projects / exim.git / blob
? search:


a1d1915fb1aaad51faf6515573815c4f0f00ce13
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
31 US"warn" };
32
33 /* For each verb, the conditions for which "message" or "log_message" are used
34 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35 "accept", the FAIL case is used only after "endpass", but that is selected in
36 the code. */
37
38 static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
47
48 /* ACL condition and modifier codes - keep in step with the table that
49 follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50 down. */
51
52 enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
55 #ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57 #endif
58 ACLC_CONDITION,
59 ACLC_CONTINUE,
60 ACLC_CONTROL,
61 #ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63 #endif
64 #ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66 #endif
67 ACLC_DELAY,
68 #ifndef DISABLE_DKIM
69 ACLC_DKIM_SIGNER,
70 ACLC_DKIM_STATUS,
71 #endif
72 #ifdef EXPERIMENTAL_DMARC
73 ACLC_DMARC_STATUS,
74 #endif
75 ACLC_DNSLISTS,
76 ACLC_DOMAINS,
77 ACLC_ENCRYPTED,
78 ACLC_ENDPASS,
79 ACLC_HOSTS,
80 ACLC_LOCAL_PARTS,
81 ACLC_LOG_MESSAGE,
82 ACLC_LOG_REJECT_TARGET,
83 ACLC_LOGWRITE,
84 #ifdef WITH_CONTENT_SCAN
85 ACLC_MALWARE,
86 #endif
87 ACLC_MESSAGE,
88 #ifdef WITH_CONTENT_SCAN
89 ACLC_MIME_REGEX,
90 #endif
91 ACLC_QUEUE,
92 ACLC_RATELIMIT,
93 ACLC_RECIPIENTS,
94 #ifdef WITH_CONTENT_SCAN
95 ACLC_REGEX,
96 #endif
97 ACLC_REMOVE_HEADER,
98 ACLC_SENDER_DOMAINS,
99 ACLC_SENDERS,
100 ACLC_SET,
101 #ifdef WITH_CONTENT_SCAN
102 ACLC_SPAM,
103 #endif
104 #ifdef EXPERIMENTAL_SPF
105 ACLC_SPF,
106 ACLC_SPF_GUESS,
107 #endif
108 ACLC_UDPSEND,
109 ACLC_VERIFY };
110
111 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
112 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
113 modifiers that look like conditions but always return TRUE. They are used for
114 their side effects. */
115
116 static uschar *conditions[] = {
117 US"acl",
118 US"add_header",
119 US"authenticated",
120 #ifdef EXPERIMENTAL_BRIGHTMAIL
121 US"bmi_optin",
122 #endif
123 US"condition",
124 US"continue",
125 US"control",
126 #ifdef EXPERIMENTAL_DCC
127 US"dcc",
128 #endif
129 #ifdef WITH_CONTENT_SCAN
130 US"decode",
131 #endif
132 US"delay",
133 #ifndef DISABLE_DKIM
134 US"dkim_signers",
135 US"dkim_status",
136 #endif
137 #ifdef EXPERIMENTAL_DMARC
138 US"dmarc_status",
139 #endif
140 US"dnslists",
141 US"domains",
142 US"encrypted",
143 US"endpass",
144 US"hosts",
145 US"local_parts",
146 US"log_message",
147 US"log_reject_target",
148 US"logwrite",
149 #ifdef WITH_CONTENT_SCAN
150 US"malware",
151 #endif
152 US"message",
153 #ifdef WITH_CONTENT_SCAN
154 US"mime_regex",
155 #endif
156 US"queue",
157 US"ratelimit",
158 US"recipients",
159 #ifdef WITH_CONTENT_SCAN
160 US"regex",
161 #endif
162 US"remove_header",
163 US"sender_domains",
164 US"senders",
165 US"set",
166 #ifdef WITH_CONTENT_SCAN
167 US"spam",
168 #endif
169 #ifdef EXPERIMENTAL_SPF
170 US"spf",
171 US"spf_guess",
172 #endif
173 US"udpsend",
174 US"verify" };
175
176
177 /* Flags to indicate for which conditions/modifiers a string expansion is done
178 at the outer level. In the other cases, expansion already occurs in the
179 checking functions. */
180
181 static uschar cond_expand_at_top[] = {
182 FALSE, /* acl */
183 TRUE, /* add_header */
184 FALSE, /* authenticated */
185 #ifdef EXPERIMENTAL_BRIGHTMAIL
186 TRUE, /* bmi_optin */
187 #endif
188 TRUE, /* condition */
189 TRUE, /* continue */
190 TRUE, /* control */
191 #ifdef EXPERIMENTAL_DCC
192 TRUE, /* dcc */
193 #endif
194 #ifdef WITH_CONTENT_SCAN
195 TRUE, /* decode */
196 #endif
197 TRUE, /* delay */
198 #ifndef DISABLE_DKIM
199 TRUE, /* dkim_signers */
200 TRUE, /* dkim_status */
201 #endif
202 #ifdef EXPERIMENTAL_DMARC
203 TRUE, /* dmarc_status */
204 #endif
205 TRUE, /* dnslists */
206 FALSE, /* domains */
207 FALSE, /* encrypted */
208 TRUE, /* endpass */
209 FALSE, /* hosts */
210 FALSE, /* local_parts */
211 TRUE, /* log_message */
212 TRUE, /* log_reject_target */
213 TRUE, /* logwrite */
214 #ifdef WITH_CONTENT_SCAN
215 TRUE, /* malware */
216 #endif
217 TRUE, /* message */
218 #ifdef WITH_CONTENT_SCAN
219 TRUE, /* mime_regex */
220 #endif
221 TRUE, /* queue */
222 TRUE, /* ratelimit */
223 FALSE, /* recipients */
224 #ifdef WITH_CONTENT_SCAN
225 TRUE, /* regex */
226 #endif
227 TRUE, /* remove_header */
228 FALSE, /* sender_domains */
229 FALSE, /* senders */
230 TRUE, /* set */
231 #ifdef WITH_CONTENT_SCAN
232 TRUE, /* spam */
233 #endif
234 #ifdef EXPERIMENTAL_SPF
235 TRUE, /* spf */
236 TRUE, /* spf_guess */
237 #endif
238 TRUE, /* udpsend */
239 TRUE /* verify */
240 };
241
242 /* Flags to identify the modifiers */
243
244 static uschar cond_modifiers[] = {
245 FALSE, /* acl */
246 TRUE, /* add_header */
247 FALSE, /* authenticated */
248 #ifdef EXPERIMENTAL_BRIGHTMAIL
249 TRUE, /* bmi_optin */
250 #endif
251 FALSE, /* condition */
252 TRUE, /* continue */
253 TRUE, /* control */
254 #ifdef EXPERIMENTAL_DCC
255 FALSE, /* dcc */
256 #endif
257 #ifdef WITH_CONTENT_SCAN
258 FALSE, /* decode */
259 #endif
260 TRUE, /* delay */
261 #ifndef DISABLE_DKIM
262 FALSE, /* dkim_signers */
263 FALSE, /* dkim_status */
264 #endif
265 #ifdef EXPERIMENTAL_DMARC
266 FALSE, /* dmarc_status */
267 #endif
268 FALSE, /* dnslists */
269 FALSE, /* domains */
270 FALSE, /* encrypted */
271 TRUE, /* endpass */
272 FALSE, /* hosts */
273 FALSE, /* local_parts */
274 TRUE, /* log_message */
275 TRUE, /* log_reject_target */
276 TRUE, /* logwrite */
277 #ifdef WITH_CONTENT_SCAN
278 FALSE, /* malware */
279 #endif
280 TRUE, /* message */
281 #ifdef WITH_CONTENT_SCAN
282 FALSE, /* mime_regex */
283 #endif
284 TRUE, /* queue */
285 FALSE, /* ratelimit */
286 FALSE, /* recipients */
287 #ifdef WITH_CONTENT_SCAN
288 FALSE, /* regex */
289 #endif
290 TRUE, /* remove_header */
291 FALSE, /* sender_domains */
292 FALSE, /* senders */
293 TRUE, /* set */
294 #ifdef WITH_CONTENT_SCAN
295 FALSE, /* spam */
296 #endif
297 #ifdef EXPERIMENTAL_SPF
298 FALSE, /* spf */
299 FALSE, /* spf_guess */
300 #endif
301 TRUE, /* udpsend */
302 FALSE /* verify */
303 };
304
305 /* Bit map vector of which conditions and modifiers are not allowed at certain
306 times. For each condition and modifier, there's a bitmap of dis-allowed times.
307 For some, it is easier to specify the negation of a small number of allowed
308 times. */
309
310 static unsigned int cond_forbids[] = {
311 0, /* acl */
312
313 (unsigned int)
314 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
315 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
316 #ifndef DISABLE_PRDR
317 (1<<ACL_WHERE_PRDR)|
318 #endif
319 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
320 (1<<ACL_WHERE_DKIM)|
321 (1<<ACL_WHERE_NOTSMTP_START)),
322
323 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
324 (1<<ACL_WHERE_NOTSMTP_START)|
325 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
326
327 #ifdef EXPERIMENTAL_BRIGHTMAIL
328 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
329 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
330 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
331 #ifndef DISABLE_PRDR
332 (1<<ACL_WHERE_PRDR)|
333 #endif
334 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
335 (1<<ACL_WHERE_MAILAUTH)|
336 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
337 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
338 (1<<ACL_WHERE_NOTSMTP_START),
339 #endif
340
341 0, /* condition */
342
343 0, /* continue */
344
345 /* Certain types of control are always allowed, so we let it through
346 always and check in the control processing itself. */
347
348 0, /* control */
349
350 #ifdef EXPERIMENTAL_DCC
351 (unsigned int)
352 ~((1<<ACL_WHERE_DATA)| /* dcc */
353 #ifndef DISABLE_PRDR
354 (1<<ACL_WHERE_PRDR)|
355 #endif
356 (1<<ACL_WHERE_NOTSMTP)),
357 #endif
358
359 #ifdef WITH_CONTENT_SCAN
360 (unsigned int)
361 ~(1<<ACL_WHERE_MIME), /* decode */
362 #endif
363
364 (1<<ACL_WHERE_NOTQUIT), /* delay */
365
366 #ifndef DISABLE_DKIM
367 (unsigned int)
368 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
369
370 (unsigned int)
371 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
372 #endif
373
374 #ifdef EXPERIMENTAL_DMARC
375 (unsigned int)
376 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
377 #endif
378
379 /* Explicit key lookups can be made in non-smtp ACLs so pass
380 always and check in the verify processing itself. */
381
382 0, /* dnslists */
383
384 (unsigned int)
385 ~((1<<ACL_WHERE_RCPT) /* domains */
386 |(1<<ACL_WHERE_VRFY)
387 #ifndef DISABLE_PRDR
388 |(1<<ACL_WHERE_PRDR)
389 #endif
390 ),
391
392 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
393 (1<<ACL_WHERE_CONNECT)|
394 (1<<ACL_WHERE_NOTSMTP_START)|
395 (1<<ACL_WHERE_HELO),
396
397 0, /* endpass */
398
399 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
400 (1<<ACL_WHERE_NOTSMTP_START),
401
402 (unsigned int)
403 ~((1<<ACL_WHERE_RCPT) /* local_parts */
404 |(1<<ACL_WHERE_VRFY)
405 #ifndef DISABLE_PRDR
406 |(1<<ACL_WHERE_PRDR)
407 #endif
408 ),
409
410 0, /* log_message */
411
412 0, /* log_reject_target */
413
414 0, /* logwrite */
415
416 #ifdef WITH_CONTENT_SCAN
417 (unsigned int)
418 ~((1<<ACL_WHERE_DATA)| /* malware */
419 #ifndef DISABLE_PRDR
420 (1<<ACL_WHERE_PRDR)|
421 #endif
422 (1<<ACL_WHERE_NOTSMTP)),
423 #endif
424
425 0, /* message */
426
427 #ifdef WITH_CONTENT_SCAN
428 (unsigned int)
429 ~(1<<ACL_WHERE_MIME), /* mime_regex */
430 #endif
431
432 (1<<ACL_WHERE_NOTSMTP)| /* queue */
433 #ifndef DISABLE_PRDR
434 (1<<ACL_WHERE_PRDR)|
435 #endif
436 (1<<ACL_WHERE_DATA),
437
438 0, /* ratelimit */
439
440 (unsigned int)
441 ~(1<<ACL_WHERE_RCPT), /* recipients */
442
443 #ifdef WITH_CONTENT_SCAN
444 (unsigned int)
445 ~((1<<ACL_WHERE_DATA)| /* regex */
446 #ifndef DISABLE_PRDR
447 (1<<ACL_WHERE_PRDR)|
448 #endif
449 (1<<ACL_WHERE_NOTSMTP)|
450 (1<<ACL_WHERE_MIME)),
451 #endif
452
453 (unsigned int)
454 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
455 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
456 #ifndef DISABLE_PRDR
457 (1<<ACL_WHERE_PRDR)|
458 #endif
459 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
460 (1<<ACL_WHERE_NOTSMTP_START)),
461
462 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
463 (1<<ACL_WHERE_HELO)|
464 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
465 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
466 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
467
468 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
469 (1<<ACL_WHERE_HELO)|
470 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
471 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
472 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
473
474 0, /* set */
475
476 #ifdef WITH_CONTENT_SCAN
477 (unsigned int)
478 ~((1<<ACL_WHERE_DATA)| /* spam */
479 #ifndef DISABLE_PRDR
480 (1<<ACL_WHERE_PRDR)|
481 #endif
482 (1<<ACL_WHERE_NOTSMTP)),
483 #endif
484
485 #ifdef EXPERIMENTAL_SPF
486 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
487 (1<<ACL_WHERE_HELO)|
488 (1<<ACL_WHERE_MAILAUTH)|
489 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
490 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
491 (1<<ACL_WHERE_NOTSMTP)|
492 (1<<ACL_WHERE_NOTSMTP_START),
493
494 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
495 (1<<ACL_WHERE_HELO)|
496 (1<<ACL_WHERE_MAILAUTH)|
497 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
498 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
499 (1<<ACL_WHERE_NOTSMTP)|
500 (1<<ACL_WHERE_NOTSMTP_START),
501 #endif
502
503 0, /* udpsend */
504
505 /* Certain types of verify are always allowed, so we let it through
506 always and check in the verify function itself */
507
508 0 /* verify */
509 };
510
511
512 /* Return values from decode_control(); used as index so keep in step
513 with the controls_list table that follows! */
514
515 enum {
516 CONTROL_AUTH_UNADVERTISED,
517 #ifdef EXPERIMENTAL_BRIGHTMAIL
518 CONTROL_BMI_RUN,
519 #endif
520 CONTROL_CASEFUL_LOCAL_PART,
521 CONTROL_CASELOWER_LOCAL_PART,
522 CONTROL_CUTTHROUGH_DELIVERY,
523 CONTROL_DEBUG,
524 #ifndef DISABLE_DKIM
525 CONTROL_DKIM_VERIFY,
526 #endif
527 #ifdef EXPERIMENTAL_DMARC
528 CONTROL_DMARC_VERIFY,
529 CONTROL_DMARC_FORENSIC,
530 #endif
531 CONTROL_DSCP,
532 CONTROL_ENFORCE_SYNC,
533 CONTROL_ERROR, /* pseudo-value for decode errors */
534 CONTROL_FAKEDEFER,
535 CONTROL_FAKEREJECT,
536 CONTROL_FREEZE,
537
538 CONTROL_NO_CALLOUT_FLUSH,
539 CONTROL_NO_DELAY_FLUSH,
540 CONTROL_NO_ENFORCE_SYNC,
541 #ifdef WITH_CONTENT_SCAN
542 CONTROL_NO_MBOX_UNSPOOL,
543 #endif
544 CONTROL_NO_MULTILINE,
545 CONTROL_NO_PIPELINING,
546
547 CONTROL_QUEUE_ONLY,
548 CONTROL_SUBMISSION,
549 CONTROL_SUPPRESS_LOCAL_FIXUPS,
550 #ifdef SUPPORT_I18N
551 CONTROL_UTF8_DOWNCONVERT,
552 #endif
553 };
554
555
556
557 /* Structure listing various control arguments, with their characteristics.
