e79c87f83daa5e8ff6ae0588b0527961f36cab63
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 US"accept",
26 US"defer",
27 US"deny",
28 US"discard",
29 US"drop",
30 US"require",
31 US"warn" };
32
33 /* For each verb, the conditions for which "message" or "log_message" are used
34 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
35 "accept", the FAIL case is used only after "endpass", but that is selected in
36 the code. */
37
38 static int msgcond[] = {
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
40 (1<<OK), /* defer */
41 (1<<OK), /* deny */
42 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
43 (1<<OK), /* drop */
44 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 (1<<OK) /* warn */
46 };
47
48 /* ACL condition and modifier codes - keep in step with the table that
49 follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
50 down. */
51
52 enum { ACLC_ACL,
53 ACLC_ADD_HEADER,
54 ACLC_AUTHENTICATED,
55 #ifdef EXPERIMENTAL_BRIGHTMAIL
56 ACLC_BMI_OPTIN,
57 #endif
58 ACLC_CONDITION,
59 ACLC_CONTINUE,
60 ACLC_CONTROL,
61 #ifdef EXPERIMENTAL_DCC
62 ACLC_DCC,
63 #endif
64 #ifdef WITH_CONTENT_SCAN
65 ACLC_DECODE,
66 #endif
67 ACLC_DELAY,
68 #ifdef WITH_OLD_DEMIME
69 ACLC_DEMIME,
70 #endif
71 #ifndef DISABLE_DKIM
72 ACLC_DKIM_SIGNER,
73 ACLC_DKIM_STATUS,
74 #endif
75 #ifdef EXPERIMENTAL_DMARC
76 ACLC_DMARC_STATUS,
77 #endif
78 ACLC_DNSLISTS,
79 ACLC_DOMAINS,
80 ACLC_ENCRYPTED,
81 ACLC_ENDPASS,
82 ACLC_HOSTS,
83 ACLC_LOCAL_PARTS,
84 ACLC_LOG_MESSAGE,
85 ACLC_LOG_REJECT_TARGET,
86 ACLC_LOGWRITE,
87 #ifdef WITH_CONTENT_SCAN
88 ACLC_MALWARE,
89 #endif
90 ACLC_MESSAGE,
91 #ifdef WITH_CONTENT_SCAN
92 ACLC_MIME_REGEX,
93 #endif
94 ACLC_RATELIMIT,
95 ACLC_RECIPIENTS,
96 #ifdef WITH_CONTENT_SCAN
97 ACLC_REGEX,
98 #endif
99 ACLC_REMOVE_HEADER,
100 ACLC_SENDER_DOMAINS,
101 ACLC_SENDERS,
102 ACLC_SET,
103 #ifdef WITH_CONTENT_SCAN
104 ACLC_SPAM,
105 #endif
106 #ifdef EXPERIMENTAL_SPF
107 ACLC_SPF,
108 ACLC_SPF_GUESS,
109 #endif
110 ACLC_UDPSEND,
111 ACLC_VERIFY };
112
113 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
114 "message", "log_message", "log_reject_target", "logwrite", and "set" are
115 modifiers that look like conditions but always return TRUE. They are used for
116 their side effects. */
117
118 static uschar *conditions[] = {
119 US"acl",
120 US"add_header",
121 US"authenticated",
122 #ifdef EXPERIMENTAL_BRIGHTMAIL
123 US"bmi_optin",
124 #endif
125 US"condition",
126 US"continue",
127 US"control",
128 #ifdef EXPERIMENTAL_DCC
129 US"dcc",
130 #endif
131 #ifdef WITH_CONTENT_SCAN
132 US"decode",
133 #endif
134 US"delay",
135 #ifdef WITH_OLD_DEMIME
136 US"demime",
137 #endif
138 #ifndef DISABLE_DKIM
139 US"dkim_signers",
140 US"dkim_status",
141 #endif
142 #ifdef EXPERIMENTAL_DMARC
143 US"dmarc_status",
144 #endif
145 US"dnslists",
146 US"domains",
147 US"encrypted",
148 US"endpass",
149 US"hosts",
150 US"local_parts",
151 US"log_message",
152 US"log_reject_target",
153 US"logwrite",
154 #ifdef WITH_CONTENT_SCAN
155 US"malware",
156 #endif
157 US"message",
158 #ifdef WITH_CONTENT_SCAN
159 US"mime_regex",
160 #endif
161 US"ratelimit",
162 US"recipients",
163 #ifdef WITH_CONTENT_SCAN
164 US"regex",
165 #endif
166 US"remove_header",
167 US"sender_domains", US"senders", US"set",
168 #ifdef WITH_CONTENT_SCAN
169 US"spam",
170 #endif
171 #ifdef EXPERIMENTAL_SPF
172 US"spf",
173 US"spf_guess",
174 #endif
175 US"udpsend",
176 US"verify" };
177
178
179 /* Return values from decode_control(); keep in step with the table of names
180 that follows! */
181
182 enum {
183 CONTROL_AUTH_UNADVERTISED,
184 #ifdef EXPERIMENTAL_BRIGHTMAIL
185 CONTROL_BMI_RUN,
186 #endif
187 CONTROL_DEBUG,
188 #ifndef DISABLE_DKIM
189 CONTROL_DKIM_VERIFY,
190 #endif
191 #ifdef EXPERIMENTAL_DMARC
192 CONTROL_DMARC_VERIFY,
193 CONTROL_DMARC_FORENSIC,
194 #endif
195 CONTROL_DSCP,
196 CONTROL_ERROR,
197 CONTROL_CASEFUL_LOCAL_PART,
198 CONTROL_CASELOWER_LOCAL_PART,
199 CONTROL_CUTTHROUGH_DELIVERY,
200 CONTROL_ENFORCE_SYNC,
201 CONTROL_NO_ENFORCE_SYNC,
202 CONTROL_FREEZE,
203 CONTROL_QUEUE_ONLY,
204 CONTROL_SUBMISSION,
205 CONTROL_SUPPRESS_LOCAL_FIXUPS,
206 #ifdef WITH_CONTENT_SCAN
207 CONTROL_NO_MBOX_UNSPOOL,
208 #endif
209 CONTROL_FAKEDEFER,
210 CONTROL_FAKEREJECT,
211 #ifdef EXPERIMENTAL_INTERNATIONAL
212 CONTROL_UTF8_DOWNCONVERT,
213 #endif
214 CONTROL_NO_MULTILINE,
215 CONTROL_NO_PIPELINING,
216 CONTROL_NO_DELAY_FLUSH,
217 CONTROL_NO_CALLOUT_FLUSH
218 };
219
220 /* ACL control names; keep in step with the table above! This list is used for
221 turning ids into names. The actual list of recognized names is in the variable
222 control_def controls_list[] below. The fact that there are two lists is a mess
223 and should be tidied up. */
224
225 static uschar *controls[] = {
226 US"allow_auth_unadvertised",
227 #ifdef EXPERIMENTAL_BRIGHTMAIL
228 US"bmi_run",
229 #endif
230 US"debug",
231 #ifndef DISABLE_DKIM
232 US"dkim_disable_verify",
233 #endif
234 #ifdef EXPERIMENTAL_DMARC
235 US"dmarc_disable_verify",
236 US"dmarc_enable_forensic",
237 #endif
238 US"dscp",
239 US"error",
240 US"caseful_local_part",
241 US"caselower_local_part",
242 US"cutthrough_delivery",
243 US"enforce_sync",
244 US"no_enforce_sync",
245 US"freeze",
246 US"queue_only",
247 US"submission",
248 US"suppress_local_fixups",
249 #ifdef WITH_CONTENT_SCAN
250 US"no_mbox_unspool",
251 #endif
252 US"fakedefer",
253 US"fakereject",
254 #ifdef EXPERIMENTAL_INTERNATIONAL
255 US"utf8_downconvert",
256 #endif
257 US"no_multiline_responses",
258 US"no_pipelining",
259 US"no_delay_flush",
260 US"no_callout_flush"
261 };
262
263 /* Flags to indicate for which conditions/modifiers a string expansion is done
264 at the outer level. In the other cases, expansion already occurs in the
265 checking functions. */
266
267 static uschar cond_expand_at_top[] = {
268 FALSE, /* acl */
269 TRUE, /* add_header */
270 FALSE, /* authenticated */
271 #ifdef EXPERIMENTAL_BRIGHTMAIL
272 TRUE, /* bmi_optin */
273 #endif
274 TRUE, /* condition */
275 TRUE, /* continue */
276 TRUE, /* control */
277 #ifdef EXPERIMENTAL_DCC
278 TRUE, /* dcc */
279 #endif
280 #ifdef WITH_CONTENT_SCAN
281 TRUE, /* decode */
282 #endif
283 TRUE, /* delay */
284 #ifdef WITH_OLD_DEMIME
285 TRUE, /* demime */
286 #endif
287 #ifndef DISABLE_DKIM
288 TRUE, /* dkim_signers */
289 TRUE, /* dkim_status */
290 #endif
291 #ifdef EXPERIMENTAL_DMARC
292 TRUE, /* dmarc_status */
293 #endif
294 TRUE, /* dnslists */
295 FALSE, /* domains */
296 FALSE, /* encrypted */
297 TRUE, /* endpass */
298 FALSE, /* hosts */
299 FALSE, /* local_parts */
300 TRUE, /* log_message */
301 TRUE, /* log_reject_target */
302 TRUE, /* logwrite */
303 #ifdef WITH_CONTENT_SCAN
304 TRUE, /* malware */
305 #endif
306 TRUE, /* message */
307 #ifdef WITH_CONTENT_SCAN
308 TRUE, /* mime_regex */
309 #endif
310 TRUE, /* ratelimit */
311 FALSE, /* recipients */
312 #ifdef WITH_CONTENT_SCAN
313 TRUE, /* regex */
314 #endif
315 TRUE, /* remove_header */
316 FALSE, /* sender_domains */
317 FALSE, /* senders */
318 TRUE, /* set */
319 #ifdef WITH_CONTENT_SCAN
320 TRUE, /* spam */
321 #endif
322 #ifdef EXPERIMENTAL_SPF
323 TRUE, /* spf */
324 TRUE, /* spf_guess */
325 #endif
326 TRUE, /* udpsend */
327 TRUE /* verify */
328 };
329
330 /* Flags to identify the modifiers */
331
332 static uschar cond_modifiers[] = {
333 FALSE, /* acl */
334 TRUE, /* add_header */
335 FALSE, /* authenticated */
336 #ifdef EXPERIMENTAL_BRIGHTMAIL
337 TRUE, /* bmi_optin */
338 #endif
339 FALSE, /* condition */
340 TRUE, /* continue */
341 TRUE, /* control */
342 #ifdef EXPERIMENTAL_DCC
343 FALSE, /* dcc */
344 #endif
345 #ifdef WITH_CONTENT_SCAN
346 FALSE, /* decode */
347 #endif
348 TRUE, /* delay */
349 #ifdef WITH_OLD_DEMIME
350 FALSE, /* demime */
351 #endif
352 #ifndef DISABLE_DKIM
353 FALSE, /* dkim_signers */
354 FALSE, /* dkim_status */
355 #endif
356 #ifdef EXPERIMENTAL_DMARC
357 FALSE, /* dmarc_status */
358 #endif
359 FALSE, /* dnslists */
360 FALSE, /* domains */
361 FALSE, /* encrypted */
362 TRUE, /* endpass */
363 FALSE, /* hosts */
364 FALSE, /* local_parts */
365 TRUE, /* log_message */
366 TRUE, /* log_reject_target */
367 TRUE, /* logwrite */
368 #ifdef WITH_CONTENT_SCAN
369 FALSE, /* malware */
370 #endif
371 TRUE, /* message */
372 #ifdef WITH_CONTENT_SCAN
373 FALSE, /* mime_regex */
374 #endif
375 FALSE, /* ratelimit */
376 FALSE, /* recipients */
377 #ifdef WITH_CONTENT_SCAN
378 FALSE, /* regex */
379 #endif
380 TRUE, /* remove_header */
381 FALSE, /* sender_domains */
382 FALSE, /* senders */
383 TRUE, /* set */
384 #ifdef WITH_CONTENT_SCAN
385 FALSE, /* spam */
386 #endif
387 #ifdef EXPERIMENTAL_SPF
388 FALSE, /* spf */
389 FALSE, /* spf_guess */
390 #endif
391 TRUE, /* udpsend */
392 FALSE /* verify */
393 };
394
395 /* Bit map vector of which conditions and modifiers are not allowed at certain
396 times. For each condition and modifier, there's a bitmap of dis-allowed times.
