Expansions: new ${lheader:<name>}. Bug 2272
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef SUPPORT_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
142 #ifndef DISABLE_PRDR
143 ACL_BIT_PRDR |
144 #endif
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
153 },
154 #ifdef EXPERIMENTAL_BRIGHTMAIL
155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
159 # ifndef DISABLE_PRDR
160 ACL_BIT_PRDR |
161 # endif
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
167 },
168 #endif
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
175
176 #ifdef EXPERIMENTAL_DCC
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
179 ~(ACL_BIT_DATA |
180 # ifndef DISABLE_PRDR
181 ACL_BIT_PRDR |
182 # endif
183 ACL_BIT_NOTSMTP),
184 },
185 #endif
186 #ifdef WITH_CONTENT_SCAN
187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
188
189 #endif
190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
191 #ifndef DISABLE_DKIM
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 #endif
195 #ifdef EXPERIMENTAL_DMARC
196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
197 #endif
198
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
202
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
206 #ifndef DISABLE_PRDR
207 |ACL_BIT_PRDR
208 #endif
209 ),
210 },
211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
214 },
215
216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
217
218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
220 },
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
224 #ifndef DISABLE_PRDR
225 | ACL_BIT_PRDR
226 #endif
227 ),
228 },
229
230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
233
234 #ifdef WITH_CONTENT_SCAN
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
237 ~(ACL_BIT_DATA |
238 # ifndef DISABLE_PRDR
239 ACL_BIT_PRDR |
240 # endif
241 ACL_BIT_NOTSMTP),
242 },
243 #endif
244
245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
248 #endif
249
250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
251 ACL_BIT_NOTSMTP |
252 #ifndef DISABLE_PRDR
253 ACL_BIT_PRDR |
254 #endif
255 ACL_BIT_DATA,
256 },
257
258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
260
261 #ifdef WITH_CONTENT_SCAN
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
264 ~(ACL_BIT_DATA |
265 # ifndef DISABLE_PRDR
266 ACL_BIT_PRDR |
267 # endif
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
270 },
271
272 #endif
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
277 #ifndef DISABLE_PRDR
278 ACL_BIT_PRDR |
279 #endif
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
282 },
283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
289 },
290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
296 },
297
298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
299
300 #ifdef WITH_CONTENT_SCAN
301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
302 (unsigned int) ~(ACL_BIT_DATA |
303 # ifndef DISABLE_PRDR
304 ACL_BIT_PRDR |
305 # endif
306 ACL_BIT_NOTSMTP),
307 },
308 #endif
309 #ifdef SUPPORT_SPF
310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
316 },
317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
323 },
324 #endif
325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
326
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
330 };
331
332
333
334 /* Return values from decode_control(); used as index so keep in step
335 with the controls_list table that follows! */
336
337 enum {
338 CONTROL_AUTH_UNADVERTISED,
339 #ifdef EXPERIMENTAL_BRIGHTMAIL
340 CONTROL_BMI_RUN,
341 #endif
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
346 #ifndef DISABLE_DKIM
347 CONTROL_DKIM_VERIFY,
348 #endif
349 #ifdef EXPERIMENTAL_DMARC
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
352 #endif
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
359
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
363 #ifdef WITH_CONTENT_SCAN
364 CONTROL_NO_MBOX_UNSPOOL,
365 #endif
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
368
369 CONTROL_QUEUE_ONLY,
370 CONTROL_SUBMISSION,
371 CONTROL_SUPPRESS_LOCAL_FIXUPS,
372 #ifdef SUPPORT_I18N
373 CONTROL_UTF8_DOWNCONVERT,
374 #endif
375 };
376
377
378
379 /* Structure listing various control arguments, with their characteristics.
380 For each control, there's a bitmap of dis-allowed times. For some, it is easier
381 to specify the negation of a small number of allowed times. */
382
383 typedef struct control_def {
384 uschar *name;
385 BOOL has_option; /* Has /option(s) following */
386 unsigned forbids; /* bitmap of dis-allowed times */
387 } control_def;
388
389 static control_def controls_list[] = {
390 /* name has_option forbids */
391 [CONTROL_AUTH_UNADVERTISED] =
392 { US"allow_auth_unadvertised", FALSE,
393 (unsigned)
394 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
395 },
396 #ifdef EXPERIMENTAL_BRIGHTMAIL
397 [CONTROL_BMI_RUN] =
398 { US"bmi_run", FALSE, 0 },
399 #endif
400 [CONTROL_CASEFUL_LOCAL_PART] =
401 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
402 [CONTROL_CASELOWER_LOCAL_PART] =
403 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
404 [CONTROL_CUTTHROUGH_DELIVERY] =
405 { US"cutthrough_delivery", TRUE, 0 },
406 [CONTROL_DEBUG] =
407 { US"debug", TRUE, 0 },
408
409 #ifndef DISABLE_DKIM
410 [CONTROL_DKIM_VERIFY] =
411 { US"dkim_disable_verify", FALSE,
412 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
413 # ifndef DISABLE_PRDR
414 ACL_BIT_PRDR |
415 # endif
416 ACL_BIT_NOTSMTP_START
417 },
418 #endif
419
420 #ifdef EXPERIMENTAL_DMARC
421 [CONTROL_DMARC_VERIFY] =
422 { US"dmarc_disable_verify", FALSE,
423 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
424 },
425 [CONTROL_DMARC_FORENSIC] =
426 { US"dmarc_enable_forensic", FALSE,
427 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
428 },
429 #endif
430
431 [CONTROL_DSCP] =
432 { US"dscp", TRUE,
433 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
434 },
435 [CONTROL_ENFORCE_SYNC] =
436 { US"enforce_sync", FALSE,
437 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
438 },
439
440 /* Pseudo-value for decode errors */
441 [CONTROL_ERROR] =
442 { US"error", FALSE, 0 },
443
444 [CONTROL_FAKEDEFER] =
445 { US"fakedefer", TRUE,
446 (unsigned)
447 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
448 ACL_BIT_PREDATA | ACL_BIT_DATA |
449 #ifndef DISABLE_PRDR
450 ACL_BIT_PRDR |
451 #endif
452 ACL_BIT_MIME)
453 },
454 [CONTROL_FAKEREJECT] =
455 { US"fakereject", TRUE,
456 (unsigned)
457 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
458 ACL_BIT_PREDATA | ACL_BIT_DATA |
459 #ifndef DISABLE_PRDR
460 ACL_BIT_PRDR |
461 #endif
462 ACL_BIT_MIME)
463 },
464 [CONTROL_FREEZE] =
465 { US"freeze", TRUE,
466 (unsigned)
467 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
468 ACL_BIT_PREDATA | ACL_BIT_DATA |
469 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
470 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
471 },
472
473 [CONTROL_NO_CALLOUT_FLUSH] =
474 { US"no_callout_flush", FALSE,
475 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
476 },
477 [CONTROL_NO_DELAY_FLUSH] =
478 { US"no_delay_flush", FALSE,
479 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
480 },
481
482 [CONTROL_NO_ENFORCE_SYNC] =
483 { US"no_enforce_sync", FALSE,
484 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
485 },
486 #ifdef WITH_CONTENT_SCAN
487 [CONTROL_NO_MBOX_UNSPOOL] =
488 { US"no_mbox_unspool", FALSE,
489 (unsigned)
490 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
491 ACL_BIT_PREDATA | ACL_BIT_DATA |
492 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
493 ACL_BIT_MIME)
494 },
495 #endif
496 [CONTROL_NO_MULTILINE] =
497 { US"no_multiline_responses", FALSE,
498 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
499 },
500 [CONTROL_NO_PIPELINING] =
501 { US"no_pipelining", FALSE,
502 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
503 },
504
505 [CONTROL_QUEUE_ONLY] =
506 { US"queue_only", FALSE,
507 (unsigned)
508 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
509 ACL_BIT_PREDATA | ACL_BIT_DATA |
510 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
511 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
512 },
513 [CONTROL_SUBMISSION] =
514 { US"submission", TRUE,
515 (unsigned)
516 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
517 },
518 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
519 { US"suppress_local_fixups", FALSE,
520 (unsigned)
521 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
522 ACL_BIT_NOTSMTP_START)
523 },
524 #ifdef SUPPORT_I18N
525 [CONTROL_UTF8_DOWNCONVERT] =
526 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
527 }
528 #endif
529 };
530
531 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
532 caches its result in a tree to avoid repeated DNS queries. The result is an
533 integer code which is used as an index into the following tables of
534 explanatory strings and verification return codes. */
535
536 static tree_node *csa_cache = NULL;
537
538 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
539 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
540
541 /* The acl_verify_csa() return code is translated into an acl_verify() return
542 code using the following table. It is OK unless the client is definitely not
543 authorized. This is because CSA is supposed to be optional for sending sites,
544 so recipients should not be too strict about checking it - especially because
545 DNS problems are quite likely to occur. It's possible to use $csa_status in
546 further ACL conditions to distinguish ok, unknown, and defer if required, but
547 the aim is to make the usual configuration simple. */
548
549 static int csa_return_code[] = {
550 [CSA_UNKNOWN] = OK,
551 [CSA_OK] = OK,
552 [CSA_DEFER_SRV] = OK,
553 [CSA_DEFER_ADDR] = OK,
554 [CSA_FAIL_EXPLICIT] = FAIL,
555 [CSA_FAIL_DOMAIN] = FAIL,
556 [CSA_FAIL_NOADDR] = FAIL,
557 [CSA_FAIL_MISMATCH] = FAIL
558 };
559
560 static uschar *csa_status_string[] = {
561 [CSA_UNKNOWN] = US"unknown",
562 [CSA_OK] = US"ok",
563 [CSA_DEFER_SRV] = US"defer",
564 [CSA_DEFER_ADDR] = US"defer",
565 [CSA_FAIL_EXPLICIT] = US"fail",
566 [CSA_FAIL_DOMAIN] = US"fail",
567 [CSA_FAIL_NOADDR] = US"fail",
568 [CSA_FAIL_MISMATCH] = US"fail"
569 };
570
571 static uschar *csa_reason_string[] = {
572 [CSA_UNKNOWN] = US"unknown",
573 [CSA_OK] = US"ok",
574 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
575 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
576 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
577 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
578 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
579 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
580 };
581
582 /* Options for the ratelimit condition. Note that there are two variants of
583 the per_rcpt option, depending on the ACL that is used to measure the rate.
584 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
585 so the two variants must have the same internal representation as well as
586 the same configuration string. */
587
588 enum {
589 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
590 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
591 };
592
593 #define RATE_SET(var,new) \
594 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
595
596 static uschar *ratelimit_option_string[] = {
597 [RATE_PER_WHAT] = US"?",
598 [RATE_PER_CLASH] = US"!",
599 [RATE_PER_ADDR] = US"per_addr",
600 [RATE_PER_BYTE] = US"per_byte",
601 [RATE_PER_CMD] = US"per_cmd",
602 [RATE_PER_CONN] = US"per_conn",
603 [RATE_PER_MAIL] = US"per_mail",
604 [RATE_PER_RCPT] = US"per_rcpt",
605 [RATE_PER_ALLRCPTS] = US"per_rcpt"
606 };
607
608 /* Enable recursion between acl_check_internal() and acl_check_condition() */
609
610 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
611 uschar **);
612
613
614 /*************************************************
615 * Find control in list *
616 *************************************************/
617
618 /* The lists are always in order, so binary chop can be used.
