640989997cfecf4f9197bdf3763221f3043208ab
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
41 [ACL_DEFER] = (1<<OK),
42 [ACL_DENY] = (1<<OK),
43 [ACL_DISCARD] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
44 [ACL_DROP] = (1<<OK),
45 [ACL_REQUIRE] = (1<<FAIL) | (1<<FAIL_DROP),
46 [ACL_WARN] = (1<<OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef EXPERIMENTAL_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
141 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
142 #ifndef DISABLE_PRDR
143 (1<<ACL_WHERE_PRDR)|
144 #endif
145 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
146 (1<<ACL_WHERE_DKIM)|
147 (1<<ACL_WHERE_NOTSMTP_START)),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 (1<<ACL_WHERE_NOTSMTP)|
152 (1<<ACL_WHERE_NOTSMTP_START)|
153 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
154 },
155 #ifdef EXPERIMENTAL_BRIGHTMAIL
156 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
157 (1<<ACL_WHERE_AUTH)|
158 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
159 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
160 # ifndef DISABLE_PRDR
161 (1<<ACL_WHERE_PRDR)|
162 # endif
163 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
164 (1<<ACL_WHERE_MAILAUTH)|
165 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
166 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
167 (1<<ACL_WHERE_NOTSMTP_START),
168 },
169 #endif
170 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
171 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
172
173 /* Certain types of control are always allowed, so we let it through
174 always and check in the control processing itself. */
175 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
176
177 #ifdef EXPERIMENTAL_DCC
178 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
179 (unsigned int)
180 ~((1<<ACL_WHERE_DATA)|
181 # ifndef DISABLE_PRDR
182 (1<<ACL_WHERE_PRDR)|
183 # endif
184 (1<<ACL_WHERE_NOTSMTP)),
185 },
186 #endif
187 #ifdef WITH_CONTENT_SCAN
188 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
189
190 #endif
191 [ACLC_DELAY] = { US"delay", TRUE, TRUE, (1<<ACL_WHERE_NOTQUIT) },
192 #ifndef DISABLE_DKIM
193 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
194 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
195 #endif
196 #ifdef EXPERIMENTAL_DMARC
197 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DATA) },
198 #endif
199
200 /* Explicit key lookups can be made in non-smtp ACLs so pass
201 always and check in the verify processing itself. */
202 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
203
204 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 (unsigned int)
206 ~((1<<ACL_WHERE_RCPT)
207 |(1<<ACL_WHERE_VRFY)
208 #ifndef DISABLE_PRDR
209 |(1<<ACL_WHERE_PRDR)
210 #endif
211 ),
212 },
213 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
214 (1<<ACL_WHERE_NOTSMTP)|
215 (1<<ACL_WHERE_CONNECT)|
216 (1<<ACL_WHERE_NOTSMTP_START)|
217 (1<<ACL_WHERE_HELO),
218 },
219
220 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
221
222 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
223 (1<<ACL_WHERE_NOTSMTP)|
224 (1<<ACL_WHERE_NOTSMTP_START),
225 },
226 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
227 (unsigned int)
228 ~((1<<ACL_WHERE_RCPT)
229 |(1<<ACL_WHERE_VRFY)
230 #ifndef DISABLE_PRDR
231 |(1<<ACL_WHERE_PRDR)
232 #endif
233 ),
234 },
235
236 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
237 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
238 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
239
240 #ifdef WITH_CONTENT_SCAN
241 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
242 (unsigned int)
243 ~((1<<ACL_WHERE_DATA)|
244 # ifndef DISABLE_PRDR
245 (1<<ACL_WHERE_PRDR)|
246 # endif
247 (1<<ACL_WHERE_NOTSMTP)),
248 },
249 #endif
250
251 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
252 #ifdef WITH_CONTENT_SCAN
253 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
254 #endif
255
256 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
257 (1<<ACL_WHERE_NOTSMTP)|
258 #ifndef DISABLE_PRDR
259 (1<<ACL_WHERE_PRDR)|
260 #endif
261 (1<<ACL_WHERE_DATA),
262 },
263
264 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
265 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~(1<<ACL_WHERE_RCPT) },
266
267 #ifdef WITH_CONTENT_SCAN
268 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
269 (unsigned int)
270 ~((1<<ACL_WHERE_DATA)|
271 # ifndef DISABLE_PRDR
272 (1<<ACL_WHERE_PRDR)|
273 # endif
274 (1<<ACL_WHERE_NOTSMTP)|
275 (1<<ACL_WHERE_MIME)),
276 },
277
278 #endif
279 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
280 (unsigned int)
281 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
282 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
283 #ifndef DISABLE_PRDR
284 (1<<ACL_WHERE_PRDR)|
285 #endif
286 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
287 (1<<ACL_WHERE_NOTSMTP_START)),
288 },
289 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
290 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
291 (1<<ACL_WHERE_HELO)|
292 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
293 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
294 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
295 },
296 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
297 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
298 (1<<ACL_WHERE_HELO)|
299 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
300 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
301 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
302 },
303
304 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
305
306 #ifdef WITH_CONTENT_SCAN
307 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
308 (unsigned int) ~((1<<ACL_WHERE_DATA)|
309 # ifndef DISABLE_PRDR
310 (1<<ACL_WHERE_PRDR)|
311 # endif
312 (1<<ACL_WHERE_NOTSMTP)),
313 },
314 #endif
315 #ifdef EXPERIMENTAL_SPF
316 [ACLC_SPF] = { US"spf", TRUE, FALSE,
317 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
318 (1<<ACL_WHERE_HELO)|
319 (1<<ACL_WHERE_MAILAUTH)|
320 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
321 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
322 (1<<ACL_WHERE_NOTSMTP)|
323 (1<<ACL_WHERE_NOTSMTP_START),
324 },
325 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
326 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
327 (1<<ACL_WHERE_HELO)|
328 (1<<ACL_WHERE_MAILAUTH)|
329 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
330 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
331 (1<<ACL_WHERE_NOTSMTP)|
332 (1<<ACL_WHERE_NOTSMTP_START),
333 },
334 #endif
335 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
336
337 /* Certain types of verify are always allowed, so we let it through
338 always and check in the verify function itself */
339 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
340 };
341
342
343
344 /* Return values from decode_control(); used as index so keep in step
345 with the controls_list table that follows! */
346
347 enum {
348 CONTROL_AUTH_UNADVERTISED,
349 #ifdef EXPERIMENTAL_BRIGHTMAIL
350 CONTROL_BMI_RUN,
351 #endif
352 CONTROL_CASEFUL_LOCAL_PART,
353 CONTROL_CASELOWER_LOCAL_PART,
354 CONTROL_CUTTHROUGH_DELIVERY,
355 CONTROL_DEBUG,
356 #ifndef DISABLE_DKIM
357 CONTROL_DKIM_VERIFY,
358 #endif
359 #ifdef EXPERIMENTAL_DMARC
360 CONTROL_DMARC_VERIFY,
361 CONTROL_DMARC_FORENSIC,
362 #endif
363 CONTROL_DSCP,
364 CONTROL_ENFORCE_SYNC,
365 CONTROL_ERROR, /* pseudo-value for decode errors */
366 CONTROL_FAKEDEFER,
367 CONTROL_FAKEREJECT,
368 CONTROL_FREEZE,
369
370 CONTROL_NO_CALLOUT_FLUSH,
371 CONTROL_NO_DELAY_FLUSH,
372 CONTROL_NO_ENFORCE_SYNC,
373 #ifdef WITH_CONTENT_SCAN
374 CONTROL_NO_MBOX_UNSPOOL,
375 #endif
376 CONTROL_NO_MULTILINE,
377 CONTROL_NO_PIPELINING,
378
379 CONTROL_QUEUE_ONLY,
380 CONTROL_SUBMISSION,
381 CONTROL_SUPPRESS_LOCAL_FIXUPS,
382 #ifdef SUPPORT_I18N
383 CONTROL_UTF8_DOWNCONVERT,
384 #endif
385 };
386
387
388
389 /* Structure listing various control arguments, with their characteristics.
390 For each control, there's a bitmap of dis-allowed times. For some, it is easier
391 to specify the negation of a small number of allowed times. */
392
393 typedef struct control_def {
394 uschar *name;
395 BOOL has_option; /* Has /option(s) following */
396 unsigned forbids; /* bitmap of dis-allowed times */
397 } control_def;
398
399 static control_def controls_list[] = {
400 /* name has_option forbids */
401 [CONTROL_AUTH_UNADVERTISED] =
402 { US"allow_auth_unadvertised", FALSE,
403 (unsigned)
404 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
405 },
406 #ifdef EXPERIMENTAL_BRIGHTMAIL
407 [CONTROL_BMI_RUN] =
408 { US"bmi_run", FALSE, 0 },
409 #endif
410 [CONTROL_CASEFUL_LOCAL_PART] =
411 { US"caseful_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
412 [CONTROL_CASELOWER_LOCAL_PART] =
413 { US"caselower_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
414 [CONTROL_CUTTHROUGH_DELIVERY] =
415 { US"cutthrough_delivery", TRUE, 0 },
416 [CONTROL_DEBUG] =
417 { US"debug", TRUE, 0 },
418
419 #ifndef DISABLE_DKIM
420 [CONTROL_DKIM_VERIFY] =
421 { US"dkim_disable_verify", FALSE,
422 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
423 # ifndef DISABLE_PRDR
424 (1<<ACL_WHERE_PRDR)|
425 # endif
426 (1<<ACL_WHERE_NOTSMTP_START)
427 },
428 #endif
429
430 #ifdef EXPERIMENTAL_DMARC
431 [CONTROL_DMARC_VERIFY] =
432 { US"dmarc_disable_verify", FALSE,
433 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
434 },
435 [CONTROL_DMARC_FORENSIC] =
436 { US"dmarc_enable_forensic", FALSE,
437 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
438 },
439 #endif
440
441 [CONTROL_DSCP] =
442 { US"dscp", TRUE,
443 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
444 },
445 [CONTROL_ENFORCE_SYNC] =
446 { US"enforce_sync", FALSE,
447 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
448 },
449
450 /* Pseudo-value for decode errors */
451 [CONTROL_ERROR] =
452 { US"error", FALSE, 0 },
453
454 [CONTROL_FAKEDEFER] =
455 { US"fakedefer", TRUE,
456 (unsigned)
457 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
458 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
459 #ifndef DISABLE_PRDR
460 (1<<ACL_WHERE_PRDR)|
461 #endif
462 (1<<ACL_WHERE_MIME))
463 },
464 [CONTROL_FAKEREJECT] =
465 { US"fakereject", TRUE,
466 (unsigned)
467 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
468 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
469 #ifndef DISABLE_PRDR
470 (1<<ACL_WHERE_PRDR)|
471 #endif
472 (1<<ACL_WHERE_MIME))
473 },
474 [CONTROL_FREEZE] =
475 { US"freeze", TRUE,
476 (unsigned)
477 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
478 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
479 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
480 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
481 },
482
483 [CONTROL_NO_CALLOUT_FLUSH] =
484 { US"no_callout_flush", FALSE,
485 (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
486 },
487 [CONTROL_NO_DELAY_FLUSH] =
488 { US"no_delay_flush", FALSE,
489 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
490 },
491
492 [CONTROL_NO_ENFORCE_SYNC] =
493 { US"no_enforce_sync", FALSE,
494 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
495 },
496 #ifdef WITH_CONTENT_SCAN
497 [CONTROL_NO_MBOX_UNSPOOL] =
498 { US"no_mbox_unspool", FALSE,
499 (unsigned)
500 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
501 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
502 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
503 (1<<ACL_WHERE_MIME))
504 },
505 #endif
506 [CONTROL_NO_MULTILINE] =
507 { US"no_multiline_responses", FALSE,
508 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
509 },
510 [CONTROL_NO_PIPELINING] =
511 { US"no_pipelining", FALSE,
512 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
513 },
514
515 [CONTROL_QUEUE_ONLY] =
516 { US"queue_only", FALSE,
517 (unsigned)
518 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
519 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
520 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
521 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
522 },
523 [CONTROL_SUBMISSION] =
524 { US"submission", TRUE,
525 (unsigned)
526 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
527 },
528 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
529 { US"suppress_local_fixups", FALSE,
530 (unsigned)
531 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
532 (1<<ACL_WHERE_NOTSMTP_START))
533 },
534 #ifdef SUPPORT_I18N
535 [CONTROL_UTF8_DOWNCONVERT] =
536 { US"utf8_downconvert", TRUE, 0 }
537 #endif
538 };
539
540 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
541 caches its result in a tree to avoid repeated DNS queries. The result is an
542 integer code which is used as an index into the following tables of
543 explanatory strings and verification return codes. */
544
545 static tree_node *csa_cache = NULL;
546
547 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
548 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
549
550 /* The acl_verify_csa() return code is translated into an acl_verify() return
551 code using the following table. It is OK unless the client is definitely not
552 authorized. This is because CSA is supposed to be optional for sending sites,
553 so recipients should not be too strict about checking it - especially because
554 DNS problems are quite likely to occur. It's possible to use $csa_status in
555 further ACL conditions to distinguish ok, unknown, and defer if required, but
556 the aim is to make the usual configuration simple. */
557
558 static int csa_return_code[] = {
559 [CSA_UNKNOWN] = OK,
560 [CSA_OK] = OK,
561 [CSA_DEFER_SRV] = OK,
562 [CSA_DEFER_ADDR] = OK,
563 [CSA_FAIL_EXPLICIT] = FAIL,
564 [CSA_FAIL_DOMAIN] = FAIL,
565 [CSA_FAIL_NOADDR] = FAIL,
566 [CSA_FAIL_MISMATCH] = FAIL
567 };
568
569 static uschar *csa_status_string[] = {
570 [CSA_UNKNOWN] = US"unknown",
571 [CSA_OK] = US"ok",
572 [CSA_DEFER_SRV] = US"defer",
573 [CSA_DEFER_ADDR] = US"defer",
574 [CSA_FAIL_EXPLICIT] = US"fail",
575 [CSA_FAIL_DOMAIN] = US"fail",
576 [CSA_FAIL_NOADDR] = US"fail",
577 [CSA_FAIL_MISMATCH] = US"fail"
578 };
579
580 static uschar *csa_reason_string[] = {
581 [CSA_UNKNOWN] = US"unknown",
582 [CSA_OK] = US"ok",
583 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
584 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
585 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
586 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
587 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
588 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
589 };
590
591 /* Options for the ratelimit condition. Note that there are two variants of
592 the per_rcpt option, depending on the ACL that is used to measure the rate.
