Recast more internal string routines to use growable-strings
[exim.git] / src / src / acl.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Code for handling Access Control Lists (ACLs) */
9
10 #include "exim.h"
11
12
13 /* Default callout timeout */
14
15 #define CALLOUT_TIMEOUT_DEFAULT 30
16
17 /* ACL verb codes - keep in step with the table of verbs that follows */
18
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
20 ACL_WARN };
21
22 /* ACL verbs */
23
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
31 [ACL_WARN] = US"warn"
32 };
33
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
37 the code. */
38
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
42 [ACL_DENY] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
44 [ACL_DROP] = BIT(OK),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
46 [ACL_WARN] = BIT(OK)
47 };
48
49 /* ACL condition and modifier codes - keep in step with the table that
50 follows.
51 down. */
52
53 enum { ACLC_ACL,
54 ACLC_ADD_HEADER,
55 ACLC_AUTHENTICATED,
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
57 ACLC_BMI_OPTIN,
58 #endif
59 ACLC_CONDITION,
60 ACLC_CONTINUE,
61 ACLC_CONTROL,
62 #ifdef EXPERIMENTAL_DCC
63 ACLC_DCC,
64 #endif
65 #ifdef WITH_CONTENT_SCAN
66 ACLC_DECODE,
67 #endif
68 ACLC_DELAY,
69 #ifndef DISABLE_DKIM
70 ACLC_DKIM_SIGNER,
71 ACLC_DKIM_STATUS,
72 #endif
73 #ifdef EXPERIMENTAL_DMARC
74 ACLC_DMARC_STATUS,
75 #endif
76 ACLC_DNSLISTS,
77 ACLC_DOMAINS,
78 ACLC_ENCRYPTED,
79 ACLC_ENDPASS,
80 ACLC_HOSTS,
81 ACLC_LOCAL_PARTS,
82 ACLC_LOG_MESSAGE,
83 ACLC_LOG_REJECT_TARGET,
84 ACLC_LOGWRITE,
85 #ifdef WITH_CONTENT_SCAN
86 ACLC_MALWARE,
87 #endif
88 ACLC_MESSAGE,
89 #ifdef WITH_CONTENT_SCAN
90 ACLC_MIME_REGEX,
91 #endif
92 ACLC_QUEUE,
93 ACLC_RATELIMIT,
94 ACLC_RECIPIENTS,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_REGEX,
97 #endif
98 ACLC_REMOVE_HEADER,
99 ACLC_SENDER_DOMAINS,
100 ACLC_SENDERS,
101 ACLC_SET,
102 #ifdef WITH_CONTENT_SCAN
103 ACLC_SPAM,
104 #endif
105 #ifdef SUPPORT_SPF
106 ACLC_SPF,
107 ACLC_SPF_GUESS,
108 #endif
109 ACLC_UDPSEND,
110 ACLC_VERIFY };
111
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
116
117 typedef struct condition_def {
118 uschar *name;
119
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
124
125 BOOL is_modifier:1;
126
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
130 times. */
131 unsigned forbids;
132
133 } condition_def;
134
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
137
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
139 (unsigned int)
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
142 #ifndef DISABLE_PRDR
143 ACL_BIT_PRDR |
144 #endif
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
146 ACL_BIT_DKIM |
147 ACL_BIT_NOTSMTP_START),
148 },
149
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
153 },
154 #ifdef EXPERIMENTAL_BRIGHTMAIL
155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
156 ACL_BIT_AUTH |
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
159 # ifndef DISABLE_PRDR
160 ACL_BIT_PRDR |
161 # endif
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
163 ACL_BIT_MAILAUTH |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
167 },
168 #endif
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
171
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
175
176 #ifdef EXPERIMENTAL_DCC
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
178 (unsigned int)
179 ~(ACL_BIT_DATA |
180 # ifndef DISABLE_PRDR
181 ACL_BIT_PRDR |
182 # endif
183 ACL_BIT_NOTSMTP),
184 },
185 #endif
186 #ifdef WITH_CONTENT_SCAN
187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
188
189 #endif
190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
191 #ifndef DISABLE_DKIM
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
194 #endif
195 #ifdef EXPERIMENTAL_DMARC
196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
197 #endif
198
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
202
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
204 (unsigned int)
205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
206 #ifndef DISABLE_PRDR
207 |ACL_BIT_PRDR
208 #endif
209 ),
210 },
211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
213 ACL_BIT_HELO,
214 },
215
216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
217
218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
220 },
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
222 (unsigned int)
223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
224 #ifndef DISABLE_PRDR
225 | ACL_BIT_PRDR
226 #endif
227 ),
228 },
229
230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
233
234 #ifdef WITH_CONTENT_SCAN
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
236 (unsigned int)
237 ~(ACL_BIT_DATA |
238 # ifndef DISABLE_PRDR
239 ACL_BIT_PRDR |
240 # endif
241 ACL_BIT_NOTSMTP),
242 },
243 #endif
244
245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
248 #endif
249
250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
251 ACL_BIT_NOTSMTP |
252 #ifndef DISABLE_PRDR
253 ACL_BIT_PRDR |
254 #endif
255 ACL_BIT_DATA,
256 },
257
258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
260
261 #ifdef WITH_CONTENT_SCAN
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
263 (unsigned int)
264 ~(ACL_BIT_DATA |
265 # ifndef DISABLE_PRDR
266 ACL_BIT_PRDR |
267 # endif
268 ACL_BIT_NOTSMTP |
269 ACL_BIT_MIME),
270 },
271
272 #endif
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
274 (unsigned int)
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
277 #ifndef DISABLE_PRDR
278 ACL_BIT_PRDR |
279 #endif
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
282 },
283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
285 ACL_BIT_HELO |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
289 },
290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
292 ACL_BIT_HELO |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
296 },
297
298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
299
300 #ifdef WITH_CONTENT_SCAN
301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
302 (unsigned int) ~(ACL_BIT_DATA |
303 # ifndef DISABLE_PRDR
304 ACL_BIT_PRDR |
305 # endif
306 ACL_BIT_NOTSMTP),
307 },
308 #endif
309 #ifdef SUPPORT_SPF
310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
316 },
317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
323 },
324 #endif
325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
326
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
330 };
331
332
333
334 /* Return values from decode_control(); used as index so keep in step
335 with the controls_list table that follows! */
336
337 enum {
338 CONTROL_AUTH_UNADVERTISED,
339 #ifdef EXPERIMENTAL_BRIGHTMAIL
340 CONTROL_BMI_RUN,
341 #endif
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
345 CONTROL_DEBUG,
346 #ifndef DISABLE_DKIM
347 CONTROL_DKIM_VERIFY,
348 #endif
349 #ifdef EXPERIMENTAL_DMARC
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
352 #endif
353 CONTROL_DSCP,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
356 CONTROL_FAKEDEFER,
357 CONTROL_FAKEREJECT,
358 CONTROL_FREEZE,
359
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
363 #ifdef WITH_CONTENT_SCAN
364 CONTROL_NO_MBOX_UNSPOOL,
365 #endif
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
368
369 CONTROL_QUEUE_ONLY,
370 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
371 CONTROL_REQUIRETLS,
372 #endif
373 CONTROL_SUBMISSION,
374 CONTROL_SUPPRESS_LOCAL_FIXUPS,
375 #ifdef SUPPORT_I18N
376 CONTROL_UTF8_DOWNCONVERT,
377 #endif
378 };
379
380
381
382 /* Structure listing various control arguments, with their characteristics.