619
620 Arguments:
621 name the control name to search for
622 ol the first entry in the control list
623 last one more than the offset of the last entry in the control list
624
625 Returns: index of a control entry, or -1 if not found
626 */
627
628 static int
629 find_control(const uschar * name, control_def * ol, int last)
630 {
631 int first = 0;
632 while (last > first)
633 {
634 int middle = (first + last)/2;
635 uschar * s = ol[middle].name;
636 int c = Ustrncmp(name, s, Ustrlen(s));
637 if (c == 0) return middle;
638 else if (c > 0) first = middle + 1;
639 else last = middle;
640 }
641 return -1;
642 }
643
644
645
646 /*************************************************
647 * Pick out condition from list *
648 *************************************************/
649
650 /* Use a binary chop method
651
652 Arguments:
653 name name to find
654 list list of conditions
655 end size of list
656
657 Returns: offset in list, or -1 if not found
658 */
659
660 static int
661 acl_checkcondition(uschar * name, condition_def * list, int end)
662 {
663 int start = 0;
664 while (start < end)
665 {
666 int mid = (start + end)/2;
667 int c = Ustrcmp(name, list[mid].name);
668 if (c == 0) return mid;
669 if (c < 0) end = mid;
670 else start = mid + 1;
671 }
672 return -1;
673 }
674
675
676 /*************************************************
677 * Pick out name from list *
678 *************************************************/
679
680 /* Use a binary chop method
681
682 Arguments:
683 name name to find
684 list list of names
685 end size of list
686
687 Returns: offset in list, or -1 if not found
688 */
689
690 static int
691 acl_checkname(uschar *name, uschar **list, int end)
692 {
693 int start = 0;
694
695 while (start < end)
696 {
697 int mid = (start + end)/2;
698 int c = Ustrcmp(name, list[mid]);
699 if (c == 0) return mid;
700 if (c < 0) end = mid; else start = mid + 1;
701 }
702
703 return -1;
704 }
705
706
707 /*************************************************
708 * Read and parse one ACL *
709 *************************************************/
710
711 /* This function is called both from readconf in order to parse the ACLs in the
712 configuration file, and also when an ACL is encountered dynamically (e.g. as
713 the result of an expansion). It is given a function to call in order to
714 retrieve the lines of the ACL. This function handles skipping comments and
715 blank lines (where relevant).
716
717 Arguments:
718 func function to get next line of ACL
719 error where to put an error message
720
721 Returns: pointer to ACL, or NULL
722 NULL can be legal (empty ACL); in this case error will be NULL
723 */
724
725 acl_block *
726 acl_read(uschar *(*func)(void), uschar **error)
727 {
728 acl_block *yield = NULL;
729 acl_block **lastp = &yield;
730 acl_block *this = NULL;
731 acl_condition_block *cond;
732 acl_condition_block **condp = NULL;
733 uschar *s;
734
735 *error = NULL;
736
737 while ((s = (*func)()) != NULL)
738 {
739 int v, c;
740 BOOL negated = FALSE;
741 uschar *saveline = s;
742 uschar name[64];
743
744 /* Conditions (but not verbs) are allowed to be negated by an initial
745 exclamation mark. */
746
747 while (isspace(*s)) s++;
748 if (*s == '!')
749 {
750 negated = TRUE;
751 s++;
752 }
753
754 /* Read the name of a verb or a condition, or the start of a new ACL, which
755 can be started by a name, or by a macro definition. */
756
757 s = readconf_readname(name, sizeof(name), s);
758 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
759
760 /* If a verb is unrecognized, it may be another condition or modifier that
761 continues the previous verb. */
762
763 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
764 {
765 if (this == NULL)
766 {
767 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
768 saveline);
769 return NULL;
770 }
771 }
772
773 /* New verb */
774
775 else
776 {
777 if (negated)
778 {
779 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
780 return NULL;
781 }
782 this = store_get(sizeof(acl_block));
783 *lastp = this;
784 lastp = &(this->next);
785 this->next = NULL;
786 this->verb = v;
787 this->condition = NULL;
788 condp = &(this->condition);
789 if (*s == 0) continue; /* No condition on this line */
790 if (*s == '!')
791 {
792 negated = TRUE;
793 s++;
794 }
795 s = readconf_readname(name, sizeof(name), s); /* Condition name */
796 }
797
798 /* Handle a condition or modifier. */
799
800 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
801 {
802 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
803 saveline);
804 return NULL;
805 }
806
807 /* The modifiers may not be negated */
808
809 if (negated && conditions[c].is_modifier)
810 {
811 *error = string_sprintf("ACL error: negation is not allowed with "
812 "\"%s\"", conditions[c].name);
813 return NULL;
814 }
815
816 /* ENDPASS may occur only with ACCEPT or DISCARD. */
817
818 if (c == ACLC_ENDPASS &&
819 this->verb != ACL_ACCEPT &&
820 this->verb != ACL_DISCARD)
821 {
822 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
823 conditions[c].name, verbs[this->verb]);
824 return NULL;
825 }
826
827 cond = store_get(sizeof(acl_condition_block));
828 cond->next = NULL;
829 cond->type = c;
830 cond->u.negated = negated;
831
832 *condp = cond;
833 condp = &(cond->next);
834
835 /* The "set" modifier is different in that its argument is "name=value"
836 rather than just a value, and we can check the validity of the name, which
837 gives us a variable name to insert into the data block. The original ACL
838 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
839 extended to 20 of each type, but after that people successfully argued for
840 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
841 After that, we allow alphanumerics and underscores, but the first character
842 after c or m must be a digit or an underscore. This retains backwards
843 compatibility. */
844
845 if (c == ACLC_SET)
846 #ifndef DISABLE_DKIM
847 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
848 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
849 {
850 uschar * endptr = s+18;
851
852 if (isalnum(*endptr))
853 {
854 *error = string_sprintf("invalid variable name after \"set\" in ACL "
855 "modifier \"set %s\" "
856 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
857 s);
858 return NULL;
859 }
860 cond->u.varname = string_copyn(s, 18);
861 s = endptr;
862 while (isspace(*s)) s++;
863 }
864 else
865 #endif
866 {
867 uschar *endptr;
868
869 if (Ustrncmp(s, "acl_c", 5) != 0 &&
870 Ustrncmp(s, "acl_m", 5) != 0)
871 {
872 *error = string_sprintf("invalid variable name after \"set\" in ACL "
873 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
874 return NULL;
875 }
876
877 endptr = s + 5;
878 if (!isdigit(*endptr) && *endptr != '_')
879 {
880 *error = string_sprintf("invalid variable name after \"set\" in ACL "
881 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
882 s);
883 return NULL;
884 }
885
886 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
887 {
888 if (!isalnum(*endptr) && *endptr != '_')
889 {
890 *error = string_sprintf("invalid character \"%c\" in variable name "
891 "in ACL modifier \"set %s\"", *endptr, s);
892 return NULL;
893 }
894 endptr++;
895 }
896
897 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
898 s = endptr;
899 while (isspace(*s)) s++;
900 }
901
902 /* For "set", we are now positioned for the data. For the others, only
903 "endpass" has no data */
904
905 if (c != ACLC_ENDPASS)
906 {
907 if (*s++ != '=')
908 {
909 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
910 conditions[c].is_modifier ? US"modifier" : US"condition");
911 return NULL;
912 }
913 while (isspace(*s)) s++;
914 cond->arg = string_copy(s);
915 }
916 }
917
918 return yield;
919 }
920
921
922
923 /*************************************************
924 * Set up added header line(s) *
925 *************************************************/
926
927 /* This function is called by the add_header modifier, and also from acl_warn()
928 to implement the now-deprecated way of adding header lines using "message" on a
929 "warn" verb. The argument is treated as a sequence of header lines which are
930 added to a chain, provided there isn't an identical one already there.
931
932 Argument: string of header lines
933 Returns: nothing
934 */
935
936 static void
937 setup_header(const uschar *hstring)
938 {
939 const uschar *p, *q;
940 int hlen = Ustrlen(hstring);
941
942 /* Ignore any leading newlines */
943 while (*hstring == '\n') hstring++, hlen--;
944
945 /* An empty string does nothing; ensure exactly one final newline. */
946 if (hlen <= 0) return;
947 if (hstring[--hlen] != '\n') /* no newline */
948 q = string_sprintf("%s\n", hstring);
949 else if (hstring[hlen-1] == '\n') /* double newline */
950 {
951 uschar * s = string_copy(hstring);
952 while(s[--hlen] == '\n')
953 s[hlen+1] = '\0';
954 q = s;
955 }
956 else
957 q = hstring;
958
959 /* Loop for multiple header lines, taking care about continuations */
960
961 for (p = q; *p; p = q)
962 {
963 const uschar *s;
964 uschar * hdr;
965 int newtype = htype_add_bot;
966 header_line **hptr = &acl_added_headers;
967
968 /* Find next header line within the string */
969
970 for (;;)
971 {
972 q = Ustrchr(q, '\n'); /* we know there was a newline */
973 if (*++q != ' ' && *q != '\t') break;
974 }
975
976 /* If the line starts with a colon, interpret the instruction for where to
977 add it. This temporarily sets up a new type. */
978
979 if (*p == ':')
980 {
981 if (strncmpic(p, US":after_received:", 16) == 0)
982 {
983 newtype = htype_add_rec;
984 p += 16;
985 }
986 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
987 {
988 newtype = htype_add_rfc;
989 p += 14;
990 }
991 else if (strncmpic(p, US":at_start:", 10) == 0)
992 {
993 newtype = htype_add_top;
994 p += 10;
995 }
996 else if (strncmpic(p, US":at_end:", 8) == 0)
997 {
998 newtype = htype_add_bot;
999 p += 8;
1000 }
1001 while (*p == ' ' || *p == '\t') p++;
1002 }
1003
1004 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1005 to the front of it. */
1006
1007 for (s = p; s < q - 1; s++)
1008 if (*s == ':' || !isgraph(*s)) break;
1009
1010 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1011 hlen = Ustrlen(hdr);
1012
1013 /* See if this line has already been added */
1014
1015 while (*hptr)
1016 {
1017 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1018 hptr = &(*hptr)->next;
1019 }
1020
1021 /* Add if not previously present */
1022
1023 if (!*hptr)
1024 {
1025 header_line *h = store_get(sizeof(header_line));
1026 h->text = hdr;
1027 h->next = NULL;
1028 h->type = newtype;
1029 h->slen = hlen;
1030 *hptr = h;
1031 hptr = &h->next;
1032 }
1033 }
1034 }
1035
1036
1037
1038 /*************************************************
1039 * List the added header lines *
1040 *************************************************/
1041 uschar *
1042 fn_hdrs_added(void)
1043 {
1044 gstring * g = NULL;
1045 header_line * h;
1046
1047 for (h = acl_added_headers; h; h = h->next)
1048 {
1049 int i = h->slen;
1050 if (h->text[i-1] == '\n') i--;
1051 g = string_append_listele_n(g, '\n', h->text, i);
1052 }
1053
1054 return g ? g->s : NULL;
1055 }
1056
1057
1058 /*************************************************
1059 * Set up removed header line(s) *
1060 *************************************************/
1061
1062 /* This function is called by the remove_header modifier. The argument is
1063 treated as a sequence of header names which are added to a colon separated
1064 list, provided there isn't an identical one already there.
1065
1066 Argument: string of header names
1067 Returns: nothing
1068 */
1069
1070 static void
1071 setup_remove_header(const uschar *hnames)
1072 {
1073 if (*hnames != 0)
1074 acl_removed_headers = acl_removed_headers
1075 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1076 : string_copy(hnames);
1077 }
1078
1079
1080
1081 /*************************************************
1082 * Handle warnings *
1083 *************************************************/
1084
1085 /* This function is called when a WARN verb's conditions are true. It adds to
1086 the message's headers, and/or writes information to the log. In each case, this
1087 only happens once (per message for headers, per connection for log).
1088
1089 ** NOTE: The header adding action using the "message" setting is historic, and
1090 its use is now deprecated. The new add_header modifier should be used instead.
