Build: probe for broken poll() timing implementation
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef SUPPORT_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
142 #ifndef DISABLE_PRDR
143 ACL_BIT_PRDR |
144 #endif
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
153 },
154 #ifdef EXPERIMENTAL_BRIGHTMAIL
155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
159 # ifndef DISABLE_PRDR
160 ACL_BIT_PRDR |
161 # endif
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
167 },
168 #endif
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
175
176 #ifdef EXPERIMENTAL_DCC
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
179 ~(ACL_BIT_DATA |
180 # ifndef DISABLE_PRDR
181 ACL_BIT_PRDR |
182 # endif
183 ACL_BIT_NOTSMTP),
184 },
185 #endif
186 #ifdef WITH_CONTENT_SCAN
187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
188
189 #endif
190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
191 #ifndef DISABLE_DKIM
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 #endif
195 #ifdef EXPERIMENTAL_DMARC
196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
197 #endif
198
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
202
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
206 #ifndef DISABLE_PRDR
207 |ACL_BIT_PRDR
208 #endif
209 ),
210 },
211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
214 },
215
216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
217
218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
220 },
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
224 #ifndef DISABLE_PRDR
225 | ACL_BIT_PRDR
226 #endif
227 ),
228 },
229
230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
233
234 #ifdef WITH_CONTENT_SCAN
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
237 ~(ACL_BIT_DATA |
238 # ifndef DISABLE_PRDR
239 ACL_BIT_PRDR |
240 # endif
241 ACL_BIT_NOTSMTP),
242 },
243 #endif
244
245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
248 #endif
249
250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
251 ACL_BIT_NOTSMTP |
252 #ifndef DISABLE_PRDR
253 ACL_BIT_PRDR |
254 #endif
255 ACL_BIT_DATA,
256 },
257
258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
260
261 #ifdef WITH_CONTENT_SCAN
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
264 ~(ACL_BIT_DATA |
265 # ifndef DISABLE_PRDR
266 ACL_BIT_PRDR |
267 # endif
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
270 },
271
272 #endif
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
277 #ifndef DISABLE_PRDR
278 ACL_BIT_PRDR |
279 #endif
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
282 },
283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
289 },
290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
296 },
297
298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
299
300 #ifdef WITH_CONTENT_SCAN
301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
302 (unsigned int) ~(ACL_BIT_DATA |
303 # ifndef DISABLE_PRDR
304 ACL_BIT_PRDR |
305 # endif
306 ACL_BIT_NOTSMTP),
307 },
308 #endif
309 #ifdef SUPPORT_SPF
310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
316 },
317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
323 },
324 #endif
325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
326
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
330 };
331
332
333
334 /* Return values from decode_control(); used as index so keep in step
335 with the controls_list table that follows! */
336
337 enum {
338 CONTROL_AUTH_UNADVERTISED,
339 #ifdef EXPERIMENTAL_BRIGHTMAIL
340 CONTROL_BMI_RUN,
341 #endif
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
346 #ifndef DISABLE_DKIM
347 CONTROL_DKIM_VERIFY,
348 #endif
349 #ifdef EXPERIMENTAL_DMARC
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
352 #endif
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
359
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
363 #ifdef WITH_CONTENT_SCAN
364 CONTROL_NO_MBOX_UNSPOOL,
365 #endif
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
368
369 CONTROL_QUEUE_ONLY,
370 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
371 CONTROL_REQUIRETLS,
372 #endif
373 CONTROL_SUBMISSION,
374 CONTROL_SUPPRESS_LOCAL_FIXUPS,
375 #ifdef SUPPORT_I18N
376 CONTROL_UTF8_DOWNCONVERT,
377 #endif
378 };
379
380
381
382 /* Structure listing various control arguments, with their characteristics.
383 For each control, there's a bitmap of dis-allowed times. For some, it is easier
384 to specify the negation of a small number of allowed times. */
385
386 typedef struct control_def {
387 uschar *name;
388 BOOL has_option; /* Has /option(s) following */
389 unsigned forbids; /* bitmap of dis-allowed times */
390 } control_def;
391
392 static control_def controls_list[] = {
393 /* name has_option forbids */
394 [CONTROL_AUTH_UNADVERTISED] =
395 { US"allow_auth_unadvertised", FALSE,
396 (unsigned)
397 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
398 },
399 #ifdef EXPERIMENTAL_BRIGHTMAIL
400 [CONTROL_BMI_RUN] =
401 { US"bmi_run", FALSE, 0 },
402 #endif
403 [CONTROL_CASEFUL_LOCAL_PART] =
404 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
405 [CONTROL_CASELOWER_LOCAL_PART] =
406 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
407 [CONTROL_CUTTHROUGH_DELIVERY] =
408 { US"cutthrough_delivery", TRUE, 0 },
409 [CONTROL_DEBUG] =
410 { US"debug", TRUE, 0 },
411
412 #ifndef DISABLE_DKIM
413 [CONTROL_DKIM_VERIFY] =
414 { US"dkim_disable_verify", FALSE,
415 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
416 # ifndef DISABLE_PRDR
417 ACL_BIT_PRDR |
418 # endif
419 ACL_BIT_NOTSMTP_START
420 },
421 #endif
422
423 #ifdef EXPERIMENTAL_DMARC
424 [CONTROL_DMARC_VERIFY] =
425 { US"dmarc_disable_verify", FALSE,
426 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
427 },
428 [CONTROL_DMARC_FORENSIC] =
429 { US"dmarc_enable_forensic", FALSE,
430 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
431 },
432 #endif
433
434 [CONTROL_DSCP] =
435 { US"dscp", TRUE,
436 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
437 },
438 [CONTROL_ENFORCE_SYNC] =
439 { US"enforce_sync", FALSE,
440 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
441 },
442
443 /* Pseudo-value for decode errors */
444 [CONTROL_ERROR] =
445 { US"error", FALSE, 0 },
446
447 [CONTROL_FAKEDEFER] =
448 { US"fakedefer", TRUE,
449 (unsigned)
450 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
451 ACL_BIT_PREDATA | ACL_BIT_DATA |
452 #ifndef DISABLE_PRDR
453 ACL_BIT_PRDR |
454 #endif
455 ACL_BIT_MIME)
456 },
457 [CONTROL_FAKEREJECT] =
458 { US"fakereject", TRUE,
459 (unsigned)
460 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
461 ACL_BIT_PREDATA | ACL_BIT_DATA |
462 #ifndef DISABLE_PRDR
463 ACL_BIT_PRDR |
464 #endif
465 ACL_BIT_MIME)
466 },
467 [CONTROL_FREEZE] =
468 { US"freeze", TRUE,
469 (unsigned)
470 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
471 ACL_BIT_PREDATA | ACL_BIT_DATA |
472 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
473 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
474 },
475
476 [CONTROL_NO_CALLOUT_FLUSH] =
477 { US"no_callout_flush", FALSE,
478 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
479 },
480 [CONTROL_NO_DELAY_FLUSH] =
481 { US"no_delay_flush", FALSE,
482 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
483 },
484
485 [CONTROL_NO_ENFORCE_SYNC] =
486 { US"no_enforce_sync", FALSE,
487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
488 },
489 #ifdef WITH_CONTENT_SCAN
490 [CONTROL_NO_MBOX_UNSPOOL] =
491 { US"no_mbox_unspool", FALSE,
492 (unsigned)
493 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
494 ACL_BIT_PREDATA | ACL_BIT_DATA |
495 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 ACL_BIT_MIME)
497 },
498 #endif
499 [CONTROL_NO_MULTILINE] =
500 { US"no_multiline_responses", FALSE,
501 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
502 },
503 [CONTROL_NO_PIPELINING] =
504 { US"no_pipelining", FALSE,
505 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
506 },
507
508 [CONTROL_QUEUE_ONLY] =
509 { US"queue_only", FALSE,
510 (unsigned)
511 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
512 ACL_BIT_PREDATA | ACL_BIT_DATA |
513 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
514 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
515 },
516
517
518 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
519 [CONTROL_REQUIRETLS] =
520 { US"requiretls", FALSE,
521 (unsigned)
522 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
523 ACL_BIT_DATA | ACL_BIT_MIME |
524 ACL_BIT_NOTSMTP)
525 },
526 #endif
527
528 [CONTROL_SUBMISSION] =
529 { US"submission", TRUE,
530 (unsigned)
531 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
532 },
533 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
534 { US"suppress_local_fixups", FALSE,
535 (unsigned)
536 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
537 ACL_BIT_NOTSMTP_START)
538 },
539 #ifdef SUPPORT_I18N
540 [CONTROL_UTF8_DOWNCONVERT] =
541 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
542 }
543 #endif
544 };
545
546 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
547 caches its result in a tree to avoid repeated DNS queries. The result is an
548 integer code which is used as an index into the following tables of
549 explanatory strings and verification return codes. */
550
551 static tree_node *csa_cache = NULL;
552
553 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
554 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
555
556 /* The acl_verify_csa() return code is translated into an acl_verify() return
557 code using the following table. It is OK unless the client is definitely not
558 authorized. This is because CSA is supposed to be optional for sending sites,
559 so recipients should not be too strict about checking it - especially because
560 DNS problems are quite likely to occur. It's possible to use $csa_status in
561 further ACL conditions to distinguish ok, unknown, and defer if required, but
562 the aim is to make the usual configuration simple. */
563
564 static int csa_return_code[] = {
565 [CSA_UNKNOWN] = OK,
566 [CSA_OK] = OK,
567 [CSA_DEFER_SRV] = OK,
568 [CSA_DEFER_ADDR] = OK,
569 [CSA_FAIL_EXPLICIT] = FAIL,
570 [CSA_FAIL_DOMAIN] = FAIL,
571 [CSA_FAIL_NOADDR] = FAIL,
572 [CSA_FAIL_MISMATCH] = FAIL
573 };
574
575 static uschar *csa_status_string[] = {
576 [CSA_UNKNOWN] = US"unknown",
577 [CSA_OK] = US"ok",
578 [CSA_DEFER_SRV] = US"defer",
579 [CSA_DEFER_ADDR] = US"defer",
580 [CSA_FAIL_EXPLICIT] = US"fail",
581 [CSA_FAIL_DOMAIN] = US"fail",
582 [CSA_FAIL_NOADDR] = US"fail",
583 [CSA_FAIL_MISMATCH] = US"fail"
584 };
585
586 static uschar *csa_reason_string[] = {
587 [CSA_UNKNOWN] = US"unknown",
588 [CSA_OK] = US"ok",
589 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
590 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
591 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
592 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
593 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
594 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
595 };
596
597 /* Options for the ratelimit condition. Note that there are two variants of
598 the per_rcpt option, depending on the ACL that is used to measure the rate.
599 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
600 so the two variants must have the same internal representation as well as
601 the same configuration string. */
602
603 enum {
604 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
605 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
606 };
607
608 #define RATE_SET(var,new) \
609 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
610
611 static uschar *ratelimit_option_string[] = {
612 [RATE_PER_WHAT] = US"?",
613 [RATE_PER_CLASH] = US"!",
614 [RATE_PER_ADDR] = US"per_addr",
615 [RATE_PER_BYTE] = US"per_byte",
616 [RATE_PER_CMD] = US"per_cmd",
617 [RATE_PER_CONN] = US"per_conn",
618 [RATE_PER_MAIL] = US"per_mail",
619 [RATE_PER_RCPT] = US"per_rcpt",
620 [RATE_PER_ALLRCPTS] = US"per_rcpt"
621 };
622
623 /* Enable recursion between acl_check_internal() and acl_check_condition() */
624
625 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
626 uschar **);
627
628
629 /*************************************************
630 * Find control in list *
631 *************************************************/
632
633 /* The lists are always in order, so binary chop can be used.
