DKIM: Allow the DKIM ACL to override verification results. Bug 2186
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2017 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
41 [ACL_DEFER] = (1<<OK),
42 [ACL_DENY] = (1<<OK),
43 [ACL_DISCARD] = (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP),
44 [ACL_DROP] = (1<<OK),
45 [ACL_REQUIRE] = (1<<FAIL) | (1<<FAIL_DROP),
46 [ACL_WARN] = (1<<OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef EXPERIMENTAL_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
141 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
142 #ifndef DISABLE_PRDR
143 (1<<ACL_WHERE_PRDR)|
144 #endif
145 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
146 (1<<ACL_WHERE_DKIM)|
147 (1<<ACL_WHERE_NOTSMTP_START)),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 (1<<ACL_WHERE_NOTSMTP)|
152 (1<<ACL_WHERE_NOTSMTP_START)|
153 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
154 },
155 #ifdef EXPERIMENTAL_BRIGHTMAIL
156 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
157 (1<<ACL_WHERE_AUTH)|
158 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
159 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
160 # ifndef DISABLE_PRDR
161 (1<<ACL_WHERE_PRDR)|
162 # endif
163 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
164 (1<<ACL_WHERE_MAILAUTH)|
165 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
166 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
167 (1<<ACL_WHERE_NOTSMTP_START),
168 },
169 #endif
170 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
171 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
172
173 /* Certain types of control are always allowed, so we let it through
174 always and check in the control processing itself. */
175 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
176
177 #ifdef EXPERIMENTAL_DCC
178 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
179 (unsigned int)
180 ~((1<<ACL_WHERE_DATA)|
181 # ifndef DISABLE_PRDR
182 (1<<ACL_WHERE_PRDR)|
183 # endif
184 (1<<ACL_WHERE_NOTSMTP)),
185 },
186 #endif
187 #ifdef WITH_CONTENT_SCAN
188 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
189
190 #endif
191 [ACLC_DELAY] = { US"delay", TRUE, TRUE, (1<<ACL_WHERE_NOTQUIT) },
192 #ifndef DISABLE_DKIM
193 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
194 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DKIM) },
195 #endif
196 #ifdef EXPERIMENTAL_DMARC
197 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_DATA) },
198 #endif
199
200 /* Explicit key lookups can be made in non-smtp ACLs so pass
201 always and check in the verify processing itself. */
202 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
203
204 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 (unsigned int)
206 ~((1<<ACL_WHERE_RCPT)
207 |(1<<ACL_WHERE_VRFY)
208 #ifndef DISABLE_PRDR
209 |(1<<ACL_WHERE_PRDR)
210 #endif
211 ),
212 },
213 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
214 (1<<ACL_WHERE_NOTSMTP)|
215 (1<<ACL_WHERE_CONNECT)|
216 (1<<ACL_WHERE_NOTSMTP_START)|
217 (1<<ACL_WHERE_HELO),
218 },
219
220 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
221
222 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
223 (1<<ACL_WHERE_NOTSMTP)|
224 (1<<ACL_WHERE_NOTSMTP_START),
225 },
226 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
227 (unsigned int)
228 ~((1<<ACL_WHERE_RCPT)
229 |(1<<ACL_WHERE_VRFY)
230 #ifndef DISABLE_PRDR
231 |(1<<ACL_WHERE_PRDR)
232 #endif
233 ),
234 },
235
236 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
237 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
238 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
239
240 #ifdef WITH_CONTENT_SCAN
241 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
242 (unsigned int)
243 ~((1<<ACL_WHERE_DATA)|
244 # ifndef DISABLE_PRDR
245 (1<<ACL_WHERE_PRDR)|
246 # endif
247 (1<<ACL_WHERE_NOTSMTP)),
248 },
249 #endif
250
251 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
252 #ifdef WITH_CONTENT_SCAN
253 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~(1<<ACL_WHERE_MIME) },
254 #endif
255
256 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
257 (1<<ACL_WHERE_NOTSMTP)|
258 #ifndef DISABLE_PRDR
259 (1<<ACL_WHERE_PRDR)|
260 #endif
261 (1<<ACL_WHERE_DATA),
262 },
263
264 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
265 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~(1<<ACL_WHERE_RCPT) },
266
267 #ifdef WITH_CONTENT_SCAN
268 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
269 (unsigned int)
270 ~((1<<ACL_WHERE_DATA)|
271 # ifndef DISABLE_PRDR
272 (1<<ACL_WHERE_PRDR)|
273 # endif
274 (1<<ACL_WHERE_NOTSMTP)|
275 (1<<ACL_WHERE_MIME)),
276 },
277
278 #endif
279 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
280 (unsigned int)
281 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
282 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
283 #ifndef DISABLE_PRDR
284 (1<<ACL_WHERE_PRDR)|
285 #endif
286 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
287 (1<<ACL_WHERE_NOTSMTP_START)),
288 },
289 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
290 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
291 (1<<ACL_WHERE_HELO)|
292 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
293 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
294 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
295 },
296 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
297 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
298 (1<<ACL_WHERE_HELO)|
299 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
300 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
301 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
302 },
303
304 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
305
306 #ifdef WITH_CONTENT_SCAN
307 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
308 (unsigned int) ~((1<<ACL_WHERE_DATA)|
309 # ifndef DISABLE_PRDR
310 (1<<ACL_WHERE_PRDR)|
311 # endif
312 (1<<ACL_WHERE_NOTSMTP)),
313 },
314 #endif
315 #ifdef EXPERIMENTAL_SPF
316 [ACLC_SPF] = { US"spf", TRUE, FALSE,
317 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
318 (1<<ACL_WHERE_HELO)|
319 (1<<ACL_WHERE_MAILAUTH)|
320 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
321 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
322 (1<<ACL_WHERE_NOTSMTP)|
323 (1<<ACL_WHERE_NOTSMTP_START),
324 },
325 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
326 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)|
327 (1<<ACL_WHERE_HELO)|
328 (1<<ACL_WHERE_MAILAUTH)|
329 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
330 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
331 (1<<ACL_WHERE_NOTSMTP)|
332 (1<<ACL_WHERE_NOTSMTP_START),
333 },
334 #endif
335 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
336
337 /* Certain types of verify are always allowed, so we let it through
338 always and check in the verify function itself */
339 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
340 };
341
342
343
344 /* Return values from decode_control(); used as index so keep in step
345 with the controls_list table that follows! */
346
347 enum {
348 CONTROL_AUTH_UNADVERTISED,
349 #ifdef EXPERIMENTAL_BRIGHTMAIL
350 CONTROL_BMI_RUN,
351 #endif
352 CONTROL_CASEFUL_LOCAL_PART,
353 CONTROL_CASELOWER_LOCAL_PART,
354 CONTROL_CUTTHROUGH_DELIVERY,
355 CONTROL_DEBUG,
356 #ifndef DISABLE_DKIM
357 CONTROL_DKIM_VERIFY,
358 #endif
359 #ifdef EXPERIMENTAL_DMARC
360 CONTROL_DMARC_VERIFY,
361 CONTROL_DMARC_FORENSIC,
362 #endif
363 CONTROL_DSCP,
364 CONTROL_ENFORCE_SYNC,
365 CONTROL_ERROR, /* pseudo-value for decode errors */
366 CONTROL_FAKEDEFER,
367 CONTROL_FAKEREJECT,
368 CONTROL_FREEZE,
369
370 CONTROL_NO_CALLOUT_FLUSH,
371 CONTROL_NO_DELAY_FLUSH,
372 CONTROL_NO_ENFORCE_SYNC,
373 #ifdef WITH_CONTENT_SCAN
374 CONTROL_NO_MBOX_UNSPOOL,
375 #endif
376 CONTROL_NO_MULTILINE,
377 CONTROL_NO_PIPELINING,
378
379 CONTROL_QUEUE_ONLY,
380 CONTROL_SUBMISSION,
381 CONTROL_SUPPRESS_LOCAL_FIXUPS,
382 #ifdef SUPPORT_I18N
383 CONTROL_UTF8_DOWNCONVERT,
384 #endif
385 };
386
387
388
389 /* Structure listing various control arguments, with their characteristics.
390 For each control, there's a bitmap of dis-allowed times. For some, it is easier
391 to specify the negation of a small number of allowed times. */
392
393 typedef struct control_def {
394 uschar *name;
395 BOOL has_option; /* Has /option(s) following */
396 unsigned forbids; /* bitmap of dis-allowed times */
397 } control_def;
398
399 static control_def controls_list[] = {
400 /* name has_option forbids */
401 [CONTROL_AUTH_UNADVERTISED] =
402 { US"allow_auth_unadvertised", FALSE,
403 (unsigned)
404 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
405 },
406 #ifdef EXPERIMENTAL_BRIGHTMAIL
407 [CONTROL_BMI_RUN] =
408 { US"bmi_run", FALSE, 0 },
409 #endif
410 [CONTROL_CASEFUL_LOCAL_PART] =
411 { US"caseful_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
412 [CONTROL_CASELOWER_LOCAL_PART] =
413 { US"caselower_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
414 [CONTROL_CUTTHROUGH_DELIVERY] =
415 { US"cutthrough_delivery", TRUE, 0 },
416 [CONTROL_DEBUG] =
417 { US"debug", TRUE, 0 },
418
419 #ifndef DISABLE_DKIM
420 [CONTROL_DKIM_VERIFY] =
421 { US"dkim_disable_verify", FALSE,
422 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
423 # ifndef DISABLE_PRDR
424 (1<<ACL_WHERE_PRDR)|
425 # endif
426 (1<<ACL_WHERE_NOTSMTP_START)
427 },
428 #endif
429
430 #ifdef EXPERIMENTAL_DMARC
431 [CONTROL_DMARC_VERIFY] =
432 { US"dmarc_disable_verify", FALSE,
433 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
434 },
435 [CONTROL_DMARC_FORENSIC] =
436 { US"dmarc_enable_forensic", FALSE,
437 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
438 },
439 #endif
440
441 [CONTROL_DSCP] =
442 { US"dscp", TRUE,
443 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
444 },
445 [CONTROL_ENFORCE_SYNC] =
446 { US"enforce_sync", FALSE,
447 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
448 },
449
450 /* Pseudo-value for decode errors */
451 [CONTROL_ERROR] =
452 { US"error", FALSE, 0 },
453
454 [CONTROL_FAKEDEFER] =
455 { US"fakedefer", TRUE,
456 (unsigned)
457 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
458 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
459 #ifndef DISABLE_PRDR
460 (1<<ACL_WHERE_PRDR)|
461 #endif
462 (1<<ACL_WHERE_MIME))
463 },
464 [CONTROL_FAKEREJECT] =
465 { US"fakereject", TRUE,
466 (unsigned)
467 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
468 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
469 #ifndef DISABLE_PRDR
470 (1<<ACL_WHERE_PRDR)|
471 #endif
472 (1<<ACL_WHERE_MIME))
473 },
474 [CONTROL_FREEZE] =
475 { US"freeze", TRUE,
476 (unsigned)
477 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
478 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
479 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
480 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
481 },
482
483 [CONTROL_NO_CALLOUT_FLUSH] =
484 { US"no_callout_flush", FALSE,
485 (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
486 },
487 [CONTROL_NO_DELAY_FLUSH] =
488 { US"no_delay_flush", FALSE,
489 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
490 },
491
492 [CONTROL_NO_ENFORCE_SYNC] =
493 { US"no_enforce_sync", FALSE,
494 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
495 },
496 #ifdef WITH_CONTENT_SCAN
497 [CONTROL_NO_MBOX_UNSPOOL] =
498 { US"no_mbox_unspool", FALSE,
499 (unsigned)
500 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
501 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
502 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
503 (1<<ACL_WHERE_MIME))
504 },
505 #endif
506 [CONTROL_NO_MULTILINE] =
507 { US"no_multiline_responses", FALSE,
508 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
509 },
510 [CONTROL_NO_PIPELINING] =
511 { US"no_pipelining", FALSE,
512 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
513 },
514
515 [CONTROL_QUEUE_ONLY] =
516 { US"queue_only", FALSE,
517 (unsigned)
518 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
519 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
520 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
521 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
522 },
523 [CONTROL_SUBMISSION] =
524 { US"submission", TRUE,
525 (unsigned)
526 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
527 },
528 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
529 { US"suppress_local_fixups", FALSE,
530 (unsigned)
531 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
532 (1<<ACL_WHERE_NOTSMTP_START))
533 },
534 #ifdef SUPPORT_I18N
535 [CONTROL_UTF8_DOWNCONVERT] =
536 { US"utf8_downconvert", TRUE, 0 }
537 #endif
538 };
539
540 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
541 caches its result in a tree to avoid repeated DNS queries. The result is an
542 integer code which is used as an index into the following tables of
543 explanatory strings and verification return codes. */
544
545 static tree_node *csa_cache = NULL;
546
547 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
548 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
549
550 /* The acl_verify_csa() return code is translated into an acl_verify() return
551 code using the following table. It is OK unless the client is definitely not
552 authorized. This is because CSA is supposed to be optional for sending sites,
553 so recipients should not be too strict about checking it - especially because
554 DNS problems are quite likely to occur. It's possible to use $csa_status in
555 further ACL conditions to distinguish ok, unknown, and defer if required, but
556 the aim is to make the usual configuration simple. */
557
558 static int csa_return_code[] = {
559 [CSA_UNKNOWN] = OK,
560 [CSA_OK] = OK,
561 [CSA_DEFER_SRV] = OK,
562 [CSA_DEFER_ADDR] = OK,
563 [CSA_FAIL_EXPLICIT] = FAIL,
564 [CSA_FAIL_DOMAIN] = FAIL,
565 [CSA_FAIL_NOADDR] = FAIL,
566 [CSA_FAIL_MISMATCH] = FAIL
567 };
568
569 static uschar *csa_status_string[] = {
570 [CSA_UNKNOWN] = US"unknown",
571 [CSA_OK] = US"ok",
572 [CSA_DEFER_SRV] = US"defer",
573 [CSA_DEFER_ADDR] = US"defer",
574 [CSA_FAIL_EXPLICIT] = US"fail",
575 [CSA_FAIL_DOMAIN] = US"fail",
576 [CSA_FAIL_NOADDR] = US"fail",
577 [CSA_FAIL_MISMATCH] = US"fail"
578 };
579
580 static uschar *csa_reason_string[] = {
581 [CSA_UNKNOWN] = US"unknown",
582 [CSA_OK] = US"ok",
583 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
584 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
585 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
586 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
587 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
588 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
589 };
590
591 /* Options for the ratelimit condition. Note that there are two variants of
592 the per_rcpt option, depending on the ACL that is used to measure the rate.