593 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
594 so the two variants must have the same internal representation as well as
595 the same configuration string. */
596
597 enum {
598 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
599 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
600 };
601
602 #define RATE_SET(var,new) \
603 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
604
605 static uschar *ratelimit_option_string[] = {
606 [RATE_PER_WHAT] = US"?",
607 [RATE_PER_CLASH] = US"!",
608 [RATE_PER_ADDR] = US"per_addr",
609 [RATE_PER_BYTE] = US"per_byte",
610 [RATE_PER_CMD] = US"per_cmd",
611 [RATE_PER_CONN] = US"per_conn",
612 [RATE_PER_MAIL] = US"per_mail",
613 [RATE_PER_RCPT] = US"per_rcpt",
614 [RATE_PER_ALLRCPTS] = US"per_rcpt"
615 };
616
617 /* Enable recursion between acl_check_internal() and acl_check_condition() */
618
619 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
620 uschar **);
621
622
623 /*************************************************
624 * Find control in list *
625 *************************************************/
626
627 /* The lists are always in order, so binary chop can be used.
628
629 Arguments:
630 name the control name to search for
631 ol the first entry in the control list
632 last one more than the offset of the last entry in the control list
633
634 Returns: index of a control entry, or -1 if not found
635 */
636
637 static int
638 find_control(const uschar * name, control_def * ol, int last)
639 {
640 int first = 0;
641 while (last > first)
642 {
643 int middle = (first + last)/2;
644 uschar * s = ol[middle].name;
645 int c = Ustrncmp(name, s, Ustrlen(s));
646 if (c == 0) return middle;
647 else if (c > 0) first = middle + 1;
648 else last = middle;
649 }
650 return -1;
651 }
652
653
654
655 /*************************************************
656 * Pick out condition from list *
657 *************************************************/
658
659 /* Use a binary chop method
660
661 Arguments:
662 name name to find
663 list list of conditions
664 end size of list
665
666 Returns: offset in list, or -1 if not found
667 */
668
669 static int
670 acl_checkcondition(uschar * name, condition_def * list, int end)
671 {
672 int start = 0;
673 while (start < end)
674 {
675 int mid = (start + end)/2;
676 int c = Ustrcmp(name, list[mid].name);
677 if (c == 0) return mid;
678 if (c < 0) end = mid;
679 else start = mid + 1;
680 }
681 return -1;
682 }
683
684
685 /*************************************************
686 * Pick out name from list *
687 *************************************************/
688
689 /* Use a binary chop method
690
691 Arguments:
692 name name to find
693 list list of names
694 end size of list
695
696 Returns: offset in list, or -1 if not found
697 */
698
699 static int
700 acl_checkname(uschar *name, uschar **list, int end)
701 {
702 int start = 0;
703
704 while (start < end)
705 {
706 int mid = (start + end)/2;
707 int c = Ustrcmp(name, list[mid]);
708 if (c == 0) return mid;
709 if (c < 0) end = mid; else start = mid + 1;
710 }
711
712 return -1;
713 }
714
715
716 /*************************************************
717 * Read and parse one ACL *
718 *************************************************/
719
720 /* This function is called both from readconf in order to parse the ACLs in the
721 configuration file, and also when an ACL is encountered dynamically (e.g. as
722 the result of an expansion). It is given a function to call in order to
723 retrieve the lines of the ACL. This function handles skipping comments and
724 blank lines (where relevant).
725
726 Arguments:
727 func function to get next line of ACL
728 error where to put an error message
729
730 Returns: pointer to ACL, or NULL
731 NULL can be legal (empty ACL); in this case error will be NULL
732 */
733
734 acl_block *
735 acl_read(uschar *(*func)(void), uschar **error)
736 {
737 acl_block *yield = NULL;
738 acl_block **lastp = &yield;
739 acl_block *this = NULL;
740 acl_condition_block *cond;
741 acl_condition_block **condp = NULL;
742 uschar *s;
743
744 *error = NULL;
745
746 while ((s = (*func)()) != NULL)
747 {
748 int v, c;
749 BOOL negated = FALSE;
750 uschar *saveline = s;
751 uschar name[64];
752
753 /* Conditions (but not verbs) are allowed to be negated by an initial
754 exclamation mark. */
755
756 while (isspace(*s)) s++;
757 if (*s == '!')
758 {
759 negated = TRUE;
760 s++;
761 }
762
763 /* Read the name of a verb or a condition, or the start of a new ACL, which
764 can be started by a name, or by a macro definition. */
765
766 s = readconf_readname(name, sizeof(name), s);
767 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
768
769 /* If a verb is unrecognized, it may be another condition or modifier that
770 continues the previous verb. */
771
772 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
773 {
774 if (this == NULL)
775 {
776 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
777 saveline);
778 return NULL;
779 }
780 }
781
782 /* New verb */
783
784 else
785 {
786 if (negated)
787 {
788 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
789 return NULL;
790 }
791 this = store_get(sizeof(acl_block));
792 *lastp = this;
793 lastp = &(this->next);
794 this->next = NULL;
795 this->verb = v;
796 this->condition = NULL;
797 condp = &(this->condition);
798 if (*s == 0) continue; /* No condition on this line */
799 if (*s == '!')
800 {
801 negated = TRUE;
802 s++;
803 }
804 s = readconf_readname(name, sizeof(name), s); /* Condition name */
805 }
806
807 /* Handle a condition or modifier. */
808
809 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
810 {
811 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
812 saveline);
813 return NULL;
814 }
815
816 /* The modifiers may not be negated */
817
818 if (negated && conditions[c].is_modifier)
819 {
820 *error = string_sprintf("ACL error: negation is not allowed with "
821 "\"%s\"", conditions[c].name);
822 return NULL;
823 }
824
825 /* ENDPASS may occur only with ACCEPT or DISCARD. */
826
827 if (c == ACLC_ENDPASS &&
828 this->verb != ACL_ACCEPT &&
829 this->verb != ACL_DISCARD)
830 {
831 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
832 conditions[c].name, verbs[this->verb]);
833 return NULL;
834 }
835
836 cond = store_get(sizeof(acl_condition_block));
837 cond->next = NULL;
838 cond->type = c;
839 cond->u.negated = negated;
840
841 *condp = cond;
842 condp = &(cond->next);
843
844 /* The "set" modifier is different in that its argument is "name=value"
845 rather than just a value, and we can check the validity of the name, which
846 gives us a variable name to insert into the data block. The original ACL
847 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
848 extended to 20 of each type, but after that people successfully argued for
849 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
850 After that, we allow alphanumerics and underscores, but the first character
851 after c or m must be a digit or an underscore. This retains backwards
852 compatibility. */
853
854 if (c == ACLC_SET)
855 {
856 uschar *endptr;
857
858 if (Ustrncmp(s, "acl_c", 5) != 0 &&
859 Ustrncmp(s, "acl_m", 5) != 0)
860 {
861 *error = string_sprintf("invalid variable name after \"set\" in ACL "
862 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
863 return NULL;
864 }
865
866 endptr = s + 5;
867 if (!isdigit(*endptr) && *endptr != '_')
868 {
869 *error = string_sprintf("invalid variable name after \"set\" in ACL "
870 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
871 s);
872 return NULL;
873 }
874
875 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
876 {
877 if (!isalnum(*endptr) && *endptr != '_')
878 {
879 *error = string_sprintf("invalid character \"%c\" in variable name "
880 "in ACL modifier \"set %s\"", *endptr, s);
881 return NULL;
882 }
883 endptr++;
884 }
885
886 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
887 s = endptr;
888 while (isspace(*s)) s++;
889 }
890
891 /* For "set", we are now positioned for the data. For the others, only
892 "endpass" has no data */
893
894 if (c != ACLC_ENDPASS)
895 {
896 if (*s++ != '=')
897 {
898 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
899 conditions[c].is_modifier ? US"modifier" : US"condition");
900 return NULL;
901 }
902 while (isspace(*s)) s++;
903 cond->arg = string_copy(s);
904 }
905 }
906
907 return yield;
908 }
909
910
911
912 /*************************************************
913 * Set up added header line(s) *
914 *************************************************/
915
916 /* This function is called by the add_header modifier, and also from acl_warn()
917 to implement the now-deprecated way of adding header lines using "message" on a
918 "warn" verb. The argument is treated as a sequence of header lines which are
919 added to a chain, provided there isn't an identical one already there.
920
921 Argument: string of header lines
922 Returns: nothing
923 */
924
925 static void
926 setup_header(const uschar *hstring)
927 {
928 const uschar *p, *q;
929 int hlen = Ustrlen(hstring);
930
931 /* Ignore any leading newlines */
932 while (*hstring == '\n') hstring++, hlen--;
933
934 /* An empty string does nothing; ensure exactly one final newline. */
935 if (hlen <= 0) return;
936 if (hstring[--hlen] != '\n') /* no newline */
937 q = string_sprintf("%s\n", hstring);
938 else if (hstring[hlen-1] == '\n') /* double newline */
939 {
940 uschar * s = string_copy(hstring);
941 while(s[--hlen] == '\n')
942 s[hlen+1] = '\0';
943 q = s;
944 }
945 else
946 q = hstring;
947
948 /* Loop for multiple header lines, taking care about continuations */
949
950 for (p = q; *p != 0; )
951 {
952 const uschar *s;
953 uschar * hdr;
954 int newtype = htype_add_bot;
955 header_line **hptr = &acl_added_headers;
956
957 /* Find next header line within the string */
958
959 for (;;)
960 {
961 q = Ustrchr(q, '\n'); /* we know there was a newline */
962 if (*(++q) != ' ' && *q != '\t') break;
963 }
964
965 /* If the line starts with a colon, interpret the instruction for where to
966 add it. This temporarily sets up a new type. */
967
968 if (*p == ':')
969 {
970 if (strncmpic(p, US":after_received:", 16) == 0)
971 {
972 newtype = htype_add_rec;
973 p += 16;
974 }
975 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
976 {
977 newtype = htype_add_rfc;
978 p += 14;
979 }
980 else if (strncmpic(p, US":at_start:", 10) == 0)
981 {
982 newtype = htype_add_top;
983 p += 10;
984 }
985 else if (strncmpic(p, US":at_end:", 8) == 0)
986 {
987 newtype = htype_add_bot;
988 p += 8;
989 }
990 while (*p == ' ' || *p == '\t') p++;
991 }
992
993 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
994 to the front of it. */
995
996 for (s = p; s < q - 1; s++)
997 {
998 if (*s == ':' || !isgraph(*s)) break;
999 }
1000
1001 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1002 hlen = Ustrlen(hdr);
1003
1004 /* See if this line has already been added */
1005
1006 while (*hptr != NULL)
1007 {
1008 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1009 hptr = &((*hptr)->next);
1010 }
1011
1012 /* Add if not previously present */
1013
1014 if (*hptr == NULL)
1015 {
1016 header_line *h = store_get(sizeof(header_line));
1017 h->text = hdr;
1018 h->next = NULL;
1019 h->type = newtype;
1020 h->slen = hlen;
1021 *hptr = h;
1022 hptr = &(h->next);
1023 }
1024
1025 /* Advance for next header line within the string */
1026
1027 p = q;
1028 }
1029 }
1030
1031
1032
1033 /*************************************************
1034 * List the added header lines *
1035 *************************************************/
1036 uschar *
1037 fn_hdrs_added(void)
1038 {
1039 gstring * g = NULL;
1040 header_line * h = acl_added_headers;
1041 uschar * s;
1042 uschar * cp;
1043
1044 if (!h) return NULL;
1045
1046 do
1047 {
1048 s = h->text;
1049 while ((cp = Ustrchr(s, '\n')) != NULL)
1050 {
1051 if (cp[1] == '\0') break;
1052
1053 /* contains embedded newline; needs doubling */
1054 g = string_catn(g, s, cp-s+1);
1055 g = string_catn(g, US"\n", 1);
1056 s = cp+1;
1057 }
1058 /* last bit of header */
1059
1060 /*XXX could we use add_listele? */
1061 g = string_catn(g, s, cp-s+1); /* newline-sep list */
1062 }
1063 while((h = h->next));
1064
1065 g->s[g->ptr - 1] = '\0'; /* overwrite last newline */
1066 return g->s;
1067 }
1068
1069
1070 /*************************************************
1071 * Set up removed header line(s) *
1072 *************************************************/
1073
1074 /* This function is called by the remove_header modifier. The argument is
1075 treated as a sequence of header names which are added to a colon separated
1076 list, provided there isn't an identical one already there.
1077
1078 Argument: string of header names
1079 Returns: nothing
1080 */
1081
1082 static void
1083 setup_remove_header(const uschar *hnames)
1084 {
1085 if (*hnames != 0)
1086 acl_removed_headers = acl_removed_headers
1087 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1088 : string_copy(hnames);
1089 }
1090
1091
1092
1093 /*************************************************
1094 * Handle warnings *
1095 *************************************************/
1096
1097 /* This function is called when a WARN verb's conditions are true. It adds to
1098 the message's headers, and/or writes information to the log. In each case, this
1099 only happens once (per message for headers, per connection for log).
1100
1101 ** NOTE: The header adding action using the "message" setting is historic, and
1102 its use is now deprecated. The new add_header modifier should be used instead.
1103
1104 Arguments:
1105 where ACL_WHERE_xxxx indicating which ACL this is
1106 user_message message for adding to headers
1107 log_message message for logging, if different
1108
1109 Returns: nothing
1110 */
1111
1112 static void
1113 acl_warn(int where, uschar *user_message, uschar *log_message)
1114 {
1115 if (log_message != NULL && log_message != user_message)
1116 {
1117 uschar *text;
1118 string_item *logged;
1119
1120 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1121 string_printing(log_message));
1122
1123 /* If a sender verification has failed, and the log message is "sender verify
1124 failed", add the failure message. */
1125
1126 if (sender_verified_failed != NULL &&
1127 sender_verified_failed->message != NULL &&
1128 strcmpic(log_message, US"sender verify failed") == 0)
1129 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1130
1131 /* Search previously logged warnings. They are kept in malloc
1132 store so they can be freed at the start of a new message. */
1133
1134 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1135 if (Ustrcmp(logged->text, text) == 0) break;
1136
1137 if (logged == NULL)
1138 {
1139 int length = Ustrlen(text) + 1;
1140 log_write(0, LOG_MAIN, "%s", text);
1141 logged = store_malloc(sizeof(string_item) + length);
1142 logged->text = US logged + sizeof(string_item);
1143 memcpy(logged->text, text, length);
1144 logged->next = acl_warn_logged;
1145 acl_warn_logged = logged;
1146 }
1147 }
1148
1149 /* If there's no user message, we are done. */
1150
1151 if (user_message == NULL) return;
1152
1153 /* If this isn't a message ACL, we can't do anything with a user message.
