 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1408 SRV records of their own. */
1409
1410 if (Ustrcmp(found, domain) != 0)
1411 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1412
1413 /* This CSA SRV record refers directly to our domain, so we check the value
1414 in the weight field to work out the domain's authorization. 0 and 1 are
1415 unauthorized; 3 means the client is authorized but we can't check the IP
1416 address in order to authenticate it, so we treat it as unknown; values
1417 greater than 3 are undefined. */
1418
1419 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1420
1421 if (weight > 2) continue;
1422
1423 /* Weight == 2, which means the domain is authorized. We must check that the
1424 client's IP address is listed as one of the SRV target addresses. Save the
1425 target hostname then break to scan the additional data for its addresses. */
1426
1427 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1428 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1429
1430 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1431
1432 break;
1433 }
1434
1435 /* If we didn't break the loop then no appropriate records were found. */
1436
1437 if (!rr) return t->data.val = CSA_UNKNOWN;
1438
1439 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1440 A target of "." indicates there are no valid addresses, so the client cannot
1441 be authorized. (This is an odd configuration because weight=2 target=. is
1442 equivalent to weight=1, but we check for it in order to keep load off the
1443 root name servers.) Note that dn_expand() turns "." into "". */
1444
1445 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1446
1447 /* Scan the additional section of the CSA SRV reply for addresses belonging
1448 to the target. If the name server didn't return any additional data (e.g.
1449 because it does not fully support SRV records), we need to do another lookup
1450 to obtain the target addresses; otherwise we have a definitive result. */
1451
1452 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1453 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1454
1455 /* The DNS lookup type corresponds to the IP version used by the client. */
1456
1457 #if HAVE_IPV6
1458 if (Ustrchr(sender_host_address, ':') != NULL)
1459 type = T_AAAA;
1460 else
1461 #endif /* HAVE_IPV6 */
1462 type = T_A;
1463
1464
1465 lookup_dnssec_authenticated = NULL;
1466 switch (dns_lookup(dnsa, target, type, NULL))
1467 {
1468 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1469
1470 default:
1471 return t->data.val = CSA_DEFER_ADDR;
1472
1473 /* If the query succeeded, scan the addresses and return the result. */
1474
1475 case DNS_SUCCEED:
1476 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1477 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1478 /* else fall through */
1479
1480 /* If the target has no IP addresses, the client cannot have an authorized
1481 IP address. However, if the target site uses A6 records (not AAAA records)
1482 we have to do yet another lookup in order to check them. */
1483
1484 case DNS_NOMATCH:
1485 case DNS_NODATA:
1486 return t->data.val = CSA_FAIL_NOADDR;
1487 }
1488 }
1489
1490
1491
1492 /*************************************************
1493 * Handle verification (address & other) *
1494 *************************************************/
1495
1496 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1497 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1498 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1499 };
1500 typedef struct {
1501 uschar * name;
1502 int value;
1503 unsigned where_allowed; /* bitmap */
1504 BOOL no_options; /* Never has /option(s) following */
1505 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1506 } verify_type_t;
1507 static verify_type_t verify_type_list[] = {
1508 /* name value where no-opt opt-sep */
1509 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1510 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1511 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1512 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1513 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1514 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1515 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1516 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1517 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1518 FALSE, 6 },
1519 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1520 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1521 #ifdef EXPERIMENTAL_ARC
1522 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1523 #endif
1524 };
1525
1526
1527 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1528 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1529 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1530 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1531 };
1532 typedef struct {
1533 uschar * name;
1534 int value;
1535 int flag;
1536 BOOL has_option; /* Has =option(s) following */
1537 BOOL timeval; /* Has a time value */
1538 } callout_opt_t;
1539 static callout_opt_t callout_opt_list[] = {
1540 /* name value flag has-opt has-time */
1541 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1542 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1543 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1544 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1545 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1546 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1547 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1548 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1549 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1550 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1551 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1552 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1553 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1554 };
1555
1556
1557
1558 /* This function implements the "verify" condition. It is called when
1559 encountered in any ACL, because some tests are almost always permitted. Some
1560 just don't make sense, and always fail (for example, an attempt to test a host
1561 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1562
1563 Arguments:
1564 where where called from
1565 addr the recipient address that the ACL is handling, or NULL
1566 arg the argument of "verify"
1567 user_msgptr pointer for user message
1568 log_msgptr pointer for log message
1569 basic_errno where to put verify errno
1570
1571 Returns: OK verification condition succeeded
1572 FAIL verification failed
1573 DEFER there was a problem verifying
1574 ERROR syntax error
1575 */
1576
1577 static int
1578 acl_verify(int where, address_item *addr, const uschar *arg,
1579 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1580 {
1581 int sep = '/';
1582 int callout = -1;
1583 int callout_overall = -1;
1584 int callout_connect = -1;
1585 int verify_options = 0;
1586 int rc;
1587 BOOL verify_header_sender = FALSE;
1588 BOOL defer_ok = FALSE;
1589 BOOL callout_defer_ok = FALSE;
1590 BOOL no_details = FALSE;
1591 BOOL success_on_redirect = FALSE;
1592 address_item *sender_vaddr = NULL;
1593 uschar *verify_sender_address = NULL;
1594 uschar *pm_mailfrom = NULL;
1595 uschar *se_mailfrom = NULL;
1596
1597 /* Some of the verify items have slash-separated options; some do not. Diagnose
1598 an error if options are given for items that don't expect them.
1599 */
1600
1601 uschar *slash = Ustrchr(arg, '/');
1602 const uschar *list = arg;
1603 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1604 verify_type_t * vp;
1605
1606 if (!ss) goto BAD_VERIFY;
1607
1608 /* Handle name/address consistency verification in a separate function. */
1609
1610 for (vp = verify_type_list;
1611 CS vp < CS verify_type_list + sizeof(verify_type_list);
1612 vp++
1613 )
1614 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1615 : strcmpic (ss, vp->name) == 0)
1616 break;
1617 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1618 goto BAD_VERIFY;
1619
1620 if (vp->no_options && slash)
1621 {
1622 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1623 "(this verify item has no options)", arg);
1624 return ERROR;
1625 }
1626 if (!(vp->where_allowed & BIT(where)))
1627 {
1628 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1629 vp->name, acl_wherenames[where]);
1630 return ERROR;
1631 }
1632 switch(vp->value)
1633 {
1634 case VERIFY_REV_HOST_LKUP:
1635 if (!sender_host_address) return OK;
1636 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1637 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1638 if (strcmpic(ss, US"defer_ok") == 0)
1639 return OK;
1640 return rc;
1641
1642 case VERIFY_CERT:
1643 /* TLS certificate verification is done at STARTTLS time; here we just
1644 test whether it was successful or not. (This is for optional verification; for
1645 mandatory verification, the connection doesn't last this long.) */
1646
1647 if (tls_in.certificate_verified) return OK;
1648 *user_msgptr = US"no verified certificate";
1649 return FAIL;
1650
1651 case VERIFY_HELO:
1652 /* We can test the result of optional HELO verification that might have
1653 occurred earlier. If not, we can attempt the verification now. */
1654
1655 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1656 return f.helo_verified ? OK : FAIL;
1657
1658 case VERIFY_CSA:
1659 /* Do Client SMTP Authorization checks in a separate function, and turn the