634
635 Arguments:
636 name the control name to search for
637 ol the first entry in the control list
638 last one more than the offset of the last entry in the control list
639
640 Returns: index of a control entry, or -1 if not found
641 */
642
643 static int
644 find_control(const uschar * name, control_def * ol, int last)
645 {
646 int first = 0;
647 while (last > first)
648 {
649 int middle = (first + last)/2;
650 uschar * s = ol[middle].name;
651 int c = Ustrncmp(name, s, Ustrlen(s));
652 if (c == 0) return middle;
653 else if (c > 0) first = middle + 1;
654 else last = middle;
655 }
656 return -1;
657 }
658
659
660
661 /*************************************************
662 * Pick out condition from list *
663 *************************************************/
664
665 /* Use a binary chop method
666
667 Arguments:
668 name name to find
669 list list of conditions
670 end size of list
671
672 Returns: offset in list, or -1 if not found
673 */
674
675 static int
676 acl_checkcondition(uschar * name, condition_def * list, int end)
677 {
678 int start = 0;
679 while (start < end)
680 {
681 int mid = (start + end)/2;
682 int c = Ustrcmp(name, list[mid].name);
683 if (c == 0) return mid;
684 if (c < 0) end = mid;
685 else start = mid + 1;
686 }
687 return -1;
688 }
689
690
691 /*************************************************
692 * Pick out name from list *
693 *************************************************/
694
695 /* Use a binary chop method
696
697 Arguments:
698 name name to find
699 list list of names
700 end size of list
701
702 Returns: offset in list, or -1 if not found
703 */
704
705 static int
706 acl_checkname(uschar *name, uschar **list, int end)
707 {
708 int start = 0;
709
710 while (start < end)
711 {
712 int mid = (start + end)/2;
713 int c = Ustrcmp(name, list[mid]);
714 if (c == 0) return mid;
715 if (c < 0) end = mid; else start = mid + 1;
716 }
717
718 return -1;
719 }
720
721
722 /*************************************************
723 * Read and parse one ACL *
724 *************************************************/
725
726 /* This function is called both from readconf in order to parse the ACLs in the
727 configuration file, and also when an ACL is encountered dynamically (e.g. as
728 the result of an expansion). It is given a function to call in order to
729 retrieve the lines of the ACL. This function handles skipping comments and
730 blank lines (where relevant).
731
732 Arguments:
733 func function to get next line of ACL
734 error where to put an error message
735
736 Returns: pointer to ACL, or NULL
737 NULL can be legal (empty ACL); in this case error will be NULL
738 */
739
740 acl_block *
741 acl_read(uschar *(*func)(void), uschar **error)
742 {
743 acl_block *yield = NULL;
744 acl_block **lastp = &yield;
745 acl_block *this = NULL;
746 acl_condition_block *cond;
747 acl_condition_block **condp = NULL;
748 uschar *s;
749
750 *error = NULL;
751
752 while ((s = (*func)()) != NULL)
753 {
754 int v, c;
755 BOOL negated = FALSE;
756 uschar *saveline = s;
757 uschar name[64];
758
759 /* Conditions (but not verbs) are allowed to be negated by an initial
760 exclamation mark. */
761
762 while (isspace(*s)) s++;
763 if (*s == '!')
764 {
765 negated = TRUE;
766 s++;
767 }
768
769 /* Read the name of a verb or a condition, or the start of a new ACL, which
770 can be started by a name, or by a macro definition. */
771
772 s = readconf_readname(name, sizeof(name), s);
773 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
774
775 /* If a verb is unrecognized, it may be another condition or modifier that
776 continues the previous verb. */
777
778 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
779 {
780 if (this == NULL)
781 {
782 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
783 saveline);
784 return NULL;
785 }
786 }
787
788 /* New verb */
789
790 else
791 {
792 if (negated)
793 {
794 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
795 return NULL;
796 }
797 this = store_get(sizeof(acl_block));
798 *lastp = this;
799 lastp = &(this->next);
800 this->next = NULL;
801 this->verb = v;
802 this->condition = NULL;
803 condp = &(this->condition);
804 if (*s == 0) continue; /* No condition on this line */
805 if (*s == '!')
806 {
807 negated = TRUE;
808 s++;
809 }
810 s = readconf_readname(name, sizeof(name), s); /* Condition name */
811 }
812
813 /* Handle a condition or modifier. */
814
815 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
816 {
817 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
818 saveline);
819 return NULL;
820 }
821
822 /* The modifiers may not be negated */
823
824 if (negated && conditions[c].is_modifier)
825 {
826 *error = string_sprintf("ACL error: negation is not allowed with "
827 "\"%s\"", conditions[c].name);
828 return NULL;
829 }
830
831 /* ENDPASS may occur only with ACCEPT or DISCARD. */
832
833 if (c == ACLC_ENDPASS &&
834 this->verb != ACL_ACCEPT &&
835 this->verb != ACL_DISCARD)
836 {
837 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
838 conditions[c].name, verbs[this->verb]);
839 return NULL;
840 }
841
842 cond = store_get(sizeof(acl_condition_block));
843 cond->next = NULL;
844 cond->type = c;
845 cond->u.negated = negated;
846
847 *condp = cond;
848 condp = &(cond->next);
849
850 /* The "set" modifier is different in that its argument is "name=value"
851 rather than just a value, and we can check the validity of the name, which
852 gives us a variable name to insert into the data block. The original ACL
853 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
854 extended to 20 of each type, but after that people successfully argued for
855 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
856 After that, we allow alphanumerics and underscores, but the first character
857 after c or m must be a digit or an underscore. This retains backwards
858 compatibility. */
859
860 if (c == ACLC_SET)
861 #ifndef DISABLE_DKIM
862 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
863 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
864 {
865 uschar * endptr = s+18;
866
867 if (isalnum(*endptr))
868 {
869 *error = string_sprintf("invalid variable name after \"set\" in ACL "
870 "modifier \"set %s\" "
871 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
872 s);
873 return NULL;
874 }
875 cond->u.varname = string_copyn(s, 18);
876 s = endptr;
877 while (isspace(*s)) s++;
878 }
879 else
880 #endif
881 {
882 uschar *endptr;
883
884 if (Ustrncmp(s, "acl_c", 5) != 0 &&
885 Ustrncmp(s, "acl_m", 5) != 0)
886 {
887 *error = string_sprintf("invalid variable name after \"set\" in ACL "
888 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
889 return NULL;
890 }
891
892 endptr = s + 5;
893 if (!isdigit(*endptr) && *endptr != '_')
894 {
895 *error = string_sprintf("invalid variable name after \"set\" in ACL "
896 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
897 s);
898 return NULL;
899 }
900
901 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
902 {
903 if (!isalnum(*endptr) && *endptr != '_')
904 {
905 *error = string_sprintf("invalid character \"%c\" in variable name "
906 "in ACL modifier \"set %s\"", *endptr, s);
907 return NULL;
908 }
909 endptr++;
910 }
911
912 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
913 s = endptr;
914 while (isspace(*s)) s++;
915 }
916
917 /* For "set", we are now positioned for the data. For the others, only
918 "endpass" has no data */
919
920 if (c != ACLC_ENDPASS)
921 {
922 if (*s++ != '=')
923 {
924 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
925 conditions[c].is_modifier ? US"modifier" : US"condition");
926 return NULL;
927 }
928 while (isspace(*s)) s++;
929 cond->arg = string_copy(s);
930 }
931 }
932
933 return yield;
934 }
935
936
937
938 /*************************************************
939 * Set up added header line(s) *
940 *************************************************/
941
942 /* This function is called by the add_header modifier, and also from acl_warn()
943 to implement the now-deprecated way of adding header lines using "message" on a
944 "warn" verb. The argument is treated as a sequence of header lines which are
945 added to a chain, provided there isn't an identical one already there.
946
947 Argument: string of header lines
948 Returns: nothing
949 */
950
951 static void
952 setup_header(const uschar *hstring)
953 {
954 const uschar *p, *q;
955 int hlen = Ustrlen(hstring);
956
957 /* Ignore any leading newlines */
958 while (*hstring == '\n') hstring++, hlen--;
959
960 /* An empty string does nothing; ensure exactly one final newline. */
961 if (hlen <= 0) return;
962 if (hstring[--hlen] != '\n') /* no newline */
963 q = string_sprintf("%s\n", hstring);
964 else if (hstring[hlen-1] == '\n') /* double newline */
965 {
966 uschar * s = string_copy(hstring);
967 while(s[--hlen] == '\n')
968 s[hlen+1] = '\0';
969 q = s;
970 }
971 else
972 q = hstring;
973
974 /* Loop for multiple header lines, taking care about continuations */
975
976 for (p = q; *p; p = q)
977 {
978 const uschar *s;
979 uschar * hdr;
980 int newtype = htype_add_bot;
981 header_line **hptr = &acl_added_headers;
982
983 /* Find next header line within the string */
984
985 for (;;)
986 {
987 q = Ustrchr(q, '\n'); /* we know there was a newline */
988 if (*++q != ' ' && *q != '\t') break;
989 }
990
991 /* If the line starts with a colon, interpret the instruction for where to
992 add it. This temporarily sets up a new type. */
993
994 if (*p == ':')
995 {
996 if (strncmpic(p, US":after_received:", 16) == 0)
997 {
998 newtype = htype_add_rec;
999 p += 16;
1000 }
1001 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1002 {
1003 newtype = htype_add_rfc;
1004 p += 14;
1005 }
1006 else if (strncmpic(p, US":at_start:", 10) == 0)
1007 {
1008 newtype = htype_add_top;
1009 p += 10;
1010 }
1011 else if (strncmpic(p, US":at_end:", 8) == 0)
1012 {
1013 newtype = htype_add_bot;
1014 p += 8;
1015 }
1016 while (*p == ' ' || *p == '\t') p++;
1017 }
1018
1019 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1020 to the front of it. */
1021
1022 for (s = p; s < q - 1; s++)
1023 if (*s == ':' || !isgraph(*s)) break;
1024
1025 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1026 hlen = Ustrlen(hdr);
1027
1028 /* See if this line has already been added */
1029
1030 while (*hptr)
1031 {
1032 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1033 hptr = &(*hptr)->next;
1034 }
1035
1036 /* Add if not previously present */
1037
1038 if (!*hptr)
1039 {
1040 header_line *h = store_get(sizeof(header_line));
1041 h->text = hdr;
1042 h->next = NULL;
1043 h->type = newtype;
1044 h->slen = hlen;
1045 *hptr = h;
1046 hptr = &h->next;
1047 }
1048 }
1049 }
1050
1051
1052
1053 /*************************************************
1054 * List the added header lines *
1055 *************************************************/
1056 uschar *
1057 fn_hdrs_added(void)
1058 {
1059 gstring * g = NULL;
1060 header_line * h;
1061
1062 for (h = acl_added_headers; h; h = h->next)
1063 {
1064 int i = h->slen;
1065 if (h->text[i-1] == '\n') i--;
1066 g = string_append_listele_n(g, '\n', h->text, i);
1067 }
1068
1069 return g ? g->s : NULL;
1070 }
1071
1072
1073 /*************************************************
1074 * Set up removed header line(s) *
1075 *************************************************/
1076
1077 /* This function is called by the remove_header modifier. The argument is
1078 treated as a sequence of header names which are added to a colon separated
1079 list, provided there isn't an identical one already there.
1080
1081 Argument: string of header names
1082 Returns: nothing
1083 */
1084
1085 static void
1086 setup_remove_header(const uschar *hnames)
1087 {
1088 if (*hnames)
1089 acl_removed_headers = acl_removed_headers
1090 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1091 : string_copy(hnames);
1092 }
1093
1094
1095
1096 /*************************************************
1097 * Handle warnings *
1098 *************************************************/
1099
1100 /* This function is called when a WARN verb's conditions are true. It adds to
1101 the message's headers, and/or writes information to the log. In each case, this
1102 only happens once (per message for headers, per connection for log).