558 For each control, there's a bitmap of dis-allowed times. For some, it is easier
559 to specify the negation of a small number of allowed times. */
560
561 typedef struct control_def {
562 uschar *name;
563 BOOL has_option; /* Has /option(s) following */
564 unsigned forbids; /* bitmap of dis-allowed times */
565 } control_def;
566
567 static control_def controls_list[] = {
568 { US"allow_auth_unadvertised", FALSE,
569 (unsigned)
570 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO))
571 },
572 #ifdef EXPERIMENTAL_BRIGHTMAIL
573 { US"bmi_run", FALSE, 0 },
574 #endif
575 { US"caseful_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
576 { US"caselower_local_part", FALSE, (unsigned) ~(1<<ACL_WHERE_RCPT) },
577 { US"cutthrough_delivery", TRUE, 0 },
578 { US"debug", TRUE, 0 },
579
580 #ifndef DISABLE_DKIM
581 { US"dkim_disable_verify", FALSE,
582 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|
583 # ifndef DISABLE_PRDR
584 (1<<ACL_WHERE_PRDR)|
585 # endif
586 (1<<ACL_WHERE_NOTSMTP_START)
587 },
588 #endif
589
590 #ifdef EXPERIMENTAL_DMARC
591 { US"dmarc_disable_verify", FALSE,
592 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
593 },
594 { US"dmarc_enable_forensic", FALSE,
595 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
596 },
597 #endif
598
599 { US"dscp", TRUE,
600 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)|(1<<ACL_WHERE_NOTQUIT)
601 },
602 { US"enforce_sync", FALSE,
603 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
604 },
605
606 /* Pseudo-value for decode errors */
607 { US"error", FALSE, 0 },
608
609 { US"fakedefer", TRUE,
610 (unsigned)
611 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
612 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
613 #ifndef DISABLE_PRDR
614 (1<<ACL_WHERE_PRDR)|
615 #endif
616 (1<<ACL_WHERE_MIME))
617 },
618 { US"fakereject", TRUE,
619 (unsigned)
620 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
621 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
622 #ifndef DISABLE_PRDR
623 (1<<ACL_WHERE_PRDR)|
624 #endif
625 (1<<ACL_WHERE_MIME))
626 },
627 { US"freeze", TRUE,
628 (unsigned)
629 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
630 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
631 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
632 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
633 },
634
635 { US"no_callout_flush", FALSE,
636 (1<<ACL_WHERE_NOTSMTP)| (1<<ACL_WHERE_NOTSMTP_START)
637 },
638 { US"no_delay_flush", FALSE,
639 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
640 },
641
642 { US"no_enforce_sync", FALSE,
643 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
644 },
645 #ifdef WITH_CONTENT_SCAN
646 { US"no_mbox_unspool", FALSE,
647 (unsigned)
648 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
649 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
650 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
651 (1<<ACL_WHERE_MIME))
652 },
653 #endif
654 { US"no_multiline_responses", FALSE,
655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
656 },
657 { US"no_pipelining", FALSE,
658 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_NOTSMTP_START)
659 },
660
661 { US"queue_only", FALSE,
662 (unsigned)
663 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|
664 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
665 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
666 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME))
667 },
668 { US"submission", TRUE,
669 (unsigned)
670 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA))
671 },
672 { US"suppress_local_fixups", FALSE,
673 (unsigned)
674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
675 (1<<ACL_WHERE_NOTSMTP_START))
676 },
677 #ifdef SUPPORT_I18N
678 { US"utf8_downconvert", TRUE, 0 }
679 #endif
680 };
681
682 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
683 caches its result in a tree to avoid repeated DNS queries. The result is an
684 integer code which is used as an index into the following tables of
685 explanatory strings and verification return codes. */
686
687 static tree_node *csa_cache = NULL;
688
689 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
690 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
691
692 /* The acl_verify_csa() return code is translated into an acl_verify() return
693 code using the following table. It is OK unless the client is definitely not
694 authorized. This is because CSA is supposed to be optional for sending sites,
695 so recipients should not be too strict about checking it - especially because
696 DNS problems are quite likely to occur. It's possible to use $csa_status in
697 further ACL conditions to distinguish ok, unknown, and defer if required, but
698 the aim is to make the usual configuration simple. */
699
700 static int csa_return_code[] = {
701 OK, OK, OK, OK,
702 FAIL, FAIL, FAIL, FAIL
703 };
704
705 static uschar *csa_status_string[] = {
706 US"unknown", US"ok", US"defer", US"defer",
707 US"fail", US"fail", US"fail", US"fail"
708 };
709
710 static uschar *csa_reason_string[] = {
711 US"unknown",
712 US"ok",
713 US"deferred (SRV lookup failed)",
714 US"deferred (target address lookup failed)",
715 US"failed (explicit authorization required)",
716 US"failed (host name not authorized)",
717 US"failed (no authorized addresses)",
718 US"failed (client address mismatch)"
719 };
720
721 /* Options for the ratelimit condition. Note that there are two variants of
722 the per_rcpt option, depending on the ACL that is used to measure the rate.
723 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
724 so the two variants must have the same internal representation as well as
725 the same configuration string. */
726
727 enum {
728 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
729 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
730 };
731
732 #define RATE_SET(var,new) \
733 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
734
735 static uschar *ratelimit_option_string[] = {
736 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
737 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
738 };
739
740 /* Enable recursion between acl_check_internal() and acl_check_condition() */
741
742 static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
743 uschar **);
744
745
746 /*************************************************
747 * Find control in list *
748 *************************************************/
749
750 /* The lists are always in order, so binary chop can be used.
751
752 Arguments:
753 name the control name to search for
754 ol the first entry in the control list
755 last one more than the offset of the last entry in the control list
756
757 Returns: index of a control entry, or -1 if not found
758 */
759
760 static int
761 find_control(const uschar * name, control_def * ol, int last)
762 {
763 int first = 0;
764 while (last > first)
765 {
766 int middle = (first + last)/2;
767 uschar * s = ol[middle].name;
768 int c = Ustrncmp(name, s, Ustrlen(s));
769 if (c == 0) return middle;
770 else if (c > 0) first = middle + 1;
771 else last = middle;
772 }
773 return -1;
774 }
775
776
777
778 /*************************************************
779 * Pick out name from list *
780 *************************************************/
781
782 /* Use a binary chop method
783
784 Arguments:
785 name name to find
786 list list of names
787 end size of list
788
789 Returns: offset in list, or -1 if not found
790 */
791
792 static int
793 acl_checkname(uschar *name, uschar **list, int end)
794 {
795 int start = 0;
796
797 while (start < end)
798 {
799 int mid = (start + end)/2;
800 int c = Ustrcmp(name, list[mid]);
801 if (c == 0) return mid;
802 if (c < 0) end = mid; else start = mid + 1;
803 }
804
805 return -1;
806 }
807
808
809 /*************************************************
810 * Read and parse one ACL *
811 *************************************************/
812
813 /* This function is called both from readconf in order to parse the ACLs in the
814 configuration file, and also when an ACL is encountered dynamically (e.g. as
815 the result of an expansion). It is given a function to call in order to
816 retrieve the lines of the ACL. This function handles skipping comments and
817 blank lines (where relevant).
818
819 Arguments:
820 func function to get next line of ACL
821 error where to put an error message
822
823 Returns: pointer to ACL, or NULL
824 NULL can be legal (empty ACL); in this case error will be NULL
825 */
826
827 acl_block *
828 acl_read(uschar *(*func)(void), uschar **error)
829 {
830 acl_block *yield = NULL;
831 acl_block **lastp = &yield;
832 acl_block *this = NULL;
833 acl_condition_block *cond;
834 acl_condition_block **condp = NULL;
835 uschar *s;
836
837 *error = NULL;
838
839 while ((s = (*func)()) != NULL)
840 {
841 int v, c;
842 BOOL negated = FALSE;
843 uschar *saveline = s;
844 uschar name[64];
845
846 /* Conditions (but not verbs) are allowed to be negated by an initial
847 exclamation mark. */
848
849 while (isspace(*s)) s++;
850 if (*s == '!')
851 {
852 negated = TRUE;
853 s++;
854 }
855
856 /* Read the name of a verb or a condition, or the start of a new ACL, which
857 can be started by a name, or by a macro definition. */
858
859 s = readconf_readname(name, sizeof(name), s);
860 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
861
862 /* If a verb is unrecognized, it may be another condition or modifier that
863 continues the previous verb. */
864
865 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
866 if (v < 0)
867 {
868 if (this == NULL)
869 {
870 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
871 saveline);
872 return NULL;
873 }
874 }
875
876 /* New verb */
877
878 else
879 {
880 if (negated)
881 {
882 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
883 return NULL;
884 }
885 this = store_get(sizeof(acl_block));
886 *lastp = this;
887 lastp = &(this->next);
888 this->next = NULL;
889 this->verb = v;
890 this->condition = NULL;
891 condp = &(this->condition);
892 if (*s == 0) continue; /* No condition on this line */
893 if (*s == '!')
894 {
895 negated = TRUE;
896 s++;
897 }
898 s = readconf_readname(name, sizeof(name), s); /* Condition name */
899 }
900
901 /* Handle a condition or modifier. */
902
903 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
904 if (c < 0)
905 {
906 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
907 saveline);
908 return NULL;
909 }
910
911 /* The modifiers may not be negated */
912
913 if (negated && cond_modifiers[c])
914 {
915 *error = string_sprintf("ACL error: negation is not allowed with "
916 "\"%s\"", conditions[c]);
917 return NULL;
918 }
919
920 /* ENDPASS may occur only with ACCEPT or DISCARD. */
921
922 if (c == ACLC_ENDPASS &&
923 this->verb != ACL_ACCEPT &&
924 this->verb != ACL_DISCARD)
925 {
926 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
927 conditions[c], verbs[this->verb]);
928 return NULL;
929 }
930
931 cond = store_get(sizeof(acl_condition_block));
932 cond->next = NULL;
933 cond->type = c;
934 cond->u.negated = negated;
935
936 *condp = cond;
937 condp = &(cond->next);
938
939 /* The "set" modifier is different in that its argument is "name=value"
940 rather than just a value, and we can check the validity of the name, which
941 gives us a variable name to insert into the data block. The original ACL
942 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
943 extended to 20 of each type, but after that people successfully argued for
944 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
945 After that, we allow alphanumerics and underscores, but the first character
946 after c or m must be a digit or an underscore. This retains backwards
947 compatibility. */
948
949 if (c == ACLC_SET)
950 {
951 uschar *endptr;
952
953 if (Ustrncmp(s, "acl_c", 5) != 0 &&
954 Ustrncmp(s, "acl_m", 5) != 0)
955 {
956 *error = string_sprintf("invalid variable name after \"set\" in ACL "
957 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
958 return NULL;
959 }
960
961 endptr = s + 5;
962 if (!isdigit(*endptr) && *endptr != '_')
963 {
964 *error = string_sprintf("invalid variable name after \"set\" in ACL "
965 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
966 s);
967 return NULL;
968 }
969
970 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
971 {
972 if (!isalnum(*endptr) && *endptr != '_')
973 {
974 *error = string_sprintf("invalid character \"%c\" in variable name "
975 "in ACL modifier \"set %s\"", *endptr, s);
976 return NULL;
977 }
978 endptr++;
979 }
980
981 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
982 s = endptr;
983 while (isspace(*s)) s++;
984 }
985
986 /* For "set", we are now positioned for the data. For the others, only
987 "endpass" has no data */
988
989 if (c != ACLC_ENDPASS)
990 {
991 if (*s++ != '=')
992 {
993 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
994 cond_modifiers[c]? US"modifier" : US"condition");
995 return NULL;
996 }
997 while (isspace(*s)) s++;
998 cond->arg = string_copy(s);
999 }
1000 }
1001
1002 return yield;
1003 }
1004
1005
1006
1007 /*************************************************
1008 * Set up added header line(s) *
1009 *************************************************/
1010
1011 /* This function is called by the add_header modifier, and also from acl_warn()
1012 to implement the now-deprecated way of adding header lines using "message" on a
1013 "warn" verb. The argument is treated as a sequence of header lines which are
1014 added to a chain, provided there isn't an identical one already there.
1015
1016 Argument: string of header lines
1017 Returns: nothing
1018 */
1019
1020 static void
1021 setup_header(const uschar *hstring)
1022 {
1023 const uschar *p, *q;
1024 int hlen = Ustrlen(hstring);
1025
1026 /* Ignore any leading newlines */
1027 while (*hstring == '\n') hstring++, hlen--;
1028
1029 /* An empty string does nothing; ensure exactly one final newline. */
1030 if (hlen <= 0) return;
1031 if (hstring[--hlen] != '\n') /* no newline */
1032 q = string_sprintf("%s\n", hstring);
1033 else if (hstring[hlen-1] == '\n') /* double newline */
1034 {
1035 uschar * s = string_copy(hstring);
1036 while(s[--hlen] == '\n')
1037 s[hlen+1] = '\0';
1038 q = s;
1039 }
1040 else
1041 q = hstring;
1042
1043 /* Loop for multiple header lines, taking care about continuations */
1044
1045 for (p = q; *p != 0; )
1046 {
1047 const uschar *s;
1048 uschar * hdr;
1049 int newtype = htype_add_bot;
1050 header_line **hptr = &acl_added_headers;
1051
1052 /* Find next header line within the string */
1053
1054 for (;;)
1055 {
1056 q = Ustrchr(q, '\n'); /* we know there was a newline */
1057 if (*(++q) != ' ' && *q != '\t') break;
1058 }
1059
1060 /* If the line starts with a colon, interpret the instruction for where to
1061 add it. This temporarily sets up a new type. */
1062
1063 if (*p == ':')
1064 {
1065 if (strncmpic(p, US":after_received:", 16) == 0)
1066 {
1067 newtype = htype_add_rec;
1068 p += 16;
1069 }
1070 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1071 {
1072 newtype = htype_add_rfc;
1073 p += 14;
1074 }
1075 else if (strncmpic(p, US":at_start:", 10) == 0)
1076 {
1077 newtype = htype_add_top;
1078 p += 10;
1079 }
1080 else if (strncmpic(p, US":at_end:", 8) == 0)
1081 {
1082 newtype = htype_add_bot;
1083 p += 8;
1084 }
1085 while (*p == ' ' || *p == '\t') p++;
1086 }
1087
1088 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1089 to the front of it. */
1090
1091 for (s = p; s < q - 1; s++)
1092 {
1093 if (*s == ':' || !isgraph(*s)) break;
1094 }
1095
1096 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1097 hlen = Ustrlen(hdr);
1098
1099 /* See if this line has already been added */
1100
1101 while (*hptr != NULL)
1102 {
1103 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1104 hptr = &((*hptr)->next);
1105 }
1106
1107 /* Add if not previously present */
1108
1109 if (*hptr == NULL)
1110 {
1111 header_line *h = store_get(sizeof(header_line));
1112 h->text = hdr;
1113 h->next = NULL;
1114 h->type = newtype;
1115 h->slen = hlen;
1116 *hptr = h;
1117 hptr = &(h->next);
1118 }
1119
1120 /* Advance for next header line within the string */
1121
1122 p = q;
1123 }
1124 }
1125
1126
1127
1128 /*************************************************
1129 * List the added header lines *
1130 *************************************************/
1131 uschar *
1132 fn_hdrs_added(void)
1133 {
1134 uschar * ret = NULL;
1135 int size = 0;
1136 int ptr = 0;
1137 header_line * h = acl_added_headers;
1138 uschar * s;
1139 uschar * cp;
1140
1141 if (!h) return NULL;
1142
1143 do
1144 {
1145 s = h->text;
1146 while ((cp = Ustrchr(s, '\n')) != NULL)
1147 {
1148 if (cp[1] == '\0') break;
1149
1150 /* contains embedded newline; needs doubling */
1151 ret = string_catn(ret, &size, &ptr, s, cp-s+1);
1152 ret = string_catn(ret, &size, &ptr, US"\n", 1);
1153 s = cp+1;
1154 }
1155 /* last bit of header */
1156
1157 ret = string_catn(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1158 }
1159 while((h = h->next));
1160
1161 ret[ptr-1] = '\0'; /* overwrite last newline */
1162 return ret;
1163 }
1164
1165
1166 /*************************************************
1167 * Set up removed header line(s) *
1168 *************************************************/
1169
1170 /* This function is called by the remove_header modifier. The argument is
1171 treated as a sequence of header names which are added to a colon separated
1172 list, provided there isn't an identical one already there.
1173
1174 Argument: string of header names
1175 Returns: nothing
1176 */
1177
1178 static void
1179 setup_remove_header(const uschar *hnames)
1180 {
1181 if (*hnames != 0)
1182 acl_removed_headers = acl_removed_headers
1183 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1184 : string_copy(hnames);
1185 }
1186
1187
1188
1189 /*************************************************
1190 * Handle warnings *
1191 *************************************************/
1192
1193 /* This function is called when a WARN verb's conditions are true. It adds to
1194 the message's headers, and/or writes information to the log. In each case, this
1195 only happens once (per message for headers, per connection for log).
1196
1197 ** NOTE: The header adding action using the "message" setting is historic, and
1198 its use is now deprecated. The new add_header modifier should be used instead.