1660 result code into user-friendly strings. */
1661
1662 rc = acl_verify_csa(list);
1663 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1664 csa_reason_string[rc]);
1665 csa_status = csa_status_string[rc];
1666 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1667 return csa_return_code[rc];
1668
1669 #ifdef EXPERIMENTAL_ARC
1670 case VERIFY_ARC:
1671 { /* Do Authenticated Received Chain checks in a separate function. */
1672 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1673 int csep = 0;
1674 uschar * cond;
1675
1676 if (!(arc_state = acl_verify_arc())) return DEFER;
1677 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1678 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1679
1680 if (!condlist) condlist = US"none:pass";
1681 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1682 if (Ustrcmp(arc_state, cond) == 0) return OK;
1683 return FAIL;
1684 }
1685 #endif
1686
1687 case VERIFY_HDR_SYNTAX:
1688 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1689 a syntax error, we return details of the error to the sender if configured to
1690 send out full details. (But a "message" setting on the ACL can override, as
1691 always). */
1692
1693 rc = verify_check_headers(log_msgptr);
1694 if (rc != OK && *log_msgptr)
1695 if (smtp_return_error_details)
1696 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1697 else
1698 acl_verify_message = *log_msgptr;
1699 return rc;
1700
1701 case VERIFY_HDR_NAMES_ASCII:
1702 /* Check that all header names are true 7 bit strings
1703 See RFC 5322, 2.2. and RFC 6532, 3. */
1704
1705 rc = verify_check_header_names_ascii(log_msgptr);
1706 if (rc != OK && smtp_return_error_details && *log_msgptr)
1707 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1708 return rc;
1709
1710 case VERIFY_NOT_BLIND:
1711 /* Check that no recipient of this message is "blind", that is, every envelope
1712 recipient must be mentioned in either To: or Cc:. */
1713 {
1714 BOOL case_sensitive = TRUE;
1715
1716 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1717 if (strcmpic(ss, US"case_insensitive") == 0)
1718 case_sensitive = FALSE;
1719 else
1720 {
1721 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1722 "condition \"verify %s\"", ss, arg);
1723 return ERROR;
1724 }
1725
1726 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1727 {
1728 *log_msgptr = US"bcc recipient detected";
1729 if (smtp_return_error_details)
1730 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1731 }
1732 return rc;
1733 }
1734
1735 /* The remaining verification tests check recipient and sender addresses,
1736 either from the envelope or from the header. There are a number of
1737 slash-separated options that are common to all of them. */
1738
1739 case VERIFY_HDR_SNDR:
1740 verify_header_sender = TRUE;
1741 break;
1742
1743 case VERIFY_SNDR:
1744 /* In the case of a sender, this can optionally be followed by an address to use
1745 in place of the actual sender (rare special-case requirement). */
1746 {
1747 uschar *s = ss + 6;
1748 if (*s == 0)
1749 verify_sender_address = sender_address;
1750 else
1751 {
1752 while (isspace(*s)) s++;
1753 if (*s++ != '=') goto BAD_VERIFY;
1754 while (isspace(*s)) s++;
1755 verify_sender_address = string_copy(s);
1756 }
1757 }
1758 break;
1759
1760 case VERIFY_RCPT:
1761 break;
1762 }
1763
1764
1765
1766 /* Remaining items are optional; they apply to sender and recipient
1767 verification, including "header sender" verification. */
1768
1769 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1770 {
1771 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1772 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1773 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1774
1775 /* These two old options are left for backwards compatibility */
1776
1777 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1778 {
1779 callout_defer_ok = TRUE;
1780 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1781 }
1782
1783 else if (strcmpic(ss, US"check_postmaster") == 0)
1784 {
1785 pm_mailfrom = US"";
1786 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1787 }
1788
1789 /* The callout option has a number of sub-options, comma separated */
1790
1791 else if (strncmpic(ss, US"callout", 7) == 0)
1792 {
1793 callout = CALLOUT_TIMEOUT_DEFAULT;
1794 ss += 7;
1795 if (*ss != 0)
1796 {
1797 while (isspace(*ss)) ss++;
1798 if (*ss++ == '=')
1799 {
1800 const uschar * sublist = ss;
1801 int optsep = ',';
1802 uschar buffer[256];
1803 uschar * opt;
1804
1805 while (isspace(*sublist)) sublist++;
1806 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1807 {
1808 callout_opt_t * op;
1809 double period = 1.0F;
1810
1811 for (op= callout_opt_list; op->name; op++)
1812 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1813 break;
1814
1815 verify_options |= op->flag;
1816 if (op->has_option)
1817 {
1818 opt += Ustrlen(op->name);
1819 while (isspace(*opt)) opt++;
1820 if (*opt++ != '=')
1821 {
1822 *log_msgptr = string_sprintf("'=' expected after "
1823 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1824 return ERROR;
1825 }
1826 while (isspace(*opt)) opt++;
1827 }
1828 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1829 {
1830 *log_msgptr = string_sprintf("bad time value in ACL condition "
1831 "\"verify %s\"", arg);
1832 return ERROR;
1833 }
1834
1835 switch(op->value)
1836 {
1837 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1838 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1839 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1840 case CALLOUT_MAILFROM:
1841 if (!verify_header_sender)
1842 {
1843 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1844 "callout option only for verify=header_sender (detected in ACL "
1845 "condition \"%s\")", arg);
1846 return ERROR;
1847 }
1848 se_mailfrom = string_copy(opt);
1849 break;
1850 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1851 case CALLOUT_MAXWAIT: callout_overall = period; break;
1852 case CALLOUT_CONNECT: callout_connect = period; break;
1853 case CALLOUT_TIME: callout = period; break;
1854 }
1855 }
1856 }
1857 else
1858 {
1859 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1860 "ACL condition \"%s\"", arg);
1861 return ERROR;
1862 }
1863 }
1864 }
1865
1866 /* Option not recognized */
1867
1868 else
1869 {
1870 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1871 "condition \"verify %s\"", ss, arg);
1872 return ERROR;
1873 }
1874 }
1875
1876 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1877 (vopt_callout_recipsender|vopt_callout_recippmaster))
1878 {
1879 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1880 "for a recipient callout";
1881 return ERROR;
1882 }
1883
1884 /* Handle sender-in-header verification. Default the user message to the log
1885 message if giving out verification details. */
1886
1887 if (verify_header_sender)
1888 {
1889 int verrno;
1890
1891 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1892 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1893 &verrno)) != OK)
1894 {
1895 *basic_errno = verrno;
1896 if (smtp_return_error_details)
1897 {
1898 if (!*user_msgptr && *log_msgptr)
1899 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1900 if (rc == DEFER) f.acl_temp_details = TRUE;
1901 }
1902 }
1903 }
1904
1905 /* Handle a sender address. The default is to verify *the* sender address, but
1906 optionally a different address can be given, for special requirements. If the
1907 address is empty, we are dealing with a bounce message that has no sender, so
1908 we cannot do any checking. If the real sender address gets rewritten during
1909 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1910 during message reception.
1911
1912 A list of verified "sender" addresses is kept to try to avoid doing to much
1913 work repetitively when there are multiple recipients in a message and they all
1914 require sender verification. However, when callouts are involved, it gets too
1915 complicated because different recipients may require different callout options.
1916 Therefore, we always do a full sender verify when any kind of callout is
1917 specified. Caching elsewhere, for instance in the DNS resolver and in the
1918 callout handling, should ensure that this is not terribly inefficient. */
1919
1920 else if (verify_sender_address)
1921 {
1922 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1923 {
1924 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1925 "sender verify callout";
1926 return ERROR;
1927 }
1928
1929 sender_vaddr = verify_checked_sender(verify_sender_address);
1930 if (sender_vaddr != NULL && /* Previously checked */
1931 callout <= 0) /* No callout needed this time */
1932 {
1933 /* If the "routed" flag is set, it means that routing worked before, so
1934 this check can give OK (the saved return code value, if set, belongs to a
1935 callout that was done previously). If the "routed" flag is not set, routing
1936 must have failed, so we use the saved return code. */
1937
1938 if (testflag(sender_vaddr, af_verify_routed))
1939 rc = OK;
1940 else
1941 {
1942 rc = sender_vaddr->special_action;
1943 *basic_errno = sender_vaddr->basic_errno;
1944 }
1945 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1946 }
1947
1948 /* Do a new verification, and cache the result. The cache is used to avoid
1949 verifying the sender multiple times for multiple RCPTs when callouts are not
1950 specified (see comments above).