1103
1104 ** NOTE: The header adding action using the "message" setting is historic, and
1105 its use is now deprecated. The new add_header modifier should be used instead.
1106
1107 Arguments:
1108 where ACL_WHERE_xxxx indicating which ACL this is
1109 user_message message for adding to headers
1110 log_message message for logging, if different
1111
1112 Returns: nothing
1113 */
1114
1115 static void
1116 acl_warn(int where, uschar *user_message, uschar *log_message)
1117 {
1118 if (log_message != NULL && log_message != user_message)
1119 {
1120 uschar *text;
1121 string_item *logged;
1122
1123 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1124 string_printing(log_message));
1125
1126 /* If a sender verification has failed, and the log message is "sender verify
1127 failed", add the failure message. */
1128
1129 if (sender_verified_failed != NULL &&
1130 sender_verified_failed->message != NULL &&
1131 strcmpic(log_message, US"sender verify failed") == 0)
1132 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1133
1134 /* Search previously logged warnings. They are kept in malloc
1135 store so they can be freed at the start of a new message. */
1136
1137 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1138 if (Ustrcmp(logged->text, text) == 0) break;
1139
1140 if (logged == NULL)
1141 {
1142 int length = Ustrlen(text) + 1;
1143 log_write(0, LOG_MAIN, "%s", text);
1144 logged = store_malloc(sizeof(string_item) + length);
1145 logged->text = US logged + sizeof(string_item);
1146 memcpy(logged->text, text, length);
1147 logged->next = acl_warn_logged;
1148 acl_warn_logged = logged;
1149 }
1150 }
1151
1152 /* If there's no user message, we are done. */
1153
1154 if (user_message == NULL) return;
1155
1156 /* If this isn't a message ACL, we can't do anything with a user message.
1157 Log an error. */
1158
1159 if (where > ACL_WHERE_NOTSMTP)
1160 {
1161 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1162 "found in a non-message (%s) ACL: cannot specify header lines here: "
1163 "message ignored", acl_wherenames[where]);
1164 return;
1165 }
1166
1167 /* The code for setting up header lines is now abstracted into a separate
1168 function so that it can be used for the add_header modifier as well. */
1169
1170 setup_header(user_message);
1171 }
1172
1173
1174
1175 /*************************************************
1176 * Verify and check reverse DNS *
1177 *************************************************/
1178
1179 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1180 address if this has not yet been done. The host_name_lookup() function checks
1181 that one of these names resolves to an address list that contains the client IP
1182 address, so we don't actually have to do the check here.
1183
1184 Arguments:
1185 user_msgptr pointer for user message
1186 log_msgptr pointer for log message
1187
1188 Returns: OK verification condition succeeded
1189 FAIL verification failed
1190 DEFER there was a problem verifying
1191 */
1192
1193 static int
1194 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1195 {
1196 int rc;
1197
1198 user_msgptr = user_msgptr; /* stop compiler warning */
1199
1200 /* Previous success */
1201
1202 if (sender_host_name != NULL) return OK;
1203
1204 /* Previous failure */
1205
1206 if (host_lookup_failed)
1207 {
1208 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1209 return FAIL;
1210 }
1211
1212 /* Need to do a lookup */
1213
1214 HDEBUG(D_acl)
1215 debug_printf_indent("looking up host name to force name/address consistency check\n");
1216
1217 if ((rc = host_name_lookup()) != OK)
1218 {
1219 *log_msgptr = (rc == DEFER)?
1220 US"host lookup deferred for reverse lookup check"
1221 :
1222 string_sprintf("host lookup failed for reverse lookup check%s",
1223 host_lookup_msg);
1224 return rc; /* DEFER or FAIL */
1225 }
1226
1227 host_build_sender_fullhost();
1228 return OK;
1229 }
1230
1231
1232
1233 /*************************************************
1234 * Check client IP address matches CSA target *
1235 *************************************************/
1236
1237 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1238 response for address records belonging to the CSA target hostname. The section
1239 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1240 If one of the addresses matches the client's IP address, then the client is
1241 authorized by CSA. If there are target IP addresses but none of them match
1242 then the client is using an unauthorized IP address. If there are no target IP
1243 addresses then the client cannot be using an authorized IP address. (This is
1244 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1245
1246 Arguments:
1247 dnsa the DNS answer block
1248 dnss a DNS scan block for us to use
1249 reset option specifying what portion to scan, as described above
1250 target the target hostname to use for matching RR names
1251
1252 Returns: CSA_OK successfully authorized
1253 CSA_FAIL_MISMATCH addresses found but none matched
1254 CSA_FAIL_NOADDR no target addresses found
1255 */
1256
1257 static int
1258 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1259 uschar *target)
1260 {
1261 dns_record *rr;
1262 dns_address *da;
1263
1264 BOOL target_found = FALSE;
1265
1266 for (rr = dns_next_rr(dnsa, dnss, reset);
1267 rr != NULL;
1268 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1269 {
1270 /* Check this is an address RR for the target hostname. */
1271
1272 if (rr->type != T_A
1273 #if HAVE_IPV6
1274 && rr->type != T_AAAA
1275 #endif
1276 ) continue;
1277
1278 if (strcmpic(target, rr->name) != 0) continue;
1279
1280 target_found = TRUE;
1281
1282 /* Turn the target address RR into a list of textual IP addresses and scan
1283 the list. There may be more than one if it is an A6 RR. */
1284
1285 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1286 {
1287 /* If the client IP address matches the target IP address, it's good! */
1288
1289 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1290
1291 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1292 }
1293 }
1294
1295 /* If we found some target addresses but none of them matched, the client is
1296 using an unauthorized IP address, otherwise the target has no authorized IP
1297 addresses. */
1298
1299 if (target_found) return CSA_FAIL_MISMATCH;
1300 else return CSA_FAIL_NOADDR;
1301 }
1302
1303
1304
1305 /*************************************************
1306 * Verify Client SMTP Authorization *
1307 *************************************************/
1308
1309 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1310 to find the CSA SRV record corresponding to the domain argument, or
1311 $sender_helo_name if no argument is provided. It then checks that the
1312 client is authorized, and that its IP address corresponds to the SRV
1313 target's address by calling acl_verify_csa_address() above. The address
1314 should have been returned in the DNS response's ADDITIONAL section, but if
1315 not we perform another DNS lookup to get it.
1316
1317 Arguments:
1318 domain pointer to optional parameter following verify = csa
1319
1320 Returns: CSA_UNKNOWN no valid CSA record found
1321 CSA_OK successfully authorized
1322 CSA_FAIL_* client is definitely not authorized
1323 CSA_DEFER_* there was a DNS problem
1324 */
1325
1326 static int
1327 acl_verify_csa(const uschar *domain)
1328 {
1329 tree_node *t;
1330 const uschar *found;
1331 int priority, weight, port;
1332 dns_answer dnsa;
1333 dns_scan dnss;
1334 dns_record *rr;
1335 int rc, type;
1336 uschar target[256];
1337
1338 /* Work out the domain we are using for the CSA lookup. The default is the
1339 client's HELO domain. If the client has not said HELO, use its IP address
1340 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1341
1342 while (isspace(*domain) && *domain != '\0') ++domain;
1343 if (*domain == '\0') domain = sender_helo_name;
1344 if (domain == NULL) domain = sender_host_address;
1345 if (sender_host_address == NULL) return CSA_UNKNOWN;
1346
1347 /* If we have an address literal, strip off the framing ready for turning it
1348 into a domain. The framing consists of matched square brackets possibly
1349 containing a keyword and a colon before the actual IP address. */
1350
1351 if (domain[0] == '[')
1352 {
1353 const uschar *start = Ustrchr(domain, ':');
1354 if (start == NULL) start = domain;
1355 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1356 }
1357
1358 /* Turn domains that look like bare IP addresses into domains in the reverse
1359 DNS. This code also deals with address literals and $sender_host_address. It's
1360 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1361 address literals, but it's probably the most friendly thing to do. This is an
1362 extension to CSA, so we allow it to be turned off for proper conformance. */
1363
1364 if (string_is_ip_address(domain, NULL) != 0)
1365 {
1366 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1367 dns_build_reverse(domain, target);
1368 domain = target;
1369 }
1370
1371 /* Find out if we've already done the CSA check for this domain. If we have,
1372 return the same result again. Otherwise build a new cached result structure
1373 for this domain. The name is filled in now, and the value is filled in when
1374 we return from this function. */
1375
1376 t = tree_search(csa_cache, domain);
1377 if (t != NULL) return t->data.val;
1378
1379 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1380 Ustrcpy(t->name, domain);
1381 (void)tree_insertnode(&csa_cache, t);
1382
1383 /* Now we are ready to do the actual DNS lookup(s). */
1384
1385 found = domain;
1386 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1387 {
1388 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1389
1390 default:
1391 return t->data.val = CSA_DEFER_SRV;
1392
1393 /* If we found nothing, the client's authorization is unknown. */
1394
1395 case DNS_NOMATCH:
1396 case DNS_NODATA:
1397 return t->data.val = CSA_UNKNOWN;
1398
1399 /* We got something! Go on to look at the reply in more detail. */
1400
1401 case DNS_SUCCEED:
1402 break;
1403 }
1404
1405 /* Scan the reply for well-formed CSA SRV records. */
1406
1407 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1408 rr;
1409 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1410 {
1411 const uschar * p = rr->data;
1412
1413 /* Extract the numerical SRV fields (p is incremented) */
1414
1415 GETSHORT(priority, p);
1416 GETSHORT(weight, p);
1417 GETSHORT(port, p);
1418
1419 DEBUG(D_acl)
1420 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1421
1422 /* Check the CSA version number */
1423
1424 if (priority != 1) continue;
1425
1426 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1427 found by dns_special_lookup() is a parent of the one we asked for), we check
1428 the subdomain assertions in the port field. At the moment there's only one
1429 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1430 SRV records of their own. */
1431
1432 if (Ustrcmp(found, domain) != 0)
1433 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1434
1435 /* This CSA SRV record refers directly to our domain, so we check the value
1436 in the weight field to work out the domain's authorization. 0 and 1 are
1437 unauthorized; 3 means the client is authorized but we can't check the IP
1438 address in order to authenticate it, so we treat it as unknown; values
1439 greater than 3 are undefined. */
1440
1441 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1442
1443 if (weight > 2) continue;
1444
1445 /* Weight == 2, which means the domain is authorized. We must check that the
1446 client's IP address is listed as one of the SRV target addresses. Save the
1447 target hostname then break to scan the additional data for its addresses. */
1448
1449 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1450 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1451
1452 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1453
1454 break;
1455 }
1456
1457 /* If we didn't break the loop then no appropriate records were found. */
1458
1459 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1460
1461 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1462 A target of "." indicates there are no valid addresses, so the client cannot
1463 be authorized. (This is an odd configuration because weight=2 target=. is
1464 equivalent to weight=1, but we check for it in order to keep load off the
1465 root name servers.) Note that dn_expand() turns "." into "". */
1466
1467 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1468
1469 /* Scan the additional section of the CSA SRV reply for addresses belonging
1470 to the target. If the name server didn't return any additional data (e.g.