397 For some, it is easier to specify the negation of a small number of allowed
398 times. */
399
400 static unsigned int cond_forbids[] = {
401 0, /* acl */
402
403 (unsigned int)
404 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
405 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
406 #ifndef DISABLE_PRDR
407 (1<<ACL_WHERE_PRDR)|
408 #endif
409 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
410 (1<<ACL_WHERE_DKIM)|
411 (1<<ACL_WHERE_NOTSMTP_START)),
412
413 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
414 (1<<ACL_WHERE_NOTSMTP_START)|
415 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
416
417 #ifdef EXPERIMENTAL_BRIGHTMAIL
418 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
419 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
420 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
421 #ifndef DISABLE_PRDR
422 (1<<ACL_WHERE_PRDR)|
423 #endif
424 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
425 (1<<ACL_WHERE_MAILAUTH)|
426 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
427 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
428 (1<<ACL_WHERE_NOTSMTP_START),
429 #endif
430
431 0, /* condition */
432
433 0, /* continue */
434
435 /* Certain types of control are always allowed, so we let it through
436 always and check in the control processing itself. */
437
438 0, /* control */
439
440 #ifdef EXPERIMENTAL_DCC
441 (unsigned int)
442 ~((1<<ACL_WHERE_DATA)| /* dcc */
443 #ifndef DISABLE_PRDR
444 (1<<ACL_WHERE_PRDR)|
445 #endif
446 (1<<ACL_WHERE_NOTSMTP)),
447 #endif
448
449 #ifdef WITH_CONTENT_SCAN
450 (unsigned int)
451 ~(1<<ACL_WHERE_MIME), /* decode */
452 #endif
453
454 (1<<ACL_WHERE_NOTQUIT), /* delay */
455
456 #ifdef WITH_OLD_DEMIME
457 (unsigned int)
458 ~((1<<ACL_WHERE_DATA)| /* demime */
459 #ifndef DISABLE_PRDR
460 (1<<ACL_WHERE_PRDR)|
461 #endif
462 (1<<ACL_WHERE_NOTSMTP)),
463 #endif
464
465 #ifndef DISABLE_DKIM
466 (unsigned int)
467 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
468
469 (unsigned int)
470 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
471 #endif
472
473 #ifdef EXPERIMENTAL_DMARC
474 (unsigned int)
475 ~(1<<ACL_WHERE_DATA), /* dmarc_status */
476 #endif
477
478 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
479 (1<<ACL_WHERE_NOTSMTP_START),
480
481 (unsigned int)
482 ~((1<<ACL_WHERE_RCPT) /* domains */
483 #ifndef DISABLE_PRDR
484 |(1<<ACL_WHERE_PRDR)
485 #endif
486 ),
487
488 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
489 (1<<ACL_WHERE_CONNECT)|
490 (1<<ACL_WHERE_NOTSMTP_START)|
491 (1<<ACL_WHERE_HELO),
492
493 0, /* endpass */
494
495 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
496 (1<<ACL_WHERE_NOTSMTP_START),
497
498 (unsigned int)
499 ~((1<<ACL_WHERE_RCPT) /* local_parts */
500 #ifndef DISABLE_PRDR
501 |(1<<ACL_WHERE_PRDR)
502 #endif
503 ),
504
505 0, /* log_message */
506
507 0, /* log_reject_target */
508
509 0, /* logwrite */
510
511 #ifdef WITH_CONTENT_SCAN
512 (unsigned int)
513 ~((1<<ACL_WHERE_DATA)| /* malware */
514 #ifndef DISABLE_PRDR
515 (1<<ACL_WHERE_PRDR)|
516 #endif
517 (1<<ACL_WHERE_NOTSMTP)),
518 #endif
519
520 0, /* message */
521
522 #ifdef WITH_CONTENT_SCAN
523 (unsigned int)
524 ~(1<<ACL_WHERE_MIME), /* mime_regex */
525 #endif
526
527 0, /* ratelimit */
528
529 (unsigned int)
530 ~(1<<ACL_WHERE_RCPT), /* recipients */
531
532 #ifdef WITH_CONTENT_SCAN
533 (unsigned int)
534 ~((1<<ACL_WHERE_DATA)| /* regex */
535 #ifndef DISABLE_PRDR
536 (1<<ACL_WHERE_PRDR)|
537 #endif
538 (1<<ACL_WHERE_NOTSMTP)|
539 (1<<ACL_WHERE_MIME)),
540 #endif
541
542 (unsigned int)
543 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* remove_header */
544 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
545 #ifndef DISABLE_PRDR
546 (1<<ACL_WHERE_PRDR)|
547 #endif
548 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
549 (1<<ACL_WHERE_NOTSMTP_START)),
550
551 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
552 (1<<ACL_WHERE_HELO)|
553 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
554 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
555 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
556
557 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
558 (1<<ACL_WHERE_HELO)|
559 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
560 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
561 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
562
563 0, /* set */
564
565 #ifdef WITH_CONTENT_SCAN
566 (unsigned int)
567 ~((1<<ACL_WHERE_DATA)| /* spam */
568 #ifndef DISABLE_PRDR
569 (1<<ACL_WHERE_PRDR)|
570 #endif
571 (1<<ACL_WHERE_NOTSMTP)),
572 #endif
573
574 #ifdef EXPERIMENTAL_SPF
575 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
576 (1<<ACL_WHERE_HELO)|
577 (1<<ACL_WHERE_MAILAUTH)|
578 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
579 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
580 (1<<ACL_WHERE_NOTSMTP)|
581 (1<<ACL_WHERE_NOTSMTP_START),
582
583 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
584 (1<<ACL_WHERE_HELO)|
585 (1<<ACL_WHERE_MAILAUTH)|
586 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
587 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
588 (1<<ACL_WHERE_NOTSMTP)|
589 (1<<ACL_WHERE_NOTSMTP_START),
590 #endif
591
592 0, /* udpsend */
593
594 /* Certain types of verify are always allowed, so we let it through
595 always and check in the verify function itself */
596
597 0 /* verify */
598 };
599
600
601 /* Bit map vector of which controls are not allowed at certain times. For
602 each control, there's a bitmap of dis-allowed times. For some, it is easier to
603 specify the negation of a small number of allowed times. */
604
605 static unsigned int control_forbids[] = {
606 (unsigned int)
607 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
608
609 #ifdef EXPERIMENTAL_BRIGHTMAIL
610 0, /* bmi_run */
611 #endif
612
613 0, /* debug */
614
615 #ifndef DISABLE_DKIM
616 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
617 # ifndef DISABLE_PRDR
618 (1<<ACL_WHERE_PRDR)|
619 # endif
620 (1<<ACL_WHERE_NOTSMTP_START),
621 #endif
622
623 #ifdef EXPERIMENTAL_DMARC
624 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_disable_verify */
625 (1<<ACL_WHERE_NOTSMTP_START),
626 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dmarc_enable_forensic */
627 (1<<ACL_WHERE_NOTSMTP_START),
628 #endif
629
630 (1<<ACL_WHERE_NOTSMTP)|
631 (1<<ACL_WHERE_NOTSMTP_START)|
632 (1<<ACL_WHERE_NOTQUIT), /* dscp */
633
634 0, /* error */
635
636 (unsigned int)
637 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
638
639 (unsigned int)
640 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
641
642 (unsigned int)
643 0, /* cutthrough_delivery */
644
645 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
646 (1<<ACL_WHERE_NOTSMTP_START),
647
648 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
649 (1<<ACL_WHERE_NOTSMTP_START),
650
651 (unsigned int)
652 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
653 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
654 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
655 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
656
657 (unsigned int)
658 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
659 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
660 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
661 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
662
663 (unsigned int)
664 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
665 (1<<ACL_WHERE_PREDATA)),
666
667 (unsigned int)
668 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
669 (1<<ACL_WHERE_PREDATA)|
670 (1<<ACL_WHERE_NOTSMTP_START)),
671
672 #ifdef WITH_CONTENT_SCAN
673 (unsigned int)
674 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
675 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
676 // (1<<ACL_WHERE_PRDR)| /* Not allow one user to freeze for all */
677 (1<<ACL_WHERE_MIME)),
678 #endif
679
680 (unsigned int)
681 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
682 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
683 #ifndef DISABLE_PRDR
684 (1<<ACL_WHERE_PRDR)|
685 #endif
686 (1<<ACL_WHERE_MIME)),
687
688 (unsigned int)
689 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
690 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
691 #ifndef DISABLE_PRDR
692 (1<<ACL_WHERE_PRDR)|
693 #endif
694 (1<<ACL_WHERE_MIME)),
695
696 #ifdef EXPERIMENTAL_INTERNATIONAL
697 0, /* utf8_downconvert */
698 #endif
699
700 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
701 (1<<ACL_WHERE_NOTSMTP_START),
702
703 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
704 (1<<ACL_WHERE_NOTSMTP_START),
705
706 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
707 (1<<ACL_WHERE_NOTSMTP_START),
708
709 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
710 (1<<ACL_WHERE_NOTSMTP_START)
711 };
712
713 /* Structure listing various control arguments, with their characteristics. */
714
715 typedef struct control_def {
716 uschar *name;
717 int value; /* CONTROL_xxx value */
718 BOOL has_option; /* Has /option(s) following */
719 } control_def;
720
721 static control_def controls_list[] = {
722 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
723 #ifdef EXPERIMENTAL_BRIGHTMAIL
724 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
725 #endif
726 { US"debug", CONTROL_DEBUG, TRUE },
727 #ifndef DISABLE_DKIM
728 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
729 #endif
730 #ifdef EXPERIMENTAL_DMARC
731 { US"dmarc_disable_verify", CONTROL_DMARC_VERIFY, FALSE },
732 { US"dmarc_enable_forensic", CONTROL_DMARC_FORENSIC, FALSE },
733 #endif
734 { US"dscp", CONTROL_DSCP, TRUE },
735 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
736 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
737 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
738 { US"freeze", CONTROL_FREEZE, TRUE },
739 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
740 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
741 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
742 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
743 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
744 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
745 #ifdef WITH_CONTENT_SCAN
746 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
747 #endif
748 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
749 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
750 { US"submission", CONTROL_SUBMISSION, TRUE },
751 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
752 { US"cutthrough_delivery", CONTROL_CUTTHROUGH_DELIVERY, FALSE },
753 #ifdef EXPERIMENTAL_INTERNATIONAL
754 { US"utf8_downconvert", CONTROL_UTF8_DOWNCONVERT, TRUE }
755 #endif
756 };
757
758 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
759 caches its result in a tree to avoid repeated DNS queries. The result is an
760 integer code which is used as an index into the following tables of
761 explanatory strings and verification return codes. */
762
763 static tree_node *csa_cache = NULL;
764
765 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
766 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
767
768 /* The acl_verify_csa() return code is translated into an acl_verify() return
769 code using the following table. It is OK unless the client is definitely not
770 authorized. This is because CSA is supposed to be optional for sending sites,
771 so recipients should not be too strict about checking it - especially because
772 DNS problems are quite likely to occur. It's possible to use $csa_status in
773 further ACL conditions to distinguish ok, unknown, and defer if required, but
774 the aim is to make the usual configuration simple. */
775
776 static int csa_return_code[] = {
777 OK, OK, OK, OK,
778 FAIL, FAIL, FAIL, FAIL
779 };
780
781 static uschar *csa_status_string[] = {
782 US"unknown", US"ok", US"defer", US"defer",
783 US"fail", US"fail", US"fail", US"fail"
784 };
785
786 static uschar *csa_reason_string[] = {
787 US"unknown",
788 US"ok",
789 US"deferred (SRV lookup failed)",
790 US"deferred (target address lookup failed)",
791 US"failed (explicit authorization required)",
792 US"failed (host name not authorized)",
793 US"failed (no authorized addresses)",
794 US"failed (client address mismatch)"
795 };
796
797 /* Options for the ratelimit condition. Note that there are two variants of
798 the per_rcpt option, depending on the ACL that is used to measure the rate.
799 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
800 so the two variants must have the same internal representation as well as
801 the same configuration string. */
802
803 enum {
804 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
805 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
806 };
807
808 #define RATE_SET(var,new) \
809 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
810
811 static uschar *ratelimit_option_string[] = {
812 US"?", US"!", US"per_addr", US"per_byte", US"per_cmd",
813 US"per_conn", US"per_mail", US"per_rcpt", US"per_rcpt"
814 };
815
816 /* Enable recursion between acl_check_internal() and acl_check_condition() */
817
818 static int acl_check_wargs(int, address_item *, const uschar *, int, uschar **,
819 uschar **);
820
821
822 /*************************************************
823 * Pick out name from list *
824 *************************************************/
825
826 /* Use a binary chop method
827
828 Arguments:
829 name name to find
830 list list of names
831 end size of list
832
833 Returns: offset in list, or -1 if not found
834 */
835
836 static int
837 acl_checkname(uschar *name, uschar **list, int end)
838 {
839 int start = 0;
840
841 while (start < end)
842 {
843 int mid = (start + end)/2;
844 int c = Ustrcmp(name, list[mid]);
845 if (c == 0) return mid;
846 if (c < 0) end = mid; else start = mid + 1;
847 }
848
849 return -1;
850 }
851
852
853 /*************************************************
854 * Read and parse one ACL *
855 *************************************************/
856
857 /* This function is called both from readconf in order to parse the ACLs in the
858 configuration file, and also when an ACL is encountered dynamically (e.g. as
859 the result of an expansion). It is given a function to call in order to
860 retrieve the lines of the ACL. This function handles skipping comments and
861 blank lines (where relevant).
862
863 Arguments:
864 func function to get next line of ACL
865 error where to put an error message
866
867 Returns: pointer to ACL, or NULL
868 NULL can be legal (empty ACL); in this case error will be NULL
869 */
870
871 acl_block *
872 acl_read(uschar *(*func)(void), uschar **error)
873 {
874 acl_block *yield = NULL;
875 acl_block **lastp = &yield;
876 acl_block *this = NULL;
877 acl_condition_block *cond;
878 acl_condition_block **condp = NULL;
879 uschar *s;
880
881 *error = NULL;
882
883 while ((s = (*func)()) != NULL)
884 {
885 int v, c;
886 BOOL negated = FALSE;
887 uschar *saveline = s;
888 uschar name[64];
889
890 /* Conditions (but not verbs) are allowed to be negated by an initial
891 exclamation mark. */
892
893 while (isspace(*s)) s++;
894 if (*s == '!')
895 {
896 negated = TRUE;
897 s++;
898 }
899
900 /* Read the name of a verb or a condition, or the start of a new ACL, which
901 can be started by a name, or by a macro definition. */
902
903 s = readconf_readname(name, sizeof(name), s);
904 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
905
906 /* If a verb is unrecognized, it may be another condition or modifier that
907 continues the previous verb. */
908
909 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
910 if (v < 0)
911 {
912 if (this == NULL)
913 {
914 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
915 saveline);
916 return NULL;
917 }
918 }
919
920 /* New verb */
921
922 else
923 {
924 if (negated)
925 {
926 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
927 return NULL;
928 }
929 this = store_get(sizeof(acl_block));
930 *lastp = this;
931 lastp = &(this->next);
932 this->next = NULL;
933 this->verb = v;
934 this->condition = NULL;
935 condp = &(this->condition);
936 if (*s == 0) continue; /* No condition on this line */
937 if (*s == '!')
938 {
939 negated = TRUE;
940 s++;
941 }
942 s = readconf_readname(name, sizeof(name), s); /* Condition name */
943 }
944
945 /* Handle a condition or modifier. */
946
947 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
948 if (c < 0)
949 {
950 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
951 saveline);
952 return NULL;
953 }
954
955 /* The modifiers may not be negated */
956
957 if (negated && cond_modifiers[c])
958 {
959 *error = string_sprintf("ACL error: negation is not allowed with "
960 "\"%s\"", conditions[c]);
961 return NULL;
962 }
963
964 /* ENDPASS may occur only with ACCEPT or DISCARD. */
965
966 if (c == ACLC_ENDPASS &&
967 this->verb != ACL_ACCEPT &&
968 this->verb != ACL_DISCARD)
969 {
970 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
971 conditions[c], verbs[this->verb]);
972 return NULL;
973 }
974
975 cond = store_get(sizeof(acl_condition_block));
976 cond->next = NULL;
977 cond->type = c;
978 cond->u.negated = negated;
979
980 *condp = cond;
981 condp = &(cond->next);
982
983 /* The "set" modifier is different in that its argument is "name=value"
984 rather than just a value, and we can check the validity of the name, which
985 gives us a variable name to insert into the data block. The original ACL
986 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
987 extended to 20 of each type, but after that people successfully argued for
988 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
989 After that, we allow alphanumerics and underscores, but the first character
990 after c or m must be a digit or an underscore. This retains backwards
991 compatibility. */
992
993 if (c == ACLC_SET)
994 {
995 uschar *endptr;
996
997 if (Ustrncmp(s, "acl_c", 5) != 0 &&
998 Ustrncmp(s, "acl_m", 5) != 0)
999 {
1000 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1001 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
1002 return NULL;
1003 }
1004
1005 endptr = s + 5;
1006 if (!isdigit(*endptr) && *endptr != '_')
1007 {
1008 *error = string_sprintf("invalid variable name after \"set\" in ACL "
1009 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
1010 s);
1011 return NULL;
1012 }
1013
1014 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
1015 {
1016 if (!isalnum(*endptr) && *endptr != '_')
1017 {
1018 *error = string_sprintf("invalid character \"%c\" in variable name "
1019 "in ACL modifier \"set %s\"", *endptr, s);
1020 return NULL;
1021 }
1022 endptr++;
1023 }
1024
1025 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
1026 s = endptr;
1027 while (isspace(*s)) s++;
1028 }
1029
1030 /* For "set", we are now positioned for the data. For the others, only
1031 "endpass" has no data */
1032
1033 if (c != ACLC_ENDPASS)
1034 {
1035 if (*s++ != '=')
1036 {
1037 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
1038 cond_modifiers[c]? US"modifier" : US"condition");
1039 return NULL;
1040 }
1041 while (isspace(*s)) s++;
1042 cond->arg = string_copy(s);
1043 }
1044 }
1045
1046 return yield;
1047 }
1048
1049
1050
1051 /*************************************************
1052 * Set up added header line(s) *
1053 *************************************************/
1054
1055 /* This function is called by the add_header modifier, and also from acl_warn()
1056 to implement the now-deprecated way of adding header lines using "message" on a
1057 "warn" verb. The argument is treated as a sequence of header lines which are
1058 added to a chain, provided there isn't an identical one already there.