1951
1952 The cache is also used on failure to give details in response to the first
1953 RCPT that gets bounced for this reason. However, this can be suppressed by
1954 the no_details option, which sets the flag that says "this detail has already
1955 been sent". The cache normally contains just one address, but there may be
1956 more in esoteric circumstances. */
1957
1958 else
1959 {
1960 BOOL routed = TRUE;
1961 uschar *save_address_data = deliver_address_data;
1962
1963 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1964 #ifdef SUPPORT_I18N
1965 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1966 {
1967 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1968 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1969 }
1970 #endif
1971 if (no_details) setflag(sender_vaddr, af_sverify_told);
1972 if (verify_sender_address[0] != 0)
1973 {
1974 /* If this is the real sender address, save the unrewritten version
1975 for use later in receive. Otherwise, set a flag so that rewriting the
1976 sender in verify_address() does not update sender_address. */
1977
1978 if (verify_sender_address == sender_address)
1979 sender_address_unrewritten = sender_address;
1980 else
1981 verify_options |= vopt_fake_sender;
1982
1983 if (success_on_redirect)
1984 verify_options |= vopt_success_on_redirect;
1985
1986 /* The recipient, qualify, and expn options are never set in
1987 verify_options. */
1988
1989 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1990 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1991
1992 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
1993
1994 if (rc != OK)
1995 *basic_errno = sender_vaddr->basic_errno;
1996 else
1997 DEBUG(D_acl)
1998 {
1999 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2000 debug_printf_indent("sender %s verified ok as %s\n",
2001 verify_sender_address, sender_vaddr->address);
2002 else
2003 debug_printf_indent("sender %s verified ok\n",
2004 verify_sender_address);
2005 }
2006 }
2007 else
2008 rc = OK; /* Null sender */
2009
2010 /* Cache the result code */
2011
2012 if (routed) setflag(sender_vaddr, af_verify_routed);
2013 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2014 sender_vaddr->special_action = rc;
2015 sender_vaddr->next = sender_verified_list;
2016 sender_verified_list = sender_vaddr;
2017
2018 /* Restore the recipient address data, which might have been clobbered by
2019 the sender verification. */
2020
2021 deliver_address_data = save_address_data;
2022 }
2023
2024 /* Put the sender address_data value into $sender_address_data */
2025
2026 sender_address_data = sender_vaddr->prop.address_data;
2027 }
2028
2029 /* A recipient address just gets a straightforward verify; again we must handle
2030 the DEFER overrides. */
2031
2032 else
2033 {
2034 address_item addr2;
2035
2036 if (success_on_redirect)
2037 verify_options |= vopt_success_on_redirect;
2038
2039 /* We must use a copy of the address for verification, because it might
2040 get rewritten. */
2041
2042 addr2 = *addr;
2043 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2044 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2045 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2046
2047 *basic_errno = addr2.basic_errno;
2048 *log_msgptr = addr2.message;
2049 *user_msgptr = (addr2.user_message != NULL)?
2050 addr2.user_message : addr2.message;
2051
2052 /* Allow details for temporary error if the address is so flagged. */
2053 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2054
2055 /* Make $address_data visible */
2056 deliver_address_data = addr2.prop.address_data;
2057 }
2058
2059 /* We have a result from the relevant test. Handle defer overrides first. */
2060
2061 if (rc == DEFER && (defer_ok ||
2062 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2063 {
2064 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2065 defer_ok? "defer_ok" : "callout_defer_ok");
2066 rc = OK;
2067 }
2068
2069 /* If we've failed a sender, set up a recipient message, and point
2070 sender_verified_failed to the address item that actually failed. */
2071
2072 if (rc != OK && verify_sender_address != NULL)
2073 {
2074 if (rc != DEFER)
2075 *log_msgptr = *user_msgptr = US"Sender verify failed";
2076 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2077 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2078 else
2079 {
2080 *log_msgptr = US"Could not complete sender verify callout";
2081 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2082 *log_msgptr;
2083 }
2084
2085 sender_verified_failed = sender_vaddr;
2086 }
2087
2088 /* Verifying an address messes up the values of $domain and $local_part,
2089 so reset them before returning if this is a RCPT ACL. */
2090
2091 if (addr != NULL)
2092 {
2093 deliver_domain = addr->domain;
2094 deliver_localpart = addr->local_part;
2095 }
2096 return rc;
2097
2098 /* Syntax errors in the verify argument come here. */
2099
2100 BAD_VERIFY:
2101 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2102 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2103 "or \"reverse_host_lookup\" at start of ACL condition "
2104 "\"verify %s\"", arg);
2105 return ERROR;
2106 }
2107
2108
2109
2110
2111 /*************************************************
2112 * Check argument for control= modifier *
2113 *************************************************/
2114
2115 /* Called from acl_check_condition() below.
2116 To handle the case "queue_only" we accept an _ in the
2117 initial / option-switch position.
2118
2119 Arguments:
2120 arg the argument string for control=
2121 pptr set to point to the terminating character
2122 where which ACL we are in
2123 log_msgptr for error messages
2124
2125 Returns: CONTROL_xxx value
2126 */
2127
2128 static int
2129 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2130 {
2131 int idx, len;
2132 control_def * d;
2133 uschar c;
2134
2135 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2136 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2137 && (!d->has_option || c != '/' && c != '_')
2138 ) )
2139 {
2140 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2141 return CONTROL_ERROR;
2142 }
2143
2144 *pptr = arg + len;
2145 return idx;
2146 }
2147
2148
2149
2150
2151 /*************************************************
2152 * Return a ratelimit error *
2153 *************************************************/
2154
2155 /* Called from acl_ratelimit() below
2156
2157 Arguments:
2158 log_msgptr for error messages
2159 format format string
2160 ... supplementary arguments
2161
2162 Returns: ERROR
2163 */
2164
2165 static int
2166 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2167 {
2168 va_list ap;
2169 gstring * g =
2170 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2171
2172 va_start(ap, format);
2173 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2174 va_end(ap);
2175
2176 gstring_release_unused(g);
2177 *log_msgptr = string_from_gstring(g);
2178 return ERROR;
2179 }
2180
2181
2182
2183
2184 /*************************************************
2185 * Handle rate limiting *
2186 *************************************************/
2187
2188 /* Called by acl_check_condition() below to calculate the result
2189 of the ACL ratelimit condition.