1471 because it does not fully support SRV records), we need to do another lookup
1472 to obtain the target addresses; otherwise we have a definitive result. */
1473
1474 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1475 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1476
1477 /* The DNS lookup type corresponds to the IP version used by the client. */
1478
1479 #if HAVE_IPV6
1480 if (Ustrchr(sender_host_address, ':') != NULL)
1481 type = T_AAAA;
1482 else
1483 #endif /* HAVE_IPV6 */
1484 type = T_A;
1485
1486
1487 lookup_dnssec_authenticated = NULL;
1488 switch (dns_lookup(&dnsa, target, type, NULL))
1489 {
1490 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1491
1492 default:
1493 return t->data.val = CSA_DEFER_ADDR;
1494
1495 /* If the query succeeded, scan the addresses and return the result. */
1496
1497 case DNS_SUCCEED:
1498 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1499 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1500 /* else fall through */
1501
1502 /* If the target has no IP addresses, the client cannot have an authorized
1503 IP address. However, if the target site uses A6 records (not AAAA records)
1504 we have to do yet another lookup in order to check them. */
1505
1506 case DNS_NOMATCH:
1507 case DNS_NODATA:
1508 return t->data.val = CSA_FAIL_NOADDR;
1509 }
1510 }
1511
1512
1513
1514 /*************************************************
1515 * Handle verification (address & other) *
1516 *************************************************/
1517
1518 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1519 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1520 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1521 };
1522 typedef struct {
1523 uschar * name;
1524 int value;
1525 unsigned where_allowed; /* bitmap */
1526 BOOL no_options; /* Never has /option(s) following */
1527 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1528 } verify_type_t;
1529 static verify_type_t verify_type_list[] = {
1530 /* name value where no-opt opt-sep */
1531 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1532 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1533 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1534 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1535 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1536 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1537 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1538 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1539 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1540 FALSE, 6 },
1541 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1542 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1543 #ifdef EXPERIMENTAL_ARC
1544 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1545 #endif
1546 };
1547
1548
1549 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1550 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1551 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1552 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1553 };
1554 typedef struct {
1555 uschar * name;
1556 int value;
1557 int flag;
1558 BOOL has_option; /* Has =option(s) following */
1559 BOOL timeval; /* Has a time value */
1560 } callout_opt_t;
1561 static callout_opt_t callout_opt_list[] = {
1562 /* name value flag has-opt has-time */
1563 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1564 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1565 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1566 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1567 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1568 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1569 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1570 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1571 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1572 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1573 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1574 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1575 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1576 };
1577
1578
1579
1580 /* This function implements the "verify" condition. It is called when
1581 encountered in any ACL, because some tests are almost always permitted. Some
1582 just don't make sense, and always fail (for example, an attempt to test a host
1583 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1584
1585 Arguments:
1586 where where called from
1587 addr the recipient address that the ACL is handling, or NULL
1588 arg the argument of "verify"
1589 user_msgptr pointer for user message
1590 log_msgptr pointer for log message
1591 basic_errno where to put verify errno
1592
1593 Returns: OK verification condition succeeded
1594 FAIL verification failed
1595 DEFER there was a problem verifying
1596 ERROR syntax error
1597 */
1598
1599 static int
1600 acl_verify(int where, address_item *addr, const uschar *arg,
1601 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1602 {
1603 int sep = '/';
1604 int callout = -1;
1605 int callout_overall = -1;
1606 int callout_connect = -1;
1607 int verify_options = 0;
1608 int rc;
1609 BOOL verify_header_sender = FALSE;
1610 BOOL defer_ok = FALSE;
1611 BOOL callout_defer_ok = FALSE;
1612 BOOL no_details = FALSE;
1613 BOOL success_on_redirect = FALSE;
1614 address_item *sender_vaddr = NULL;
1615 uschar *verify_sender_address = NULL;
1616 uschar *pm_mailfrom = NULL;
1617 uschar *se_mailfrom = NULL;
1618
1619 /* Some of the verify items have slash-separated options; some do not. Diagnose
1620 an error if options are given for items that don't expect them.
1621 */
1622
1623 uschar *slash = Ustrchr(arg, '/');
1624 const uschar *list = arg;
1625 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1626 verify_type_t * vp;
1627
1628 if (!ss) goto BAD_VERIFY;
1629
1630 /* Handle name/address consistency verification in a separate function. */
1631
1632 for (vp= verify_type_list;
1633 CS vp < CS verify_type_list + sizeof(verify_type_list);
1634 vp++
1635 )
1636 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1637 : strcmpic (ss, vp->name) == 0)
1638 break;
1639 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1640 goto BAD_VERIFY;
1641
1642 if (vp->no_options && slash)
1643 {
1644 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1645 "(this verify item has no options)", arg);
1646 return ERROR;
1647 }
1648 if (!(vp->where_allowed & BIT(where)))
1649 {
1650 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1651 vp->name, acl_wherenames[where]);
1652 return ERROR;
1653 }
1654 switch(vp->value)
1655 {
1656 case VERIFY_REV_HOST_LKUP:
1657 if (!sender_host_address) return OK;
1658 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1659 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1660 if (strcmpic(ss, US"defer_ok") == 0)
1661 return OK;
1662 return rc;
1663
1664 case VERIFY_CERT:
1665 /* TLS certificate verification is done at STARTTLS time; here we just
1666 test whether it was successful or not. (This is for optional verification; for
1667 mandatory verification, the connection doesn't last this long.) */
1668
1669 if (tls_in.certificate_verified) return OK;
1670 *user_msgptr = US"no verified certificate";
1671 return FAIL;
1672
1673 case VERIFY_HELO:
1674 /* We can test the result of optional HELO verification that might have
1675 occurred earlier. If not, we can attempt the verification now. */
1676
1677 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1678 return f.helo_verified ? OK : FAIL;
1679
1680 case VERIFY_CSA:
1681 /* Do Client SMTP Authorization checks in a separate function, and turn the
1682 result code into user-friendly strings. */
1683
1684 rc = acl_verify_csa(list);
1685 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1686 csa_reason_string[rc]);
1687 csa_status = csa_status_string[rc];
1688 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1689 return csa_return_code[rc];
1690
1691 #ifdef EXPERIMENTAL_ARC
1692 case VERIFY_ARC:
1693 { /* Do Authenticated Received Chain checks in a separate function. */
1694 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1695 int csep = 0;
1696 uschar * cond;
1697
1698 if (!(arc_state = acl_verify_arc())) return DEFER;
1699 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1700 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1701
1702 if (!condlist) condlist = US"none:pass";
1703 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1704 if (Ustrcmp(arc_state, cond) == 0) return OK;
1705 return FAIL;
1706 }
1707 #endif
1708
1709 case VERIFY_HDR_SYNTAX:
1710 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1711 a syntax error, we return details of the error to the sender if configured to
1712 send out full details. (But a "message" setting on the ACL can override, as
1713 always). */
1714
1715 rc = verify_check_headers(log_msgptr);
1716 if (rc != OK && *log_msgptr)
1717 if (smtp_return_error_details)
1718 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1719 else
1720 acl_verify_message = *log_msgptr;
1721 return rc;
1722
1723 case VERIFY_HDR_NAMES_ASCII:
1724 /* Check that all header names are true 7 bit strings
1725 See RFC 5322, 2.2. and RFC 6532, 3. */
1726
1727 rc = verify_check_header_names_ascii(log_msgptr);
1728 if (rc != OK && smtp_return_error_details && *log_msgptr)
1729 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1730 return rc;
1731
1732 case VERIFY_NOT_BLIND:
1733 /* Check that no recipient of this message is "blind", that is, every envelope
1734 recipient must be mentioned in either To: or Cc:. */
1735
1736 if ((rc = verify_check_notblind()) != OK)
1737 {
1738 *log_msgptr = string_sprintf("bcc recipient detected");
1739 if (smtp_return_error_details)
1740 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1741 }
1742 return rc;
1743
1744 /* The remaining verification tests check recipient and sender addresses,
1745 either from the envelope or from the header. There are a number of
1746 slash-separated options that are common to all of them. */
1747
1748 case VERIFY_HDR_SNDR:
1749 verify_header_sender = TRUE;
1750 break;
1751
1752 case VERIFY_SNDR:
1753 /* In the case of a sender, this can optionally be followed by an address to use
1754 in place of the actual sender (rare special-case requirement). */
1755 {
1756 uschar *s = ss + 6;
1757 if (*s == 0)
1758 verify_sender_address = sender_address;
1759 else
1760 {
1761 while (isspace(*s)) s++;
1762 if (*s++ != '=') goto BAD_VERIFY;
1763 while (isspace(*s)) s++;
1764 verify_sender_address = string_copy(s);
1765 }
1766 }
1767 break;
1768
1769 case VERIFY_RCPT:
1770 break;
1771 }
1772
1773
1774
1775 /* Remaining items are optional; they apply to sender and recipient
1776 verification, including "header sender" verification. */
1777
1778 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1779 != NULL)
1780 {
1781 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1782 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1783 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1784
1785 /* These two old options are left for backwards compatibility */
1786
1787 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1788 {
1789 callout_defer_ok = TRUE;
1790 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1791 }
1792
1793 else if (strcmpic(ss, US"check_postmaster") == 0)
1794 {
1795 pm_mailfrom = US"";
1796 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1797 }
1798
1799 /* The callout option has a number of sub-options, comma separated */
1800
1801 else if (strncmpic(ss, US"callout", 7) == 0)
1802 {
1803 callout = CALLOUT_TIMEOUT_DEFAULT;
1804 ss += 7;
1805 if (*ss != 0)
1806 {
1807 while (isspace(*ss)) ss++;
1808 if (*ss++ == '=')
1809 {
1810 const uschar * sublist = ss;
1811 int optsep = ',';
1812 uschar *opt;
1813 uschar buffer[256];
1814 while (isspace(*sublist)) sublist++;
1815
1816 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1817 {
1818 callout_opt_t * op;
1819 double period = 1.0F;
1820
1821 for (op= callout_opt_list; op->name; op++)
1822 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1823 break;
1824
1825 verify_options |= op->flag;
1826 if (op->has_option)
1827 {
1828 opt += Ustrlen(op->name);
1829 while (isspace(*opt)) opt++;
1830 if (*opt++ != '=')
1831 {
1832 *log_msgptr = string_sprintf("'=' expected after "
1833 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1834 return ERROR;
1835 }
1836 while (isspace(*opt)) opt++;
1837 }
1838 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1839 {
1840 *log_msgptr = string_sprintf("bad time value in ACL condition "
1841 "\"verify %s\"", arg);
1842 return ERROR;
1843 }
1844
1845 switch(op->value)
1846 {
1847 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1848 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1849 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1850 case CALLOUT_MAILFROM:
1851 if (!verify_header_sender)
1852 {
1853 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1854 "callout option only for verify=header_sender (detected in ACL "
1855 "condition \"%s\")", arg);
1856 return ERROR;
1857 }
1858 se_mailfrom = string_copy(opt);
1859 break;
1860 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1861 case CALLOUT_MAXWAIT: callout_overall = period; break;
1862 case CALLOUT_CONNECT: callout_connect = period; break;
1863 case CALLOUT_TIME: callout = period; break;
1864 }
1865 }
1866 }
1867 else
1868 {
1869 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1870 "ACL condition \"%s\"", arg);
1871 return ERROR;
1872 }
1873 }
1874 }
1875
1876 /* Option not recognized */
1877
1878 else
1879 {
1880 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1881 "condition \"verify %s\"", ss, arg);
1882 return ERROR;
1883 }
1884 }
1885
1886 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1887 (vopt_callout_recipsender|vopt_callout_recippmaster))
1888 {
1889 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1890 "for a recipient callout";
1891 return ERROR;
1892 }
1893
1894 /* Handle sender-in-header verification. Default the user message to the log
1895 message if giving out verification details. */
1896
1897 if (verify_header_sender)
1898 {
1899 int verrno;
1900
1901 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1902 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1903 &verrno)) != OK)
1904 {
1905 *basic_errno = verrno;
1906 if (smtp_return_error_details)
1907 {
1908 if (!*user_msgptr && *log_msgptr)
1909 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1910 if (rc == DEFER) f.acl_temp_details = TRUE;
1911 }
1912 }
1913 }
1914
1915 /* Handle a sender address. The default is to verify *the* sender address, but
1916 optionally a different address can be given, for special requirements. If the
1917 address is empty, we are dealing with a bounce message that has no sender, so
1918 we cannot do any checking. If the real sender address gets rewritten during
1919 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1920 during message reception.