1091
1092 Arguments:
1093 where ACL_WHERE_xxxx indicating which ACL this is
1094 user_message message for adding to headers
1095 log_message message for logging, if different
1096
1097 Returns: nothing
1098 */
1099
1100 static void
1101 acl_warn(int where, uschar *user_message, uschar *log_message)
1102 {
1103 if (log_message != NULL && log_message != user_message)
1104 {
1105 uschar *text;
1106 string_item *logged;
1107
1108 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1109 string_printing(log_message));
1110
1111 /* If a sender verification has failed, and the log message is "sender verify
1112 failed", add the failure message. */
1113
1114 if (sender_verified_failed != NULL &&
1115 sender_verified_failed->message != NULL &&
1116 strcmpic(log_message, US"sender verify failed") == 0)
1117 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1118
1119 /* Search previously logged warnings. They are kept in malloc
1120 store so they can be freed at the start of a new message. */
1121
1122 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1123 if (Ustrcmp(logged->text, text) == 0) break;
1124
1125 if (logged == NULL)
1126 {
1127 int length = Ustrlen(text) + 1;
1128 log_write(0, LOG_MAIN, "%s", text);
1129 logged = store_malloc(sizeof(string_item) + length);
1130 logged->text = US logged + sizeof(string_item);
1131 memcpy(logged->text, text, length);
1132 logged->next = acl_warn_logged;
1133 acl_warn_logged = logged;
1134 }
1135 }
1136
1137 /* If there's no user message, we are done. */
1138
1139 if (user_message == NULL) return;
1140
1141 /* If this isn't a message ACL, we can't do anything with a user message.
1142 Log an error. */
1143
1144 if (where > ACL_WHERE_NOTSMTP)
1145 {
1146 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1147 "found in a non-message (%s) ACL: cannot specify header lines here: "
1148 "message ignored", acl_wherenames[where]);
1149 return;
1150 }
1151
1152 /* The code for setting up header lines is now abstracted into a separate
1153 function so that it can be used for the add_header modifier as well. */
1154
1155 setup_header(user_message);
1156 }
1157
1158
1159
1160 /*************************************************
1161 * Verify and check reverse DNS *
1162 *************************************************/
1163
1164 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1165 address if this has not yet been done. The host_name_lookup() function checks
1166 that one of these names resolves to an address list that contains the client IP
1167 address, so we don't actually have to do the check here.
1168
1169 Arguments:
1170 user_msgptr pointer for user message
1171 log_msgptr pointer for log message
1172
1173 Returns: OK verification condition succeeded
1174 FAIL verification failed
1175 DEFER there was a problem verifying
1176 */
1177
1178 static int
1179 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1180 {
1181 int rc;
1182
1183 user_msgptr = user_msgptr; /* stop compiler warning */
1184
1185 /* Previous success */
1186
1187 if (sender_host_name != NULL) return OK;
1188
1189 /* Previous failure */
1190
1191 if (host_lookup_failed)
1192 {
1193 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1194 return FAIL;
1195 }
1196
1197 /* Need to do a lookup */
1198
1199 HDEBUG(D_acl)
1200 debug_printf_indent("looking up host name to force name/address consistency check\n");
1201
1202 if ((rc = host_name_lookup()) != OK)
1203 {
1204 *log_msgptr = (rc == DEFER)?
1205 US"host lookup deferred for reverse lookup check"
1206 :
1207 string_sprintf("host lookup failed for reverse lookup check%s",
1208 host_lookup_msg);
1209 return rc; /* DEFER or FAIL */
1210 }
1211
1212 host_build_sender_fullhost();
1213 return OK;
1214 }
1215
1216
1217
1218 /*************************************************
1219 * Check client IP address matches CSA target *
1220 *************************************************/
1221
1222 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1223 response for address records belonging to the CSA target hostname. The section
1224 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1225 If one of the addresses matches the client's IP address, then the client is
1226 authorized by CSA. If there are target IP addresses but none of them match
1227 then the client is using an unauthorized IP address. If there are no target IP
1228 addresses then the client cannot be using an authorized IP address. (This is
1229 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1230
1231 Arguments:
1232 dnsa the DNS answer block
1233 dnss a DNS scan block for us to use
1234 reset option specifying what portion to scan, as described above
1235 target the target hostname to use for matching RR names
1236
1237 Returns: CSA_OK successfully authorized
1238 CSA_FAIL_MISMATCH addresses found but none matched
1239 CSA_FAIL_NOADDR no target addresses found
1240 */
1241
1242 static int
1243 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1244 uschar *target)
1245 {
1246 dns_record *rr;
1247 dns_address *da;
1248
1249 BOOL target_found = FALSE;
1250
1251 for (rr = dns_next_rr(dnsa, dnss, reset);
1252 rr != NULL;
1253 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1254 {
1255 /* Check this is an address RR for the target hostname. */
1256
1257 if (rr->type != T_A
1258 #if HAVE_IPV6
1259 && rr->type != T_AAAA
1260 #endif
1261 ) continue;
1262
1263 if (strcmpic(target, rr->name) != 0) continue;
1264
1265 target_found = TRUE;
1266
1267 /* Turn the target address RR into a list of textual IP addresses and scan
1268 the list. There may be more than one if it is an A6 RR. */
1269
1270 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1271 {
1272 /* If the client IP address matches the target IP address, it's good! */
1273
1274 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1275
1276 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1277 }
1278 }
1279
1280 /* If we found some target addresses but none of them matched, the client is
1281 using an unauthorized IP address, otherwise the target has no authorized IP
1282 addresses. */
1283
1284 if (target_found) return CSA_FAIL_MISMATCH;
1285 else return CSA_FAIL_NOADDR;
1286 }
1287
1288
1289
1290 /*************************************************
1291 * Verify Client SMTP Authorization *
1292 *************************************************/
1293
1294 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1295 to find the CSA SRV record corresponding to the domain argument, or
1296 $sender_helo_name if no argument is provided. It then checks that the
1297 client is authorized, and that its IP address corresponds to the SRV
1298 target's address by calling acl_verify_csa_address() above. The address
1299 should have been returned in the DNS response's ADDITIONAL section, but if
1300 not we perform another DNS lookup to get it.
1301
1302 Arguments:
1303 domain pointer to optional parameter following verify = csa
1304
1305 Returns: CSA_UNKNOWN no valid CSA record found
1306 CSA_OK successfully authorized
1307 CSA_FAIL_* client is definitely not authorized
1308 CSA_DEFER_* there was a DNS problem
1309 */
1310
1311 static int
1312 acl_verify_csa(const uschar *domain)
1313 {
1314 tree_node *t;
1315 const uschar *found;
1316 int priority, weight, port;
1317 dns_answer dnsa;
1318 dns_scan dnss;
1319 dns_record *rr;
1320 int rc, type;
1321 uschar target[256];
1322
1323 /* Work out the domain we are using for the CSA lookup. The default is the
1324 client's HELO domain. If the client has not said HELO, use its IP address
1325 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1326
1327 while (isspace(*domain) && *domain != '\0') ++domain;
1328 if (*domain == '\0') domain = sender_helo_name;
1329 if (domain == NULL) domain = sender_host_address;
1330 if (sender_host_address == NULL) return CSA_UNKNOWN;
1331
1332 /* If we have an address literal, strip off the framing ready for turning it
1333 into a domain. The framing consists of matched square brackets possibly
1334 containing a keyword and a colon before the actual IP address. */
1335
1336 if (domain[0] == '[')
1337 {
1338 const uschar *start = Ustrchr(domain, ':');
1339 if (start == NULL) start = domain;
1340 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1341 }
1342
1343 /* Turn domains that look like bare IP addresses into domains in the reverse
1344 DNS. This code also deals with address literals and $sender_host_address. It's
1345 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1346 address literals, but it's probably the most friendly thing to do. This is an
1347 extension to CSA, so we allow it to be turned off for proper conformance. */
1348
1349 if (string_is_ip_address(domain, NULL) != 0)
1350 {
1351 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1352 dns_build_reverse(domain, target);
1353 domain = target;
1354 }
1355
1356 /* Find out if we've already done the CSA check for this domain. If we have,
1357 return the same result again. Otherwise build a new cached result structure
1358 for this domain. The name is filled in now, and the value is filled in when
1359 we return from this function. */
1360
1361 t = tree_search(csa_cache, domain);
1362 if (t != NULL) return t->data.val;
1363
1364 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1365 Ustrcpy(t->name, domain);
1366 (void)tree_insertnode(&csa_cache, t);
1367
1368 /* Now we are ready to do the actual DNS lookup(s). */
1369
1370 found = domain;
1371 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1372 {
1373 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1374
1375 default:
1376 return t->data.val = CSA_DEFER_SRV;
1377
1378 /* If we found nothing, the client's authorization is unknown. */
1379
1380 case DNS_NOMATCH:
1381 case DNS_NODATA:
1382 return t->data.val = CSA_UNKNOWN;
1383
1384 /* We got something! Go on to look at the reply in more detail. */
1385
1386 case DNS_SUCCEED:
1387 break;
1388 }
1389
1390 /* Scan the reply for well-formed CSA SRV records. */
1391
1392 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1393 rr;
1394 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1395 {
1396 const uschar * p = rr->data;
1397
1398 /* Extract the numerical SRV fields (p is incremented) */
1399
1400 GETSHORT(priority, p);
1401 GETSHORT(weight, p);
1402 GETSHORT(port, p);
1403
1404 DEBUG(D_acl)
1405 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1406
1407 /* Check the CSA version number */
1408
1409 if (priority != 1) continue;
1410
1411 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1412 found by dns_special_lookup() is a parent of the one we asked for), we check
1413 the subdomain assertions in the port field. At the moment there's only one
1414 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1415 SRV records of their own. */
1416
1417 if (Ustrcmp(found, domain) != 0)
1418 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1419
1420 /* This CSA SRV record refers directly to our domain, so we check the value
1421 in the weight field to work out the domain's authorization. 0 and 1 are
1422 unauthorized; 3 means the client is authorized but we can't check the IP
1423 address in order to authenticate it, so we treat it as unknown; values
1424 greater than 3 are undefined. */
1425
1426 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1427
1428 if (weight > 2) continue;
1429
1430 /* Weight == 2, which means the domain is authorized. We must check that the
1431 client's IP address is listed as one of the SRV target addresses. Save the
1432 target hostname then break to scan the additional data for its addresses. */
1433
1434 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1435 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1436
1437 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1438
1439 break;
1440 }
1441
1442 /* If we didn't break the loop then no appropriate records were found. */
1443
1444 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1445
1446 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1447 A target of "." indicates there are no valid addresses, so the client cannot
1448 be authorized. (This is an odd configuration because weight=2 target=. is
1449 equivalent to weight=1, but we check for it in order to keep load off the
1450 root name servers.) Note that dn_expand() turns "." into "". */
1451
1452 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1453
1454 /* Scan the additional section of the CSA SRV reply for addresses belonging
1455 to the target. If the name server didn't return any additional data (e.g.