383 For each control, there's a bitmap of dis-allowed times. For some, it is easier
384 to specify the negation of a small number of allowed times. */
385
386 typedef struct control_def {
387 uschar *name;
388 BOOL has_option; /* Has /option(s) following */
389 unsigned forbids; /* bitmap of dis-allowed times */
390 } control_def;
391
392 static control_def controls_list[] = {
393 /* name has_option forbids */
394 [CONTROL_AUTH_UNADVERTISED] =
395 { US"allow_auth_unadvertised", FALSE,
396 (unsigned)
397 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
398 },
399 #ifdef EXPERIMENTAL_BRIGHTMAIL
400 [CONTROL_BMI_RUN] =
401 { US"bmi_run", FALSE, 0 },
402 #endif
403 [CONTROL_CASEFUL_LOCAL_PART] =
404 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
405 [CONTROL_CASELOWER_LOCAL_PART] =
406 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
407 [CONTROL_CUTTHROUGH_DELIVERY] =
408 { US"cutthrough_delivery", TRUE, 0 },
409 [CONTROL_DEBUG] =
410 { US"debug", TRUE, 0 },
411
412 #ifndef DISABLE_DKIM
413 [CONTROL_DKIM_VERIFY] =
414 { US"dkim_disable_verify", FALSE,
415 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
416 # ifndef DISABLE_PRDR
417 ACL_BIT_PRDR |
418 # endif
419 ACL_BIT_NOTSMTP_START
420 },
421 #endif
422
423 #ifdef EXPERIMENTAL_DMARC
424 [CONTROL_DMARC_VERIFY] =
425 { US"dmarc_disable_verify", FALSE,
426 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
427 },
428 [CONTROL_DMARC_FORENSIC] =
429 { US"dmarc_enable_forensic", FALSE,
430 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
431 },
432 #endif
433
434 [CONTROL_DSCP] =
435 { US"dscp", TRUE,
436 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
437 },
438 [CONTROL_ENFORCE_SYNC] =
439 { US"enforce_sync", FALSE,
440 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
441 },
442
443 /* Pseudo-value for decode errors */
444 [CONTROL_ERROR] =
445 { US"error", FALSE, 0 },
446
447 [CONTROL_FAKEDEFER] =
448 { US"fakedefer", TRUE,
449 (unsigned)
450 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
451 ACL_BIT_PREDATA | ACL_BIT_DATA |
452 #ifndef DISABLE_PRDR
453 ACL_BIT_PRDR |
454 #endif
455 ACL_BIT_MIME)
456 },
457 [CONTROL_FAKEREJECT] =
458 { US"fakereject", TRUE,
459 (unsigned)
460 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
461 ACL_BIT_PREDATA | ACL_BIT_DATA |
462 #ifndef DISABLE_PRDR
463 ACL_BIT_PRDR |
464 #endif
465 ACL_BIT_MIME)
466 },
467 [CONTROL_FREEZE] =
468 { US"freeze", TRUE,
469 (unsigned)
470 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
471 ACL_BIT_PREDATA | ACL_BIT_DATA |
472 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
473 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
474 },
475
476 [CONTROL_NO_CALLOUT_FLUSH] =
477 { US"no_callout_flush", FALSE,
478 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
479 },
480 [CONTROL_NO_DELAY_FLUSH] =
481 { US"no_delay_flush", FALSE,
482 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
483 },
484
485 [CONTROL_NO_ENFORCE_SYNC] =
486 { US"no_enforce_sync", FALSE,
487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
488 },
489 #ifdef WITH_CONTENT_SCAN
490 [CONTROL_NO_MBOX_UNSPOOL] =
491 { US"no_mbox_unspool", FALSE,
492 (unsigned)
493 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
494 ACL_BIT_PREDATA | ACL_BIT_DATA |
495 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 ACL_BIT_MIME)
497 },
498 #endif
499 [CONTROL_NO_MULTILINE] =
500 { US"no_multiline_responses", FALSE,
501 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
502 },
503 [CONTROL_NO_PIPELINING] =
504 { US"no_pipelining", FALSE,
505 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
506 },
507
508 [CONTROL_QUEUE_ONLY] =
509 { US"queue_only", FALSE,
510 (unsigned)
511 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
512 ACL_BIT_PREDATA | ACL_BIT_DATA |
513 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
514 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
515 },
516
517
518 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
519 [CONTROL_REQUIRETLS] =
520 { US"requiretls", FALSE,
521 (unsigned)
522 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
523 ACL_BIT_DATA | ACL_BIT_MIME |
524 ACL_BIT_NOTSMTP)
525 },
526 #endif
527
528 [CONTROL_SUBMISSION] =
529 { US"submission", TRUE,
530 (unsigned)
531 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
532 },
533 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
534 { US"suppress_local_fixups", FALSE,
535 (unsigned)
536 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
537 ACL_BIT_NOTSMTP_START)
538 },
539 #ifdef SUPPORT_I18N
540 [CONTROL_UTF8_DOWNCONVERT] =
541 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
542 }
543 #endif
544 };
545
546 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
547 caches its result in a tree to avoid repeated DNS queries. The result is an
548 integer code which is used as an index into the following tables of
549 explanatory strings and verification return codes. */
550
551 static tree_node *csa_cache = NULL;
552
553 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
554 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
555
556 /* The acl_verify_csa() return code is translated into an acl_verify() return
557 code using the following table. It is OK unless the client is definitely not
558 authorized. This is because CSA is supposed to be optional for sending sites,
559 so recipients should not be too strict about checking it - especially because
560 DNS problems are quite likely to occur. It's possible to use $csa_status in
561 further ACL conditions to distinguish ok, unknown, and defer if required, but
562 the aim is to make the usual configuration simple. */
563
564 static int csa_return_code[] = {
565 [CSA_UNKNOWN] = OK,
566 [CSA_OK] = OK,
567 [CSA_DEFER_SRV] = OK,
568 [CSA_DEFER_ADDR] = OK,
569 [CSA_FAIL_EXPLICIT] = FAIL,
570 [CSA_FAIL_DOMAIN] = FAIL,
571 [CSA_FAIL_NOADDR] = FAIL,
572 [CSA_FAIL_MISMATCH] = FAIL
573 };
574
575 static uschar *csa_status_string[] = {
576 [CSA_UNKNOWN] = US"unknown",
577 [CSA_OK] = US"ok",
578 [CSA_DEFER_SRV] = US"defer",
579 [CSA_DEFER_ADDR] = US"defer",
580 [CSA_FAIL_EXPLICIT] = US"fail",
581 [CSA_FAIL_DOMAIN] = US"fail",
582 [CSA_FAIL_NOADDR] = US"fail",
583 [CSA_FAIL_MISMATCH] = US"fail"
584 };
585
586 static uschar *csa_reason_string[] = {
587 [CSA_UNKNOWN] = US"unknown",
588 [CSA_OK] = US"ok",
589 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
590 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
591 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
592 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
593 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
594 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
595 };
596
597 /* Options for the ratelimit condition. Note that there are two variants of
598 the per_rcpt option, depending on the ACL that is used to measure the rate.
599 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
600 so the two variants must have the same internal representation as well as
601 the same configuration string. */
602
603 enum {
604 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
605 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
606 };
607
608 #define RATE_SET(var,new) \
609 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
610
611 static uschar *ratelimit_option_string[] = {
612 [RATE_PER_WHAT] = US"?",
613 [RATE_PER_CLASH] = US"!",
614 [RATE_PER_ADDR] = US"per_addr",
615 [RATE_PER_BYTE] = US"per_byte",
616 [RATE_PER_CMD] = US"per_cmd",
617 [RATE_PER_CONN] = US"per_conn",
618 [RATE_PER_MAIL] = US"per_mail",
619 [RATE_PER_RCPT] = US"per_rcpt",
620 [RATE_PER_ALLRCPTS] = US"per_rcpt"
621 };
622
623 /* Enable recursion between acl_check_internal() and acl_check_condition() */
624
625 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
626 uschar **);
627
628
629 /*************************************************
630 * Find control in list *
631 *************************************************/
632
633 /* The lists are always in order, so binary chop can be used.
634
635 Arguments:
636 name the control name to search for
637 ol the first entry in the control list
638 last one more than the offset of the last entry in the control list
639
640 Returns: index of a control entry, or -1 if not found
641 */
642
643 static int
644 find_control(const uschar * name, control_def * ol, int last)
645 {
646 int first = 0;
647 while (last > first)
648 {
649 int middle = (first + last)/2;
650 uschar * s = ol[middle].name;
651 int c = Ustrncmp(name, s, Ustrlen(s));
652 if (c == 0) return middle;
653 else if (c > 0) first = middle + 1;
654 else last = middle;
655 }
656 return -1;
657 }
658
659
660
661 /*************************************************
662 * Pick out condition from list *
663 *************************************************/
664
665 /* Use a binary chop method
666
667 Arguments:
668 name name to find
669 list list of conditions
670 end size of list
671
672 Returns: offset in list, or -1 if not found
673 */
674
675 static int
676 acl_checkcondition(uschar * name, condition_def * list, int end)
677 {
678 int start = 0;
679 while (start < end)
680 {
681 int mid = (start + end)/2;
682 int c = Ustrcmp(name, list[mid].name);
683 if (c == 0) return mid;
684 if (c < 0) end = mid;
685 else start = mid + 1;
686 }
687 return -1;
688 }
689
690
691 /*************************************************
692 * Pick out name from list *
693 *************************************************/
694
695 /* Use a binary chop method
696
697 Arguments:
698 name name to find
699 list list of names
700 end size of list
701
702 Returns: offset in list, or -1 if not found
703 */
704
705 static int
706 acl_checkname(uschar *name, uschar **list, int end)
707 {
708 int start = 0;
709
710 while (start < end)
711 {
712 int mid = (start + end)/2;
713 int c = Ustrcmp(name, list[mid]);
714 if (c == 0) return mid;
715 if (c < 0) end = mid; else start = mid + 1;
716 }
717
718 return -1;
719 }
720
721
722 /*************************************************
723 * Read and parse one ACL *
724 *************************************************/
725
726 /* This function is called both from readconf in order to parse the ACLs in the
727 configuration file, and also when an ACL is encountered dynamically (e.g. as
728 the result of an expansion). It is given a function to call in order to
729 retrieve the lines of the ACL. This function handles skipping comments and
730 blank lines (where relevant).