1921
1922 A list of verified "sender" addresses is kept to try to avoid doing to much
1923 work repetitively when there are multiple recipients in a message and they all
1924 require sender verification. However, when callouts are involved, it gets too
1925 complicated because different recipients may require different callout options.
1926 Therefore, we always do a full sender verify when any kind of callout is
1927 specified. Caching elsewhere, for instance in the DNS resolver and in the
1928 callout handling, should ensure that this is not terribly inefficient. */
1929
1930 else if (verify_sender_address)
1931 {
1932 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1933 {
1934 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1935 "sender verify callout";
1936 return ERROR;
1937 }
1938
1939 sender_vaddr = verify_checked_sender(verify_sender_address);
1940 if (sender_vaddr != NULL && /* Previously checked */
1941 callout <= 0) /* No callout needed this time */
1942 {
1943 /* If the "routed" flag is set, it means that routing worked before, so
1944 this check can give OK (the saved return code value, if set, belongs to a
1945 callout that was done previously). If the "routed" flag is not set, routing
1946 must have failed, so we use the saved return code. */
1947
1948 if (testflag(sender_vaddr, af_verify_routed))
1949 rc = OK;
1950 else
1951 {
1952 rc = sender_vaddr->special_action;
1953 *basic_errno = sender_vaddr->basic_errno;
1954 }
1955 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1956 }
1957
1958 /* Do a new verification, and cache the result. The cache is used to avoid
1959 verifying the sender multiple times for multiple RCPTs when callouts are not
1960 specified (see comments above).
1961
1962 The cache is also used on failure to give details in response to the first
1963 RCPT that gets bounced for this reason. However, this can be suppressed by
1964 the no_details option, which sets the flag that says "this detail has already
1965 been sent". The cache normally contains just one address, but there may be
1966 more in esoteric circumstances. */
1967
1968 else
1969 {
1970 BOOL routed = TRUE;
1971 uschar *save_address_data = deliver_address_data;
1972
1973 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1974 #ifdef SUPPORT_I18N
1975 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1976 {
1977 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1978 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1979 }
1980 #endif
1981 if (no_details) setflag(sender_vaddr, af_sverify_told);
1982 if (verify_sender_address[0] != 0)
1983 {
1984 /* If this is the real sender address, save the unrewritten version
1985 for use later in receive. Otherwise, set a flag so that rewriting the
1986 sender in verify_address() does not update sender_address. */
1987
1988 if (verify_sender_address == sender_address)
1989 sender_address_unrewritten = sender_address;
1990 else
1991 verify_options |= vopt_fake_sender;
1992
1993 if (success_on_redirect)
1994 verify_options |= vopt_success_on_redirect;
1995
1996 /* The recipient, qualify, and expn options are never set in
1997 verify_options. */
1998
1999 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2000 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2001
2002 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2003
2004 if (rc != OK)
2005 *basic_errno = sender_vaddr->basic_errno;
2006 else
2007 DEBUG(D_acl)
2008 {
2009 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2010 debug_printf_indent("sender %s verified ok as %s\n",
2011 verify_sender_address, sender_vaddr->address);
2012 else
2013 debug_printf_indent("sender %s verified ok\n",
2014 verify_sender_address);
2015 }
2016 }
2017 else
2018 rc = OK; /* Null sender */
2019
2020 /* Cache the result code */
2021
2022 if (routed) setflag(sender_vaddr, af_verify_routed);
2023 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2024 sender_vaddr->special_action = rc;
2025 sender_vaddr->next = sender_verified_list;
2026 sender_verified_list = sender_vaddr;
2027
2028 /* Restore the recipient address data, which might have been clobbered by
2029 the sender verification. */
2030
2031 deliver_address_data = save_address_data;
2032 }
2033
2034 /* Put the sender address_data value into $sender_address_data */
2035
2036 sender_address_data = sender_vaddr->prop.address_data;
2037 }
2038
2039 /* A recipient address just gets a straightforward verify; again we must handle
2040 the DEFER overrides. */
2041
2042 else
2043 {
2044 address_item addr2;
2045
2046 if (success_on_redirect)
2047 verify_options |= vopt_success_on_redirect;
2048
2049 /* We must use a copy of the address for verification, because it might
2050 get rewritten. */
2051
2052 addr2 = *addr;
2053 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2054 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2055 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2056
2057 *basic_errno = addr2.basic_errno;
2058 *log_msgptr = addr2.message;
2059 *user_msgptr = (addr2.user_message != NULL)?
2060 addr2.user_message : addr2.message;
2061
2062 /* Allow details for temporary error if the address is so flagged. */
2063 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2064
2065 /* Make $address_data visible */
2066 deliver_address_data = addr2.prop.address_data;
2067 }
2068
2069 /* We have a result from the relevant test. Handle defer overrides first. */
2070
2071 if (rc == DEFER && (defer_ok ||
2072 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2073 {
2074 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2075 defer_ok? "defer_ok" : "callout_defer_ok");
2076 rc = OK;
2077 }
2078
2079 /* If we've failed a sender, set up a recipient message, and point
2080 sender_verified_failed to the address item that actually failed. */
2081
2082 if (rc != OK && verify_sender_address != NULL)
2083 {
2084 if (rc != DEFER)
2085 *log_msgptr = *user_msgptr = US"Sender verify failed";
2086 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2087 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2088 else
2089 {
2090 *log_msgptr = US"Could not complete sender verify callout";
2091 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2092 *log_msgptr;
2093 }
2094
2095 sender_verified_failed = sender_vaddr;
2096 }
2097
2098 /* Verifying an address messes up the values of $domain and $local_part,
2099 so reset them before returning if this is a RCPT ACL. */
2100
2101 if (addr != NULL)
2102 {
2103 deliver_domain = addr->domain;
2104 deliver_localpart = addr->local_part;
2105 }
2106 return rc;
2107
2108 /* Syntax errors in the verify argument come here. */
2109
2110 BAD_VERIFY:
2111 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2112 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2113 "or \"reverse_host_lookup\" at start of ACL condition "
2114 "\"verify %s\"", arg);
2115 return ERROR;
2116 }
2117
2118
2119
2120
2121 /*************************************************
2122 * Check argument for control= modifier *
2123 *************************************************/
2124
2125 /* Called from acl_check_condition() below
2126
2127 Arguments:
2128 arg the argument string for control=
2129 pptr set to point to the terminating character
2130 where which ACL we are in
2131 log_msgptr for error messages
2132
2133 Returns: CONTROL_xxx value
2134 */
2135
2136 static int
2137 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2138 {
2139 int idx, len;
2140 control_def * d;
2141
2142 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2143 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2144 && (!d->has_option || arg[len] != '/')
2145 ) )
2146 {
2147 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2148 return CONTROL_ERROR;
2149 }
2150
2151 *pptr = arg + len;
2152 return idx;
2153 }
2154
2155
2156
2157
2158 /*************************************************
2159 * Return a ratelimit error *
2160 *************************************************/
2161
2162 /* Called from acl_ratelimit() below
2163
2164 Arguments:
2165 log_msgptr for error messages
2166 format format string
2167 ... supplementary arguments
2168 ss ratelimit option name
2169 where ACL_WHERE_xxxx indicating which ACL this is
2170
2171 Returns: ERROR
2172 */
2173
2174 static int
2175 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2176 {
2177 va_list ap;
2178 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2179 va_start(ap, format);
2180 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2181 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2182 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2183 va_end(ap);
2184 *log_msgptr = string_sprintf(
2185 "error in arguments to \"ratelimit\" condition: %s", buffer);
2186 return ERROR;
2187 }
2188
2189
2190
2191
2192 /*************************************************
2193 * Handle rate limiting *
2194 *************************************************/
2195
2196 /* Called by acl_check_condition() below to calculate the result
2197 of the ACL ratelimit condition.
2198
2199 Note that the return value might be slightly unexpected: if the
2200 sender's rate is above the limit then the result is OK. This is
2201 similar to the dnslists condition, and is so that you can write
2202 ACL clauses like: defer ratelimit = 15 / 1h
2203
2204 Arguments:
2205 arg the option string for ratelimit=
2206 where ACL_WHERE_xxxx indicating which ACL this is
2207 log_msgptr for error messages
2208
2209 Returns: OK - Sender's rate is above limit
2210 FAIL - Sender's rate is below limit
2211 DEFER - Problem opening ratelimit database
2212 ERROR - Syntax error in options.
2213 */
2214
2215 static int
2216 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2217 {
2218 double limit, period, count;
2219 uschar *ss;
2220 uschar *key = NULL;
2221 uschar *unique = NULL;
2222 int sep = '/';
2223 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2224 BOOL noupdate = FALSE, badacl = FALSE;
2225 int mode = RATE_PER_WHAT;
2226 int old_pool, rc;
2227 tree_node **anchor, *t;
2228 open_db dbblock, *dbm;
2229 int dbdb_size;
2230 dbdata_ratelimit *dbd;
2231 dbdata_ratelimit_unique *dbdb;
2232 struct timeval tv;
2233
2234 /* Parse the first two options and record their values in expansion
2235 variables. These variables allow the configuration to have informative
2236 error messages based on rate limits obtained from a table lookup. */
2237
2238 /* First is the maximum number of messages per period / maximum burst
2239 size, which must be greater than or equal to zero. Zero is useful for
2240 rate measurement as opposed to rate limiting. */
2241
2242 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2243 return ratelimit_error(log_msgptr, "sender rate limit not set");
2244
2245 limit = Ustrtod(sender_rate_limit, &ss);
2246 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2247 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2248 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2249
2250 if (limit < 0.0 || *ss != '\0')
2251 return ratelimit_error(log_msgptr,
2252 "\"%s\" is not a positive number", sender_rate_limit);
2253
2254 /* Second is the rate measurement period / exponential smoothing time
2255 constant. This must be strictly greater than zero, because zero leads to
2256 run-time division errors. */
2257
2258 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2259 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2260 if (period <= 0.0)
2261 return ratelimit_error(log_msgptr,
2262 "\"%s\" is not a time value", sender_rate_period);
2263
2264 /* By default we are counting one of something, but the per_rcpt,
2265 per_byte, and count options can change this. */
2266
2267 count = 1.0;
2268
2269 /* Parse the other options. */
2270
2271 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
2272 {
2273 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2274 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2275 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2276 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2277 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2278 else if (strcmpic(ss, US"per_conn") == 0)
2279 {
2280 RATE_SET(mode, PER_CONN);
2281 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2282 badacl = TRUE;
2283 }
2284 else if (strcmpic(ss, US"per_mail") == 0)
2285 {
2286 RATE_SET(mode, PER_MAIL);
2287 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2288 }
2289 else if (strcmpic(ss, US"per_rcpt") == 0)
2290 {
2291 /* If we are running in the RCPT ACL, then we'll count the recipients
2292 one by one, but if we are running when we have accumulated the whole
2293 list then we'll add them all in one batch. */
2294 if (where == ACL_WHERE_RCPT)
2295 RATE_SET(mode, PER_RCPT);
2296 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2297 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2298 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2299 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2300 }
2301 else if (strcmpic(ss, US"per_byte") == 0)
2302 {
2303 /* If we have not yet received the message data and there was no SIZE
2304 declaration on the MAIL command, then it's safe to just use a value of
2305 zero and let the recorded rate decay as if nothing happened. */
2306 RATE_SET(mode, PER_MAIL);
2307 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2308 else count = message_size < 0 ? 0.0 : (double)message_size;
2309 }
2310 else if (strcmpic(ss, US"per_addr") == 0)
2311 {
2312 RATE_SET(mode, PER_RCPT);
2313 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2314 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2315 }
2316 else if (strncmpic(ss, US"count=", 6) == 0)
2317 {
2318 uschar *e;
2319 count = Ustrtod(ss+6, &e);
2320 if (count < 0.0 || *e != '\0')
2321 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2322 }
2323 else if (strncmpic(ss, US"unique=", 7) == 0)
2324 unique = string_copy(ss + 7);
2325 else if (!key)
2326 key = string_copy(ss);
2327 else
2328 key = string_sprintf("%s/%s", key, ss);
2329 }
2330
2331 /* Sanity check. When the badacl flag is set the update mode must either
2332 be readonly (which is the default if it is omitted) or, for backwards
2333 compatibility, a combination of noupdate and strict or leaky. */
2334
2335 if (mode == RATE_PER_CLASH)
2336 return ratelimit_error(log_msgptr, "conflicting per_* options");
2337 if (leaky + strict + readonly > 1)
2338 return ratelimit_error(log_msgptr, "conflicting update modes");
2339 if (badacl && (leaky || strict) && !noupdate)
2340 return ratelimit_error(log_msgptr,
2341 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2342 ratelimit_option_string[mode], acl_wherenames[where]);
2343
2344 /* Set the default values of any unset options. In readonly mode we
2345 perform the rate computation without any increment so that its value
2346 decays to eventually allow over-limit senders through. */
2347
2348 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2349 if (badacl) readonly = TRUE;
2350 if (readonly) count = 0.0;
2351 if (!strict && !readonly) leaky = TRUE;
2352 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2353
2354 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2355 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2356 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2357 are added to the key because they alter the meaning of the stored data. */
2358
2359 if (!key)
2360 key = !sender_host_address ? US"" : sender_host_address;
2361
2362 key = string_sprintf("%s/%s/%s%s",
2363 sender_rate_period,
2364 ratelimit_option_string[mode],
2365 unique == NULL ? "" : "unique/",
2366 key);
2367
2368 HDEBUG(D_acl)
2369 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2370
2371 /* See if we have already computed the rate by looking in the relevant tree.