2190
2191 Note that the return value might be slightly unexpected: if the
2192 sender's rate is above the limit then the result is OK. This is
2193 similar to the dnslists condition, and is so that you can write
2194 ACL clauses like: defer ratelimit = 15 / 1h
2195
2196 Arguments:
2197 arg the option string for ratelimit=
2198 where ACL_WHERE_xxxx indicating which ACL this is
2199 log_msgptr for error messages
2200
2201 Returns: OK - Sender's rate is above limit
2202 FAIL - Sender's rate is below limit
2203 DEFER - Problem opening ratelimit database
2204 ERROR - Syntax error in options.
2205 */
2206
2207 static int
2208 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2209 {
2210 double limit, period, count;
2211 uschar *ss;
2212 uschar *key = NULL;
2213 uschar *unique = NULL;
2214 int sep = '/';
2215 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2216 BOOL noupdate = FALSE, badacl = FALSE;
2217 int mode = RATE_PER_WHAT;
2218 int old_pool, rc;
2219 tree_node **anchor, *t;
2220 open_db dbblock, *dbm;
2221 int dbdb_size;
2222 dbdata_ratelimit *dbd;
2223 dbdata_ratelimit_unique *dbdb;
2224 struct timeval tv;
2225
2226 /* Parse the first two options and record their values in expansion
2227 variables. These variables allow the configuration to have informative
2228 error messages based on rate limits obtained from a table lookup. */
2229
2230 /* First is the maximum number of messages per period / maximum burst
2231 size, which must be greater than or equal to zero. Zero is useful for
2232 rate measurement as opposed to rate limiting. */
2233
2234 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2235 return ratelimit_error(log_msgptr, "sender rate limit not set");
2236
2237 limit = Ustrtod(sender_rate_limit, &ss);
2238 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2239 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2240 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2241
2242 if (limit < 0.0 || *ss != '\0')
2243 return ratelimit_error(log_msgptr,
2244 "\"%s\" is not a positive number", sender_rate_limit);
2245
2246 /* Second is the rate measurement period / exponential smoothing time
2247 constant. This must be strictly greater than zero, because zero leads to
2248 run-time division errors. */
2249
2250 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2251 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2252 if (period <= 0.0)
2253 return ratelimit_error(log_msgptr,
2254 "\"%s\" is not a time value", sender_rate_period);
2255
2256 /* By default we are counting one of something, but the per_rcpt,
2257 per_byte, and count options can change this. */
2258
2259 count = 1.0;
2260
2261 /* Parse the other options. */
2262
2263 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2264 {
2265 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2266 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2267 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2268 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2269 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2270 else if (strcmpic(ss, US"per_conn") == 0)
2271 {
2272 RATE_SET(mode, PER_CONN);
2273 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2274 badacl = TRUE;
2275 }
2276 else if (strcmpic(ss, US"per_mail") == 0)
2277 {
2278 RATE_SET(mode, PER_MAIL);
2279 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2280 }
2281 else if (strcmpic(ss, US"per_rcpt") == 0)
2282 {
2283 /* If we are running in the RCPT ACL, then we'll count the recipients
2284 one by one, but if we are running when we have accumulated the whole
2285 list then we'll add them all in one batch. */
2286 if (where == ACL_WHERE_RCPT)
2287 RATE_SET(mode, PER_RCPT);
2288 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2289 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2290 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2291 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2292 }
2293 else if (strcmpic(ss, US"per_byte") == 0)
2294 {
2295 /* If we have not yet received the message data and there was no SIZE
2296 declaration on the MAIL command, then it's safe to just use a value of
2297 zero and let the recorded rate decay as if nothing happened. */
2298 RATE_SET(mode, PER_MAIL);
2299 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2300 else count = message_size < 0 ? 0.0 : (double)message_size;
2301 }
2302 else if (strcmpic(ss, US"per_addr") == 0)
2303 {
2304 RATE_SET(mode, PER_RCPT);
2305 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2306 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2307 }
2308 else if (strncmpic(ss, US"count=", 6) == 0)
2309 {
2310 uschar *e;
2311 count = Ustrtod(ss+6, &e);
2312 if (count < 0.0 || *e != '\0')
2313 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2314 }
2315 else if (strncmpic(ss, US"unique=", 7) == 0)
2316 unique = string_copy(ss + 7);
2317 else if (!key)
2318 key = string_copy(ss);
2319 else
2320 key = string_sprintf("%s/%s", key, ss);
2321 }
2322
2323 /* Sanity check. When the badacl flag is set the update mode must either
2324 be readonly (which is the default if it is omitted) or, for backwards
2325 compatibility, a combination of noupdate and strict or leaky. */
2326
2327 if (mode == RATE_PER_CLASH)
2328 return ratelimit_error(log_msgptr, "conflicting per_* options");
2329 if (leaky + strict + readonly > 1)
2330 return ratelimit_error(log_msgptr, "conflicting update modes");
2331 if (badacl && (leaky || strict) && !noupdate)
2332 return ratelimit_error(log_msgptr,
2333 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2334 ratelimit_option_string[mode], acl_wherenames[where]);
2335
2336 /* Set the default values of any unset options. In readonly mode we
2337 perform the rate computation without any increment so that its value
2338 decays to eventually allow over-limit senders through. */
2339
2340 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2341 if (badacl) readonly = TRUE;
2342 if (readonly) count = 0.0;
2343 if (!strict && !readonly) leaky = TRUE;
2344 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2345
2346 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2347 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2348 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2349 are added to the key because they alter the meaning of the stored data. */
2350
2351 if (!key)
2352 key = !sender_host_address ? US"" : sender_host_address;
2353
2354 key = string_sprintf("%s/%s/%s%s",
2355 sender_rate_period,
2356 ratelimit_option_string[mode],
2357 unique == NULL ? "" : "unique/",
2358 key);
2359
2360 HDEBUG(D_acl)
2361 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2362
2363 /* See if we have already computed the rate by looking in the relevant tree.
2364 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2365 pool so that they survive across resets. In readonly mode we only remember the
2366 result for the rest of this command in case a later command changes it. After
2367 this bit of logic the code is independent of the per_* mode. */
2368
2369 old_pool = store_pool;
2370
2371 if (readonly)
2372 anchor = &ratelimiters_cmd;
2373 else switch(mode)
2374 {
2375 case RATE_PER_CONN:
2376 anchor = &ratelimiters_conn;
2377 store_pool = POOL_PERM;
2378 break;
2379 case RATE_PER_BYTE:
2380 case RATE_PER_MAIL:
2381 case RATE_PER_ALLRCPTS:
2382 anchor = &ratelimiters_mail;
2383 break;
2384 case RATE_PER_ADDR:
2385 case RATE_PER_CMD:
2386 case RATE_PER_RCPT:
2387 anchor = &ratelimiters_cmd;
2388 break;
2389 default:
2390 anchor = NULL; /* silence an "unused" complaint */
2391 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2392 "internal ACL error: unknown ratelimit mode %d", mode);
2393 break;
2394 }
2395
2396 if ((t = tree_search(*anchor, key)))
2397 {
2398 dbd = t->data.ptr;
2399 /* The following few lines duplicate some of the code below. */
2400 rc = (dbd->rate < limit)? FAIL : OK;
2401 store_pool = old_pool;
2402 sender_rate = string_sprintf("%.1f", dbd->rate);
2403 HDEBUG(D_acl)
2404 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2405 return rc;
2406 }
2407
2408 /* We aren't using a pre-computed rate, so get a previously recorded rate
2409 from the database, which will be updated and written back if required. */
2410
2411 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2412 {
2413 store_pool = old_pool;
2414 sender_rate = NULL;
2415 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2416 *log_msgptr = US"ratelimit database not available";
2417 return DEFER;
2418 }
2419 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2420 dbd = NULL;
2421
2422 gettimeofday(&tv, NULL);
2423
2424 if (dbdb)
2425 {
2426 /* Locate the basic ratelimit block inside the DB data. */
2427 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2428 dbd = &dbdb->dbd;
2429
2430 /* Forget the old Bloom filter if it is too old, so that we count each
2431 repeating event once per period. We don't simply clear and re-use the old
2432 filter because we want its size to change if the limit changes. Note that
2433 we keep the dbd pointer for copying the rate into the new data block. */
2434
2435 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2436 {
2437 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2438 dbdb = NULL;
2439 }
2440
2441 /* Sanity check. */
2442
2443 if(unique && dbdb_size < sizeof(*dbdb))
2444 {
2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2446 dbdb = NULL;
2447 }
2448 }
2449
2450 /* Allocate a new data block if the database lookup failed
2451 or the Bloom filter passed its age limit. */
2452
2453 if (!dbdb)
2454 {
2455 if (!unique)
2456 {
2457 /* No Bloom filter. This basic ratelimit block is initialized below. */
2458 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2459 dbdb_size = sizeof(*dbd);
2460 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2461 }
2462 else
2463 {
2464 int extra;
2465 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2466
2467 /* See the long comment below for an explanation of the magic number 2.