1199
1200 Arguments:
1201 where ACL_WHERE_xxxx indicating which ACL this is
1202 user_message message for adding to headers
1203 log_message message for logging, if different
1204
1205 Returns: nothing
1206 */
1207
1208 static void
1209 acl_warn(int where, uschar *user_message, uschar *log_message)
1210 {
1211 if (log_message != NULL && log_message != user_message)
1212 {
1213 uschar *text;
1214 string_item *logged;
1215
1216 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1217 string_printing(log_message));
1218
1219 /* If a sender verification has failed, and the log message is "sender verify
1220 failed", add the failure message. */
1221
1222 if (sender_verified_failed != NULL &&
1223 sender_verified_failed->message != NULL &&
1224 strcmpic(log_message, US"sender verify failed") == 0)
1225 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1226
1227 /* Search previously logged warnings. They are kept in malloc
1228 store so they can be freed at the start of a new message. */
1229
1230 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1231 if (Ustrcmp(logged->text, text) == 0) break;
1232
1233 if (logged == NULL)
1234 {
1235 int length = Ustrlen(text) + 1;
1236 log_write(0, LOG_MAIN, "%s", text);
1237 logged = store_malloc(sizeof(string_item) + length);
1238 logged->text = (uschar *)logged + sizeof(string_item);
1239 memcpy(logged->text, text, length);
1240 logged->next = acl_warn_logged;
1241 acl_warn_logged = logged;
1242 }
1243 }
1244
1245 /* If there's no user message, we are done. */
1246
1247 if (user_message == NULL) return;
1248
1249 /* If this isn't a message ACL, we can't do anything with a user message.
1250 Log an error. */
1251
1252 if (where > ACL_WHERE_NOTSMTP)
1253 {
1254 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1255 "found in a non-message (%s) ACL: cannot specify header lines here: "
1256 "message ignored", acl_wherenames[where]);
1257 return;
1258 }
1259
1260 /* The code for setting up header lines is now abstracted into a separate
1261 function so that it can be used for the add_header modifier as well. */
1262
1263 setup_header(user_message);
1264 }
1265
1266
1267
1268 /*************************************************
1269 * Verify and check reverse DNS *
1270 *************************************************/
1271
1272 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1273 address if this has not yet been done. The host_name_lookup() function checks
1274 that one of these names resolves to an address list that contains the client IP
1275 address, so we don't actually have to do the check here.
1276
1277 Arguments:
1278 user_msgptr pointer for user message
1279 log_msgptr pointer for log message
1280
1281 Returns: OK verification condition succeeded
1282 FAIL verification failed
1283 DEFER there was a problem verifying
1284 */
1285
1286 static int
1287 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1288 {
1289 int rc;
1290
1291 user_msgptr = user_msgptr; /* stop compiler warning */
1292
1293 /* Previous success */
1294
1295 if (sender_host_name != NULL) return OK;
1296
1297 /* Previous failure */
1298
1299 if (host_lookup_failed)
1300 {
1301 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1302 return FAIL;
1303 }
1304
1305 /* Need to do a lookup */
1306
1307 HDEBUG(D_acl)
1308 debug_printf("looking up host name to force name/address consistency check\n");
1309
1310 if ((rc = host_name_lookup()) != OK)
1311 {
1312 *log_msgptr = (rc == DEFER)?
1313 US"host lookup deferred for reverse lookup check"
1314 :
1315 string_sprintf("host lookup failed for reverse lookup check%s",
1316 host_lookup_msg);
1317 return rc; /* DEFER or FAIL */
1318 }
1319
1320 host_build_sender_fullhost();
1321 return OK;
1322 }
1323
1324
1325
1326 /*************************************************
1327 * Check client IP address matches CSA target *
1328 *************************************************/
1329
1330 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1331 response for address records belonging to the CSA target hostname. The section
1332 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1333 If one of the addresses matches the client's IP address, then the client is
1334 authorized by CSA. If there are target IP addresses but none of them match
1335 then the client is using an unauthorized IP address. If there are no target IP
1336 addresses then the client cannot be using an authorized IP address. (This is
1337 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1338
1339 Arguments:
1340 dnsa the DNS answer block
1341 dnss a DNS scan block for us to use
1342 reset option specifing what portion to scan, as described above
1343 target the target hostname to use for matching RR names
1344
1345 Returns: CSA_OK successfully authorized
1346 CSA_FAIL_MISMATCH addresses found but none matched
1347 CSA_FAIL_NOADDR no target addresses found
1348 */
1349
1350 static int
1351 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1352 uschar *target)
1353 {
1354 dns_record *rr;
1355 dns_address *da;
1356
1357 BOOL target_found = FALSE;
1358
1359 for (rr = dns_next_rr(dnsa, dnss, reset);
1360 rr != NULL;
1361 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1362 {
1363 /* Check this is an address RR for the target hostname. */
1364
1365 if (rr->type != T_A
1366 #if HAVE_IPV6
1367 && rr->type != T_AAAA
1368 #endif
1369 ) continue;
1370
1371 if (strcmpic(target, rr->name) != 0) continue;
1372
1373 target_found = TRUE;
1374
1375 /* Turn the target address RR into a list of textual IP addresses and scan
1376 the list. There may be more than one if it is an A6 RR. */
1377
1378 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1379 {
1380 /* If the client IP address matches the target IP address, it's good! */
1381
1382 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1383
1384 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1385 }
1386 }
1387
1388 /* If we found some target addresses but none of them matched, the client is
1389 using an unauthorized IP address, otherwise the target has no authorized IP
1390 addresses. */
1391
1392 if (target_found) return CSA_FAIL_MISMATCH;
1393 else return CSA_FAIL_NOADDR;
1394 }
1395
1396
1397
1398 /*************************************************
1399 * Verify Client SMTP Authorization *
1400 *************************************************/
1401
1402 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1403 to find the CSA SRV record corresponding to the domain argument, or
1404 $sender_helo_name if no argument is provided. It then checks that the
1405 client is authorized, and that its IP address corresponds to the SRV
1406 target's address by calling acl_verify_csa_address() above. The address
1407 should have been returned in the DNS response's ADDITIONAL section, but if
1408 not we perform another DNS lookup to get it.
1409
1410 Arguments:
1411 domain pointer to optional parameter following verify = csa
1412
1413 Returns: CSA_UNKNOWN no valid CSA record found
1414 CSA_OK successfully authorized
1415 CSA_FAIL_* client is definitely not authorized
1416 CSA_DEFER_* there was a DNS problem
1417 */
1418
1419 static int
1420 acl_verify_csa(const uschar *domain)
1421 {
1422 tree_node *t;
1423 const uschar *found;
1424 uschar *p;
1425 int priority, weight, port;
1426 dns_answer dnsa;
1427 dns_scan dnss;
1428 dns_record *rr;
1429 int rc, type;
1430 uschar target[256];
1431
1432 /* Work out the domain we are using for the CSA lookup. The default is the
1433 client's HELO domain. If the client has not said HELO, use its IP address
1434 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1435
1436 while (isspace(*domain) && *domain != '\0') ++domain;
1437 if (*domain == '\0') domain = sender_helo_name;
1438 if (domain == NULL) domain = sender_host_address;
1439 if (sender_host_address == NULL) return CSA_UNKNOWN;
1440
1441 /* If we have an address literal, strip off the framing ready for turning it
1442 into a domain. The framing consists of matched square brackets possibly
1443 containing a keyword and a colon before the actual IP address. */
1444
1445 if (domain[0] == '[')
1446 {
1447 const uschar *start = Ustrchr(domain, ':');
1448 if (start == NULL) start = domain;
1449 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1450 }
1451
1452 /* Turn domains that look like bare IP addresses into domains in the reverse
1453 DNS. This code also deals with address literals and $sender_host_address. It's
1454 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1455 address literals, but it's probably the most friendly thing to do. This is an
1456 extension to CSA, so we allow it to be turned off for proper conformance. */
1457
1458 if (string_is_ip_address(domain, NULL) != 0)
1459 {
1460 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1461 dns_build_reverse(domain, target);
1462 domain = target;
1463 }
1464
1465 /* Find out if we've already done the CSA check for this domain. If we have,
1466 return the same result again. Otherwise build a new cached result structure
1467 for this domain. The name is filled in now, and the value is filled in when
1468 we return from this function. */
1469
1470 t = tree_search(csa_cache, domain);
1471 if (t != NULL) return t->data.val;
1472
1473 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1474 Ustrcpy(t->name, domain);
1475 (void)tree_insertnode(&csa_cache, t);
1476
1477 /* Now we are ready to do the actual DNS lookup(s). */
1478
1479 found = domain;
1480 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1481 {
1482 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1483
1484 default:
1485 return t->data.val = CSA_DEFER_SRV;
1486
1487 /* If we found nothing, the client's authorization is unknown. */
1488
1489 case DNS_NOMATCH:
1490 case DNS_NODATA:
1491 return t->data.val = CSA_UNKNOWN;
1492
1493 /* We got something! Go on to look at the reply in more detail. */
1494
1495 case DNS_SUCCEED:
1496 break;
1497 }
1498
1499 /* Scan the reply for well-formed CSA SRV records. */
1500
1501 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1502 rr != NULL;
1503 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1504 {
1505 if (rr->type != T_SRV) continue;
1506
1507 /* Extract the numerical SRV fields (p is incremented) */
1508
1509 p = rr->data;
1510 GETSHORT(priority, p);
1511 GETSHORT(weight, p);
1512 GETSHORT(port, p);
1513
1514 DEBUG(D_acl)
1515 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1516
1517 /* Check the CSA version number */
1518
1519 if (priority != 1) continue;
1520
1521 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1522 found by dns_special_lookup() is a parent of the one we asked for), we check
1523 the subdomain assertions in the port field. At the moment there's only one
1524 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1525 SRV records of their own. */
1526
1527 if (Ustrcmp(found, domain) != 0)
1528 {
1529 if (port & 1)
1530 return t->data.val = CSA_FAIL_EXPLICIT;
1531 else
1532 return t->data.val = CSA_UNKNOWN;
1533 }
1534
1535 /* This CSA SRV record refers directly to our domain, so we check the value
1536 in the weight field to work out the domain's authorization. 0 and 1 are
1537 unauthorized; 3 means the client is authorized but we can't check the IP
1538 address in order to authenticate it, so we treat it as unknown; values
1539 greater than 3 are undefined. */
1540
1541 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1542
1543 if (weight > 2) continue;
1544
1545 /* Weight == 2, which means the domain is authorized. We must check that the
1546 client's IP address is listed as one of the SRV target addresses. Save the
1547 target hostname then break to scan the additional data for its addresses. */
1548
1549 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1550 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1551
1552 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1553
1554 break;
1555 }
1556
1557 /* If we didn't break the loop then no appropriate records were found. */
1558
1559 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1560
1561 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1562 A target of "." indicates there are no valid addresses, so the client cannot
1563 be authorized. (This is an odd configuration because weight=2 target=. is
1564 equivalent to weight=1, but we check for it in order to keep load off the
1565 root name servers.) Note that dn_expand() turns "." into "". */
1566
1567 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1568
1569 /* Scan the additional section of the CSA SRV reply for addresses belonging
1570 to the target. If the name server didn't return any additional data (e.g.
1571 because it does not fully support SRV records), we need to do another lookup
1572 to obtain the target addresses; otherwise we have a definitive result. */
1573
1574 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1575 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1576
1577 /* The DNS lookup type corresponds to the IP version used by the client. */
1578
1579 #if HAVE_IPV6
1580 if (Ustrchr(sender_host_address, ':') != NULL)
1581 type = T_AAAA;
1582 else
1583 #endif /* HAVE_IPV6 */
1584 type = T_A;
1585
1586
1587 lookup_dnssec_authenticated = NULL;
1588 switch (dns_lookup(&dnsa, target, type, NULL))
1589 {
1590 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1591
1592 default:
1593 return t->data.val = CSA_DEFER_ADDR;
1594
1595 /* If the query succeeded, scan the addresses and return the result. */
1596
1597 case DNS_SUCCEED:
1598 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1599 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1600 /* else fall through */
1601
1602 /* If the target has no IP addresses, the client cannot have an authorized
1603 IP address. However, if the target site uses A6 records (not AAAA records)
1604 we have to do yet another lookup in order to check them. */
1605
1606 case DNS_NOMATCH:
1607 case DNS_NODATA:
1608 return t->data.val = CSA_FAIL_NOADDR;
1609 }
1610 }
1611
1612
1613
1614 /*************************************************
1615 * Handle verification (address & other) *
1616 *************************************************/
1617
1618 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1619 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1620 VERIFY_HDR_NAMES_ASCII
1621 };
1622 typedef struct {
1623 uschar * name;
1624 int value;
1625 unsigned where_allowed; /* bitmap */
1626 BOOL no_options; /* Never has /option(s) following */
1627 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1628 } verify_type_t;
1629 static verify_type_t verify_type_list[] = {
1630 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1631 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1632 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1633 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1634 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1635 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1636 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1637 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1638 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1639 FALSE, 6 },
1640 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1641 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
1642 };
1643
1644
1645 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1646 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1647 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1648 CALLOUT_TIME
1649 };
1650 typedef struct {
1651 uschar * name;
1652 int value;
1653 int flag;
1654 BOOL has_option; /* Has =option(s) following */
1655 BOOL timeval; /* Has a time value */
1656 } callout_opt_t;
1657 static callout_opt_t callout_opt_list[] = {
1658 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1659 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1660 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1661 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1662 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1663 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1664 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1665 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1666 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1667 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1668 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1669 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1670 };
1671
1672
1673
1674 /* This function implements the "verify" condition. It is called when
1675 encountered in any ACL, because some tests are almost always permitted. Some
1676 just don't make sense, and always fail (for example, an attempt to test a host
1677 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1678
1679 Arguments:
1680 where where called from
1681 addr the recipient address that the ACL is handling, or NULL
1682 arg the argument of "verify"
1683 user_msgptr pointer for user message
1684 log_msgptr pointer for log message
1685 basic_errno where to put verify errno
1686
1687 Returns: OK verification condition succeeded
1688 FAIL verification failed
1689 DEFER there was a problem verifying
1690 ERROR syntax error
1691 */
1692
1693 static int
1694 acl_verify(int where, address_item *addr, const uschar *arg,
1695 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1696 {
1697 int sep = '/';
1698 int callout = -1;
1699 int callout_overall = -1;
1700 int callout_connect = -1;
1701 int verify_options = 0;
1702 int rc;
1703 BOOL verify_header_sender = FALSE;
1704 BOOL defer_ok = FALSE;
1705 BOOL callout_defer_ok = FALSE;
1706 BOOL no_details = FALSE;
1707 BOOL success_on_redirect = FALSE;
1708 address_item *sender_vaddr = NULL;
1709 uschar *verify_sender_address = NULL;
1710 uschar *pm_mailfrom = NULL;
1711 uschar *se_mailfrom = NULL;
1712
1713 /* Some of the verify items have slash-separated options; some do not. Diagnose
1714 an error if options are given for items that don't expect them.