1456 because it does not fully support SRV records), we need to do another lookup
1457 to obtain the target addresses; otherwise we have a definitive result. */
1458
1459 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1460 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1461
1462 /* The DNS lookup type corresponds to the IP version used by the client. */
1463
1464 #if HAVE_IPV6
1465 if (Ustrchr(sender_host_address, ':') != NULL)
1466 type = T_AAAA;
1467 else
1468 #endif /* HAVE_IPV6 */
1469 type = T_A;
1470
1471
1472 lookup_dnssec_authenticated = NULL;
1473 switch (dns_lookup(&dnsa, target, type, NULL))
1474 {
1475 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1476
1477 default:
1478 return t->data.val = CSA_DEFER_ADDR;
1479
1480 /* If the query succeeded, scan the addresses and return the result. */
1481
1482 case DNS_SUCCEED:
1483 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1484 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1485 /* else fall through */
1486
1487 /* If the target has no IP addresses, the client cannot have an authorized
1488 IP address. However, if the target site uses A6 records (not AAAA records)
1489 we have to do yet another lookup in order to check them. */
1490
1491 case DNS_NOMATCH:
1492 case DNS_NODATA:
1493 return t->data.val = CSA_FAIL_NOADDR;
1494 }
1495 }
1496
1497
1498
1499 /*************************************************
1500 * Handle verification (address & other) *
1501 *************************************************/
1502
1503 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1504 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1505 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1506 };
1507 typedef struct {
1508 uschar * name;
1509 int value;
1510 unsigned where_allowed; /* bitmap */
1511 BOOL no_options; /* Never has /option(s) following */
1512 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1513 } verify_type_t;
1514 static verify_type_t verify_type_list[] = {
1515 /* name value where no-opt opt-sep */
1516 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1517 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1518 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1519 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1520 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1521 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1522 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1523 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1524 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1525 FALSE, 6 },
1526 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1527 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1528 #ifdef EXPERIMENTAL_ARC
1529 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1530 #endif
1531 };
1532
1533
1534 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1535 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1536 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1537 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1538 };
1539 typedef struct {
1540 uschar * name;
1541 int value;
1542 int flag;
1543 BOOL has_option; /* Has =option(s) following */
1544 BOOL timeval; /* Has a time value */
1545 } callout_opt_t;
1546 static callout_opt_t callout_opt_list[] = {
1547 /* name value flag has-opt has-time */
1548 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1549 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1550 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1551 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1552 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1553 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1554 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1555 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1556 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1557 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1558 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1559 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1560 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1561 };
1562
1563
1564
1565 /* This function implements the "verify" condition. It is called when
1566 encountered in any ACL, because some tests are almost always permitted. Some
1567 just don't make sense, and always fail (for example, an attempt to test a host
1568 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1569
1570 Arguments:
1571 where where called from
1572 addr the recipient address that the ACL is handling, or NULL
1573 arg the argument of "verify"
1574 user_msgptr pointer for user message
1575 log_msgptr pointer for log message
1576 basic_errno where to put verify errno
1577
1578 Returns: OK verification condition succeeded
1579 FAIL verification failed
1580 DEFER there was a problem verifying
1581 ERROR syntax error
1582 */
1583
1584 static int
1585 acl_verify(int where, address_item *addr, const uschar *arg,
1586 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1587 {
1588 int sep = '/';
1589 int callout = -1;
1590 int callout_overall = -1;
1591 int callout_connect = -1;
1592 int verify_options = 0;
1593 int rc;
1594 BOOL verify_header_sender = FALSE;
1595 BOOL defer_ok = FALSE;
1596 BOOL callout_defer_ok = FALSE;
1597 BOOL no_details = FALSE;
1598 BOOL success_on_redirect = FALSE;
1599 address_item *sender_vaddr = NULL;
1600 uschar *verify_sender_address = NULL;
1601 uschar *pm_mailfrom = NULL;
1602 uschar *se_mailfrom = NULL;
1603
1604 /* Some of the verify items have slash-separated options; some do not. Diagnose
1605 an error if options are given for items that don't expect them.
1606 */
1607
1608 uschar *slash = Ustrchr(arg, '/');
1609 const uschar *list = arg;
1610 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1611 verify_type_t * vp;
1612
1613 if (!ss) goto BAD_VERIFY;
1614
1615 /* Handle name/address consistency verification in a separate function. */
1616
1617 for (vp= verify_type_list;
1618 CS vp < CS verify_type_list + sizeof(verify_type_list);
1619 vp++
1620 )
1621 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1622 : strcmpic (ss, vp->name) == 0)
1623 break;
1624 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1625 goto BAD_VERIFY;
1626
1627 if (vp->no_options && slash)
1628 {
1629 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1630 "(this verify item has no options)", arg);
1631 return ERROR;
1632 }
1633 if (!(vp->where_allowed & BIT(where)))
1634 {
1635 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1636 vp->name, acl_wherenames[where]);
1637 return ERROR;
1638 }
1639 switch(vp->value)
1640 {
1641 case VERIFY_REV_HOST_LKUP:
1642 if (!sender_host_address) return OK;
1643 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1644 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1645 if (strcmpic(ss, US"defer_ok") == 0)
1646 return OK;
1647 return rc;
1648
1649 case VERIFY_CERT:
1650 /* TLS certificate verification is done at STARTTLS time; here we just
1651 test whether it was successful or not. (This is for optional verification; for
1652 mandatory verification, the connection doesn't last this long.) */
1653
1654 if (tls_in.certificate_verified) return OK;
1655 *user_msgptr = US"no verified certificate";
1656 return FAIL;
1657
1658 case VERIFY_HELO:
1659 /* We can test the result of optional HELO verification that might have
1660 occurred earlier. If not, we can attempt the verification now. */
1661
1662 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1663 return helo_verified ? OK : FAIL;
1664
1665 case VERIFY_CSA:
1666 /* Do Client SMTP Authorization checks in a separate function, and turn the
1667 result code into user-friendly strings. */
1668
1669 rc = acl_verify_csa(list);
1670 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1671 csa_reason_string[rc]);
1672 csa_status = csa_status_string[rc];
1673 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1674 return csa_return_code[rc];
1675
1676 #ifdef EXPERIMENTAL_ARC
1677 case VERIFY_ARC:
1678 { /* Do Authenticated Received Chain checks in a separate function. */
1679 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1680 int csep = 0;
1681 uschar * cond;
1682
1683 if (!(arc_state = acl_verify_arc())) return DEFER;
1684 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1685 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1686
1687 if (!condlist) condlist = US"none:pass";
1688 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1689 if (Ustrcmp(arc_state, cond) == 0) return OK;
1690 return FAIL;
1691 }
1692 #endif
1693
1694 case VERIFY_HDR_SYNTAX:
1695 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1696 a syntax error, we return details of the error to the sender if configured to
1697 send out full details. (But a "message" setting on the ACL can override, as
1698 always). */
1699
1700 rc = verify_check_headers(log_msgptr);
1701 if (rc != OK && *log_msgptr)
1702 if (smtp_return_error_details)
1703 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1704 else
1705 acl_verify_message = *log_msgptr;
1706 return rc;
1707
1708 case VERIFY_HDR_NAMES_ASCII:
1709 /* Check that all header names are true 7 bit strings
1710 See RFC 5322, 2.2. and RFC 6532, 3. */
1711
1712 rc = verify_check_header_names_ascii(log_msgptr);
1713 if (rc != OK && smtp_return_error_details && *log_msgptr)
1714 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1715 return rc;
1716
1717 case VERIFY_NOT_BLIND:
1718 /* Check that no recipient of this message is "blind", that is, every envelope
1719 recipient must be mentioned in either To: or Cc:. */
1720
1721 if ((rc = verify_check_notblind()) != OK)
1722 {
1723 *log_msgptr = string_sprintf("bcc recipient detected");
1724 if (smtp_return_error_details)
1725 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1726 }
1727 return rc;
1728
1729 /* The remaining verification tests check recipient and sender addresses,
1730 either from the envelope or from the header. There are a number of
1731 slash-separated options that are common to all of them. */
1732
1733 case VERIFY_HDR_SNDR:
1734 verify_header_sender = TRUE;
1735 break;
1736
1737 case VERIFY_SNDR:
1738 /* In the case of a sender, this can optionally be followed by an address to use
1739 in place of the actual sender (rare special-case requirement). */
1740 {
1741 uschar *s = ss + 6;
1742 if (*s == 0)
1743 verify_sender_address = sender_address;
1744 else
1745 {
1746 while (isspace(*s)) s++;
1747 if (*s++ != '=') goto BAD_VERIFY;
1748 while (isspace(*s)) s++;
1749 verify_sender_address = string_copy(s);
1750 }
1751 }
1752 break;
1753
1754 case VERIFY_RCPT:
1755 break;
1756 }
1757
1758
1759
1760 /* Remaining items are optional; they apply to sender and recipient
1761 verification, including "header sender" verification. */
1762
1763 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1764 != NULL)
1765 {
1766 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1767 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1768 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1769
1770 /* These two old options are left for backwards compatibility */
1771
1772 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1773 {
1774 callout_defer_ok = TRUE;
1775 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1776 }
1777
1778 else if (strcmpic(ss, US"check_postmaster") == 0)
1779 {
1780 pm_mailfrom = US"";
1781 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1782 }
1783
1784 /* The callout option has a number of sub-options, comma separated */
1785
1786 else if (strncmpic(ss, US"callout", 7) == 0)
1787 {
1788 callout = CALLOUT_TIMEOUT_DEFAULT;
1789 ss += 7;
1790 if (*ss != 0)
1791 {
1792 while (isspace(*ss)) ss++;
1793 if (*ss++ == '=')
1794 {
1795 const uschar * sublist = ss;
1796 int optsep = ',';
1797 uschar *opt;
1798 uschar buffer[256];
1799 while (isspace(*sublist)) sublist++;
1800
1801 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1802 {
1803 callout_opt_t * op;
1804 double period = 1.0F;
1805
1806 for (op= callout_opt_list; op->name; op++)
1807 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1808 break;
1809
1810 verify_options |= op->flag;
1811 if (op->has_option)
1812 {
1813 opt += Ustrlen(op->name);
1814 while (isspace(*opt)) opt++;
1815 if (*opt++ != '=')
1816 {
1817 *log_msgptr = string_sprintf("'=' expected after "
1818 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1819 return ERROR;
1820 }
1821 while (isspace(*opt)) opt++;
1822 }
1823 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1824 {
1825 *log_msgptr = string_sprintf("bad time value in ACL condition "
1826 "\"verify %s\"", arg);
1827 return ERROR;
1828 }
1829
1830 switch(op->value)
1831 {
1832 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1833 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1834 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1835 case CALLOUT_MAILFROM:
1836 if (!verify_header_sender)
1837 {
1838 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1839 "callout option only for verify=header_sender (detected in ACL "
1840 "condition \"%s\")", arg);
1841 return ERROR;
1842 }
1843 se_mailfrom = string_copy(opt);
1844 break;
1845 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1846 case CALLOUT_MAXWAIT: callout_overall = period; break;
1847 case CALLOUT_CONNECT: callout_connect = period; break;
1848 case CALLOUT_TIME: callout = period; break;
1849 }
1850 }
1851 }
1852 else
1853 {
1854 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1855 "ACL condition \"%s\"", arg);
1856 return ERROR;
1857 }
1858 }
1859 }
1860
1861 /* Option not recognized */
1862
1863 else
1864 {
1865 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1866 "condition \"verify %s\"", ss, arg);
1867 return ERROR;
1868 }
1869 }
1870
1871 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1872 (vopt_callout_recipsender|vopt_callout_recippmaster))
1873 {
1874 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1875 "for a recipient callout";
1876 return ERROR;
1877 }
1878
1879 /* Handle sender-in-header verification. Default the user message to the log
1880 message if giving out verification details. */
1881
1882 if (verify_header_sender)
1883 {
1884 int verrno;
1885
1886 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1887 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1888 &verrno)) != OK)
1889 {
1890 *basic_errno = verrno;
1891 if (smtp_return_error_details)
1892 {
1893 if (!*user_msgptr && *log_msgptr)
1894 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1895 if (rc == DEFER) acl_temp_details = TRUE;
1896 }
1897 }
1898 }
1899
1900 /* Handle a sender address. The default is to verify *the* sender address, but
1901 optionally a different address can be given, for special requirements. If the
1902 address is empty, we are dealing with a bounce message that has no sender, so
1903 we cannot do any checking. If the real sender address gets rewritten during
1904 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1905 during message reception.
1906
1907 A list of verified "sender" addresses is kept to try to avoid doing to much
1908 work repetitively when there are multiple recipients in a message and they all
1909 require sender verification. However, when callouts are involved, it gets too
1910 complicated because different recipients may require different callout options.