2468 The filter has a minimum size in case the rate limit is very small;
2469 this is determined by the definition of dbdata_ratelimit_unique. */
2470
2471 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2472 if (extra < 0) extra = 0;
2473 dbdb_size = sizeof(*dbdb) + extra;
2474 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2475 dbdb->bloom_epoch = tv.tv_sec;
2476 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2477 memset(dbdb->bloom, 0, dbdb->bloom_size);
2478
2479 /* Preserve any basic ratelimit data (which is our longer-term memory)
2480 by copying it from the discarded block. */
2481
2482 if (dbd)
2483 {
2484 dbdb->dbd = *dbd;
2485 dbd = &dbdb->dbd;
2486 }
2487 }
2488 }
2489
2490 /* If we are counting unique events, find out if this event is new or not.
2491 If the client repeats the event during the current period then it should be
2492 counted. We skip this code in readonly mode for efficiency, because any
2493 changes to the filter will be discarded and because count is already set to
2494 zero. */
2495
2496 if (unique && !readonly)
2497 {
2498 /* We identify unique events using a Bloom filter. (You can find my
2499 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2500 With the per_addr option, an "event" is a recipient address, though the
2501 user can use the unique option to define their own events. We only count
2502 an event if we have not seen it before.
2503
2504 We size the filter according to the rate limit, which (in leaky mode)
2505 is the limit on the population of the filter. We allow 16 bits of space
2506 per entry (see the construction code above) and we set (up to) 8 of them
2507 when inserting an element (see the loop below). The probability of a false
2508 positive (an event we have not seen before but which we fail to count) is
2509
2510 size = limit * 16
2511 numhash = 8
2512 allzero = exp(-numhash * pop / size)
2513 = exp(-0.5 * pop / limit)
2514 fpr = pow(1 - allzero, numhash)
2515
2516 For senders at the limit the fpr is 0.06% or 1 in 1700
2517 and for senders at half the limit it is 0.0006% or 1 in 170000
2518
2519 In strict mode the Bloom filter can fill up beyond the normal limit, in
2520 which case the false positive rate will rise. This means that the
2521 measured rate for very fast senders can bogusly drop off after a while.
2522
2523 At twice the limit, the fpr is 2.5% or 1 in 40
2524 At four times the limit, it is 31% or 1 in 3.2
2525
2526 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2527 decay below the limit, and if this is more than one then the Bloom filter
2528 will be discarded before the decay gets that far. The false positive rate
2529 at this threshold is 9.3% or 1 in 10.7. */
2530
2531 BOOL seen;
2532 unsigned n, hash, hinc;
2533 uschar md5sum[16];
2534 md5 md5info;
2535
2536 /* Instead of using eight independent hash values, we combine two values
2537 using the formula h1 + n * h2. This does not harm the Bloom filter's
2538 performance, and means the amount of hash we need is independent of the
2539 number of bits we set in the filter. */
2540
2541 md5_start(&md5info);
2542 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2543 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2544 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2545
2546 /* Scan the bits corresponding to this event. A zero bit means we have
2547 not seen it before. Ensure all bits are set to record this event. */
2548
2549 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2550
2551 seen = TRUE;
2552 for (n = 0; n < 8; n++, hash += hinc)
2553 {
2554 int bit = 1 << (hash % 8);
2555 int byte = (hash / 8) % dbdb->bloom_size;
2556 if ((dbdb->bloom[byte] & bit) == 0)
2557 {
2558 dbdb->bloom[byte] |= bit;
2559 seen = FALSE;
2560 }
2561 }
2562
2563 /* If this event has occurred before, do not count it. */
2564
2565 if (seen)
2566 {
2567 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2568 count = 0.0;
2569 }
2570 else
2571 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2572 }
2573
2574 /* If there was no previous ratelimit data block for this key, initialize
2575 the new one, otherwise update the block from the database. The initial rate
2576 is what would be computed by the code below for an infinite interval. */
2577
2578 if (!dbd)
2579 {
2580 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2581 dbd = &dbdb->dbd;
2582 dbd->time_stamp = tv.tv_sec;
2583 dbd->time_usec = tv.tv_usec;
2584 dbd->rate = count;
2585 }
2586 else
2587 {
2588 /* The smoothed rate is computed using an exponentially weighted moving
2589 average adjusted for variable sampling intervals. The standard EWMA for
2590 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2591 where f() is the measured value and f'() is the smoothed value.
2592
2593 Old data decays out of the smoothed value exponentially, such that data n
2594 samples old is multiplied by a^n. The exponential decay time constant p
2595 is defined such that data p samples old is multiplied by 1/e, which means
2596 that a = exp(-1/p). We can maintain the same time constant for a variable
2597 sampling interval i by using a = exp(-i/p).
2598
2599 The rate we are measuring is messages per period, suitable for directly
2600 comparing with the limit. The average rate between now and the previous
2601 message is period / interval, which we feed into the EWMA as the sample.
2602
2603 It turns out that the number of messages required for the smoothed rate
2604 to reach the limit when they are sent in a burst is equal to the limit.
2605 This can be seen by analysing the value of the smoothed rate after N
2606 messages sent at even intervals. Let k = (1 - a) * p/i
2607
2608 rate_1 = (1 - a) * p/i + a * rate_0
2609 = k + a * rate_0
2610 rate_2 = k + a * rate_1
2611 = k + a * k + a^2 * rate_0
2612 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2613 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2614 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2615 = rate_0 * a^N + p/i * (1 - a^N)
2616
2617 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2618
2619 rate_N = p/i + (rate_0 - p/i) * a^N
2620 a^N = (rate_N - p/i) / (rate_0 - p/i)
2621 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2622 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2623
2624 Numerical analysis of the above equation, setting the computed rate to
2625 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2626 rates, p/i, the number of messages N = limit. So limit serves as both the
2627 maximum rate measured in messages per period, and the maximum number of
2628 messages that can be sent in a fast burst. */
2629
2630 double this_time = (double)tv.tv_sec
2631 + (double)tv.tv_usec / 1000000.0;
2632 double prev_time = (double)dbd->time_stamp
2633 + (double)dbd->time_usec / 1000000.0;
2634
2635 /* We must avoid division by zero, and deal gracefully with the clock going
2636 backwards. If we blunder ahead when time is in reverse then the computed
2637 rate will be bogus. To be safe we clamp interval to a very small number. */
2638
2639 double interval = this_time - prev_time <= 0.0 ? 1e-9
2640 : this_time - prev_time;
2641
2642 double i_over_p = interval / period;
2643 double a = exp(-i_over_p);
2644
2645 /* Combine the instantaneous rate (period / interval) with the previous rate
2646 using the smoothing factor a. In order to measure sized events, multiply the
2647 instantaneous rate by the count of bytes or recipients etc. */
2648
2649 dbd->time_stamp = tv.tv_sec;
2650 dbd->time_usec = tv.tv_usec;
2651 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2652
2653 /* When events are very widely spaced the computed rate tends towards zero.
2654 Although this is accurate it turns out not to be useful for our purposes,
2655 especially when the first event after a long silence is the start of a spam
2656 run. A more useful model is that the rate for an isolated event should be the
2657 size of the event per the period size, ignoring the lack of events outside
2658 the current period and regardless of where the event falls in the period. So,
2659 if the interval was so long that the calculated rate is unhelpfully small, we
2660 re-initialize the rate. In the absence of higher-rate bursts, the condition
2661 below is true if the interval is greater than the period. */
2662
2663 if (dbd->rate < count) dbd->rate = count;
2664 }
2665
2666 /* Clients sending at the limit are considered to be over the limit.