593 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
594 so the two variants must have the same internal representation as well as
595 the same configuration string. */
596
597 enum {
598 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
599 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
600 };
601
602 #define RATE_SET(var,new) \
603 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
604
605 static uschar *ratelimit_option_string[] = {
606 [RATE_PER_WHAT] = US"?",
607 [RATE_PER_CLASH] = US"!",
608 [RATE_PER_ADDR] = US"per_addr",
609 [RATE_PER_BYTE] = US"per_byte",
610 [RATE_PER_CMD] = US"per_cmd",
611 [RATE_PER_CONN] = US"per_conn",
612 [RATE_PER_MAIL] = US"per_mail",
613 [RATE_PER_RCPT] = US"per_rcpt",
614 [RATE_PER_ALLRCPTS] = US"per_rcpt"
615 };
616
617 /* Enable recursion between acl_check_internal() and acl_check_condition() */
618
619 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
620 uschar **);
621
622
623 /*************************************************
624 * Find control in list *
625 *************************************************/
626
627 /* The lists are always in order, so binary chop can be used.
628
629 Arguments:
630 name the control name to search for
631 ol the first entry in the control list
632 last one more than the offset of the last entry in the control list
633
634 Returns: index of a control entry, or -1 if not found
635 */
636
637 static int
638 find_control(const uschar * name, control_def * ol, int last)
639 {
640 int first = 0;
641 while (last > first)
642 {
643 int middle = (first + last)/2;
644 uschar * s = ol[middle].name;
645 int c = Ustrncmp(name, s, Ustrlen(s));
646 if (c == 0) return middle;
647 else if (c > 0) first = middle + 1;
648 else last = middle;
649 }
650 return -1;
651 }
652
653
654
655 /*************************************************
656 * Pick out condition from list *
657 *************************************************/
658
659 /* Use a binary chop method
660
661 Arguments:
662 name name to find
663 list list of conditions
664 end size of list
665
666 Returns: offset in list, or -1 if not found
667 */
668
669 static int
670 acl_checkcondition(uschar * name, condition_def * list, int end)
671 {
672 int start = 0;
673 while (start < end)
674 {
675 int mid = (start + end)/2;
676 int c = Ustrcmp(name, list[mid].name);
677 if (c == 0) return mid;
678 if (c < 0) end = mid;
679 else start = mid + 1;
680 }
681 return -1;
682 }
683
684
685 /*************************************************
686 * Pick out name from list *
687 *************************************************/
688
689 /* Use a binary chop method
690
691 Arguments:
692 name name to find
693 list list of names
694 end size of list
695
696 Returns: offset in list, or -1 if not found
697 */
698
699 static int
700 acl_checkname(uschar *name, uschar **list, int end)
701 {
702 int start = 0;
703
704 while (start < end)
705 {
706 int mid = (start + end)/2;
707 int c = Ustrcmp(name, list[mid]);
708 if (c == 0) return mid;
709 if (c < 0) end = mid; else start = mid + 1;
710 }
711
712 return -1;
713 }
714
715
716 /*************************************************
717 * Read and parse one ACL *
718 *************************************************/
719
720 /* This function is called both from readconf in order to parse the ACLs in the
721 configuration file, and also when an ACL is encountered dynamically (e.g. as
722 the result of an expansion). It is given a function to call in order to
723 retrieve the lines of the ACL. This function handles skipping comments and
724 blank lines (where relevant).
725
726 Arguments:
727 func function to get next line of ACL
728 error where to put an error message
729
730 Returns: pointer to ACL, or NULL
731 NULL can be legal (empty ACL); in this case error will be NULL
732 */
733
734 acl_block *
735 acl_read(uschar *(*func)(void), uschar **error)
736 {
737 acl_block *yield = NULL;
738 acl_block **lastp = &yield;
739 acl_block *this = NULL;
740 acl_condition_block *cond;
741 acl_condition_block **condp = NULL;
742 uschar *s;
743
744 *error = NULL;
745
746 while ((s = (*func)()) != NULL)
747 {
748 int v, c;
749 BOOL negated = FALSE;
750 uschar *saveline = s;
751 uschar name[64];
752
753 /* Conditions (but not verbs) are allowed to be negated by an initial
754 exclamation mark. */
755
756 while (isspace(*s)) s++;
757 if (*s == '!')
758 {
759 negated = TRUE;
760 s++;
761 }
762
763 /* Read the name of a verb or a condition, or the start of a new ACL, which
764 can be started by a name, or by a macro definition. */
765
766 s = readconf_readname(name, sizeof(name), s);
767 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
768
769 /* If a verb is unrecognized, it may be another condition or modifier that
770 continues the previous verb. */
771
772 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
773 {
774 if (this == NULL)
775 {
776 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
777 saveline);
778 return NULL;
779 }
780 }
781
782 /* New verb */
783
784 else
785 {
786 if (negated)
787 {
788 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
789 return NULL;
790 }
791 this = store_get(sizeof(acl_block));
792 *lastp = this;
793 lastp = &(this->next);
794 this->next = NULL;
795 this->verb = v;
796 this->condition = NULL;
797 condp = &(this->condition);
798 if (*s == 0) continue; /* No condition on this line */
799 if (*s == '!')
800 {
801 negated = TRUE;
802 s++;
803 }
804 s = readconf_readname(name, sizeof(name), s); /* Condition name */
805 }
806
807 /* Handle a condition or modifier. */
808
809 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
810 {
811 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
812 saveline);
813 return NULL;
814 }
815
816 /* The modifiers may not be negated */
817
818 if (negated && conditions[c].is_modifier)
819 {
820 *error = string_sprintf("ACL error: negation is not allowed with "
821 "\"%s\"", conditions[c].name);
822 return NULL;
823 }
824
825 /* ENDPASS may occur only with ACCEPT or DISCARD. */
826
827 if (c == ACLC_ENDPASS &&
828 this->verb != ACL_ACCEPT &&
829 this->verb != ACL_DISCARD)
830 {
831 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
832 conditions[c].name, verbs[this->verb]);
833 return NULL;
834 }
835
836 cond = store_get(sizeof(acl_condition_block));
837 cond->next = NULL;
838 cond->type = c;
839 cond->u.negated = negated;
840
841 *condp = cond;
842 condp = &(cond->next);
843
844 /* The "set" modifier is different in that its argument is "name=value"
845 rather than just a value, and we can check the validity of the name, which
846 gives us a variable name to insert into the data block. The original ACL
847 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
848 extended to 20 of each type, but after that people successfully argued for
849 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
850 After that, we allow alphanumerics and underscores, but the first character
851 after c or m must be a digit or an underscore. This retains backwards
852 compatibility. */
853
854 if (c == ACLC_SET)
855 #ifndef DISABLE_DKIM
856 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
857 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
858 {
859 uschar * endptr = s+18;
860
861 if (isalnum(*endptr))
862 {
863 *error = string_sprintf("invalid variable name after \"set\" in ACL "
864 "modifier \"set %s\" "
865 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
866 s);
867 return NULL;
868 }
869 cond->u.varname = string_copyn(s, 18);
870 s = endptr;
871 while (isspace(*s)) s++;
872 }
873 else
874 #endif
875 {
876 uschar *endptr;
877
878 if (Ustrncmp(s, "acl_c", 5) != 0 &&
879 Ustrncmp(s, "acl_m", 5) != 0)
880 {
881 *error = string_sprintf("invalid variable name after \"set\" in ACL "
882 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
883 return NULL;
884 }
885
886 endptr = s + 5;
887 if (!isdigit(*endptr) && *endptr != '_')
888 {
889 *error = string_sprintf("invalid variable name after \"set\" in ACL "
890 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
891 s);
892 return NULL;
893 }
894
895 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
896 {
897 if (!isalnum(*endptr) && *endptr != '_')
898 {
899 *error = string_sprintf("invalid character \"%c\" in variable name "
900 "in ACL modifier \"set %s\"", *endptr, s);
901 return NULL;
902 }
903 endptr++;
904 }
905
906 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
907 s = endptr;
908 while (isspace(*s)) s++;
909 }
910
911 /* For "set", we are now positioned for the data. For the others, only
912 "endpass" has no data */
913
914 if (c != ACLC_ENDPASS)
915 {
916 if (*s++ != '=')
917 {
918 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
919 conditions[c].is_modifier ? US"modifier" : US"condition");
920 return NULL;
921 }
922 while (isspace(*s)) s++;
923 cond->arg = string_copy(s);
924 }
925 }
926
927 return yield;
928 }
929
930
931
932 /*************************************************
933 * Set up added header line(s) *
934 *************************************************/
935
936 /* This function is called by the add_header modifier, and also from acl_warn()
937 to implement the now-deprecated way of adding header lines using "message" on a
938 "warn" verb. The argument is treated as a sequence of header lines which are
939 added to a chain, provided there isn't an identical one already there.