1715 */
1716
1717 uschar *slash = Ustrchr(arg, '/');
1718 const uschar *list = arg;
1719 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1720 verify_type_t * vp;
1721
1722 if (ss == NULL) goto BAD_VERIFY;
1723
1724 /* Handle name/address consistency verification in a separate function. */
1725
1726 for (vp= verify_type_list;
1727 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1728 vp++
1729 )
1730 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1731 : strcmpic (ss, vp->name) == 0)
1732 break;
1733 if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1734 goto BAD_VERIFY;
1735
1736 if (vp->no_options && slash != NULL)
1737 {
1738 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1739 "(this verify item has no options)", arg);
1740 return ERROR;
1741 }
1742 if (!(vp->where_allowed & (1<<where)))
1743 {
1744 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1745 return ERROR;
1746 }
1747 switch(vp->value)
1748 {
1749 case VERIFY_REV_HOST_LKUP:
1750 if (sender_host_address == NULL) return OK;
1751 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1752 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1753 if (strcmpic(ss, US"defer_ok") == 0)
1754 return OK;
1755 return rc;
1756
1757 case VERIFY_CERT:
1758 /* TLS certificate verification is done at STARTTLS time; here we just
1759 test whether it was successful or not. (This is for optional verification; for
1760 mandatory verification, the connection doesn't last this long.) */
1761
1762 if (tls_in.certificate_verified) return OK;
1763 *user_msgptr = US"no verified certificate";
1764 return FAIL;
1765
1766 case VERIFY_HELO:
1767 /* We can test the result of optional HELO verification that might have
1768 occurred earlier. If not, we can attempt the verification now. */
1769
1770 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1771 return helo_verified? OK : FAIL;
1772
1773 case VERIFY_CSA:
1774 /* Do Client SMTP Authorization checks in a separate function, and turn the
1775 result code into user-friendly strings. */
1776
1777 rc = acl_verify_csa(list);
1778 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1779 csa_reason_string[rc]);
1780 csa_status = csa_status_string[rc];
1781 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1782 return csa_return_code[rc];
1783
1784 case VERIFY_HDR_SYNTAX:
1785 /* Check that all relevant header lines have the correct syntax. If there is
1786 a syntax error, we return details of the error to the sender if configured to
1787 send out full details. (But a "message" setting on the ACL can override, as
1788 always). */
1789
1790 rc = verify_check_headers(log_msgptr);
1791 if (rc != OK && *log_msgptr)
1792 if (smtp_return_error_details)
1793 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1794 else
1795 acl_verify_message = *log_msgptr;
1796 return rc;
1797
1798 case VERIFY_HDR_NAMES_ASCII:
1799 /* Check that all header names are true 7 bit strings
1800 See RFC 5322, 2.2. and RFC 6532, 3. */
1801
1802 rc = verify_check_header_names_ascii(log_msgptr);
1803 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1804 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1805 return rc;
1806
1807 case VERIFY_NOT_BLIND:
1808 /* Check that no recipient of this message is "blind", that is, every envelope
1809 recipient must be mentioned in either To: or Cc:. */
1810
1811 rc = verify_check_notblind();
1812 if (rc != OK)
1813 {
1814 *log_msgptr = string_sprintf("bcc recipient detected");
1815 if (smtp_return_error_details)
1816 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1817 }
1818 return rc;
1819
1820 /* The remaining verification tests check recipient and sender addresses,
1821 either from the envelope or from the header. There are a number of
1822 slash-separated options that are common to all of them. */
1823
1824 case VERIFY_HDR_SNDR:
1825 verify_header_sender = TRUE;
1826 break;
1827
1828 case VERIFY_SNDR:
1829 /* In the case of a sender, this can optionally be followed by an address to use
1830 in place of the actual sender (rare special-case requirement). */
1831 {
1832 uschar *s = ss + 6;
1833 if (*s == 0)
1834 verify_sender_address = sender_address;
1835 else
1836 {
1837 while (isspace(*s)) s++;
1838 if (*s++ != '=') goto BAD_VERIFY;
1839 while (isspace(*s)) s++;
1840 verify_sender_address = string_copy(s);
1841 }
1842 }
1843 break;
1844
1845 case VERIFY_RCPT:
1846 break;
1847 }
1848
1849
1850
1851 /* Remaining items are optional; they apply to sender and recipient
1852 verification, including "header sender" verification. */
1853
1854 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1855 != NULL)
1856 {
1857 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1858 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1859 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1860
1861 /* These two old options are left for backwards compatibility */
1862
1863 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1864 {
1865 callout_defer_ok = TRUE;
1866 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1867 }
1868
1869 else if (strcmpic(ss, US"check_postmaster") == 0)
1870 {
1871 pm_mailfrom = US"";
1872 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1873 }
1874
1875 /* The callout option has a number of sub-options, comma separated */
1876
1877 else if (strncmpic(ss, US"callout", 7) == 0)
1878 {
1879 callout = CALLOUT_TIMEOUT_DEFAULT;
1880 ss += 7;
1881 if (*ss != 0)
1882 {
1883 while (isspace(*ss)) ss++;
1884 if (*ss++ == '=')
1885 {
1886 const uschar * sublist = ss;
1887 int optsep = ',';
1888 uschar *opt;
1889 uschar buffer[256];
1890 while (isspace(*sublist)) sublist++;
1891
1892 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
1893 != NULL)
1894 {
1895 callout_opt_t * op;
1896 double period = 1.0F;
1897
1898 for (op= callout_opt_list; op->name; op++)
1899 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1900 break;
1901
1902 verify_options |= op->flag;
1903 if (op->has_option)
1904 {
1905 opt += Ustrlen(op->name);
1906 while (isspace(*opt)) opt++;
1907 if (*opt++ != '=')
1908 {
1909 *log_msgptr = string_sprintf("'=' expected after "
1910 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1911 return ERROR;
1912 }
1913 while (isspace(*opt)) opt++;
1914 }
1915 if (op->timeval)
1916 {
1917 period = readconf_readtime(opt, 0, FALSE);
1918 if (period < 0)
1919 {
1920 *log_msgptr = string_sprintf("bad time value in ACL condition "
1921 "\"verify %s\"", arg);
1922 return ERROR;
1923 }
1924 }
1925
1926 switch(op->value)
1927 {
1928 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1929 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1930 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1931 case CALLOUT_MAILFROM:
1932 if (!verify_header_sender)
1933 {
1934 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1935 "callout option only for verify=header_sender (detected in ACL "
1936 "condition \"%s\")", arg);
1937 return ERROR;
1938 }
1939 se_mailfrom = string_copy(opt);
1940 break;
1941 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1942 case CALLOUT_MAXWAIT: callout_overall = period; break;
1943 case CALLOUT_CONNECT: callout_connect = period; break;
1944 case CALLOUT_TIME: callout = period; break;
1945 }
1946 }
1947 }
1948 else
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1951 "ACL condition \"%s\"", arg);
1952 return ERROR;
1953 }
1954 }
1955 }
1956
1957 /* Option not recognized */
1958
1959 else
1960 {
1961 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1962 "condition \"verify %s\"", ss, arg);
1963 return ERROR;
1964 }
1965 }
1966
1967 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1968 (vopt_callout_recipsender|vopt_callout_recippmaster))
1969 {
1970 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1971 "for a recipient callout";
1972 return ERROR;
1973 }
1974
1975 /* Handle sender-in-header verification. Default the user message to the log
1976 message if giving out verification details. */
1977
1978 if (verify_header_sender)
1979 {
1980 int verrno;
1981
1982 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1983 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1984 &verrno)) != OK)
1985 {
1986 *basic_errno = verrno;
1987 if (smtp_return_error_details)
1988 {
1989 if (!*user_msgptr && *log_msgptr)
1990 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1991 if (rc == DEFER) acl_temp_details = TRUE;
1992 }
1993 }
1994 }
1995
1996 /* Handle a sender address. The default is to verify *the* sender address, but
1997 optionally a different address can be given, for special requirements. If the
1998 address is empty, we are dealing with a bounce message that has no sender, so
1999 we cannot do any checking. If the real sender address gets rewritten during
2000 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2001 during message reception.
2002
2003 A list of verified "sender" addresses is kept to try to avoid doing to much
2004 work repetitively when there are multiple recipients in a message and they all
2005 require sender verification. However, when callouts are involved, it gets too
2006 complicated because different recipients may require different callout options.
2007 Therefore, we always do a full sender verify when any kind of callout is
2008 specified. Caching elsewhere, for instance in the DNS resolver and in the
2009 callout handling, should ensure that this is not terribly inefficient. */
2010
2011 else if (verify_sender_address)
2012 {
2013 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
2014 {
2015 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2016 "sender verify callout";
2017 return ERROR;
2018 }
2019
2020 sender_vaddr = verify_checked_sender(verify_sender_address);
2021 if (sender_vaddr != NULL && /* Previously checked */
2022 callout <= 0) /* No callout needed this time */
2023 {
2024 /* If the "routed" flag is set, it means that routing worked before, so
2025 this check can give OK (the saved return code value, if set, belongs to a
2026 callout that was done previously). If the "routed" flag is not set, routing
2027 must have failed, so we use the saved return code. */
2028
2029 if (testflag(sender_vaddr, af_verify_routed))
2030 rc = OK;
2031 else
2032 {
2033 rc = sender_vaddr->special_action;
2034 *basic_errno = sender_vaddr->basic_errno;
2035 }
2036 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2037 }
2038
2039 /* Do a new verification, and cache the result. The cache is used to avoid
2040 verifying the sender multiple times for multiple RCPTs when callouts are not
2041 specified (see comments above).
2042
2043 The cache is also used on failure to give details in response to the first
2044 RCPT that gets bounced for this reason. However, this can be suppressed by
2045 the no_details option, which sets the flag that says "this detail has already
2046 been sent". The cache normally contains just one address, but there may be
2047 more in esoteric circumstances. */
2048
2049 else
2050 {
2051 BOOL routed = TRUE;
2052 uschar *save_address_data = deliver_address_data;
2053
2054 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2055 #ifdef SUPPORT_I18N
2056 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2057 {
2058 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2059 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2060 }
2061 #endif
2062 if (no_details) setflag(sender_vaddr, af_sverify_told);
2063 if (verify_sender_address[0] != 0)
2064 {
2065 /* If this is the real sender address, save the unrewritten version
2066 for use later in receive. Otherwise, set a flag so that rewriting the
2067 sender in verify_address() does not update sender_address. */
2068
2069 if (verify_sender_address == sender_address)
2070 sender_address_unrewritten = sender_address;
2071 else
2072 verify_options |= vopt_fake_sender;
2073
2074 if (success_on_redirect)
2075 verify_options |= vopt_success_on_redirect;
2076
2077 /* The recipient, qualify, and expn options are never set in
2078 verify_options. */
2079
2080 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2081 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2082
2083 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2084
2085 if (rc != OK)
2086 *basic_errno = sender_vaddr->basic_errno;
2087 else
2088 DEBUG(D_acl)
2089 {
2090 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2091 debug_printf("sender %s verified ok as %s\n",
2092 verify_sender_address, sender_vaddr->address);
2093 else
2094 debug_printf("sender %s verified ok\n",
2095 verify_sender_address);
2096 }
2097 }
2098 else
2099 rc = OK; /* Null sender */
2100
2101 /* Cache the result code */
2102
2103 if (routed) setflag(sender_vaddr, af_verify_routed);
2104 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2105 sender_vaddr->special_action = rc;
2106 sender_vaddr->next = sender_verified_list;
2107 sender_verified_list = sender_vaddr;
2108
2109 /* Restore the recipient address data, which might have been clobbered by
2110 the sender verification. */
2111
2112 deliver_address_data = save_address_data;
2113 }
2114
2115 /* Put the sender address_data value into $sender_address_data */
2116
2117 sender_address_data = sender_vaddr->prop.address_data;
2118 }
2119
2120 /* A recipient address just gets a straightforward verify; again we must handle
2121 the DEFER overrides. */
2122
2123 else
2124 {
2125 address_item addr2;
2126
2127 if (success_on_redirect)
2128 verify_options |= vopt_success_on_redirect;
2129
2130 /* We must use a copy of the address for verification, because it might
2131 get rewritten. */
2132
2133 addr2 = *addr;
2134 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2135 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2136 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2137
2138 *basic_errno = addr2.basic_errno;
2139 *log_msgptr = addr2.message;
2140 *user_msgptr = (addr2.user_message != NULL)?
2141 addr2.user_message : addr2.message;
2142
2143 /* Allow details for temporary error if the address is so flagged. */
2144 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
2145
2146 /* Make $address_data visible */
2147 deliver_address_data = addr2.prop.address_data;
2148 }
2149
2150 /* We have a result from the relevant test. Handle defer overrides first. */
2151
2152 if (rc == DEFER && (defer_ok ||
2153 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2154 {
2155 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2156 defer_ok? "defer_ok" : "callout_defer_ok");
2157 rc = OK;
2158 }
2159
2160 /* If we've failed a sender, set up a recipient message, and point
2161 sender_verified_failed to the address item that actually failed. */
2162
2163 if (rc != OK && verify_sender_address != NULL)
2164 {
2165 if (rc != DEFER)
2166 *log_msgptr = *user_msgptr = US"Sender verify failed";
2167 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2168 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2169 else
2170 {
2171 *log_msgptr = US"Could not complete sender verify callout";
2172 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2173 *log_msgptr;
2174 }
2175
2176 sender_verified_failed = sender_vaddr;
2177 }
2178
2179 /* Verifying an address messes up the values of $domain and $local_part,
2180 so reset them before returning if this is a RCPT ACL. */
2181
2182 if (addr != NULL)
2183 {
2184 deliver_domain = addr->domain;
2185 deliver_localpart = addr->local_part;
2186 }
2187 return rc;
2188
2189 /* Syntax errors in the verify argument come here. */
2190
2191 BAD_VERIFY:
2192 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2193 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2194 "or \"reverse_host_lookup\" at start of ACL condition "
2195 "\"verify %s\"", arg);
2196 return ERROR;
2197 }
2198
2199
2200
2201
2202 /*************************************************
2203 * Check argument for control= modifier *
2204 *************************************************/
2205
2206 /* Called from acl_check_condition() below
2207
2208 Arguments:
2209 arg the argument string for control=
2210 pptr set to point to the terminating character
2211 where which ACL we are in
2212 log_msgptr for error messages
2213
2214 Returns: CONTROL_xxx value
2215 */
2216
2217 static int
2218 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2219 {
2220 int idx, len;
2221 control_def * d;
2222
2223 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2224 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2225 && (!d->has_option || arg[len] != '/')
2226 ) )
2227 {
2228 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2229 return CONTROL_ERROR;
2230 }
2231
2232 *pptr = arg + len;
2233 return idx;
2234 }
2235
2236
2237
2238
2239 /*************************************************
2240 * Return a ratelimit error *
2241 *************************************************/
2242
2243 /* Called from acl_ratelimit() below
2244
2245 Arguments:
2246 log_msgptr for error messages
2247 format format string
2248 ... supplementary arguments
2249 ss ratelimit option name
2250 where ACL_WHERE_xxxx indicating which ACL this is
2251
2252 Returns: ERROR
2253 */
2254
2255 static int
2256 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2257 {
2258 va_list ap;
2259 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2260 va_start(ap, format);
2261 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2262 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2263 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2264 va_end(ap);
2265 *log_msgptr = string_sprintf(
2266 "error in arguments to \"ratelimit\" condition: %s", buffer);
2267 return ERROR;
2268 }
2269
2270
2271
2272
2273 /*************************************************
2274 * Handle rate limiting *
2275 *************************************************/
2276
2277 /* Called by acl_check_condition() below to calculate the result
2278 of the ACL ratelimit condition.
2279
2280 Note that the return value might be slightly unexpected: if the
2281 sender's rate is above the limit then the result is OK. This is
2282 similar to the dnslists condition, and is so that you can write
2283 ACL clauses like: defer ratelimit = 15 / 1h
2284
2285 Arguments:
2286 arg the option string for ratelimit=
2287 where ACL_WHERE_xxxx indicating which ACL this is
2288 log_msgptr for error messages
2289
2290 Returns: OK - Sender's rate is above limit
2291 FAIL - Sender's rate is below limit
2292 DEFER - Problem opening ratelimit database
2293 ERROR - Syntax error in options.
2294 */
2295
2296 static int
2297 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2298 {
2299 double limit, period, count;
2300 uschar *ss;
2301 uschar *key = NULL;
2302 uschar *unique = NULL;
2303 int sep = '/';
2304 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2305 BOOL noupdate = FALSE, badacl = FALSE;
2306 int mode = RATE_PER_WHAT;
2307 int old_pool, rc;
2308 tree_node **anchor, *t;
2309 open_db dbblock, *dbm;
2310 int dbdb_size;
2311 dbdata_ratelimit *dbd;
2312 dbdata_ratelimit_unique *dbdb;
2313 struct timeval tv;
2314
2315 /* Parse the first two options and record their values in expansion
2316 variables. These variables allow the configuration to have informative
2317 error messages based on rate limits obtained from a table lookup. */
2318
2319 /* First is the maximum number of messages per period / maximum burst
2320 size, which must be greater than or equal to zero. Zero is useful for
2321 rate measurement as opposed to rate limiting. */
2322
2323 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2324 if (sender_rate_limit == NULL)
2325 return ratelimit_error(log_msgptr, "sender rate limit not set");
2326
2327 limit = Ustrtod(sender_rate_limit, &ss);
2328 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2329 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2330 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2331
2332 if (limit < 0.0 || *ss != '\0')
2333 return ratelimit_error(log_msgptr,
2334 "\"%s\" is not a positive number", sender_rate_limit);
2335
2336 /* Second is the rate measurement period / exponential smoothing time
2337 constant. This must be strictly greater than zero, because zero leads to
2338 run-time division errors. */
2339
2340 sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2341 if (sender_rate_period == NULL) period = -1.0;
2342 else period = readconf_readtime(sender_rate_period, 0, FALSE);
2343 if (period <= 0.0)
2344 return ratelimit_error(log_msgptr,
2345 "\"%s\" is not a time value", sender_rate_period);
2346
2347 /* By default we are counting one of something, but the per_rcpt,
2348 per_byte, and count options can change this. */
2349
2350 count = 1.0;
2351
2352 /* Parse the other options. */
2353
2354 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2355 != NULL)
2356 {
2357 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2358 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2359 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2360 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2361 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2362 else if (strcmpic(ss, US"per_conn") == 0)
2363 {
2364 RATE_SET(mode, PER_CONN);
2365 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2366 badacl = TRUE;
2367 }
2368 else if (strcmpic(ss, US"per_mail") == 0)
2369 {
2370 RATE_SET(mode, PER_MAIL);
2371 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2372 }
2373 else if (strcmpic(ss, US"per_rcpt") == 0)
2374 {
2375 /* If we are running in the RCPT ACL, then we'll count the recipients
2376 one by one, but if we are running when we have accumulated the whole
2377 list then we'll add them all in one batch. */
2378 if (where == ACL_WHERE_RCPT)
2379 RATE_SET(mode, PER_RCPT);
2380 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2381 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2382 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2383 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2384 }
2385 else if (strcmpic(ss, US"per_byte") == 0)
2386 {
2387 /* If we have not yet received the message data and there was no SIZE
2388 declaration on the MAIL comand, then it's safe to just use a value of
2389 zero and let the recorded rate decay as if nothing happened. */
2390 RATE_SET(mode, PER_MAIL);
2391 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2392 else count = message_size < 0 ? 0.0 : (double)message_size;
2393 }
2394 else if (strcmpic(ss, US"per_addr") == 0)
2395 {
2396 RATE_SET(mode, PER_RCPT);
2397 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2398 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2399 }
2400 else if (strncmpic(ss, US"count=", 6) == 0)
2401 {
2402 uschar *e;
2403 count = Ustrtod(ss+6, &e);
2404 if (count < 0.0 || *e != '\0')
2405 return ratelimit_error(log_msgptr,
2406 "\"%s\" is not a positive number", ss);
2407 }
2408 else if (strncmpic(ss, US"unique=", 7) == 0)
2409 unique = string_copy(ss + 7);
2410 else if (key == NULL)
2411 key = string_copy(ss);
2412 else
2413 key = string_sprintf("%s/%s", key, ss);
2414 }
2415
2416 /* Sanity check. When the badacl flag is set the update mode must either
2417 be readonly (which is the default if it is omitted) or, for backwards
2418 compatibility, a combination of noupdate and strict or leaky. */
2419
2420 if (mode == RATE_PER_CLASH)
2421 return ratelimit_error(log_msgptr, "conflicting per_* options");
2422 if (leaky + strict + readonly > 1)
2423 return ratelimit_error(log_msgptr, "conflicting update modes");
2424 if (badacl && (leaky || strict) && !noupdate)
2425 return ratelimit_error(log_msgptr,
2426 "\"%s\" must not have /leaky or /strict option in %s ACL",
2427 ratelimit_option_string[mode], acl_wherenames[where]);
2428
2429 /* Set the default values of any unset options. In readonly mode we
2430 perform the rate computation without any increment so that its value
2431 decays to eventually allow over-limit senders through. */
2432
2433 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2434 if (badacl) readonly = TRUE;
2435 if (readonly) count = 0.0;
2436 if (!strict && !readonly) leaky = TRUE;
2437 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2438
2439 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2440 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2441 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2442 are added to the key because they alter the meaning of the stored data. */
2443
2444 if (key == NULL)
2445 key = (sender_host_address == NULL)? US"" : sender_host_address;
2446
2447 key = string_sprintf("%s/%s/%s%s",
2448 sender_rate_period,
2449 ratelimit_option_string[mode],
2450 unique == NULL ? "" : "unique/",
2451 key);
2452
2453 HDEBUG(D_acl)
2454 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2455
2456 /* See if we have already computed the rate by looking in the relevant tree.