1059
1060 Argument: string of header lines
1061 Returns: nothing
1062 */
1063
1064 static void
1065 setup_header(const uschar *hstring)
1066 {
1067 const uschar *p, *q;
1068 int hlen = Ustrlen(hstring);
1069
1070 /* Ignore any leading newlines */
1071 while (*hstring == '\n') hstring++, hlen--;
1072
1073 /* An empty string does nothing; ensure exactly one final newline. */
1074 if (hlen <= 0) return;
1075 if (hstring[--hlen] != '\n')
1076 q = string_sprintf("%s\n", hstring);
1077 else if (hstring[hlen-1] == '\n')
1078 {
1079 uschar * s = string_copy(hstring);
1080 while(s[--hlen] == '\n')
1081 s[hlen+1] = '\0';
1082 q = s;
1083 }
1084 else
1085 q = hstring;
1086
1087 /* Loop for multiple header lines, taking care about continuations */
1088
1089 for (p = q; *p != 0; )
1090 {
1091 const uschar *s;
1092 uschar * hdr;
1093 int newtype = htype_add_bot;
1094 header_line **hptr = &acl_added_headers;
1095
1096 /* Find next header line within the string */
1097
1098 for (;;)
1099 {
1100 q = Ustrchr(q, '\n');
1101 if (*(++q) != ' ' && *q != '\t') break;
1102 }
1103
1104 /* If the line starts with a colon, interpret the instruction for where to
1105 add it. This temporarily sets up a new type. */
1106
1107 if (*p == ':')
1108 {
1109 if (strncmpic(p, US":after_received:", 16) == 0)
1110 {
1111 newtype = htype_add_rec;
1112 p += 16;
1113 }
1114 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1115 {
1116 newtype = htype_add_rfc;
1117 p += 14;
1118 }
1119 else if (strncmpic(p, US":at_start:", 10) == 0)
1120 {
1121 newtype = htype_add_top;
1122 p += 10;
1123 }
1124 else if (strncmpic(p, US":at_end:", 8) == 0)
1125 {
1126 newtype = htype_add_bot;
1127 p += 8;
1128 }
1129 while (*p == ' ' || *p == '\t') p++;
1130 }
1131
1132 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1133 to the front of it. */
1134
1135 for (s = p; s < q - 1; s++)
1136 {
1137 if (*s == ':' || !isgraph(*s)) break;
1138 }
1139
1140 hdr = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", (int) (q - p), p);
1141 hlen = Ustrlen(hdr);
1142
1143 /* See if this line has already been added */
1144
1145 while (*hptr != NULL)
1146 {
1147 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1148 hptr = &((*hptr)->next);
1149 }
1150
1151 /* Add if not previously present */
1152
1153 if (*hptr == NULL)
1154 {
1155 header_line *h = store_get(sizeof(header_line));
1156 h->text = hdr;
1157 h->next = NULL;
1158 h->type = newtype;
1159 h->slen = hlen;
1160 *hptr = h;
1161 hptr = &(h->next);
1162 }
1163
1164 /* Advance for next header line within the string */
1165
1166 p = q;
1167 }
1168 }
1169
1170
1171
1172 /*************************************************
1173 * List the added header lines *
1174 *************************************************/
1175 uschar *
1176 fn_hdrs_added(void)
1177 {
1178 uschar * ret = NULL;
1179 header_line * h = acl_added_headers;
1180 uschar * s;
1181 uschar * cp;
1182 int size = 0;
1183 int ptr = 0;
1184
1185 if (!h) return NULL;
1186
1187 do
1188 {
1189 s = h->text;
1190 while ((cp = Ustrchr(s, '\n')) != NULL)
1191 {
1192 if (cp[1] == '\0') break;
1193
1194 /* contains embedded newline; needs doubling */
1195 ret = string_cat(ret, &size, &ptr, s, cp-s+1);
1196 ret = string_cat(ret, &size, &ptr, US"\n", 1);
1197 s = cp+1;
1198 }
1199 /* last bit of header */
1200
1201 ret = string_cat(ret, &size, &ptr, s, cp-s+1); /* newline-sep list */
1202 }
1203 while((h = h->next));
1204
1205 ret[ptr-1] = '\0'; /* overwrite last newline */
1206 return ret;
1207 }
1208
1209
1210 /*************************************************
1211 * Set up removed header line(s) *
1212 *************************************************/
1213
1214 /* This function is called by the remove_header modifier. The argument is
1215 treated as a sequence of header names which are added to a colon separated
1216 list, provided there isn't an identical one already there.
1217
1218 Argument: string of header names
1219 Returns: nothing
1220 */
1221
1222 static void
1223 setup_remove_header(const uschar *hnames)
1224 {
1225 if (*hnames != 0)
1226 acl_removed_headers = acl_removed_headers
1227 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1228 : string_copy(hnames);
1229 }
1230
1231
1232
1233 /*************************************************
1234 * Handle warnings *
1235 *************************************************/
1236
1237 /* This function is called when a WARN verb's conditions are true. It adds to
1238 the message's headers, and/or writes information to the log. In each case, this
1239 only happens once (per message for headers, per connection for log).
1240
1241 ** NOTE: The header adding action using the "message" setting is historic, and
1242 its use is now deprecated. The new add_header modifier should be used instead.
1243
1244 Arguments:
1245 where ACL_WHERE_xxxx indicating which ACL this is
1246 user_message message for adding to headers
1247 log_message message for logging, if different
1248
1249 Returns: nothing
1250 */
1251
1252 static void
1253 acl_warn(int where, uschar *user_message, uschar *log_message)
1254 {
1255 if (log_message != NULL && log_message != user_message)
1256 {
1257 uschar *text;
1258 string_item *logged;
1259
1260 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1261 string_printing(log_message));
1262
1263 /* If a sender verification has failed, and the log message is "sender verify
1264 failed", add the failure message. */
1265
1266 if (sender_verified_failed != NULL &&
1267 sender_verified_failed->message != NULL &&
1268 strcmpic(log_message, US"sender verify failed") == 0)
1269 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1270
1271 /* Search previously logged warnings. They are kept in malloc
1272 store so they can be freed at the start of a new message. */
1273
1274 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1275 if (Ustrcmp(logged->text, text) == 0) break;
1276
1277 if (logged == NULL)
1278 {
1279 int length = Ustrlen(text) + 1;
1280 log_write(0, LOG_MAIN, "%s", text);
1281 logged = store_malloc(sizeof(string_item) + length);
1282 logged->text = (uschar *)logged + sizeof(string_item);
1283 memcpy(logged->text, text, length);
1284 logged->next = acl_warn_logged;
1285 acl_warn_logged = logged;
1286 }
1287 }
1288
1289 /* If there's no user message, we are done. */
1290
1291 if (user_message == NULL) return;
1292
1293 /* If this isn't a message ACL, we can't do anything with a user message.
1294 Log an error. */
1295
1296 if (where > ACL_WHERE_NOTSMTP)
1297 {
1298 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1299 "found in a non-message (%s) ACL: cannot specify header lines here: "
1300 "message ignored", acl_wherenames[where]);
1301 return;
1302 }
1303
1304 /* The code for setting up header lines is now abstracted into a separate
1305 function so that it can be used for the add_header modifier as well. */
1306
1307 setup_header(user_message);
1308 }
1309
1310
1311
1312 /*************************************************
1313 * Verify and check reverse DNS *
1314 *************************************************/
1315
1316 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1317 address if this has not yet been done. The host_name_lookup() function checks
1318 that one of these names resolves to an address list that contains the client IP
1319 address, so we don't actually have to do the check here.
1320
1321 Arguments:
1322 user_msgptr pointer for user message
1323 log_msgptr pointer for log message
1324
1325 Returns: OK verification condition succeeded
1326 FAIL verification failed
1327 DEFER there was a problem verifying
1328 */
1329
1330 static int
1331 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1332 {
1333 int rc;
1334
1335 user_msgptr = user_msgptr; /* stop compiler warning */
1336
1337 /* Previous success */
1338
1339 if (sender_host_name != NULL) return OK;
1340
1341 /* Previous failure */
1342
1343 if (host_lookup_failed)
1344 {
1345 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1346 return FAIL;
1347 }
1348
1349 /* Need to do a lookup */
1350
1351 HDEBUG(D_acl)
1352 debug_printf("looking up host name to force name/address consistency check\n");
1353
1354 if ((rc = host_name_lookup()) != OK)
1355 {
1356 *log_msgptr = (rc == DEFER)?
1357 US"host lookup deferred for reverse lookup check"
1358 :
1359 string_sprintf("host lookup failed for reverse lookup check%s",
1360 host_lookup_msg);
1361 return rc; /* DEFER or FAIL */
1362 }
1363
1364 host_build_sender_fullhost();
1365 return OK;
1366 }
1367
1368
1369
1370 /*************************************************
1371 * Check client IP address matches CSA target *
1372 *************************************************/
1373
1374 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1375 response for address records belonging to the CSA target hostname. The section
1376 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1377 If one of the addresses matches the client's IP address, then the client is
1378 authorized by CSA. If there are target IP addresses but none of them match
1379 then the client is using an unauthorized IP address. If there are no target IP
1380 addresses then the client cannot be using an authorized IP address. (This is
1381 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1382
1383 Arguments:
1384 dnsa the DNS answer block
1385 dnss a DNS scan block for us to use
1386 reset option specifing what portion to scan, as described above
1387 target the target hostname to use for matching RR names
1388
1389 Returns: CSA_OK successfully authorized
1390 CSA_FAIL_MISMATCH addresses found but none matched
1391 CSA_FAIL_NOADDR no target addresses found
1392 */
1393
1394 static int
1395 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1396 uschar *target)
1397 {
1398 dns_record *rr;
1399 dns_address *da;
1400
1401 BOOL target_found = FALSE;
1402
1403 for (rr = dns_next_rr(dnsa, dnss, reset);
1404 rr != NULL;
1405 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1406 {
1407 /* Check this is an address RR for the target hostname. */
1408
1409 if (rr->type != T_A
1410 #if HAVE_IPV6
1411 && rr->type != T_AAAA
1412 #endif
1413 ) continue;
1414
1415 if (strcmpic(target, rr->name) != 0) continue;
1416
1417 target_found = TRUE;
1418
1419 /* Turn the target address RR into a list of textual IP addresses and scan
1420 the list. There may be more than one if it is an A6 RR. */
1421
1422 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1423 {
1424 /* If the client IP address matches the target IP address, it's good! */
1425
1426 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1427
1428 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1429 }
1430 }
1431
1432 /* If we found some target addresses but none of them matched, the client is
1433 using an unauthorized IP address, otherwise the target has no authorized IP
1434 addresses. */
1435
1436 if (target_found) return CSA_FAIL_MISMATCH;
1437 else return CSA_FAIL_NOADDR;
1438 }
1439
1440
1441
1442 /*************************************************
1443 * Verify Client SMTP Authorization *
1444 *************************************************/
1445
1446 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1447 to find the CSA SRV record corresponding to the domain argument, or
1448 $sender_helo_name if no argument is provided. It then checks that the
1449 client is authorized, and that its IP address corresponds to the SRV
1450 target's address by calling acl_verify_csa_address() above. The address
1451 should have been returned in the DNS response's ADDITIONAL section, but if
1452 not we perform another DNS lookup to get it.
1453
1454 Arguments:
1455 domain pointer to optional parameter following verify = csa
1456
1457 Returns: CSA_UNKNOWN no valid CSA record found
1458 CSA_OK successfully authorized
1459 CSA_FAIL_* client is definitely not authorized
1460 CSA_DEFER_* there was a DNS problem
1461 */
1462
1463 static int
1464 acl_verify_csa(const uschar *domain)
1465 {
1466 tree_node *t;
1467 const uschar *found;
1468 uschar *p;
1469 int priority, weight, port;
1470 dns_answer dnsa;
1471 dns_scan dnss;
1472 dns_record *rr;
1473 int rc, type;
1474 uschar target[256];
1475
1476 /* Work out the domain we are using for the CSA lookup. The default is the
1477 client's HELO domain. If the client has not said HELO, use its IP address
1478 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1479
1480 while (isspace(*domain) && *domain != '\0') ++domain;
1481 if (*domain == '\0') domain = sender_helo_name;
1482 if (domain == NULL) domain = sender_host_address;
1483 if (sender_host_address == NULL) return CSA_UNKNOWN;
1484
1485 /* If we have an address literal, strip off the framing ready for turning it
1486 into a domain. The framing consists of matched square brackets possibly
1487 containing a keyword and a colon before the actual IP address. */
1488
1489 if (domain[0] == '[')
1490 {
1491 const uschar *start = Ustrchr(domain, ':');
1492 if (start == NULL) start = domain;
1493 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1494 }
1495
1496 /* Turn domains that look like bare IP addresses into domains in the reverse
1497 DNS. This code also deals with address literals and $sender_host_address. It's
1498 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1499 address literals, but it's probably the most friendly thing to do. This is an
1500 extension to CSA, so we allow it to be turned off for proper conformance. */
1501
1502 if (string_is_ip_address(domain, NULL) != 0)
1503 {
1504 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1505 dns_build_reverse(domain, target);
1506 domain = target;
1507 }
1508
1509 /* Find out if we've already done the CSA check for this domain. If we have,
1510 return the same result again. Otherwise build a new cached result structure
1511 for this domain. The name is filled in now, and the value is filled in when
1512 we return from this function. */
1513
1514 t = tree_search(csa_cache, domain);
1515 if (t != NULL) return t->data.val;
1516
1517 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1518 Ustrcpy(t->name, domain);
1519 (void)tree_insertnode(&csa_cache, t);
1520
1521 /* Now we are ready to do the actual DNS lookup(s). */
1522
1523 found = domain;
1524 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1525 {
1526 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1527
1528 default:
1529 return t->data.val = CSA_DEFER_SRV;
1530
1531 /* If we found nothing, the client's authorization is unknown. */
1532
1533 case DNS_NOMATCH:
1534 case DNS_NODATA:
1535 return t->data.val = CSA_UNKNOWN;
1536
1537 /* We got something! Go on to look at the reply in more detail. */
1538
1539 case DNS_SUCCEED:
1540 break;
1541 }
1542
1543 /* Scan the reply for well-formed CSA SRV records. */
1544
1545 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1546 rr != NULL;
1547 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1548 {
1549 if (rr->type != T_SRV) continue;
1550
1551 /* Extract the numerical SRV fields (p is incremented) */
1552
1553 p = rr->data;
1554 GETSHORT(priority, p);
1555 GETSHORT(weight, p);
1556 GETSHORT(port, p);
1557
1558 DEBUG(D_acl)
1559 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1560
1561 /* Check the CSA version number */
1562
1563 if (priority != 1) continue;
1564
1565 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1566 found by dns_special_lookup() is a parent of the one we asked for), we check
1567 the subdomain assertions in the port field. At the moment there's only one
1568 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1569 SRV records of their own. */
1570
1571 if (Ustrcmp(found, domain) != 0)
1572 {
1573 if (port & 1)
1574 return t->data.val = CSA_FAIL_EXPLICIT;
1575 else
1576 return t->data.val = CSA_UNKNOWN;
1577 }
1578
1579 /* This CSA SRV record refers directly to our domain, so we check the value
1580 in the weight field to work out the domain's authorization. 0 and 1 are
1581 unauthorized; 3 means the client is authorized but we can't check the IP
1582 address in order to authenticate it, so we treat it as unknown; values
1583 greater than 3 are undefined. */
1584
1585 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1586
1587 if (weight > 2) continue;
1588
1589 /* Weight == 2, which means the domain is authorized. We must check that the
1590 client's IP address is listed as one of the SRV target addresses. Save the
1591 target hostname then break to scan the additional data for its addresses. */
1592
1593 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1594 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1595
1596 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1597
1598 break;
1599 }
1600
1601 /* If we didn't break the loop then no appropriate records were found. */
1602
1603 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1604
1605 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1606 A target of "." indicates there are no valid addresses, so the client cannot
1607 be authorized. (This is an odd configuration because weight=2 target=. is
1608 equivalent to weight=1, but we check for it in order to keep load off the
1609 root name servers.) Note that dn_expand() turns "." into "". */
1610
1611 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1612
1613 /* Scan the additional section of the CSA SRV reply for addresses belonging
1614 to the target. If the name server didn't return any additional data (e.g.