940
941 Argument: string of header lines
942 Returns: nothing
943 */
944
945 static void
946 setup_header(const uschar *hstring)
947 {
948 const uschar *p, *q;
949 int hlen = Ustrlen(hstring);
950
951 /* Ignore any leading newlines */
952 while (*hstring == '\n') hstring++, hlen--;
953
954 /* An empty string does nothing; ensure exactly one final newline. */
955 if (hlen <= 0) return;
956 if (hstring[--hlen] != '\n') /* no newline */
957 q = string_sprintf("%s\n", hstring);
958 else if (hstring[hlen-1] == '\n') /* double newline */
959 {
960 uschar * s = string_copy(hstring);
961 while(s[--hlen] == '\n')
962 s[hlen+1] = '\0';
963 q = s;
964 }
965 else
966 q = hstring;
967
968 /* Loop for multiple header lines, taking care about continuations */
969
970 for (p = q; *p != 0; )
971 {
972 const uschar *s;
973 uschar * hdr;
974 int newtype = htype_add_bot;
975 header_line **hptr = &acl_added_headers;
976
977 /* Find next header line within the string */
978
979 for (;;)
980 {
981 q = Ustrchr(q, '\n'); /* we know there was a newline */
982 if (*(++q) != ' ' && *q != '\t') break;
983 }
984
985 /* If the line starts with a colon, interpret the instruction for where to
986 add it. This temporarily sets up a new type. */
987
988 if (*p == ':')
989 {
990 if (strncmpic(p, US":after_received:", 16) == 0)
991 {
992 newtype = htype_add_rec;
993 p += 16;
994 }
995 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
996 {
997 newtype = htype_add_rfc;
998 p += 14;
999 }
1000 else if (strncmpic(p, US":at_start:", 10) == 0)
1001 {
1002 newtype = htype_add_top;
1003 p += 10;
1004 }
1005 else if (strncmpic(p, US":at_end:", 8) == 0)
1006 {
1007 newtype = htype_add_bot;
1008 p += 8;
1009 }
1010 while (*p == ' ' || *p == '\t') p++;
1011 }
1012
1013 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1014 to the front of it. */
1015
1016 for (s = p; s < q - 1; s++)
1017 {
1018 if (*s == ':' || !isgraph(*s)) break;
1019 }
1020
1021 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1022 hlen = Ustrlen(hdr);
1023
1024 /* See if this line has already been added */
1025
1026 while (*hptr != NULL)
1027 {
1028 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1029 hptr = &((*hptr)->next);
1030 }
1031
1032 /* Add if not previously present */
1033
1034 if (*hptr == NULL)
1035 {
1036 header_line *h = store_get(sizeof(header_line));
1037 h->text = hdr;
1038 h->next = NULL;
1039 h->type = newtype;
1040 h->slen = hlen;
1041 *hptr = h;
1042 hptr = &(h->next);
1043 }
1044
1045 /* Advance for next header line within the string */
1046
1047 p = q;
1048 }
1049 }
1050
1051
1052
1053 /*************************************************
1054 * List the added header lines *
1055 *************************************************/
1056 uschar *
1057 fn_hdrs_added(void)
1058 {
1059 gstring * g = NULL;
1060 header_line * h = acl_added_headers;
1061 uschar * s;
1062 uschar * cp;
1063
1064 if (!h) return NULL;
1065
1066 do
1067 {
1068 s = h->text;
1069 while ((cp = Ustrchr(s, '\n')) != NULL)
1070 {
1071 if (cp[1] == '\0') break;
1072
1073 /* contains embedded newline; needs doubling */
1074 g = string_catn(g, s, cp-s+1);
1075 g = string_catn(g, US"\n", 1);
1076 s = cp+1;
1077 }
1078 /* last bit of header */
1079
1080 /*XXX could we use add_listele? */
1081 g = string_catn(g, s, cp-s+1); /* newline-sep list */
1082 }
1083 while((h = h->next));
1084
1085 g->s[g->ptr - 1] = '\0'; /* overwrite last newline */
1086 return g->s;
1087 }
1088
1089
1090 /*************************************************
1091 * Set up removed header line(s) *
1092 *************************************************/
1093
1094 /* This function is called by the remove_header modifier. The argument is
1095 treated as a sequence of header names which are added to a colon separated
1096 list, provided there isn't an identical one already there.
1097
1098 Argument: string of header names
1099 Returns: nothing
1100 */
1101
1102 static void
1103 setup_remove_header(const uschar *hnames)
1104 {
1105 if (*hnames != 0)
1106 acl_removed_headers = acl_removed_headers
1107 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1108 : string_copy(hnames);
1109 }
1110
1111
1112
1113 /*************************************************
1114 * Handle warnings *
1115 *************************************************/
1116
1117 /* This function is called when a WARN verb's conditions are true. It adds to
1118 the message's headers, and/or writes information to the log. In each case, this
1119 only happens once (per message for headers, per connection for log).
1120
1121 ** NOTE: The header adding action using the "message" setting is historic, and
1122 its use is now deprecated. The new add_header modifier should be used instead.
1123
1124 Arguments:
1125 where ACL_WHERE_xxxx indicating which ACL this is
1126 user_message message for adding to headers
1127 log_message message for logging, if different
1128
1129 Returns: nothing
1130 */
1131
1132 static void
1133 acl_warn(int where, uschar *user_message, uschar *log_message)
1134 {
1135 if (log_message != NULL && log_message != user_message)
1136 {
1137 uschar *text;
1138 string_item *logged;
1139
1140 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1141 string_printing(log_message));
1142
1143 /* If a sender verification has failed, and the log message is "sender verify
1144 failed", add the failure message. */
1145
1146 if (sender_verified_failed != NULL &&
1147 sender_verified_failed->message != NULL &&
1148 strcmpic(log_message, US"sender verify failed") == 0)
1149 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1150
1151 /* Search previously logged warnings. They are kept in malloc
1152 store so they can be freed at the start of a new message. */
1153
1154 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1155 if (Ustrcmp(logged->text, text) == 0) break;
1156
1157 if (logged == NULL)
1158 {
1159 int length = Ustrlen(text) + 1;
1160 log_write(0, LOG_MAIN, "%s", text);
1161 logged = store_malloc(sizeof(string_item) + length);
1162 logged->text = US logged + sizeof(string_item);
1163 memcpy(logged->text, text, length);
1164 logged->next = acl_warn_logged;
1165 acl_warn_logged = logged;
1166 }
1167 }
1168
1169 /* If there's no user message, we are done. */
1170
1171 if (user_message == NULL) return;
1172
1173 /* If this isn't a message ACL, we can't do anything with a user message.
1174 Log an error. */
1175
1176 if (where > ACL_WHERE_NOTSMTP)
1177 {
1178 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1179 "found in a non-message (%s) ACL: cannot specify header lines here: "
1180 "message ignored", acl_wherenames[where]);
1181 return;
1182 }
1183
1184 /* The code for setting up header lines is now abstracted into a separate
1185 function so that it can be used for the add_header modifier as well. */
1186
1187 setup_header(user_message);
1188 }
1189
1190
1191
1192 /*************************************************
1193 * Verify and check reverse DNS *
1194 *************************************************/
1195
1196 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1197 address if this has not yet been done. The host_name_lookup() function checks
1198 that one of these names resolves to an address list that contains the client IP
1199 address, so we don't actually have to do the check here.
1200
1201 Arguments:
1202 user_msgptr pointer for user message
1203 log_msgptr pointer for log message
1204
1205 Returns: OK verification condition succeeded
1206 FAIL verification failed
1207 DEFER there was a problem verifying
1208 */
1209
1210 static int
1211 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1212 {
1213 int rc;
1214
1215 user_msgptr = user_msgptr; /* stop compiler warning */
1216
1217 /* Previous success */
1218
1219 if (sender_host_name != NULL) return OK;
1220
1221 /* Previous failure */
1222
1223 if (host_lookup_failed)
1224 {
1225 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1226 return FAIL;
1227 }
1228
1229 /* Need to do a lookup */
1230
1231 HDEBUG(D_acl)
1232 debug_printf_indent("looking up host name to force name/address consistency check\n");
1233
1234 if ((rc = host_name_lookup()) != OK)
1235 {
1236 *log_msgptr = (rc == DEFER)?
1237 US"host lookup deferred for reverse lookup check"
1238 :
1239 string_sprintf("host lookup failed for reverse lookup check%s",
1240 host_lookup_msg);
1241 return rc; /* DEFER or FAIL */
1242 }
1243
1244 host_build_sender_fullhost();
1245 return OK;
1246 }
1247
1248
1249
1250 /*************************************************
1251 * Check client IP address matches CSA target *
1252 *************************************************/
1253
1254 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1255 response for address records belonging to the CSA target hostname. The section
1256 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1257 If one of the addresses matches the client's IP address, then the client is
1258 authorized by CSA. If there are target IP addresses but none of them match
1259 then the client is using an unauthorized IP address. If there are no target IP
1260 addresses then the client cannot be using an authorized IP address. (This is
1261 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1262
1263 Arguments:
1264 dnsa the DNS answer block
1265 dnss a DNS scan block for us to use
1266 reset option specifying what portion to scan, as described above
1267 target the target hostname to use for matching RR names
1268
1269 Returns: CSA_OK successfully authorized
1270 CSA_FAIL_MISMATCH addresses found but none matched
1271 CSA_FAIL_NOADDR no target addresses found
1272 */
1273
1274 static int
1275 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1276 uschar *target)
1277 {
1278 dns_record *rr;
1279 dns_address *da;
1280
1281 BOOL target_found = FALSE;
1282
1283 for (rr = dns_next_rr(dnsa, dnss, reset);
1284 rr != NULL;
1285 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1286 {
1287 /* Check this is an address RR for the target hostname. */
1288
1289 if (rr->type != T_A
1290 #if HAVE_IPV6
1291 && rr->type != T_AAAA
1292 #endif
1293 ) continue;
1294
1295 if (strcmpic(target, rr->name) != 0) continue;
1296
1297 target_found = TRUE;
1298
1299 /* Turn the target address RR into a list of textual IP addresses and scan
1300 the list. There may be more than one if it is an A6 RR. */
1301
1302 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1303 {
1304 /* If the client IP address matches the target IP address, it's good! */
1305
1306 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1307
1308 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1309 }
1310 }
1311
1312 /* If we found some target addresses but none of them matched, the client is
1313 using an unauthorized IP address, otherwise the target has no authorized IP
1314 addresses. */
1315
1316 if (target_found) return CSA_FAIL_MISMATCH;
1317 else return CSA_FAIL_NOADDR;
1318 }
1319
1320
1321
1322 /*************************************************
1323 * Verify Client SMTP Authorization *
1324 *************************************************/
1325
1326 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1327 to find the CSA SRV record corresponding to the domain argument, or
1328 $sender_helo_name if no argument is provided. It then checks that the
1329 client is authorized, and that its IP address corresponds to the SRV
1330 target's address by calling acl_verify_csa_address() above. The address
1331 should have been returned in the DNS response's ADDITIONAL section, but if
1332 not we perform another DNS lookup to get it.