2457 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2458 pool so that they survive across resets. In readonly mode we only remember the
2459 result for the rest of this command in case a later command changes it. After
2460 this bit of logic the code is independent of the per_* mode. */
2461
2462 old_pool = store_pool;
2463
2464 if (readonly)
2465 anchor = &ratelimiters_cmd;
2466 else switch(mode) {
2467 case RATE_PER_CONN:
2468 anchor = &ratelimiters_conn;
2469 store_pool = POOL_PERM;
2470 break;
2471 case RATE_PER_BYTE:
2472 case RATE_PER_MAIL:
2473 case RATE_PER_ALLRCPTS:
2474 anchor = &ratelimiters_mail;
2475 break;
2476 case RATE_PER_ADDR:
2477 case RATE_PER_CMD:
2478 case RATE_PER_RCPT:
2479 anchor = &ratelimiters_cmd;
2480 break;
2481 default:
2482 anchor = NULL; /* silence an "unused" complaint */
2483 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2484 "internal ACL error: unknown ratelimit mode %d", mode);
2485 break;
2486 }
2487
2488 t = tree_search(*anchor, key);
2489 if (t != NULL)
2490 {
2491 dbd = t->data.ptr;
2492 /* The following few lines duplicate some of the code below. */
2493 rc = (dbd->rate < limit)? FAIL : OK;
2494 store_pool = old_pool;
2495 sender_rate = string_sprintf("%.1f", dbd->rate);
2496 HDEBUG(D_acl)
2497 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2498 return rc;
2499 }
2500
2501 /* We aren't using a pre-computed rate, so get a previously recorded rate
2502 from the database, which will be updated and written back if required. */
2503
2504 dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2505 if (dbm == NULL)
2506 {
2507 store_pool = old_pool;
2508 sender_rate = NULL;
2509 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2510 *log_msgptr = US"ratelimit database not available";
2511 return DEFER;
2512 }
2513 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2514 dbd = NULL;
2515
2516 gettimeofday(&tv, NULL);
2517
2518 if (dbdb != NULL)
2519 {
2520 /* Locate the basic ratelimit block inside the DB data. */
2521 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2522 dbd = &dbdb->dbd;
2523
2524 /* Forget the old Bloom filter if it is too old, so that we count each
2525 repeating event once per period. We don't simply clear and re-use the old
2526 filter because we want its size to change if the limit changes. Note that
2527 we keep the dbd pointer for copying the rate into the new data block. */
2528
2529 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2530 {
2531 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2532 dbdb = NULL;
2533 }
2534
2535 /* Sanity check. */
2536
2537 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2538 {
2539 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2540 dbdb = NULL;
2541 }
2542 }
2543
2544 /* Allocate a new data block if the database lookup failed
2545 or the Bloom filter passed its age limit. */
2546
2547 if (dbdb == NULL)
2548 {
2549 if (unique == NULL)
2550 {
2551 /* No Bloom filter. This basic ratelimit block is initialized below. */
2552 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2553 dbdb_size = sizeof(*dbd);
2554 dbdb = store_get(dbdb_size);
2555 }
2556 else
2557 {
2558 int extra;
2559 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2560
2561 /* See the long comment below for an explanation of the magic number 2.
2562 The filter has a minimum size in case the rate limit is very small;
2563 this is determined by the definition of dbdata_ratelimit_unique. */
2564
2565 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2566 if (extra < 0) extra = 0;
2567 dbdb_size = sizeof(*dbdb) + extra;
2568 dbdb = store_get(dbdb_size);
2569 dbdb->bloom_epoch = tv.tv_sec;
2570 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2571 memset(dbdb->bloom, 0, dbdb->bloom_size);
2572
2573 /* Preserve any basic ratelimit data (which is our longer-term memory)
2574 by copying it from the discarded block. */
2575
2576 if (dbd != NULL)
2577 {
2578 dbdb->dbd = *dbd;
2579 dbd = &dbdb->dbd;
2580 }
2581 }
2582 }
2583
2584 /* If we are counting unique events, find out if this event is new or not.
2585 If the client repeats the event during the current period then it should be
2586 counted. We skip this code in readonly mode for efficiency, because any
2587 changes to the filter will be discarded and because count is already set to
2588 zero. */
2589
2590 if (unique != NULL && !readonly)
2591 {
2592 /* We identify unique events using a Bloom filter. (You can find my
2593 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2594 With the per_addr option, an "event" is a recipient address, though the
2595 user can use the unique option to define their own events. We only count
2596 an event if we have not seen it before.
2597
2598 We size the filter according to the rate limit, which (in leaky mode)
2599 is the limit on the population of the filter. We allow 16 bits of space
2600 per entry (see the construction code above) and we set (up to) 8 of them
2601 when inserting an element (see the loop below). The probability of a false
2602 positive (an event we have not seen before but which we fail to count) is
2603
2604 size = limit * 16
2605 numhash = 8
2606 allzero = exp(-numhash * pop / size)
2607 = exp(-0.5 * pop / limit)
2608 fpr = pow(1 - allzero, numhash)
2609
2610 For senders at the limit the fpr is 0.06% or 1 in 1700
2611 and for senders at half the limit it is 0.0006% or 1 in 170000
2612
2613 In strict mode the Bloom filter can fill up beyond the normal limit, in
2614 which case the false positive rate will rise. This means that the
2615 measured rate for very fast senders can bogusly drop off after a while.
2616
2617 At twice the limit, the fpr is 2.5% or 1 in 40
2618 At four times the limit, it is 31% or 1 in 3.2
2619
2620 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2621 decay below the limit, and if this is more than one then the Bloom filter
2622 will be discarded before the decay gets that far. The false positive rate
2623 at this threshold is 9.3% or 1 in 10.7. */
2624
2625 BOOL seen;
2626 unsigned n, hash, hinc;
2627 uschar md5sum[16];
2628 md5 md5info;
2629
2630 /* Instead of using eight independent hash values, we combine two values
2631 using the formula h1 + n * h2. This does not harm the Bloom filter's
2632 performance, and means the amount of hash we need is independent of the
2633 number of bits we set in the filter. */
2634
2635 md5_start(&md5info);
2636 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2637 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2638 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2639
2640 /* Scan the bits corresponding to this event. A zero bit means we have
2641 not seen it before. Ensure all bits are set to record this event. */
2642
2643 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2644
2645 seen = TRUE;
2646 for (n = 0; n < 8; n++, hash += hinc)
2647 {
2648 int bit = 1 << (hash % 8);
2649 int byte = (hash / 8) % dbdb->bloom_size;
2650 if ((dbdb->bloom[byte] & bit) == 0)
2651 {
2652 dbdb->bloom[byte] |= bit;
2653 seen = FALSE;
2654 }
2655 }
2656
2657 /* If this event has occurred before, do not count it. */
2658
2659 if (seen)
2660 {
2661 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2662 count = 0.0;
2663 }
2664 else
2665 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2666 }
2667
2668 /* If there was no previous ratelimit data block for this key, initialize
2669 the new one, otherwise update the block from the database. The initial rate
2670 is what would be computed by the code below for an infinite interval. */
2671
2672 if (dbd == NULL)
2673 {
2674 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2675 dbd = &dbdb->dbd;
2676 dbd->time_stamp = tv.tv_sec;
2677 dbd->time_usec = tv.tv_usec;
2678 dbd->rate = count;
2679 }
2680 else
2681 {
2682 /* The smoothed rate is computed using an exponentially weighted moving
2683 average adjusted for variable sampling intervals. The standard EWMA for
2684 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2685 where f() is the measured value and f'() is the smoothed value.
2686
2687 Old data decays out of the smoothed value exponentially, such that data n
2688 samples old is multiplied by a^n. The exponential decay time constant p
2689 is defined such that data p samples old is multiplied by 1/e, which means
2690 that a = exp(-1/p). We can maintain the same time constant for a variable
2691 sampling interval i by using a = exp(-i/p).
2692
2693 The rate we are measuring is messages per period, suitable for directly
2694 comparing with the limit. The average rate between now and the previous
2695 message is period / interval, which we feed into the EWMA as the sample.
2696
2697 It turns out that the number of messages required for the smoothed rate
2698 to reach the limit when they are sent in a burst is equal to the limit.
2699 This can be seen by analysing the value of the smoothed rate after N
2700 messages sent at even intervals. Let k = (1 - a) * p/i
2701
2702 rate_1 = (1 - a) * p/i + a * rate_0
2703 = k + a * rate_0
2704 rate_2 = k + a * rate_1
2705 = k + a * k + a^2 * rate_0
2706 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2707 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2708 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2709 = rate_0 * a^N + p/i * (1 - a^N)
2710
2711 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2712
2713 rate_N = p/i + (rate_0 - p/i) * a^N
2714 a^N = (rate_N - p/i) / (rate_0 - p/i)
2715 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2716 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2717
2718 Numerical analysis of the above equation, setting the computed rate to
2719 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2720 rates, p/i, the number of messages N = limit. So limit serves as both the
2721 maximum rate measured in messages per period, and the maximum number of
2722 messages that can be sent in a fast burst. */
2723
2724 double this_time = (double)tv.tv_sec
2725 + (double)tv.tv_usec / 1000000.0;
2726 double prev_time = (double)dbd->time_stamp
2727 + (double)dbd->time_usec / 1000000.0;
2728
2729 /* We must avoid division by zero, and deal gracefully with the clock going
2730 backwards. If we blunder ahead when time is in reverse then the computed
2731 rate will be bogus. To be safe we clamp interval to a very small number. */
2732
2733 double interval = this_time - prev_time <= 0.0 ? 1e-9
2734 : this_time - prev_time;
2735
2736 double i_over_p = interval / period;
2737 double a = exp(-i_over_p);
2738
2739 /* Combine the instantaneous rate (period / interval) with the previous rate
2740 using the smoothing factor a. In order to measure sized events, multiply the
2741 instantaneous rate by the count of bytes or recipients etc. */
2742
2743 dbd->time_stamp = tv.tv_sec;
2744 dbd->time_usec = tv.tv_usec;
2745 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2746
2747 /* When events are very widely spaced the computed rate tends towards zero.
2748 Although this is accurate it turns out not to be useful for our purposes,
2749 especially when the first event after a long silence is the start of a spam
2750 run. A more useful model is that the rate for an isolated event should be the
2751 size of the event per the period size, ignoring the lack of events outside
2752 the current period and regardless of where the event falls in the period. So,
2753 if the interval was so long that the calculated rate is unhelpfully small, we
2754 re-intialize the rate. In the absence of higher-rate bursts, the condition
2755 below is true if the interval is greater than the period. */
2756
2757 if (dbd->rate < count) dbd->rate = count;
2758 }
2759
2760 /* Clients sending at the limit are considered to be over the limit.
2761 This matters for edge cases such as a limit of zero, when the client
2762 should be completely blocked. */
2763
2764 rc = (dbd->rate < limit)? FAIL : OK;
2765
2766 /* Update the state if the rate is low or if we are being strict. If we
2767 are in leaky mode and the sender's rate is too high, we do not update
2768 the recorded rate in order to avoid an over-aggressive sender's retry
2769 rate preventing them from getting any email through. If readonly is set,
2770 neither leaky nor strict are set, so we do not do any updates. */
2771
2772 if ((rc == FAIL && leaky) || strict)
2773 {
2774 dbfn_write(dbm, key, dbdb, dbdb_size);
2775 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2776 }
2777 else
2778 {
2779 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
2780 readonly? "readonly mode" : "over the limit, but leaky");
2781 }
2782
2783 dbfn_close(dbm);
2784
2785 /* Store the result in the tree for future reference. */
2786
2787 t = store_get(sizeof(tree_node) + Ustrlen(key));
2788 t->data.ptr = dbd;
2789 Ustrcpy(t->name, key);
2790 (void)tree_insertnode(anchor, t);
2791
2792 /* We create the formatted version of the sender's rate very late in
2793 order to ensure that it is done using the correct storage pool. */
2794
2795 store_pool = old_pool;
2796 sender_rate = string_sprintf("%.1f", dbd->rate);
2797
2798 HDEBUG(D_acl)
2799 debug_printf("ratelimit computed rate %s\n", sender_rate);
2800
2801 return rc;
2802 }
2803
2804
2805
2806 /*************************************************
2807 * The udpsend ACL modifier *
2808 *************************************************/
2809
2810 /* Called by acl_check_condition() below.
2811
2812 Arguments:
2813 arg the option string for udpsend=
2814 log_msgptr for error messages
2815
2816 Returns: OK - Completed.
2817 DEFER - Problem with DNS lookup.
2818 ERROR - Syntax error in options.
2819 */
2820
2821 static int
2822 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2823 {
2824 int sep = 0;
2825 uschar *hostname;
2826 uschar *portstr;
2827 uschar *portend;
2828 host_item *h;
2829 int portnum;
2830 int len;
2831 int r, s;
2832 uschar * errstr;
2833
2834 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2835 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2836
2837 if (hostname == NULL)
2838 {
2839 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2840 return ERROR;
2841 }
2842 if (portstr == NULL)
2843 {
2844 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2845 return ERROR;
2846 }
2847 if (arg == NULL)
2848 {
2849 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2850 return ERROR;
2851 }
2852 portnum = Ustrtol(portstr, &portend, 10);
2853 if (*portend != '\0')
2854 {
2855 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2856 return ERROR;
2857 }
2858
2859 /* Make a single-item host list. */
2860 h = store_get(sizeof(host_item));
2861 memset(h, 0, sizeof(host_item));
2862 h->name = hostname;
2863 h->port = portnum;
2864 h->mx = MX_NONE;
2865
2866 if (string_is_ip_address(hostname, NULL))
2867 h->address = hostname, r = HOST_FOUND;
2868 else
2869 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2870 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2871 {
2872 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2873 return DEFER;
2874 }
2875
2876 HDEBUG(D_acl)
2877 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2878
2879 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2880 1, NULL, &errstr);
2881 if (r < 0) goto defer;
2882 len = Ustrlen(arg);
2883 r = send(s, arg, len, 0);
2884 if (r < 0)
2885 {
2886 errstr = US strerror(errno);
2887 close(s);
2888 goto defer;
2889 }
2890 close(s);
2891 if (r < len)
2892 {
2893 *log_msgptr =
2894 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2895 return DEFER;
2896 }
2897
2898 HDEBUG(D_acl)
2899 debug_printf("udpsend %d bytes\n", r);
2900
2901 return OK;
2902
2903 defer:
2904 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2905 return DEFER;
2906 }
2907
2908
2909
2910 /*************************************************
2911 * Handle conditions/modifiers on an ACL item *
2912 *************************************************/
2913
2914 /* Called from acl_check() below.