2372 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2373 pool so that they survive across resets. In readonly mode we only remember the
2374 result for the rest of this command in case a later command changes it. After
2375 this bit of logic the code is independent of the per_* mode. */
2376
2377 old_pool = store_pool;
2378
2379 if (readonly)
2380 anchor = &ratelimiters_cmd;
2381 else switch(mode)
2382 {
2383 case RATE_PER_CONN:
2384 anchor = &ratelimiters_conn;
2385 store_pool = POOL_PERM;
2386 break;
2387 case RATE_PER_BYTE:
2388 case RATE_PER_MAIL:
2389 case RATE_PER_ALLRCPTS:
2390 anchor = &ratelimiters_mail;
2391 break;
2392 case RATE_PER_ADDR:
2393 case RATE_PER_CMD:
2394 case RATE_PER_RCPT:
2395 anchor = &ratelimiters_cmd;
2396 break;
2397 default:
2398 anchor = NULL; /* silence an "unused" complaint */
2399 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2400 "internal ACL error: unknown ratelimit mode %d", mode);
2401 break;
2402 }
2403
2404 if ((t = tree_search(*anchor, key)))
2405 {
2406 dbd = t->data.ptr;
2407 /* The following few lines duplicate some of the code below. */
2408 rc = (dbd->rate < limit)? FAIL : OK;
2409 store_pool = old_pool;
2410 sender_rate = string_sprintf("%.1f", dbd->rate);
2411 HDEBUG(D_acl)
2412 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2413 return rc;
2414 }
2415
2416 /* We aren't using a pre-computed rate, so get a previously recorded rate
2417 from the database, which will be updated and written back if required. */
2418
2419 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2420 {
2421 store_pool = old_pool;
2422 sender_rate = NULL;
2423 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2424 *log_msgptr = US"ratelimit database not available";
2425 return DEFER;
2426 }
2427 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2428 dbd = NULL;
2429
2430 gettimeofday(&tv, NULL);
2431
2432 if (dbdb)
2433 {
2434 /* Locate the basic ratelimit block inside the DB data. */
2435 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2436 dbd = &dbdb->dbd;
2437
2438 /* Forget the old Bloom filter if it is too old, so that we count each
2439 repeating event once per period. We don't simply clear and re-use the old
2440 filter because we want its size to change if the limit changes. Note that
2441 we keep the dbd pointer for copying the rate into the new data block. */
2442
2443 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2444 {
2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2446 dbdb = NULL;
2447 }
2448
2449 /* Sanity check. */
2450
2451 if(unique && dbdb_size < sizeof(*dbdb))
2452 {
2453 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2454 dbdb = NULL;
2455 }
2456 }
2457
2458 /* Allocate a new data block if the database lookup failed
2459 or the Bloom filter passed its age limit. */
2460
2461 if (!dbdb)
2462 {
2463 if (!unique)
2464 {
2465 /* No Bloom filter. This basic ratelimit block is initialized below. */
2466 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2467 dbdb_size = sizeof(*dbd);
2468 dbdb = store_get(dbdb_size);
2469 }
2470 else
2471 {
2472 int extra;
2473 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2474
2475 /* See the long comment below for an explanation of the magic number 2.
2476 The filter has a minimum size in case the rate limit is very small;
2477 this is determined by the definition of dbdata_ratelimit_unique. */
2478
2479 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2480 if (extra < 0) extra = 0;
2481 dbdb_size = sizeof(*dbdb) + extra;
2482 dbdb = store_get(dbdb_size);
2483 dbdb->bloom_epoch = tv.tv_sec;
2484 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2485 memset(dbdb->bloom, 0, dbdb->bloom_size);
2486
2487 /* Preserve any basic ratelimit data (which is our longer-term memory)
2488 by copying it from the discarded block. */
2489
2490 if (dbd)
2491 {
2492 dbdb->dbd = *dbd;
2493 dbd = &dbdb->dbd;
2494 }
2495 }
2496 }
2497
2498 /* If we are counting unique events, find out if this event is new or not.
2499 If the client repeats the event during the current period then it should be
2500 counted. We skip this code in readonly mode for efficiency, because any
2501 changes to the filter will be discarded and because count is already set to
2502 zero. */
2503
2504 if (unique && !readonly)
2505 {
2506 /* We identify unique events using a Bloom filter. (You can find my
2507 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2508 With the per_addr option, an "event" is a recipient address, though the
2509 user can use the unique option to define their own events. We only count
2510 an event if we have not seen it before.
2511
2512 We size the filter according to the rate limit, which (in leaky mode)
2513 is the limit on the population of the filter. We allow 16 bits of space
2514 per entry (see the construction code above) and we set (up to) 8 of them
2515 when inserting an element (see the loop below). The probability of a false
2516 positive (an event we have not seen before but which we fail to count) is
2517
2518 size = limit * 16
2519 numhash = 8
2520 allzero = exp(-numhash * pop / size)
2521 = exp(-0.5 * pop / limit)
2522 fpr = pow(1 - allzero, numhash)
2523
2524 For senders at the limit the fpr is 0.06% or 1 in 1700
2525 and for senders at half the limit it is 0.0006% or 1 in 170000
2526
2527 In strict mode the Bloom filter can fill up beyond the normal limit, in
2528 which case the false positive rate will rise. This means that the
2529 measured rate for very fast senders can bogusly drop off after a while.
2530
2531 At twice the limit, the fpr is 2.5% or 1 in 40
2532 At four times the limit, it is 31% or 1 in 3.2
2533
2534 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2535 decay below the limit, and if this is more than one then the Bloom filter
2536 will be discarded before the decay gets that far. The false positive rate
2537 at this threshold is 9.3% or 1 in 10.7. */
2538
2539 BOOL seen;
2540 unsigned n, hash, hinc;
2541 uschar md5sum[16];
2542 md5 md5info;
2543
2544 /* Instead of using eight independent hash values, we combine two values
2545 using the formula h1 + n * h2. This does not harm the Bloom filter's
2546 performance, and means the amount of hash we need is independent of the
2547 number of bits we set in the filter. */
2548
2549 md5_start(&md5info);
2550 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2551 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2552 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2553
2554 /* Scan the bits corresponding to this event. A zero bit means we have
2555 not seen it before. Ensure all bits are set to record this event. */
2556
2557 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2558
2559 seen = TRUE;
2560 for (n = 0; n < 8; n++, hash += hinc)
2561 {
2562 int bit = 1 << (hash % 8);
2563 int byte = (hash / 8) % dbdb->bloom_size;
2564 if ((dbdb->bloom[byte] & bit) == 0)
2565 {
2566 dbdb->bloom[byte] |= bit;
2567 seen = FALSE;
2568 }
2569 }
2570
2571 /* If this event has occurred before, do not count it. */
2572
2573 if (seen)
2574 {
2575 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2576 count = 0.0;
2577 }
2578 else
2579 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2580 }
2581
2582 /* If there was no previous ratelimit data block for this key, initialize
2583 the new one, otherwise update the block from the database. The initial rate
2584 is what would be computed by the code below for an infinite interval. */
2585
2586 if (!dbd)
2587 {
2588 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2589 dbd = &dbdb->dbd;
2590 dbd->time_stamp = tv.tv_sec;
2591 dbd->time_usec = tv.tv_usec;
2592 dbd->rate = count;
2593 }
2594 else
2595 {
2596 /* The smoothed rate is computed using an exponentially weighted moving
2597 average adjusted for variable sampling intervals. The standard EWMA for
2598 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2599 where f() is the measured value and f'() is the smoothed value.
2600
2601 Old data decays out of the smoothed value exponentially, such that data n
2602 samples old is multiplied by a^n. The exponential decay time constant p
2603 is defined such that data p samples old is multiplied by 1/e, which means
2604 that a = exp(-1/p). We can maintain the same time constant for a variable
2605 sampling interval i by using a = exp(-i/p).
2606
2607 The rate we are measuring is messages per period, suitable for directly
2608 comparing with the limit. The average rate between now and the previous
2609 message is period / interval, which we feed into the EWMA as the sample.
2610
2611 It turns out that the number of messages required for the smoothed rate
2612 to reach the limit when they are sent in a burst is equal to the limit.
2613 This can be seen by analysing the value of the smoothed rate after N
2614 messages sent at even intervals. Let k = (1 - a) * p/i
2615
2616 rate_1 = (1 - a) * p/i + a * rate_0
2617 = k + a * rate_0
2618 rate_2 = k + a * rate_1
2619 = k + a * k + a^2 * rate_0
2620 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2621 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2622 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2623 = rate_0 * a^N + p/i * (1 - a^N)
2624
2625 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2626
2627 rate_N = p/i + (rate_0 - p/i) * a^N
2628 a^N = (rate_N - p/i) / (rate_0 - p/i)
2629 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2630 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2631
2632 Numerical analysis of the above equation, setting the computed rate to
2633 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2634 rates, p/i, the number of messages N = limit. So limit serves as both the
2635 maximum rate measured in messages per period, and the maximum number of
2636 messages that can be sent in a fast burst. */
2637
2638 double this_time = (double)tv.tv_sec
2639 + (double)tv.tv_usec / 1000000.0;
2640 double prev_time = (double)dbd->time_stamp
2641 + (double)dbd->time_usec / 1000000.0;
2642
2643 /* We must avoid division by zero, and deal gracefully with the clock going
2644 backwards. If we blunder ahead when time is in reverse then the computed
2645 rate will be bogus. To be safe we clamp interval to a very small number. */
2646
2647 double interval = this_time - prev_time <= 0.0 ? 1e-9
2648 : this_time - prev_time;
2649
2650 double i_over_p = interval / period;
2651 double a = exp(-i_over_p);
2652
2653 /* Combine the instantaneous rate (period / interval) with the previous rate
2654 using the smoothing factor a. In order to measure sized events, multiply the
2655 instantaneous rate by the count of bytes or recipients etc. */
2656
2657 dbd->time_stamp = tv.tv_sec;
2658 dbd->time_usec = tv.tv_usec;
2659 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2660
2661 /* When events are very widely spaced the computed rate tends towards zero.