1154 Log an error. */
1155
1156 if (where > ACL_WHERE_NOTSMTP)
1157 {
1158 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1159 "found in a non-message (%s) ACL: cannot specify header lines here: "
1160 "message ignored", acl_wherenames[where]);
1161 return;
1162 }
1163
1164 /* The code for setting up header lines is now abstracted into a separate
1165 function so that it can be used for the add_header modifier as well. */
1166
1167 setup_header(user_message);
1168 }
1169
1170
1171
1172 /*************************************************
1173 * Verify and check reverse DNS *
1174 *************************************************/
1175
1176 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1177 address if this has not yet been done. The host_name_lookup() function checks
1178 that one of these names resolves to an address list that contains the client IP
1179 address, so we don't actually have to do the check here.
1180
1181 Arguments:
1182 user_msgptr pointer for user message
1183 log_msgptr pointer for log message
1184
1185 Returns: OK verification condition succeeded
1186 FAIL verification failed
1187 DEFER there was a problem verifying
1188 */
1189
1190 static int
1191 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1192 {
1193 int rc;
1194
1195 user_msgptr = user_msgptr; /* stop compiler warning */
1196
1197 /* Previous success */
1198
1199 if (sender_host_name != NULL) return OK;
1200
1201 /* Previous failure */
1202
1203 if (host_lookup_failed)
1204 {
1205 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1206 return FAIL;
1207 }
1208
1209 /* Need to do a lookup */
1210
1211 HDEBUG(D_acl)
1212 debug_printf_indent("looking up host name to force name/address consistency check\n");
1213
1214 if ((rc = host_name_lookup()) != OK)
1215 {
1216 *log_msgptr = (rc == DEFER)?
1217 US"host lookup deferred for reverse lookup check"
1218 :
1219 string_sprintf("host lookup failed for reverse lookup check%s",
1220 host_lookup_msg);
1221 return rc; /* DEFER or FAIL */
1222 }
1223
1224 host_build_sender_fullhost();
1225 return OK;
1226 }
1227
1228
1229
1230 /*************************************************
1231 * Check client IP address matches CSA target *
1232 *************************************************/
1233
1234 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1235 response for address records belonging to the CSA target hostname. The section
1236 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1237 If one of the addresses matches the client's IP address, then the client is
1238 authorized by CSA. If there are target IP addresses but none of them match
1239 then the client is using an unauthorized IP address. If there are no target IP
1240 addresses then the client cannot be using an authorized IP address. (This is
1241 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1242
1243 Arguments:
1244 dnsa the DNS answer block
1245 dnss a DNS scan block for us to use
1246 reset option specifying what portion to scan, as described above
1247 target the target hostname to use for matching RR names
1248
1249 Returns: CSA_OK successfully authorized
1250 CSA_FAIL_MISMATCH addresses found but none matched
1251 CSA_FAIL_NOADDR no target addresses found
1252 */
1253
1254 static int
1255 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1256 uschar *target)
1257 {
1258 dns_record *rr;
1259 dns_address *da;
1260
1261 BOOL target_found = FALSE;
1262
1263 for (rr = dns_next_rr(dnsa, dnss, reset);
1264 rr != NULL;
1265 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1266 {
1267 /* Check this is an address RR for the target hostname. */
1268
1269 if (rr->type != T_A
1270 #if HAVE_IPV6
1271 && rr->type != T_AAAA
1272 #endif
1273 ) continue;
1274
1275 if (strcmpic(target, rr->name) != 0) continue;
1276
1277 target_found = TRUE;
1278
1279 /* Turn the target address RR into a list of textual IP addresses and scan
1280 the list. There may be more than one if it is an A6 RR. */
1281
1282 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1283 {
1284 /* If the client IP address matches the target IP address, it's good! */
1285
1286 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1287
1288 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1289 }
1290 }
1291
1292 /* If we found some target addresses but none of them matched, the client is
1293 using an unauthorized IP address, otherwise the target has no authorized IP
1294 addresses. */
1295
1296 if (target_found) return CSA_FAIL_MISMATCH;
1297 else return CSA_FAIL_NOADDR;
1298 }
1299
1300
1301
1302 /*************************************************
1303 * Verify Client SMTP Authorization *
1304 *************************************************/
1305
1306 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1307 to find the CSA SRV record corresponding to the domain argument, or
1308 $sender_helo_name if no argument is provided. It then checks that the
1309 client is authorized, and that its IP address corresponds to the SRV
1310 target's address by calling acl_verify_csa_address() above. The address
1311 should have been returned in the DNS response's ADDITIONAL section, but if
1312 not we perform another DNS lookup to get it.
1313
1314 Arguments:
1315 domain pointer to optional parameter following verify = csa
1316
1317 Returns: CSA_UNKNOWN no valid CSA record found
1318 CSA_OK successfully authorized
1319 CSA_FAIL_* client is definitely not authorized
1320 CSA_DEFER_* there was a DNS problem
1321 */
1322
1323 static int
1324 acl_verify_csa(const uschar *domain)
1325 {
1326 tree_node *t;
1327 const uschar *found;
1328 int priority, weight, port;
1329 dns_answer dnsa;
1330 dns_scan dnss;
1331 dns_record *rr;
1332 int rc, type;
1333 uschar target[256];
1334
1335 /* Work out the domain we are using for the CSA lookup. The default is the
1336 client's HELO domain. If the client has not said HELO, use its IP address
1337 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1338
1339 while (isspace(*domain) && *domain != '\0') ++domain;
1340 if (*domain == '\0') domain = sender_helo_name;
1341 if (domain == NULL) domain = sender_host_address;
1342 if (sender_host_address == NULL) return CSA_UNKNOWN;
1343
1344 /* If we have an address literal, strip off the framing ready for turning it
1345 into a domain. The framing consists of matched square brackets possibly
1346 containing a keyword and a colon before the actual IP address. */
1347
1348 if (domain[0] == '[')
1349 {
1350 const uschar *start = Ustrchr(domain, ':');
1351 if (start == NULL) start = domain;
1352 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1353 }
1354
1355 /* Turn domains that look like bare IP addresses into domains in the reverse
1356 DNS. This code also deals with address literals and $sender_host_address. It's
1357 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1358 address literals, but it's probably the most friendly thing to do. This is an
1359 extension to CSA, so we allow it to be turned off for proper conformance. */
1360
1361 if (string_is_ip_address(domain, NULL) != 0)
1362 {
1363 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1364 dns_build_reverse(domain, target);
1365 domain = target;
1366 }
1367
1368 /* Find out if we've already done the CSA check for this domain. If we have,
1369 return the same result again. Otherwise build a new cached result structure
1370 for this domain. The name is filled in now, and the value is filled in when
1371 we return from this function. */
1372
1373 t = tree_search(csa_cache, domain);
1374 if (t != NULL) return t->data.val;
1375
1376 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1377 Ustrcpy(t->name, domain);
1378 (void)tree_insertnode(&csa_cache, t);
1379
1380 /* Now we are ready to do the actual DNS lookup(s). */
1381
1382 found = domain;
1383 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1384 {
1385 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1386
1387 default:
1388 return t->data.val = CSA_DEFER_SRV;
1389
1390 /* If we found nothing, the client's authorization is unknown. */
1391
1392 case DNS_NOMATCH:
1393 case DNS_NODATA:
1394 return t->data.val = CSA_UNKNOWN;
1395
1396 /* We got something! Go on to look at the reply in more detail. */
1397
1398 case DNS_SUCCEED:
1399 break;
1400 }
1401
1402 /* Scan the reply for well-formed CSA SRV records. */
1403
1404 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1405 rr;
1406 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1407 {
1408 const uschar * p = rr->data;
1409
1410 /* Extract the numerical SRV fields (p is incremented) */
1411
1412 GETSHORT(priority, p);
1413 GETSHORT(weight, p);
1414 GETSHORT(port, p);
1415
1416 DEBUG(D_acl)
1417 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1418
1419 /* Check the CSA version number */
1420
1421 if (priority != 1) continue;
1422
1423 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1424 found by dns_special_lookup() is a parent of the one we asked for), we check
1425 the subdomain assertions in the port field. At the moment there's only one
1426 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1427 SRV records of their own. */
1428
1429 if (Ustrcmp(found, domain) != 0)
1430 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1431
1432 /* This CSA SRV record refers directly to our domain, so we check the value
1433 in the weight field to work out the domain's authorization. 0 and 1 are
1434 unauthorized; 3 means the client is authorized but we can't check the IP
1435 address in order to authenticate it, so we treat it as unknown; values
1436 greater than 3 are undefined. */
1437
1438 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1439
1440 if (weight > 2) continue;
1441
1442 /* Weight == 2, which means the domain is authorized. We must check that the
1443 client's IP address is listed as one of the SRV target addresses. Save the
1444 target hostname then break to scan the additional data for its addresses. */
1445
1446 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1447 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1448
1449 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1450
1451 break;
1452 }
1453
1454 /* If we didn't break the loop then no appropriate records were found. */
1455
1456 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1457
1458 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1459 A target of "." indicates there are no valid addresses, so the client cannot
1460 be authorized. (This is an odd configuration because weight=2 target=. is
1461 equivalent to weight=1, but we check for it in order to keep load off the
1462 root name servers.) Note that dn_expand() turns "." into "". */
1463
1464 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1465
1466 /* Scan the additional section of the CSA SRV reply for addresses belonging
1467 to the target. If the name server didn't return any additional data (e.g.
1468 because it does not fully support SRV records), we need to do another lookup
1469 to obtain the target addresses; otherwise we have a definitive result. */
1470
1471 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1472 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1473
1474 /* The DNS lookup type corresponds to the IP version used by the client. */
1475
1476 #if HAVE_IPV6
1477 if (Ustrchr(sender_host_address, ':') != NULL)
1478 type = T_AAAA;
1479 else
1480 #endif /* HAVE_IPV6 */
1481 type = T_A;
1482
1483
1484 lookup_dnssec_authenticated = NULL;
1485 switch (dns_lookup(&dnsa, target, type, NULL))
1486 {
1487 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1488
1489 default:
1490 return t->data.val = CSA_DEFER_ADDR;
1491
1492 /* If the query succeeded, scan the addresses and return the result. */
1493
1494 case DNS_SUCCEED:
1495 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1496 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1497 /* else fall through */
1498
1499 /* If the target has no IP addresses, the client cannot have an authorized
1500 IP address. However, if the target site uses A6 records (not AAAA records)
1501 we have to do yet another lookup in order to check them. */
1502
1503 case DNS_NOMATCH:
1504 case DNS_NODATA:
1505 return t->data.val = CSA_FAIL_NOADDR;
1506 }
1507 }
1508
1509
1510
1511 /*************************************************
1512 * Handle verification (address & other) *
1513 *************************************************/
1514
1515 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1516 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1517 VERIFY_HDR_NAMES_ASCII
1518 };
1519 typedef struct {
1520 uschar * name;
1521 int value;
1522 unsigned where_allowed; /* bitmap */
1523 BOOL no_options; /* Never has /option(s) following */
1524 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1525 } verify_type_t;
1526 static verify_type_t verify_type_list[] = {
1527 /* name value where no-opt opt-sep */
1528 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1529 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1530 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1531 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1532 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1533 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1534 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1535 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1536 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1537 FALSE, 6 },
1538 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1539 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
1540 };
1541
1542
1543 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1544 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1545 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1546 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1547 };
1548 typedef struct {
1549 uschar * name;
1550 int value;
1551 int flag;
1552 BOOL has_option; /* Has =option(s) following */
1553 BOOL timeval; /* Has a time value */
1554 } callout_opt_t;
1555 static callout_opt_t callout_opt_list[] = {
1556 /* name value flag has-opt has-time */
1557 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1558 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1559 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1560 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1561 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1562 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1563 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1564 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1565 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1566 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1567 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1568 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1569 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1570 };
1571
1572
1573
1574 /* This function implements the "verify" condition. It is called when
1575 encountered in any ACL, because some tests are almost always permitted. Some
1576 just don't make sense, and always fail (for example, an attempt to test a host
1577 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1578
1579 Arguments:
1580 where where called from
1581 addr the recipient address that the ACL is handling, or NULL
1582 arg the argument of "verify"
1583 user_msgptr pointer for user message
1584 log_msgptr pointer for log message
1585 basic_errno where to put verify errno
1586
1587 Returns: OK verification condition succeeded
1588 FAIL verification failed
1589 DEFER there was a problem verifying
1590 ERROR syntax error
1591 */
1592
1593 static int
1594 acl_verify(int where, address_item *addr, const uschar *arg,
1595 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1596 {
1597 int sep = '/';
1598 int callout = -1;
1599 int callout_overall = -1;
1600 int callout_connect = -1;
1601 int verify_options = 0;
1602 int rc;
1603 BOOL verify_header_sender = FALSE;
1604 BOOL defer_ok = FALSE;
1605 BOOL callout_defer_ok = FALSE;
1606 BOOL no_details = FALSE;
1607 BOOL success_on_redirect = FALSE;
1608 address_item *sender_vaddr = NULL;
1609 uschar *verify_sender_address = NULL;
1610 uschar *pm_mailfrom = NULL;
1611 uschar *se_mailfrom = NULL;
1612
1613 /* Some of the verify items have slash-separated options; some do not. Diagnose
1614 an error if options are given for items that don't expect them.