2915
2916 Arguments:
2917 verb ACL verb
2918 cb ACL condition block - if NULL, result is OK
2919 where where called from
2920 addr the address being checked for RCPT, or NULL
2921 level the nesting level
2922 epp pointer to pass back TRUE if "endpass" encountered
2923 (applies only to "accept" and "discard")
2924 user_msgptr user message pointer
2925 log_msgptr log message pointer
2926 basic_errno pointer to where to put verify error
2927
2928 Returns: OK - all conditions are met
2929 DISCARD - an "acl" condition returned DISCARD - only allowed
2930 for "accept" or "discard" verbs
2931 FAIL - at least one condition fails
2932 FAIL_DROP - an "acl" condition returned FAIL_DROP
2933 DEFER - can't tell at the moment (typically, lookup defer,
2934 but can be temporary callout problem)
2935 ERROR - ERROR from nested ACL or expansion failure or other
2936 error
2937 */
2938
2939 static int
2940 acl_check_condition(int verb, acl_condition_block *cb, int where,
2941 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2942 uschar **log_msgptr, int *basic_errno)
2943 {
2944 uschar *user_message = NULL;
2945 uschar *log_message = NULL;
2946 int rc = OK;
2947 #ifdef WITH_CONTENT_SCAN
2948 int sep = -'/';
2949 #endif
2950
2951 for (; cb != NULL; cb = cb->next)
2952 {
2953 const uschar *arg;
2954 int control_type;
2955
2956 /* The message and log_message items set up messages to be used in
2957 case of rejection. They are expanded later. */
2958
2959 if (cb->type == ACLC_MESSAGE)
2960 {
2961 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
2962 user_message = cb->arg;
2963 continue;
2964 }
2965
2966 if (cb->type == ACLC_LOG_MESSAGE)
2967 {
2968 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
2969 log_message = cb->arg;
2970 continue;
2971 }
2972
2973 /* The endpass "condition" just sets a flag to show it occurred. This is
2974 checked at compile time to be on an "accept" or "discard" item. */
2975
2976 if (cb->type == ACLC_ENDPASS)
2977 {
2978 *epp = TRUE;
2979 continue;
2980 }
2981
2982 /* For other conditions and modifiers, the argument is expanded now for some
2983 of them, but not for all, because expansion happens down in some lower level
2984 checking functions in some cases. */
2985
2986 if (cond_expand_at_top[cb->type])
2987 {
2988 arg = expand_string(cb->arg);
2989 if (arg == NULL)
2990 {
2991 if (expand_string_forcedfail) continue;
2992 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2993 cb->arg, expand_string_message);
2994 return search_find_defer? DEFER : ERROR;
2995 }
2996 }
2997 else arg = cb->arg;
2998
2999 /* Show condition, and expanded condition if it's different */
3000
3001 HDEBUG(D_acl)
3002 {
3003 int lhswidth = 0;
3004 debug_printf("check %s%s %n",
3005 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3006 conditions[cb->type], &lhswidth);
3007
3008 if (cb->type == ACLC_SET)
3009 {
3010 debug_printf("acl_%s ", cb->u.varname);
3011 lhswidth += 5 + Ustrlen(cb->u.varname);
3012 }
3013
3014 debug_printf("= %s\n", cb->arg);
3015
3016 if (arg != cb->arg)
3017 debug_printf("%.*s= %s\n", lhswidth,
3018 US" ", CS arg);
3019 }
3020
3021 /* Check that this condition makes sense at this time */
3022
3023 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3024 {
3025 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3026 cond_modifiers[cb->type]? "use" : "test",
3027 conditions[cb->type], acl_wherenames[where]);
3028 return ERROR;
3029 }
3030
3031 /* Run the appropriate test for each condition, or take the appropriate
3032 action for the remaining modifiers. */
3033
3034 switch(cb->type)
3035 {
3036 case ACLC_ADD_HEADER:
3037 setup_header(arg);
3038 break;
3039
3040 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3041 "discard" verb. */
3042
3043 case ACLC_ACL:
3044 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
3045 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3046 {
3047 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3048 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3049 verbs[verb]);
3050 return ERROR;
3051 }
3052 break;
3053
3054 case ACLC_AUTHENTICATED:
3055 rc = (sender_host_authenticated == NULL)? FAIL :
3056 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3057 TRUE, NULL);
3058 break;
3059
3060 #ifdef EXPERIMENTAL_BRIGHTMAIL
3061 case ACLC_BMI_OPTIN:
3062 {
3063 int old_pool = store_pool;
3064 store_pool = POOL_PERM;
3065 bmi_current_optin = string_copy(arg);
3066 store_pool = old_pool;
3067 }
3068 break;
3069 #endif
3070
3071 case ACLC_CONDITION:
3072 /* The true/false parsing here should be kept in sync with that used in
3073 expand.c when dealing with ECOND_BOOL so that we don't have too many
3074 different definitions of what can be a boolean. */
3075 if (*arg == '-'
3076 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3077 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3078 rc = (Uatoi(arg) == 0)? FAIL : OK;
3079 else
3080 rc = (strcmpic(arg, US"no") == 0 ||
3081 strcmpic(arg, US"false") == 0)? FAIL :
3082 (strcmpic(arg, US"yes") == 0 ||
3083 strcmpic(arg, US"true") == 0)? OK : DEFER;
3084 if (rc == DEFER)
3085 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3086 break;
3087
3088 case ACLC_CONTINUE: /* Always succeeds */
3089 break;
3090
3091 case ACLC_CONTROL:
3092 {
3093 const uschar *p = NULL;
3094 control_type = decode_control(arg, &p, where, log_msgptr);
3095
3096 /* Check if this control makes sense at this time */
3097
3098 if (controls_list[control_type].forbids & (1 << where))
3099 {
3100 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3101 controls_list[control_type].name, acl_wherenames[where]);
3102 return ERROR;
3103 }
3104
3105 switch(control_type)
3106 {
3107 case CONTROL_AUTH_UNADVERTISED:
3108 allow_auth_unadvertised = TRUE;
3109 break;
3110
3111 #ifdef EXPERIMENTAL_BRIGHTMAIL
3112 case CONTROL_BMI_RUN:
3113 bmi_run = 1;
3114 break;
3115 #endif
3116
3117 #ifndef DISABLE_DKIM
3118 case CONTROL_DKIM_VERIFY:
3119 dkim_disable_verify = TRUE;
3120 #ifdef EXPERIMENTAL_DMARC
3121 /* Since DKIM was blocked, skip DMARC too */
3122 dmarc_disable_verify = TRUE;
3123 dmarc_enable_forensic = FALSE;
3124 #endif
3125 break;
3126 #endif
3127
3128 #ifdef EXPERIMENTAL_DMARC
3129 case CONTROL_DMARC_VERIFY:
3130 dmarc_disable_verify = TRUE;
3131 break;
3132
3133 case CONTROL_DMARC_FORENSIC:
3134 dmarc_enable_forensic = TRUE;
3135 break;
3136 #endif
3137
3138 case CONTROL_DSCP:
3139 if (*p == '/')
3140 {
3141 int fd, af, level, optname, value;
3142 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3143 a socket; we can accept that, we'll just debug-log failures anyway. */
3144 fd = fileno(smtp_in);
3145 af = ip_get_address_family(fd);
3146 if (af < 0)
3147 {
3148 HDEBUG(D_acl)
3149 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3150 strerror(errno));
3151 break;
3152 }
3153 if (dscp_lookup(p+1, af, &level, &optname, &value))
3154 {
3155 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3156 {
3157 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3158 p+1, strerror(errno));
3159 }
3160 else
3161 {
3162 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3163 }
3164 }
3165 else
3166 {
3167 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3168 return ERROR;
3169 }
3170 }
3171 else
3172 {
3173 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3174 return ERROR;
3175 }
3176 break;
3177
3178 case CONTROL_ERROR:
3179 return ERROR;
3180
3181 case CONTROL_CASEFUL_LOCAL_PART:
3182 deliver_localpart = addr->cc_local_part;
3183 break;
3184
3185 case CONTROL_CASELOWER_LOCAL_PART:
3186 deliver_localpart = addr->lc_local_part;
3187 break;
3188
3189 case CONTROL_ENFORCE_SYNC:
3190 smtp_enforce_sync = TRUE;
3191 break;
3192
3193 case CONTROL_NO_ENFORCE_SYNC:
3194 smtp_enforce_sync = FALSE;
3195 break;
3196
3197 #ifdef WITH_CONTENT_SCAN
3198 case CONTROL_NO_MBOX_UNSPOOL:
3199 no_mbox_unspool = TRUE;
3200 break;
3201 #endif
3202
3203 case CONTROL_NO_MULTILINE:
3204 no_multiline_responses = TRUE;
3205 break;
3206
3207 case CONTROL_NO_PIPELINING:
3208 pipelining_enable = FALSE;
3209 break;
3210
3211 case CONTROL_NO_DELAY_FLUSH:
3212 disable_delay_flush = TRUE;
3213 break;
3214
3215 case CONTROL_NO_CALLOUT_FLUSH:
3216 disable_callout_flush = TRUE;
3217 break;
3218
3219 case CONTROL_FAKEREJECT:
3220 cancel_cutthrough_connection("fakereject");
3221 case CONTROL_FAKEDEFER:
3222 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3223 if (*p == '/')
3224 {
3225 const uschar *pp = p + 1;
3226 while (*pp != 0) pp++;
3227 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3228 p = pp;
3229 }
3230 else
3231 {
3232 /* Explicitly reset to default string */
3233 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3234 }
3235 break;
3236
3237 case CONTROL_FREEZE:
3238 deliver_freeze = TRUE;
3239 deliver_frozen_at = time(NULL);
3240 freeze_tell = freeze_tell_config; /* Reset to configured value */
3241 if (Ustrncmp(p, "/no_tell", 8) == 0)
3242 {
3243 p += 8;
3244 freeze_tell = NULL;
3245 }
3246 if (*p != 0)
3247 {
3248 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3249 return ERROR;
3250 }
3251 cancel_cutthrough_connection("item frozen");
3252 break;
3253
3254 case CONTROL_QUEUE_ONLY:
3255 queue_only_policy = TRUE;
3256 cancel_cutthrough_connection("queueing forced");
3257 break;
3258
3259 case CONTROL_SUBMISSION:
3260 originator_name = US"";
3261 submission_mode = TRUE;
3262 while (*p == '/')
3263 {
3264 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3265 {
3266 p += 14;
3267 active_local_sender_retain = TRUE;
3268 active_local_from_check = FALSE;
3269 }
3270 else if (Ustrncmp(p, "/domain=", 8) == 0)
3271 {
3272 const uschar *pp = p + 8;
3273 while (*pp != 0 && *pp != '/') pp++;
3274 submission_domain = string_copyn(p+8, pp-p-8);
3275 p = pp;
3276 }
3277 /* The name= option must be last, because it swallows the rest of
3278 the string. */
3279 else if (Ustrncmp(p, "/name=", 6) == 0)
3280 {
3281 const uschar *pp = p + 6;
3282 while (*pp != 0) pp++;
3283 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3284 big_buffer, big_buffer_size));
3285 p = pp;
3286 }
3287 else break;
3288 }
3289 if (*p != 0)
3290 {
3291 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3292 return ERROR;
3293 }
3294 break;
3295
3296 case CONTROL_DEBUG:
3297 {
3298 uschar * debug_tag = NULL;
3299 uschar * debug_opts = NULL;
3300 BOOL kill = FALSE;
3301
3302 while (*p == '/')
3303 {
3304 const uschar * pp = p+1;
3305 if (Ustrncmp(pp, "tag=", 4) == 0)
3306 {
3307 for (pp += 4; *pp && *pp != '/';) pp++;
3308 debug_tag = string_copyn(p+5, pp-p-5);
3309 }
3310 else if (Ustrncmp(pp, "opts=", 5) == 0)
3311 {
3312 for (pp += 5; *pp && *pp != '/';) pp++;
3313 debug_opts = string_copyn(p+6, pp-p-6);
3314 }
3315 else if (Ustrncmp(pp, "kill", 4) == 0)
3316 {
3317 for (pp += 4; *pp && *pp != '/';) pp++;
3318 kill = TRUE;
3319 }
3320 else
3321 while (*pp && *pp != '/') pp++;
3322 p = pp;
3323 }
3324
3325 if (kill)
3326 debug_logging_stop();
3327 else
3328 debug_logging_activate(debug_tag, debug_opts);
3329 }
3330 break;
3331
3332 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3333 suppress_local_fixups = TRUE;
3334 break;
3335
3336 case CONTROL_CUTTHROUGH_DELIVERY:
3337 #ifndef DISABLE_PRDR
3338 if (prdr_requested)
3339 #else
3340 if (0)
3341 #endif
3342 /* Too hard to think about for now. We might in future cutthrough
3343 the case where both sides handle prdr and this-node prdr acl
3344 is "accept" */
3345 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
3346 else
3347 {
3348 if (deliver_freeze)
3349 *log_msgptr = US"frozen";
3350 else if (queue_only_policy)
3351 *log_msgptr = US"queue-only";
3352 else if (fake_response == FAIL)
3353 *log_msgptr = US"fakereject";
3354 else
3355 {
3356 if (rcpt_count == 1)
3357 {
3358 cutthrough.delivery = TRUE;
3359 while (*p == '/')
3360 {
3361 const uschar * pp = p+1;
3362 if (Ustrncmp(pp, "defer=", 6) == 0)
3363 {
3364 pp += 6;
3365 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3366 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3367 }
3368 else
3369 while (*pp && *pp != '/') pp++;
3370 p = pp;
3371 }
3372 }
3373 break;
3374 }
3375 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3376 arg, *log_msgptr);
3377 }
3378 return ERROR;
3379
3380 #ifdef SUPPORT_I18N
3381 case CONTROL_UTF8_DOWNCONVERT:
3382 if (*p == '/')
3383 {
3384 if (p[1] == '1')
3385 {
3386 message_utf8_downconvert = 1;
3387 addr->prop.utf8_downcvt = TRUE;
3388 addr->prop.utf8_downcvt_maybe = FALSE;
3389 p += 2;
3390 break;
3391 }
3392 if (p[1] == '0')
3393 {
3394 message_utf8_downconvert = 0;
3395 addr->prop.utf8_downcvt = FALSE;
3396 addr->prop.utf8_downcvt_maybe = FALSE;
3397 p += 2;
3398 break;
3399 }
3400 if (p[1] == '-' && p[2] == '1')
3401 {
3402 message_utf8_downconvert = -1;
3403 addr->prop.utf8_downcvt = FALSE;
3404 addr->prop.utf8_downcvt_maybe = TRUE;
3405 p += 3;
3406 break;
3407 }
3408 *log_msgptr = US"bad option value for control=utf8_downconvert";
3409 }
3410 else
3411 {
3412 message_utf8_downconvert = 1;
3413 addr->prop.utf8_downcvt = TRUE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 break;
3416 }
3417 return ERROR;
3418 #endif
3419
3420 }
3421 break;
3422 }
3423
3424 #ifdef EXPERIMENTAL_DCC
3425 case ACLC_DCC:
3426 {
3427 /* Seperate the regular expression and any optional parameters. */
3428 const uschar * list = arg;
3429 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3430 /* Run the dcc backend. */
3431 rc = dcc_process(&ss);
3432 /* Modify return code based upon the existance of options. */
3433 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3434 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3435 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3436 }
3437 break;
3438 #endif
3439
3440 #ifdef WITH_CONTENT_SCAN
3441 case ACLC_DECODE:
3442 rc = mime_decode(&arg);
3443 break;
3444 #endif
3445
3446 case ACLC_DELAY:
3447 {
3448 int delay = readconf_readtime(arg, 0, FALSE);
3449 if (delay < 0)
3450 {
3451 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3452 "modifier: \"%s\" is not a time value", arg);
3453 return ERROR;
3454 }
3455 else
3456 {
3457 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3458 delay);
3459 if (host_checking)
3460 {
3461 HDEBUG(D_acl)
3462 debug_printf("delay skipped in -bh checking mode\n");
3463 }
3464
3465 /* NOTE 1: Remember that we may be
3466 dealing with stdin/stdout here, in addition to TCP/IP connections.
3467 Also, delays may be specified for non-SMTP input, where smtp_out and
3468 smtp_in will be NULL. Whatever is done must work in all cases.