1615 because it does not fully support SRV records), we need to do another lookup
1616 to obtain the target addresses; otherwise we have a definitive result. */
1617
1618 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1619 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1620
1621 /* The DNS lookup type corresponds to the IP version used by the client. */
1622
1623 #if HAVE_IPV6
1624 if (Ustrchr(sender_host_address, ':') != NULL)
1625 type = T_AAAA;
1626 else
1627 #endif /* HAVE_IPV6 */
1628 type = T_A;
1629
1630
1631 lookup_dnssec_authenticated = NULL;
1632 switch (dns_lookup(&dnsa, target, type, NULL))
1633 {
1634 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1635
1636 default:
1637 return t->data.val = CSA_DEFER_ADDR;
1638
1639 /* If the query succeeded, scan the addresses and return the result. */
1640
1641 case DNS_SUCCEED:
1642 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1643 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1644 /* else fall through */
1645
1646 /* If the target has no IP addresses, the client cannot have an authorized
1647 IP address. However, if the target site uses A6 records (not AAAA records)
1648 we have to do yet another lookup in order to check them. */
1649
1650 case DNS_NOMATCH:
1651 case DNS_NODATA:
1652 return t->data.val = CSA_FAIL_NOADDR;
1653 }
1654 }
1655
1656
1657
1658 /*************************************************
1659 * Handle verification (address & other) *
1660 *************************************************/
1661
1662 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1663 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1664 VERIFY_HDR_NAMES_ASCII
1665 };
1666 typedef struct {
1667 uschar * name;
1668 int value;
1669 unsigned where_allowed; /* bitmap */
1670 BOOL no_options; /* Never has /option(s) following */
1671 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1672 } verify_type_t;
1673 static verify_type_t verify_type_list[] = {
1674 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1675 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1676 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1677 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1678 { US"header_syntax", VERIFY_HDR_SYNTAX, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1679 { US"not_blind", VERIFY_NOT_BLIND, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 },
1680 { US"header_sender", VERIFY_HDR_SNDR, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), FALSE, 0 },
1681 { US"sender", VERIFY_SNDR, (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)
1682 |(1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP),
1683 FALSE, 6 },
1684 { US"recipient", VERIFY_RCPT, (1<<ACL_WHERE_RCPT), FALSE, 0 },
1685 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP), TRUE, 0 }
1686 };
1687
1688
1689 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1690 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1691 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1692 CALLOUT_TIME
1693 };
1694 typedef struct {
1695 uschar * name;
1696 int value;
1697 int flag;
1698 BOOL has_option; /* Has =option(s) following */
1699 BOOL timeval; /* Has a time value */
1700 } callout_opt_t;
1701 static callout_opt_t callout_opt_list[] = {
1702 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1703 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1704 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1705 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1706 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1707 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1708 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1709 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1710 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1711 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1712 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1713 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1714 };
1715
1716
1717
1718 /* This function implements the "verify" condition. It is called when
1719 encountered in any ACL, because some tests are almost always permitted. Some
1720 just don't make sense, and always fail (for example, an attempt to test a host
1721 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1722
1723 Arguments:
1724 where where called from
1725 addr the recipient address that the ACL is handling, or NULL
1726 arg the argument of "verify"
1727 user_msgptr pointer for user message
1728 log_msgptr pointer for log message
1729 basic_errno where to put verify errno
1730
1731 Returns: OK verification condition succeeded
1732 FAIL verification failed
1733 DEFER there was a problem verifying
1734 ERROR syntax error
1735 */
1736
1737 static int
1738 acl_verify(int where, address_item *addr, const uschar *arg,
1739 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1740 {
1741 int sep = '/';
1742 int callout = -1;
1743 int callout_overall = -1;
1744 int callout_connect = -1;
1745 int verify_options = 0;
1746 int rc;
1747 BOOL verify_header_sender = FALSE;
1748 BOOL defer_ok = FALSE;
1749 BOOL callout_defer_ok = FALSE;
1750 BOOL no_details = FALSE;
1751 BOOL success_on_redirect = FALSE;
1752 address_item *sender_vaddr = NULL;
1753 uschar *verify_sender_address = NULL;
1754 uschar *pm_mailfrom = NULL;
1755 uschar *se_mailfrom = NULL;
1756
1757 /* Some of the verify items have slash-separated options; some do not. Diagnose
1758 an error if options are given for items that don't expect them.
1759 */
1760
1761 uschar *slash = Ustrchr(arg, '/');
1762 const uschar *list = arg;
1763 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1764 verify_type_t * vp;
1765
1766 if (ss == NULL) goto BAD_VERIFY;
1767
1768 /* Handle name/address consistency verification in a separate function. */
1769
1770 for (vp= verify_type_list;
1771 (char *)vp < (char *)verify_type_list + sizeof(verify_type_list);
1772 vp++
1773 )
1774 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1775 : strcmpic (ss, vp->name) == 0)
1776 break;
1777 if ((char *)vp >= (char *)verify_type_list + sizeof(verify_type_list))
1778 goto BAD_VERIFY;
1779
1780 if (vp->no_options && slash != NULL)
1781 {
1782 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1783 "(this verify item has no options)", arg);
1784 return ERROR;
1785 }
1786 if (!(vp->where_allowed & (1<<where)))
1787 {
1788 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s", vp->name, acl_wherenames[where]);
1789 return ERROR;
1790 }
1791 switch(vp->value)
1792 {
1793 case VERIFY_REV_HOST_LKUP:
1794 if (sender_host_address == NULL) return OK;
1795 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1796 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1797 if (strcmpic(ss, US"defer_ok") == 0)
1798 return OK;
1799 return rc;
1800
1801 case VERIFY_CERT:
1802 /* TLS certificate verification is done at STARTTLS time; here we just
1803 test whether it was successful or not. (This is for optional verification; for
1804 mandatory verification, the connection doesn't last this long.) */
1805
1806 if (tls_in.certificate_verified) return OK;
1807 *user_msgptr = US"no verified certificate";
1808 return FAIL;
1809
1810 case VERIFY_HELO:
1811 /* We can test the result of optional HELO verification that might have
1812 occurred earlier. If not, we can attempt the verification now. */
1813
1814 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1815 return helo_verified? OK : FAIL;
1816
1817 case VERIFY_CSA:
1818 /* Do Client SMTP Authorization checks in a separate function, and turn the
1819 result code into user-friendly strings. */
1820
1821 rc = acl_verify_csa(list);
1822 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1823 csa_reason_string[rc]);
1824 csa_status = csa_status_string[rc];
1825 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1826 return csa_return_code[rc];
1827
1828 case VERIFY_HDR_SYNTAX:
1829 /* Check that all relevant header lines have the correct syntax. If there is
1830 a syntax error, we return details of the error to the sender if configured to
1831 send out full details. (But a "message" setting on the ACL can override, as
1832 always). */
1833
1834 rc = verify_check_headers(log_msgptr);
1835 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1836 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1837 return rc;
1838
1839 case VERIFY_HDR_NAMES_ASCII:
1840 /* Check that all header names are true 7 bit strings
1841 See RFC 5322, 2.2. and RFC 6532, 3. */
1842
1843 rc = verify_check_header_names_ascii(log_msgptr);
1844 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1845 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1846 return rc;
1847
1848 case VERIFY_NOT_BLIND:
1849 /* Check that no recipient of this message is "blind", that is, every envelope
1850 recipient must be mentioned in either To: or Cc:. */
1851
1852 rc = verify_check_notblind();
1853 if (rc != OK)
1854 {
1855 *log_msgptr = string_sprintf("bcc recipient detected");
1856 if (smtp_return_error_details)
1857 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1858 }
1859 return rc;
1860
1861 /* The remaining verification tests check recipient and sender addresses,
1862 either from the envelope or from the header. There are a number of
1863 slash-separated options that are common to all of them. */
1864
1865 case VERIFY_HDR_SNDR:
1866 verify_header_sender = TRUE;
1867 break;
1868
1869 case VERIFY_SNDR:
1870 /* In the case of a sender, this can optionally be followed by an address to use
1871 in place of the actual sender (rare special-case requirement). */
1872 {
1873 uschar *s = ss + 6;
1874 if (*s == 0)
1875 verify_sender_address = sender_address;
1876 else
1877 {
1878 while (isspace(*s)) s++;
1879 if (*s++ != '=') goto BAD_VERIFY;
1880 while (isspace(*s)) s++;
1881 verify_sender_address = string_copy(s);
1882 }
1883 }
1884 break;
1885
1886 case VERIFY_RCPT:
1887 break;
1888 }
1889
1890
1891
1892 /* Remaining items are optional; they apply to sender and recipient
1893 verification, including "header sender" verification. */
1894
1895 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1896 != NULL)
1897 {
1898 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1899 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1900 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1901
1902 /* These two old options are left for backwards compatibility */
1903
1904 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1905 {
1906 callout_defer_ok = TRUE;
1907 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1908 }
1909
1910 else if (strcmpic(ss, US"check_postmaster") == 0)
1911 {
1912 pm_mailfrom = US"";
1913 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1914 }
1915
1916 /* The callout option has a number of sub-options, comma separated */
1917
1918 else if (strncmpic(ss, US"callout", 7) == 0)
1919 {
1920 callout = CALLOUT_TIMEOUT_DEFAULT;
1921 ss += 7;
1922 if (*ss != 0)
1923 {
1924 while (isspace(*ss)) ss++;
1925 if (*ss++ == '=')
1926 {
1927 const uschar * sublist = ss;
1928 int optsep = ',';
1929 uschar *opt;
1930 uschar buffer[256];
1931 while (isspace(*sublist)) sublist++;
1932
1933 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer)))
1934 != NULL)
1935 {
1936 callout_opt_t * op;
1937 double period = 1.0F;
1938
1939 for (op= callout_opt_list; op->name; op++)
1940 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1941 break;
1942
1943 verify_options |= op->flag;
1944 if (op->has_option)
1945 {
1946 opt += Ustrlen(op->name);
1947 while (isspace(*opt)) opt++;
1948 if (*opt++ != '=')
1949 {
1950 *log_msgptr = string_sprintf("'=' expected after "
1951 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1952 return ERROR;
1953 }
1954 while (isspace(*opt)) opt++;
1955 }
1956 if (op->timeval)
1957 {
1958 period = readconf_readtime(opt, 0, FALSE);
1959 if (period < 0)
1960 {
1961 *log_msgptr = string_sprintf("bad time value in ACL condition "
1962 "\"verify %s\"", arg);
1963 return ERROR;
1964 }
1965 }
1966
1967 switch(op->value)
1968 {
1969 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1970 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1971 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1972 case CALLOUT_MAILFROM:
1973 if (!verify_header_sender)
1974 {
1975 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1976 "callout option only for verify=header_sender (detected in ACL "
1977 "condition \"%s\")", arg);
1978 return ERROR;
1979 }
1980 se_mailfrom = string_copy(opt);
1981 break;
1982 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1983 case CALLOUT_MAXWAIT: callout_overall = period; break;
1984 case CALLOUT_CONNECT: callout_connect = period; break;
1985 case CALLOUT_TIME: callout = period; break;
1986 }
1987 }
1988 }
1989 else
1990 {
1991 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1992 "ACL condition \"%s\"", arg);
1993 return ERROR;
1994 }
1995 }
1996 }
1997
1998 /* Option not recognized */
1999
2000 else
2001 {
2002 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
2003 "condition \"verify %s\"", ss, arg);
2004 return ERROR;
2005 }
2006 }
2007
2008 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
2009 (vopt_callout_recipsender|vopt_callout_recippmaster))
2010 {
2011 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
2012 "for a recipient callout";
2013 return ERROR;
2014 }
2015
2016 /* Handle sender-in-header verification. Default the user message to the log
2017 message if giving out verification details. */
2018
2019 if (verify_header_sender)
2020 {
2021 int verrno;
2022 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
2023 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2024 &verrno);
2025 if (rc != OK)
2026 {
2027 *basic_errno = verrno;
2028 if (smtp_return_error_details)
2029 {
2030 if (*user_msgptr == NULL && *log_msgptr != NULL)
2031 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2032 if (rc == DEFER) acl_temp_details = TRUE;
2033 }
2034 }
2035 }
2036
2037 /* Handle a sender address. The default is to verify *the* sender address, but
2038 optionally a different address can be given, for special requirements. If the
2039 address is empty, we are dealing with a bounce message that has no sender, so
2040 we cannot do any checking. If the real sender address gets rewritten during
2041 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2042 during message reception.
2043
2044 A list of verified "sender" addresses is kept to try to avoid doing to much
2045 work repetitively when there are multiple recipients in a message and they all
2046 require sender verification. However, when callouts are involved, it gets too
2047 complicated because different recipients may require different callout options.
2048 Therefore, we always do a full sender verify when any kind of callout is
2049 specified. Caching elsewhere, for instance in the DNS resolver and in the
2050 callout handling, should ensure that this is not terribly inefficient. */
2051
2052 else if (verify_sender_address != NULL)
2053 {
2054 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
2055 != 0)
2056 {
2057 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2058 "sender verify callout";
2059 return ERROR;
2060 }
2061
2062 sender_vaddr = verify_checked_sender(verify_sender_address);
2063 if (sender_vaddr != NULL && /* Previously checked */
2064 callout <= 0) /* No callout needed this time */
2065 {
2066 /* If the "routed" flag is set, it means that routing worked before, so
2067 this check can give OK (the saved return code value, if set, belongs to a
2068 callout that was done previously). If the "routed" flag is not set, routing
2069 must have failed, so we use the saved return code. */
2070
2071 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
2072 {
2073 rc = sender_vaddr->special_action;
2074 *basic_errno = sender_vaddr->basic_errno;
2075 }
2076 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
2077 }
2078
2079 /* Do a new verification, and cache the result. The cache is used to avoid
2080 verifying the sender multiple times for multiple RCPTs when callouts are not
2081 specified (see comments above).