1615 */
1616
1617 uschar *slash = Ustrchr(arg, '/');
1618 const uschar *list = arg;
1619 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1620 verify_type_t * vp;
1621
1622 if (ss == NULL) goto BAD_VERIFY;
1623
1624 /* Handle name/address consistency verification in a separate function. */
1625
1626 for (vp= verify_type_list;
1627 CS vp < CS verify_type_list + sizeof(verify_type_list);
1628 vp++
1629 )
1630 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1631 : strcmpic (ss, vp->name) == 0)
1632 break;
1633 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1634 goto BAD_VERIFY;
1635
1636 if (vp->no_options && slash != NULL)
1637 {
1638 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1639 "(this verify item has no options)", arg);
1640 return ERROR;
1641 }
1642 if (!(vp->where_allowed & (1<<where)))
1643 {
1644 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1645 return ERROR;
1646 }
1647 switch(vp->value)
1648 {
1649 case VERIFY_REV_HOST_LKUP:
1650 if (sender_host_address == NULL) return OK;
1651 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1652 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1653 if (strcmpic(ss, US"defer_ok") == 0)
1654 return OK;
1655 return rc;
1656
1657 case VERIFY_CERT:
1658 /* TLS certificate verification is done at STARTTLS time; here we just
1659 test whether it was successful or not. (This is for optional verification; for
1660 mandatory verification, the connection doesn't last this long.) */
1661
1662 if (tls_in.certificate_verified) return OK;
1663 *user_msgptr = US"no verified certificate";
1664 return FAIL;
1665
1666 case VERIFY_HELO:
1667 /* We can test the result of optional HELO verification that might have
1668 occurred earlier. If not, we can attempt the verification now. */
1669
1670 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1671 return helo_verified? OK : FAIL;
1672
1673 case VERIFY_CSA:
1674 /* Do Client SMTP Authorization checks in a separate function, and turn the
1675 result code into user-friendly strings. */
1676
1677 rc = acl_verify_csa(list);
1678 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1679 csa_reason_string[rc]);
1680 csa_status = csa_status_string[rc];
1681 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1682 return csa_return_code[rc];
1683
1684 case VERIFY_HDR_SYNTAX:
1685 /* Check that all relevant header lines have the correct syntax. If there is
1686 a syntax error, we return details of the error to the sender if configured to
1687 send out full details. (But a "message" setting on the ACL can override, as
1688 always). */
1689
1690 rc = verify_check_headers(log_msgptr);
1691 if (rc != OK && *log_msgptr)
1692 if (smtp_return_error_details)
1693 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1694 else
1695 acl_verify_message = *log_msgptr;
1696 return rc;
1697
1698 case VERIFY_HDR_NAMES_ASCII:
1699 /* Check that all header names are true 7 bit strings
1700 See RFC 5322, 2.2. and RFC 6532, 3. */
1701
1702 rc = verify_check_header_names_ascii(log_msgptr);
1703 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1704 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1705 return rc;
1706
1707 case VERIFY_NOT_BLIND:
1708 /* Check that no recipient of this message is "blind", that is, every envelope
1709 recipient must be mentioned in either To: or Cc:. */
1710
1711 rc = verify_check_notblind();
1712 if (rc != OK)
1713 {
1714 *log_msgptr = string_sprintf("bcc recipient detected");
1715 if (smtp_return_error_details)
1716 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1717 }
1718 return rc;
1719
1720 /* The remaining verification tests check recipient and sender addresses,
1721 either from the envelope or from the header. There are a number of
1722 slash-separated options that are common to all of them. */
1723
1724 case VERIFY_HDR_SNDR:
1725 verify_header_sender = TRUE;
1726 break;
1727
1728 case VERIFY_SNDR:
1729 /* In the case of a sender, this can optionally be followed by an address to use
1730 in place of the actual sender (rare special-case requirement). */
1731 {
1732 uschar *s = ss + 6;
1733 if (*s == 0)
1734 verify_sender_address = sender_address;
1735 else
1736 {
1737 while (isspace(*s)) s++;
1738 if (*s++ != '=') goto BAD_VERIFY;
1739 while (isspace(*s)) s++;
1740 verify_sender_address = string_copy(s);
1741 }
1742 }
1743 break;
1744
1745 case VERIFY_RCPT:
1746 break;
1747 }
1748
1749
1750
1751 /* Remaining items are optional; they apply to sender and recipient
1752 verification, including "header sender" verification. */
1753
1754 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1755 != NULL)
1756 {
1757 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1758 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1759 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1760
1761 /* These two old options are left for backwards compatibility */
1762
1763 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1764 {
1765 callout_defer_ok = TRUE;
1766 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1767 }
1768
1769 else if (strcmpic(ss, US"check_postmaster") == 0)
1770 {
1771 pm_mailfrom = US"";
1772 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1773 }
1774
1775 /* The callout option has a number of sub-options, comma separated */
1776
1777 else if (strncmpic(ss, US"callout", 7) == 0)
1778 {
1779 callout = CALLOUT_TIMEOUT_DEFAULT;
1780 ss += 7;
1781 if (*ss != 0)
1782 {
1783 while (isspace(*ss)) ss++;
1784 if (*ss++ == '=')
1785 {
1786 const uschar * sublist = ss;
1787 int optsep = ',';
1788 uschar *opt;
1789 uschar buffer[256];
1790 while (isspace(*sublist)) sublist++;
1791
1792 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1793 {
1794 callout_opt_t * op;
1795 double period = 1.0F;
1796
1797 for (op= callout_opt_list; op->name; op++)
1798 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1799 break;
1800
1801 verify_options |= op->flag;
1802 if (op->has_option)
1803 {
1804 opt += Ustrlen(op->name);
1805 while (isspace(*opt)) opt++;
1806 if (*opt++ != '=')
1807 {
1808 *log_msgptr = string_sprintf("'=' expected after "
1809 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1810 return ERROR;
1811 }
1812 while (isspace(*opt)) opt++;
1813 }
1814 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1815 {
1816 *log_msgptr = string_sprintf("bad time value in ACL condition "
1817 "\"verify %s\"", arg);
1818 return ERROR;
1819 }
1820
1821 switch(op->value)
1822 {
1823 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1824 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1825 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1826 case CALLOUT_MAILFROM:
1827 if (!verify_header_sender)
1828 {
1829 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1830 "callout option only for verify=header_sender (detected in ACL "
1831 "condition \"%s\")", arg);
1832 return ERROR;
1833 }
1834 se_mailfrom = string_copy(opt);
1835 break;
1836 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1837 case CALLOUT_MAXWAIT: callout_overall = period; break;
1838 case CALLOUT_CONNECT: callout_connect = period; break;
1839 case CALLOUT_TIME: callout = period; break;
1840 }
1841 }
1842 }
1843 else
1844 {
1845 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1846 "ACL condition \"%s\"", arg);
1847 return ERROR;
1848 }
1849 }
1850 }
1851
1852 /* Option not recognized */
1853
1854 else
1855 {
1856 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1857 "condition \"verify %s\"", ss, arg);
1858 return ERROR;
1859 }
1860 }
1861
1862 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1863 (vopt_callout_recipsender|vopt_callout_recippmaster))
1864 {
1865 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1866 "for a recipient callout";
1867 return ERROR;
1868 }
1869
1870 /* Handle sender-in-header verification. Default the user message to the log
1871 message if giving out verification details. */
1872
1873 if (verify_header_sender)
1874 {
1875 int verrno;
1876
1877 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1878 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1879 &verrno)) != OK)
1880 {
1881 *basic_errno = verrno;
1882 if (smtp_return_error_details)
1883 {
1884 if (!*user_msgptr && *log_msgptr)
1885 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1886 if (rc == DEFER) acl_temp_details = TRUE;
1887 }
1888 }
1889 }
1890
1891 /* Handle a sender address. The default is to verify *the* sender address, but
1892 optionally a different address can be given, for special requirements. If the
1893 address is empty, we are dealing with a bounce message that has no sender, so
1894 we cannot do any checking. If the real sender address gets rewritten during
1895 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1896 during message reception.
1897
1898 A list of verified "sender" addresses is kept to try to avoid doing to much
1899 work repetitively when there are multiple recipients in a message and they all
1900 require sender verification. However, when callouts are involved, it gets too
1901 complicated because different recipients may require different callout options.
1902 Therefore, we always do a full sender verify when any kind of callout is
1903 specified. Caching elsewhere, for instance in the DNS resolver and in the
1904 callout handling, should ensure that this is not terribly inefficient. */
1905
1906 else if (verify_sender_address)
1907 {
1908 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1909 {
1910 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1911 "sender verify callout";
1912 return ERROR;
1913 }
1914
1915 sender_vaddr = verify_checked_sender(verify_sender_address);
1916 if (sender_vaddr != NULL && /* Previously checked */
1917 callout <= 0) /* No callout needed this time */
1918 {
1919 /* If the "routed" flag is set, it means that routing worked before, so
1920 this check can give OK (the saved return code value, if set, belongs to a
1921 callout that was done previously). If the "routed" flag is not set, routing
1922 must have failed, so we use the saved return code. */
1923
1924 if (testflag(sender_vaddr, af_verify_routed))
1925 rc = OK;
1926 else
1927 {
1928 rc = sender_vaddr->special_action;
1929 *basic_errno = sender_vaddr->basic_errno;
1930 }
1931 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1932 }
1933
1934 /* Do a new verification, and cache the result. The cache is used to avoid
1935 verifying the sender multiple times for multiple RCPTs when callouts are not
1936 specified (see comments above).
1937
1938 The cache is also used on failure to give details in response to the first
1939 RCPT that gets bounced for this reason. However, this can be suppressed by
1940 the no_details option, which sets the flag that says "this detail has already
1941 been sent". The cache normally contains just one address, but there may be
1942 more in esoteric circumstances. */
1943
1944 else
1945 {
1946 BOOL routed = TRUE;
1947 uschar *save_address_data = deliver_address_data;
1948
1949 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1950 #ifdef SUPPORT_I18N
1951 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1952 {
1953 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1954 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1955 }
1956 #endif
1957 if (no_details) setflag(sender_vaddr, af_sverify_told);
1958 if (verify_sender_address[0] != 0)
1959 {
1960 /* If this is the real sender address, save the unrewritten version
1961 for use later in receive. Otherwise, set a flag so that rewriting the
1962 sender in verify_address() does not update sender_address. */
1963
1964 if (verify_sender_address == sender_address)
1965 sender_address_unrewritten = sender_address;
1966 else
1967 verify_options |= vopt_fake_sender;
1968
1969 if (success_on_redirect)
1970 verify_options |= vopt_success_on_redirect;
1971
1972 /* The recipient, qualify, and expn options are never set in
1973 verify_options. */
1974
1975 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1976 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1977
1978 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
1979
1980 if (rc != OK)
1981 *basic_errno = sender_vaddr->basic_errno;
1982 else
1983 DEBUG(D_acl)
1984 {
1985 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1986 debug_printf_indent("sender %s verified ok as %s\n",
1987 verify_sender_address, sender_vaddr->address);
1988 else
1989 debug_printf_indent("sender %s verified ok\n",
1990 verify_sender_address);
1991 }
1992 }
1993 else
1994 rc = OK; /* Null sender */
1995
1996 /* Cache the result code */
1997
1998 if (routed) setflag(sender_vaddr, af_verify_routed);
1999 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2000 sender_vaddr->special_action = rc;
2001 sender_vaddr->next = sender_verified_list;
2002 sender_verified_list = sender_vaddr;
2003
2004 /* Restore the recipient address data, which might have been clobbered by
2005 the sender verification. */
2006
2007 deliver_address_data = save_address_data;
2008 }
2009
2010 /* Put the sender address_data value into $sender_address_data */
2011
2012 sender_address_data = sender_vaddr->prop.address_data;
2013 }
2014
2015 /* A recipient address just gets a straightforward verify; again we must handle
2016 the DEFER overrides. */
2017
2018 else
2019 {
2020 address_item addr2;
2021
2022 if (success_on_redirect)
2023 verify_options |= vopt_success_on_redirect;
2024
2025 /* We must use a copy of the address for verification, because it might
2026 get rewritten. */
2027
2028 addr2 = *addr;
2029 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2030 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2031 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2032
2033 *basic_errno = addr2.basic_errno;
2034 *log_msgptr = addr2.message;
2035 *user_msgptr = (addr2.user_message != NULL)?
2036 addr2.user_message : addr2.message;
2037
2038 /* Allow details for temporary error if the address is so flagged. */
2039 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
2040
2041 /* Make $address_data visible */
2042 deliver_address_data = addr2.prop.address_data;
2043 }
2044
2045 /* We have a result from the relevant test. Handle defer overrides first. */
2046
2047 if (rc == DEFER && (defer_ok ||
2048 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2049 {
2050 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2051 defer_ok? "defer_ok" : "callout_defer_ok");
2052 rc = OK;
2053 }
2054
2055 /* If we've failed a sender, set up a recipient message, and point
2056 sender_verified_failed to the address item that actually failed. */
2057
2058 if (rc != OK && verify_sender_address != NULL)
2059 {
2060 if (rc != DEFER)
2061 *log_msgptr = *user_msgptr = US"Sender verify failed";
2062 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2063 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2064 else
2065 {
2066 *log_msgptr = US"Could not complete sender verify callout";
2067 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2068 *log_msgptr;
2069 }
2070
2071 sender_verified_failed = sender_vaddr;
2072 }
2073
2074 /* Verifying an address messes up the values of $domain and $local_part,
2075 so reset them before returning if this is a RCPT ACL. */
2076
2077 if (addr != NULL)
2078 {
2079 deliver_domain = addr->domain;
2080 deliver_localpart = addr->local_part;
2081 }
2082 return rc;
2083
2084 /* Syntax errors in the verify argument come here. */
2085
2086 BAD_VERIFY:
2087 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2088 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2089 "or \"reverse_host_lookup\" at start of ACL condition "
2090 "\"verify %s\"", arg);
2091 return ERROR;
2092 }
2093
2094
2095
2096
2097 /*************************************************
2098 * Check argument for control= modifier *
2099 *************************************************/
2100
2101 /* Called from acl_check_condition() below
2102
2103 Arguments:
2104 arg the argument string for control=
2105 pptr set to point to the terminating character
2106 where which ACL we are in
2107 log_msgptr for error messages
2108
2109 Returns: CONTROL_xxx value
2110 */
2111
2112 static int
2113 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2114 {
2115 int idx, len;
2116 control_def * d;
2117
2118 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2119 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2120 && (!d->has_option || arg[len] != '/')
2121 ) )
2122 {
2123 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2124 return CONTROL_ERROR;
2125 }
2126
2127 *pptr = arg + len;
2128 return idx;
2129 }
2130
2131
2132
2133
2134 /*************************************************
2135 * Return a ratelimit error *
2136 *************************************************/
2137
2138 /* Called from acl_ratelimit() below
2139
2140 Arguments:
2141 log_msgptr for error messages
2142 format format string
2143 ... supplementary arguments
2144 ss ratelimit option name
2145 where ACL_WHERE_xxxx indicating which ACL this is
2146
2147 Returns: ERROR
2148 */
2149
2150 static int
2151 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2152 {
2153 va_list ap;
2154 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2155 va_start(ap, format);
2156 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2157 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2158 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2159 va_end(ap);
2160 *log_msgptr = string_sprintf(
2161 "error in arguments to \"ratelimit\" condition: %s", buffer);
2162 return ERROR;
2163 }
2164
2165
2166
2167
2168 /*************************************************
2169 * Handle rate limiting *
2170 *************************************************/
2171
2172 /* Called by acl_check_condition() below to calculate the result
2173 of the ACL ratelimit condition.