2662 Although this is accurate it turns out not to be useful for our purposes,
2663 especially when the first event after a long silence is the start of a spam
2664 run. A more useful model is that the rate for an isolated event should be the
2665 size of the event per the period size, ignoring the lack of events outside
2666 the current period and regardless of where the event falls in the period. So,
2667 if the interval was so long that the calculated rate is unhelpfully small, we
2668 re-initialize the rate. In the absence of higher-rate bursts, the condition
2669 below is true if the interval is greater than the period. */
2670
2671 if (dbd->rate < count) dbd->rate = count;
2672 }
2673
2674 /* Clients sending at the limit are considered to be over the limit.
2675 This matters for edge cases such as a limit of zero, when the client
2676 should be completely blocked. */
2677
2678 rc = dbd->rate < limit ? FAIL : OK;
2679
2680 /* Update the state if the rate is low or if we are being strict. If we
2681 are in leaky mode and the sender's rate is too high, we do not update
2682 the recorded rate in order to avoid an over-aggressive sender's retry
2683 rate preventing them from getting any email through. If readonly is set,
2684 neither leaky nor strict are set, so we do not do any updates. */
2685
2686 if ((rc == FAIL && leaky) || strict)
2687 {
2688 dbfn_write(dbm, key, dbdb, dbdb_size);
2689 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2690 }
2691 else
2692 {
2693 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2694 readonly? "readonly mode" : "over the limit, but leaky");
2695 }
2696
2697 dbfn_close(dbm);
2698
2699 /* Store the result in the tree for future reference. */
2700
2701 t = store_get(sizeof(tree_node) + Ustrlen(key));
2702 t->data.ptr = dbd;
2703 Ustrcpy(t->name, key);
2704 (void)tree_insertnode(anchor, t);
2705
2706 /* We create the formatted version of the sender's rate very late in
2707 order to ensure that it is done using the correct storage pool. */
2708
2709 store_pool = old_pool;
2710 sender_rate = string_sprintf("%.1f", dbd->rate);
2711
2712 HDEBUG(D_acl)
2713 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2714
2715 return rc;
2716 }
2717
2718
2719
2720 /*************************************************
2721 * The udpsend ACL modifier *
2722 *************************************************/
2723
2724 /* Called by acl_check_condition() below.
2725
2726 Arguments:
2727 arg the option string for udpsend=
2728 log_msgptr for error messages
2729
2730 Returns: OK - Completed.
2731 DEFER - Problem with DNS lookup.
2732 ERROR - Syntax error in options.
2733 */
2734
2735 static int
2736 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2737 {
2738 int sep = 0;
2739 uschar *hostname;
2740 uschar *portstr;
2741 uschar *portend;
2742 host_item *h;
2743 int portnum;
2744 int len;
2745 int r, s;
2746 uschar * errstr;
2747
2748 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2749 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2750
2751 if (!hostname)
2752 {
2753 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2754 return ERROR;
2755 }
2756 if (!portstr)
2757 {
2758 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2759 return ERROR;
2760 }
2761 if (!arg)
2762 {
2763 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2764 return ERROR;
2765 }
2766 portnum = Ustrtol(portstr, &portend, 10);
2767 if (*portend != '\0')
2768 {
2769 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2770 return ERROR;
2771 }
2772
2773 /* Make a single-item host list. */
2774 h = store_get(sizeof(host_item));
2775 memset(h, 0, sizeof(host_item));
2776 h->name = hostname;
2777 h->port = portnum;
2778 h->mx = MX_NONE;
2779
2780 if (string_is_ip_address(hostname, NULL))
2781 h->address = hostname, r = HOST_FOUND;
2782 else
2783 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2784 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2785 {
2786 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2787 return DEFER;
2788 }
2789
2790 HDEBUG(D_acl)
2791 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2792
2793 /*XXX this could better use sendto */
2794 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2795 1, NULL, &errstr, NULL);
2796 if (r < 0) goto defer;
2797 len = Ustrlen(arg);
2798 r = send(s, arg, len, 0);
2799 if (r < 0)
2800 {
2801 errstr = US strerror(errno);
2802 close(s);
2803 goto defer;
2804 }
2805 close(s);
2806 if (r < len)
2807 {
2808 *log_msgptr =
2809 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2810 return DEFER;
2811 }
2812
2813 HDEBUG(D_acl)
2814 debug_printf_indent("udpsend %d bytes\n", r);
2815
2816 return OK;
2817
2818 defer:
2819 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2820 return DEFER;
2821 }
2822
2823
2824
2825 /*************************************************
2826 * Handle conditions/modifiers on an ACL item *
2827 *************************************************/
2828
2829 /* Called from acl_check() below.
2830
2831 Arguments:
2832 verb ACL verb
2833 cb ACL condition block - if NULL, result is OK
2834 where where called from
2835 addr the address being checked for RCPT, or NULL
2836 level the nesting level
2837 epp pointer to pass back TRUE if "endpass" encountered
2838 (applies only to "accept" and "discard")
2839 user_msgptr user message pointer
2840 log_msgptr log message pointer
2841 basic_errno pointer to where to put verify error
2842
2843 Returns: OK - all conditions are met
2844 DISCARD - an "acl" condition returned DISCARD - only allowed
2845 for "accept" or "discard" verbs
2846 FAIL - at least one condition fails
2847 FAIL_DROP - an "acl" condition returned FAIL_DROP
2848 DEFER - can't tell at the moment (typically, lookup defer,
2849 but can be temporary callout problem)
2850 ERROR - ERROR from nested ACL or expansion failure or other
2851 error
2852 */
2853
2854 static int
2855 acl_check_condition(int verb, acl_condition_block *cb, int where,
2856 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2857 uschar **log_msgptr, int *basic_errno)
2858 {
2859 uschar *user_message = NULL;
2860 uschar *log_message = NULL;
2861 int rc = OK;
2862 #ifdef WITH_CONTENT_SCAN
2863 int sep = -'/';
2864 #endif
2865
2866 for (; cb; cb = cb->next)
2867 {
2868 const uschar *arg;
2869 int control_type;
2870
2871 /* The message and log_message items set up messages to be used in
2872 case of rejection. They are expanded later. */
2873
2874 if (cb->type == ACLC_MESSAGE)
2875 {
2876 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2877 user_message = cb->arg;
2878 continue;
2879 }
2880
2881 if (cb->type == ACLC_LOG_MESSAGE)
2882 {
2883 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2884 log_message = cb->arg;
2885 continue;
2886 }
2887
2888 /* The endpass "condition" just sets a flag to show it occurred. This is
2889 checked at compile time to be on an "accept" or "discard" item. */
2890
2891 if (cb->type == ACLC_ENDPASS)
2892 {
2893 *epp = TRUE;
2894 continue;
2895 }
2896
2897 /* For other conditions and modifiers, the argument is expanded now for some
2898 of them, but not for all, because expansion happens down in some lower level
2899 checking functions in some cases. */
2900
2901 if (!conditions[cb->type].expand_at_top)
2902 arg = cb->arg;
2903 else if (!(arg = expand_string(cb->arg)))
2904 {
2905 if (f.expand_string_forcedfail) continue;
2906 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2907 cb->arg, expand_string_message);
2908 return f.search_find_defer ? DEFER : ERROR;
2909 }
2910
2911 /* Show condition, and expanded condition if it's different */
2912
2913 HDEBUG(D_acl)
2914 {
2915 int lhswidth = 0;
2916 debug_printf_indent("check %s%s %n",
2917 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2918 conditions[cb->type].name, &lhswidth);
2919
2920 if (cb->type == ACLC_SET)
2921 {
2922 #ifndef DISABLE_DKIM
2923 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2924 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2925 {
2926 debug_printf("%s ", cb->u.varname);
2927 lhswidth += 19;
2928 }
2929 else
2930 #endif
2931 {
2932 debug_printf("acl_%s ", cb->u.varname);
2933 lhswidth += 5 + Ustrlen(cb->u.varname);
2934 }
2935 }
2936
2937 debug_printf("= %s\n", cb->arg);
2938
2939 if (arg != cb->arg)
2940 debug_printf("%.*s= %s\n", lhswidth,
2941 US" ", CS arg);
2942 }
2943
2944 /* Check that this condition makes sense at this time */
2945
2946 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2947 {
2948 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2949 conditions[cb->type].is_modifier ? "use" : "test",
2950 conditions[cb->type].name, acl_wherenames[where]);
2951 return ERROR;
2952 }
2953
2954 /* Run the appropriate test for each condition, or take the appropriate
2955 action for the remaining modifiers. */
2956
2957 switch(cb->type)
2958 {
2959 case ACLC_ADD_HEADER:
2960 setup_header(arg);
2961 break;
2962
2963 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2964 "discard" verb. */
2965
2966 case ACLC_ACL:
2967 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2968 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2969 {
2970 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2971 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2972 verbs[verb]);
2973 return ERROR;
2974 }
2975 break;
2976
2977 case ACLC_AUTHENTICATED:
2978 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2979 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2980 break;
2981
2982 #ifdef EXPERIMENTAL_BRIGHTMAIL
2983 case ACLC_BMI_OPTIN:
2984 {
2985 int old_pool = store_pool;
2986 store_pool = POOL_PERM;
2987 bmi_current_optin = string_copy(arg);
2988 store_pool = old_pool;
2989 }
2990 break;
2991 #endif
2992
2993 case ACLC_CONDITION:
2994 /* The true/false parsing here should be kept in sync with that used in
2995 expand.c when dealing with ECOND_BOOL so that we don't have too many
2996 different definitions of what can be a boolean. */
2997 if (*arg == '-'
2998 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2999 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3000 rc = (Uatoi(arg) == 0)? FAIL : OK;
3001 else
3002 rc = (strcmpic(arg, US"no") == 0 ||
3003 strcmpic(arg, US"false") == 0)? FAIL :
3004 (strcmpic(arg, US"yes") == 0 ||
3005 strcmpic(arg, US"true") == 0)? OK : DEFER;
3006 if (rc == DEFER)
3007 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3008 break;
3009
3010 case ACLC_CONTINUE: /* Always succeeds */
3011 break;
3012
3013 case ACLC_CONTROL:
3014 {
3015 const uschar *p = NULL;
3016 control_type = decode_control(arg, &p, where, log_msgptr);
3017
3018 /* Check if this control makes sense at this time */
3019
3020 if (controls_list[control_type].forbids & (1 << where))
3021 {
3022 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3023 controls_list[control_type].name, acl_wherenames[where]);
3024 return ERROR;
3025 }
3026
3027 switch(control_type)
3028 {
3029 case CONTROL_AUTH_UNADVERTISED:
3030 f.allow_auth_unadvertised = TRUE;
3031 break;
3032
3033 #ifdef EXPERIMENTAL_BRIGHTMAIL
3034 case CONTROL_BMI_RUN:
3035 bmi_run = 1;
3036 break;
3037 #endif
3038