1333
1334 Arguments:
1335 domain pointer to optional parameter following verify = csa
1336
1337 Returns: CSA_UNKNOWN no valid CSA record found
1338 CSA_OK successfully authorized
1339 CSA_FAIL_* client is definitely not authorized
1340 CSA_DEFER_* there was a DNS problem
1341 */
1342
1343 static int
1344 acl_verify_csa(const uschar *domain)
1345 {
1346 tree_node *t;
1347 const uschar *found;
1348 int priority, weight, port;
1349 dns_answer dnsa;
1350 dns_scan dnss;
1351 dns_record *rr;
1352 int rc, type;
1353 uschar target[256];
1354
1355 /* Work out the domain we are using for the CSA lookup. The default is the
1356 client's HELO domain. If the client has not said HELO, use its IP address
1357 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1358
1359 while (isspace(*domain) && *domain != '\0') ++domain;
1360 if (*domain == '\0') domain = sender_helo_name;
1361 if (domain == NULL) domain = sender_host_address;
1362 if (sender_host_address == NULL) return CSA_UNKNOWN;
1363
1364 /* If we have an address literal, strip off the framing ready for turning it
1365 into a domain. The framing consists of matched square brackets possibly
1366 containing a keyword and a colon before the actual IP address. */
1367
1368 if (domain[0] == '[')
1369 {
1370 const uschar *start = Ustrchr(domain, ':');
1371 if (start == NULL) start = domain;
1372 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1373 }
1374
1375 /* Turn domains that look like bare IP addresses into domains in the reverse
1376 DNS. This code also deals with address literals and $sender_host_address. It's
1377 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1378 address literals, but it's probably the most friendly thing to do. This is an
1379 extension to CSA, so we allow it to be turned off for proper conformance. */
1380
1381 if (string_is_ip_address(domain, NULL) != 0)
1382 {
1383 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1384 dns_build_reverse(domain, target);
1385 domain = target;
1386 }
1387
1388 /* Find out if we've already done the CSA check for this domain. If we have,
1389 return the same result again. Otherwise build a new cached result structure
1390 for this domain. The name is filled in now, and the value is filled in when
1391 we return from this function. */
1392
1393 t = tree_search(csa_cache, domain);
1394 if (t != NULL) return t->data.val;
1395
1396 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1397 Ustrcpy(t->name, domain);
1398 (void)tree_insertnode(&csa_cache, t);
1399
1400 /* Now we are ready to do the actual DNS lookup(s). */
1401
1402 found = domain;
1403 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1404 {
1405 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1406
1407 default:
1408 return t->data.val = CSA_DEFER_SRV;
1409
1410 /* If we found nothing, the client's authorization is unknown. */
1411
1412 case DNS_NOMATCH:
1413 case DNS_NODATA:
1414 return t->data.val = CSA_UNKNOWN;
1415
1416 /* We got something! Go on to look at the reply in more detail. */
1417
1418 case DNS_SUCCEED:
1419 break;
1420 }
1421
1422 /* Scan the reply for well-formed CSA SRV records. */
1423
1424 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1425 rr;
1426 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1427 {
1428 const uschar * p = rr->data;
1429
1430 /* Extract the numerical SRV fields (p is incremented) */
1431
1432 GETSHORT(priority, p);
1433 GETSHORT(weight, p);
1434 GETSHORT(port, p);
1435
1436 DEBUG(D_acl)
1437 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1438
1439 /* Check the CSA version number */
1440
1441 if (priority != 1) continue;
1442
1443 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1444 found by dns_special_lookup() is a parent of the one we asked for), we check
1445 the subdomain assertions in the port field. At the moment there's only one
1446 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1447 SRV records of their own. */
1448
1449 if (Ustrcmp(found, domain) != 0)
1450 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1451
1452 /* This CSA SRV record refers directly to our domain, so we check the value
1453 in the weight field to work out the domain's authorization. 0 and 1 are
1454 unauthorized; 3 means the client is authorized but we can't check the IP
1455 address in order to authenticate it, so we treat it as unknown; values
1456 greater than 3 are undefined. */
1457
1458 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1459
1460 if (weight > 2) continue;
1461
1462 /* Weight == 2, which means the domain is authorized. We must check that the
1463 client's IP address is listed as one of the SRV target addresses. Save the
1464 target hostname then break to scan the additional data for its addresses. */
1465
1466 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1467 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1468
1469 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1470
1471 break;
1472 }
1473
1474 /* If we didn't break the loop then no appropriate records were found. */
1475
1476 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1477
1478 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1479 A target of "." indicates there are no valid addresses, so the client cannot
1480 be authorized. (This is an odd configuration because weight=2 target=. is
1481 equivalent to weight=1, but we check for it in order to keep load off the
1482 root name servers.) Note that dn_expand() turns "." into "". */
1483
1484 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1485
1486 /* Scan the additional section of the CSA SRV reply for addresses belonging
1487 to the target. If the name server didn't return any additional data (e.g.
1488 because it does not fully support SRV records), we need to do another lookup
1489 to obtain the target addresses; otherwise we have a definitive result. */
1490
1491 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1492 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1493
1494 /* The DNS lookup type corresponds to the IP version used by the client. */
1495
1496 #if HAVE_IPV6
1497 if (Ustrchr(sender_host_address, ':') != NULL)
1498 type = T_AAAA;
1499 else
1500 #endif /* HAVE_IPV6 */
1501 type = T_A;
1502
1503
1504 lookup_dnssec_authenticated = NULL;
1505 switch (dns_lookup(&dnsa, target, type, NULL))
1506 {
1507 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1508
1509 default:
1510 return t->data.val = CSA_DEFER_ADDR;
1511
1512 /* If the query succeeded, scan the addresses and return the result. */
1513
1514 case DNS_SUCCEED:
1515 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1516 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1517 /* else fall through */
1518
1519 /* If the target has no IP addresses, the client cannot have an authorized
1520 IP address. However, if the target site uses A6 records (not AAAA records)
1521 we have to do yet another lookup in order to check them. */
1522
1523 case DNS_NOMATCH:
1524 case DNS_NODATA:
1525 return t->data.val = CSA_FAIL_NOADDR;
1526 }
1527 }
1528
1529
1530
1531 /*************************************************
1532 * Handle verification (address & other) *
1533 *************************************************/
1534
1535 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1536 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1537 VERIFY_HDR_NAMES_ASCII
1538 };
1539 typedef struct {
1540 uschar * name;
1541 int value;
1542 unsigned where_allowed; /* bitmap */
1543 BOOL no_options; /* Never has /option(s) following */
1544 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1545 } verify_type_t;
1546 static verify_type_t verify_type_list[] = {
1547 /* name value where no-opt opt-sep */
1548 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1549 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1550 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1551 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1552 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1553 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1554 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1555 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1556 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1557 FALSE, 6 },
1558 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1559 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
1560 };
1561
1562
1563 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1564 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1565 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1566 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1567 };
1568 typedef struct {
1569 uschar * name;
1570 int value;
1571 int flag;
1572 BOOL has_option; /* Has =option(s) following */
1573 BOOL timeval; /* Has a time value */
1574 } callout_opt_t;
1575 static callout_opt_t callout_opt_list[] = {
1576 /* name value flag has-opt has-time */
1577 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1578 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1579 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1580 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1581 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1582 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1583 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1584 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1585 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1586 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1587 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1588 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1589 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1590 };
1591
1592
1593
1594 /* This function implements the "verify" condition. It is called when
1595 encountered in any ACL, because some tests are almost always permitted. Some
1596 just don't make sense, and always fail (for example, an attempt to test a host
1597 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1598
1599 Arguments:
1600 where where called from
1601 addr the recipient address that the ACL is handling, or NULL
1602 arg the argument of "verify"
1603 user_msgptr pointer for user message
1604 log_msgptr pointer for log message
1605 basic_errno where to put verify errno
1606
1607 Returns: OK verification condition succeeded
1608 FAIL verification failed
1609 DEFER there was a problem verifying
1610 ERROR syntax error
1611 */
1612
1613 static int
1614 acl_verify(int where, address_item *addr, const uschar *arg,
1615 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1616 {
1617 int sep = '/';
1618 int callout = -1;
1619 int callout_overall = -1;
1620 int callout_connect = -1;
1621 int verify_options = 0;
1622 int rc;
1623 BOOL verify_header_sender = FALSE;
1624 BOOL defer_ok = FALSE;
1625 BOOL callout_defer_ok = FALSE;
1626 BOOL no_details = FALSE;
1627 BOOL success_on_redirect = FALSE;
1628 address_item *sender_vaddr = NULL;
1629 uschar *verify_sender_address = NULL;
1630 uschar *pm_mailfrom = NULL;
1631 uschar *se_mailfrom = NULL;
1632
1633 /* Some of the verify items have slash-separated options; some do not. Diagnose
1634 an error if options are given for items that don't expect them.
1635 */
1636
1637 uschar *slash = Ustrchr(arg, '/');
1638 const uschar *list = arg;
1639 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1640 verify_type_t * vp;
1641
1642 if (ss == NULL) goto BAD_VERIFY;
1643
1644 /* Handle name/address consistency verification in a separate function. */
1645
1646 for (vp= verify_type_list;
1647 CS vp < CS verify_type_list + sizeof(verify_type_list);
1648 vp++
1649 )
1650 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1651 : strcmpic (ss, vp->name) == 0)
1652 break;
1653 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1654 goto BAD_VERIFY;
1655
1656 if (vp->no_options && slash != NULL)
1657 {
1658 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1659 "(this verify item has no options)", arg);
1660 return ERROR;
1661 }
1662 if (!(vp->where_allowed & (1<<where)))
1663 {
1664 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1665 return ERROR;
1666 }
1667 switch(vp->value)
1668 {
1669 case VERIFY_REV_HOST_LKUP:
1670 if (sender_host_address == NULL) return OK;
1671 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1672 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1673 if (strcmpic(ss, US"defer_ok") == 0)
1674 return OK;
1675 return rc;
1676
1677 case VERIFY_CERT:
1678 /* TLS certificate verification is done at STARTTLS time; here we just
1679 test whether it was successful or not. (This is for optional verification; for
1680 mandatory verification, the connection doesn't last this long.) */
1681
1682 if (tls_in.certificate_verified) return OK;
1683 *user_msgptr = US"no verified certificate";
1684 return FAIL;
1685
1686 case VERIFY_HELO:
1687 /* We can test the result of optional HELO verification that might have
1688 occurred earlier. If not, we can attempt the verification now. */
1689
1690 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1691 return helo_verified? OK : FAIL;
1692
1693 case VERIFY_CSA:
1694 /* Do Client SMTP Authorization checks in a separate function, and turn the
1695 result code into user-friendly strings. */
1696
1697 rc = acl_verify_csa(list);
1698 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1699 csa_reason_string[rc]);
1700 csa_status = csa_status_string[rc];
1701 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1702 return csa_return_code[rc];
1703
1704 case VERIFY_HDR_SYNTAX:
1705 /* Check that all relevant header lines have the correct syntax. If there is
1706 a syntax error, we return details of the error to the sender if configured to
1707 send out full details. (But a "message" setting on the ACL can override, as
1708 always). */
1709
1710 rc = verify_check_headers(log_msgptr);
1711 if (rc != OK && *log_msgptr)
1712 if (smtp_return_error_details)
1713 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1714 else
1715 acl_verify_message = *log_msgptr;
1716 return rc;
1717
1718 case VERIFY_HDR_NAMES_ASCII:
1719 /* Check that all header names are true 7 bit strings
1720 See RFC 5322, 2.2. and RFC 6532, 3. */
1721
1722 rc = verify_check_header_names_ascii(log_msgptr);
1723 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1724 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1725 return rc;
1726
1727 case VERIFY_NOT_BLIND:
1728 /* Check that no recipient of this message is "blind", that is, every envelope
1729 recipient must be mentioned in either To: or Cc:. */
1730
1731 rc = verify_check_notblind();
1732 if (rc != OK)
1733 {
1734 *log_msgptr = string_sprintf("bcc recipient detected");
1735 if (smtp_return_error_details)
1736 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1737 }
1738 return rc;
1739
1740 /* The remaining verification tests check recipient and sender addresses,
1741 either from the envelope or from the header. There are a number of
1742 slash-separated options that are common to all of them. */
1743
1744 case VERIFY_HDR_SNDR:
1745 verify_header_sender = TRUE;
1746 break;
1747
1748 case VERIFY_SNDR:
1749 /* In the case of a sender, this can optionally be followed by an address to use
1750 in place of the actual sender (rare special-case requirement). */
1751 {
1752 uschar *s = ss + 6;
1753 if (*s == 0)
1754 verify_sender_address = sender_address;
1755 else
1756 {
1757 while (isspace(*s)) s++;
1758 if (*s++ != '=') goto BAD_VERIFY;
1759 while (isspace(*s)) s++;
1760 verify_sender_address = string_copy(s);
1761 }
1762 }
1763 break;
1764
1765 case VERIFY_RCPT:
1766 break;
1767 }
1768
1769
1770
1771 /* Remaining items are optional; they apply to sender and recipient
1772 verification, including "header sender" verification. */
1773
1774 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1775 != NULL)
1776 {
1777 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1778 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1779 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1780
1781 /* These two old options are left for backwards compatibility */
1782
1783 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1784 {
1785 callout_defer_ok = TRUE;
1786 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1787 }
1788
1789 else if (strcmpic(ss, US"check_postmaster") == 0)
1790 {
1791 pm_mailfrom = US"";
1792 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1793 }
1794
1795 /* The callout option has a number of sub-options, comma separated */
1796
1797 else if (strncmpic(ss, US"callout", 7) == 0)
1798 {
1799 callout = CALLOUT_TIMEOUT_DEFAULT;
1800 ss += 7;
1801 if (*ss != 0)
1802 {
1803 while (isspace(*ss)) ss++;
1804 if (*ss++ == '=')
1805 {
1806 const uschar * sublist = ss;
1807 int optsep = ',';
1808 uschar *opt;
1809 uschar buffer[256];
1810 while (isspace(*sublist)) sublist++;
1811
1812 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1813 {
1814 callout_opt_t * op;
1815 double period = 1.0F;
1816
1817 for (op= callout_opt_list; op->name; op++)
1818 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1819 break;
1820
1821 verify_options |= op->flag;
1822 if (op->has_option)
1823 {
1824 opt += Ustrlen(op->name);
1825 while (isspace(*opt)) opt++;
1826 if (*opt++ != '=')
1827 {
1828 *log_msgptr = string_sprintf("'=' expected after "
1829 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1830 return ERROR;
1831 }
1832 while (isspace(*opt)) opt++;
1833 }
1834 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1835 {
1836 *log_msgptr = string_sprintf("bad time value in ACL condition "
1837 "\"verify %s\"", arg);
1838 return ERROR;
1839 }
1840
1841 switch(op->value)
1842 {
1843 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1844 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1845 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1846 case CALLOUT_MAILFROM:
1847 if (!verify_header_sender)
1848 {
1849 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1850 "callout option only for verify=header_sender (detected in ACL "
1851 "condition \"%s\")", arg);
1852 return ERROR;
1853 }
1854 se_mailfrom = string_copy(opt);
1855 break;
1856 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1857 case CALLOUT_MAXWAIT: callout_overall = period; break;
1858 case CALLOUT_CONNECT: callout_connect = period; break;
1859 case CALLOUT_TIME: callout = period; break;
1860 }
1861 }
1862 }
1863 else
1864 {
1865 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1866 "ACL condition \"%s\"", arg);
1867 return ERROR;
1868 }
1869 }
1870 }
1871
1872 /* Option not recognized */
1873
1874 else
1875 {
1876 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1877 "condition \"verify %s\"", ss, arg);
1878 return ERROR;
1879 }
1880 }
1881
1882 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1883 (vopt_callout_recipsender|vopt_callout_recippmaster))
1884 {
1885 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1886 "for a recipient callout";
1887 return ERROR;
1888 }
1889
1890 /* Handle sender-in-header verification. Default the user message to the log
1891 message if giving out verification details. */
1892
1893 if (verify_header_sender)
1894 {
1895 int verrno;
1896
1897 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1898 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1899 &verrno)) != OK)
1900 {
1901 *basic_errno = verrno;
1902 if (smtp_return_error_details)
1903 {
1904 if (!*user_msgptr && *log_msgptr)
1905 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1906 if (rc == DEFER) acl_temp_details = TRUE;
1907 }
1908 }
1909 }
1910
1911 /* Handle a sender address. The default is to verify *the* sender address, but
1912 optionally a different address can be given, for special requirements. If the
1913 address is empty, we are dealing with a bounce message that has no sender, so
1914 we cannot do any checking. If the real sender address gets rewritten during
1915 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1916 during message reception.