731
732 Arguments:
733 func function to get next line of ACL
734 error where to put an error message
735
736 Returns: pointer to ACL, or NULL
737 NULL can be legal (empty ACL); in this case error will be NULL
738 */
739
740 acl_block *
741 acl_read(uschar *(*func)(void), uschar **error)
742 {
743 acl_block *yield = NULL;
744 acl_block **lastp = &yield;
745 acl_block *this = NULL;
746 acl_condition_block *cond;
747 acl_condition_block **condp = NULL;
748 uschar *s;
749
750 *error = NULL;
751
752 while ((s = (*func)()) != NULL)
753 {
754 int v, c;
755 BOOL negated = FALSE;
756 uschar *saveline = s;
757 uschar name[64];
758
759 /* Conditions (but not verbs) are allowed to be negated by an initial
760 exclamation mark. */
761
762 while (isspace(*s)) s++;
763 if (*s == '!')
764 {
765 negated = TRUE;
766 s++;
767 }
768
769 /* Read the name of a verb or a condition, or the start of a new ACL, which
770 can be started by a name, or by a macro definition. */
771
772 s = readconf_readname(name, sizeof(name), s);
773 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
774
775 /* If a verb is unrecognized, it may be another condition or modifier that
776 continues the previous verb. */
777
778 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
779 {
780 if (this == NULL)
781 {
782 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
783 saveline);
784 return NULL;
785 }
786 }
787
788 /* New verb */
789
790 else
791 {
792 if (negated)
793 {
794 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
795 return NULL;
796 }
797 this = store_get(sizeof(acl_block));
798 *lastp = this;
799 lastp = &(this->next);
800 this->next = NULL;
801 this->verb = v;
802 this->condition = NULL;
803 condp = &(this->condition);
804 if (*s == 0) continue; /* No condition on this line */
805 if (*s == '!')
806 {
807 negated = TRUE;
808 s++;
809 }
810 s = readconf_readname(name, sizeof(name), s); /* Condition name */
811 }
812
813 /* Handle a condition or modifier. */
814
815 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
816 {
817 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
818 saveline);
819 return NULL;
820 }
821
822 /* The modifiers may not be negated */
823
824 if (negated && conditions[c].is_modifier)
825 {
826 *error = string_sprintf("ACL error: negation is not allowed with "
827 "\"%s\"", conditions[c].name);
828 return NULL;
829 }
830
831 /* ENDPASS may occur only with ACCEPT or DISCARD. */
832
833 if (c == ACLC_ENDPASS &&
834 this->verb != ACL_ACCEPT &&
835 this->verb != ACL_DISCARD)
836 {
837 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
838 conditions[c].name, verbs[this->verb]);
839 return NULL;
840 }
841
842 cond = store_get(sizeof(acl_condition_block));
843 cond->next = NULL;
844 cond->type = c;
845 cond->u.negated = negated;
846
847 *condp = cond;
848 condp = &(cond->next);
849
850 /* The "set" modifier is different in that its argument is "name=value"
851 rather than just a value, and we can check the validity of the name, which
852 gives us a variable name to insert into the data block. The original ACL
853 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
854 extended to 20 of each type, but after that people successfully argued for
855 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
856 After that, we allow alphanumerics and underscores, but the first character
857 after c or m must be a digit or an underscore. This retains backwards
858 compatibility. */
859
860 if (c == ACLC_SET)
861 #ifndef DISABLE_DKIM
862 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
863 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
864 {
865 uschar * endptr = s+18;
866
867 if (isalnum(*endptr))
868 {
869 *error = string_sprintf("invalid variable name after \"set\" in ACL "
870 "modifier \"set %s\" "
871 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
872 s);
873 return NULL;
874 }
875 cond->u.varname = string_copyn(s, 18);
876 s = endptr;
877 while (isspace(*s)) s++;
878 }
879 else
880 #endif
881 {
882 uschar *endptr;
883
884 if (Ustrncmp(s, "acl_c", 5) != 0 &&
885 Ustrncmp(s, "acl_m", 5) != 0)
886 {
887 *error = string_sprintf("invalid variable name after \"set\" in ACL "
888 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
889 return NULL;
890 }
891
892 endptr = s + 5;
893 if (!isdigit(*endptr) && *endptr != '_')
894 {
895 *error = string_sprintf("invalid variable name after \"set\" in ACL "
896 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
897 s);
898 return NULL;
899 }
900
901 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
902 {
903 if (!isalnum(*endptr) && *endptr != '_')
904 {
905 *error = string_sprintf("invalid character \"%c\" in variable name "
906 "in ACL modifier \"set %s\"", *endptr, s);
907 return NULL;
908 }
909 endptr++;
910 }
911
912 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
913 s = endptr;
914 while (isspace(*s)) s++;
915 }
916
917 /* For "set", we are now positioned for the data. For the others, only
918 "endpass" has no data */
919
920 if (c != ACLC_ENDPASS)
921 {
922 if (*s++ != '=')
923 {
924 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
925 conditions[c].is_modifier ? US"modifier" : US"condition");
926 return NULL;
927 }
928 while (isspace(*s)) s++;
929 cond->arg = string_copy(s);
930 }
931 }
932
933 return yield;
934 }
935
936
937
938 /*************************************************
939 * Set up added header line(s) *
940 *************************************************/
941
942 /* This function is called by the add_header modifier, and also from acl_warn()
943 to implement the now-deprecated way of adding header lines using "message" on a
944 "warn" verb. The argument is treated as a sequence of header lines which are
945 added to a chain, provided there isn't an identical one already there.
946
947 Argument: string of header lines
948 Returns: nothing
949 */
950
951 static void
952 setup_header(const uschar *hstring)
953 {
954 const uschar *p, *q;
955 int hlen = Ustrlen(hstring);
956
957 /* Ignore any leading newlines */
958 while (*hstring == '\n') hstring++, hlen--;
959
960 /* An empty string does nothing; ensure exactly one final newline. */
961 if (hlen <= 0) return;
962 if (hstring[--hlen] != '\n') /* no newline */
963 q = string_sprintf("%s\n", hstring);
964 else if (hstring[hlen-1] == '\n') /* double newline */
965 {
966 uschar * s = string_copy(hstring);
967 while(s[--hlen] == '\n')
968 s[hlen+1] = '\0';
969 q = s;
970 }
971 else
972 q = hstring;
973
974 /* Loop for multiple header lines, taking care about continuations */
975
976 for (p = q; *p; p = q)
977 {
978 const uschar *s;
979 uschar * hdr;
980 int newtype = htype_add_bot;
981 header_line **hptr = &acl_added_headers;
982
983 /* Find next header line within the string */
984
985 for (;;)
986 {
987 q = Ustrchr(q, '\n'); /* we know there was a newline */
988 if (*++q != ' ' && *q != '\t') break;
989 }
990
991 /* If the line starts with a colon, interpret the instruction for where to
992 add it. This temporarily sets up a new type. */
993
994 if (*p == ':')
995 {
996 if (strncmpic(p, US":after_received:", 16) == 0)
997 {
998 newtype = htype_add_rec;
999 p += 16;
1000 }
1001 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1002 {
1003 newtype = htype_add_rfc;
1004 p += 14;
1005 }
1006 else if (strncmpic(p, US":at_start:", 10) == 0)
1007 {
1008 newtype = htype_add_top;
1009 p += 10;
1010 }
1011 else if (strncmpic(p, US":at_end:", 8) == 0)
1012 {
1013 newtype = htype_add_bot;
1014 p += 8;
1015 }
1016 while (*p == ' ' || *p == '\t') p++;
1017 }
1018
1019 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1020 to the front of it. */
1021
1022 for (s = p; s < q - 1; s++)
1023 if (*s == ':' || !isgraph(*s)) break;
1024
1025 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1026 hlen = Ustrlen(hdr);
1027
1028 /* See if this line has already been added */
1029
1030 while (*hptr)
1031 {
1032 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1033 hptr = &(*hptr)->next;
1034 }
1035
1036 /* Add if not previously present */
1037
1038 if (!*hptr)
1039 {
1040 header_line *h = store_get(sizeof(header_line));
1041 h->text = hdr;
1042 h->next = NULL;
1043 h->type = newtype;
1044 h->slen = hlen;
1045 *hptr = h;
1046 hptr = &h->next;
1047 }
1048 }
1049 }
1050
1051
1052
1053 /*************************************************
1054 * List the added header lines *
1055 *************************************************/
1056 uschar *
1057 fn_hdrs_added(void)
1058 {
1059 gstring * g = NULL;
1060 header_line * h;
1061
1062 for (h = acl_added_headers; h; h = h->next)
1063 {
1064 int i = h->slen;
1065 if (h->text[i-1] == '\n') i--;
1066 g = string_append_listele_n(g, '\n', h->text, i);
1067 }
1068
1069 return g ? g->s : NULL;
1070 }
1071
1072
1073 /*************************************************
1074 * Set up removed header line(s) *
1075 *************************************************/
1076
1077 /* This function is called by the remove_header modifier. The argument is
1078 treated as a sequence of header names which are added to a colon separated
1079 list, provided there isn't an identical one already there.