3469
3470 NOTE 2: The added feature of flushing the output before a delay must
3471 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3472 */
3473
3474 else
3475 {
3476 if (smtp_out != NULL && !disable_delay_flush)
3477 mac_smtp_fflush();
3478
3479 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3480 {
3481 struct pollfd p;
3482 nfds_t n = 0;
3483 if (smtp_out)
3484 {
3485 p.fd = fileno(smtp_out);
3486 p.events = POLLRDHUP;
3487 n = 1;
3488 }
3489 if (poll(&p, n, delay*1000) > 0)
3490 HDEBUG(D_acl) debug_printf("delay cancelled by peer close\n");
3491 }
3492 #else
3493 /* It appears to be impossible to detect that a TCP/IP connection has
3494 gone away without reading from it. This means that we cannot shorten
3495 the delay below if the client goes away, because we cannot discover
3496 that the client has closed its end of the connection. (The connection
3497 is actually in a half-closed state, waiting for the server to close its
3498 end.) It would be nice to be able to detect this state, so that the
3499 Exim process is not held up unnecessarily. However, it seems that we
3500 can't. The poll() function does not do the right thing, and in any case
3501 it is not always available.
3502 */
3503
3504 while (delay > 0) delay = sleep(delay);
3505 #endif
3506 }
3507 }
3508 }
3509 break;
3510
3511 #ifndef DISABLE_DKIM
3512 case ACLC_DKIM_SIGNER:
3513 if (dkim_cur_signer != NULL)
3514 rc = match_isinlist(dkim_cur_signer,
3515 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3516 else
3517 rc = FAIL;
3518 break;
3519
3520 case ACLC_DKIM_STATUS:
3521 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3522 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3523 break;
3524 #endif
3525
3526 #ifdef EXPERIMENTAL_DMARC
3527 case ACLC_DMARC_STATUS:
3528 if (!dmarc_has_been_checked)
3529 dmarc_process();
3530 dmarc_has_been_checked = TRUE;
3531 /* used long way of dmarc_exim_expand_query() in case we need more
3532 * view into the process in the future. */
3533 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3534 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3535 break;
3536 #endif
3537
3538 case ACLC_DNSLISTS:
3539 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3540 break;
3541
3542 case ACLC_DOMAINS:
3543 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3544 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3545 break;
3546
3547 /* The value in tls_cipher is the full cipher name, for example,
3548 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3549 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3550 what may in practice come out of the SSL library - which at the time of
3551 writing is poorly documented. */
3552
3553 case ACLC_ENCRYPTED:
3554 if (tls_in.cipher == NULL) rc = FAIL; else
3555 {
3556 uschar *endcipher = NULL;
3557 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3558 if (cipher == NULL) cipher = tls_in.cipher; else
3559 {
3560 endcipher = Ustrchr(++cipher, ':');
3561 if (endcipher != NULL) *endcipher = 0;
3562 }
3563 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3564 if (endcipher != NULL) *endcipher = ':';
3565 }
3566 break;
3567
3568 /* Use verify_check_this_host() instead of verify_check_host() so that
3569 we can pass over &host_data to catch any looked up data. Once it has been
3570 set, it retains its value so that it's still there if another ACL verb
3571 comes through here and uses the cache. However, we must put it into
3572 permanent store in case it is also expected to be used in a subsequent
3573 message in the same SMTP connection. */
3574
3575 case ACLC_HOSTS:
3576 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3577 (sender_host_address == NULL)? US"" : sender_host_address,
3578 CUSS &host_data);
3579 if (rc == DEFER) *log_msgptr = search_error_message;
3580 if (host_data) host_data = string_copy_malloc(host_data);
3581 break;
3582
3583 case ACLC_LOCAL_PARTS:
3584 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3585 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3586 CUSS &deliver_localpart_data);
3587 break;
3588
3589 case ACLC_LOG_REJECT_TARGET:
3590 {
3591 int logbits = 0;
3592 int sep = 0;
3593 const uschar *s = arg;
3594 uschar *ss;
3595 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
3596 {
3597 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3598 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3599 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3600 else
3601 {
3602 logbits |= LOG_MAIN|LOG_REJECT;
3603 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3604 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3605 }
3606 }
3607 log_reject_target = logbits;
3608 }
3609 break;
3610
3611 case ACLC_LOGWRITE:
3612 {
3613 int logbits = 0;
3614 const uschar *s = arg;
3615 if (*s == ':')
3616 {
3617 s++;
3618 while (*s != ':')
3619 {
3620 if (Ustrncmp(s, "main", 4) == 0)
3621 { logbits |= LOG_MAIN; s += 4; }
3622 else if (Ustrncmp(s, "panic", 5) == 0)
3623 { logbits |= LOG_PANIC; s += 5; }
3624 else if (Ustrncmp(s, "reject", 6) == 0)
3625 { logbits |= LOG_REJECT; s += 6; }
3626 else
3627 {
3628 logbits = LOG_MAIN|LOG_PANIC;
3629 s = string_sprintf(":unknown log name in \"%s\" in "
3630 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3631 }
3632 if (*s == ',') s++;
3633 }
3634 s++;
3635 }
3636 while (isspace(*s)) s++;
3637
3638
3639 if (logbits == 0) logbits = LOG_MAIN;
3640 log_write(0, logbits, "%s", string_printing(s));
3641 }
3642 break;
3643
3644 #ifdef WITH_CONTENT_SCAN
3645 case ACLC_MALWARE: /* Run the malware backend. */
3646 {
3647 /* Separate the regular expression and any optional parameters. */
3648 const uschar * list = arg;
3649 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3650 uschar *opt;
3651 BOOL defer_ok = FALSE;
3652 int timeout = 0;
3653
3654 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3655 if (strcmpic(opt, US"defer_ok") == 0)
3656 defer_ok = TRUE;
3657 else if ( strncmpic(opt, US"tmo=", 4) == 0
3658 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3659 )
3660 {
3661 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3662 return ERROR;
3663 }
3664
3665 rc = malware(ss, timeout);
3666 if (rc == DEFER && defer_ok)
3667 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3668 }
3669 break;
3670
3671 case ACLC_MIME_REGEX:
3672 rc = mime_regex(&arg);
3673 break;
3674 #endif
3675
3676 case ACLC_QUEUE:
3677 queue_name = string_copy_malloc(arg);
3678 break;
3679
3680 case ACLC_RATELIMIT:
3681 rc = acl_ratelimit(arg, where, log_msgptr);
3682 break;
3683
3684 case ACLC_RECIPIENTS:
3685 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3686 CUSS &recipient_data);
3687 break;
3688
3689 #ifdef WITH_CONTENT_SCAN
3690 case ACLC_REGEX:
3691 rc = regex(&arg);
3692 break;
3693 #endif
3694
3695 case ACLC_REMOVE_HEADER:
3696 setup_remove_header(arg);
3697 break;
3698
3699 case ACLC_SENDER_DOMAINS:
3700 {
3701 uschar *sdomain;
3702 sdomain = Ustrrchr(sender_address, '@');
3703 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3704 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3705 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3706 }
3707 break;
3708
3709 case ACLC_SENDERS:
3710 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3711 sender_address_cache, -1, 0, CUSS &sender_data);
3712 break;
3713
3714 /* Connection variables must persist forever */
3715
3716 case ACLC_SET:
3717 {
3718 int old_pool = store_pool;
3719 if ( cb->u.varname[0] == 'c'
3720 #ifndef DISABLE_EVENT
3721 || event_name /* An event is being delivered */
3722 #endif
3723 )
3724 store_pool = POOL_PERM;
3725 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3726 store_pool = old_pool;
3727 }
3728 break;
3729
3730 #ifdef WITH_CONTENT_SCAN
3731 case ACLC_SPAM:
3732 {
3733 /* Seperate the regular expression and any optional parameters. */
3734 const uschar * list = arg;
3735 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3736 /* Run the spam backend. */
3737 rc = spam(CUSS &ss);
3738 /* Modify return code based upon the existance of options. */
3739 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
3740 != NULL) {
3741 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3742 {
3743 /* FAIL so that the message is passed to the next ACL */
3744 rc = FAIL;
3745 }
3746 }
3747 }
3748 break;
3749 #endif
3750
3751 #ifdef EXPERIMENTAL_SPF
3752 case ACLC_SPF:
3753 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3754 break;
3755 case ACLC_SPF_GUESS:
3756 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3757 break;
3758 #endif
3759
3760 case ACLC_UDPSEND:
3761 rc = acl_udpsend(arg, log_msgptr);
3762 break;
3763
3764 /* If the verb is WARN, discard any user message from verification, because
3765 such messages are SMTP responses, not header additions. The latter come
3766 only from explicit "message" modifiers. However, put the user message into
3767 $acl_verify_message so it can be used in subsequent conditions or modifiers
3768 (until something changes it). */
3769
3770 case ACLC_VERIFY:
3771 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3772 if (*user_msgptr)
3773 acl_verify_message = *user_msgptr;
3774 if (verb == ACL_WARN) *user_msgptr = NULL;
3775 break;
3776
3777 default:
3778 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3779 "condition %d", cb->type);
3780 break;
3781 }
3782
3783 /* If a condition was negated, invert OK/FAIL. */
3784
3785 if (!cond_modifiers[cb->type] && cb->u.negated)
3786 {
3787 if (rc == OK) rc = FAIL;
3788 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3789 }
3790
3791 if (rc != OK) break; /* Conditions loop */
3792 }
3793
3794
3795 /* If the result is the one for which "message" and/or "log_message" are used,
3796 handle the values of these modifiers. If there isn't a log message set, we make
3797 it the same as the user message.
3798
3799 "message" is a user message that will be included in an SMTP response. Unless
3800 it is empty, it overrides any previously set user message.
3801
3802 "log_message" is a non-user message, and it adds to any existing non-user
3803 message that is already set.
3804
3805 Most verbs have but a single return for which the messages are relevant, but
3806 for "discard", it's useful to have the log message both when it succeeds and
3807 when it fails. For "accept", the message is used in the OK case if there is no
3808 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3809 present. */
3810
3811 if (*epp && rc == OK) user_message = NULL;
3812
3813 if (((1<<rc) & msgcond[verb]) != 0)
3814 {
3815 uschar *expmessage;
3816 uschar *old_user_msgptr = *user_msgptr;
3817 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3818
3819 /* If the verb is "warn", messages generated by conditions (verification or
3820 nested ACLs) are always discarded. This also happens for acceptance verbs
3821 when they actually do accept. Only messages specified at this level are used.
3822 However, the value of an existing message is available in $acl_verify_message
3823 during expansions. */
3824
3825 if (verb == ACL_WARN ||
3826 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3827 *log_msgptr = *user_msgptr = NULL;
3828
3829 if (user_message != NULL)
3830 {
3831 acl_verify_message = old_user_msgptr;
3832 expmessage = expand_string(user_message);
3833 if (expmessage == NULL)
3834 {
3835 if (!expand_string_forcedfail)
3836 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3837 user_message, expand_string_message);
3838 }
3839 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3840 }
3841
3842 if (log_message != NULL)
3843 {
3844 acl_verify_message = old_log_msgptr;
3845 expmessage = expand_string(log_message);
3846 if (expmessage == NULL)
3847 {
3848 if (!expand_string_forcedfail)
3849 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3850 log_message, expand_string_message);
3851 }
3852 else if (expmessage[0] != 0)
3853 {
3854 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3855 string_sprintf("%s: %s", expmessage, *log_msgptr);
3856 }
3857 }
3858
3859 /* If no log message, default it to the user message */
3860
3861 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3862 }
3863
3864 acl_verify_message = NULL;
3865 return rc;
3866 }
3867
3868
3869
3870
3871
3872 /*************************************************
3873 * Get line from a literal ACL *
3874 *************************************************/
3875
3876 /* This function is passed to acl_read() in order to extract individual lines
3877 of a literal ACL, which we access via static pointers. We can destroy the
3878 contents because this is called only once (the compiled ACL is remembered).
3879
3880 This code is intended to treat the data in the same way as lines in the main
3881 Exim configuration file. That is:
3882
3883 . Leading spaces are ignored.
3884
3885 . A \ at the end of a line is a continuation - trailing spaces after the \
3886 are permitted (this is because I don't believe in making invisible things
3887 significant). Leading spaces on the continued part of a line are ignored.
3888
3889 . Physical lines starting (significantly) with # are totally ignored, and
3890 may appear within a sequence of backslash-continued lines.
3891
3892 . Blank lines are ignored, but will end a sequence of continuations.
3893
3894 Arguments: none
3895 Returns: a pointer to the next line
3896 */
3897
3898
3899 static uschar *acl_text; /* Current pointer in the text */
3900 static uschar *acl_text_end; /* Points one past the terminating '0' */
3901
3902
3903 static uschar *
3904 acl_getline(void)
3905 {
3906 uschar *yield;
3907
3908 /* This loop handles leading blank lines and comments. */
3909
3910 for(;;)
3911 {
3912 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3913 if (*acl_text == 0) return NULL; /* No more data */
3914 yield = acl_text; /* Potential data line */
3915
3916 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3917
3918 /* If we hit the end before a newline, we have the whole logical line. If
3919 it's a comment, there's no more data to be given. Otherwise, yield it. */
3920
3921 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3922
3923 /* After reaching a newline, end this loop if the physical line does not
3924 start with '#'. If it does, it's a comment, and the loop continues. */
3925
3926 if (*yield != '#') break;
3927 }
3928
3929 /* This loop handles continuations. We know we have some real data, ending in
3930 newline. See if there is a continuation marker at the end (ignoring trailing
3931 white space). We know that *yield is not white space, so no need to test for
3932 cont > yield in the backwards scanning loop. */
3933
3934 for(;;)
3935 {
3936 uschar *cont;
3937 for (cont = acl_text - 1; isspace(*cont); cont--);
3938
3939 /* If no continuation follows, we are done. Mark the end of the line and
3940 return it. */
3941
3942 if (*cont != '\\')
3943 {
3944 *acl_text++ = 0;
3945 return yield;
3946 }
3947
3948 /* We have encountered a continuation. Skip over whitespace at the start of
3949 the next line, and indeed the whole of the next line or lines if they are
3950 comment lines. */
3951
3952 for (;;)
3953 {
3954 while (*(++acl_text) == ' ' || *acl_text == '\t');
3955 if (*acl_text != '#') break;
3956 while (*(++acl_text) != 0 && *acl_text != '\n');
3957 }
3958
3959 /* We have the start of a continuation line. Move all the rest of the data
3960 to join onto the previous line, and then find its end. If the end is not a
3961 newline, we are done. Otherwise loop to look for another continuation. */
3962
3963 memmove(cont, acl_text, acl_text_end - acl_text);
3964 acl_text_end -= acl_text - cont;
3965 acl_text = cont;
3966 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3967 if (*acl_text == 0) return yield;
3968 }
3969
3970 /* Control does not reach here */
3971 }
3972
3973
3974
3975
3976
3977 /*************************************************
3978 * Check access using an ACL *
3979 *************************************************/
3980
3981 /* This function is called from address_check. It may recurse via
3982 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3983 passed as a string which is expanded. A forced failure implies no access check
3984 is required. If the result is a single word, it is taken as the name of an ACL
3985 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3986 text, complete with newlines, and parsed as such. In both cases, the ACL check
3987 is then run. This function uses an auxiliary function for acl_read() to call
3988 for reading individual lines of a literal ACL. This is acl_getline(), which
3989 appears immediately above.
3990
3991 Arguments:
3992 where where called from
3993 addr address item when called from RCPT; otherwise NULL
3994 s the input string; NULL is the same as an empty ACL => DENY
3995 level the nesting level
3996 user_msgptr where to put a user error (for SMTP response)
3997 log_msgptr where to put a logging message (not for SMTP response)
3998
3999 Returns: OK access is granted
4000 DISCARD access is apparently granted...
4001 FAIL access is denied
4002 FAIL_DROP access is denied; drop the connection
4003 DEFER can't tell at the moment
4004 ERROR disaster
4005 */
4006
4007 static int
4008 acl_check_internal(int where, address_item *addr, uschar *s, int level,
4009 uschar **user_msgptr, uschar **log_msgptr)
4010 {
4011 int fd = -1;
4012 acl_block *acl = NULL;
4013 uschar *acl_name = US"inline ACL";
4014 uschar *ss;
4015
4016 /* Catch configuration loops */
4017
4018 if (level > 20)
4019 {
4020 *log_msgptr = US"ACL nested too deep: possible loop";
4021 return ERROR;
4022 }
4023
4024 if (s == NULL)
4025 {
4026 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4027 return FAIL;
4028 }
4029
4030 /* At top level, we expand the incoming string. At lower levels, it has already
4031 been expanded as part of condition processing. */
4032
4033 if (level == 0)
4034 {
4035 ss = expand_string(s);
4036 if (ss == NULL)
4037 {
4038 if (expand_string_forcedfail) return OK;
4039 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4040 expand_string_message);
4041 return ERROR;
4042 }
4043 }
4044 else ss = s;
4045
4046 while (isspace(*ss))ss++;
4047
4048 /* If we can't find a named ACL, the default is to parse it as an inline one.