1911 Therefore, we always do a full sender verify when any kind of callout is
1912 specified. Caching elsewhere, for instance in the DNS resolver and in the
1913 callout handling, should ensure that this is not terribly inefficient. */
1914
1915 else if (verify_sender_address)
1916 {
1917 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1918 {
1919 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1920 "sender verify callout";
1921 return ERROR;
1922 }
1923
1924 sender_vaddr = verify_checked_sender(verify_sender_address);
1925 if (sender_vaddr != NULL && /* Previously checked */
1926 callout <= 0) /* No callout needed this time */
1927 {
1928 /* If the "routed" flag is set, it means that routing worked before, so
1929 this check can give OK (the saved return code value, if set, belongs to a
1930 callout that was done previously). If the "routed" flag is not set, routing
1931 must have failed, so we use the saved return code. */
1932
1933 if (testflag(sender_vaddr, af_verify_routed))
1934 rc = OK;
1935 else
1936 {
1937 rc = sender_vaddr->special_action;
1938 *basic_errno = sender_vaddr->basic_errno;
1939 }
1940 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1941 }
1942
1943 /* Do a new verification, and cache the result. The cache is used to avoid
1944 verifying the sender multiple times for multiple RCPTs when callouts are not
1945 specified (see comments above).
1946
1947 The cache is also used on failure to give details in response to the first
1948 RCPT that gets bounced for this reason. However, this can be suppressed by
1949 the no_details option, which sets the flag that says "this detail has already
1950 been sent". The cache normally contains just one address, but there may be
1951 more in esoteric circumstances. */
1952
1953 else
1954 {
1955 BOOL routed = TRUE;
1956 uschar *save_address_data = deliver_address_data;
1957
1958 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1959 #ifdef SUPPORT_I18N
1960 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1961 {
1962 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1963 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1964 }
1965 #endif
1966 if (no_details) setflag(sender_vaddr, af_sverify_told);
1967 if (verify_sender_address[0] != 0)
1968 {
1969 /* If this is the real sender address, save the unrewritten version
1970 for use later in receive. Otherwise, set a flag so that rewriting the
1971 sender in verify_address() does not update sender_address. */
1972
1973 if (verify_sender_address == sender_address)
1974 sender_address_unrewritten = sender_address;
1975 else
1976 verify_options |= vopt_fake_sender;
1977
1978 if (success_on_redirect)
1979 verify_options |= vopt_success_on_redirect;
1980
1981 /* The recipient, qualify, and expn options are never set in
1982 verify_options. */
1983
1984 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1985 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1986
1987 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
1988
1989 if (rc != OK)
1990 *basic_errno = sender_vaddr->basic_errno;
1991 else
1992 DEBUG(D_acl)
1993 {
1994 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1995 debug_printf_indent("sender %s verified ok as %s\n",
1996 verify_sender_address, sender_vaddr->address);
1997 else
1998 debug_printf_indent("sender %s verified ok\n",
1999 verify_sender_address);
2000 }
2001 }
2002 else
2003 rc = OK; /* Null sender */
2004
2005 /* Cache the result code */
2006
2007 if (routed) setflag(sender_vaddr, af_verify_routed);
2008 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2009 sender_vaddr->special_action = rc;
2010 sender_vaddr->next = sender_verified_list;
2011 sender_verified_list = sender_vaddr;
2012
2013 /* Restore the recipient address data, which might have been clobbered by
2014 the sender verification. */
2015
2016 deliver_address_data = save_address_data;
2017 }
2018
2019 /* Put the sender address_data value into $sender_address_data */
2020
2021 sender_address_data = sender_vaddr->prop.address_data;
2022 }
2023
2024 /* A recipient address just gets a straightforward verify; again we must handle
2025 the DEFER overrides. */
2026
2027 else
2028 {
2029 address_item addr2;
2030
2031 if (success_on_redirect)
2032 verify_options |= vopt_success_on_redirect;
2033
2034 /* We must use a copy of the address for verification, because it might
2035 get rewritten. */
2036
2037 addr2 = *addr;
2038 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2039 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2040 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2041
2042 *basic_errno = addr2.basic_errno;
2043 *log_msgptr = addr2.message;
2044 *user_msgptr = (addr2.user_message != NULL)?
2045 addr2.user_message : addr2.message;
2046
2047 /* Allow details for temporary error if the address is so flagged. */
2048 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
2049
2050 /* Make $address_data visible */
2051 deliver_address_data = addr2.prop.address_data;
2052 }
2053
2054 /* We have a result from the relevant test. Handle defer overrides first. */
2055
2056 if (rc == DEFER && (defer_ok ||
2057 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2058 {
2059 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2060 defer_ok? "defer_ok" : "callout_defer_ok");
2061 rc = OK;
2062 }
2063
2064 /* If we've failed a sender, set up a recipient message, and point
2065 sender_verified_failed to the address item that actually failed. */
2066
2067 if (rc != OK && verify_sender_address != NULL)
2068 {
2069 if (rc != DEFER)
2070 *log_msgptr = *user_msgptr = US"Sender verify failed";
2071 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2072 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2073 else
2074 {
2075 *log_msgptr = US"Could not complete sender verify callout";
2076 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2077 *log_msgptr;
2078 }
2079
2080 sender_verified_failed = sender_vaddr;
2081 }
2082
2083 /* Verifying an address messes up the values of $domain and $local_part,
2084 so reset them before returning if this is a RCPT ACL. */
2085
2086 if (addr != NULL)
2087 {
2088 deliver_domain = addr->domain;
2089 deliver_localpart = addr->local_part;
2090 }
2091 return rc;
2092
2093 /* Syntax errors in the verify argument come here. */
2094
2095 BAD_VERIFY:
2096 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2097 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2098 "or \"reverse_host_lookup\" at start of ACL condition "
2099 "\"verify %s\"", arg);
2100 return ERROR;
2101 }
2102
2103
2104
2105
2106 /*************************************************
2107 * Check argument for control= modifier *
2108 *************************************************/
2109
2110 /* Called from acl_check_condition() below
2111
2112 Arguments:
2113 arg the argument string for control=
2114 pptr set to point to the terminating character
2115 where which ACL we are in
2116 log_msgptr for error messages
2117
2118 Returns: CONTROL_xxx value
2119 */
2120
2121 static int
2122 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2123 {
2124 int idx, len;
2125 control_def * d;
2126
2127 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2128 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2129 && (!d->has_option || arg[len] != '/')
2130 ) )
2131 {
2132 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2133 return CONTROL_ERROR;
2134 }
2135
2136 *pptr = arg + len;
2137 return idx;
2138 }
2139
2140
2141
2142
2143 /*************************************************
2144 * Return a ratelimit error *
2145 *************************************************/
2146
2147 /* Called from acl_ratelimit() below
2148
2149 Arguments:
2150 log_msgptr for error messages
2151 format format string
2152 ... supplementary arguments
2153 ss ratelimit option name
2154 where ACL_WHERE_xxxx indicating which ACL this is
2155
2156 Returns: ERROR
2157 */
2158
2159 static int
2160 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2161 {
2162 va_list ap;
2163 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2164 va_start(ap, format);
2165 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2166 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2167 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2168 va_end(ap);
2169 *log_msgptr = string_sprintf(
2170 "error in arguments to \"ratelimit\" condition: %s", buffer);
2171 return ERROR;
2172 }
2173
2174
2175
2176
2177 /*************************************************
2178 * Handle rate limiting *
2179 *************************************************/
2180
2181 /* Called by acl_check_condition() below to calculate the result
2182 of the ACL ratelimit condition.
2183
2184 Note that the return value might be slightly unexpected: if the
2185 sender's rate is above the limit then the result is OK. This is
2186 similar to the dnslists condition, and is so that you can write
2187 ACL clauses like: defer ratelimit = 15 / 1h
2188
2189 Arguments:
2190 arg the option string for ratelimit=
2191 where ACL_WHERE_xxxx indicating which ACL this is
2192 log_msgptr for error messages
2193
2194 Returns: OK - Sender's rate is above limit
2195 FAIL - Sender's rate is below limit
2196 DEFER - Problem opening ratelimit database
2197 ERROR - Syntax error in options.
2198 */
2199
2200 static int
2201 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2202 {
2203 double limit, period, count;
2204 uschar *ss;
2205 uschar *key = NULL;
2206 uschar *unique = NULL;
2207 int sep = '/';
2208 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2209 BOOL noupdate = FALSE, badacl = FALSE;
2210 int mode = RATE_PER_WHAT;
2211 int old_pool, rc;
2212 tree_node **anchor, *t;
2213 open_db dbblock, *dbm;
2214 int dbdb_size;
2215 dbdata_ratelimit *dbd;
2216 dbdata_ratelimit_unique *dbdb;
2217 struct timeval tv;
2218
2219 /* Parse the first two options and record their values in expansion
2220 variables. These variables allow the configuration to have informative
2221 error messages based on rate limits obtained from a table lookup. */
2222
2223 /* First is the maximum number of messages per period / maximum burst
2224 size, which must be greater than or equal to zero. Zero is useful for
2225 rate measurement as opposed to rate limiting. */
2226
2227 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2228 return ratelimit_error(log_msgptr, "sender rate limit not set");
2229
2230 limit = Ustrtod(sender_rate_limit, &ss);
2231 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2232 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2233 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2234
2235 if (limit < 0.0 || *ss != '\0')
2236 return ratelimit_error(log_msgptr,
2237 "\"%s\" is not a positive number", sender_rate_limit);
2238
2239 /* Second is the rate measurement period / exponential smoothing time
2240 constant. This must be strictly greater than zero, because zero leads to
2241 run-time division errors. */
2242
2243 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2244 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2245 if (period <= 0.0)
2246 return ratelimit_error(log_msgptr,
2247 "\"%s\" is not a time value", sender_rate_period);
2248
2249 /* By default we are counting one of something, but the per_rcpt,
2250 per_byte, and count options can change this. */
2251
2252 count = 1.0;
2253
2254 /* Parse the other options. */
2255
2256 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
2257 {
2258 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2259 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2260 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2261 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2262 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2263 else if (strcmpic(ss, US"per_conn") == 0)
2264 {
2265 RATE_SET(mode, PER_CONN);
2266 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2267 badacl = TRUE;
2268 }
2269 else if (strcmpic(ss, US"per_mail") == 0)
2270 {
2271 RATE_SET(mode, PER_MAIL);
2272 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2273 }
2274 else if (strcmpic(ss, US"per_rcpt") == 0)
2275 {
2276 /* If we are running in the RCPT ACL, then we'll count the recipients
2277 one by one, but if we are running when we have accumulated the whole
2278 list then we'll add them all in one batch. */
2279 if (where == ACL_WHERE_RCPT)
2280 RATE_SET(mode, PER_RCPT);
2281 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2282 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2283 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2284 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2285 }
2286 else if (strcmpic(ss, US"per_byte") == 0)
2287 {
2288 /* If we have not yet received the message data and there was no SIZE
2289 declaration on the MAIL command, then it's safe to just use a value of
2290 zero and let the recorded rate decay as if nothing happened. */
2291 RATE_SET(mode, PER_MAIL);
2292 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2293 else count = message_size < 0 ? 0.0 : (double)message_size;
2294 }
2295 else if (strcmpic(ss, US"per_addr") == 0)
2296 {
2297 RATE_SET(mode, PER_RCPT);
2298 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2299 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2300 }
2301 else if (strncmpic(ss, US"count=", 6) == 0)
2302 {
2303 uschar *e;
2304 count = Ustrtod(ss+6, &e);
2305 if (count < 0.0 || *e != '\0')
2306 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2307 }
2308 else if (strncmpic(ss, US"unique=", 7) == 0)
2309 unique = string_copy(ss + 7);
2310 else if (!key)
2311 key = string_copy(ss);
2312 else
2313 key = string_sprintf("%s/%s", key, ss);
2314 }
2315
2316 /* Sanity check. When the badacl flag is set the update mode must either
2317 be readonly (which is the default if it is omitted) or, for backwards
2318 compatibility, a combination of noupdate and strict or leaky. */
2319
2320 if (mode == RATE_PER_CLASH)
2321 return ratelimit_error(log_msgptr, "conflicting per_* options");
2322 if (leaky + strict + readonly > 1)
2323 return ratelimit_error(log_msgptr, "conflicting update modes");
2324 if (badacl && (leaky || strict) && !noupdate)
2325 return ratelimit_error(log_msgptr,
2326 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2327 ratelimit_option_string[mode], acl_wherenames[where]);
2328
2329 /* Set the default values of any unset options. In readonly mode we
2330 perform the rate computation without any increment so that its value
2331 decays to eventually allow over-limit senders through. */
2332
2333 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2334 if (badacl) readonly = TRUE;
2335 if (readonly) count = 0.0;
2336 if (!strict && !readonly) leaky = TRUE;
2337 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2338
2339 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2340 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2341 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2342 are added to the key because they alter the meaning of the stored data. */
2343
2344 if (!key)
2345 key = !sender_host_address ? US"" : sender_host_address;
2346
2347 key = string_sprintf("%s/%s/%s%s",
2348 sender_rate_period,
2349 ratelimit_option_string[mode],
2350 unique == NULL ? "" : "unique/",
2351 key);
2352
2353 HDEBUG(D_acl)
2354 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2355
2356 /* See if we have already computed the rate by looking in the relevant tree.