1080
1081 Argument: string of header names
1082 Returns: nothing
1083 */
1084
1085 static void
1086 setup_remove_header(const uschar *hnames)
1087 {
1088 if (*hnames)
1089 acl_removed_headers = acl_removed_headers
1090 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1091 : string_copy(hnames);
1092 }
1093
1094
1095
1096 /*************************************************
1097 * Handle warnings *
1098 *************************************************/
1099
1100 /* This function is called when a WARN verb's conditions are true. It adds to
1101 the message's headers, and/or writes information to the log. In each case, this
1102 only happens once (per message for headers, per connection for log).
1103
1104 ** NOTE: The header adding action using the "message" setting is historic, and
1105 its use is now deprecated. The new add_header modifier should be used instead.
1106
1107 Arguments:
1108 where ACL_WHERE_xxxx indicating which ACL this is
1109 user_message message for adding to headers
1110 log_message message for logging, if different
1111
1112 Returns: nothing
1113 */
1114
1115 static void
1116 acl_warn(int where, uschar *user_message, uschar *log_message)
1117 {
1118 if (log_message != NULL && log_message != user_message)
1119 {
1120 uschar *text;
1121 string_item *logged;
1122
1123 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1124 string_printing(log_message));
1125
1126 /* If a sender verification has failed, and the log message is "sender verify
1127 failed", add the failure message. */
1128
1129 if (sender_verified_failed != NULL &&
1130 sender_verified_failed->message != NULL &&
1131 strcmpic(log_message, US"sender verify failed") == 0)
1132 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1133
1134 /* Search previously logged warnings. They are kept in malloc
1135 store so they can be freed at the start of a new message. */
1136
1137 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1138 if (Ustrcmp(logged->text, text) == 0) break;
1139
1140 if (logged == NULL)
1141 {
1142 int length = Ustrlen(text) + 1;
1143 log_write(0, LOG_MAIN, "%s", text);
1144 logged = store_malloc(sizeof(string_item) + length);
1145 logged->text = US logged + sizeof(string_item);
1146 memcpy(logged->text, text, length);
1147 logged->next = acl_warn_logged;
1148 acl_warn_logged = logged;
1149 }
1150 }
1151
1152 /* If there's no user message, we are done. */
1153
1154 if (user_message == NULL) return;
1155
1156 /* If this isn't a message ACL, we can't do anything with a user message.
1157 Log an error. */
1158
1159 if (where > ACL_WHERE_NOTSMTP)
1160 {
1161 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1162 "found in a non-message (%s) ACL: cannot specify header lines here: "
1163 "message ignored", acl_wherenames[where]);
1164 return;
1165 }
1166
1167 /* The code for setting up header lines is now abstracted into a separate
1168 function so that it can be used for the add_header modifier as well. */
1169
1170 setup_header(user_message);
1171 }
1172
1173
1174
1175 /*************************************************
1176 * Verify and check reverse DNS *
1177 *************************************************/
1178
1179 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1180 address if this has not yet been done. The host_name_lookup() function checks
1181 that one of these names resolves to an address list that contains the client IP
1182 address, so we don't actually have to do the check here.
1183
1184 Arguments:
1185 user_msgptr pointer for user message
1186 log_msgptr pointer for log message
1187
1188 Returns: OK verification condition succeeded
1189 FAIL verification failed
1190 DEFER there was a problem verifying
1191 */
1192
1193 static int
1194 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1195 {
1196 int rc;
1197
1198 user_msgptr = user_msgptr; /* stop compiler warning */
1199
1200 /* Previous success */
1201
1202 if (sender_host_name != NULL) return OK;
1203
1204 /* Previous failure */
1205
1206 if (host_lookup_failed)
1207 {
1208 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1209 return FAIL;
1210 }
1211
1212 /* Need to do a lookup */
1213
1214 HDEBUG(D_acl)
1215 debug_printf_indent("looking up host name to force name/address consistency check\n");
1216
1217 if ((rc = host_name_lookup()) != OK)
1218 {
1219 *log_msgptr = (rc == DEFER)?
1220 US"host lookup deferred for reverse lookup check"
1221 :
1222 string_sprintf("host lookup failed for reverse lookup check%s",
1223 host_lookup_msg);
1224 return rc; /* DEFER or FAIL */
1225 }
1226
1227 host_build_sender_fullhost();
1228 return OK;
1229 }
1230
1231
1232
1233 /*************************************************
1234 * Check client IP address matches CSA target *
1235 *************************************************/
1236
1237 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1238 response for address records belonging to the CSA target hostname. The section
1239 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1240 If one of the addresses matches the client's IP address, then the client is
1241 authorized by CSA. If there are target IP addresses but none of them match
1242 then the client is using an unauthorized IP address. If there are no target IP
1243 addresses then the client cannot be using an authorized IP address. (This is
1244 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1245
1246 Arguments:
1247 dnsa the DNS answer block
1248 dnss a DNS scan block for us to use
1249 reset option specifying what portion to scan, as described above
1250 target the target hostname to use for matching RR names
1251
1252 Returns: CSA_OK successfully authorized
1253 CSA_FAIL_MISMATCH addresses found but none matched
1254 CSA_FAIL_NOADDR no target addresses found
1255 */
1256
1257 static int
1258 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1259 uschar *target)
1260 {
1261 dns_record *rr;
1262 dns_address *da;
1263
1264 BOOL target_found = FALSE;
1265
1266 for (rr = dns_next_rr(dnsa, dnss, reset);
1267 rr != NULL;
1268 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1269 {
1270 /* Check this is an address RR for the target hostname. */
1271
1272 if (rr->type != T_A
1273 #if HAVE_IPV6
1274 && rr->type != T_AAAA
1275 #endif
1276 ) continue;
1277
1278 if (strcmpic(target, rr->name) != 0) continue;
1279
1280 target_found = TRUE;
1281
1282 /* Turn the target address RR into a list of textual IP addresses and scan
1283 the list. There may be more than one if it is an A6 RR. */
1284
1285 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1286 {
1287 /* If the client IP address matches the target IP address, it's good! */
1288
1289 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1290
1291 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1292 }
1293 }
1294
1295 /* If we found some target addresses but none of them matched, the client is
1296 using an unauthorized IP address, otherwise the target has no authorized IP
1297 addresses. */
1298
1299 if (target_found) return CSA_FAIL_MISMATCH;
1300 else return CSA_FAIL_NOADDR;
1301 }
1302
1303
1304
1305 /*************************************************
1306 * Verify Client SMTP Authorization *
1307 *************************************************/
1308
1309 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1310 to find the CSA SRV record corresponding to the domain argument, or
1311 $sender_helo_name if no argument is provided. It then checks that the
1312 client is authorized, and that its IP address corresponds to the SRV
1313 target's address by calling acl_verify_csa_address() above. The address
1314 should have been returned in the DNS response's ADDITIONAL section, but if
1315 not we perform another DNS lookup to get it.