1917
1918 A list of verified "sender" addresses is kept to try to avoid doing to much
1919 work repetitively when there are multiple recipients in a message and they all
1920 require sender verification. However, when callouts are involved, it gets too
1921 complicated because different recipients may require different callout options.
1922 Therefore, we always do a full sender verify when any kind of callout is
1923 specified. Caching elsewhere, for instance in the DNS resolver and in the
1924 callout handling, should ensure that this is not terribly inefficient. */
1925
1926 else if (verify_sender_address)
1927 {
1928 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1929 {
1930 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1931 "sender verify callout";
1932 return ERROR;
1933 }
1934
1935 sender_vaddr = verify_checked_sender(verify_sender_address);
1936 if (sender_vaddr != NULL && /* Previously checked */
1937 callout <= 0) /* No callout needed this time */
1938 {
1939 /* If the "routed" flag is set, it means that routing worked before, so
1940 this check can give OK (the saved return code value, if set, belongs to a
1941 callout that was done previously). If the "routed" flag is not set, routing
1942 must have failed, so we use the saved return code. */
1943
1944 if (testflag(sender_vaddr, af_verify_routed))
1945 rc = OK;
1946 else
1947 {
1948 rc = sender_vaddr->special_action;
1949 *basic_errno = sender_vaddr->basic_errno;
1950 }
1951 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1952 }
1953
1954 /* Do a new verification, and cache the result. The cache is used to avoid
1955 verifying the sender multiple times for multiple RCPTs when callouts are not
1956 specified (see comments above).
1957
1958 The cache is also used on failure to give details in response to the first
1959 RCPT that gets bounced for this reason. However, this can be suppressed by
1960 the no_details option, which sets the flag that says "this detail has already
1961 been sent". The cache normally contains just one address, but there may be
1962 more in esoteric circumstances. */
1963
1964 else
1965 {
1966 BOOL routed = TRUE;
1967 uschar *save_address_data = deliver_address_data;
1968
1969 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1970 #ifdef SUPPORT_I18N
1971 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1972 {
1973 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1974 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1975 }
1976 #endif
1977 if (no_details) setflag(sender_vaddr, af_sverify_told);
1978 if (verify_sender_address[0] != 0)
1979 {
1980 /* If this is the real sender address, save the unrewritten version
1981 for use later in receive. Otherwise, set a flag so that rewriting the
1982 sender in verify_address() does not update sender_address. */
1983
1984 if (verify_sender_address == sender_address)
1985 sender_address_unrewritten = sender_address;
1986 else
1987 verify_options |= vopt_fake_sender;
1988
1989 if (success_on_redirect)
1990 verify_options |= vopt_success_on_redirect;
1991
1992 /* The recipient, qualify, and expn options are never set in
1993 verify_options. */
1994
1995 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1996 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1997
1998 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
1999
2000 if (rc != OK)
2001 *basic_errno = sender_vaddr->basic_errno;
2002 else
2003 DEBUG(D_acl)
2004 {
2005 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2006 debug_printf_indent("sender %s verified ok as %s\n",
2007 verify_sender_address, sender_vaddr->address);
2008 else
2009 debug_printf_indent("sender %s verified ok\n",
2010 verify_sender_address);
2011 }
2012 }
2013 else
2014 rc = OK; /* Null sender */
2015
2016 /* Cache the result code */
2017
2018 if (routed) setflag(sender_vaddr, af_verify_routed);
2019 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2020 sender_vaddr->special_action = rc;
2021 sender_vaddr->next = sender_verified_list;
2022 sender_verified_list = sender_vaddr;
2023
2024 /* Restore the recipient address data, which might have been clobbered by
2025 the sender verification. */
2026
2027 deliver_address_data = save_address_data;
2028 }
2029
2030 /* Put the sender address_data value into $sender_address_data */
2031
2032 sender_address_data = sender_vaddr->prop.address_data;
2033 }
2034
2035 /* A recipient address just gets a straightforward verify; again we must handle
2036 the DEFER overrides. */
2037
2038 else
2039 {
2040 address_item addr2;
2041
2042 if (success_on_redirect)
2043 verify_options |= vopt_success_on_redirect;
2044
2045 /* We must use a copy of the address for verification, because it might
2046 get rewritten. */
2047
2048 addr2 = *addr;
2049 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2050 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2051 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2052
2053 *basic_errno = addr2.basic_errno;
2054 *log_msgptr = addr2.message;
2055 *user_msgptr = (addr2.user_message != NULL)?
2056 addr2.user_message : addr2.message;
2057
2058 /* Allow details for temporary error if the address is so flagged. */
2059 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
2060
2061 /* Make $address_data visible */
2062 deliver_address_data = addr2.prop.address_data;
2063 }
2064
2065 /* We have a result from the relevant test. Handle defer overrides first. */
2066
2067 if (rc == DEFER && (defer_ok ||
2068 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2069 {
2070 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2071 defer_ok? "defer_ok" : "callout_defer_ok");
2072 rc = OK;
2073 }
2074
2075 /* If we've failed a sender, set up a recipient message, and point
2076 sender_verified_failed to the address item that actually failed. */
2077
2078 if (rc != OK && verify_sender_address != NULL)
2079 {
2080 if (rc != DEFER)
2081 *log_msgptr = *user_msgptr = US"Sender verify failed";
2082 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2083 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2084 else
2085 {
2086 *log_msgptr = US"Could not complete sender verify callout";
2087 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2088 *log_msgptr;
2089 }
2090
2091 sender_verified_failed = sender_vaddr;
2092 }
2093
2094 /* Verifying an address messes up the values of $domain and $local_part,
2095 so reset them before returning if this is a RCPT ACL. */
2096
2097 if (addr != NULL)
2098 {
2099 deliver_domain = addr->domain;
2100 deliver_localpart = addr->local_part;
2101 }
2102 return rc;
2103
2104 /* Syntax errors in the verify argument come here. */
2105
2106 BAD_VERIFY:
2107 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2108 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2109 "or \"reverse_host_lookup\" at start of ACL condition "
2110 "\"verify %s\"", arg);
2111 return ERROR;
2112 }
2113
2114
2115
2116
2117 /*************************************************
2118 * Check argument for control= modifier *
2119 *************************************************/
2120
2121 /* Called from acl_check_condition() below
2122
2123 Arguments:
2124 arg the argument string for control=
2125 pptr set to point to the terminating character
2126 where which ACL we are in
2127 log_msgptr for error messages
2128
2129 Returns: CONTROL_xxx value
2130 */
2131
2132 static int
2133 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2134 {
2135 int idx, len;
2136 control_def * d;
2137
2138 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2139 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2140 && (!d->has_option || arg[len] != '/')
2141 ) )
2142 {
2143 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2144 return CONTROL_ERROR;
2145 }
2146
2147 *pptr = arg + len;
2148 return idx;
2149 }
2150
2151
2152
2153
2154 /*************************************************
2155 * Return a ratelimit error *
2156 *************************************************/
2157
2158 /* Called from acl_ratelimit() below
2159
2160 Arguments:
2161 log_msgptr for error messages
2162 format format string
2163 ... supplementary arguments
2164 ss ratelimit option name
2165 where ACL_WHERE_xxxx indicating which ACL this is
2166
2167 Returns: ERROR
2168 */
2169
2170 static int
2171 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2172 {
2173 va_list ap;
2174 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2175 va_start(ap, format);
2176 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2177 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2178 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2179 va_end(ap);
2180 *log_msgptr = string_sprintf(
2181 "error in arguments to \"ratelimit\" condition: %s", buffer);
2182 return ERROR;
2183 }
2184
2185
2186
2187
2188 /*************************************************
2189 * Handle rate limiting *
2190 *************************************************/
2191
2192 /* Called by acl_check_condition() below to calculate the result
2193 of the ACL ratelimit condition.