2357 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2358 pool so that they survive across resets. In readonly mode we only remember the
2359 result for the rest of this command in case a later command changes it. After
2360 this bit of logic the code is independent of the per_* mode. */
2361
2362 old_pool = store_pool;
2363
2364 if (readonly)
2365 anchor = &ratelimiters_cmd;
2366 else switch(mode)
2367 {
2368 case RATE_PER_CONN:
2369 anchor = &ratelimiters_conn;
2370 store_pool = POOL_PERM;
2371 break;
2372 case RATE_PER_BYTE:
2373 case RATE_PER_MAIL:
2374 case RATE_PER_ALLRCPTS:
2375 anchor = &ratelimiters_mail;
2376 break;
2377 case RATE_PER_ADDR:
2378 case RATE_PER_CMD:
2379 case RATE_PER_RCPT:
2380 anchor = &ratelimiters_cmd;
2381 break;
2382 default:
2383 anchor = NULL; /* silence an "unused" complaint */
2384 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2385 "internal ACL error: unknown ratelimit mode %d", mode);
2386 break;
2387 }
2388
2389 if ((t = tree_search(*anchor, key)))
2390 {
2391 dbd = t->data.ptr;
2392 /* The following few lines duplicate some of the code below. */
2393 rc = (dbd->rate < limit)? FAIL : OK;
2394 store_pool = old_pool;
2395 sender_rate = string_sprintf("%.1f", dbd->rate);
2396 HDEBUG(D_acl)
2397 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2398 return rc;
2399 }
2400
2401 /* We aren't using a pre-computed rate, so get a previously recorded rate
2402 from the database, which will be updated and written back if required. */
2403
2404 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2405 {
2406 store_pool = old_pool;
2407 sender_rate = NULL;
2408 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2409 *log_msgptr = US"ratelimit database not available";
2410 return DEFER;
2411 }
2412 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2413 dbd = NULL;
2414
2415 gettimeofday(&tv, NULL);
2416
2417 if (dbdb)
2418 {
2419 /* Locate the basic ratelimit block inside the DB data. */
2420 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2421 dbd = &dbdb->dbd;
2422
2423 /* Forget the old Bloom filter if it is too old, so that we count each
2424 repeating event once per period. We don't simply clear and re-use the old
2425 filter because we want its size to change if the limit changes. Note that
2426 we keep the dbd pointer for copying the rate into the new data block. */
2427
2428 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2429 {
2430 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2431 dbdb = NULL;
2432 }
2433
2434 /* Sanity check. */
2435
2436 if(unique && dbdb_size < sizeof(*dbdb))
2437 {
2438 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2439 dbdb = NULL;
2440 }
2441 }
2442
2443 /* Allocate a new data block if the database lookup failed
2444 or the Bloom filter passed its age limit. */
2445
2446 if (!dbdb)
2447 {
2448 if (!unique)
2449 {
2450 /* No Bloom filter. This basic ratelimit block is initialized below. */
2451 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2452 dbdb_size = sizeof(*dbd);
2453 dbdb = store_get(dbdb_size);
2454 }
2455 else
2456 {
2457 int extra;
2458 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2459
2460 /* See the long comment below for an explanation of the magic number 2.
2461 The filter has a minimum size in case the rate limit is very small;
2462 this is determined by the definition of dbdata_ratelimit_unique. */
2463
2464 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2465 if (extra < 0) extra = 0;
2466 dbdb_size = sizeof(*dbdb) + extra;
2467 dbdb = store_get(dbdb_size);
2468 dbdb->bloom_epoch = tv.tv_sec;
2469 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2470 memset(dbdb->bloom, 0, dbdb->bloom_size);
2471
2472 /* Preserve any basic ratelimit data (which is our longer-term memory)
2473 by copying it from the discarded block. */
2474
2475 if (dbd)
2476 {
2477 dbdb->dbd = *dbd;
2478 dbd = &dbdb->dbd;
2479 }
2480 }
2481 }
2482
2483 /* If we are counting unique events, find out if this event is new or not.
2484 If the client repeats the event during the current period then it should be
2485 counted. We skip this code in readonly mode for efficiency, because any
2486 changes to the filter will be discarded and because count is already set to
2487 zero. */
2488
2489 if (unique && !readonly)
2490 {
2491 /* We identify unique events using a Bloom filter. (You can find my
2492 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2493 With the per_addr option, an "event" is a recipient address, though the
2494 user can use the unique option to define their own events. We only count
2495 an event if we have not seen it before.
2496
2497 We size the filter according to the rate limit, which (in leaky mode)
2498 is the limit on the population of the filter. We allow 16 bits of space
2499 per entry (see the construction code above) and we set (up to) 8 of them
2500 when inserting an element (see the loop below). The probability of a false
2501 positive (an event we have not seen before but which we fail to count) is
2502
2503 size = limit * 16
2504 numhash = 8
2505 allzero = exp(-numhash * pop / size)
2506 = exp(-0.5 * pop / limit)
2507 fpr = pow(1 - allzero, numhash)
2508
2509 For senders at the limit the fpr is 0.06% or 1 in 1700
2510 and for senders at half the limit it is 0.0006% or 1 in 170000
2511
2512 In strict mode the Bloom filter can fill up beyond the normal limit, in
2513 which case the false positive rate will rise. This means that the
2514 measured rate for very fast senders can bogusly drop off after a while.
2515
2516 At twice the limit, the fpr is 2.5% or 1 in 40
2517 At four times the limit, it is 31% or 1 in 3.2
2518
2519 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2520 decay below the limit, and if this is more than one then the Bloom filter
2521 will be discarded before the decay gets that far. The false positive rate
2522 at this threshold is 9.3% or 1 in 10.7. */
2523
2524 BOOL seen;
2525 unsigned n, hash, hinc;
2526 uschar md5sum[16];
2527 md5 md5info;
2528
2529 /* Instead of using eight independent hash values, we combine two values
2530 using the formula h1 + n * h2. This does not harm the Bloom filter's
2531 performance, and means the amount of hash we need is independent of the
2532 number of bits we set in the filter. */
2533
2534 md5_start(&md5info);
2535 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2536 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2537 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2538
2539 /* Scan the bits corresponding to this event. A zero bit means we have
2540 not seen it before. Ensure all bits are set to record this event. */
2541
2542 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2543
2544 seen = TRUE;
2545 for (n = 0; n < 8; n++, hash += hinc)
2546 {
2547 int bit = 1 << (hash % 8);
2548 int byte = (hash / 8) % dbdb->bloom_size;
2549 if ((dbdb->bloom[byte] & bit) == 0)
2550 {
2551 dbdb->bloom[byte] |= bit;
2552 seen = FALSE;
2553 }
2554 }
2555
2556 /* If this event has occurred before, do not count it. */
2557
2558 if (seen)
2559 {
2560 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2561 count = 0.0;
2562 }
2563 else
2564 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2565 }
2566
2567 /* If there was no previous ratelimit data block for this key, initialize
2568 the new one, otherwise update the block from the database. The initial rate
2569 is what would be computed by the code below for an infinite interval. */
2570
2571 if (!dbd)
2572 {
2573 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2574 dbd = &dbdb->dbd;
2575 dbd->time_stamp = tv.tv_sec;
2576 dbd->time_usec = tv.tv_usec;
2577 dbd->rate = count;
2578 }
2579 else
2580 {
2581 /* The smoothed rate is computed using an exponentially weighted moving
2582 average adjusted for variable sampling intervals. The standard EWMA for
2583 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2584 where f() is the measured value and f'() is the smoothed value.
2585
2586 Old data decays out of the smoothed value exponentially, such that data n
2587 samples old is multiplied by a^n. The exponential decay time constant p
2588 is defined such that data p samples old is multiplied by 1/e, which means
2589 that a = exp(-1/p). We can maintain the same time constant for a variable
2590 sampling interval i by using a = exp(-i/p).
2591
2592 The rate we are measuring is messages per period, suitable for directly
2593 comparing with the limit. The average rate between now and the previous
2594 message is period / interval, which we feed into the EWMA as the sample.
2595
2596 It turns out that the number of messages required for the smoothed rate
2597 to reach the limit when they are sent in a burst is equal to the limit.
2598 This can be seen by analysing the value of the smoothed rate after N
2599 messages sent at even intervals. Let k = (1 - a) * p/i
2600
2601 rate_1 = (1 - a) * p/i + a * rate_0
2602 = k + a * rate_0
2603 rate_2 = k + a * rate_1
2604 = k + a * k + a^2 * rate_0
2605 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2606 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2607 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2608 = rate_0 * a^N + p/i * (1 - a^N)
2609
2610 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2611
2612 rate_N = p/i + (rate_0 - p/i) * a^N
2613 a^N = (rate_N - p/i) / (rate_0 - p/i)
2614 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2615 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2616
2617 Numerical analysis of the above equation, setting the computed rate to
2618 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2619 rates, p/i, the number of messages N = limit. So limit serves as both the
2620 maximum rate measured in messages per period, and the maximum number of
2621 messages that can be sent in a fast burst. */
2622
2623 double this_time = (double)tv.tv_sec
2624 + (double)tv.tv_usec / 1000000.0;
2625 double prev_time = (double)dbd->time_stamp
2626 + (double)dbd->time_usec / 1000000.0;
2627
2628 /* We must avoid division by zero, and deal gracefully with the clock going
2629 backwards. If we blunder ahead when time is in reverse then the computed
2630 rate will be bogus. To be safe we clamp interval to a very small number. */
2631
2632 double interval = this_time - prev_time <= 0.0 ? 1e-9
2633 : this_time - prev_time;
2634
2635 double i_over_p = interval / period;
2636 double a = exp(-i_over_p);
2637
2638 /* Combine the instantaneous rate (period / interval) with the previous rate
2639 using the smoothing factor a. In order to measure sized events, multiply the
2640 instantaneous rate by the count of bytes or recipients etc. */
2641
2642 dbd->time_stamp = tv.tv_sec;
2643 dbd->time_usec = tv.tv_usec;
2644 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2645
2646 /* When events are very widely spaced the computed rate tends towards zero.
2647 Although this is accurate it turns out not to be useful for our purposes,
2648 especially when the first event after a long silence is the start of a spam
2649 run. A more useful model is that the rate for an isolated event should be the
2650 size of the event per the period size, ignoring the lack of events outside
2651 the current period and regardless of where the event falls in the period. So,
2652 if the interval was so long that the calculated rate is unhelpfully small, we
2653 re-initialize the rate. In the absence of higher-rate bursts, the condition
2654 below is true if the interval is greater than the period. */
2655
2656 if (dbd->rate < count) dbd->rate = count;
2657 }
2658
2659 /* Clients sending at the limit are considered to be over the limit.