2082
2083 The cache is also used on failure to give details in response to the first
2084 RCPT that gets bounced for this reason. However, this can be suppressed by
2085 the no_details option, which sets the flag that says "this detail has already
2086 been sent". The cache normally contains just one address, but there may be
2087 more in esoteric circumstances. */
2088
2089 else
2090 {
2091 BOOL routed = TRUE;
2092 uschar *save_address_data = deliver_address_data;
2093
2094 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2095 #ifdef EXPERIMENTAL_INTERNATIONAL
2096 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2097 {
2098 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2099 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2100 }
2101 #endif
2102 if (no_details) setflag(sender_vaddr, af_sverify_told);
2103 if (verify_sender_address[0] != 0)
2104 {
2105 /* If this is the real sender address, save the unrewritten version
2106 for use later in receive. Otherwise, set a flag so that rewriting the
2107 sender in verify_address() does not update sender_address. */
2108
2109 if (verify_sender_address == sender_address)
2110 sender_address_unrewritten = sender_address;
2111 else
2112 verify_options |= vopt_fake_sender;
2113
2114 if (success_on_redirect)
2115 verify_options |= vopt_success_on_redirect;
2116
2117 /* The recipient, qualify, and expn options are never set in
2118 verify_options. */
2119
2120 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2121 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2122
2123 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2124
2125 if (rc == OK)
2126 {
2127 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2128 {
2129 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
2130 verify_sender_address, sender_vaddr->address);
2131 }
2132 else
2133 {
2134 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
2135 verify_sender_address);
2136 }
2137 }
2138 else *basic_errno = sender_vaddr->basic_errno;
2139 }
2140 else rc = OK; /* Null sender */
2141
2142 /* Cache the result code */
2143
2144 if (routed) setflag(sender_vaddr, af_verify_routed);
2145 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2146 sender_vaddr->special_action = rc;
2147 sender_vaddr->next = sender_verified_list;
2148 sender_verified_list = sender_vaddr;
2149
2150 /* Restore the recipient address data, which might have been clobbered by
2151 the sender verification. */
2152
2153 deliver_address_data = save_address_data;
2154 }
2155
2156 /* Put the sender address_data value into $sender_address_data */
2157
2158 sender_address_data = sender_vaddr->prop.address_data;
2159 }
2160
2161 /* A recipient address just gets a straightforward verify; again we must handle
2162 the DEFER overrides. */
2163
2164 else
2165 {
2166 address_item addr2;
2167
2168 if (success_on_redirect)
2169 verify_options |= vopt_success_on_redirect;
2170
2171 /* We must use a copy of the address for verification, because it might
2172 get rewritten. */
2173
2174 addr2 = *addr;
2175 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2176 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2177 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
2178
2179 *basic_errno = addr2.basic_errno;
2180 *log_msgptr = addr2.message;
2181 *user_msgptr = (addr2.user_message != NULL)?
2182 addr2.user_message : addr2.message;
2183
2184 /* Allow details for temporary error if the address is so flagged. */
2185 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
2186
2187 /* Make $address_data visible */
2188 deliver_address_data = addr2.prop.address_data;
2189 }
2190
2191 /* We have a result from the relevant test. Handle defer overrides first. */
2192
2193 if (rc == DEFER && (defer_ok ||
2194 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2195 {
2196 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
2197 defer_ok? "defer_ok" : "callout_defer_ok");
2198 rc = OK;
2199 }
2200
2201 /* If we've failed a sender, set up a recipient message, and point
2202 sender_verified_failed to the address item that actually failed. */
2203
2204 if (rc != OK && verify_sender_address != NULL)
2205 {
2206 if (rc != DEFER)
2207 *log_msgptr = *user_msgptr = US"Sender verify failed";
2208 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2209 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2210 else
2211 {
2212 *log_msgptr = US"Could not complete sender verify callout";
2213 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2214 *log_msgptr;
2215 }
2216
2217 sender_verified_failed = sender_vaddr;
2218 }
2219
2220 /* Verifying an address messes up the values of $domain and $local_part,
2221 so reset them before returning if this is a RCPT ACL. */
2222
2223 if (addr != NULL)
2224 {
2225 deliver_domain = addr->domain;
2226 deliver_localpart = addr->local_part;
2227 }
2228 return rc;
2229
2230 /* Syntax errors in the verify argument come here. */
2231
2232 BAD_VERIFY:
2233 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2234 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2235 "or \"reverse_host_lookup\" at start of ACL condition "
2236 "\"verify %s\"", arg);
2237 return ERROR;
2238 }
2239
2240
2241
2242
2243 /*************************************************
2244 * Check argument for control= modifier *
2245 *************************************************/
2246
2247 /* Called from acl_check_condition() below
2248
2249 Arguments:
2250 arg the argument string for control=
2251 pptr set to point to the terminating character
2252 where which ACL we are in
2253 log_msgptr for error messages
2254
2255 Returns: CONTROL_xxx value
2256 */
2257
2258 static int
2259 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2260 {
2261 int len;
2262 control_def *d;
2263
2264 for (d = controls_list;
2265 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2266 d++)
2267 {
2268 len = Ustrlen(d->name);
2269 if (Ustrncmp(d->name, arg, len) == 0) break;
2270 }
2271
2272 if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2273 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2274 {
2275 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2276 return CONTROL_ERROR;
2277 }
2278
2279 *pptr = arg + len;
2280 return d->value;
2281 }
2282
2283
2284
2285
2286 /*************************************************
2287 * Return a ratelimit error *
2288 *************************************************/
2289
2290 /* Called from acl_ratelimit() below
2291
2292 Arguments:
2293 log_msgptr for error messages
2294 format format string
2295 ... supplementary arguments
2296 ss ratelimit option name
2297 where ACL_WHERE_xxxx indicating which ACL this is
2298
2299 Returns: ERROR
2300 */
2301
2302 static int
2303 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2304 {
2305 va_list ap;
2306 uschar buffer[STRING_SPRINTF_BUFFER_SIZE];
2307 va_start(ap, format);
2308 if (!string_vformat(buffer, sizeof(buffer), format, ap))
2309 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2310 "string_sprintf expansion was longer than " SIZE_T_FMT, sizeof(buffer));
2311 va_end(ap);
2312 *log_msgptr = string_sprintf(
2313 "error in arguments to \"ratelimit\" condition: %s", buffer);
2314 return ERROR;
2315 }
2316
2317
2318
2319
2320 /*************************************************
2321 * Handle rate limiting *
2322 *************************************************/
2323
2324 /* Called by acl_check_condition() below to calculate the result
2325 of the ACL ratelimit condition.
2326
2327 Note that the return value might be slightly unexpected: if the
2328 sender's rate is above the limit then the result is OK. This is
2329 similar to the dnslists condition, and is so that you can write
2330 ACL clauses like: defer ratelimit = 15 / 1h
2331
2332 Arguments:
2333 arg the option string for ratelimit=
2334 where ACL_WHERE_xxxx indicating which ACL this is
2335 log_msgptr for error messages
2336
2337 Returns: OK - Sender's rate is above limit
2338 FAIL - Sender's rate is below limit
2339 DEFER - Problem opening ratelimit database
2340 ERROR - Syntax error in options.
2341 */
2342
2343 static int
2344 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2345 {
2346 double limit, period, count;
2347 uschar *ss;
2348 uschar *key = NULL;
2349 uschar *unique = NULL;
2350 int sep = '/';
2351 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2352 BOOL noupdate = FALSE, badacl = FALSE;
2353 int mode = RATE_PER_WHAT;
2354 int old_pool, rc;
2355 tree_node **anchor, *t;
2356 open_db dbblock, *dbm;
2357 int dbdb_size;
2358 dbdata_ratelimit *dbd;
2359 dbdata_ratelimit_unique *dbdb;
2360 struct timeval tv;
2361
2362 /* Parse the first two options and record their values in expansion
2363 variables. These variables allow the configuration to have informative
2364 error messages based on rate limits obtained from a table lookup. */
2365
2366 /* First is the maximum number of messages per period / maximum burst
2367 size, which must be greater than or equal to zero. Zero is useful for
2368 rate measurement as opposed to rate limiting. */
2369
2370 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2371 if (sender_rate_limit == NULL)
2372 {
2373 limit = -1.0;
2374 ss = NULL; /* compiler quietening */
2375 }
2376 else
2377 {
2378 limit = Ustrtod(sender_rate_limit, &ss);
2379 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2380 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2381 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2382 }
2383 if (limit < 0.0 || *ss != '\0')
2384 return ratelimit_error(log_msgptr,
2385 "\"%s\" is not a positive number", sender_rate_limit);
2386
2387 /* Second is the rate measurement period / exponential smoothing time
2388 constant. This must be strictly greater than zero, because zero leads to
2389 run-time division errors. */
2390
2391 sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2392 if (sender_rate_period == NULL) period = -1.0;
2393 else period = readconf_readtime(sender_rate_period, 0, FALSE);
2394 if (period <= 0.0)
2395 return ratelimit_error(log_msgptr,
2396 "\"%s\" is not a time value", sender_rate_period);
2397
2398 /* By default we are counting one of something, but the per_rcpt,
2399 per_byte, and count options can change this. */
2400
2401 count = 1.0;
2402
2403 /* Parse the other options. */
2404
2405 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2406 != NULL)
2407 {
2408 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2409 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2410 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2411 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2412 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2413 else if (strcmpic(ss, US"per_conn") == 0)
2414 {
2415 RATE_SET(mode, PER_CONN);
2416 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2417 badacl = TRUE;
2418 }
2419 else if (strcmpic(ss, US"per_mail") == 0)
2420 {
2421 RATE_SET(mode, PER_MAIL);
2422 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2423 }
2424 else if (strcmpic(ss, US"per_rcpt") == 0)
2425 {
2426 /* If we are running in the RCPT ACL, then we'll count the recipients
2427 one by one, but if we are running when we have accumulated the whole
2428 list then we'll add them all in one batch. */
2429 if (where == ACL_WHERE_RCPT)
2430 RATE_SET(mode, PER_RCPT);
2431 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2432 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2433 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2434 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2435 }
2436 else if (strcmpic(ss, US"per_byte") == 0)
2437 {
2438 /* If we have not yet received the message data and there was no SIZE
2439 declaration on the MAIL comand, then it's safe to just use a value of
2440 zero and let the recorded rate decay as if nothing happened. */
2441 RATE_SET(mode, PER_MAIL);
2442 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2443 else count = message_size < 0 ? 0.0 : (double)message_size;
2444 }
2445 else if (strcmpic(ss, US"per_addr") == 0)
2446 {
2447 RATE_SET(mode, PER_RCPT);
2448 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2449 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2450 }
2451 else if (strncmpic(ss, US"count=", 6) == 0)
2452 {
2453 uschar *e;
2454 count = Ustrtod(ss+6, &e);
2455 if (count < 0.0 || *e != '\0')
2456 return ratelimit_error(log_msgptr,
2457 "\"%s\" is not a positive number", ss);
2458 }
2459 else if (strncmpic(ss, US"unique=", 7) == 0)
2460 unique = string_copy(ss + 7);
2461 else if (key == NULL)
2462 key = string_copy(ss);
2463 else
2464 key = string_sprintf("%s/%s", key, ss);
2465 }
2466
2467 /* Sanity check. When the badacl flag is set the update mode must either
2468 be readonly (which is the default if it is omitted) or, for backwards
2469 compatibility, a combination of noupdate and strict or leaky. */
2470
2471 if (mode == RATE_PER_CLASH)
2472 return ratelimit_error(log_msgptr, "conflicting per_* options");
2473 if (leaky + strict + readonly > 1)
2474 return ratelimit_error(log_msgptr, "conflicting update modes");
2475 if (badacl && (leaky || strict) && !noupdate)
2476 return ratelimit_error(log_msgptr,
2477 "\"%s\" must not have /leaky or /strict option in %s ACL",
2478 ratelimit_option_string[mode], acl_wherenames[where]);
2479
2480 /* Set the default values of any unset options. In readonly mode we
2481 perform the rate computation without any increment so that its value
2482 decays to eventually allow over-limit senders through. */
2483
2484 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2485 if (badacl) readonly = TRUE;
2486 if (readonly) count = 0.0;
2487 if (!strict && !readonly) leaky = TRUE;
2488 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2489
2490 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2491 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2492 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2493 are added to the key because they alter the meaning of the stored data. */
2494
2495 if (key == NULL)
2496 key = (sender_host_address == NULL)? US"" : sender_host_address;
2497
2498 key = string_sprintf("%s/%s/%s%s",
2499 sender_rate_period,
2500 ratelimit_option_string[mode],
2501 unique == NULL ? "" : "unique/",
2502 key);
2503
2504 HDEBUG(D_acl)
2505 debug_printf("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2506
2507 /* See if we have already computed the rate by looking in the relevant tree.
2508 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2509 pool so that they survive across resets. In readonly mode we only remember the
2510 result for the rest of this command in case a later command changes it. After
2511 this bit of logic the code is independent of the per_* mode. */
2512
2513 old_pool = store_pool;
2514
2515 if (readonly)
2516 anchor = &ratelimiters_cmd;
2517 else switch(mode) {
2518 case RATE_PER_CONN:
2519 anchor = &ratelimiters_conn;
2520 store_pool = POOL_PERM;
2521 break;
2522 case RATE_PER_BYTE:
2523 case RATE_PER_MAIL:
2524 case RATE_PER_ALLRCPTS:
2525 anchor = &ratelimiters_mail;
2526 break;
2527 case RATE_PER_ADDR:
2528 case RATE_PER_CMD:
2529 case RATE_PER_RCPT:
2530 anchor = &ratelimiters_cmd;
2531 break;
2532 default:
2533 anchor = NULL; /* silence an "unused" complaint */
2534 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2535 "internal ACL error: unknown ratelimit mode %d", mode);
2536 break;
2537 }
2538
2539 t = tree_search(*anchor, key);
2540 if (t != NULL)
2541 {
2542 dbd = t->data.ptr;
2543 /* The following few lines duplicate some of the code below. */
2544 rc = (dbd->rate < limit)? FAIL : OK;
2545 store_pool = old_pool;
2546 sender_rate = string_sprintf("%.1f", dbd->rate);
2547 HDEBUG(D_acl)
2548 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2549 return rc;
2550 }
2551
2552 /* We aren't using a pre-computed rate, so get a previously recorded rate
2553 from the database, which will be updated and written back if required. */
2554
2555 dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2556 if (dbm == NULL)
2557 {
2558 store_pool = old_pool;
2559 sender_rate = NULL;
2560 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2561 *log_msgptr = US"ratelimit database not available";
2562 return DEFER;
2563 }
2564 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2565 dbd = NULL;
2566
2567 gettimeofday(&tv, NULL);
2568
2569 if (dbdb != NULL)
2570 {
2571 /* Locate the basic ratelimit block inside the DB data. */
2572 HDEBUG(D_acl) debug_printf("ratelimit found key in database\n");
2573 dbd = &dbdb->dbd;
2574
2575 /* Forget the old Bloom filter if it is too old, so that we count each
2576 repeating event once per period. We don't simply clear and re-use the old
2577 filter because we want its size to change if the limit changes. Note that
2578 we keep the dbd pointer for copying the rate into the new data block. */
2579
2580 if(unique != NULL && tv.tv_sec > dbdb->bloom_epoch + period)
2581 {
2582 HDEBUG(D_acl) debug_printf("ratelimit discarding old Bloom filter\n");
2583 dbdb = NULL;
2584 }
2585
2586 /* Sanity check. */
2587
2588 if(unique != NULL && dbdb_size < sizeof(*dbdb))
2589 {
2590 HDEBUG(D_acl) debug_printf("ratelimit discarding undersize Bloom filter\n");
2591 dbdb = NULL;
2592 }
2593 }
2594
2595 /* Allocate a new data block if the database lookup failed
2596 or the Bloom filter passed its age limit. */
2597
2598 if (dbdb == NULL)
2599 {
2600 if (unique == NULL)
2601 {
2602 /* No Bloom filter. This basic ratelimit block is initialized below. */
2603 HDEBUG(D_acl) debug_printf("ratelimit creating new rate data block\n");
2604 dbdb_size = sizeof(*dbd);
2605 dbdb = store_get(dbdb_size);
2606 }
2607 else
2608 {
2609 int extra;
2610 HDEBUG(D_acl) debug_printf("ratelimit creating new Bloom filter\n");
2611
2612 /* See the long comment below for an explanation of the magic number 2.