2174
2175 Note that the return value might be slightly unexpected: if the
2176 sender's rate is above the limit then the result is OK. This is
2177 similar to the dnslists condition, and is so that you can write
2178 ACL clauses like: defer ratelimit = 15 / 1h
2179
2180 Arguments:
2181 arg the option string for ratelimit=
2182 where ACL_WHERE_xxxx indicating which ACL this is
2183 log_msgptr for error messages
2184
2185 Returns: OK - Sender's rate is above limit
2186 FAIL - Sender's rate is below limit
2187 DEFER - Problem opening ratelimit database
2188 ERROR - Syntax error in options.
2189 */
2190
2191 static int
2192 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2193 {
2194 double limit, period, count;
2195 uschar *ss;
2196 uschar *key = NULL;
2197 uschar *unique = NULL;
2198 int sep = '/';
2199 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2200 BOOL noupdate = FALSE, badacl = FALSE;
2201 int mode = RATE_PER_WHAT;
2202 int old_pool, rc;
2203 tree_node **anchor, *t;
2204 open_db dbblock, *dbm;
2205 int dbdb_size;
2206 dbdata_ratelimit *dbd;
2207 dbdata_ratelimit_unique *dbdb;
2208 struct timeval tv;
2209
2210 /* Parse the first two options and record their values in expansion
2211 variables. These variables allow the configuration to have informative
2212 error messages based on rate limits obtained from a table lookup. */
2213
2214 /* First is the maximum number of messages per period / maximum burst
2215 size, which must be greater than or equal to zero. Zero is useful for
2216 rate measurement as opposed to rate limiting. */
2217
2218 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2219 if (sender_rate_limit == NULL)
2220 return ratelimit_error(log_msgptr, "sender rate limit not set");
2221
2222 limit = Ustrtod(sender_rate_limit, &ss);
2223 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2224 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2225 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2226
2227 if (limit < 0.0 || *ss != '\0')
2228 return ratelimit_error(log_msgptr,
2229 "\"%s\" is not a positive number", sender_rate_limit);
2230
2231 /* Second is the rate measurement period / exponential smoothing time
2232 constant. This must be strictly greater than zero, because zero leads to
2233 run-time division errors. */
2234
2235 sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2236 if (sender_rate_period == NULL) period = -1.0;
2237 else period = readconf_readtime(sender_rate_period, 0, FALSE);
2238 if (period <= 0.0)
2239 return ratelimit_error(log_msgptr,
2240 "\"%s\" is not a time value", sender_rate_period);
2241
2242 /* By default we are counting one of something, but the per_rcpt,
2243 per_byte, and count options can change this. */
2244
2245 count = 1.0;
2246
2247 /* Parse the other options. */
2248
2249 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2250 != NULL)
2251 {
2252 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2253 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2254 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2255 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2256 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2257 else if (strcmpic(ss, US"per_conn") == 0)
2258 {
2259 RATE_SET(mode, PER_CONN);
2260 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2261 badacl = TRUE;
2262 }
2263 else if (strcmpic(ss, US"per_mail") == 0)
2264 {
2265 RATE_SET(mode, PER_MAIL);
2266 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2267 }
2268 else if (strcmpic(ss, US"per_rcpt") == 0)
2269 {
2270 /* If we are running in the RCPT ACL, then we'll count the recipients
2271 one by one, but if we are running when we have accumulated the whole
2272 list then we'll add them all in one batch. */
2273 if (where == ACL_WHERE_RCPT)
2274 RATE_SET(mode, PER_RCPT);
2275 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2276 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2277 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2278 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2279 }
2280 else if (strcmpic(ss, US"per_byte") == 0)
2281 {
2282 /* If we have not yet received the message data and there was no SIZE
2283 declaration on the MAIL command, then it's safe to just use a value of
2284 zero and let the recorded rate decay as if nothing happened. */
2285 RATE_SET(mode, PER_MAIL);
2286 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2287 else count = message_size < 0 ? 0.0 : (double)message_size;
2288 }
2289 else if (strcmpic(ss, US"per_addr") == 0)
2290 {
2291 RATE_SET(mode, PER_RCPT);
2292 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2293 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2294 }
2295 else if (strncmpic(ss, US"count=", 6) == 0)
2296 {
2297 uschar *e;
2298 count = Ustrtod(ss+6, &e);
2299 if (count < 0.0 || *e != '\0')
2300 return ratelimit_error(log_msgptr,
2301 "\"%s\" is not a positive number", ss);
2302 }
2303 else if (strncmpic(ss, US"unique=", 7) == 0)
2304 unique = string_copy(ss + 7);
2305 else if (key == NULL)
2306 key = string_copy(ss);
2307 else
2308 key = string_sprintf("%s/%s", key, ss);
2309 }
2310
2311 /* Sanity check. When the badacl flag is set the update mode must either
2312 be readonly (which is the default if it is omitted) or, for backwards
2313 compatibility, a combination of noupdate and strict or leaky. */
2314
2315 if (mode == RATE_PER_CLASH)
2316 return ratelimit_error(log_msgptr, "conflicting per_* options");
2317 if (leaky + strict + readonly > 1)
2318 return ratelimit_error(log_msgptr, "conflicting update modes");
2319 if (badacl && (leaky || strict) && !noupdate)
2320 return ratelimit_error(log_msgptr,
2321 "\"%s\" must not have /leaky or /strict option in %s ACL",
2322 ratelimit_option_string[mode], acl_wherenames[where]);
2323
2324 /* Set the default values of any unset options. In readonly mode we
2325 perform the rate computation without any increment so that its value
2326 decays to eventually allow over-limit senders through. */
2327
2328 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2329 if (badacl) readonly = TRUE;
2330 if (readonly) count = 0.0;
2331 if (!strict && !readonly) leaky = TRUE;
2332 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2333
2334 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2335 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2336 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2337 are added to the key because they alter the meaning of the stored data. */
2338
2339 if (key == NULL)
2340 key = (sender_host_address == NULL)? US"" : sender_host_address;
2341
2342 key = string_sprintf("%s/%s/%s%s",
2343 sender_rate_period,
2344 ratelimit_option_string[mode],
2345 unique == NULL ? "" : "unique/",
2346 key);
2347
2348 HDEBUG(D_acl)
2349 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2350
2351 /* See if we have already computed the rate by looking in the relevant tree.
2352 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2353 pool so that they survive across resets. In readonly mode we only remember the
2354 result for the rest of this command in case a later command changes it. After
2355 this bit of logic the code is independent of the per_* mode. */
2356
2357 old_pool = store_pool;
2358
2359 if (readonly)
2360 anchor = &ratelimiters_cmd;
2361 else switch(mode) {
2362 case RATE_PER_CONN:
2363 anchor = &ratelimiters_conn;
2364 store_pool = POOL_PERM;
2365 break;
2366 case RATE_PER_BYTE:
2367 case RATE_PER_MAIL:
2368 case RATE_PER_ALLRCPTS:
2369 anchor = &ratelimiters_mail;
2370 break;
2371 case RATE_PER_ADDR:
2372 case RATE_PER_CMD:
2373 case RATE_PER_RCPT:
2374 anchor = &ratelimiters_cmd;
2375 break;
2376 default:
2377 anchor = NULL; /* silence an "unused" complaint */
2378 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2379 "internal ACL error: unknown ratelimit mode %d", mode);
2380 break;
2381 }
2382
2383 t = tree_search(*anchor, key);
2384 if (t != NULL)
2385 {
2386 dbd = t->data.ptr;
2387 /* The following few lines duplicate some of the code below. */
2388 rc = (dbd->rate < limit)? FAIL : OK;
2389 store_pool = old_pool;
2390 sender_rate = string_sprintf("%.1f", dbd->rate);
2391 HDEBUG(D_acl)
2392 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2393 return rc;
2394 }
2395
2396 /* We aren't using a pre-computed rate, so get a previously recorded rate
2397 from the database, which will be updated and written back if required. */
2398
2399 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2400 {
2401 store_pool = old_pool;
2402 sender_rate = NULL;
2403 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2404 *log_msgptr = US"ratelimit database not available";
2405 return DEFER;
2406 }
2407 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2408 dbd = NULL;
2409
2410 gettimeofday(&tv, NULL);
2411
2412 if (dbdb != NULL)
2413 {
2414 /* Locate the basic ratelimit block inside the DB data. */
2415 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2416 dbd = &dbdb->dbd;
2417
2418 /* Forget the old Bloom filter if it is too old, so that we count each
2419 repeating event once per period. We don't simply clear and re-use the old
2420 filter because we want its size to change if the limit changes. Note that
2421 we keep the dbd pointer for copying the rate into the new data block. */
2422
2423 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2424 {
2425 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2426 dbdb = NULL;
2427 }
2428
2429 /* Sanity check. */
2430
2431 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2432 {
2433 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2434 dbdb = NULL;
2435 }
2436 }
2437
2438 /* Allocate a new data block if the database lookup failed
2439 or the Bloom filter passed its age limit. */
2440
2441 if (dbdb == NULL)
2442 {
2443 if (unique == NULL)
2444 {
2445 /* No Bloom filter. This basic ratelimit block is initialized below. */
2446 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2447 dbdb_size = sizeof(*dbd);
2448 dbdb = store_get(dbdb_size);
2449 }
2450 else
2451 {
2452 int extra;
2453 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2454
2455 /* See the long comment below for an explanation of the magic number 2.
2456 The filter has a minimum size in case the rate limit is very small;
2457 this is determined by the definition of dbdata_ratelimit_unique. */
2458
2459 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2460 if (extra < 0) extra = 0;
2461 dbdb_size = sizeof(*dbdb) + extra;
2462 dbdb = store_get(dbdb_size);
2463 dbdb->bloom_epoch = tv.tv_sec;
2464 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2465 memset(dbdb->bloom, 0, dbdb->bloom_size);
2466
2467 /* Preserve any basic ratelimit data (which is our longer-term memory)
2468 by copying it from the discarded block. */
2469
2470 if (dbd != NULL)
2471 {
2472 dbdb->dbd = *dbd;
2473 dbd = &dbdb->dbd;
2474 }
2475 }
2476 }
2477
2478 /* If we are counting unique events, find out if this event is new or not.
2479 If the client repeats the event during the current period then it should be
2480 counted. We skip this code in readonly mode for efficiency, because any
2481 changes to the filter will be discarded and because count is already set to
2482 zero. */
2483
2484 if (unique != NULL && !readonly)
2485 {
2486 /* We identify unique events using a Bloom filter. (You can find my
2487 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2488 With the per_addr option, an "event" is a recipient address, though the
2489 user can use the unique option to define their own events. We only count
2490 an event if we have not seen it before.
2491
2492 We size the filter according to the rate limit, which (in leaky mode)
2493 is the limit on the population of the filter. We allow 16 bits of space
2494 per entry (see the construction code above) and we set (up to) 8 of them
2495 when inserting an element (see the loop below). The probability of a false
2496 positive (an event we have not seen before but which we fail to count) is
2497
2498 size = limit * 16
2499 numhash = 8
2500 allzero = exp(-numhash * pop / size)
2501 = exp(-0.5 * pop / limit)
2502 fpr = pow(1 - allzero, numhash)
2503
2504 For senders at the limit the fpr is 0.06% or 1 in 1700
2505 and for senders at half the limit it is 0.0006% or 1 in 170000
2506
2507 In strict mode the Bloom filter can fill up beyond the normal limit, in
2508 which case the false positive rate will rise. This means that the
2509 measured rate for very fast senders can bogusly drop off after a while.
2510
2511 At twice the limit, the fpr is 2.5% or 1 in 40
2512 At four times the limit, it is 31% or 1 in 3.2
2513
2514 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2515 decay below the limit, and if this is more than one then the Bloom filter
2516 will be discarded before the decay gets that far. The false positive rate
2517 at this threshold is 9.3% or 1 in 10.7. */
2518
2519 BOOL seen;
2520 unsigned n, hash, hinc;
2521 uschar md5sum[16];
2522 md5 md5info;
2523
2524 /* Instead of using eight independent hash values, we combine two values
2525 using the formula h1 + n * h2. This does not harm the Bloom filter's
2526 performance, and means the amount of hash we need is independent of the
2527 number of bits we set in the filter. */
2528
2529 md5_start(&md5info);
2530 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2531 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2532 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2533
2534 /* Scan the bits corresponding to this event. A zero bit means we have
2535 not seen it before. Ensure all bits are set to record this event. */
2536
2537 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2538
2539 seen = TRUE;
2540 for (n = 0; n < 8; n++, hash += hinc)
2541 {
2542 int bit = 1 << (hash % 8);
2543 int byte = (hash / 8) % dbdb->bloom_size;
2544 if ((dbdb->bloom[byte] & bit) == 0)
2545 {
2546 dbdb->bloom[byte] |= bit;
2547 seen = FALSE;
2548 }
2549 }
2550
2551 /* If this event has occurred before, do not count it. */
2552
2553 if (seen)
2554 {
2555 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2556 count = 0.0;
2557 }
2558 else
2559 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2560 }
2561
2562 /* If there was no previous ratelimit data block for this key, initialize
2563 the new one, otherwise update the block from the database. The initial rate
2564 is what would be computed by the code below for an infinite interval. */
2565
2566 if (dbd == NULL)
2567 {
2568 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2569 dbd = &dbdb->dbd;
2570 dbd->time_stamp = tv.tv_sec;
2571 dbd->time_usec = tv.tv_usec;
2572 dbd->rate = count;
2573 }
2574 else
2575 {
2576 /* The smoothed rate is computed using an exponentially weighted moving
2577 average adjusted for variable sampling intervals. The standard EWMA for
2578 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2579 where f() is the measured value and f'() is the smoothed value.