2660 This matters for edge cases such as a limit of zero, when the client
2661 should be completely blocked. */
2662
2663 rc = dbd->rate < limit ? FAIL : OK;
2664
2665 /* Update the state if the rate is low or if we are being strict. If we
2666 are in leaky mode and the sender's rate is too high, we do not update
2667 the recorded rate in order to avoid an over-aggressive sender's retry
2668 rate preventing them from getting any email through. If readonly is set,
2669 neither leaky nor strict are set, so we do not do any updates. */
2670
2671 if ((rc == FAIL && leaky) || strict)
2672 {
2673 dbfn_write(dbm, key, dbdb, dbdb_size);
2674 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2675 }
2676 else
2677 {
2678 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2679 readonly? "readonly mode" : "over the limit, but leaky");
2680 }
2681
2682 dbfn_close(dbm);
2683
2684 /* Store the result in the tree for future reference. */
2685
2686 t = store_get(sizeof(tree_node) + Ustrlen(key));
2687 t->data.ptr = dbd;
2688 Ustrcpy(t->name, key);
2689 (void)tree_insertnode(anchor, t);
2690
2691 /* We create the formatted version of the sender's rate very late in
2692 order to ensure that it is done using the correct storage pool. */
2693
2694 store_pool = old_pool;
2695 sender_rate = string_sprintf("%.1f", dbd->rate);
2696
2697 HDEBUG(D_acl)
2698 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2699
2700 return rc;
2701 }
2702
2703
2704
2705 /*************************************************
2706 * The udpsend ACL modifier *
2707 *************************************************/
2708
2709 /* Called by acl_check_condition() below.
2710
2711 Arguments:
2712 arg the option string for udpsend=
2713 log_msgptr for error messages
2714
2715 Returns: OK - Completed.
2716 DEFER - Problem with DNS lookup.
2717 ERROR - Syntax error in options.
2718 */
2719
2720 static int
2721 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2722 {
2723 int sep = 0;
2724 uschar *hostname;
2725 uschar *portstr;
2726 uschar *portend;
2727 host_item *h;
2728 int portnum;
2729 int len;
2730 int r, s;
2731 uschar * errstr;
2732
2733 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2734 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2735
2736 if (!hostname)
2737 {
2738 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2739 return ERROR;
2740 }
2741 if (!portstr)
2742 {
2743 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2744 return ERROR;
2745 }
2746 if (!arg)
2747 {
2748 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2749 return ERROR;
2750 }
2751 portnum = Ustrtol(portstr, &portend, 10);
2752 if (*portend != '\0')
2753 {
2754 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2755 return ERROR;
2756 }
2757
2758 /* Make a single-item host list. */
2759 h = store_get(sizeof(host_item));
2760 memset(h, 0, sizeof(host_item));
2761 h->name = hostname;
2762 h->port = portnum;
2763 h->mx = MX_NONE;
2764
2765 if (string_is_ip_address(hostname, NULL))
2766 h->address = hostname, r = HOST_FOUND;
2767 else
2768 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2769 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2770 {
2771 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2772 return DEFER;
2773 }
2774
2775 HDEBUG(D_acl)
2776 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2777
2778 /*XXX this could better use sendto */
2779 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2780 1, NULL, &errstr, NULL);
2781 if (r < 0) goto defer;
2782 len = Ustrlen(arg);
2783 r = send(s, arg, len, 0);
2784 if (r < 0)
2785 {
2786 errstr = US strerror(errno);
2787 close(s);
2788 goto defer;
2789 }
2790 close(s);
2791 if (r < len)
2792 {
2793 *log_msgptr =
2794 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2795 return DEFER;
2796 }
2797
2798 HDEBUG(D_acl)
2799 debug_printf_indent("udpsend %d bytes\n", r);
2800
2801 return OK;
2802
2803 defer:
2804 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2805 return DEFER;
2806 }
2807
2808
2809
2810 /*************************************************
2811 * Handle conditions/modifiers on an ACL item *
2812 *************************************************/
2813
2814 /* Called from acl_check() below.
2815
2816 Arguments:
2817 verb ACL verb
2818 cb ACL condition block - if NULL, result is OK
2819 where where called from
2820 addr the address being checked for RCPT, or NULL
2821 level the nesting level
2822 epp pointer to pass back TRUE if "endpass" encountered
2823 (applies only to "accept" and "discard")
2824 user_msgptr user message pointer
2825 log_msgptr log message pointer
2826 basic_errno pointer to where to put verify error
2827
2828 Returns: OK - all conditions are met
2829 DISCARD - an "acl" condition returned DISCARD - only allowed
2830 for "accept" or "discard" verbs
2831 FAIL - at least one condition fails
2832 FAIL_DROP - an "acl" condition returned FAIL_DROP
2833 DEFER - can't tell at the moment (typically, lookup defer,
2834 but can be temporary callout problem)
2835 ERROR - ERROR from nested ACL or expansion failure or other
2836 error
2837 */
2838
2839 static int
2840 acl_check_condition(int verb, acl_condition_block *cb, int where,
2841 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2842 uschar **log_msgptr, int *basic_errno)
2843 {
2844 uschar *user_message = NULL;
2845 uschar *log_message = NULL;
2846 int rc = OK;
2847 #ifdef WITH_CONTENT_SCAN
2848 int sep = -'/';
2849 #endif
2850
2851 for (; cb; cb = cb->next)
2852 {
2853 const uschar *arg;
2854 int control_type;
2855
2856 /* The message and log_message items set up messages to be used in
2857 case of rejection. They are expanded later. */
2858
2859 if (cb->type == ACLC_MESSAGE)
2860 {
2861 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2862 user_message = cb->arg;
2863 continue;
2864 }
2865
2866 if (cb->type == ACLC_LOG_MESSAGE)
2867 {
2868 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2869 log_message = cb->arg;
2870 continue;
2871 }
2872
2873 /* The endpass "condition" just sets a flag to show it occurred. This is
2874 checked at compile time to be on an "accept" or "discard" item. */
2875
2876 if (cb->type == ACLC_ENDPASS)
2877 {
2878 *epp = TRUE;
2879 continue;
2880 }
2881
2882 /* For other conditions and modifiers, the argument is expanded now for some
2883 of them, but not for all, because expansion happens down in some lower level
2884 checking functions in some cases. */
2885
2886 if (!conditions[cb->type].expand_at_top)
2887 arg = cb->arg;
2888 else if (!(arg = expand_string(cb->arg)))
2889 {
2890 if (expand_string_forcedfail) continue;
2891 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2892 cb->arg, expand_string_message);
2893 return search_find_defer ? DEFER : ERROR;
2894 }
2895
2896 /* Show condition, and expanded condition if it's different */
2897
2898 HDEBUG(D_acl)
2899 {
2900 int lhswidth = 0;
2901 debug_printf_indent("check %s%s %n",
2902 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2903 conditions[cb->type].name, &lhswidth);
2904
2905 if (cb->type == ACLC_SET)
2906 {
2907 #ifndef DISABLE_DKIM
2908 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2909 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2910 {
2911 debug_printf("%s ", cb->u.varname);
2912 lhswidth += 19;
2913 }
2914 else
2915 #endif
2916 {
2917 debug_printf("acl_%s ", cb->u.varname);
2918 lhswidth += 5 + Ustrlen(cb->u.varname);
2919 }
2920 }
2921
2922 debug_printf("= %s\n", cb->arg);
2923
2924 if (arg != cb->arg)
2925 debug_printf("%.*s= %s\n", lhswidth,
2926 US" ", CS arg);
2927 }
2928
2929 /* Check that this condition makes sense at this time */
2930
2931 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2932 {
2933 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2934 conditions[cb->type].is_modifier ? "use" : "test",
2935 conditions[cb->type].name, acl_wherenames[where]);
2936 return ERROR;
2937 }
2938
2939 /* Run the appropriate test for each condition, or take the appropriate
2940 action for the remaining modifiers. */
2941
2942 switch(cb->type)
2943 {
2944 case ACLC_ADD_HEADER:
2945 setup_header(arg);
2946 break;
2947
2948 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2949 "discard" verb. */
2950
2951 case ACLC_ACL:
2952 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2953 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2954 {
2955 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2956 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2957 verbs[verb]);
2958 return ERROR;
2959 }
2960 break;
2961
2962 case ACLC_AUTHENTICATED:
2963 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2964 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2965 break;
2966
2967 #ifdef EXPERIMENTAL_BRIGHTMAIL
2968 case ACLC_BMI_OPTIN:
2969 {
2970 int old_pool = store_pool;
2971 store_pool = POOL_PERM;
2972 bmi_current_optin = string_copy(arg);
2973 store_pool = old_pool;
2974 }
2975 break;
2976 #endif
2977
2978 case ACLC_CONDITION:
2979 /* The true/false parsing here should be kept in sync with that used in
2980 expand.c when dealing with ECOND_BOOL so that we don't have too many
2981 different definitions of what can be a boolean. */
2982 if (*arg == '-'
2983 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2984 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2985 rc = (Uatoi(arg) == 0)? FAIL : OK;
2986 else
2987 rc = (strcmpic(arg, US"no") == 0 ||
2988 strcmpic(arg, US"false") == 0)? FAIL :
2989 (strcmpic(arg, US"yes") == 0 ||
2990 strcmpic(arg, US"true") == 0)? OK : DEFER;
2991 if (rc == DEFER)
2992 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2993 break;
2994
2995 case ACLC_CONTINUE: /* Always succeeds */
2996 break;
2997
2998 case ACLC_CONTROL:
2999 {
3000 const uschar *p = NULL;
3001 control_type = decode_control(arg, &p, where, log_msgptr);
3002
3003 /* Check if this control makes sense at this time */
3004
3005 if (controls_list[control_type].forbids & (1 << where))
3006 {
3007 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3008 controls_list[control_type].name, acl_wherenames[where]);
3009 return ERROR;
3010 }
3011
3012 switch(control_type)
3013 {
3014 case CONTROL_AUTH_UNADVERTISED:
3015 allow_auth_unadvertised = TRUE;
3016 break;
3017
3018 #ifdef EXPERIMENTAL_BRIGHTMAIL
3019 case CONTROL_BMI_RUN:
3020 bmi_run = 1;
3021 break;
3022 #endif
3023
3024 #ifndef DISABLE_DKIM
3025 case CONTROL_DKIM_VERIFY:
3026 dkim_disable_verify = TRUE;
3027 #ifdef EXPERIMENTAL_DMARC
3028 /* Since DKIM was blocked, skip DMARC too */
3029 dmarc_disable_verify = TRUE;
3030 dmarc_enable_forensic = FALSE;
3031 #endif
3032 break;
3033 #endif
3034
3035 #ifdef EXPERIMENTAL_DMARC
3036 case CONTROL_DMARC_VERIFY:
3037 dmarc_disable_verify = TRUE;
3038 break;
3039
3040 case CONTROL_DMARC_FORENSIC:
3041 dmarc_enable_forensic = TRUE;
3042 break;
3043 #endif
3044
3045 case CONTROL_DSCP:
3046 if (*p == '/')
3047 {
3048 int fd, af, level, optname, value;