2194
2195 Note that the return value might be slightly unexpected: if the
2196 sender's rate is above the limit then the result is OK. This is
2197 similar to the dnslists condition, and is so that you can write
2198 ACL clauses like: defer ratelimit = 15 / 1h
2199
2200 Arguments:
2201 arg the option string for ratelimit=
2202 where ACL_WHERE_xxxx indicating which ACL this is
2203 log_msgptr for error messages
2204
2205 Returns: OK - Sender's rate is above limit
2206 FAIL - Sender's rate is below limit
2207 DEFER - Problem opening ratelimit database
2208 ERROR - Syntax error in options.
2209 */
2210
2211 static int
2212 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2213 {
2214 double limit, period, count;
2215 uschar *ss;
2216 uschar *key = NULL;
2217 uschar *unique = NULL;
2218 int sep = '/';
2219 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2220 BOOL noupdate = FALSE, badacl = FALSE;
2221 int mode = RATE_PER_WHAT;
2222 int old_pool, rc;
2223 tree_node **anchor, *t;
2224 open_db dbblock, *dbm;
2225 int dbdb_size;
2226 dbdata_ratelimit *dbd;
2227 dbdata_ratelimit_unique *dbdb;
2228 struct timeval tv;
2229
2230 /* Parse the first two options and record their values in expansion
2231 variables. These variables allow the configuration to have informative
2232 error messages based on rate limits obtained from a table lookup. */
2233
2234 /* First is the maximum number of messages per period / maximum burst
2235 size, which must be greater than or equal to zero. Zero is useful for
2236 rate measurement as opposed to rate limiting. */
2237
2238 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2239 if (sender_rate_limit == NULL)
2240 return ratelimit_error(log_msgptr, "sender rate limit not set");
2241
2242 limit = Ustrtod(sender_rate_limit, &ss);
2243 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2244 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2245 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2246
2247 if (limit < 0.0 || *ss != '\0')
2248 return ratelimit_error(log_msgptr,
2249 "\"%s\" is not a positive number", sender_rate_limit);
2250
2251 /* Second is the rate measurement period / exponential smoothing time
2252 constant. This must be strictly greater than zero, because zero leads to
2253 run-time division errors. */
2254
2255 sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2256 if (sender_rate_period == NULL) period = -1.0;
2257 else period = readconf_readtime(sender_rate_period, 0, FALSE);
2258 if (period <= 0.0)
2259 return ratelimit_error(log_msgptr,
2260 "\"%s\" is not a time value", sender_rate_period);
2261
2262 /* By default we are counting one of something, but the per_rcpt,
2263 per_byte, and count options can change this. */
2264
2265 count = 1.0;
2266
2267 /* Parse the other options. */
2268
2269 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2270 != NULL)
2271 {
2272 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2273 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2274 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2275 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2276 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2277 else if (strcmpic(ss, US"per_conn") == 0)
2278 {
2279 RATE_SET(mode, PER_CONN);
2280 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2281 badacl = TRUE;
2282 }
2283 else if (strcmpic(ss, US"per_mail") == 0)
2284 {
2285 RATE_SET(mode, PER_MAIL);
2286 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2287 }
2288 else if (strcmpic(ss, US"per_rcpt") == 0)
2289 {
2290 /* If we are running in the RCPT ACL, then we'll count the recipients
2291 one by one, but if we are running when we have accumulated the whole
2292 list then we'll add them all in one batch. */
2293 if (where == ACL_WHERE_RCPT)
2294 RATE_SET(mode, PER_RCPT);
2295 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2296 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2297 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2298 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2299 }
2300 else if (strcmpic(ss, US"per_byte") == 0)
2301 {
2302 /* If we have not yet received the message data and there was no SIZE
2303 declaration on the MAIL command, then it's safe to just use a value of
2304 zero and let the recorded rate decay as if nothing happened. */
2305 RATE_SET(mode, PER_MAIL);
2306 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2307 else count = message_size < 0 ? 0.0 : (double)message_size;
2308 }
2309 else if (strcmpic(ss, US"per_addr") == 0)
2310 {
2311 RATE_SET(mode, PER_RCPT);
2312 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2313 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2314 }
2315 else if (strncmpic(ss, US"count=", 6) == 0)
2316 {
2317 uschar *e;
2318 count = Ustrtod(ss+6, &e);
2319 if (count < 0.0 || *e != '\0')
2320 return ratelimit_error(log_msgptr,
2321 "\"%s\" is not a positive number", ss);
2322 }
2323 else if (strncmpic(ss, US"unique=", 7) == 0)
2324 unique = string_copy(ss + 7);
2325 else if (key == NULL)
2326 key = string_copy(ss);
2327 else
2328 key = string_sprintf("%s/%s", key, ss);
2329 }
2330
2331 /* Sanity check. When the badacl flag is set the update mode must either
2332 be readonly (which is the default if it is omitted) or, for backwards
2333 compatibility, a combination of noupdate and strict or leaky. */
2334
2335 if (mode == RATE_PER_CLASH)
2336 return ratelimit_error(log_msgptr, "conflicting per_* options");
2337 if (leaky + strict + readonly > 1)
2338 return ratelimit_error(log_msgptr, "conflicting update modes");
2339 if (badacl && (leaky || strict) && !noupdate)
2340 return ratelimit_error(log_msgptr,
2341 "\"%s\" must not have /leaky or /strict option in %s ACL",
2342 ratelimit_option_string[mode], acl_wherenames[where]);
2343
2344 /* Set the default values of any unset options. In readonly mode we
2345 perform the rate computation without any increment so that its value
2346 decays to eventually allow over-limit senders through. */
2347
2348 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2349 if (badacl) readonly = TRUE;
2350 if (readonly) count = 0.0;
2351 if (!strict && !readonly) leaky = TRUE;
2352 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2353
2354 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2355 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2356 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2357 are added to the key because they alter the meaning of the stored data. */
2358
2359 if (key == NULL)
2360 key = (sender_host_address == NULL)? US"" : sender_host_address;
2361
2362 key = string_sprintf("%s/%s/%s%s",
2363 sender_rate_period,
2364 ratelimit_option_string[mode],
2365 unique == NULL ? "" : "unique/",
2366 key);
2367
2368 HDEBUG(D_acl)
2369 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2370
2371 /* See if we have already computed the rate by looking in the relevant tree.
2372 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2373 pool so that they survive across resets. In readonly mode we only remember the
2374 result for the rest of this command in case a later command changes it. After
2375 this bit of logic the code is independent of the per_* mode. */
2376
2377 old_pool = store_pool;
2378
2379 if (readonly)
2380 anchor = &ratelimiters_cmd;
2381 else switch(mode) {
2382 case RATE_PER_CONN:
2383 anchor = &ratelimiters_conn;
2384 store_pool = POOL_PERM;
2385 break;
2386 case RATE_PER_BYTE:
2387 case RATE_PER_MAIL:
2388 case RATE_PER_ALLRCPTS:
2389 anchor = &ratelimiters_mail;
2390 break;
2391 case RATE_PER_ADDR:
2392 case RATE_PER_CMD:
2393 case RATE_PER_RCPT:
2394 anchor = &ratelimiters_cmd;
2395 break;
2396 default:
2397 anchor = NULL; /* silence an "unused" complaint */
2398 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2399 "internal ACL error: unknown ratelimit mode %d", mode);
2400 break;
2401 }
2402
2403 t = tree_search(*anchor, key);
2404 if (t != NULL)
2405 {
2406 dbd = t->data.ptr;
2407 /* The following few lines duplicate some of the code below. */
2408 rc = (dbd->rate < limit)? FAIL : OK;
2409 store_pool = old_pool;
2410 sender_rate = string_sprintf("%.1f", dbd->rate);
2411 HDEBUG(D_acl)
2412 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2413 return rc;
2414 }
2415
2416 /* We aren't using a pre-computed rate, so get a previously recorded rate
2417 from the database, which will be updated and written back if required. */
2418
2419 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2420 {
2421 store_pool = old_pool;
2422 sender_rate = NULL;
2423 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2424 *log_msgptr = US"ratelimit database not available";
2425 return DEFER;
2426 }
2427 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2428 dbd = NULL;
2429
2430 gettimeofday(&tv, NULL);
2431
2432 if (dbdb != NULL)
2433 {
2434 /* Locate the basic ratelimit block inside the DB data. */
2435 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2436 dbd = &dbdb->dbd;
2437
2438 /* Forget the old Bloom filter if it is too old, so that we count each
2439 repeating event once per period. We don't simply clear and re-use the old
2440 filter because we want its size to change if the limit changes. Note that
2441 we keep the dbd pointer for copying the rate into the new data block. */
2442
2443 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2444 {
2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2446 dbdb = NULL;
2447 }
2448
2449 /* Sanity check. */
2450
2451 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2452 {
2453 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2454 dbdb = NULL;
2455 }
2456 }
2457
2458 /* Allocate a new data block if the database lookup failed
2459 or the Bloom filter passed its age limit. */
2460
2461 if (dbdb == NULL)
2462 {
2463 if (unique == NULL)
2464 {
2465 /* No Bloom filter. This basic ratelimit block is initialized below. */
2466 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2467 dbdb_size = sizeof(*dbd);
2468 dbdb = store_get(dbdb_size);
2469 }
2470 else
2471 {
2472 int extra;
2473 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2474
2475 /* See the long comment below for an explanation of the magic number 2.
2476 The filter has a minimum size in case the rate limit is very small;
2477 this is determined by the definition of dbdata_ratelimit_unique. */
2478
2479 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2480 if (extra < 0) extra = 0;
2481 dbdb_size = sizeof(*dbdb) + extra;
2482 dbdb = store_get(dbdb_size);
2483 dbdb->bloom_epoch = tv.tv_sec;
2484 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2485 memset(dbdb->bloom, 0, dbdb->bloom_size);
2486
2487 /* Preserve any basic ratelimit data (which is our longer-term memory)
2488 by copying it from the discarded block. */
2489
2490 if (dbd != NULL)
2491 {
2492 dbdb->dbd = *dbd;
2493 dbd = &dbdb->dbd;
2494 }
2495 }
2496 }
2497
2498 /* If we are counting unique events, find out if this event is new or not.
2499 If the client repeats the event during the current period then it should be
2500 counted. We skip this code in readonly mode for efficiency, because any
2501 changes to the filter will be discarded and because count is already set to
2502 zero. */
2503
2504 if (unique != NULL && !readonly)
2505 {
2506 /* We identify unique events using a Bloom filter. (You can find my
2507 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2508 With the per_addr option, an "event" is a recipient address, though the
2509 user can use the unique option to define their own events. We only count
2510 an event if we have not seen it before.
2511
2512 We size the filter according to the rate limit, which (in leaky mode)
2513 is the limit on the population of the filter. We allow 16 bits of space
2514 per entry (see the construction code above) and we set (up to) 8 of them
2515 when inserting an element (see the loop below). The probability of a false
2516 positive (an event we have not seen before but which we fail to count) is
2517
2518 size = limit * 16
2519 numhash = 8
2520 allzero = exp(-numhash * pop / size)
2521 = exp(-0.5 * pop / limit)
2522 fpr = pow(1 - allzero, numhash)
2523
2524 For senders at the limit the fpr is 0.06% or 1 in 1700
2525 and for senders at half the limit it is 0.0006% or 1 in 170000
2526
2527 In strict mode the Bloom filter can fill up beyond the normal limit, in
2528 which case the false positive rate will rise. This means that the
2529 measured rate for very fast senders can bogusly drop off after a while.
2530
2531 At twice the limit, the fpr is 2.5% or 1 in 40
2532 At four times the limit, it is 31% or 1 in 3.2
2533
2534 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2535 decay below the limit, and if this is more than one then the Bloom filter
2536 will be discarded before the decay gets that far. The false positive rate
2537 at this threshold is 9.3% or 1 in 10.7. */
2538
2539 BOOL seen;
2540 unsigned n, hash, hinc;
2541 uschar md5sum[16];
2542 md5 md5info;
2543
2544 /* Instead of using eight independent hash values, we combine two values
2545 using the formula h1 + n * h2. This does not harm the Bloom filter's
2546 performance, and means the amount of hash we need is independent of the
2547 number of bits we set in the filter. */
2548
2549 md5_start(&md5info);
2550 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2551 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2552 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2553
2554 /* Scan the bits corresponding to this event. A zero bit means we have
2555 not seen it before. Ensure all bits are set to record this event. */
2556
2557 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2558
2559 seen = TRUE;
2560 for (n = 0; n < 8; n++, hash += hinc)
2561 {
2562 int bit = 1 << (hash % 8);
2563 int byte = (hash / 8) % dbdb->bloom_size;
2564 if ((dbdb->bloom[byte] & bit) == 0)
2565 {
2566 dbdb->bloom[byte] |= bit;
2567 seen = FALSE;
2568 }
2569 }
2570
2571 /* If this event has occurred before, do not count it. */
2572
2573 if (seen)
2574 {
2575 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2576 count = 0.0;
2577 }
2578 else
2579 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2580 }
2581
2582 /* If there was no previous ratelimit data block for this key, initialize
2583 the new one, otherwise update the block from the database. The initial rate
2584 is what would be computed by the code below for an infinite interval. */
2585
2586 if (dbd == NULL)
2587 {
2588 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2589 dbd = &dbdb->dbd;
2590 dbd->time_stamp = tv.tv_sec;
2591 dbd->time_usec = tv.tv_usec;
2592 dbd->rate = count;
2593 }
2594 else
2595 {
2596 /* The smoothed rate is computed using an exponentially weighted moving
2597 average adjusted for variable sampling intervals. The standard EWMA for
2598 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2599 where f() is the measured value and f'() is the smoothed value.
2600
2601 Old data decays out of the smoothed value exponentially, such that data n
2602 samples old is multiplied by a^n. The exponential decay time constant p
2603 is defined such that data p samples old is multiplied by 1/e, which means
2604 that a = exp(-1/p). We can maintain the same time constant for a variable
2605 sampling interval i by using a = exp(-i/p).
2606
2607 The rate we are measuring is messages per period, suitable for directly
2608 comparing with the limit. The average rate between now and the previous
2609 message is period / interval, which we feed into the EWMA as the sample.