2580
2581 Old data decays out of the smoothed value exponentially, such that data n
2582 samples old is multiplied by a^n. The exponential decay time constant p
2583 is defined such that data p samples old is multiplied by 1/e, which means
2584 that a = exp(-1/p). We can maintain the same time constant for a variable
2585 sampling interval i by using a = exp(-i/p).
2586
2587 The rate we are measuring is messages per period, suitable for directly
2588 comparing with the limit. The average rate between now and the previous
2589 message is period / interval, which we feed into the EWMA as the sample.
2590
2591 It turns out that the number of messages required for the smoothed rate
2592 to reach the limit when they are sent in a burst is equal to the limit.
2593 This can be seen by analysing the value of the smoothed rate after N
2594 messages sent at even intervals. Let k = (1 - a) * p/i
2595
2596 rate_1 = (1 - a) * p/i + a * rate_0
2597 = k + a * rate_0
2598 rate_2 = k + a * rate_1
2599 = k + a * k + a^2 * rate_0
2600 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2601 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2602 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2603 = rate_0 * a^N + p/i * (1 - a^N)
2604
2605 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2606
2607 rate_N = p/i + (rate_0 - p/i) * a^N
2608 a^N = (rate_N - p/i) / (rate_0 - p/i)
2609 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2610 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2611
2612 Numerical analysis of the above equation, setting the computed rate to
2613 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2614 rates, p/i, the number of messages N = limit. So limit serves as both the
2615 maximum rate measured in messages per period, and the maximum number of
2616 messages that can be sent in a fast burst. */
2617
2618 double this_time = (double)tv.tv_sec
2619 + (double)tv.tv_usec / 1000000.0;
2620 double prev_time = (double)dbd->time_stamp
2621 + (double)dbd->time_usec / 1000000.0;
2622
2623 /* We must avoid division by zero, and deal gracefully with the clock going
2624 backwards. If we blunder ahead when time is in reverse then the computed
2625 rate will be bogus. To be safe we clamp interval to a very small number. */
2626
2627 double interval = this_time - prev_time <= 0.0 ? 1e-9
2628 : this_time - prev_time;
2629
2630 double i_over_p = interval / period;
2631 double a = exp(-i_over_p);
2632
2633 /* Combine the instantaneous rate (period / interval) with the previous rate
2634 using the smoothing factor a. In order to measure sized events, multiply the
2635 instantaneous rate by the count of bytes or recipients etc. */
2636
2637 dbd->time_stamp = tv.tv_sec;
2638 dbd->time_usec = tv.tv_usec;
2639 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2640
2641 /* When events are very widely spaced the computed rate tends towards zero.
2642 Although this is accurate it turns out not to be useful for our purposes,
2643 especially when the first event after a long silence is the start of a spam
2644 run. A more useful model is that the rate for an isolated event should be the
2645 size of the event per the period size, ignoring the lack of events outside
2646 the current period and regardless of where the event falls in the period. So,
2647 if the interval was so long that the calculated rate is unhelpfully small, we
2648 re-initialize the rate. In the absence of higher-rate bursts, the condition
2649 below is true if the interval is greater than the period. */
2650
2651 if (dbd->rate < count) dbd->rate = count;
2652 }
2653
2654 /* Clients sending at the limit are considered to be over the limit.
2655 This matters for edge cases such as a limit of zero, when the client
2656 should be completely blocked. */
2657
2658 rc = (dbd->rate < limit)? FAIL : OK;
2659
2660 /* Update the state if the rate is low or if we are being strict. If we
2661 are in leaky mode and the sender's rate is too high, we do not update
2662 the recorded rate in order to avoid an over-aggressive sender's retry
2663 rate preventing them from getting any email through. If readonly is set,
2664 neither leaky nor strict are set, so we do not do any updates. */
2665
2666 if ((rc == FAIL && leaky) || strict)
2667 {
2668 dbfn_write(dbm, key, dbdb, dbdb_size);
2669 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2670 }
2671 else
2672 {
2673 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2674 readonly? "readonly mode" : "over the limit, but leaky");
2675 }
2676
2677 dbfn_close(dbm);
2678
2679 /* Store the result in the tree for future reference. */
2680
2681 t = store_get(sizeof(tree_node) + Ustrlen(key));
2682 t->data.ptr = dbd;
2683 Ustrcpy(t->name, key);
2684 (void)tree_insertnode(anchor, t);
2685
2686 /* We create the formatted version of the sender's rate very late in
2687 order to ensure that it is done using the correct storage pool. */
2688
2689 store_pool = old_pool;
2690 sender_rate = string_sprintf("%.1f", dbd->rate);
2691
2692 HDEBUG(D_acl)
2693 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2694
2695 return rc;
2696 }
2697
2698
2699
2700 /*************************************************
2701 * The udpsend ACL modifier *
2702 *************************************************/
2703
2704 /* Called by acl_check_condition() below.
2705
2706 Arguments:
2707 arg the option string for udpsend=
2708 log_msgptr for error messages
2709
2710 Returns: OK - Completed.
2711 DEFER - Problem with DNS lookup.
2712 ERROR - Syntax error in options.
2713 */
2714
2715 static int
2716 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2717 {
2718 int sep = 0;
2719 uschar *hostname;
2720 uschar *portstr;
2721 uschar *portend;
2722 host_item *h;
2723 int portnum;
2724 int len;
2725 int r, s;
2726 uschar * errstr;
2727
2728 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2729 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2730
2731 if (!hostname)
2732 {
2733 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2734 return ERROR;
2735 }
2736 if (!portstr)
2737 {
2738 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2739 return ERROR;
2740 }
2741 if (!arg)
2742 {
2743 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2744 return ERROR;
2745 }
2746 portnum = Ustrtol(portstr, &portend, 10);
2747 if (*portend != '\0')
2748 {
2749 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2750 return ERROR;
2751 }
2752
2753 /* Make a single-item host list. */
2754 h = store_get(sizeof(host_item));
2755 memset(h, 0, sizeof(host_item));
2756 h->name = hostname;
2757 h->port = portnum;
2758 h->mx = MX_NONE;
2759
2760 if (string_is_ip_address(hostname, NULL))
2761 h->address = hostname, r = HOST_FOUND;
2762 else
2763 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2764 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2765 {
2766 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2767 return DEFER;
2768 }
2769
2770 HDEBUG(D_acl)
2771 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2772
2773 /*XXX this could better use sendto */
2774 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2775 1, NULL, &errstr, NULL);
2776 if (r < 0) goto defer;
2777 len = Ustrlen(arg);
2778 r = send(s, arg, len, 0);
2779 if (r < 0)
2780 {
2781 errstr = US strerror(errno);
2782 close(s);
2783 goto defer;
2784 }
2785 close(s);
2786 if (r < len)
2787 {
2788 *log_msgptr =
2789 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2790 return DEFER;
2791 }
2792
2793 HDEBUG(D_acl)
2794 debug_printf_indent("udpsend %d bytes\n", r);
2795
2796 return OK;
2797
2798 defer:
2799 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2800 return DEFER;
2801 }
2802
2803
2804
2805 /*************************************************
2806 * Handle conditions/modifiers on an ACL item *
2807 *************************************************/
2808
2809 /* Called from acl_check() below.
2810
2811 Arguments:
2812 verb ACL verb
2813 cb ACL condition block - if NULL, result is OK
2814 where where called from
2815 addr the address being checked for RCPT, or NULL
2816 level the nesting level
2817 epp pointer to pass back TRUE if "endpass" encountered
2818 (applies only to "accept" and "discard")
2819 user_msgptr user message pointer
2820 log_msgptr log message pointer
2821 basic_errno pointer to where to put verify error
2822
2823 Returns: OK - all conditions are met
2824 DISCARD - an "acl" condition returned DISCARD - only allowed
2825 for "accept" or "discard" verbs
2826 FAIL - at least one condition fails
2827 FAIL_DROP - an "acl" condition returned FAIL_DROP
2828 DEFER - can't tell at the moment (typically, lookup defer,
2829 but can be temporary callout problem)
2830 ERROR - ERROR from nested ACL or expansion failure or other
2831 error
2832 */
2833
2834 static int
2835 acl_check_condition(int verb, acl_condition_block *cb, int where,
2836 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2837 uschar **log_msgptr, int *basic_errno)
2838 {
2839 uschar *user_message = NULL;
2840 uschar *log_message = NULL;
2841 int rc = OK;
2842 #ifdef WITH_CONTENT_SCAN
2843 int sep = -'/';
2844 #endif
2845
2846 for (; cb != NULL; cb = cb->next)
2847 {
2848 const uschar *arg;
2849 int control_type;
2850
2851 /* The message and log_message items set up messages to be used in
2852 case of rejection. They are expanded later. */
2853
2854 if (cb->type == ACLC_MESSAGE)
2855 {
2856 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2857 user_message = cb->arg;
2858 continue;
2859 }
2860
2861 if (cb->type == ACLC_LOG_MESSAGE)
2862 {
2863 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2864 log_message = cb->arg;
2865 continue;
2866 }
2867
2868 /* The endpass "condition" just sets a flag to show it occurred. This is
2869 checked at compile time to be on an "accept" or "discard" item. */
2870
2871 if (cb->type == ACLC_ENDPASS)
2872 {
2873 *epp = TRUE;
2874 continue;
2875 }
2876
2877 /* For other conditions and modifiers, the argument is expanded now for some
2878 of them, but not for all, because expansion happens down in some lower level
2879 checking functions in some cases. */
2880
2881 if (!conditions[cb->type].expand_at_top)
2882 arg = cb->arg;
2883 else if (!(arg = expand_string(cb->arg)))
2884 {
2885 if (expand_string_forcedfail) continue;
2886 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2887 cb->arg, expand_string_message);
2888 return search_find_defer ? DEFER : ERROR;
2889 }
2890
2891 /* Show condition, and expanded condition if it's different */
2892
2893 HDEBUG(D_acl)
2894 {
2895 int lhswidth = 0;
2896 debug_printf_indent("check %s%s %n",
2897 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2898 conditions[cb->type].name, &lhswidth);
2899
2900 if (cb->type == ACLC_SET)
2901 {
2902 debug_printf("acl_%s ", cb->u.varname);
2903 lhswidth += 5 + Ustrlen(cb->u.varname);
2904 }
2905
2906 debug_printf("= %s\n", cb->arg);
2907
2908 if (arg != cb->arg)
2909 debug_printf("%.*s= %s\n", lhswidth,
2910 US" ", CS arg);
2911 }
2912
2913 /* Check that this condition makes sense at this time */
2914
2915 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2916 {
2917 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2918 conditions[cb->type].is_modifier ? "use" : "test",
2919 conditions[cb->type].name, acl_wherenames[where]);
2920 return ERROR;
2921 }
2922
2923 /* Run the appropriate test for each condition, or take the appropriate
2924 action for the remaining modifiers. */
2925
2926 switch(cb->type)
2927 {
2928 case ACLC_ADD_HEADER:
2929 setup_header(arg);
2930 break;
2931
2932 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2933 "discard" verb. */
2934
2935 case ACLC_ACL:
2936 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2937 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2938 {