1316
1317 Arguments:
1318 domain pointer to optional parameter following verify = csa
1319
1320 Returns: CSA_UNKNOWN no valid CSA record found
1321 CSA_OK successfully authorized
1322 CSA_FAIL_* client is definitely not authorized
1323 CSA_DEFER_* there was a DNS problem
1324 */
1325
1326 static int
1327 acl_verify_csa(const uschar *domain)
1328 {
1329 tree_node *t;
1330 const uschar *found;
1331 int priority, weight, port;
1332 dns_answer dnsa;
1333 dns_scan dnss;
1334 dns_record *rr;
1335 int rc, type;
1336 uschar target[256];
1337
1338 /* Work out the domain we are using for the CSA lookup. The default is the
1339 client's HELO domain. If the client has not said HELO, use its IP address
1340 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1341
1342 while (isspace(*domain) && *domain != '\0') ++domain;
1343 if (*domain == '\0') domain = sender_helo_name;
1344 if (domain == NULL) domain = sender_host_address;
1345 if (sender_host_address == NULL) return CSA_UNKNOWN;
1346
1347 /* If we have an address literal, strip off the framing ready for turning it
1348 into a domain. The framing consists of matched square brackets possibly
1349 containing a keyword and a colon before the actual IP address. */
1350
1351 if (domain[0] == '[')
1352 {
1353 const uschar *start = Ustrchr(domain, ':');
1354 if (start == NULL) start = domain;
1355 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1356 }
1357
1358 /* Turn domains that look like bare IP addresses into domains in the reverse
1359 DNS. This code also deals with address literals and $sender_host_address. It's
1360 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1361 address literals, but it's probably the most friendly thing to do. This is an
1362 extension to CSA, so we allow it to be turned off for proper conformance. */
1363
1364 if (string_is_ip_address(domain, NULL) != 0)
1365 {
1366 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1367 dns_build_reverse(domain, target);
1368 domain = target;
1369 }
1370
1371 /* Find out if we've already done the CSA check for this domain. If we have,
1372 return the same result again. Otherwise build a new cached result structure
1373 for this domain. The name is filled in now, and the value is filled in when
1374 we return from this function. */
1375
1376 t = tree_search(csa_cache, domain);
1377 if (t != NULL) return t->data.val;
1378
1379 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1380 Ustrcpy(t->name, domain);
1381 (void)tree_insertnode(&csa_cache, t);
1382
1383 /* Now we are ready to do the actual DNS lookup(s). */
1384
1385 found = domain;
1386 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1387 {
1388 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1389
1390 default:
1391 return t->data.val = CSA_DEFER_SRV;
1392
1393 /* If we found nothing, the client's authorization is unknown. */
1394
1395 case DNS_NOMATCH:
1396 case DNS_NODATA:
1397 return t->data.val = CSA_UNKNOWN;
1398
1399 /* We got something! Go on to look at the reply in more detail. */
1400
1401 case DNS_SUCCEED:
1402 break;
1403 }
1404
1405 /* Scan the reply for well-formed CSA SRV records. */
1406
1407 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1408 rr;
1409 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1410 {
1411 const uschar * p = rr->data;
1412
1413 /* Extract the numerical SRV fields (p is incremented) */
1414
1415 GETSHORT(priority, p);
1416 GETSHORT(weight, p);
1417 GETSHORT(port, p);
1418
1419 DEBUG(D_acl)
1420 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1421
1422 /* Check the CSA version number */
1423
1424 if (priority != 1) continue;
1425
1426 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1427 found by dns_special_lookup() is a parent of the one we asked for), we check
1428 the subdomain assertions in the port field. At the moment there's only one
1429 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1430 SRV records of their own. */
1431
1432 if (Ustrcmp(found, domain) != 0)
1433 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1434
1435 /* This CSA SRV record refers directly to our domain, so we check the value
1436 in the weight field to work out the domain's authorization. 0 and 1 are
1437 unauthorized; 3 means the client is authorized but we can't check the IP
1438 address in order to authenticate it, so we treat it as unknown; values
1439 greater than 3 are undefined. */
1440
1441 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1442
1443 if (weight > 2) continue;
1444
1445 /* Weight == 2, which means the domain is authorized. We must check that the
1446 client's IP address is listed as one of the SRV target addresses. Save the
1447 target hostname then break to scan the additional data for its addresses. */
1448
1449 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1450 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1451
1452 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1453
1454 break;
1455 }
1456
1457 /* If we didn't break the loop then no appropriate records were found. */
1458
1459 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1460
1461 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1462 A target of "." indicates there are no valid addresses, so the client cannot
1463 be authorized. (This is an odd configuration because weight=2 target=. is
1464 equivalent to weight=1, but we check for it in order to keep load off the
1465 root name servers.) Note that dn_expand() turns "." into "". */
1466
1467 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1468
1469 /* Scan the additional section of the CSA SRV reply for addresses belonging
1470 to the target. If the name server didn't return any additional data (e.g.
1471 because it does not fully support SRV records), we need to do another lookup
1472 to obtain the target addresses; otherwise we have a definitive result. */
1473
1474 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1475 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1476
1477 /* The DNS lookup type corresponds to the IP version used by the client. */
1478
1479 #if HAVE_IPV6
1480 if (Ustrchr(sender_host_address, ':') != NULL)
1481 type = T_AAAA;
1482 else
1483 #endif /* HAVE_IPV6 */
1484 type = T_A;
1485
1486
1487 lookup_dnssec_authenticated = NULL;
1488 switch (dns_lookup(&dnsa, target, type, NULL))
1489 {
1490 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1491
1492 default:
1493 return t->data.val = CSA_DEFER_ADDR;
1494
1495 /* If the query succeeded, scan the addresses and return the result. */
1496
1497 case DNS_SUCCEED:
1498 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1499 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1500 /* else fall through */
1501
1502 /* If the target has no IP addresses, the client cannot have an authorized
1503 IP address. However, if the target site uses A6 records (not AAAA records)
1504 we have to do yet another lookup in order to check them. */
1505
1506 case DNS_NOMATCH:
1507 case DNS_NODATA:
1508 return t->data.val = CSA_FAIL_NOADDR;
1509 }
1510 }
1511
1512
1513
1514 /*************************************************
1515 * Handle verification (address & other) *
1516 *************************************************/
1517
1518 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1519 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1520 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1521 };
1522 typedef struct {
1523 uschar * name;
1524 int value;
1525 unsigned where_allowed; /* bitmap */
1526 BOOL no_options; /* Never has /option(s) following */
1527 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1528 } verify_type_t;
1529 static verify_type_t verify_type_list[] = {
1530 /* name value where no-opt opt-sep */
1531 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1532 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1533 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1534 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1535 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1536 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1537 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1538 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1539 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1540 FALSE, 6 },
1541 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1542 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1543 #ifdef EXPERIMENTAL_ARC
1544 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1545 #endif
1546 };
1547
1548
1549 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1550 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1551 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1552 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1553 };
1554 typedef struct {
1555 uschar * name;
1556 int value;
1557 int flag;
1558 BOOL has_option; /* Has =option(s) following */
1559 BOOL timeval; /* Has a time value */
1560 } callout_opt_t;
1561 static callout_opt_t callout_opt_list[] = {
1562 /* name value flag has-opt has-time */
1563 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1564 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1565 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1566 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1567 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1568 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1569 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1570 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1571 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1572 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1573 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1574 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1575 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1576 };
1577
1578
1579
1580 /* This function implements the "verify" condition. It is called when
1581 encountered in any ACL, because some tests are almost always permitted. Some
1582 just don't make sense, and always fail (for example, an attempt to test a host
1583 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1584
1585 Arguments:
1586 where where called from
1587 addr the recipient address that the ACL is handling, or NULL
1588 arg the argument of "verify"
1589 user_msgptr pointer for user message
1590 log_msgptr pointer for log message
1591 basic_errno where to put verify errno
1592
1593 Returns: OK verification condition succeeded
1594 FAIL verification failed
1595 DEFER there was a problem verifying
1596 ERROR syntax error
1597 */
1598
1599 static int
1600 acl_verify(int where, address_item *addr, const uschar *arg,
1601 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1602 {
1603 int sep = '/';
1604 int callout = -1;
1605 int callout_overall = -1;
1606 int callout_connect = -1;
1607 int verify_options = 0;
1608 int rc;
1609 BOOL verify_header_sender = FALSE;
1610 BOOL defer_ok = FALSE;
1611 BOOL callout_defer_ok = FALSE;
1612 BOOL no_details = FALSE;
1613 BOOL success_on_redirect = FALSE;
1614 address_item *sender_vaddr = NULL;
1615 uschar *verify_sender_address = NULL;
1616 uschar *pm_mailfrom = NULL;
1617 uschar *se_mailfrom = NULL;
1618
1619 /* Some of the verify items have slash-separated options; some do not. Diagnose
1620 an error if options are given for items that don't expect them.