2613 The filter has a minimum size in case the rate limit is very small;
2614 this is determined by the definition of dbdata_ratelimit_unique. */
2615
2616 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2617 if (extra < 0) extra = 0;
2618 dbdb_size = sizeof(*dbdb) + extra;
2619 dbdb = store_get(dbdb_size);
2620 dbdb->bloom_epoch = tv.tv_sec;
2621 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2622 memset(dbdb->bloom, 0, dbdb->bloom_size);
2623
2624 /* Preserve any basic ratelimit data (which is our longer-term memory)
2625 by copying it from the discarded block. */
2626
2627 if (dbd != NULL)
2628 {
2629 dbdb->dbd = *dbd;
2630 dbd = &dbdb->dbd;
2631 }
2632 }
2633 }
2634
2635 /* If we are counting unique events, find out if this event is new or not.
2636 If the client repeats the event during the current period then it should be
2637 counted. We skip this code in readonly mode for efficiency, because any
2638 changes to the filter will be discarded and because count is already set to
2639 zero. */
2640
2641 if (unique != NULL && !readonly)
2642 {
2643 /* We identify unique events using a Bloom filter. (You can find my
2644 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2645 With the per_addr option, an "event" is a recipient address, though the
2646 user can use the unique option to define their own events. We only count
2647 an event if we have not seen it before.
2648
2649 We size the filter according to the rate limit, which (in leaky mode)
2650 is the limit on the population of the filter. We allow 16 bits of space
2651 per entry (see the construction code above) and we set (up to) 8 of them
2652 when inserting an element (see the loop below). The probability of a false
2653 positive (an event we have not seen before but which we fail to count) is
2654
2655 size = limit * 16
2656 numhash = 8
2657 allzero = exp(-numhash * pop / size)
2658 = exp(-0.5 * pop / limit)
2659 fpr = pow(1 - allzero, numhash)
2660
2661 For senders at the limit the fpr is 0.06% or 1 in 1700
2662 and for senders at half the limit it is 0.0006% or 1 in 170000
2663
2664 In strict mode the Bloom filter can fill up beyond the normal limit, in
2665 which case the false positive rate will rise. This means that the
2666 measured rate for very fast senders can bogusly drop off after a while.
2667
2668 At twice the limit, the fpr is 2.5% or 1 in 40
2669 At four times the limit, it is 31% or 1 in 3.2
2670
2671 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2672 decay below the limit, and if this is more than one then the Bloom filter
2673 will be discarded before the decay gets that far. The false positive rate
2674 at this threshold is 9.3% or 1 in 10.7. */
2675
2676 BOOL seen;
2677 unsigned n, hash, hinc;
2678 uschar md5sum[16];
2679 md5 md5info;
2680
2681 /* Instead of using eight independent hash values, we combine two values
2682 using the formula h1 + n * h2. This does not harm the Bloom filter's
2683 performance, and means the amount of hash we need is independent of the
2684 number of bits we set in the filter. */
2685
2686 md5_start(&md5info);
2687 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2688 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2689 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2690
2691 /* Scan the bits corresponding to this event. A zero bit means we have
2692 not seen it before. Ensure all bits are set to record this event. */
2693
2694 HDEBUG(D_acl) debug_printf("ratelimit checking uniqueness of %s\n", unique);
2695
2696 seen = TRUE;
2697 for (n = 0; n < 8; n++, hash += hinc)
2698 {
2699 int bit = 1 << (hash % 8);
2700 int byte = (hash / 8) % dbdb->bloom_size;
2701 if ((dbdb->bloom[byte] & bit) == 0)
2702 {
2703 dbdb->bloom[byte] |= bit;
2704 seen = FALSE;
2705 }
2706 }
2707
2708 /* If this event has occurred before, do not count it. */
2709
2710 if (seen)
2711 {
2712 HDEBUG(D_acl) debug_printf("ratelimit event found in Bloom filter\n");
2713 count = 0.0;
2714 }
2715 else
2716 HDEBUG(D_acl) debug_printf("ratelimit event added to Bloom filter\n");
2717 }
2718
2719 /* If there was no previous ratelimit data block for this key, initialize
2720 the new one, otherwise update the block from the database. The initial rate
2721 is what would be computed by the code below for an infinite interval. */
2722
2723 if (dbd == NULL)
2724 {
2725 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's rate data\n");
2726 dbd = &dbdb->dbd;
2727 dbd->time_stamp = tv.tv_sec;
2728 dbd->time_usec = tv.tv_usec;
2729 dbd->rate = count;
2730 }
2731 else
2732 {
2733 /* The smoothed rate is computed using an exponentially weighted moving
2734 average adjusted for variable sampling intervals. The standard EWMA for
2735 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2736 where f() is the measured value and f'() is the smoothed value.
2737
2738 Old data decays out of the smoothed value exponentially, such that data n
2739 samples old is multiplied by a^n. The exponential decay time constant p
2740 is defined such that data p samples old is multiplied by 1/e, which means
2741 that a = exp(-1/p). We can maintain the same time constant for a variable
2742 sampling interval i by using a = exp(-i/p).
2743
2744 The rate we are measuring is messages per period, suitable for directly
2745 comparing with the limit. The average rate between now and the previous
2746 message is period / interval, which we feed into the EWMA as the sample.
2747
2748 It turns out that the number of messages required for the smoothed rate
2749 to reach the limit when they are sent in a burst is equal to the limit.
2750 This can be seen by analysing the value of the smoothed rate after N
2751 messages sent at even intervals. Let k = (1 - a) * p/i
2752
2753 rate_1 = (1 - a) * p/i + a * rate_0
2754 = k + a * rate_0
2755 rate_2 = k + a * rate_1
2756 = k + a * k + a^2 * rate_0
2757 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2758 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2759 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2760 = rate_0 * a^N + p/i * (1 - a^N)
2761
2762 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2763
2764 rate_N = p/i + (rate_0 - p/i) * a^N
2765 a^N = (rate_N - p/i) / (rate_0 - p/i)
2766 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2767 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2768
2769 Numerical analysis of the above equation, setting the computed rate to
2770 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2771 rates, p/i, the number of messages N = limit. So limit serves as both the
2772 maximum rate measured in messages per period, and the maximum number of
2773 messages that can be sent in a fast burst. */
2774
2775 double this_time = (double)tv.tv_sec
2776 + (double)tv.tv_usec / 1000000.0;
2777 double prev_time = (double)dbd->time_stamp
2778 + (double)dbd->time_usec / 1000000.0;
2779
2780 /* We must avoid division by zero, and deal gracefully with the clock going
2781 backwards. If we blunder ahead when time is in reverse then the computed
2782 rate will be bogus. To be safe we clamp interval to a very small number. */
2783
2784 double interval = this_time - prev_time <= 0.0 ? 1e-9
2785 : this_time - prev_time;
2786
2787 double i_over_p = interval / period;
2788 double a = exp(-i_over_p);
2789
2790 /* Combine the instantaneous rate (period / interval) with the previous rate
2791 using the smoothing factor a. In order to measure sized events, multiply the
2792 instantaneous rate by the count of bytes or recipients etc. */
2793
2794 dbd->time_stamp = tv.tv_sec;
2795 dbd->time_usec = tv.tv_usec;
2796 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2797
2798 /* When events are very widely spaced the computed rate tends towards zero.
2799 Although this is accurate it turns out not to be useful for our purposes,
2800 especially when the first event after a long silence is the start of a spam
2801 run. A more useful model is that the rate for an isolated event should be the
2802 size of the event per the period size, ignoring the lack of events outside
2803 the current period and regardless of where the event falls in the period. So,
2804 if the interval was so long that the calculated rate is unhelpfully small, we
2805 re-intialize the rate. In the absence of higher-rate bursts, the condition
2806 below is true if the interval is greater than the period. */
2807
2808 if (dbd->rate < count) dbd->rate = count;
2809 }
2810
2811 /* Clients sending at the limit are considered to be over the limit.
2812 This matters for edge cases such as a limit of zero, when the client
2813 should be completely blocked. */
2814
2815 rc = (dbd->rate < limit)? FAIL : OK;
2816
2817 /* Update the state if the rate is low or if we are being strict. If we
2818 are in leaky mode and the sender's rate is too high, we do not update
2819 the recorded rate in order to avoid an over-aggressive sender's retry
2820 rate preventing them from getting any email through. If readonly is set,
2821 neither leaky nor strict are set, so we do not do any updates. */
2822
2823 if ((rc == FAIL && leaky) || strict)
2824 {
2825 dbfn_write(dbm, key, dbdb, dbdb_size);
2826 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2827 }
2828 else
2829 {
2830 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
2831 readonly? "readonly mode" : "over the limit, but leaky");
2832 }
2833
2834 dbfn_close(dbm);
2835
2836 /* Store the result in the tree for future reference. */
2837
2838 t = store_get(sizeof(tree_node) + Ustrlen(key));
2839 t->data.ptr = dbd;
2840 Ustrcpy(t->name, key);
2841 (void)tree_insertnode(anchor, t);
2842
2843 /* We create the formatted version of the sender's rate very late in
2844 order to ensure that it is done using the correct storage pool. */
2845
2846 store_pool = old_pool;
2847 sender_rate = string_sprintf("%.1f", dbd->rate);
2848
2849 HDEBUG(D_acl)
2850 debug_printf("ratelimit computed rate %s\n", sender_rate);
2851
2852 return rc;
2853 }
2854
2855
2856
2857 /*************************************************
2858 * The udpsend ACL modifier *
2859 *************************************************/
2860
2861 /* Called by acl_check_condition() below.
2862
2863 Arguments:
2864 arg the option string for udpsend=
2865 log_msgptr for error messages
2866
2867 Returns: OK - Completed.
2868 DEFER - Problem with DNS lookup.
2869 ERROR - Syntax error in options.
2870 */
2871
2872 static int
2873 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2874 {
2875 int sep = 0;
2876 uschar *hostname;
2877 uschar *portstr;
2878 uschar *portend;
2879 host_item *h;
2880 int portnum;
2881 int len;
2882 int r, s;
2883 uschar * errstr;
2884
2885 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2886 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2887
2888 if (hostname == NULL)
2889 {
2890 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2891 return ERROR;
2892 }
2893 if (portstr == NULL)
2894 {
2895 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2896 return ERROR;
2897 }
2898 if (arg == NULL)
2899 {
2900 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2901 return ERROR;
2902 }
2903 portnum = Ustrtol(portstr, &portend, 10);
2904 if (*portend != '\0')
2905 {
2906 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2907 return ERROR;
2908 }
2909
2910 /* Make a single-item host list. */
2911 h = store_get(sizeof(host_item));
2912 memset(h, 0, sizeof(host_item));
2913 h->name = hostname;
2914 h->port = portnum;
2915 h->mx = MX_NONE;
2916
2917 if (string_is_ip_address(hostname, NULL))
2918 h->address = hostname, r = HOST_FOUND;
2919 else
2920 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2921 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2922 {
2923 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2924 return DEFER;
2925 }
2926
2927 HDEBUG(D_acl)
2928 debug_printf("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2929
2930 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2931 1, NULL, &errstr);
2932 if (r < 0) goto defer;
2933 len = Ustrlen(arg);
2934 r = send(s, arg, len, 0);
2935 if (r < 0)
2936 {
2937 errstr = US strerror(errno);
2938 close(s);
2939 goto defer;
2940 }
2941 close(s);
2942 if (r < len)
2943 {
2944 *log_msgptr =
2945 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2946 return DEFER;
2947 }
2948
2949 HDEBUG(D_acl)
2950 debug_printf("udpsend %d bytes\n", r);
2951
2952 return OK;
2953
2954 defer:
2955 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2956 return DEFER;
2957 }
2958
2959
2960
2961 /*************************************************
2962 * Handle conditions/modifiers on an ACL item *
2963 *************************************************/
2964
2965 /* Called from acl_check() below.