2667 This matters for edge cases such as a limit of zero, when the client
2668 should be completely blocked. */
2669
2670 rc = dbd->rate < limit ? FAIL : OK;
2671
2672 /* Update the state if the rate is low or if we are being strict. If we
2673 are in leaky mode and the sender's rate is too high, we do not update
2674 the recorded rate in order to avoid an over-aggressive sender's retry
2675 rate preventing them from getting any email through. If readonly is set,
2676 neither leaky nor strict are set, so we do not do any updates. */
2677
2678 if ((rc == FAIL && leaky) || strict)
2679 {
2680 dbfn_write(dbm, key, dbdb, dbdb_size);
2681 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2682 }
2683 else
2684 {
2685 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2686 readonly? "readonly mode" : "over the limit, but leaky");
2687 }
2688
2689 dbfn_close(dbm);
2690
2691 /* Store the result in the tree for future reference. Take the taint status
2692 from the key for consistency even though it's unlikely we'll ever expand this. */
2693
2694 t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
2695 t->data.ptr = dbd;
2696 Ustrcpy(t->name, key);
2697 (void)tree_insertnode(anchor, t);
2698
2699 /* We create the formatted version of the sender's rate very late in
2700 order to ensure that it is done using the correct storage pool. */
2701
2702 store_pool = old_pool;
2703 sender_rate = string_sprintf("%.1f", dbd->rate);
2704
2705 HDEBUG(D_acl)
2706 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2707
2708 return rc;
2709 }
2710
2711
2712
2713 /*************************************************
2714 * The udpsend ACL modifier *
2715 *************************************************/
2716
2717 /* Called by acl_check_condition() below.
2718
2719 Arguments:
2720 arg the option string for udpsend=
2721 log_msgptr for error messages
2722
2723 Returns: OK - Completed.
2724 DEFER - Problem with DNS lookup.
2725 ERROR - Syntax error in options.
2726 */
2727
2728 static int
2729 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2730 {
2731 int sep = 0;
2732 uschar *hostname;
2733 uschar *portstr;
2734 uschar *portend;
2735 host_item *h;
2736 int portnum;
2737 int len;
2738 int r, s;
2739 uschar * errstr;
2740
2741 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2742 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2743
2744 if (!hostname)
2745 {
2746 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2747 return ERROR;
2748 }
2749 if (!portstr)
2750 {
2751 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2752 return ERROR;
2753 }
2754 if (!arg)
2755 {
2756 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2757 return ERROR;
2758 }
2759 portnum = Ustrtol(portstr, &portend, 10);
2760 if (*portend != '\0')
2761 {
2762 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2763 return ERROR;
2764 }
2765
2766 /* Make a single-item host list. */
2767 h = store_get(sizeof(host_item), FALSE);
2768 memset(h, 0, sizeof(host_item));
2769 h->name = hostname;
2770 h->port = portnum;
2771 h->mx = MX_NONE;
2772
2773 if (string_is_ip_address(hostname, NULL))
2774 h->address = hostname, r = HOST_FOUND;
2775 else
2776 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2777 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2778 {
2779 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2780 return DEFER;
2781 }
2782
2783 HDEBUG(D_acl)
2784 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2785
2786 /*XXX this could better use sendto */
2787 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2788 1, NULL, &errstr, NULL);
2789 if (r < 0) goto defer;
2790 len = Ustrlen(arg);
2791 r = send(s, arg, len, 0);
2792 if (r < 0)
2793 {
2794 errstr = US strerror(errno);
2795 close(s);
2796 goto defer;
2797 }
2798 close(s);
2799 if (r < len)
2800 {
2801 *log_msgptr =
2802 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2803 return DEFER;
2804 }
2805
2806 HDEBUG(D_acl)
2807 debug_printf_indent("udpsend %d bytes\n", r);
2808
2809 return OK;
2810
2811 defer:
2812 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2813 return DEFER;
2814 }
2815
2816
2817
2818 /*************************************************
2819 * Handle conditions/modifiers on an ACL item *
2820 *************************************************/
2821
2822 /* Called from acl_check() below.
2823
2824 Arguments:
2825 verb ACL verb
2826 cb ACL condition block - if NULL, result is OK
2827 where where called from
2828 addr the address being checked for RCPT, or NULL
2829 level the nesting level
2830 epp pointer to pass back TRUE if "endpass" encountered
2831 (applies only to "accept" and "discard")
2832 user_msgptr user message pointer
2833 log_msgptr log message pointer
2834 basic_errno pointer to where to put verify error
2835
2836 Returns: OK - all conditions are met
2837 DISCARD - an "acl" condition returned DISCARD - only allowed
2838 for "accept" or "discard" verbs
2839 FAIL - at least one condition fails
2840 FAIL_DROP - an "acl" condition returned FAIL_DROP
2841 DEFER - can't tell at the moment (typically, lookup defer,
2842 but can be temporary callout problem)
2843 ERROR - ERROR from nested ACL or expansion failure or other
2844 error
2845 */
2846
2847 static int
2848 acl_check_condition(int verb, acl_condition_block *cb, int where,
2849 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2850 uschar **log_msgptr, int *basic_errno)
2851 {
2852 uschar *user_message = NULL;
2853 uschar *log_message = NULL;
2854 int rc = OK;
2855 #ifdef WITH_CONTENT_SCAN
2856 int sep = -'/';
2857 #endif
2858
2859 for (; cb; cb = cb->next)
2860 {
2861 const uschar *arg;
2862 int control_type;
2863
2864 /* The message and log_message items set up messages to be used in
2865 case of rejection. They are expanded later. */
2866
2867 if (cb->type == ACLC_MESSAGE)
2868 {
2869 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2870 user_message = cb->arg;
2871 continue;
2872 }
2873
2874 if (cb->type == ACLC_LOG_MESSAGE)
2875 {
2876 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2877 log_message = cb->arg;
2878 continue;
2879 }
2880
2881 /* The endpass "condition" just sets a flag to show it occurred. This is
2882 checked at compile time to be on an "accept" or "discard" item. */
2883
2884 if (cb->type == ACLC_ENDPASS)
2885 {
2886 *epp = TRUE;
2887 continue;
2888 }
2889
2890 /* For other conditions and modifiers, the argument is expanded now for some
2891 of them, but not for all, because expansion happens down in some lower level
2892 checking functions in some cases. */
2893
2894 if (!conditions[cb->type].expand_at_top)
2895 arg = cb->arg;
2896 else if (!(arg = expand_string(cb->arg)))
2897 {
2898 if (f.expand_string_forcedfail) continue;
2899 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2900 cb->arg, expand_string_message);
2901 return f.search_find_defer ? DEFER : ERROR;
2902 }
2903
2904 /* Show condition, and expanded condition if it's different */
2905
2906 HDEBUG(D_acl)
2907 {
2908 int lhswidth = 0;
2909 debug_printf_indent("check %s%s %n",
2910 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2911 conditions[cb->type].name, &lhswidth);
2912
2913 if (cb->type == ACLC_SET)