1621 */
1622
1623 uschar *slash = Ustrchr(arg, '/');
1624 const uschar *list = arg;
1625 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1626 verify_type_t * vp;
1627
1628 if (!ss) goto BAD_VERIFY;
1629
1630 /* Handle name/address consistency verification in a separate function. */
1631
1632 for (vp= verify_type_list;
1633 CS vp < CS verify_type_list + sizeof(verify_type_list);
1634 vp++
1635 )
1636 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1637 : strcmpic (ss, vp->name) == 0)
1638 break;
1639 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1640 goto BAD_VERIFY;
1641
1642 if (vp->no_options && slash)
1643 {
1644 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1645 "(this verify item has no options)", arg);
1646 return ERROR;
1647 }
1648 if (!(vp->where_allowed & BIT(where)))
1649 {
1650 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1651 vp->name, acl_wherenames[where]);
1652 return ERROR;
1653 }
1654 switch(vp->value)
1655 {
1656 case VERIFY_REV_HOST_LKUP:
1657 if (!sender_host_address) return OK;
1658 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1659 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1660 if (strcmpic(ss, US"defer_ok") == 0)
1661 return OK;
1662 return rc;
1663
1664 case VERIFY_CERT:
1665 /* TLS certificate verification is done at STARTTLS time; here we just
1666 test whether it was successful or not. (This is for optional verification; for
1667 mandatory verification, the connection doesn't last this long.) */
1668
1669 if (tls_in.certificate_verified) return OK;
1670 *user_msgptr = US"no verified certificate";
1671 return FAIL;
1672
1673 case VERIFY_HELO:
1674 /* We can test the result of optional HELO verification that might have
1675 occurred earlier. If not, we can attempt the verification now. */
1676
1677 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1678 return f.helo_verified ? OK : FAIL;
1679
1680 case VERIFY_CSA:
1681 /* Do Client SMTP Authorization checks in a separate function, and turn the
1682 result code into user-friendly strings. */
1683
1684 rc = acl_verify_csa(list);
1685 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1686 csa_reason_string[rc]);
1687 csa_status = csa_status_string[rc];
1688 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1689 return csa_return_code[rc];
1690
1691 #ifdef EXPERIMENTAL_ARC
1692 case VERIFY_ARC:
1693 { /* Do Authenticated Received Chain checks in a separate function. */
1694 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1695 int csep = 0;
1696 uschar * cond;
1697
1698 if (!(arc_state = acl_verify_arc())) return DEFER;
1699 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1700 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1701
1702 if (!condlist) condlist = US"none:pass";
1703 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1704 if (Ustrcmp(arc_state, cond) == 0) return OK;
1705 return FAIL;
1706 }
1707 #endif
1708
1709 case VERIFY_HDR_SYNTAX:
1710 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1711 a syntax error, we return details of the error to the sender if configured to
1712 send out full details. (But a "message" setting on the ACL can override, as
1713 always). */
1714
1715 rc = verify_check_headers(log_msgptr);
1716 if (rc != OK && *log_msgptr)
1717 if (smtp_return_error_details)
1718 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1719 else
1720 acl_verify_message = *log_msgptr;
1721 return rc;
1722
1723 case VERIFY_HDR_NAMES_ASCII:
1724 /* Check that all header names are true 7 bit strings
1725 See RFC 5322, 2.2. and RFC 6532, 3. */
1726
1727 rc = verify_check_header_names_ascii(log_msgptr);
1728 if (rc != OK && smtp_return_error_details && *log_msgptr)
1729 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1730 return rc;
1731
1732 case VERIFY_NOT_BLIND:
1733 /* Check that no recipient of this message is "blind", that is, every envelope
1734 recipient must be mentioned in either To: or Cc:. */
1735
1736 if ((rc = verify_check_notblind()) != OK)
1737 {
1738 *log_msgptr = string_sprintf("bcc recipient detected");
1739 if (smtp_return_error_details)
1740 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1741 }
1742 return rc;
1743
1744 /* The remaining verification tests check recipient and sender addresses,
1745 either from the envelope or from the header. There are a number of
1746 slash-separated options that are common to all of them. */
1747
1748 case VERIFY_HDR_SNDR:
1749 verify_header_sender = TRUE;
1750 break;
1751
1752 case VERIFY_SNDR:
1753 /* In the case of a sender, this can optionally be followed by an address to use
1754 in place of the actual sender (rare special-case requirement). */
1755 {
1756 uschar *s = ss + 6;
1757 if (*s == 0)
1758 verify_sender_address = sender_address;
1759 else
1760 {
1761 while (isspace(*s)) s++;
1762 if (*s++ != '=') goto BAD_VERIFY;
1763 while (isspace(*s)) s++;
1764 verify_sender_address = string_copy(s);
1765 }
1766 }
1767 break;
1768
1769 case VERIFY_RCPT:
1770 break;
1771 }
1772
1773
1774
1775 /* Remaining items are optional; they apply to sender and recipient
1776 verification, including "header sender" verification. */
1777
1778 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1779 != NULL)
1780 {
1781 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1782 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1783 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1784
1785 /* These two old options are left for backwards compatibility */
1786
1787 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1788 {
1789 callout_defer_ok = TRUE;
1790 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1791 }
1792
1793 else if (strcmpic(ss, US"check_postmaster") == 0)
1794 {
1795 pm_mailfrom = US"";
1796 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1797 }
1798
1799 /* The callout option has a number of sub-options, comma separated */
1800
1801 else if (strncmpic(ss, US"callout", 7) == 0)
1802 {
1803 callout = CALLOUT_TIMEOUT_DEFAULT;
1804 ss += 7;
1805 if (*ss != 0)
1806 {
1807 while (isspace(*ss)) ss++;
1808 if (*ss++ == '=')
1809 {
1810 const uschar * sublist = ss;
1811 int optsep = ',';
1812 uschar *opt;
1813 uschar buffer[256];
1814 while (isspace(*sublist)) sublist++;
1815
1816 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1817 {
1818 callout_opt_t * op;
1819 double period = 1.0F;
1820
1821 for (op= callout_opt_list; op->name; op++)
1822 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1823 break;
1824
1825 verify_options |= op->flag;
1826 if (op->has_option)
1827 {
1828 opt += Ustrlen(op->name);
1829 while (isspace(*opt)) opt++;
1830 if (*opt++ != '=')
1831 {
1832 *log_msgptr = string_sprintf("'=' expected after "
1833 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1834 return ERROR;
1835 }
1836 while (isspace(*opt)) opt++;
1837 }
1838 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1839 {
1840 *log_msgptr = string_sprintf("bad time value in ACL condition "
1841 "\"verify %s\"", arg);
1842 return ERROR;
1843 }
1844
1845 switch(op->value)
1846 {
1847 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1848 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1849 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1850 case CALLOUT_MAILFROM:
1851 if (!verify_header_sender)
1852 {
1853 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1854 "callout option only for verify=header_sender (detected in ACL "
1855 "condition \"%s\")", arg);
1856 return ERROR;
1857 }
1858 se_mailfrom = string_copy(opt);
1859 break;
1860 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1861 case CALLOUT_MAXWAIT: callout_overall = period; break;
1862 case CALLOUT_CONNECT: callout_connect = period; break;
1863 case CALLOUT_TIME: callout = period; break;
1864 }
1865 }
1866 }
1867 else
1868 {
1869 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1870 "ACL condition \"%s\"", arg);
1871 return ERROR;
1872 }
1873 }
1874 }
1875
1876 /* Option not recognized */
1877
1878 else
1879 {
1880 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1881 "condition \"verify %s\"", ss, arg);
1882 return ERROR;
1883 }
1884 }
1885
1886 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1887 (vopt_callout_recipsender|vopt_callout_recippmaster))
1888 {
1889 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1890 "for a recipient callout";
1891 return ERROR;
1892 }
1893
1894 /* Handle sender-in-header verification. Default the user message to the log
1895 message if giving out verification details. */
1896
1897 if (verify_header_sender)
1898 {
1899 int verrno;
1900
1901 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1902 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1903 &verrno)) != OK)
1904 {
1905 *basic_errno = verrno;
1906 if (smtp_return_error_details)
1907 {
1908 if (!*user_msgptr && *log_msgptr)
1909 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1910 if (rc == DEFER) f.acl_temp_details = TRUE;
1911 }
1912 }
1913 }
1914
1915 /* Handle a sender address. The default is to verify *the* sender address, but
1916 optionally a different address can be given, for special requirements. If the
1917 address is empty, we are dealing with a bounce message that has no sender, so
1918 we cannot do any checking. If the real sender address gets rewritten during
1919 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1920 during message reception.
1921
1922 A list of verified "sender" addresses is kept to try to avoid doing to much
1923 work repetitively when there are multiple recipients in a message and they all
1924 require sender verification. However, when callouts are involved, it gets too
1925 complicated because different recipients may require different callout options.
1926 Therefore, we always do a full sender verify when any kind of callout is
1927 specified. Caching elsewhere, for instance in the DNS resolver and in the
1928 callout handling, should ensure that this is not terribly inefficient. */
1929
1930 else if (verify_sender_address)
1931 {
1932 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1933 {
1934 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1935 "sender verify callout";
1936 return ERROR;
1937 }
1938
1939 sender_vaddr = verify_checked_sender(verify_sender_address);
1940 if (sender_vaddr != NULL && /* Previously checked */
1941 callout <= 0) /* No callout needed this time */
1942 {
1943 /* If the "routed" flag is set, it means that routing worked before, so
1944 this check can give OK (the saved return code value, if set, belongs to a
1945 callout that was done previously). If the "routed" flag is not set, routing
1946 must have failed, so we use the saved return code. */
1947
1948 if (testflag(sender_vaddr, af_verify_routed))
1949 rc = OK;
1950 else
1951 {
1952 rc = sender_vaddr->special_action;
1953 *basic_errno = sender_vaddr->basic_errno;
1954 }
1955 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1956 }
1957
1958 /* Do a new verification, and cache the result. The cache is used to avoid
1959 verifying the sender multiple times for multiple RCPTs when callouts are not
1960 specified (see comments above).