2966
2967 Arguments:
2968 verb ACL verb
2969 cb ACL condition block - if NULL, result is OK
2970 where where called from
2971 addr the address being checked for RCPT, or NULL
2972 level the nesting level
2973 epp pointer to pass back TRUE if "endpass" encountered
2974 (applies only to "accept" and "discard")
2975 user_msgptr user message pointer
2976 log_msgptr log message pointer
2977 basic_errno pointer to where to put verify error
2978
2979 Returns: OK - all conditions are met
2980 DISCARD - an "acl" condition returned DISCARD - only allowed
2981 for "accept" or "discard" verbs
2982 FAIL - at least one condition fails
2983 FAIL_DROP - an "acl" condition returned FAIL_DROP
2984 DEFER - can't tell at the moment (typically, lookup defer,
2985 but can be temporary callout problem)
2986 ERROR - ERROR from nested ACL or expansion failure or other
2987 error
2988 */
2989
2990 static int
2991 acl_check_condition(int verb, acl_condition_block *cb, int where,
2992 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2993 uschar **log_msgptr, int *basic_errno)
2994 {
2995 uschar *user_message = NULL;
2996 uschar *log_message = NULL;
2997 uschar *debug_tag = NULL;
2998 uschar *debug_opts = NULL;
2999 int rc = OK;
3000 #ifdef WITH_CONTENT_SCAN
3001 int sep = -'/';
3002 #endif
3003
3004 for (; cb != NULL; cb = cb->next)
3005 {
3006 const uschar *arg;
3007 int control_type;
3008
3009 /* The message and log_message items set up messages to be used in
3010 case of rejection. They are expanded later. */
3011
3012 if (cb->type == ACLC_MESSAGE)
3013 {
3014 HDEBUG(D_acl) debug_printf(" message: %s\n", cb->arg);
3015 user_message = cb->arg;
3016 continue;
3017 }
3018
3019 if (cb->type == ACLC_LOG_MESSAGE)
3020 {
3021 HDEBUG(D_acl) debug_printf("l_message: %s\n", cb->arg);
3022 log_message = cb->arg;
3023 continue;
3024 }
3025
3026 /* The endpass "condition" just sets a flag to show it occurred. This is
3027 checked at compile time to be on an "accept" or "discard" item. */
3028
3029 if (cb->type == ACLC_ENDPASS)
3030 {
3031 *epp = TRUE;
3032 continue;
3033 }
3034
3035 /* For other conditions and modifiers, the argument is expanded now for some
3036 of them, but not for all, because expansion happens down in some lower level
3037 checking functions in some cases. */
3038
3039 if (cond_expand_at_top[cb->type])
3040 {
3041 arg = expand_string(cb->arg);
3042 if (arg == NULL)
3043 {
3044 if (expand_string_forcedfail) continue;
3045 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3046 cb->arg, expand_string_message);
3047 return search_find_defer? DEFER : ERROR;
3048 }
3049 }
3050 else arg = cb->arg;
3051
3052 /* Show condition, and expanded condition if it's different */
3053
3054 HDEBUG(D_acl)
3055 {
3056 int lhswidth = 0;
3057 debug_printf("check %s%s %n",
3058 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
3059 conditions[cb->type], &lhswidth);
3060
3061 if (cb->type == ACLC_SET)
3062 {
3063 debug_printf("acl_%s ", cb->u.varname);
3064 lhswidth += 5 + Ustrlen(cb->u.varname);
3065 }
3066
3067 debug_printf("= %s\n", cb->arg);
3068
3069 if (arg != cb->arg)
3070 debug_printf("%.*s= %s\n", lhswidth,
3071 US" ", CS arg);
3072 }
3073
3074 /* Check that this condition makes sense at this time */
3075
3076 if ((cond_forbids[cb->type] & (1 << where)) != 0)
3077 {
3078 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3079 cond_modifiers[cb->type]? "use" : "test",
3080 conditions[cb->type], acl_wherenames[where]);
3081 return ERROR;
3082 }
3083
3084 /* Run the appropriate test for each condition, or take the appropriate
3085 action for the remaining modifiers. */
3086
3087 switch(cb->type)
3088 {
3089 case ACLC_ADD_HEADER:
3090 setup_header(arg);
3091 break;
3092
3093 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3094 "discard" verb. */
3095
3096 case ACLC_ACL:
3097 rc = acl_check_wargs(where, addr, arg, level+1, user_msgptr, log_msgptr);
3098 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3099 {
3100 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3101 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3102 verbs[verb]);
3103 return ERROR;
3104 }
3105 break;
3106
3107 case ACLC_AUTHENTICATED:
3108 rc = (sender_host_authenticated == NULL)? FAIL :
3109 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
3110 TRUE, NULL);
3111 break;
3112
3113 #ifdef EXPERIMENTAL_BRIGHTMAIL
3114 case ACLC_BMI_OPTIN:
3115 {
3116 int old_pool = store_pool;
3117 store_pool = POOL_PERM;
3118 bmi_current_optin = string_copy(arg);
3119 store_pool = old_pool;
3120 }
3121 break;
3122 #endif
3123
3124 case ACLC_CONDITION:
3125 /* The true/false parsing here should be kept in sync with that used in
3126 expand.c when dealing with ECOND_BOOL so that we don't have too many
3127 different definitions of what can be a boolean. */
3128 if (*arg == '-'
3129 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3130 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3131 rc = (Uatoi(arg) == 0)? FAIL : OK;
3132 else
3133 rc = (strcmpic(arg, US"no") == 0 ||
3134 strcmpic(arg, US"false") == 0)? FAIL :
3135 (strcmpic(arg, US"yes") == 0 ||
3136 strcmpic(arg, US"true") == 0)? OK : DEFER;
3137 if (rc == DEFER)
3138 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3139 break;
3140
3141 case ACLC_CONTINUE: /* Always succeeds */
3142 break;
3143
3144 case ACLC_CONTROL:
3145 {
3146 const uschar *p = NULL;
3147 control_type = decode_control(arg, &p, where, log_msgptr);
3148
3149 /* Check if this control makes sense at this time */
3150
3151 if ((control_forbids[control_type] & (1 << where)) != 0)
3152 {
3153 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3154 controls[control_type], acl_wherenames[where]);
3155 return ERROR;
3156 }
3157
3158 switch(control_type)
3159 {
3160 case CONTROL_AUTH_UNADVERTISED:
3161 allow_auth_unadvertised = TRUE;
3162 break;
3163
3164 #ifdef EXPERIMENTAL_BRIGHTMAIL
3165 case CONTROL_BMI_RUN:
3166 bmi_run = 1;
3167 break;
3168 #endif
3169
3170 #ifndef DISABLE_DKIM
3171 case CONTROL_DKIM_VERIFY:
3172 dkim_disable_verify = TRUE;
3173 #ifdef EXPERIMENTAL_DMARC
3174 /* Since DKIM was blocked, skip DMARC too */
3175 dmarc_disable_verify = TRUE;
3176 dmarc_enable_forensic = FALSE;
3177 #endif
3178 break;
3179 #endif
3180
3181 #ifdef EXPERIMENTAL_DMARC
3182 case CONTROL_DMARC_VERIFY:
3183 dmarc_disable_verify = TRUE;
3184 break;
3185
3186 case CONTROL_DMARC_FORENSIC:
3187 dmarc_enable_forensic = TRUE;
3188 break;
3189 #endif
3190
3191 case CONTROL_DSCP:
3192 if (*p == '/')
3193 {
3194 int fd, af, level, optname, value;
3195 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3196 a socket; we can accept that, we'll just debug-log failures anyway. */
3197 fd = fileno(smtp_in);
3198 af = ip_get_address_family(fd);
3199 if (af < 0)
3200 {
3201 HDEBUG(D_acl)
3202 debug_printf("smtp input is probably not a socket [%s], not setting DSCP\n",
3203 strerror(errno));
3204 break;
3205 }
3206 if (dscp_lookup(p+1, af, &level, &optname, &value))
3207 {
3208 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3209 {
3210 HDEBUG(D_acl) debug_printf("failed to set input DSCP[%s]: %s\n",
3211 p+1, strerror(errno));
3212 }
3213 else
3214 {
3215 HDEBUG(D_acl) debug_printf("set input DSCP to \"%s\"\n", p+1);
3216 }
3217 }
3218 else
3219 {
3220 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3221 return ERROR;
3222 }
3223 }
3224 else
3225 {
3226 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3227 return ERROR;
3228 }
3229 break;
3230
3231 case CONTROL_ERROR:
3232 return ERROR;
3233
3234 case CONTROL_CASEFUL_LOCAL_PART:
3235 deliver_localpart = addr->cc_local_part;
3236 break;
3237
3238 case CONTROL_CASELOWER_LOCAL_PART:
3239 deliver_localpart = addr->lc_local_part;
3240 break;
3241
3242 case CONTROL_ENFORCE_SYNC:
3243 smtp_enforce_sync = TRUE;
3244 break;
3245
3246 case CONTROL_NO_ENFORCE_SYNC:
3247 smtp_enforce_sync = FALSE;
3248 break;
3249
3250 #ifdef WITH_CONTENT_SCAN
3251 case CONTROL_NO_MBOX_UNSPOOL:
3252 no_mbox_unspool = TRUE;
3253 break;
3254 #endif
3255
3256 case CONTROL_NO_MULTILINE:
3257 no_multiline_responses = TRUE;
3258 break;
3259
3260 case CONTROL_NO_PIPELINING:
3261 pipelining_enable = FALSE;
3262 break;
3263
3264 case CONTROL_NO_DELAY_FLUSH:
3265 disable_delay_flush = TRUE;
3266 break;
3267
3268 case CONTROL_NO_CALLOUT_FLUSH:
3269 disable_callout_flush = TRUE;
3270 break;
3271
3272 case CONTROL_FAKEREJECT:
3273 cancel_cutthrough_connection("fakereject");
3274 case CONTROL_FAKEDEFER:
3275 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3276 if (*p == '/')
3277 {
3278 const uschar *pp = p + 1;
3279 while (*pp != 0) pp++;
3280 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3281 p = pp;
3282 }
3283 else
3284 {
3285 /* Explicitly reset to default string */
3286 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3287 }
3288 break;
3289
3290 case CONTROL_FREEZE:
3291 deliver_freeze = TRUE;
3292 deliver_frozen_at = time(NULL);
3293 freeze_tell = freeze_tell_config; /* Reset to configured value */
3294 if (Ustrncmp(p, "/no_tell", 8) == 0)
3295 {
3296 p += 8;
3297 freeze_tell = NULL;
3298 }
3299 if (*p != 0)
3300 {
3301 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3302 return ERROR;
3303 }
3304 cancel_cutthrough_connection("item frozen");
3305 break;
3306
3307 case CONTROL_QUEUE_ONLY:
3308 queue_only_policy = TRUE;
3309 cancel_cutthrough_connection("queueing forced");
3310 break;
3311
3312 case CONTROL_SUBMISSION:
3313 originator_name = US"";
3314 submission_mode = TRUE;
3315 while (*p == '/')
3316 {
3317 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3318 {
3319 p += 14;
3320 active_local_sender_retain = TRUE;
3321 active_local_from_check = FALSE;
3322 }
3323 else if (Ustrncmp(p, "/domain=", 8) == 0)
3324 {
3325 const uschar *pp = p + 8;
3326 while (*pp != 0 && *pp != '/') pp++;
3327 submission_domain = string_copyn(p+8, pp-p-8);
3328 p = pp;
3329 }
3330 /* The name= option must be last, because it swallows the rest of
3331 the string. */
3332 else if (Ustrncmp(p, "/name=", 6) == 0)
3333 {
3334 const uschar *pp = p + 6;
3335 while (*pp != 0) pp++;
3336 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3337 big_buffer, big_buffer_size));
3338 p = pp;
3339 }
3340 else break;
3341 }
3342 if (*p != 0)
3343 {
3344 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3345 return ERROR;
3346 }
3347 break;
3348
3349 case CONTROL_DEBUG:
3350 while (*p == '/')
3351 {
3352 if (Ustrncmp(p, "/tag=", 5) == 0)
3353 {
3354 const uschar *pp = p + 5;
3355 while (*pp != '\0' && *pp != '/') pp++;
3356 debug_tag = string_copyn(p+5, pp-p-5);
3357 p = pp;
3358 }
3359 else if (Ustrncmp(p, "/opts=", 6) == 0)
3360 {
3361 const uschar *pp = p + 6;
3362 while (*pp != '\0' && *pp != '/') pp++;
3363 debug_opts = string_copyn(p+6, pp-p-6);
3364 p = pp;
3365 }
3366 }
3367 debug_logging_activate(debug_tag, debug_opts);
3368 break;
3369
3370 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3371 suppress_local_fixups = TRUE;
3372 break;
3373
3374 case CONTROL_CUTTHROUGH_DELIVERY:
3375 if (prdr_requested)
3376 /* Too hard to think about for now. We might in future cutthrough
3377 the case where both sides handle prdr and this-node prdr acl
3378 is "accept" */
3379 *log_msgptr = string_sprintf("PRDR on %s reception\n", arg);
3380 else
3381 {
3382 if (deliver_freeze)
3383 *log_msgptr = US"frozen";
3384 else if (queue_only_policy)
3385 *log_msgptr = US"queue-only";
3386 else if (fake_response == FAIL)
3387 *log_msgptr = US"fakereject";
3388 else
3389 {
3390 if (rcpt_count == 1) cutthrough.delivery = TRUE;
3391 break;
3392 }
3393 *log_msgptr = string_sprintf("\"control=%s\" on %s item",
3394 arg, *log_msgptr);
3395 }
3396 return ERROR;
3397
3398 #ifdef EXPERIMENTAL_INTERNATIONAL
3399 case CONTROL_UTF8_DOWNCONVERT:
3400 if (*p == '/')
3401 {
3402 if (p[1] == '1')
3403 {
3404 message_utf8_downconvert = 1;
3405 addr->prop.utf8_downcvt = TRUE;
3406 addr->prop.utf8_downcvt_maybe = FALSE;
3407 p += 2;
3408 break;
3409 }
3410 if (p[1] == '0')
3411 {
3412 message_utf8_downconvert = 0;
3413 addr->prop.utf8_downcvt = FALSE;
3414 addr->prop.utf8_downcvt_maybe = FALSE;
3415 p += 2;
3416 break;
3417 }
3418 if (p[1] == '-' && p[2] == '1')
3419 {
3420 message_utf8_downconvert = -1;
3421 addr->prop.utf8_downcvt = FALSE;
3422 addr->prop.utf8_downcvt_maybe = TRUE;
3423 p += 3;
3424 break;
3425 }
3426 *log_msgptr = US"bad option value for control=utf8_downconvert";
3427 }
3428 else
3429 {
3430 message_utf8_downconvert = 1;
3431 addr->prop.utf8_downcvt = TRUE;
3432 addr->prop.utf8_downcvt_maybe = FALSE;
3433 break;
3434 }
3435 return ERROR;
3436 #endif
3437
3438 }
3439 break;
3440 }
3441
3442 #ifdef EXPERIMENTAL_DCC
3443 case ACLC_DCC:
3444 {
3445 /* Seperate the regular expression and any optional parameters. */
3446 const uschar * list = arg;
3447 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3448 /* Run the dcc backend. */
3449 rc = dcc_process(&ss);
3450 /* Modify return code based upon the existance of options. */
3451 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3452 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3453 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3454 }
3455 break;
3456 #endif
3457
3458 #ifdef WITH_CONTENT_SCAN
3459 case ACLC_DECODE:
3460 rc = mime_decode(&arg);
3461 break;
3462 #endif
3463
3464 case ACLC_DELAY:
3465 {
3466 int delay = readconf_readtime(arg, 0, FALSE);
3467 if (delay < 0)
3468 {
3469 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3470 "modifier: \"%s\" is not a time value", arg);
3471 return ERROR;
3472 }
3473 else
3474 {
3475 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
3476 delay);
3477 if (host_checking)
3478 {
3479 HDEBUG(D_acl)
3480 debug_printf("delay skipped in -bh checking mode\n");
3481 }
3482
3483 /* It appears to be impossible to detect that a TCP/IP connection has
3484 gone away without reading from it. This means that we cannot shorten
3485 the delay below if the client goes away, because we cannot discover
3486 that the client has closed its end of the connection. (The connection
3487 is actually in a half-closed state, waiting for the server to close its
3488 end.) It would be nice to be able to detect this state, so that the
3489 Exim process is not held up unnecessarily. However, it seems that we
3490 can't. The poll() function does not do the right thing, and in any case
3491 it is not always available.
3492
3493 NOTE 1: If ever this state of affairs changes, remember that we may be
3494 dealing with stdin/stdout here, in addition to TCP/IP connections.
3495 Also, delays may be specified for non-SMTP input, where smtp_out and
3496 smtp_in will be NULL. Whatever is done must work in all cases.