3049 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3050 a socket; we can accept that, we'll just debug-log failures anyway. */
3051 fd = fileno(smtp_in);
3052 af = ip_get_address_family(fd);
3053 if (af < 0)
3054 {
3055 HDEBUG(D_acl)
3056 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3057 strerror(errno));
3058 break;
3059 }
3060 if (dscp_lookup(p+1, af, &level, &optname, &value))
3061 {
3062 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3063 {
3064 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3065 p+1, strerror(errno));
3066 }
3067 else
3068 {
3069 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3070 }
3071 }
3072 else
3073 {
3074 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3075 return ERROR;
3076 }
3077 }
3078 else
3079 {
3080 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3081 return ERROR;
3082 }
3083 break;
3084
3085 case CONTROL_ERROR:
3086 return ERROR;
3087
3088 case CONTROL_CASEFUL_LOCAL_PART:
3089 deliver_localpart = addr->cc_local_part;
3090 break;
3091
3092 case CONTROL_CASELOWER_LOCAL_PART:
3093 deliver_localpart = addr->lc_local_part;
3094 break;
3095
3096 case CONTROL_ENFORCE_SYNC:
3097 smtp_enforce_sync = TRUE;
3098 break;
3099
3100 case CONTROL_NO_ENFORCE_SYNC:
3101 smtp_enforce_sync = FALSE;
3102 break;
3103
3104 #ifdef WITH_CONTENT_SCAN
3105 case CONTROL_NO_MBOX_UNSPOOL:
3106 no_mbox_unspool = TRUE;
3107 break;
3108 #endif
3109
3110 case CONTROL_NO_MULTILINE:
3111 no_multiline_responses = TRUE;
3112 break;
3113
3114 case CONTROL_NO_PIPELINING:
3115 pipelining_enable = FALSE;
3116 break;
3117
3118 case CONTROL_NO_DELAY_FLUSH:
3119 disable_delay_flush = TRUE;
3120 break;
3121
3122 case CONTROL_NO_CALLOUT_FLUSH:
3123 disable_callout_flush = TRUE;
3124 break;
3125
3126 case CONTROL_FAKEREJECT:
3127 cancel_cutthrough_connection(TRUE, US"fakereject");
3128 case CONTROL_FAKEDEFER:
3129 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3130 if (*p == '/')
3131 {
3132 const uschar *pp = p + 1;
3133 while (*pp != 0) pp++;
3134 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3135 p = pp;
3136 }
3137 else
3138 {
3139 /* Explicitly reset to default string */
3140 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3141 }
3142 break;
3143
3144 case CONTROL_FREEZE:
3145 deliver_freeze = TRUE;
3146 deliver_frozen_at = time(NULL);
3147 freeze_tell = freeze_tell_config; /* Reset to configured value */
3148 if (Ustrncmp(p, "/no_tell", 8) == 0)
3149 {
3150 p += 8;
3151 freeze_tell = NULL;
3152 }
3153 if (*p != 0)
3154 {
3155 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3156 return ERROR;
3157 }
3158 cancel_cutthrough_connection(TRUE, US"item frozen");
3159 break;
3160
3161 case CONTROL_QUEUE_ONLY:
3162 queue_only_policy = TRUE;
3163 cancel_cutthrough_connection(TRUE, US"queueing forced");
3164 break;
3165
3166 case CONTROL_SUBMISSION:
3167 originator_name = US"";
3168 submission_mode = TRUE;
3169 while (*p == '/')
3170 {
3171 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3172 {
3173 p += 14;
3174 active_local_sender_retain = TRUE;
3175 active_local_from_check = FALSE;
3176 }
3177 else if (Ustrncmp(p, "/domain=", 8) == 0)
3178 {
3179 const uschar *pp = p + 8;
3180 while (*pp != 0 && *pp != '/') pp++;
3181 submission_domain = string_copyn(p+8, pp-p-8);
3182 p = pp;
3183 }
3184 /* The name= option must be last, because it swallows the rest of
3185 the string. */
3186 else if (Ustrncmp(p, "/name=", 6) == 0)
3187 {
3188 const uschar *pp = p + 6;
3189 while (*pp != 0) pp++;
3190 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3191 big_buffer, big_buffer_size));
3192 p = pp;
3193 }
3194 else break;
3195 }
3196 if (*p != 0)
3197 {
3198 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3199 return ERROR;
3200 }
3201 break;
3202
3203 case CONTROL_DEBUG:
3204 {
3205 uschar * debug_tag = NULL;
3206 uschar * debug_opts = NULL;
3207 BOOL kill = FALSE;
3208
3209 while (*p == '/')
3210 {
3211 const uschar * pp = p+1;
3212 if (Ustrncmp(pp, "tag=", 4) == 0)
3213 {
3214 for (pp += 4; *pp && *pp != '/';) pp++;
3215 debug_tag = string_copyn(p+5, pp-p-5);
3216 }
3217 else if (Ustrncmp(pp, "opts=", 5) == 0)
3218 {
3219 for (pp += 5; *pp && *pp != '/';) pp++;
3220 debug_opts = string_copyn(p+6, pp-p-6);
3221 }
3222 else if (Ustrncmp(pp, "kill", 4) == 0)
3223 {
3224 for (pp += 4; *pp && *pp != '/';) pp++;
3225 kill = TRUE;
3226 }
3227 else
3228 while (*pp && *pp != '/') pp++;
3229 p = pp;
3230 }
3231
3232 if (kill)
3233 debug_logging_stop();
3234 else
3235 debug_logging_activate(debug_tag, debug_opts);
3236 }
3237 break;
3238
3239 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3240 suppress_local_fixups = TRUE;
3241 break;
3242
3243 case CONTROL_CUTTHROUGH_DELIVERY:
3244 {
3245 uschar * ignored = NULL;
3246 #ifndef DISABLE_PRDR
3247 if (prdr_requested)
3248 #else
3249 if (0)
3250 #endif
3251 /* Too hard to think about for now. We might in future cutthrough
3252 the case where both sides handle prdr and this-node prdr acl
3253 is "accept" */
3254 ignored = US"PRDR active";
3255 else
3256 {
3257 if (deliver_freeze)
3258 ignored = US"frozen";
3259 else if (queue_only_policy)
3260 ignored = US"queue-only";
3261 else if (fake_response == FAIL)
3262 ignored = US"fakereject";
3263 else
3264 {
3265 if (rcpt_count == 1)
3266 {
3267 cutthrough.delivery = TRUE; /* control accepted */
3268 while (*p == '/')
3269 {
3270 const uschar * pp = p+1;
3271 if (Ustrncmp(pp, "defer=", 6) == 0)
3272 {
3273 pp += 6;
3274 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3275 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3276 }
3277 else
3278 while (*pp && *pp != '/') pp++;
3279 p = pp;
3280 }
3281 }
3282 else
3283 ignored = US"nonfirst rcpt";
3284 }
3285 }
3286 DEBUG(D_acl) if (ignored)
3287 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3288 }
3289 break;
3290
3291 #ifdef SUPPORT_I18N
3292 case CONTROL_UTF8_DOWNCONVERT:
3293 if (*p == '/')
3294 {
3295 if (p[1] == '1')
3296 {
3297 message_utf8_downconvert = 1;
3298 addr->prop.utf8_downcvt = TRUE;
3299 addr->prop.utf8_downcvt_maybe = FALSE;
3300 p += 2;
3301 break;
3302 }
3303 if (p[1] == '0')
3304 {
3305 message_utf8_downconvert = 0;
3306 addr->prop.utf8_downcvt = FALSE;
3307 addr->prop.utf8_downcvt_maybe = FALSE;
3308 p += 2;
3309 break;
3310 }
3311 if (p[1] == '-' && p[2] == '1')
3312 {
3313 message_utf8_downconvert = -1;
3314 addr->prop.utf8_downcvt = FALSE;
3315 addr->prop.utf8_downcvt_maybe = TRUE;
3316 p += 3;
3317 break;
3318 }
3319 *log_msgptr = US"bad option value for control=utf8_downconvert";
3320 }
3321 else
3322 {
3323 message_utf8_downconvert = 1;
3324 addr->prop.utf8_downcvt = TRUE;
3325 addr->prop.utf8_downcvt_maybe = FALSE;
3326 break;
3327 }
3328 return ERROR;
3329 #endif
3330
3331 }
3332 break;
3333 }
3334
3335 #ifdef EXPERIMENTAL_DCC
3336 case ACLC_DCC:
3337 {
3338 /* Separate the regular expression and any optional parameters. */
3339 const uschar * list = arg;
3340 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3341 /* Run the dcc backend. */
3342 rc = dcc_process(&ss);
3343 /* Modify return code based upon the existence of options. */
3344 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3345 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3346 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3347 }
3348 break;
3349 #endif
3350
3351 #ifdef WITH_CONTENT_SCAN
3352 case ACLC_DECODE:
3353 rc = mime_decode(&arg);
3354 break;
3355 #endif
3356
3357 case ACLC_DELAY:
3358 {
3359 int delay = readconf_readtime(arg, 0, FALSE);
3360 if (delay < 0)
3361 {
3362 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3363 "modifier: \"%s\" is not a time value", arg);
3364 return ERROR;
3365 }
3366 else
3367 {
3368 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3369 delay);
3370 if (host_checking)
3371 {
3372 HDEBUG(D_acl)
3373 debug_printf_indent("delay skipped in -bh checking mode\n");
3374 }
3375
3376 /* NOTE 1: Remember that we may be
3377 dealing with stdin/stdout here, in addition to TCP/IP connections.
3378 Also, delays may be specified for non-SMTP input, where smtp_out and
3379 smtp_in will be NULL. Whatever is done must work in all cases.
3380
3381 NOTE 2: The added feature of flushing the output before a delay must
3382 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3383 */
3384
3385 else
3386 {
3387 if (smtp_out != NULL && !disable_delay_flush)
3388 mac_smtp_fflush();
3389
3390 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3391 {
3392 struct pollfd p;
3393 nfds_t n = 0;
3394 if (smtp_out)
3395 {
3396 p.fd = fileno(smtp_out);
3397 p.events = POLLRDHUP;
3398 n = 1;
3399 }
3400 if (poll(&p, n, delay*1000) > 0)
3401 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3402 }
3403 #else
3404 /* It appears to be impossible to detect that a TCP/IP connection has
3405 gone away without reading from it. This means that we cannot shorten
3406 the delay below if the client goes away, because we cannot discover
3407 that the client has closed its end of the connection. (The connection
3408 is actually in a half-closed state, waiting for the server to close its
3409 end.) It would be nice to be able to detect this state, so that the
3410 Exim process is not held up unnecessarily. However, it seems that we
3411 can't. The poll() function does not do the right thing, and in any case
3412 it is not always available.
3413 */
3414
3415 while (delay > 0) delay = sleep(delay);
3416 #endif
3417 }
3418 }
3419 }
3420 break;
3421
3422 #ifndef DISABLE_DKIM
3423 case ACLC_DKIM_SIGNER:
3424 if (dkim_cur_signer)
3425 rc = match_isinlist(dkim_cur_signer,
3426 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3427 else
3428 rc = FAIL;
3429 break;
3430
3431 case ACLC_DKIM_STATUS:
3432 rc = match_isinlist(dkim_verify_status,
3433 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3434 break;
3435 #endif
3436
3437 #ifdef EXPERIMENTAL_DMARC
3438 case ACLC_DMARC_STATUS:
3439 if (!dmarc_has_been_checked)
3440 dmarc_process();
3441 dmarc_has_been_checked = TRUE;
3442 /* used long way of dmarc_exim_expand_query() in case we need more
3443 * view into the process in the future. */
3444 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3445 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3446 break;
3447 #endif
3448
3449 case ACLC_DNSLISTS:
3450 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3451 break;
3452
3453 case ACLC_DOMAINS:
3454 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3455 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3456 break;
3457
3458 /* The value in tls_cipher is the full cipher name, for example,
3459 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3460 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3461 what may in practice come out of the SSL library - which at the time of
3462 writing is poorly documented. */
3463
3464 case ACLC_ENCRYPTED:
3465 if (tls_in.cipher == NULL) rc = FAIL; else
3466 {
3467 uschar *endcipher = NULL;
3468 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3469 if (cipher == NULL) cipher = tls_in.cipher; else
3470