1961
1962 The cache is also used on failure to give details in response to the first
1963 RCPT that gets bounced for this reason. However, this can be suppressed by
1964 the no_details option, which sets the flag that says "this detail has already
1965 been sent". The cache normally contains just one address, but there may be
1966 more in esoteric circumstances. */
1967
1968 else
1969 {
1970 BOOL routed = TRUE;
1971 uschar *save_address_data = deliver_address_data;
1972
1973 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1974 #ifdef SUPPORT_I18N
1975 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1976 {
1977 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1978 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1979 }
1980 #endif
1981 if (no_details) setflag(sender_vaddr, af_sverify_told);
1982 if (verify_sender_address[0] != 0)
1983 {
1984 /* If this is the real sender address, save the unrewritten version
1985 for use later in receive. Otherwise, set a flag so that rewriting the
1986 sender in verify_address() does not update sender_address. */
1987
1988 if (verify_sender_address == sender_address)
1989 sender_address_unrewritten = sender_address;
1990 else
1991 verify_options |= vopt_fake_sender;
1992
1993 if (success_on_redirect)
1994 verify_options |= vopt_success_on_redirect;
1995
1996 /* The recipient, qualify, and expn options are never set in
1997 verify_options. */
1998
1999 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2000 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2001
2002 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2003
2004 if (rc != OK)
2005 *basic_errno = sender_vaddr->basic_errno;
2006 else
2007 DEBUG(D_acl)
2008 {
2009 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2010 debug_printf_indent("sender %s verified ok as %s\n",
2011 verify_sender_address, sender_vaddr->address);
2012 else
2013 debug_printf_indent("sender %s verified ok\n",
2014 verify_sender_address);
2015 }
2016 }
2017 else
2018 rc = OK; /* Null sender */
2019
2020 /* Cache the result code */
2021
2022 if (routed) setflag(sender_vaddr, af_verify_routed);
2023 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2024 sender_vaddr->special_action = rc;
2025 sender_vaddr->next = sender_verified_list;
2026 sender_verified_list = sender_vaddr;
2027
2028 /* Restore the recipient address data, which might have been clobbered by
2029 the sender verification. */
2030
2031 deliver_address_data = save_address_data;
2032 }
2033
2034 /* Put the sender address_data value into $sender_address_data */
2035
2036 sender_address_data = sender_vaddr->prop.address_data;
2037 }
2038
2039 /* A recipient address just gets a straightforward verify; again we must handle
2040 the DEFER overrides. */
2041
2042 else
2043 {
2044 address_item addr2;
2045
2046 if (success_on_redirect)
2047 verify_options |= vopt_success_on_redirect;
2048
2049 /* We must use a copy of the address for verification, because it might
2050 get rewritten. */
2051
2052 addr2 = *addr;
2053 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2054 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2055 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2056
2057 *basic_errno = addr2.basic_errno;
2058 *log_msgptr = addr2.message;
2059 *user_msgptr = (addr2.user_message != NULL)?
2060 addr2.user_message : addr2.message;
2061
2062 /* Allow details for temporary error if the address is so flagged. */
2063 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2064
2065 /* Make $address_data visible */
2066 deliver_address_data = addr2.prop.address_data;
2067 }
2068
2069 /* We have a result from the relevant test. Handle defer overrides first. */
2070
2071 if (rc == DEFER && (defer_ok ||
2072 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2073 {
2074 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2075 defer_ok? "defer_ok" : "callout_defer_ok");
2076 rc = OK;
2077 }
2078
2079 /* If we've failed a sender, set up a recipient message, and point
2080 sender_verified_failed to the address item that actually failed. */
2081
2082 if (rc != OK && verify_sender_address != NULL)
2083 {
2084 if (rc != DEFER)
2085 *log_msgptr = *user_msgptr = US"Sender verify failed";
2086 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2087 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2088 else
2089 {
2090 *log_msgptr = US"Could not complete sender verify callout";
2091 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2092 *log_msgptr;
2093 }
2094
2095 sender_verified_failed = sender_vaddr;
2096 }
2097
2098 /* Verifying an address messes up the values of $domain and $local_part,
2099 so reset them before returning if this is a RCPT ACL. */
2100
2101 if (addr != NULL)
2102 {
2103 deliver_domain = addr->domain;
2104 deliver_localpart = addr->local_part;
2105 }
2106 return rc;
2107
2108 /* Syntax errors in the verify argument come here. */
2109
2110 BAD_VERIFY:
2111 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2112 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2113 "or \"reverse_host_lookup\" at start of ACL condition "
2114 "\"verify %s\"", arg);
2115 return ERROR;
2116 }
2117
2118
2119
2120
2121 /*************************************************
2122 * Check argument for control= modifier *
2123 *************************************************/
2124
2125 /* Called from acl_check_condition() below
2126
2127 Arguments:
2128 arg the argument string for control=
2129 pptr set to point to the terminating character
2130 where which ACL we are in
2131 log_msgptr for error messages
2132
2133 Returns: CONTROL_xxx value
2134 */
2135
2136 static int
2137 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2138 {
2139 int idx, len;
2140 control_def * d;
2141
2142 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2143 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2144 && (!d->has_option || arg[len] != '/')
2145 ) )
2146 {
2147 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2148 return CONTROL_ERROR;
2149 }
2150
2151 *pptr = arg + len;
2152 return idx;
2153 }
2154
2155
2156
2157
2158 /*************************************************
2159 * Return a ratelimit error *
2160 *************************************************/
2161
2162 /* Called from acl_ratelimit() below
2163
2164 Arguments:
2165 log_msgptr for error messages
2166 format format string
2167 ... supplementary arguments
2168
2169 Returns: ERROR
2170 */
2171
2172 static int
2173 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2174 {
2175 va_list ap;
2176 gstring * g =
2177 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2178
2179 va_start(ap, format);
2180 g = string_vformat(g, TRUE, format, ap);
2181 va_end(ap);
2182
2183 gstring_reset_unused(g);
2184 *log_msgptr = string_from_gstring(g);
2185 return ERROR;
2186 }
2187
2188
2189
2190
2191 /*************************************************
2192 * Handle rate limiting *
2193 *************************************************/
2194
2195 /* Called by acl_check_condition() below to calculate the result
2196 of the ACL ratelimit condition.
2197
2198 Note that the return value might be slightly unexpected: if the
2199 sender's rate is above the limit then the result is OK. This is
2200 similar to the dnslists condition, and is so that you can write
2201 ACL clauses like: defer ratelimit = 15 / 1h
2202
2203 Arguments:
2204 arg the option string for ratelimit=
2205 where ACL_WHERE_xxxx indicating which ACL this is
2206 log_msgptr for error messages
2207
2208 Returns: OK - Sender's rate is above limit
2209 FAIL - Sender's rate is below limit
2210 DEFER - Problem opening ratelimit database
2211 ERROR - Syntax error in options.
2212 */
2213
2214 static int
2215 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2216 {
2217 double limit, period, count;
2218 uschar *ss;
2219 uschar *key = NULL;
2220 uschar *unique = NULL;
2221 int sep = '/';
2222 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2223 BOOL noupdate = FALSE, badacl = FALSE;
2224 int mode = RATE_PER_WHAT;
2225 int old_pool, rc;
2226 tree_node **anchor, *t;
2227 open_db dbblock, *dbm;
2228 int dbdb_size;
2229 dbdata_ratelimit *dbd;
2230 dbdata_ratelimit_unique *dbdb;
2231 struct timeval tv;
2232
2233 /* Parse the first two options and record their values in expansion
2234 variables. These variables allow the configuration to have informative
2235 error messages based on rate limits obtained from a table lookup. */
2236
2237 /* First is the maximum number of messages per period / maximum burst
2238 size, which must be greater than or equal to zero. Zero is useful for
2239 rate measurement as opposed to rate limiting. */
2240
2241 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2242 return ratelimit_error(log_msgptr, "sender rate limit not set");
2243
2244 limit = Ustrtod(sender_rate_limit, &ss);
2245 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2246 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2247 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2248
2249 if (limit < 0.0 || *ss != '\0')
2250 return ratelimit_error(log_msgptr,
2251 "\"%s\" is not a positive number", sender_rate_limit);
2252
2253 /* Second is the rate measurement period / exponential smoothing time
2254 constant. This must be strictly greater than zero, because zero leads to
2255 run-time division errors. */
2256
2257 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2258 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2259 if (period <= 0.0)
2260 return ratelimit_error(log_msgptr,
2261 "\"%s\" is not a time value", sender_rate_period);
2262
2263 /* By default we are counting one of something, but the per_rcpt,
2264 per_byte, and count options can change this. */
2265
2266 count = 1.0;
2267
2268 /* Parse the other options. */
2269
2270 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
2271 {
2272 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2273 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2274 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2275 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2276 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2277 else if (strcmpic(ss, US"per_conn") == 0)
2278 {
2279 RATE_SET(mode, PER_CONN);
2280 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2281 badacl = TRUE;
2282 }
2283 else if (strcmpic(ss, US"per_mail") == 0)
2284 {
2285 RATE_SET(mode, PER_MAIL);
2286 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2287 }
2288 else if (strcmpic(ss, US"per_rcpt") == 0)
2289 {
2290 /* If we are running in the RCPT ACL, then we'll count the recipients
2291 one by one, but if we are running when we have accumulated the whole
2292 list then we'll add them all in one batch. */
2293 if (where == ACL_WHERE_RCPT)
2294 RATE_SET(mode, PER_RCPT);
2295 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2296 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2297 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2298 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2299 }
2300 else if (strcmpic(ss, US"per_byte") == 0)
2301 {
2302 /* If we have not yet received the message data and there was no SIZE
2303 declaration on the MAIL command, then it's safe to just use a value of
2304 zero and let the recorded rate decay as if nothing happened. */
2305 RATE_SET(mode, PER_MAIL);
2306 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2307 else count = message_size < 0 ? 0.0 : (double)message_size;
2308 }
2309 else if (strcmpic(ss, US"per_addr") == 0)
2310 {
2311 RATE_SET(mode, PER_RCPT);
2312 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2313 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2314 }
2315 else if (strncmpic(ss, US"count=", 6) == 0)
2316 {
2317 uschar *e;
2318 count = Ustrtod(ss+6, &e);
2319 if (count < 0.0 || *e != '\0')
2320 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2321 }
2322 else if (strncmpic(ss, US"unique=", 7) == 0)
2323 unique = string_copy(ss + 7);
2324 else if (!key)
2325 key = string_copy(ss);
2326 else
2327 key = string_sprintf("%s/%s", key, ss);
2328 }
2329
2330 /* Sanity check. When the badacl flag is set the update mode must either
2331 be readonly (which is the default if it is omitted) or, for backwards
2332 compatibility, a combination of noupdate and strict or leaky. */
2333
2334 if (mode == RATE_PER_CLASH)
2335 return ratelimit_error(log_msgptr, "conflicting per_* options");
2336 if (leaky + strict + readonly > 1)
2337 return ratelimit_error(log_msgptr, "conflicting update modes");
2338 if (badacl && (leaky || strict) && !noupdate)
2339 return ratelimit_error(log_msgptr,
2340 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2341 ratelimit_option_string[mode], acl_wherenames[where]);
2342
2343 /* Set the default values of any unset options. In readonly mode we
2344 perform the rate computation without any increment so that its value
2345 decays to eventually allow over-limit senders through. */
2346
2347 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2348 if (badacl) readonly = TRUE;
2349 if (readonly) count = 0.0;
2350 if (!strict && !readonly) leaky = TRUE;
2351 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2352
2353 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2354 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2355 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2356 are added to the key because they alter the meaning of the stored data. */
2357
2358 if (!key)
2359 key = !sender_host_address ? US"" : sender_host_address;
2360
2361 key = string_sprintf("%s/%s/%s%s",
2362 sender_rate_period,
2363 ratelimit_option_string[mode],
2364 unique == NULL ? "" : "unique/",
2365 key);
2366
2367 HDEBUG(D_acl)
2368 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2369
2370 /* See if we have already computed the rate by looking in the relevant tree.