2939 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2940 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2941 verbs[verb]);
2942 return ERROR;
2943 }
2944 break;
2945
2946 case ACLC_AUTHENTICATED:
2947 rc = (sender_host_authenticated == NULL)? FAIL :
2948 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2949 TRUE, NULL);
2950 break;
2951
2952 #ifdef EXPERIMENTAL_BRIGHTMAIL
2953 case ACLC_BMI_OPTIN:
2954 {
2955 int old_pool = store_pool;
2956 store_pool = POOL_PERM;
2957 bmi_current_optin = string_copy(arg);
2958 store_pool = old_pool;
2959 }
2960 break;
2961 #endif
2962
2963 case ACLC_CONDITION:
2964 /* The true/false parsing here should be kept in sync with that used in
2965 expand.c when dealing with ECOND_BOOL so that we don't have too many
2966 different definitions of what can be a boolean. */
2967 if (*arg == '-'
2968 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2969 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2970 rc = (Uatoi(arg) == 0)? FAIL : OK;
2971 else
2972 rc = (strcmpic(arg, US"no") == 0 ||
2973 strcmpic(arg, US"false") == 0)? FAIL :
2974 (strcmpic(arg, US"yes") == 0 ||
2975 strcmpic(arg, US"true") == 0)? OK : DEFER;
2976 if (rc == DEFER)
2977 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2978 break;
2979
2980 case ACLC_CONTINUE: /* Always succeeds */
2981 break;
2982
2983 case ACLC_CONTROL:
2984 {
2985 const uschar *p = NULL;
2986 control_type = decode_control(arg, &p, where, log_msgptr);
2987
2988 /* Check if this control makes sense at this time */
2989
2990 if (controls_list[control_type].forbids & (1 << where))
2991 {
2992 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2993 controls_list[control_type].name, acl_wherenames[where]);
2994 return ERROR;
2995 }
2996
2997 switch(control_type)
2998 {
2999 case CONTROL_AUTH_UNADVERTISED:
3000 allow_auth_unadvertised = TRUE;
3001 break;
3002
3003 #ifdef EXPERIMENTAL_BRIGHTMAIL
3004 case CONTROL_BMI_RUN:
3005 bmi_run = 1;
3006 break;
3007 #endif
3008
3009 #ifndef DISABLE_DKIM
3010 case CONTROL_DKIM_VERIFY:
3011 dkim_disable_verify = TRUE;
3012 #ifdef EXPERIMENTAL_DMARC
3013 /* Since DKIM was blocked, skip DMARC too */
3014 dmarc_disable_verify = TRUE;
3015 dmarc_enable_forensic = FALSE;
3016 #endif
3017 break;
3018 #endif
3019
3020 #ifdef EXPERIMENTAL_DMARC
3021 case CONTROL_DMARC_VERIFY:
3022 dmarc_disable_verify = TRUE;
3023 break;
3024
3025 case CONTROL_DMARC_FORENSIC:
3026 dmarc_enable_forensic = TRUE;
3027 break;
3028 #endif
3029
3030 case CONTROL_DSCP:
3031 if (*p == '/')
3032 {
3033 int fd, af, level, optname, value;
3034 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3035 a socket; we can accept that, we'll just debug-log failures anyway. */
3036 fd = fileno(smtp_in);
3037 af = ip_get_address_family(fd);
3038 if (af < 0)
3039 {
3040 HDEBUG(D_acl)
3041 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3042 strerror(errno));
3043 break;
3044 }
3045 if (dscp_lookup(p+1, af, &level, &optname, &value))
3046 {
3047 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3048 {
3049 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3050 p+1, strerror(errno));
3051 }
3052 else
3053 {
3054 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3055 }
3056 }
3057 else
3058 {
3059 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3060 return ERROR;
3061 }
3062 }
3063 else
3064 {
3065 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3066 return ERROR;
3067 }
3068 break;
3069
3070 case CONTROL_ERROR:
3071 return ERROR;
3072
3073 case CONTROL_CASEFUL_LOCAL_PART:
3074 deliver_localpart = addr->cc_local_part;
3075 break;
3076
3077 case CONTROL_CASELOWER_LOCAL_PART:
3078 deliver_localpart = addr->lc_local_part;
3079 break;
3080
3081 case CONTROL_ENFORCE_SYNC:
3082 smtp_enforce_sync = TRUE;
3083 break;
3084
3085 case CONTROL_NO_ENFORCE_SYNC:
3086 smtp_enforce_sync = FALSE;
3087 break;
3088
3089 #ifdef WITH_CONTENT_SCAN
3090 case CONTROL_NO_MBOX_UNSPOOL:
3091 no_mbox_unspool = TRUE;
3092 break;
3093 #endif
3094
3095 case CONTROL_NO_MULTILINE:
3096 no_multiline_responses = TRUE;
3097 break;
3098
3099 case CONTROL_NO_PIPELINING:
3100 pipelining_enable = FALSE;
3101 break;
3102
3103 case CONTROL_NO_DELAY_FLUSH:
3104 disable_delay_flush = TRUE;
3105 break;
3106
3107 case CONTROL_NO_CALLOUT_FLUSH:
3108 disable_callout_flush = TRUE;
3109 break;
3110
3111 case CONTROL_FAKEREJECT:
3112 cancel_cutthrough_connection(TRUE, US"fakereject");
3113 case CONTROL_FAKEDEFER:
3114 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3115 if (*p == '/')
3116 {
3117 const uschar *pp = p + 1;
3118 while (*pp != 0) pp++;
3119 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3120 p = pp;
3121 }
3122 else
3123 {
3124 /* Explicitly reset to default string */
3125 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3126 }
3127 break;
3128
3129 case CONTROL_FREEZE:
3130 deliver_freeze = TRUE;
3131 deliver_frozen_at = time(NULL);
3132 freeze_tell = freeze_tell_config; /* Reset to configured value */
3133 if (Ustrncmp(p, "/no_tell", 8) == 0)
3134 {
3135 p += 8;
3136 freeze_tell = NULL;
3137 }
3138 if (*p != 0)
3139 {
3140 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3141 return ERROR;
3142 }
3143 cancel_cutthrough_connection(TRUE, US"item frozen");
3144 break;
3145
3146 case CONTROL_QUEUE_ONLY:
3147 queue_only_policy = TRUE;
3148 cancel_cutthrough_connection(TRUE, US"queueing forced");
3149 break;
3150
3151 case CONTROL_SUBMISSION:
3152 originator_name = US"";
3153 submission_mode = TRUE;
3154 while (*p == '/')
3155 {
3156 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3157 {
3158 p += 14;
3159 active_local_sender_retain = TRUE;
3160 active_local_from_check = FALSE;
3161 }
3162 else if (Ustrncmp(p, "/domain=", 8) == 0)
3163 {
3164 const uschar *pp = p + 8;
3165 while (*pp != 0 && *pp != '/') pp++;
3166 submission_domain = string_copyn(p+8, pp-p-8);
3167 p = pp;
3168 }
3169 /* The name= option must be last, because it swallows the rest of
3170 the string. */
3171 else if (Ustrncmp(p, "/name=", 6) == 0)
3172 {
3173 const uschar *pp = p + 6;
3174 while (*pp != 0) pp++;
3175 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3176 big_buffer, big_buffer_size));
3177 p = pp;
3178 }
3179 else break;
3180 }
3181 if (*p != 0)
3182 {
3183 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3184 return ERROR;
3185 }
3186 break;
3187
3188 case CONTROL_DEBUG:
3189 {
3190 uschar * debug_tag = NULL;
3191 uschar * debug_opts = NULL;
3192 BOOL kill = FALSE;
3193
3194 while (*p == '/')
3195 {
3196 const uschar * pp = p+1;
3197 if (Ustrncmp(pp, "tag=", 4) == 0)
3198 {
3199 for (pp += 4; *pp && *pp != '/';) pp++;
3200 debug_tag = string_copyn(p+5, pp-p-5);
3201 }
3202 else if (Ustrncmp(pp, "opts=", 5) == 0)
3203 {
3204 for (pp += 5; *pp && *pp != '/';) pp++;
3205 debug_opts = string_copyn(p+6, pp-p-6);
3206 }
3207 else if (Ustrncmp(pp, "kill", 4) == 0)
3208 {
3209 for (pp += 4; *pp && *pp != '/';) pp++;
3210 kill = TRUE;
3211 }
3212 else
3213 while (*pp && *pp != '/') pp++;
3214 p = pp;
3215 }
3216
3217 if (kill)
3218 debug_logging_stop();
3219 else
3220 debug_logging_activate(debug_tag, debug_opts);
3221 }
3222 break;
3223
3224 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3225 suppress_local_fixups = TRUE;
3226 break;
3227
3228 case CONTROL_CUTTHROUGH_DELIVERY:
3229 #ifndef DISABLE_PRDR
3230 if (prdr_requested)
3231 #else
3232 if (0)
3233 #endif
3234 /* Too hard to think about for now. We might in future cutthrough
3235 the case where both sides handle prdr and this-node prdr acl
3236 is "accept" */
3237 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
3238 else
3239 {
3240 if (deliver_freeze)
3241 *log_msgptr = US"frozen";
3242 else if (queue_only_policy)
3243 *log_msgptr = US"queue-only";
3244 else if (fake_response == FAIL)
3245 *log_msgptr = US"fakereject";
3246 else
3247 {
3248 if (rcpt_count == 1)
3249 {
3250 cutthrough.delivery = TRUE;
3251 while (*p == '/')
3252 {
3253 const uschar * pp = p+1;
3254 if (Ustrncmp(pp, "defer=", 6) == 0)
3255 {
3256 pp += 6;
3257 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3258 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3259 }
3260 else
3261 while (*pp && *pp != '/') pp++;
3262 p = pp;
3263 }
3264 }
3265 break;
3266 }
3267 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3268 arg, *log_msgptr);
3269 }
3270 return ERROR;
3271
3272 #ifdef SUPPORT_I18N
3273 case CONTROL_UTF8_DOWNCONVERT:
3274 if (*p == '/')
3275 {
3276 if (p[1] == '1')
3277 {
3278 message_utf8_downconvert = 1;
3279 addr->prop.utf8_downcvt = TRUE;
3280 addr->prop.utf8_downcvt_maybe = FALSE;
3281 p += 2;
3282 break;
3283 }
3284 if (p[1] == '0')
3285 {
3286 message_utf8_downconvert = 0;
3287 addr->prop.utf8_downcvt = FALSE;
3288 addr->prop.utf8_downcvt_maybe = FALSE;
3289 p += 2;
3290 break;
3291 }
3292 if (p[1] == '-' && p[2] == '1')
3293 {
3294 message_utf8_downconvert = -1;
3295 addr->prop.utf8_downcvt = FALSE;
3296 addr->prop.utf8_downcvt_maybe = TRUE;
3297 p += 3;
3298 break;
3299 }
3300 *log_msgptr = US"bad option value for control=utf8_downconvert";
3301 }
3302 else
3303 {
3304 message_utf8_downconvert = 1;
3305 addr->prop.utf8_downcvt = TRUE;
3306 addr->prop.utf8_downcvt_maybe = FALSE;
3307 break;
3308 }
3309 return ERROR;
3310 #endif
3311
3312 }
3313 break;
3314 }
3315
3316 #ifdef EXPERIMENTAL_DCC
3317 case ACLC_DCC:
3318 {
3319 /* Separate the regular expression and any optional parameters. */
3320 const uschar * list = arg;
3321 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3322 /* Run the dcc backend. */
3323 rc = dcc_process(&ss);
3324 /* Modify return code based upon the existence of options. */
3325 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3326 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3327 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3328 }
3329 break;
3330 #endif
3331
3332 #ifdef WITH_CONTENT_SCAN
3333 case ACLC_DECODE:
3334 rc = mime_decode(&arg);
3335 break;
3336 #endif
3337
3338 case ACLC_DELAY:
3339 {
3340 int delay = readconf_readtime(arg, 0, FALSE);
3341 if (delay < 0)
3342 {
3343 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3344 "modifier: \"%s\" is not a time value", arg);
3345 return ERROR;
3346 }
3347 else
3348 {
3349 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3350 delay);
3351 if (host_checking)
3352 {
3353 HDEBUG(D_acl)
3354 debug_printf_indent("delay skipped in -bh checking mode\n");
3355 }
3356
3357 /* NOTE 1: Remember that we may be
3358 dealing with stdin/stdout here, in addition to TCP/IP connections.
3359 Also, delays may be specified for non-SMTP input, where smtp_out and
3360 smtp_in will be NULL. Whatever is done must work in all cases.
3361
3362 NOTE 2: The added feature of flushing the output before a delay must
3363 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3364 */
3365
3366 else
3367 {
3368 if (smtp_out != NULL && !disable_delay_flush)
3369 mac_smtp_fflush();
3370
3371 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3372 {
3373 struct pollfd p;
3374 nfds_t n = 0;
3375 if (smtp_out)
3376 {
3377 p.fd = fileno(smtp_out);
3378 p.events = POLLRDHUP;
3379 n = 1;
3380 }
3381 if (poll(&p, n, delay*1000) > 0)
3382 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3383 }
3384 #else
3385 /* It appears to be impossible to detect that a TCP/IP connection has
3386 gone away without reading from it. This means that we cannot shorten
3387 the delay below if the client goes away, because we cannot discover
3388 that the client has closed its end of the connection. (The connection
3389 is actually in a half-closed state, waiting for the server to close its
3390 end.) It would be nice to be able to detect this state, so that the
3391 Exim process is not held up unnecessarily. However, it seems that we
3392 can't. The poll() function does not do the right thing, and in any case
3393 it is not always available.