3497
3498 NOTE 2: The added feature of flushing the output before a delay must
3499 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3500 */
3501
3502 else
3503 {
3504 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
3505 while (delay > 0) delay = sleep(delay);
3506 }
3507 }
3508 }
3509 break;
3510
3511 #ifdef WITH_OLD_DEMIME
3512 case ACLC_DEMIME:
3513 rc = demime(&arg);
3514 break;
3515 #endif
3516
3517 #ifndef DISABLE_DKIM
3518 case ACLC_DKIM_SIGNER:
3519 if (dkim_cur_signer != NULL)
3520 rc = match_isinlist(dkim_cur_signer,
3521 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3522 else
3523 rc = FAIL;
3524 break;
3525
3526 case ACLC_DKIM_STATUS:
3527 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
3528 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3529 break;
3530 #endif
3531
3532 #ifdef EXPERIMENTAL_DMARC
3533 case ACLC_DMARC_STATUS:
3534 if (!dmarc_has_been_checked)
3535 dmarc_process();
3536 dmarc_has_been_checked = TRUE;
3537 /* used long way of dmarc_exim_expand_query() in case we need more
3538 * view into the process in the future. */
3539 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3540 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3541 break;
3542 #endif
3543
3544 case ACLC_DNSLISTS:
3545 rc = verify_check_dnsbl(&arg);
3546 break;
3547
3548 case ACLC_DOMAINS:
3549 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3550 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3551 break;
3552
3553 /* The value in tls_cipher is the full cipher name, for example,
3554 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3555 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3556 what may in practice come out of the SSL library - which at the time of
3557 writing is poorly documented. */
3558
3559 case ACLC_ENCRYPTED:
3560 if (tls_in.cipher == NULL) rc = FAIL; else
3561 {
3562 uschar *endcipher = NULL;
3563 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3564 if (cipher == NULL) cipher = tls_in.cipher; else
3565 {
3566 endcipher = Ustrchr(++cipher, ':');
3567 if (endcipher != NULL) *endcipher = 0;
3568 }
3569 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3570 if (endcipher != NULL) *endcipher = ':';
3571 }
3572 break;
3573
3574 /* Use verify_check_this_host() instead of verify_check_host() so that
3575 we can pass over &host_data to catch any looked up data. Once it has been
3576 set, it retains its value so that it's still there if another ACL verb
3577 comes through here and uses the cache. However, we must put it into
3578 permanent store in case it is also expected to be used in a subsequent
3579 message in the same SMTP connection. */
3580
3581 case ACLC_HOSTS:
3582 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3583 (sender_host_address == NULL)? US"" : sender_host_address,
3584 CUSS &host_data);
3585 if (rc == DEFER) *log_msgptr = search_error_message;
3586 if (host_data) host_data = string_copy_malloc(host_data);
3587 break;
3588
3589 case ACLC_LOCAL_PARTS:
3590 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3591 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3592 CUSS &deliver_localpart_data);
3593 break;
3594
3595 case ACLC_LOG_REJECT_TARGET:
3596 {
3597 int logbits = 0;
3598 int sep = 0;
3599 const uschar *s = arg;
3600 uschar *ss;
3601 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
3602 {
3603 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3604 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3605 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3606 else
3607 {
3608 logbits |= LOG_MAIN|LOG_REJECT;
3609 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3610 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3611 }
3612 }
3613 log_reject_target = logbits;
3614 }
3615 break;
3616
3617 case ACLC_LOGWRITE:
3618 {
3619 int logbits = 0;
3620 const uschar *s = arg;
3621 if (*s == ':')
3622 {
3623 s++;
3624 while (*s != ':')
3625 {
3626 if (Ustrncmp(s, "main", 4) == 0)
3627 { logbits |= LOG_MAIN; s += 4; }
3628 else if (Ustrncmp(s, "panic", 5) == 0)
3629 { logbits |= LOG_PANIC; s += 5; }
3630 else if (Ustrncmp(s, "reject", 6) == 0)
3631 { logbits |= LOG_REJECT; s += 6; }
3632 else
3633 {
3634 logbits = LOG_MAIN|LOG_PANIC;
3635 s = string_sprintf(":unknown log name in \"%s\" in "
3636 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3637 }
3638 if (*s == ',') s++;
3639 }
3640 s++;
3641 }
3642 while (isspace(*s)) s++;
3643
3644
3645 if (logbits == 0) logbits = LOG_MAIN;
3646 log_write(0, logbits, "%s", string_printing(s));
3647 }
3648 break;
3649
3650 #ifdef WITH_CONTENT_SCAN
3651 case ACLC_MALWARE: /* Run the malware backend. */
3652 {
3653 /* Separate the regular expression and any optional parameters. */
3654 const uschar * list = arg;
3655 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3656 uschar *opt;
3657 BOOL defer_ok = FALSE;
3658 int timeout = 0;
3659
3660 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3661 if (strcmpic(opt, US"defer_ok") == 0)
3662 defer_ok = TRUE;
3663 else if ( strncmpic(opt, US"tmo=", 4) == 0
3664 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3665 )
3666 {
3667 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3668 return ERROR;
3669 }
3670
3671 rc = malware(ss, timeout);
3672 if (rc == DEFER && defer_ok)
3673 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3674 }
3675 break;
3676
3677 case ACLC_MIME_REGEX:
3678 rc = mime_regex(&arg);
3679 break;
3680 #endif
3681
3682 case ACLC_RATELIMIT:
3683 rc = acl_ratelimit(arg, where, log_msgptr);
3684 break;
3685
3686 case ACLC_RECIPIENTS:
3687 rc = match_address_list((const uschar *)addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3688 CUSS &recipient_data);
3689 break;
3690
3691 #ifdef WITH_CONTENT_SCAN
3692 case ACLC_REGEX:
3693 rc = regex(&arg);
3694 break;
3695 #endif
3696
3697 case ACLC_REMOVE_HEADER:
3698 setup_remove_header(arg);
3699 break;
3700
3701 case ACLC_SENDER_DOMAINS:
3702 {
3703 uschar *sdomain;
3704 sdomain = Ustrrchr(sender_address, '@');
3705 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
3706 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3707 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3708 }
3709 break;
3710
3711 case ACLC_SENDERS:
3712 rc = match_address_list((const uschar *)sender_address, TRUE, TRUE, &arg,
3713 sender_address_cache, -1, 0, CUSS &sender_data);
3714 break;
3715
3716 /* Connection variables must persist forever */
3717
3718 case ACLC_SET:
3719 {
3720 int old_pool = store_pool;
3721 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
3722 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3723 store_pool = old_pool;
3724 }
3725 break;
3726
3727 #ifdef WITH_CONTENT_SCAN
3728 case ACLC_SPAM:
3729 {
3730 /* Seperate the regular expression and any optional parameters. */
3731 const uschar * list = arg;
3732 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3733 /* Run the spam backend. */
3734 rc = spam(CUSS &ss);
3735 /* Modify return code based upon the existance of options. */
3736 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
3737 != NULL) {
3738 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3739 {
3740 /* FAIL so that the message is passed to the next ACL */
3741 rc = FAIL;
3742 }
3743 }
3744 }
3745 break;
3746 #endif
3747
3748 #ifdef EXPERIMENTAL_SPF
3749 case ACLC_SPF:
3750 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3751 break;
3752 case ACLC_SPF_GUESS:
3753 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3754 break;
3755 #endif
3756
3757 case ACLC_UDPSEND:
3758 rc = acl_udpsend(arg, log_msgptr);
3759 break;
3760
3761 /* If the verb is WARN, discard any user message from verification, because
3762 such messages are SMTP responses, not header additions. The latter come
3763 only from explicit "message" modifiers. However, put the user message into
3764 $acl_verify_message so it can be used in subsequent conditions or modifiers
3765 (until something changes it). */
3766
3767 case ACLC_VERIFY:
3768 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3769 acl_verify_message = *user_msgptr;
3770 if (verb == ACL_WARN) *user_msgptr = NULL;
3771 break;
3772
3773 default:
3774 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3775 "condition %d", cb->type);
3776 break;
3777 }
3778
3779 /* If a condition was negated, invert OK/FAIL. */
3780
3781 if (!cond_modifiers[cb->type] && cb->u.negated)
3782 {
3783 if (rc == OK) rc = FAIL;
3784 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3785 }
3786
3787 if (rc != OK) break; /* Conditions loop */
3788 }
3789
3790
3791 /* If the result is the one for which "message" and/or "log_message" are used,
3792 handle the values of these modifiers. If there isn't a log message set, we make
3793 it the same as the user message.
3794
3795 "message" is a user message that will be included in an SMTP response. Unless
3796 it is empty, it overrides any previously set user message.
3797
3798 "log_message" is a non-user message, and it adds to any existing non-user
3799 message that is already set.
3800
3801 Most verbs have but a single return for which the messages are relevant, but
3802 for "discard", it's useful to have the log message both when it succeeds and
3803 when it fails. For "accept", the message is used in the OK case if there is no
3804 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3805 present. */
3806
3807 if (*epp && rc == OK) user_message = NULL;
3808
3809 if (((1<<rc) & msgcond[verb]) != 0)
3810 {
3811 uschar *expmessage;
3812 uschar *old_user_msgptr = *user_msgptr;
3813 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3814
3815 /* If the verb is "warn", messages generated by conditions (verification or
3816 nested ACLs) are always discarded. This also happens for acceptance verbs
3817 when they actually do accept. Only messages specified at this level are used.
3818 However, the value of an existing message is available in $acl_verify_message
3819 during expansions. */
3820
3821 if (verb == ACL_WARN ||
3822 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3823 *log_msgptr = *user_msgptr = NULL;
3824
3825 if (user_message != NULL)
3826 {
3827 acl_verify_message = old_user_msgptr;
3828 expmessage = expand_string(user_message);
3829 if (expmessage == NULL)
3830 {
3831 if (!expand_string_forcedfail)
3832 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3833 user_message, expand_string_message);
3834 }
3835 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3836 }
3837
3838 if (log_message != NULL)
3839 {
3840 acl_verify_message = old_log_msgptr;
3841 expmessage = expand_string(log_message);
3842 if (expmessage == NULL)
3843 {
3844 if (!expand_string_forcedfail)
3845 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3846 log_message, expand_string_message);
3847 }
3848 else if (expmessage[0] != 0)
3849 {
3850 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3851 string_sprintf("%s: %s", expmessage, *log_msgptr);
3852 }
3853 }
3854
3855 /* If no log message, default it to the user message */
3856
3857 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3858 }
3859
3860 acl_verify_message = NULL;
3861 return rc;
3862 }
3863
3864
3865
3866
3867
3868 /*************************************************
3869 * Get line from a literal ACL *
3870 *************************************************/
3871
3872 /* This function is passed to acl_read() in order to extract individual lines
3873 of a literal ACL, which we access via static pointers. We can destroy the
3874 contents because this is called only once (the compiled ACL is remembered).
3875
3876 This code is intended to treat the data in the same way as lines in the main
3877 Exim configuration file. That is:
3878
3879 . Leading spaces are ignored.
3880
3881 . A \ at the end of a line is a continuation - trailing spaces after the \
3882 are permitted (this is because I don't believe in making invisible things
3883 significant). Leading spaces on the continued part of a line are ignored.
3884
3885 . Physical lines starting (significantly) with # are totally ignored, and
3886 may appear within a sequence of backslash-continued lines.
3887
3888 . Blank lines are ignored, but will end a sequence of continuations.
3889
3890 Arguments: none
3891 Returns: a pointer to the next line
3892 */
3893
3894
3895 static uschar *acl_text; /* Current pointer in the text */
3896 static uschar *acl_text_end; /* Points one past the terminating '0' */
3897
3898
3899 static uschar *
3900 acl_getline(void)
3901 {
3902 uschar *yield;
3903
3904 /* This loop handles leading blank lines and comments. */
3905
3906 for(;;)
3907 {
3908 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3909 if (*acl_text == 0) return NULL; /* No more data */
3910 yield = acl_text; /* Potential data line */
3911
3912 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3913
3914 /* If we hit the end before a newline, we have the whole logical line. If
3915 it's a comment, there's no more data to be given. Otherwise, yield it. */
3916
3917 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3918
3919 /* After reaching a newline, end this loop if the physical line does not
3920 start with '#'. If it does, it's a comment, and the loop continues. */
3921
3922 if (*yield != '#') break;
3923 }
3924
3925 /* This loop handles continuations. We know we have some real data, ending in
3926 newline. See if there is a continuation marker at the end (ignoring trailing
3927 white space). We know that *yield is not white space, so no need to test for
3928 cont > yield in the backwards scanning loop. */
3929
3930 for(;;)
3931 {
3932 uschar *cont;
3933 for (cont = acl_text - 1; isspace(*cont); cont--);
3934
3935 /* If no continuation follows, we are done. Mark the end of the line and
3936 return it. */
3937
3938 if (*cont != '\\')
3939 {
3940 *acl_text++ = 0;
3941 return yield;
3942 }
3943
3944 /* We have encountered a continuation. Skip over whitespace at the start of
3945 the next line, and indeed the whole of the next line or lines if they are
3946 comment lines. */
3947
3948 for (;;)
3949 {
3950 while (*(++acl_text) == ' ' || *acl_text == '\t');
3951 if (*acl_text != '#') break;
3952 while (*(++acl_text) != 0 && *acl_text != '\n');
3953 }
3954
3955 /* We have the start of a continuation line. Move all the rest of the data
3956 to join onto the previous line, and then find its end. If the end is not a
3957 newline, we are done. Otherwise loop to look for another continuation. */
3958
3959 memmove(cont, acl_text, acl_text_end - acl_text);
3960 acl_text_end -= acl_text - cont;
3961 acl_text = cont;
3962 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3963 if (*acl_text == 0) return yield;
3964 }
3965
3966 /* Control does not reach here */
3967 }
3968
3969
3970
3971
3972
3973 /*************************************************
3974 * Check access using an ACL *
3975 *************************************************/
3976
3977 /* This function is called from address_check. It may recurse via
3978 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3979 passed as a string which is expanded. A forced failure implies no access check
3980 is required. If the result is a single word, it is taken as the name of an ACL
3981 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3982 text, complete with newlines, and parsed as such. In both cases, the ACL check
3983 is then run. This function uses an auxiliary function for acl_read() to call
3984 for reading individual lines of a literal ACL. This is acl_getline(), which
3985 appears immediately above.
3986
3987 Arguments:
3988 where where called from
3989 addr address item when called from RCPT; otherwise NULL
3990 s the input string; NULL is the same as an empty ACL => DENY
3991 level the nesting level
3992 user_msgptr where to put a user error (for SMTP response)
3993 log_msgptr where to put a logging message (not for SMTP response)
3994
3995 Returns: OK access is granted
3996 DISCARD access is apparently granted...
3997 FAIL access is denied
3998 FAIL_DROP access is denied; drop the connection
3999 DEFER can't tell at the moment
4000 ERROR disaster
4001 */
4002
4003 static int
4004 acl_check_internal(int where, address_item *addr, uschar *s, int level,
4005 uschar **user_msgptr, uschar **log_msgptr)
4006 {
4007 int fd = -1;
4008 acl_block *acl = NULL;
4009 uschar *acl_name = US"inline ACL";
4010 uschar *ss;
4011
4012 /* Catch configuration loops */
4013
4014 if (level > 20)
4015 {
4016 *log_msgptr = US"ACL nested too deep: possible loop";
4017 return ERROR;
4018 }
4019
4020 if (s == NULL)
4021 {
4022 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
4023 return FAIL;
4024 }
4025
4026 /* At top level, we expand the incoming string. At lower levels, it has already
4027 been expanded as part of condition processing. */
4028
4029 if (level == 0)
4030 {
4031 ss = expand_string(s);
4032 if (ss == NULL)
4033 {
4034 if (expand_string_forcedfail) return OK;
4035 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4036 expand_string_message);
4037 return ERROR;
4038 }
4039 }
4040 else ss = s;
4041
4042 while (isspace(*ss))ss++;
4043
4044 /* If we can't find a named ACL, the default is to parse it as an inline one.
4045 (Unless it begins with a slash; non-existent files give rise to an error.) */
4046
4047 acl_text = ss;
4048
4049 /* Handle the case of a string that does not contain any spaces. Look for a
4050 named ACL among those read from the configuration, or a previously read file.
4051 It is possible that the pointer to the ACL is NULL if the configuration
4052 contains a name with no data. If not found, and the text begins with '/',
4053 read an ACL from a file, and save it so it can be re-used. */
4054
4055 if (Ustrchr(ss, ' ') == NULL)
4056 {
4057 tree_node *t = tree_search(acl_anchor, ss);
4058 if (t != NULL)
4059 {
4060 acl = (acl_block *)(t->data.ptr);
4061 if (acl == NULL)
4062 {
4063 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
4064 return FAIL;
4065 }
4066 acl_name = string_sprintf("ACL \"%s\"", ss);
4067 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
4068 }
4069
4070 else if (*ss == '/')
4071 {
4072 struct stat statbuf;
4073 fd = Uopen(ss, O_RDONLY, 0);
4074 if (fd < 0)
4075 {
4076 *log_msgptr = string_sprintf("failed to open ACL file \"%s\"<