2610
2611 It turns out that the number of messages required for the smoothed rate
2612 to reach the limit when they are sent in a burst is equal to the limit.
2613 This can be seen by analysing the value of the smoothed rate after N
2614 messages sent at even intervals. Let k = (1 - a) * p/i
2615
2616 rate_1 = (1 - a) * p/i + a * rate_0
2617 = k + a * rate_0
2618 rate_2 = k + a * rate_1
2619 = k + a * k + a^2 * rate_0
2620 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2621 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2622 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2623 = rate_0 * a^N + p/i * (1 - a^N)
2624
2625 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2626
2627 rate_N = p/i + (rate_0 - p/i) * a^N
2628 a^N = (rate_N - p/i) / (rate_0 - p/i)
2629 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2630 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2631
2632 Numerical analysis of the above equation, setting the computed rate to
2633 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2634 rates, p/i, the number of messages N = limit. So limit serves as both the
2635 maximum rate measured in messages per period, and the maximum number of
2636 messages that can be sent in a fast burst. */
2637
2638 double this_time = (double)tv.tv_sec
2639 + (double)tv.tv_usec / 1000000.0;
2640 double prev_time = (double)dbd->time_stamp
2641 + (double)dbd->time_usec / 1000000.0;
2642
2643 /* We must avoid division by zero, and deal gracefully with the clock going
2644 backwards. If we blunder ahead when time is in reverse then the computed
2645 rate will be bogus. To be safe we clamp interval to a very small number. */
2646
2647 double interval = this_time - prev_time <= 0.0 ? 1e-9
2648 : this_time - prev_time;
2649
2650 double i_over_p = interval / period;
2651 double a = exp(-i_over_p);
2652
2653 /* Combine the instantaneous rate (period / interval) with the previous rate
2654 using the smoothing factor a. In order to measure sized events, multiply the
2655 instantaneous rate by the count of bytes or recipients etc. */
2656
2657 dbd->time_stamp = tv.tv_sec;
2658 dbd->time_usec = tv.tv_usec;
2659 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2660
2661 /* When events are very widely spaced the computed rate tends towards zero.
2662 Although this is accurate it turns out not to be useful for our purposes,
2663 especially when the first event after a long silence is the start of a spam
2664 run. A more useful model is that the rate for an isolated event should be the
2665 size of the event per the period size, ignoring the lack of events outside
2666 the current period and regardless of where the event falls in the period. So,
2667 if the interval was so long that the calculated rate is unhelpfully small, we
2668 re-initialize the rate. In the absence of higher-rate bursts, the condition
2669 below is true if the interval is greater than the period. */
2670
2671 if (dbd->rate < count) dbd->rate = count;
2672 }
2673
2674 /* Clients sending at the limit are considered to be over the limit.
2675 This matters for edge cases such as a limit of zero, when the client
2676 should be completely blocked. */
2677
2678 rc = (dbd->rate < limit)? FAIL : OK;
2679
2680 /* Update the state if the rate is low or if we are being strict. If we
2681 are in leaky mode and the sender's rate is too high, we do not update
2682 the recorded rate in order to avoid an over-aggressive sender's retry
2683 rate preventing them from getting any email through. If readonly is set,
2684 neither leaky nor strict are set, so we do not do any updates. */
2685
2686 if ((rc == FAIL && leaky) || strict)
2687 {
2688 dbfn_write(dbm, key, dbdb, dbdb_size);
2689 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2690 }
2691 else
2692 {
2693 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2694 readonly? "readonly mode" : "over the limit, but leaky");
2695 }
2696
2697 dbfn_close(dbm);
2698
2699 /* Store the result in the tree for future reference. */
2700
2701 t = store_get(sizeof(tree_node) + Ustrlen(key));
2702 t->data.ptr = dbd;
2703 Ustrcpy(t->name, key);
2704 (void)tree_insertnode(anchor, t);
2705
2706 /* We create the formatted version of the sender's rate very late in
2707 order to ensure that it is done using the correct storage pool. */
2708
2709 store_pool = old_pool;
2710 sender_rate = string_sprintf("%.1f", dbd->rate);
2711
2712 HDEBUG(D_acl)
2713 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2714
2715 return rc;
2716 }
2717
2718
2719
2720 /*************************************************
2721 * The udpsend ACL modifier *
2722 *************************************************/
2723
2724 /* Called by acl_check_condition() below.
2725
2726 Arguments:
2727 arg the option string for udpsend=
2728 log_msgptr for error messages
2729
2730 Returns: OK - Completed.
2731 DEFER - Problem with DNS lookup.
2732 ERROR - Syntax error in options.
2733 */
2734
2735 static int
2736 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2737 {
2738 int sep = 0;
2739 uschar *hostname;
2740 uschar *portstr;
2741 uschar *portend;
2742 host_item *h;
2743 int portnum;
2744 int len;
2745 int r, s;
2746 uschar * errstr;
2747
2748 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2749 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2750
2751 if (!hostname)
2752 {
2753 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2754 return ERROR;
2755 }
2756 if (!portstr)
2757 {
2758 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2759 return ERROR;
2760 }
2761 if (!arg)
2762 {
2763 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2764 return ERROR;
2765 }
2766 portnum = Ustrtol(portstr, &portend, 10);
2767 if (*portend != '\0')
2768 {
2769 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2770 return ERROR;
2771 }
2772
2773 /* Make a single-item host list. */
2774 h = store_get(sizeof(host_item));
2775 memset(h, 0, sizeof(host_item));
2776 h->name = hostname;
2777 h->port = portnum;
2778 h->mx = MX_NONE;
2779
2780 if (string_is_ip_address(hostname, NULL))
2781 h->address = hostname, r = HOST_FOUND;
2782 else
2783 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2784 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2785 {
2786 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2787 return DEFER;
2788 }
2789
2790 HDEBUG(D_acl)
2791 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2792
2793 /*XXX this could better use sendto */
2794 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2795 1, NULL, &errstr, NULL);
2796 if (r < 0) goto defer;
2797 len = Ustrlen(arg);
2798 r = send(s, arg, len, 0);
2799 if (r < 0)
2800 {
2801 errstr = US strerror(errno);
2802 close(s);
2803 goto defer;
2804 }
2805 close(s);
2806 if (r < len)
2807 {
2808 *log_msgptr =
2809 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2810 return DEFER;
2811 }
2812
2813 HDEBUG(D_acl)
2814 debug_printf_indent("udpsend %d bytes\n", r);
2815
2816 return OK;
2817
2818 defer:
2819 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2820 return DEFER;
2821 }
2822
2823
2824
2825 /*************************************************
2826 * Handle conditions/modifiers on an ACL item *
2827 *************************************************/
2828
2829 /* Called from acl_check() below.
2830
2831 Arguments:
2832 verb ACL verb
2833 cb ACL condition block - if NULL, result is OK
2834 where where called from
2835 addr the address being checked for RCPT, or NULL
2836 level the nesting level
2837 epp pointer to pass back TRUE if "endpass" encountered
2838 (applies only to "accept" and "discard")
2839 user_msgptr user message pointer
2840 log_msgptr log message pointer
2841 basic_errno pointer to where to put verify error
2842
2843 Returns: OK - all conditions are met
2844 DISCARD - an "acl" condition returned DISCARD - only allowed
2845 for "accept" or "discard" verbs
2846 FAIL - at least one condition fails
2847 FAIL_DROP - an "acl" condition returned FAIL_DROP
2848 DEFER - can't tell at the moment (typically, lookup defer,
2849 but can be temporary callout problem)
2850 ERROR - ERROR from nested ACL or expansion failure or other
2851 error
2852 */
2853
2854 static int
2855 acl_check_condition(int verb, acl_condition_block *cb, int where,
2856 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2857 uschar **log_msgptr, int *basic_errno)
2858 {
2859 uschar *user_message = NULL;
2860 uschar *log_message = NULL;
2861 int rc = OK;
2862 #ifdef WITH_CONTENT_SCAN
2863 int sep = -'/';
2864 #endif
2865
2866 for (; cb != NULL; cb = cb->next)
2867 {
2868 const uschar *arg;
2869 int control_type;
2870
2871 /* The message and log_message items set up messages to be used in
2872 case of rejection. They are expanded later. */
2873
2874 if (cb->type == ACLC_MESSAGE)
2875 {
2876 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2877 user_message = cb->arg;
2878 continue;
2879 }
2880
2881 if (cb->type == ACLC_LOG_MESSAGE)
2882 {
2883 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2884 log_message = cb->arg;
2885 continue;
2886 }
2887
2888 /* The endpass "condition" just sets a flag to show it occurred. This is
2889 checked at compile time to be on an "accept" or "discard" item. */
2890
2891 if (cb->type == ACLC_ENDPASS)
2892 {
2893 *epp = TRUE;
2894 continue;
2895 }
2896
2897 /* For other conditions and modifiers, the argument is expanded now for some
2898 of them, but not for all, because expansion happens down in some lower level
2899 checking functions in some cases. */
2900
2901 if (!conditions[cb->type].expand_at_top)
2902 arg = cb->arg;
2903 else if (!(arg = expand_string(cb->arg)))
2904 {
2905 if (expand_string_forcedfail) continue;
2906 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2907 cb->arg, expand_string_message);
2908 return search_find_defer ? DEFER : ERROR;
2909 }
2910
2911 /* Show condition, and expanded condition if it's different */
2912
2913 HDEBUG(D_acl)
2914 {
2915 int lhswidth = 0;
2916 debug_printf_indent("check %s%s %n",
2917 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2918 conditions[cb->type].name, &lhswidth);
2919
2920 if (cb->type == ACLC_SET)
2921 {
2922 #ifndef DISABLE_DKIM
2923 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2924 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2925 {
2926 debug_printf("%s ", cb->u.varname);
2927 lhswidth += 19;
2928 }
2929 else
2930 #endif
2931 {
2932 debug_printf("acl_%s ", cb->u.varname);
2933 lhswidth += 5 + Ustrlen(cb->u.varname);
2934 }
2935 }
2936
2937 debug_printf("= %s\n", cb->arg);
2938
2939 if (arg != cb->arg)
2940 debug_printf("%.*s= %s\n", lhswidth,
2941 US" ", CS arg);
2942 }
2943
2944 /* Check that this condition makes sense at this time */
2945
2946 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2947 {
2948 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2949 conditions[cb->type].is_modifier ? "use" : "test",
2950 conditions[cb->type].name, acl_wherenames[where]);
2951 return ERROR;
2952 }
2953
2954 /* Run the appropriate test for each condition, or take the appropriate
2955 action for the remaining modifiers. */
2956
2957 switch(cb->type)
2958 {
2959 case ACLC_ADD_HEADER:
2960 setup_header(arg);
2961 break;
2962
2963 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2964 "discard" verb. */
2965
2966 case ACLC_ACL:
2967 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2968 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2969 {
2970 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2971 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2972 verbs[verb]);