3394 */
3395
3396 while (delay > 0) delay = sleep(delay);
3397 #endif
3398 }
3399 }
3400 }
3401 break;
3402
3403 #ifndef DISABLE_DKIM
3404 case ACLC_DKIM_SIGNER:
3405 if (dkim_cur_signer != NULL)
3406 rc = match_isinlist(dkim_cur_signer,
3407 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3408 else
3409 rc = FAIL;
3410 break;
3411
3412 case ACLC_DKIM_STATUS:
3413 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3414 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3415 break;
3416 #endif
3417
3418 #ifdef EXPERIMENTAL_DMARC
3419 case ACLC_DMARC_STATUS:
3420 if (!dmarc_has_been_checked)
3421 dmarc_process();
3422 dmarc_has_been_checked = TRUE;
3423 /* used long way of dmarc_exim_expand_query() in case we need more
3424 * view into the process in the future. */
3425 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3426 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3427 break;
3428 #endif
3429
3430 case ACLC_DNSLISTS:
3431 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3432 break;
3433
3434 case ACLC_DOMAINS:
3435 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3436 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3437 break;
3438
3439 /* The value in tls_cipher is the full cipher name, for example,
3440 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3441 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3442 what may in practice come out of the SSL library - which at the time of
3443 writing is poorly documented. */
3444
3445 case ACLC_ENCRYPTED:
3446 if (tls_in.cipher == NULL) rc = FAIL; else
3447 {
3448 uschar *endcipher = NULL;
3449 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3450 if (cipher == NULL) cipher = tls_in.cipher; else
3451 {
3452 endcipher = Ustrchr(++cipher, ':');
3453 if (endcipher != NULL) *endcipher = 0;
3454 }
3455 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3456 if (endcipher != NULL) *endcipher = ':';
3457 }
3458 break;
3459
3460 /* Use verify_check_this_host() instead of verify_check_host() so that
3461 we can pass over &host_data to catch any looked up data. Once it has been
3462 set, it retains its value so that it's still there if another ACL verb
3463 comes through here and uses the cache. However, we must put it into
3464 permanent store in case it is also expected to be used in a subsequent
3465 message in the same SMTP connection. */
3466
3467 case ACLC_HOSTS:
3468 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3469 (sender_host_address == NULL)? US"" : sender_host_address,
3470 CUSS &host_data);
3471 if (rc == DEFER) *log_msgptr = search_error_message;
3472 if (host_data) host_data = string_copy_malloc(host_data);
3473 break;
3474
3475 case ACLC_LOCAL_PARTS:
3476 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3477 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3478 CUSS &deliver_localpart_data);
3479 break;
3480
3481 case ACLC_LOG_REJECT_TARGET:
3482 {
3483 int logbits = 0;
3484 int sep = 0;
3485 const uschar *s = arg;
3486 uschar *ss;
3487 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
3488 {
3489 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3490 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3491 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3492 else
3493 {
3494 logbits |= LOG_MAIN|LOG_REJECT;
3495 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3496 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3497 }
3498 }
3499 log_reject_target = logbits;
3500 }
3501 break;
3502
3503 case ACLC_LOGWRITE:
3504 {
3505 int logbits = 0;
3506 const uschar *s = arg;
3507 if (*s == ':')
3508 {
3509 s++;
3510 while (*s != ':')
3511 {
3512 if (Ustrncmp(s, "main", 4) == 0)
3513 { logbits |= LOG_MAIN; s += 4; }
3514 else if (Ustrncmp(s, "panic", 5) == 0)
3515 { logbits |= LOG_PANIC; s += 5; }
3516 else if (Ustrncmp(s, "reject", 6) == 0)
3517 { logbits |= LOG_REJECT; s += 6; }
3518 else
3519 {
3520 logbits = LOG_MAIN|LOG_PANIC;
3521 s = string_sprintf(":unknown log name in \"%s\" in "
3522 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3523 }
3524 if (*s == ',') s++;
3525 }
3526 s++;
3527 }
3528 while (isspace(*s)) s++;
3529
3530
3531 if (logbits == 0) logbits = LOG_MAIN;
3532 log_write(0, logbits, "%s", string_printing(s));
3533 }
3534 break;
3535
3536 #ifdef WITH_CONTENT_SCAN
3537 case ACLC_MALWARE: /* Run the malware backend. */
3538 {
3539 /* Separate the regular expression and any optional parameters. */
3540 const uschar * list = arg;
3541 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3542 uschar *opt;
3543 BOOL defer_ok = FALSE;
3544 int timeout = 0;
3545
3546 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3547 if (strcmpic(opt, US"defer_ok") == 0)
3548 defer_ok = TRUE;
3549 else if ( strncmpic(opt, US"tmo=", 4) == 0
3550 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3551 )
3552 {
3553 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3554 return ERROR;
3555 }
3556
3557 rc = malware(ss, timeout);
3558 if (rc == DEFER && defer_ok)
3559 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3560 }
3561 break;
3562
3563 case ACLC_MIME_REGEX:
3564 rc = mime_regex(&arg);
3565 break;
3566 #endif
3567
3568 case ACLC_QUEUE:
3569 queue_name = string_copy_malloc(arg);
3570 break;
3571
3572 case ACLC_RATELIMIT:
3573 rc = acl_ratelimit(arg, where, log_msgptr);
3574 break;
3575
3576 case ACLC_RECIPIENTS:
3577 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3578 CUSS &recipient_data);
3579 break;
3580
3581 #ifdef WITH_CONTENT_SCAN
3582 case ACLC_REGEX:
3583 rc = regex(&arg);
3584 break;
3585 #endif
3586
3587 case ACLC_REMOVE_HEADER:
3588 setup_remove_header(arg);
3589 break;
3590
3591 case ACLC_SENDER_DOMAINS:
3592 {
3593 uschar *sdomain;
3594 sdomain = Ustrrchr(sender_address, '@');
3595 sdomain = sdomain ? sdomain + 1 : US"";
3596 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3597 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3598 }
3599 break;
3600
3601 case ACLC_SENDERS:
3602 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3603 sender_address_cache, -1, 0, CUSS &sender_data);
3604 break;
3605
3606 /* Connection variables must persist forever */
3607
3608 case ACLC_SET:
3609 {
3610 int old_pool = store_pool;
3611 if ( cb->u.varname[0] == 'c'
3612 #ifndef DISABLE_EVENT
3613 || event_name /* An event is being delivered */
3614 #endif
3615 )
3616 store_pool = POOL_PERM;
3617 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3618 store_pool = old_pool;
3619 }
3620 break;
3621
3622 #ifdef WITH_CONTENT_SCAN
3623 case ACLC_SPAM:
3624 {
3625 /* Separate the regular expression and any optional parameters. */
3626 const uschar * list = arg;
3627 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3628 /* Run the spam backend. */
3629 rc = spam(CUSS &ss);
3630 /* Modify return code based upon the existence of options. */
3631 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
3632 != NULL) {
3633 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3634 {
3635 /* FAIL so that the message is passed to the next ACL */
3636 rc = FAIL;
3637 }
3638 }
3639 }
3640 break;
3641 #endif
3642
3643 #ifdef EXPERIMENTAL_SPF
3644 case ACLC_SPF:
3645 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3646 break;
3647 case ACLC_SPF_GUESS:
3648 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3649 break;
3650 #endif
3651
3652 case ACLC_UDPSEND:
3653 rc = acl_udpsend(arg, log_msgptr);
3654 break;
3655
3656 /* If the verb is WARN, discard any user message from verification, because
3657 such messages are SMTP responses, not header additions. The latter come
3658 only from explicit "message" modifiers. However, put the user message into
3659 $acl_verify_message so it can be used in subsequent conditions or modifiers
3660 (until something changes it). */
3661
3662 case ACLC_VERIFY:
3663 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3664 if (*user_msgptr)
3665 acl_verify_message = *user_msgptr;
3666 if (verb == ACL_WARN) *user_msgptr = NULL;
3667 break;
3668
3669 default:
3670 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3671 "condition %d", cb->type);
3672 break;
3673 }
3674
3675 /* If a condition was negated, invert OK/FAIL. */
3676
3677 if (!conditions[cb->type].is_modifier && cb->u.negated)
3678 if (rc == OK) rc = FAIL;
3679 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3680
3681 if (rc != OK) break; /* Conditions loop */
3682 }
3683
3684
3685 /* If the result is the one for which "message" and/or "log_message" are used,
3686 handle the values of these modifiers. If there isn't a log message set, we make
3687 it the same as the user message.
3688
3689 "message" is a user message that will be included in an SMTP response. Unless
3690 it is empty, it overrides any previously set user message.
3691
3692 "log_message" is a non-user message, and it adds to any existing non-user
3693 message that is already set.
3694
3695 Most verbs have but a single return for which the messages are relevant, but
3696 for "discard", it's useful to have the log message both when it succeeds and
3697 when it fails. For "accept", the message is used in the OK case if there is no
3698 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3699 present. */
3700
3701 if (*epp && rc == OK) user_message = NULL;
3702
3703 if (((1<<rc) & msgcond[verb]) != 0)
3704 {
3705 uschar *expmessage;
3706 uschar *old_user_msgptr = *user_msgptr;
3707 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3708
3709 /* If the verb is "warn", messages generated by conditions (verification or
3710 nested ACLs) are always discarded. This also happens for acceptance verbs
3711 when they actually do accept. Only messages specified at this level are used.
3712 However, the value of an existing message is available in $acl_verify_message
3713 during expansions. */
3714
3715 if (verb == ACL_WARN ||
3716 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3717 *log_msgptr = *user_msgptr = NULL;
3718
3719 if (user_message != NULL)
3720 {
3721 acl_verify_message = old_user_msgptr;
3722 expmessage = expand_string(user_message);
3723 if (expmessage == NULL)
3724 {
3725 if (!expand_string_forcedfail)
3726 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3727 user_message, expand_string_message);
3728 }
3729 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3730 }
3731
3732 if (log_message != NULL)
3733 {
3734 acl_verify_message = old_log_msgptr;
3735 expmessage = expand_string(log_message);
3736 if (expmessage == NULL)
3737 {
3738 if (!expand_string_forcedfail)
3739 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3740 log_message, expand_string_message);
3741 }
3742 else if (expmessage[0] != 0)
3743 {
3744 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3745 string_sprintf("%s: %s", expmessage, *log_msgptr);
3746 }
3747 }
3748
3749 /* If no log message, default it to the user message */
3750
3751 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3752 }
3753
3754 acl_verify_message = NULL;
3755 return rc;
3756 }
3757
3758
3759
3760
3761
3762 /*************************************************
3763 * Get line from a literal ACL *
3764 *************************************************/
3765
3766 /* This function is passed to acl_read() in order to extract individual lines
3767 of a literal ACL, which we access via static pointers. We can destroy the
3768 contents because this is called only once (the compiled ACL is remembered).
3769
3770 This code is intended to treat the data in the same way as lines in the main
3771 Exim configuration file. That is:
3772
3773 . Leading spaces are ignored.
3774
3775 . A \ at the end of a line is a continuation - trailing spaces after the \
3776 are permitted (this is because I don't believe in making invisible things
3777 significant). Leading spaces on the continued part of a line are ignored.
3778
3779 . Physical lines starting (significantly) with # are totally ignored, and
3780 may appear within a sequence of backslash-continued lines.
3781
3782 . Blank lines are ignored, but will end a sequence of continuations.
3783
3784 Arguments: none
3785 Returns: a pointer to the next line
3786 */
3787
3788
3789 static uschar *acl_text; /* Current pointer in the text */
3790 static uschar *acl_text_end; /* Points one past the terminating '0' */
3791
3792
3793 static uschar *
3794 acl_getline(void)
3795 {
3796 uschar *yield;
3797
3798 /* This loop handles leading blank lines and comments. */
3799
3800 for(;;)
3801 {
3802 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3803 if (*acl_text == 0) return NULL; /* No more data */
3804 yield = acl_text; /* Potential data line */
3805
3806 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3807
3808 /* If we hit the end before a newline, we have the whole logical line. If
3809 it's a comment, there's no more data to be given. Otherwise, yield it. */
3810
3811 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3812
3813 /* After reaching a newline, end this loop if the physical line does not
3814 start with '#'. If it does, it's a comment, and the loop continues. */
3815
3816 if (*yield != '#') break;
3817 }
3818
3819 /* This loop handles continuations. We know we have some real data, ending in
3820 newline. See if there is a continuation marker at the end (ignoring trailing
3821 white space). We know that *yield is not white space, so no need to test for
3822 cont > yield in the backwards scanning loop. */
3823
3824 for(;;)
3825 {
3826 uschar *cont;
3827 for (cont = acl_text - 1; isspace(*cont); cont--);
3828
3829 /* If no continuation follows, we are done. Mark the end of the line and
3830 return it. */
3831
3832 if (*cont != '\\')
3833 {
3834 *acl_text++ = 0;
3835 return yield;
3836 }
3837
3838 /* We have encountered a continuation. Skip over whitespace at the start of
3839 the next line, and indeed the whole of the next line or lines if they are
3840 comment lines. */
3841
3842 for (;;)
3843 {
3844 while (*(++acl_text) == ' ' || *acl_text == '\t');
3845 if (*acl_text != '#') break;
3846 while (*(++acl_text) != 0 && *acl_text != '\n');
3847 }
3848
3849 /* We have the start of a continuation line. Move all the rest of the data
3850 to join onto the previous line, and then find its end. If the end is not a
3851 newline, we are done. Otherwise loop to look for another continuation. */
3852
3853 memmove(cont, acl_text, acl_text_end - acl_text);
3854 acl_text_end -= acl_text - cont;
3855 acl_text = cont;
3856 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3857 if (*acl_text == 0) return yield;
3858 }
3859
3860 /* Control does not reach here */
3861 }
3862
3863
3864
3865
3866
3867 /*************************************************
3868 * Check access using an ACL *
3869 *************************************************/
3870
3871 /* This function is called from address_check. It may recurse via
3872 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3873 passed as a string which is expanded. A forced failure implies no access check
3874 is required. If the result is a single word, it is taken as the name of an ACL
3875 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3876 text, complete with newlines, and parsed as such. In both cases, the ACL check
3877 is then run. This function uses an auxiliary function for acl_read() to call
3878 for reading individual lines of a literal ACL. This is acl_getline(), which
3879 appears immediately above.
3880
3881 Arguments:
3882 where where called from
3883 addr address item when called from RCPT; otherwise NULL
3884 s the input string; NULL is the same as an empty ACL => DENY
3885 user_msgptr where to put a user error (for SMTP response)
3886 log_msgptr where to put a logging message (not for SMTP response)
3887
3888 Returns: OK access is granted
3889 DISCARD access is apparently granted...
3890 FAIL access is denied
3891 FAIL_DROP access is denied; drop the connection
3892 DEFER can't tell at the moment
3893 ERROR disaster
3894 */
3895
3896 static int
3897 acl_check_internal(int where, address_item *addr, uschar *s,
3898 uschar **user_msgptr, uschar **log_msgptr)
3899 {
3900 int fd = -1;
3901 acl_block *acl = NULL;
3902 uschar *acl_name = US"inline ACL";
3903 uschar *ss;
3904
3905 /* Catch configuration loops */
3906
3907 if (acl_level > 20)
3908 {
3909 *log_msgptr = US"ACL nested too deep: possible loop";
3910 return ERROR;
3911 }
3912
3913 if (!s)
3914 {
3915 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
3916 return FAIL;
3917 }
3918
3919 /* At top level, we expand the incoming string. At lower levels, it has already
3920 been expanded as part of condition processing. */
3921
3922 if (acl_level == 0)
3923 {
3924 if (!(ss = expand_string(s)))
3925 {
3926 if (expand_string_forcedfail) return OK;
3927 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3928 expand_string_message);
3929 return ERROR;
3930 }
3931 }
3932 else ss = s;
3933
3934 while (isspace(*ss)) ss++;
3935
3936 /* If we can't find a named ACL, the default is to parse it as an inline one.
3937 (Unless it begins with a slash; non-existent files give rise to an error.) */
3938
3939 acl_text = ss;
3940
3941 /* Handle the case of a string that does not contain any spaces. Look for a
3942 named ACL among those read from the configuration, or a previously read file.
3943 It is possible that the pointer to the ACL is NULL if the configuration
3944 contains a name with no data. If not found, and the text begins with '/',
3945 read an ACL from a file, and save it so it can be re-used. */
3946
3947 if (Ustrchr(ss, ' ') == NULL)
3948 {
3949 tree_node *t = tree_search(acl_anchor, ss);
3950 if (t != NULL)
3951 {
3952 acl = (acl_block *)(t->data.ptr);
3953 if (acl == NULL)
3954 {
3955 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
3956 return FAIL;
3957 }
3958 acl_name = string_sprintf("ACL \"%s\"", ss);
3959 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
3960 }
3961
3962 else if (*ss == '/')
3963 {
3964 struct stat statbuf;
3965 fd = Uopen(ss, O_RDONLY, 0);
3966 if (fd < 0)
3967 {
3968 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3969 strerror(errno));
3970 return ERROR;
3971 }
3972
3973 if (fstat(fd, &statbuf) != 0)
3974 {
3975 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3976 strerror(errno));
3977 return ERROR;
3978 }
3979
3980 acl_text = store_get(statbuf.st_size + 1);
3981 acl_text_end = acl_text + statbuf.st_size + 1;
3982
3983 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3984 {
3985 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3986 ss, strerror(errno));
3987 return ERROR;
3988 }
3989 acl_text[statbuf.st_size] = 0;
3990 (void)close(fd);
3991
3992 acl_name = string_sprintf("ACL \"%s\"", ss);
3993 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
3994 }
3995 }
3996
3997 /* Parse an ACL that is still in text form. If it came from a file, remember it
3998 in the ACL tree, having read it into the POOL_PERM store pool so that it
3999 persists between multiple messages. */
4000
4001 if (acl == NULL)
4002 {
4003 int old_pool = store_pool;
4004 if (fd >= 0) store_pool = POOL_PERM;
4005 acl = acl_read(acl_getline, log_msgptr);
4006 store_pool = old_pool;
4007 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4008 if (fd >=