3039 #ifndef DISABLE_DKIM
3040 case CONTROL_DKIM_VERIFY:
3041 f.dkim_disable_verify = TRUE;
3042 #ifdef EXPERIMENTAL_DMARC
3043 /* Since DKIM was blocked, skip DMARC too */
3044 f.dmarc_disable_verify = TRUE;
3045 f.dmarc_enable_forensic = FALSE;
3046 #endif
3047 break;
3048 #endif
3049
3050 #ifdef EXPERIMENTAL_DMARC
3051 case CONTROL_DMARC_VERIFY:
3052 f.dmarc_disable_verify = TRUE;
3053 break;
3054
3055 case CONTROL_DMARC_FORENSIC:
3056 f.dmarc_enable_forensic = TRUE;
3057 break;
3058 #endif
3059
3060 case CONTROL_DSCP:
3061 if (*p == '/')
3062 {
3063 int fd, af, level, optname, value;
3064 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3065 a socket; we can accept that, we'll just debug-log failures anyway. */
3066 fd = fileno(smtp_in);
3067 af = ip_get_address_family(fd);
3068 if (af < 0)
3069 {
3070 HDEBUG(D_acl)
3071 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3072 strerror(errno));
3073 break;
3074 }
3075 if (dscp_lookup(p+1, af, &level, &optname, &value))
3076 {
3077 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3078 {
3079 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3080 p+1, strerror(errno));
3081 }
3082 else
3083 {
3084 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3085 }
3086 }
3087 else
3088 {
3089 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3090 return ERROR;
3091 }
3092 }
3093 else
3094 {
3095 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3096 return ERROR;
3097 }
3098 break;
3099
3100 case CONTROL_ERROR:
3101 return ERROR;
3102
3103 case CONTROL_CASEFUL_LOCAL_PART:
3104 deliver_localpart = addr->cc_local_part;
3105 break;
3106
3107 case CONTROL_CASELOWER_LOCAL_PART:
3108 deliver_localpart = addr->lc_local_part;
3109 break;
3110
3111 case CONTROL_ENFORCE_SYNC:
3112 smtp_enforce_sync = TRUE;
3113 break;
3114
3115 case CONTROL_NO_ENFORCE_SYNC:
3116 smtp_enforce_sync = FALSE;
3117 break;
3118
3119 #ifdef WITH_CONTENT_SCAN
3120 case CONTROL_NO_MBOX_UNSPOOL:
3121 f.no_mbox_unspool = TRUE;
3122 break;
3123 #endif
3124
3125 case CONTROL_NO_MULTILINE:
3126 f.no_multiline_responses = TRUE;
3127 break;
3128
3129 case CONTROL_NO_PIPELINING:
3130 f.pipelining_enable = FALSE;
3131 break;
3132
3133 case CONTROL_NO_DELAY_FLUSH:
3134 f.disable_delay_flush = TRUE;
3135 break;
3136
3137 case CONTROL_NO_CALLOUT_FLUSH:
3138 f.disable_callout_flush = TRUE;
3139 break;
3140
3141 case CONTROL_FAKEREJECT:
3142 cancel_cutthrough_connection(TRUE, US"fakereject");
3143 case CONTROL_FAKEDEFER:
3144 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3145 if (*p == '/')
3146 {
3147 const uschar *pp = p + 1;
3148 while (*pp != 0) pp++;
3149 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3150 p = pp;
3151 }
3152 else
3153 {
3154 /* Explicitly reset to default string */
3155 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3156 }
3157 break;
3158
3159 case CONTROL_FREEZE:
3160 f.deliver_freeze = TRUE;
3161 deliver_frozen_at = time(NULL);
3162 freeze_tell = freeze_tell_config; /* Reset to configured value */
3163 if (Ustrncmp(p, "/no_tell", 8) == 0)
3164 {
3165 p += 8;
3166 freeze_tell = NULL;
3167 }
3168 if (*p != 0)
3169 {
3170 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3171 return ERROR;
3172 }
3173 cancel_cutthrough_connection(TRUE, US"item frozen");
3174 break;
3175
3176 case CONTROL_QUEUE_ONLY:
3177 f.queue_only_policy = TRUE;
3178 cancel_cutthrough_connection(TRUE, US"queueing forced");
3179 break;
3180
3181 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
3182 case CONTROL_REQUIRETLS:
3183 tls_requiretls |= REQUIRETLS_MSG;
3184 break;
3185 #endif
3186 case CONTROL_SUBMISSION:
3187 originator_name = US"";
3188 f.submission_mode = TRUE;
3189 while (*p == '/')
3190 {
3191 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3192 {
3193 p += 14;
3194 f.active_local_sender_retain = TRUE;
3195 f.active_local_from_check = FALSE;
3196 }
3197 else if (Ustrncmp(p, "/domain=", 8) == 0)
3198 {
3199 const uschar *pp = p + 8;
3200 while (*pp != 0 && *pp != '/') pp++;
3201 submission_domain = string_copyn(p+8, pp-p-8);
3202 p = pp;
3203 }
3204 /* The name= option must be last, because it swallows the rest of
3205 the string. */
3206 else if (Ustrncmp(p, "/name=", 6) == 0)
3207 {
3208 const uschar *pp = p + 6;
3209 while (*pp != 0) pp++;
3210 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3211 big_buffer, big_buffer_size));
3212 p = pp;
3213 }
3214 else break;
3215 }
3216 if (*p != 0)
3217 {
3218 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3219 return ERROR;
3220 }
3221 break;
3222
3223 case CONTROL_DEBUG:
3224 {
3225 uschar * debug_tag = NULL;
3226 uschar * debug_opts = NULL;
3227 BOOL kill = FALSE;
3228
3229 while (*p == '/')
3230 {
3231 const uschar * pp = p+1;
3232 if (Ustrncmp(pp, "tag=", 4) == 0)
3233 {
3234 for (pp += 4; *pp && *pp != '/';) pp++;
3235 debug_tag = string_copyn(p+5, pp-p-5);
3236 }
3237 else if (Ustrncmp(pp, "opts=", 5) == 0)
3238 {
3239 for (pp += 5; *pp && *pp != '/';) pp++;
3240 debug_opts = string_copyn(p+6, pp-p-6);
3241 }
3242 else if (Ustrncmp(pp, "kill", 4) == 0)
3243 {
3244 for (pp += 4; *pp && *pp != '/';) pp++;
3245 kill = TRUE;
3246 }
3247 else
3248 while (*pp && *pp != '/') pp++;
3249 p = pp;
3250 }
3251
3252 if (kill)
3253 debug_logging_stop();
3254 else
3255 debug_logging_activate(debug_tag, debug_opts);
3256 }
3257 break;
3258
3259 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3260 f.suppress_local_fixups = TRUE;
3261 break;
3262
3263 case CONTROL_CUTTHROUGH_DELIVERY:
3264 {
3265 uschar * ignored = NULL;
3266 #ifndef DISABLE_PRDR
3267 if (prdr_requested)
3268 #else
3269 if (0)
3270 #endif
3271 /* Too hard to think about for now. We might in future cutthrough
3272 the case where both sides handle prdr and this-node prdr acl
3273 is "accept" */
3274 ignored = US"PRDR active";
3275 else
3276 {
3277 if (f.deliver_freeze)
3278 ignored = US"frozen";
3279 else if (f.queue_only_policy)
3280 ignored = US"queue-only";
3281 else if (fake_response == FAIL)
3282 ignored = US"fakereject";
3283 else
3284 {
3285 if (rcpt_count == 1)
3286 {
3287 cutthrough.delivery = TRUE; /* control accepted */
3288 while (*p == '/')
3289 {
3290 const uschar * pp = p+1;
3291 if (Ustrncmp(pp, "defer=", 6) == 0)
3292 {
3293 pp += 6;
3294 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3295 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3296 }
3297 else
3298 while (*pp && *pp != '/') pp++;
3299 p = pp;
3300 }
3301 }
3302 else
3303 ignored = US"nonfirst rcpt";
3304 }
3305 }
3306 DEBUG(D_acl) if (ignored)
3307 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3308 }
3309 break;
3310
3311 #ifdef SUPPORT_I18N
3312 case CONTROL_UTF8_DOWNCONVERT:
3313 if (*p == '/')
3314 {
3315 if (p[1] == '1')
3316 {
3317 message_utf8_downconvert = 1;
3318 addr->prop.utf8_downcvt = TRUE;
3319 addr->prop.utf8_downcvt_maybe = FALSE;
3320 p += 2;
3321 break;
3322 }
3323 if (p[1] == '0')
3324 {
3325 message_utf8_downconvert = 0;
3326 addr->prop.utf8_downcvt = FALSE;
3327 addr->prop.utf8_downcvt_maybe = FALSE;
3328 p += 2;
3329 break;
3330 }
3331 if (p[1] == '-' && p[2] == '1')
3332 {
3333 message_utf8_downconvert = -1;
3334 addr->prop.utf8_downcvt = FALSE;
3335 addr->prop.utf8_downcvt_maybe = TRUE;
3336 p += 3;
3337 break;
3338 }
3339 *log_msgptr = US"bad option value for control=utf8_downconvert";
3340 }
3341 else
3342 {
3343 message_utf8_downconvert = 1;
3344 addr->prop.utf8_downcvt = TRUE;
3345 addr->prop.utf8_downcvt_maybe = FALSE;
3346 break;
3347 }
3348 return ERROR;
3349 #endif
3350
3351 }
3352 break;
3353 }
3354
3355 #ifdef EXPERIMENTAL_DCC
3356 case ACLC_DCC:
3357 {
3358 /* Separate the regular expression and any optional parameters. */
3359 const uschar * list = arg;
3360 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3361 /* Run the dcc backend. */
3362 rc = dcc_process(&ss);
3363 /* Modify return code based upon the existence of options. */
3364 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3365 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3366 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3367 }
3368 break;
3369 #endif
3370
3371 #ifdef WITH_CONTENT_SCAN
3372 case ACLC_DECODE:
3373 rc = mime_decode(&arg);
3374 break;
3375 #endif
3376
3377 case ACLC_DELAY:
3378 {
3379 int delay = readconf_readtime(arg, 0, FALSE);
3380 if (delay < 0)
3381 {
3382 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3383 "modifier: \"%s\" is not a time value", arg);
3384 return ERROR;
3385 }
3386 else
3387 {
3388 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3389 delay);
3390 if (host_checking)
3391 {
3392 HDEBUG(D_acl)
3393 debug_printf_indent("delay skipped in -bh checking mode\n");
3394 }
3395
3396 /* NOTE 1: Remember that we may be
3397 dealing with stdin/stdout here, in addition to TCP/IP connections.
3398 Also, delays may be specified for non-SMTP input, where smtp_out and
3399 smtp_in will be NULL. Whatever is done must work in all cases.
3400
3401 NOTE 2: The added feature of flushing the output before a delay must
3402 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3403 */
3404
3405 else
3406 {
3407 if (smtp_out && !f.disable_delay_flush)
3408 mac_smtp_fflush();
3409
3410 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3411 {
3412 struct pollfd p;
3413 nfds_t n = 0;
3414 if (smtp_out)
3415 {
3416 p.fd = fileno(smtp_out);
3417 p.events = POLLRDHUP;
3418 n = 1;
3419 }
3420 if (poll(&p, n, delay*1000) > 0)
3421 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3422 }
3423 #else
3424 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3425 TCP/IP connection has gone away without reading from it. This means
3426 that we cannot shorten the delay below if the client goes away,
3427 because we cannot discover that the client has closed its end of the
3428 connection. (The connection is actually in a half-closed state,
3429 waiting for the server to close its end.) It would be nice to be able
3430 to detect this state, so that the Exim process is not held up
3431 unnecessarily. However, it seems that we can't. The poll() function
3432 does not do the right thing, and in any case it is not always
3433 available. */
3434
3435 while (delay > 0) delay = sleep(delay);
3436 #endif
3437 }
3438 }
3439 }
3440 break;
3441
3442 #ifndef DISABLE_DKIM
3443 case ACLC_DKIM_SIGNER:
3444 if (dkim_cur_signer)
3445 rc = match_isinlist(dkim_cur_signer,
3446 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3447 else
3448 rc = FAIL;
3449 break;
3450
3451 case ACLC_DKIM_STATUS:
3452 rc = match_isinlist(dkim_verify_status,
3453 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3454 break;
3455 #endif
3456
3457 #ifdef EXPERIMENTAL_DMARC
3458 case ACLC_DMARC_STATUS:
3459 if (!f.dmarc_has_been_checked)
3460 dmarc_process();
3461 f.dmarc_has_been_checked = TRUE;
3462 /* used long way of dmarc_exim_expand_query() in case we need more
3463 * view into the process in the future. */
3464 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3465 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3466 break;
3467 #endif
3468
3469 case ACLC_DNSLISTS:
3470 rc = verify_check_dnsbl(where, &arg, log_msgptr);