4049 (Unless it begins with a slash; non-existent files give rise to an error.) */
4050
4051 acl_text = ss;
4052
4053 /* Handle the case of a string that does not contain any spaces. Look for a
4054 named ACL among those read from the configuration, or a previously read file.
4055 It is possible that the pointer to the ACL is NULL if the configuration
4056 contains a name with no data. If not found, and the text begins with '/',
4057 read an ACL from a file, and save it so it can be re-used. */
4058
4059 if (Ustrchr(ss, ' ') == NULL)
4060 {
4061 tree_node *t = tree_search(acl_anchor, ss);
4062 if (t != NULL)
4063 {
4064 acl = (acl_block *)(t->data.ptr);
4065 if (acl == NULL)
4066 {
4067 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4068 return FAIL;
4069 }
4070 acl_name = string_sprintf("ACL \"%s\"", ss);
4071 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4072 }
4073
4074 else if (*ss == '/')
4075 {
4076 struct stat statbuf;
4077 fd = Uopen(ss, O_RDONLY, 0);
4078 if (fd < 0)
4079 {
4080 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4081 strerror(errno));
4082 return ERROR;
4083 }
4084
4085 if (fstat(fd, &statbuf) != 0)
4086 {
4087 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4088 strerror(errno));
4089 return ERROR;
4090 }
4091
4092 acl_text = store_get(statbuf.st_size + 1);
4093 acl_text_end = acl_text + statbuf.st_size + 1;
4094
4095 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4096 {
4097 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4098 ss, strerror(errno));
4099 return ERROR;
4100 }
4101 acl_text[statbuf.st_size] = 0;
4102 (void)close(fd);
4103
4104 acl_name = string_sprintf("ACL \"%s\"", ss);
4105 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
4106 }
4107 }
4108
4109 /* Parse an ACL that is still in text form. If it came from a file, remember it
4110 in the ACL tree, having read it into the POOL_PERM store pool so that it
4111 persists between multiple messages. */
4112
4113 if (acl == NULL)
4114 {
4115 int old_pool = store_pool;
4116 if (fd >= 0) store_pool = POOL_PERM;
4117 acl = acl_read(acl_getline, log_msgptr);
4118 store_pool = old_pool;
4119 if (acl == NULL && *log_msgptr != NULL) return ERROR;
4120 if (fd >= 0)
4121 {
4122 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
4123 Ustrcpy(t->name, ss);
4124 t->data.ptr = acl;
4125 (void)tree_insertnode(&acl_anchor, t);
4126 }
4127 }
4128
4129 /* Now we have an ACL to use. It's possible it may be NULL. */
4130
4131 while (acl != NULL)
4132 {
4133 int cond;
4134 int basic_errno = 0;
4135 BOOL endpass_seen = FALSE;
4136 BOOL acl_quit_check = level == 0
4137 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4138
4139 *log_msgptr = *user_msgptr = NULL;
4140 acl_temp_details = FALSE;
4141
4142 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
4143
4144 /* Clear out any search error message from a previous check before testing
4145 this condition. */
4146
4147 search_error_message = NULL;
4148 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
4149 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4150
4151 /* Handle special returns: DEFER causes a return except on a WARN verb;
4152 ERROR always causes a return. */
4153
4154 switch (cond)
4155 {
4156 case DEFER:
4157 HDEBUG(D_acl) debug_printf("%s: condition test deferred in %s\n", verbs[acl->verb], acl_name);
4158 if (basic_errno != ERRNO_CALLOUTDEFER)
4159 {
4160 if (search_error_message != NULL && *search_error_message != 0)
4161 *log_msgptr = search_error_message;
4162 if (smtp_return_error_details) acl_temp_details = TRUE;
4163 }
4164 else
4165 {
4166 acl_temp_details = TRUE;
4167 }
4168 if (acl->verb != ACL_WARN) return DEFER;
4169 break;
4170
4171 default: /* Paranoia */
4172 case ERROR:
4173 HDEBUG(D_acl) debug_printf("%s: condition test error in %s\n", verbs[acl->verb], acl_name);
4174 return ERROR;
4175
4176 case OK:
4177 HDEBUG(D_acl) debug_printf("%s: condition test succeeded in %s\n",
4178 verbs[acl->verb], acl_name);
4179 break;
4180
4181 case FAIL:
4182 HDEBUG(D_acl) debug_printf("%s: condition test failed in %s\n", verbs[acl->verb], acl_name);
4183 break;
4184
4185 /* DISCARD and DROP can happen only from a nested ACL condition, and
4186 DISCARD can happen only for an "accept" or "discard" verb. */
4187
4188 case DISCARD:
4189 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\" in %s\n",
4190 verbs[acl->verb], acl_name);
4191 break;
4192
4193 case FAIL_DROP:
4194 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\" in %s\n",
4195 verbs[acl->verb], acl_name);
4196 break;
4197 }
4198
4199 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4200 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4201 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4202
4203 switch(acl->verb)
4204 {
4205 case ACL_ACCEPT:
4206 if (cond == OK || cond == DISCARD)
4207 {
4208 HDEBUG(D_acl) debug_printf("end of %s: ACCEPT\n", acl_name);
4209 return cond;
4210 }
4211 if (endpass_seen)
4212 {
4213 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
4214 return cond;
4215 }
4216 break;
4217
4218 case ACL_DEFER:
4219 if (cond == OK)
4220 {
4221 HDEBUG(D_acl) debug_printf("end of %s: DEFER\n", acl_name);
4222 if (acl_quit_check) goto badquit;
4223 acl_temp_details = TRUE;
4224 return DEFER;
4225 }
4226 break;
4227
4228 case ACL_DENY:
4229 if (cond == OK)
4230 {
4231 HDEBUG(D_acl) debug_printf("end of %s: DENY\n", acl_name);
4232 if (acl_quit_check) goto badquit;
4233 return FAIL;
4234 }
4235 break;
4236
4237 case ACL_DISCARD:
4238 if (cond == OK || cond == DISCARD)
4239 {
4240 HDEBUG(D_acl) debug_printf("end of %s: DISCARD\n", acl_name);
4241 if (acl_quit_check) goto badquit;
4242 return DISCARD;
4243 }
4244 if (endpass_seen)
4245 {
4246 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
4247 return cond;
4248 }
4249 break;
4250
4251 case ACL_DROP:
4252 if (cond == OK)
4253 {
4254 HDEBUG(D_acl) debug_printf("end of %s: DROP\n", acl_name);
4255 if (acl_quit_check) goto badquit;
4256 return FAIL_DROP;
4257 }
4258 break;
4259
4260 case ACL_REQUIRE:
4261 if (cond != OK)
4262 {
4263 HDEBUG(D_acl) debug_printf("end of %s: not OK\n", acl_name);
4264 if (acl_quit_check) goto badquit;
4265 return cond;
4266 }
4267 break;
4268
4269 case ACL_WARN:
4270 if (cond == OK)
4271 acl_warn(where, *user_msgptr, *log_msgptr);
4272 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4273 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4274 "condition test deferred%s%s", host_and_ident(TRUE),
4275 (*log_msgptr == NULL)? US"" : US": ",
4276 (*log_msgptr == NULL)? US"" : *log_msgptr);
4277 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4278 break;
4279
4280 default:
4281 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4282 acl->verb);
4283 break;
4284 }
4285
4286 /* Pass to the next ACL item */
4287
4288 acl = acl->next;
4289 }
4290
4291 /* We have reached the end of the ACL. This is an implicit DENY. */
4292
4293 HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
4294 return FAIL;
4295
4296 badquit:
4297 *log_msgptr = string_sprintf("QUIT or not-QUIT teplevel ACL may not fail "
4298 "('%s' verb used incorrectly)", verbs[acl->verb]);
4299 return ERROR;
4300 }
4301
4302
4303
4304
4305 /* Same args as acl_check_internal() above, but the string s is
4306 the name of an ACL followed optionally by up to 9 space-separated arguments.
4307 The name and args are separately expanded. Args go into $acl_arg globals. */
4308 static int
4309 acl_check_wargs(int where, address_item *addr, const uschar *s, int level,
4310 uschar **user_msgptr, uschar **log_msgptr)
4311 {
4312 uschar * tmp;
4313 uschar * tmp_arg[9]; /* must match acl_arg[] */
4314 uschar * sav_arg[9]; /* must match acl_arg[] */
4315 int sav_narg;
4316 uschar * name;
4317 int i;
4318 int ret;
4319
4320 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4321 goto bad;
4322
4323 for (i = 0; i < 9; i++)
4324 {
4325 while (*s && isspace(*s)) s++;
4326 if (!*s) break;
4327 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4328 {
4329 tmp = name;
4330 goto bad;
4331 }
4332 }
4333
4334 sav_narg = acl_narg;
4335 acl_narg = i;
4336 for (i = 0; i < acl_narg; i++)
4337 {
4338 sav_arg[i] = acl_arg[i];
4339 acl_arg[i] = tmp_arg[i];
4340 }
4341 while (i < 9)
4342 {
4343 sav_arg[i] = acl_arg[i];
4344 acl_arg[i++] = NULL;
4345 }
4346
4347 ret = acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
4348
4349 acl_narg = sav_narg;
4350 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4351 return ret;
4352
4353 bad:
4354 if (expand_string_forcedfail) return ERROR;
4355 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4356 tmp, expand_string_message);
4357 return search_find_defer?DEFER:ERROR;
4358 }
4359
4360
4361
4362 /*************************************************
4363 * Check access using an ACL *
4364 *************************************************/
4365
4366 /* Alternate interface for ACL, used by expansions */
4367 int
4368 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4369 {
4370 address_item adb;
4371 address_item *addr = NULL;
4372
4373 *user_msgptr = *log_msgptr = NULL;
4374 sender_verified_failed = NULL;
4375 ratelimiters_cmd = NULL;
4376 log_reject_target = LOG_MAIN|LOG_REJECT;
4377
4378 if (where == ACL_WHERE_RCPT)
4379 {
4380 adb = address_defaults;
4381 addr = &adb;
4382 addr->address = expand_string(US"$local_part@$domain");
4383 addr->domain = deliver_domain;
4384 addr->local_part = deliver_localpart;
4385 addr->cc_local_part = deliver_localpart;
4386 addr->lc_local_part = deliver_localpart;
4387 }
4388
4389 return acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4390 }
4391
4392
4393
4394 /* This is the external interface for ACL checks. It sets up an address and the
4395 expansions for $domain and $local_part when called after RCPT, then calls
4396 acl_check_internal() to do the actual work.
4397
4398 Arguments:
4399 where ACL_WHERE_xxxx indicating where called from
4400 recipient RCPT address for RCPT check, else NULL
4401 s the input string; NULL is the same as an empty ACL => DENY
4402 user_msgptr where to put a user error (for SMTP response)
4403 log_msgptr where to put a logging message (not for SMTP response)
4404
4405 Returns: OK access is granted by an ACCEPT verb
4406 DISCARD access is granted by a DISCARD verb
4407 FAIL access is denied
4408 FAIL_DROP access is denied; drop the connection
4409 DEFER can't tell at the moment
4410 ERROR disaster
4411 */
4412 int acl_where = ACL_WHERE_UNKNOWN;
4413
4414 int
4415 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4416 uschar **log_msgptr)
4417 {
4418 int rc;
4419 address_item adb;
4420 address_item *addr = NULL;
4421
4422 *user_msgptr = *log_msgptr = NULL;
4423 sender_verified_failed = NULL;
4424 ratelimiters_cmd = NULL;
4425 log_reject_target = LOG_MAIN|LOG_REJECT;
4426
4427 #ifndef DISABLE_PRDR
4428 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4429 #else
4430 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4431 #endif
4432 {
4433 adb = address_defaults;
4434 addr = &adb;
4435 addr->address = recipient;
4436 if (deliver_split_address(addr) == DEFER)
4437 {
4438 *log_msgptr = US"defer in percent_hack_domains check";
4439 return DEFER;
4440 }
4441 #ifdef SUPPORT_I18N
4442 if ((addr->prop.utf8_msg = message_smtputf8))
4443 {
4444 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4445 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4446 }
4447 #endif
4448 deliver_domain = addr->domain;
4449 deliver_localpart = addr->local_part;
4450 }
4451
4452 acl_where = where;
4453 rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
4454 acl_where = ACL_WHERE_UNKNOWN;
4455
4456 /* Cutthrough - if requested,
4457 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4458 and rcpt acl returned accept,
4459 and first recipient (cancel on any subsequents)
4460 open one now and run it up to RCPT acceptance.
4461 A failed verify should cancel cutthrough request,
4462 and will pass the fail to the originator.
4463 Initial implementation: dual-write to spool.
4464 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4465
4466 Cease cutthrough copy on rxd final dot; do not send one.
4467
4468 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4469
4470 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4471 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4472 If temp-reject, close the conn (and keep the spooled copy).
4473 If conn-failure, no action (and keep the spooled copy).
4474 */
4475 switch (where)
4476 {
4477 case ACL_WHERE_RCPT:
4478 #ifndef DISABLE_PRDR
4479 case ACL_WHERE_PRDR:
4480 #endif
4481 if (host_checking_callout) /* -bhc mode */
4482 cancel_cutthrough_connection("host-checking mode");
4483
4484 else if ( rc == OK
4485 && cutthrough.delivery
4486 && rcpt_count > cutthrough.nrcpt
4487 && (rc = open_cutthrough_connection(addr)) == DEFER
4488 )
4489 if (cutthrough.defer_pass)
4490 {
4491 uschar * s = addr->message;
4492 /* Horrid kludge to recover target's SMTP message */
4493 while (*s) s++;
4494 do --s; while (!isdigit(*s));
4495 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4496 acl_temp_details = TRUE;
4497 }
4498 else
4499 {
4500 HDEBUG(D_acl) debug_printf("cutthrough defer; will spool\n");
4501 rc = OK;
4502 }
4503 break;
4504
4505 case ACL_WHERE_PREDATA:
4506 if (rc == OK)
4507 cutthrough_predata();
4508 else
4509 cancel_cutthrough_connection("predata acl not ok");
4510 break;
4511
4512 case ACL_WHERE_QUIT:
4513 case ACL_WHERE_NOTQUIT:
4514 cancel_cutthrough_connection("quit or notquit");
4515 break;
4516
4517 default:
4518 break;
4519 }
4520
4521 deliver_domain = deliver_localpart = deliver_address_data =
4522 sender_address_data = NULL;
4523
4524 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4525 ACL, which is really in the middle of an SMTP command. */
4526
4527 if (rc == DISCARD)
4528 {
4529 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4530 {
4531 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4532 "ACL", acl_wherenames[where]);
4533 return ERROR;
4534 }
4535 return DISCARD;
4536 }
4537
4538 /* A DROP response is not permitted from MAILAUTH */
4539
4540 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4541 {
4542 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4543 "ACL", acl_wherenames[where]);
4544 return ERROR;
4545 }
4546
4547 /* Before giving a response, take a look at the length of any user message, and
4548 split it up into multiple lines if possible. */
4549
4550 *user_msgptr = string_split_message(*user_msgptr);
4551 if (fake_response != OK)
4552 fake_response_text = string_split_message(fake_response_text);
4553
4554 return rc;
4555 }
4556
4557
4558 /*************************************************
4559 * Create ACL variable *
4560 *************************************************/
4561
4562 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4563 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4564
4565 Argument:
4566 name pointer to the variable's name, starting with c or m
4567
4568 Returns the pointer to variable's tree node
4569 */
4570
4571 tree_node *
4572 acl_var_create(uschar *name)
4573 {
4574 tree_node *node, **root;
4575 root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
4576 node = tree_search(*root, name);
4577 if (node == NULL)
4578 {
4579 node = store_get(sizeof(tree_node) + Ustrlen(name));
4580 Ustrcpy(node->name, name);
4581 (void)tree_insertnode(root, node);
4582 }
4583 node->data.ptr = NULL;
4584 return node;
4585 }
4586
4587
4588
4589 /*************************************************
4590 * Write an ACL variable in spool format *
4591 *************************************************/
4592
4593 /* This function is used as a callback for tree_walk when writing variables to
4594 the spool file. To retain spool file compatibility, what is written is -aclc or
4595 -aclm followed by the rest of the name and the data length, space separated,
4596 then the value itself, starting on a new line, and terminated by an additional
4597 newline. When we had only numbered ACL variables, the first line might look
4598 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4599 acl_cfoo.
4600
4601 Arguments:
4602 name of the variable
4603 value of the variable
4604 ctx FILE pointer (as a void pointer)
4605
4606 Returns: nothing
4607 */
4608
4609 void
4610 acl_var_write(uschar *name, uschar *value, void *ctx)
4611 {
4612 FILE *f = (FILE *)ctx;
4613 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4614 }
4615
4616 /* vi: aw ai sw=2
4617 */
4618 /* End of acl.c */
Unnamed repository; edit this file 'description' to name the repository.