2914 {
2915 #ifndef DISABLE_DKIM
2916 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2917 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2918 {
2919 debug_printf("%s ", cb->u.varname);
2920 lhswidth += 19;
2921 }
2922 else
2923 #endif
2924 {
2925 debug_printf("acl_%s ", cb->u.varname);
2926 lhswidth += 5 + Ustrlen(cb->u.varname);
2927 }
2928 }
2929
2930 debug_printf("= %s\n", cb->arg);
2931
2932 if (arg != cb->arg)
2933 debug_printf("%.*s= %s\n", lhswidth,
2934 US" ", CS arg);
2935 }
2936
2937 /* Check that this condition makes sense at this time */
2938
2939 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2940 {
2941 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2942 conditions[cb->type].is_modifier ? "use" : "test",
2943 conditions[cb->type].name, acl_wherenames[where]);
2944 return ERROR;
2945 }
2946
2947 /* Run the appropriate test for each condition, or take the appropriate
2948 action for the remaining modifiers. */
2949
2950 switch(cb->type)
2951 {
2952 case ACLC_ADD_HEADER:
2953 setup_header(arg);
2954 break;
2955
2956 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2957 "discard" verb. */
2958
2959 case ACLC_ACL:
2960 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2961 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2962 {
2963 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2964 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2965 verbs[verb]);
2966 return ERROR;
2967 }
2968 break;
2969
2970 case ACLC_AUTHENTICATED:
2971 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2972 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2973 break;
2974
2975 #ifdef EXPERIMENTAL_BRIGHTMAIL
2976 case ACLC_BMI_OPTIN:
2977 {
2978 int old_pool = store_pool;
2979 store_pool = POOL_PERM;
2980 bmi_current_optin = string_copy(arg);
2981 store_pool = old_pool;
2982 }
2983 break;
2984 #endif
2985
2986 case ACLC_CONDITION:
2987 /* The true/false parsing here should be kept in sync with that used in
2988 expand.c when dealing with ECOND_BOOL so that we don't have too many
2989 different definitions of what can be a boolean. */
2990 if (*arg == '-'
2991 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2992 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2993 rc = (Uatoi(arg) == 0)? FAIL : OK;
2994 else
2995 rc = (strcmpic(arg, US"no") == 0 ||
2996 strcmpic(arg, US"false") == 0)? FAIL :
2997 (strcmpic(arg, US"yes") == 0 ||
2998 strcmpic(arg, US"true") == 0)? OK : DEFER;
2999 if (rc == DEFER)
3000 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3001 break;
3002
3003 case ACLC_CONTINUE: /* Always succeeds */
3004 break;
3005
3006 case ACLC_CONTROL:
3007 {
3008 const uschar *p = NULL;
3009 control_type = decode_control(arg, &p, where, log_msgptr);
3010
3011 /* Check if this control makes sense at this time */
3012
3013 if (controls_list[control_type].forbids & (1 << where))
3014 {
3015 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3016 controls_list[control_type].name, acl_wherenames[where]);
3017 return ERROR;
3018 }
3019
3020 switch(control_type)
3021 {
3022 case CONTROL_AUTH_UNADVERTISED:
3023 f.allow_auth_unadvertised = TRUE;
3024 break;
3025
3026 #ifdef EXPERIMENTAL_BRIGHTMAIL
3027 case CONTROL_BMI_RUN:
3028 bmi_run = 1;
3029 break;
3030 #endif
3031
3032 #ifndef DISABLE_DKIM
3033 case CONTROL_DKIM_VERIFY:
3034 f.dkim_disable_verify = TRUE;
3035 # ifdef SUPPORT_DMARC
3036 /* Since DKIM was blocked, skip DMARC too */
3037 f.dmarc_disable_verify = TRUE;
3038 f.dmarc_enable_forensic = FALSE;
3039 # endif
3040 break;
3041 #endif
3042
3043 #ifdef SUPPORT_DMARC
3044 case CONTROL_DMARC_VERIFY:
3045 f.dmarc_disable_verify = TRUE;
3046 break;
3047
3048 case CONTROL_DMARC_FORENSIC:
3049 f.dmarc_enable_forensic = TRUE;
3050 break;
3051 #endif
3052
3053 case CONTROL_DSCP:
3054 if (*p == '/')
3055 {
3056 int fd, af, level, optname, value;
3057 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3058 a socket; we can accept that, we'll just debug-log failures anyway. */
3059 fd = fileno(smtp_in);
3060 if ((af = ip_get_address_family(fd)) < 0)
3061 {
3062 HDEBUG(D_acl)
3063 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3064 strerror(errno));
3065 break;
3066 }
3067 if (dscp_lookup(p+1, af, &level, &optname, &value))
3068 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3069 {
3070 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3071 p+1, strerror(errno));
3072 }
3073 else
3074 {
3075 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3076 }
3077 else
3078 {
3079 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3080 return ERROR;
3081 }
3082 }
3083 else
3084 {
3085 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3086 return ERROR;
3087 }
3088 break;
3089
3090 case CONTROL_ERROR:
3091 return ERROR;
3092
3093 case CONTROL_CASEFUL_LOCAL_PART:
3094 deliver_localpart = addr->cc_local_part;
3095 break;
3096
3097 case CONTROL_CASELOWER_LOCAL_PART:
3098 deliver_localpart = addr->lc_local_part;
3099 break;
3100
3101 case CONTROL_ENFORCE_SYNC:
3102 smtp_enforce_sync = TRUE;
3103 break;
3104
3105 case CONTROL_NO_ENFORCE_SYNC:
3106 smtp_enforce_sync = FALSE;
3107 break;
3108
3109 #ifdef WITH_CONTENT_SCAN
3110 case CONTROL_NO_MBOX_UNSPOOL:
3111 f.no_mbox_unspool = TRUE;
3112 break;
3113 #endif
3114
3115 case CONTROL_NO_MULTILINE:
3116 f.no_multiline_responses = TRUE;
3117 break;
3118
3119 case CONTROL_NO_PIPELINING:
3120 f.pipelining_enable = FALSE;
3121 break;
3122
3123 case CONTROL_NO_DELAY_FLUSH:
3124 f.disable_delay_flush = TRUE;
3125 break;
3126
3127 case CONTROL_NO_CALLOUT_FLUSH:
3128 f.disable_callout_flush = TRUE;
3129 break;
3130
3131 case CONTROL_FAKEREJECT:
3132 cancel_cutthrough_connection(TRUE, US"fakereject");
3133 case CONTROL_FAKEDEFER:
3134 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3135 if (*p == '/')
3136 {
3137 const uschar *pp = p + 1;
3138 while (*pp) pp++;
3139 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3140 p = pp;
3141 }
3142 else /* Explicitly reset to default string */
3143 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3144 break;
3145
3146 case CONTROL_FREEZE:
3147 f.deliver_freeze = TRUE;
3148 deliver_frozen_at = time(NULL);
3149 freeze_tell = freeze_tell_config; /* Reset to configured value */
3150 if (Ustrncmp(p, "/no_tell", 8) == 0)
3151 {
3152 p += 8;
3153 freeze_tell = NULL;
3154 }
3155 if (*p)
3156 {
3157 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3158 return ERROR;
3159 }
3160 cancel_cutthrough_connection(TRUE, US"item frozen");
3161 break;
3162
3163 case CONTROL_QUEUE:
3164 f.queue_only_policy = TRUE;
3165 if (Ustrcmp(p, "_only") == 0)
3166 p += 5;
3167 else while (*p == '/')
3168 if (Ustrncmp(p, "/only", 5) == 0)
3169 { p += 5; f.queue_smtp = FALSE; }
3170 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3171 { p += 17; f.queue_smtp = TRUE; }
3172 else
3173 break;
3174 cancel_cutthrough_connection(TRUE, US"queueing forced");
3175 break;
3176
3177 case CONTROL_SUBMISSION:
3178 originator_name = US"";
3179 f.submission_mode = TRUE;
3180 while (*p == '/')
3181 {
3182 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3183 {
3184 p += 14;
3185 f.active_local_sender_retain = TRUE;