2973 return ERROR;
2974 }
2975 break;
2976
2977 case ACLC_AUTHENTICATED:
2978 rc = (sender_host_authenticated == NULL)? FAIL :
2979 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2980 TRUE, NULL);
2981 break;
2982
2983 #ifdef EXPERIMENTAL_BRIGHTMAIL
2984 case ACLC_BMI_OPTIN:
2985 {
2986 int old_pool = store_pool;
2987 store_pool = POOL_PERM;
2988 bmi_current_optin = string_copy(arg);
2989 store_pool = old_pool;
2990 }
2991 break;
2992 #endif
2993
2994 case ACLC_CONDITION:
2995 /* The true/false parsing here should be kept in sync with that used in
2996 expand.c when dealing with ECOND_BOOL so that we don't have too many
2997 different definitions of what can be a boolean. */
2998 if (*arg == '-'
2999 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3000 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3001 rc = (Uatoi(arg) == 0)? FAIL : OK;
3002 else
3003 rc = (strcmpic(arg, US"no") == 0 ||
3004 strcmpic(arg, US"false") == 0)? FAIL :
3005 (strcmpic(arg, US"yes") == 0 ||
3006 strcmpic(arg, US"true") == 0)? OK : DEFER;
3007 if (rc == DEFER)
3008 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3009 break;
3010
3011 case ACLC_CONTINUE: /* Always succeeds */
3012 break;
3013
3014 case ACLC_CONTROL:
3015 {
3016 const uschar *p = NULL;
3017 control_type = decode_control(arg, &p, where, log_msgptr);
3018
3019 /* Check if this control makes sense at this time */
3020
3021 if (controls_list[control_type].forbids & (1 << where))
3022 {
3023 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3024 controls_list[control_type].name, acl_wherenames[where]);
3025 return ERROR;
3026 }
3027
3028 switch(control_type)
3029 {
3030 case CONTROL_AUTH_UNADVERTISED:
3031 allow_auth_unadvertised = TRUE;
3032 break;
3033
3034 #ifdef EXPERIMENTAL_BRIGHTMAIL
3035 case CONTROL_BMI_RUN:
3036 bmi_run = 1;
3037 break;
3038 #endif
3039
3040 #ifndef DISABLE_DKIM
3041 case CONTROL_DKIM_VERIFY:
3042 dkim_disable_verify = TRUE;
3043 #ifdef EXPERIMENTAL_DMARC
3044 /* Since DKIM was blocked, skip DMARC too */
3045 dmarc_disable_verify = TRUE;
3046 dmarc_enable_forensic = FALSE;
3047 #endif
3048 break;
3049 #endif
3050
3051 #ifdef EXPERIMENTAL_DMARC
3052 case CONTROL_DMARC_VERIFY:
3053 dmarc_disable_verify = TRUE;
3054 break;
3055
3056 case CONTROL_DMARC_FORENSIC:
3057 dmarc_enable_forensic = TRUE;
3058 break;
3059 #endif
3060
3061 case CONTROL_DSCP:
3062 if (*p == '/')
3063 {
3064 int fd, af, level, optname, value;
3065 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3066 a socket; we can accept that, we'll just debug-log failures anyway. */
3067 fd = fileno(smtp_in);
3068 af = ip_get_address_family(fd);
3069 if (af < 0)
3070 {
3071 HDEBUG(D_acl)
3072 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3073 strerror(errno));
3074 break;
3075 }
3076 if (dscp_lookup(p+1, af, &level, &optname, &value))
3077 {
3078 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3079 {
3080 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3081 p+1, strerror(errno));
3082 }
3083 else
3084 {
3085 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3086 }
3087 }
3088 else
3089 {
3090 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3091 return ERROR;
3092 }
3093 }
3094 else
3095 {
3096 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3097 return ERROR;
3098 }
3099 break;
3100
3101 case CONTROL_ERROR:
3102 return ERROR;
3103
3104 case CONTROL_CASEFUL_LOCAL_PART:
3105 deliver_localpart = addr->cc_local_part;
3106 break;
3107
3108 case CONTROL_CASELOWER_LOCAL_PART:
3109 deliver_localpart = addr->lc_local_part;
3110 break;
3111
3112 case CONTROL_ENFORCE_SYNC:
3113 smtp_enforce_sync = TRUE;
3114 break;
3115
3116 case CONTROL_NO_ENFORCE_SYNC:
3117 smtp_enforce_sync = FALSE;
3118 break;
3119
3120 #ifdef WITH_CONTENT_SCAN
3121 case CONTROL_NO_MBOX_UNSPOOL:
3122 no_mbox_unspool = TRUE;
3123 break;
3124 #endif
3125
3126 case CONTROL_NO_MULTILINE:
3127 no_multiline_responses = TRUE;
3128 break;
3129
3130 case CONTROL_NO_PIPELINING:
3131 pipelining_enable = FALSE;
3132 break;
3133
3134 case CONTROL_NO_DELAY_FLUSH:
3135 disable_delay_flush = TRUE;
3136 break;
3137
3138 case CONTROL_NO_CALLOUT_FLUSH:
3139 disable_callout_flush = TRUE;
3140 break;
3141
3142 case CONTROL_FAKEREJECT:
3143 cancel_cutthrough_connection(TRUE, US"fakereject");
3144 case CONTROL_FAKEDEFER:
3145 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3146 if (*p == '/')
3147 {
3148 const uschar *pp = p + 1;
3149 while (*pp != 0) pp++;
3150 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3151 p = pp;
3152 }
3153 else
3154 {
3155 /* Explicitly reset to default string */
3156 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3157 }
3158 break;
3159
3160 case CONTROL_FREEZE:
3161 deliver_freeze = TRUE;
3162 deliver_frozen_at = time(NULL);
3163 freeze_tell = freeze_tell_config; /* Reset to configured value */
3164 if (Ustrncmp(p, "/no_tell", 8) == 0)
3165 {
3166 p += 8;
3167 freeze_tell = NULL;
3168 }
3169 if (*p != 0)
3170 {
3171 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3172 return ERROR;
3173 }
3174 cancel_cutthrough_connection(TRUE, US"item frozen");
3175 break;
3176
3177 case CONTROL_QUEUE_ONLY:
3178 queue_only_policy = TRUE;
3179 cancel_cutthrough_connection(TRUE, US"queueing forced");
3180 break;
3181
3182 case CONTROL_SUBMISSION:
3183 originator_name = US"";
3184 submission_mode = TRUE;
3185 while (*p == '/')
3186 {
3187 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3188 {
3189 p += 14;
3190 active_local_sender_retain = TRUE;
3191 active_local_from_check = FALSE;
3192 }
3193 else if (Ustrncmp(p, "/domain=", 8) == 0)
3194 {
3195 const uschar *pp = p + 8;
3196 while (*pp != 0 && *pp != '/') pp++;
3197 submission_domain = string_copyn(p+8, pp-p-8);
3198 p = pp;
3199 }
3200 /* The name= option must be last, because it swallows the rest of
3201 the string. */
3202 else if (Ustrncmp(p, "/name=", 6) == 0)
3203 {
3204 const uschar *pp = p + 6;
3205 while (*pp != 0) pp++;
3206 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3207 big_buffer, big_buffer_size));
3208 p = pp;
3209 }
3210 else break;
3211 }
3212 if (*p != 0)
3213 {
3214 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3215 return ERROR;
3216 }
3217 break;
3218
3219 case CONTROL_DEBUG:
3220 {
3221 uschar * debug_tag = NULL;
3222 uschar * debug_opts = NULL;
3223 BOOL kill = FALSE;
3224
3225 while (*p == '/')
3226 {
3227 const uschar * pp = p+1;
3228 if (Ustrncmp(pp, "tag=", 4) == 0)
3229 {
3230 for (pp += 4; *pp && *pp != '/';) pp++;
3231 debug_tag = string_copyn(p+5, pp-p-5);
3232 }
3233 else if (Ustrncmp(pp, "opts=", 5) == 0)
3234 {
3235 for (pp += 5; *pp && *pp != '/';) pp++;
3236 debug_opts = string_copyn(p+6, pp-p-6);
3237 }
3238 else if (Ustrncmp(pp, "kill", 4) == 0)
3239 {
3240 for (pp += 4; *pp && *pp != '/';) pp++;
3241 kill = TRUE;
3242 }
3243 else
3244 while (*pp && *pp != '/') pp++;
3245 p = pp;
3246 }
3247
3248 if (kill)
3249 debug_logging_stop();
3250 else
3251 debug_logging_activate(debug_tag, debug_opts);
3252 }
3253 break;
3254
3255 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3256 suppress_local_fixups = TRUE;
3257 break;
3258
3259 case CONTROL_CUTTHROUGH_DELIVERY:
3260 #ifndef DISABLE_PRDR
3261 if (prdr_requested)
3262 #else
3263 if (0)
3264 #endif
3265 /* Too hard to think about for now. We might in future cutthrough
3266 the case where both sides handle prdr and this-node prdr acl
3267 is "accept" */
3268 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
3269 else
3270 {
3271 if (deliver_freeze)
3272 *log_msgptr = US"frozen";
3273 else if (queue_only_policy)
3274 *log_msgptr = US"queue-only";
3275 else if (fake_response == FAIL)
3276 *log_msgptr = US"fakereject";
3277 else
3278 {
3279 if (rcpt_count == 1)
3280 {
3281 cutthrough.delivery = TRUE;
3282 while (*p == '/')
3283 {
3284 const uschar * pp = p+1;
3285 if (Ustrncmp(pp, "defer=", 6) == 0)
3286 {
3287 pp += 6;
3288 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3289 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3290 }
3291 else
3292 while (*pp && *pp != '/') pp++;
3293 p = pp;
3294 }
3295 }
3296 break;
3297 }
3298 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3299 arg, *log_msgptr);
3300 }
3301 return ERROR;
3302
3303 #ifdef SUPPORT_I18N
3304 case CONTROL_UTF8_DOWNCONVERT:
3305 if (*p == '/')
3306 {
3307 if (p[1] == '1')
3308 {
3309 message_utf8_downconvert = 1;
3310 addr->prop.utf8_downcvt = TRUE;
3311 addr->prop.utf8_downcvt_maybe = FALSE;
3312 p += 2;
3313 break;
3314 }
3315 if (p[1] == '0')
3316 {
3317 message_utf8_downconvert = 0;
3318 addr->prop.utf8_downcvt = FALSE;
3319 addr->prop.utf8_downcvt_maybe = FALSE;
3320 p += 2;
3321 break;
3322 }
3323 if (p[1] == '-' && p[2] == '1')
3324 {
3325 message_utf8_downconvert = -1;
3326 addr->prop.utf8_downcvt = FALSE;
3327 addr->prop.utf8_downcvt_maybe = TRUE;
3328 p += 3;
3329 break;
3330 }
3331 *log_msgptr = US"bad option value for control=utf8_downconvert";
3332 }
3333 else
3334 {
3335 message_utf8_downconvert = 1;
3336 addr->prop.utf8_downcvt = TRUE;
3337 addr->prop.utf8_downcvt_maybe = FALSE;
3338 break;
3339 }
3340 return ERROR;
3341 #endif
3342
3343 }
3344 break;
3345 }
3346
3347 #ifdef EXPERIMENTAL_DCC
3348 case ACLC_DCC:
3349 {
3350 /* Separate the regular expression and any optional parameters. */
3351 const uschar * list = arg;
3352 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3353 /* Run the dcc backend. */
3354 rc = dcc_process(&ss);
3355 /* Modify return code based upon the existence of options. */
3356 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3357 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3358 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3359 }
3360 break;
3361 #endif
3362
3363 #ifdef WITH_CONTENT_SCAN
3364 case ACLC_DECODE:
3365 rc = mime_decode(&arg);
3366 break;
3367 #endif
3368
3369 case ACLC_DELAY:
3370 {
3371 int delay = readconf_readtime(arg, 0, FALSE);
3372 if (delay < 0)
3373 {
3374 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3375 "modifier: \"%s\" is not a time value", arg);
3376 return ERROR;
3377 }
3378 else
3379 {
3380 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3381 delay);
3382 if (host_checking)
3383 {
3384 HDEBUG(D_acl)
3385 debug_printf_indent("delay skipped in -bh checking mode\n");
3386 }
3387
3388 /* NOTE 1: Remember that we may be
3389 dealing with stdin/stdout here, in addition to TCP/IP connections.
3390 Also, delays may be specified for non-SMTP input, where smtp_out and
3391 smtp_in will be NULL. Whatever is done must work in all cases.
3392
3393 NOTE 2: The added feature of flushing the output before a delay must
3394 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3395 */
3396
3397 else
3398 {
3399 if (smtp_out != NULL && !disable_delay_flush)
3400 mac_smtp_fflush();
3401
3402 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3403 {
3404 struct pollfd p;
3405 nfds_t n = 0;
3406 if (smtp_out)
3407 {
3408 p.fd = fileno(smtp_out);
3409 p.events = POLLRDHUP;
3410 n = 1;
3411 }
3412 if (poll(&p, n, delay*1000) > 0)
3413 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3414 }
3415 #else
3416 /* It appears to be impossible to detect that a TCP/IP connection has
3417 gone away without reading from it. This means that we cannot shorten
3418 the delay below if the client goes away, because we cannot discover
3419 that the client has closed its end of the connection. (The connection
3420 is actually in a half-closed state, waiting for the server to close its
3421 end.) It would be nice to be able to detect this state, so that the
3422