3186 f.active_local_from_check = FALSE;
3187 }
3188 else if (Ustrncmp(p, "/domain=", 8) == 0)
3189 {
3190 const uschar *pp = p + 8;
3191 while (*pp && *pp != '/') pp++;
3192 submission_domain = string_copyn(p+8, pp-p-8);
3193 p = pp;
3194 }
3195 /* The name= option must be last, because it swallows the rest of
3196 the string. */
3197 else if (Ustrncmp(p, "/name=", 6) == 0)
3198 {
3199 const uschar *pp = p + 6;
3200 while (*pp) pp++;
3201 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3202 big_buffer, big_buffer_size));
3203 p = pp;
3204 }
3205 else break;
3206 }
3207 if (*p)
3208 {
3209 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3210 return ERROR;
3211 }
3212 break;
3213
3214 case CONTROL_DEBUG:
3215 {
3216 uschar * debug_tag = NULL;
3217 uschar * debug_opts = NULL;
3218 BOOL kill = FALSE;
3219
3220 while (*p == '/')
3221 {
3222 const uschar * pp = p+1;
3223 if (Ustrncmp(pp, "tag=", 4) == 0)
3224 {
3225 for (pp += 4; *pp && *pp != '/';) pp++;
3226 debug_tag = string_copyn(p+5, pp-p-5);
3227 }
3228 else if (Ustrncmp(pp, "opts=", 5) == 0)
3229 {
3230 for (pp += 5; *pp && *pp != '/';) pp++;
3231 debug_opts = string_copyn(p+6, pp-p-6);
3232 }
3233 else if (Ustrncmp(pp, "kill", 4) == 0)
3234 {
3235 for (pp += 4; *pp && *pp != '/';) pp++;
3236 kill = TRUE;
3237 }
3238 else
3239 while (*pp && *pp != '/') pp++;
3240 p = pp;
3241 }
3242
3243 if (kill)
3244 debug_logging_stop();
3245 else
3246 debug_logging_activate(debug_tag, debug_opts);
3247 break;
3248 }
3249
3250 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3251 f.suppress_local_fixups = TRUE;
3252 break;
3253
3254 case CONTROL_CUTTHROUGH_DELIVERY:
3255 {
3256 uschar * ignored = NULL;
3257 #ifndef DISABLE_PRDR
3258 if (prdr_requested)
3259 #else
3260 if (0)
3261 #endif
3262 /* Too hard to think about for now. We might in future cutthrough
3263 the case where both sides handle prdr and this-node prdr acl
3264 is "accept" */
3265 ignored = US"PRDR active";
3266 else
3267 {
3268 if (f.deliver_freeze)
3269 ignored = US"frozen";
3270 else if (f.queue_only_policy)
3271 ignored = US"queue-only";
3272 else if (fake_response == FAIL)
3273 ignored = US"fakereject";
3274 else
3275 {
3276 if (rcpt_count == 1)
3277 {
3278 cutthrough.delivery = TRUE; /* control accepted */
3279 while (*p == '/')
3280 {
3281 const uschar * pp = p+1;
3282 if (Ustrncmp(pp, "defer=", 6) == 0)
3283 {
3284 pp += 6;
3285 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3286 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3287 }
3288 else
3289 while (*pp && *pp != '/') pp++;
3290 p = pp;
3291 }
3292 }
3293 else
3294 ignored = US"nonfirst rcpt";
3295 }
3296 }
3297 DEBUG(D_acl) if (ignored)
3298 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3299 }
3300 break;
3301
3302 #ifdef SUPPORT_I18N
3303 case CONTROL_UTF8_DOWNCONVERT:
3304 if (*p == '/')
3305 {
3306 if (p[1] == '1')
3307 {
3308 message_utf8_downconvert = 1;
3309 addr->prop.utf8_downcvt = TRUE;
3310 addr->prop.utf8_downcvt_maybe = FALSE;
3311 p += 2;
3312 break;
3313 }
3314 if (p[1] == '0')
3315 {
3316 message_utf8_downconvert = 0;
3317 addr->prop.utf8_downcvt = FALSE;
3318 addr->prop.utf8_downcvt_maybe = FALSE;
3319 p += 2;
3320 break;
3321 }
3322 if (p[1] == '-' && p[2] == '1')
3323 {
3324 message_utf8_downconvert = -1;
3325 addr->prop.utf8_downcvt = FALSE;
3326 addr->prop.utf8_downcvt_maybe = TRUE;
3327 p += 3;
3328 break;
3329 }
3330 *log_msgptr = US"bad option value for control=utf8_downconvert";
3331 }
3332 else
3333 {
3334 message_utf8_downconvert = 1;
3335 addr->prop.utf8_downcvt = TRUE;
3336 addr->prop.utf8_downcvt_maybe = FALSE;
3337 break;
3338 }
3339 return ERROR;
3340 #endif
3341
3342 }
3343 break;
3344 }
3345
3346 #ifdef EXPERIMENTAL_DCC
3347 case ACLC_DCC:
3348 {
3349 /* Separate the regular expression and any optional parameters. */
3350 const uschar * list = arg;
3351 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3352 /* Run the dcc backend. */
3353 rc = dcc_process(&ss);
3354 /* Modify return code based upon the existence of options. */
3355 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3356 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3357 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3358 }
3359 break;
3360 #endif
3361
3362 #ifdef WITH_CONTENT_SCAN
3363 case ACLC_DECODE:
3364 rc = mime_decode(&arg);
3365 break;
3366 #endif
3367
3368 case ACLC_DELAY:
3369 {
3370 int delay = readconf_readtime(arg, 0, FALSE);
3371 if (delay < 0)
3372 {
3373 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3374 "modifier: \"%s\" is not a time value", arg);
3375 return ERROR;
3376 }
3377 else
3378 {
3379 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3380 delay);
3381 if (host_checking)
3382 {
3383 HDEBUG(D_acl)
3384 debug_printf_indent("delay skipped in -bh checking mode\n");
3385 }
3386
3387 /* NOTE 1: Remember that we may be
3388 dealing with stdin/stdout here, in addition to TCP/IP connections.
3389 Also, delays may be specified for non-SMTP input, where smtp_out and
3390 smtp_in will be NULL. Whatever is done must work in all cases.
3391
3392 NOTE 2: The added feature of flushing the output before a delay must
3393 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3394 */
3395
3396 else
3397 {
3398 if (smtp_out && !f.disable_delay_flush)
3399 mac_smtp_fflush();
3400
3401 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3402 {
3403 struct pollfd p;
3404 nfds_t n = 0;
3405 if (smtp_out)
3406 {
3407 p.fd = fileno(smtp_out);
3408 p.events = POLLRDHUP;
3409 n = 1;
3410 }
3411 if (poll(&p, n, delay*1000) > 0)
3412 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3413 }
3414 #else
3415 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3416 TCP/IP connection has gone away without reading from it. This means
3417 that we cannot shorten the delay below if the client goes away,
3418 because we cannot discover that the client has closed its end of the
3419 connection. (The connection is actually in a half-closed state,
3420 waiting for the server to close its end.) It would be nice to be able
3421 to detect this state, so that the Exim process is not held up
3422 unnecessarily. However, it seems that we can't. The poll() function
3423 does not do the right thing, and in any case it is not always
3424 available. */
3425
3426 while (delay > 0) delay = sleep(delay);
3427 #endif
3428 }
3429 }
3430 }
3431 break;
3432
3433 #ifndef DISABLE_DKIM
3434 case ACLC_DKIM_SIGNER:
3435 if (dkim_cur_signer)
3436 rc = match_isinlist(dkim_cur_signer,
3437 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3438 else
3439 rc = FAIL;
3440 break;
3441
3442 case ACLC_DKIM_STATUS:
3443 rc = match_isinlist(dkim_verify_status,
3444 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3445 break;
3446 #endif
3447
3448 #ifdef SUPPORT_DMARC
3449 case ACLC_DMARC_STATUS:
3450 if (!f.dmarc_has_been_checked)
3451 dmarc_process();
3452 f.dmarc_has_been_checked = TRUE;
3453 /* used long way of dmarc_exim_expand_query() in case we need more
3454 * view into the process in the future. */
3455 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3456 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3457 break;
3458 #endif
3459