2371 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2372 pool so that they survive across resets. In readonly mode we only remember the
2373 result for the rest of this command in case a later command changes it. After
2374 this bit of logic the code is independent of the per_* mode. */
2375
2376 old_pool = store_pool;
2377
2378 if (readonly)
2379 anchor = &ratelimiters_cmd;
2380 else switch(mode)
2381 {
2382 case RATE_PER_CONN:
2383 anchor = &ratelimiters_conn;
2384 store_pool = POOL_PERM;
2385 break;
2386 case RATE_PER_BYTE:
2387 case RATE_PER_MAIL:
2388 case RATE_PER_ALLRCPTS:
2389 anchor = &ratelimiters_mail;
2390 break;
2391 case RATE_PER_ADDR:
2392 case RATE_PER_CMD:
2393 case RATE_PER_RCPT:
2394 anchor = &ratelimiters_cmd;
2395 break;
2396 default:
2397 anchor = NULL; /* silence an "unused" complaint */
2398 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2399 "internal ACL error: unknown ratelimit mode %d", mode);
2400 break;
2401 }
2402
2403 if ((t = tree_search(*anchor, key)))
2404 {
2405 dbd = t->data.ptr;
2406 /* The following few lines duplicate some of the code below. */
2407 rc = (dbd->rate < limit)? FAIL : OK;
2408 store_pool = old_pool;
2409 sender_rate = string_sprintf("%.1f", dbd->rate);
2410 HDEBUG(D_acl)
2411 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2412 return rc;
2413 }
2414
2415 /* We aren't using a pre-computed rate, so get a previously recorded rate
2416 from the database, which will be updated and written back if required. */
2417
2418 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE)))
2419 {
2420 store_pool = old_pool;
2421 sender_rate = NULL;
2422 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2423 *log_msgptr = US"ratelimit database not available";
2424 return DEFER;
2425 }
2426 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2427 dbd = NULL;
2428
2429 gettimeofday(&tv, NULL);
2430
2431 if (dbdb)
2432 {
2433 /* Locate the basic ratelimit block inside the DB data. */
2434 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2435 dbd = &dbdb->dbd;
2436
2437 /* Forget the old Bloom filter if it is too old, so that we count each
2438 repeating event once per period. We don't simply clear and re-use the old
2439 filter because we want its size to change if the limit changes. Note that
2440 we keep the dbd pointer for copying the rate into the new data block. */
2441
2442 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2443 {
2444 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2445 dbdb = NULL;
2446 }
2447
2448 /* Sanity check. */
2449
2450 if(unique && dbdb_size < sizeof(*dbdb))
2451 {
2452 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2453 dbdb = NULL;
2454 }
2455 }
2456
2457 /* Allocate a new data block if the database lookup failed
2458 or the Bloom filter passed its age limit. */
2459
2460 if (!dbdb)
2461 {
2462 if (!unique)
2463 {
2464 /* No Bloom filter. This basic ratelimit block is initialized below. */
2465 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2466 dbdb_size = sizeof(*dbd);
2467 dbdb = store_get(dbdb_size);
2468 }
2469 else
2470 {
2471 int extra;
2472 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2473
2474 /* See the long comment below for an explanation of the magic number 2.
2475 The filter has a minimum size in case the rate limit is very small;
2476 this is determined by the definition of dbdata_ratelimit_unique. */
2477
2478 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2479 if (extra < 0) extra = 0;
2480 dbdb_size = sizeof(*dbdb) + extra;
2481 dbdb = store_get(dbdb_size);
2482 dbdb->bloom_epoch = tv.tv_sec;
2483 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2484 memset(dbdb->bloom, 0, dbdb->bloom_size);
2485
2486 /* Preserve any basic ratelimit data (which is our longer-term memory)
2487 by copying it from the discarded block. */
2488
2489 if (dbd)
2490 {
2491 dbdb->dbd = *dbd;
2492 dbd = &dbdb->dbd;
2493 }
2494 }
2495 }
2496
2497 /* If we are counting unique events, find out if this event is new or not.
2498 If the client repeats the event during the current period then it should be
2499 counted. We skip this code in readonly mode for efficiency, because any
2500 changes to the filter will be discarded and because count is already set to
2501 zero. */
2502
2503 if (unique && !readonly)
2504 {
2505 /* We identify unique events using a Bloom filter. (You can find my
2506 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2507 With the per_addr option, an "event" is a recipient address, though the
2508 user can use the unique option to define their own events. We only count
2509 an event if we have not seen it before.
2510
2511 We size the filter according to the rate limit, which (in leaky mode)
2512 is the limit on the population of the filter. We allow 16 bits of space
2513 per entry (see the construction code above) and we set (up to) 8 of them
2514 when inserting an element (see the loop below). The probability of a false
2515 positive (an event we have not seen before but which we fail to count) is
2516
2517 size = limit * 16
2518 numhash = 8
2519 allzero = exp(-numhash * pop / size)
2520 = exp(-0.5 * pop / limit)
2521 fpr = pow(1 - allzero, numhash)
2522
2523 For senders at the limit the fpr is 0.06% or 1 in 1700
2524 and for senders at half the limit it is 0.0006% or 1 in 170000
2525
2526 In strict mode the Bloom filter can fill up beyond the normal limit, in
2527 which case the false positive rate will rise. This means that the
2528 measured rate for very fast senders can bogusly drop off after a while.
2529
2530 At twice the limit, the fpr is 2.5% or 1 in 40
2531 At four times the limit, it is 31% or 1 in 3.2
2532
2533 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2534 decay below the limit, and if this is more than one then the Bloom filter
2535 will be discarded before the decay gets that far. The false positive rate
2536 at this threshold is 9.3% or 1 in 10.7. */
2537
2538 BOOL seen;
2539 unsigned n, hash, hinc;
2540 uschar md5sum[16];
2541 md5 md5info;
2542
2543 /* Instead of using eight independent hash values, we combine two values
2544 using the formula h1 + n * h2. This does not harm the Bloom filter's
2545 performance, and means the amount of hash we need is independent of the
2546 number of bits we set in the filter. */
2547
2548 md5_start(&md5info);
2549 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2550 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2551 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2552
2553 /* Scan the bits corresponding to this event. A zero bit means we have
2554 not seen it before. Ensure all bits are set to record this event. */
2555
2556 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2557
2558 seen = TRUE;
2559 for (n = 0; n < 8; n++, hash += hinc)
2560 {
2561 int bit = 1 << (hash % 8);
2562 int byte = (hash / 8) % dbdb->bloom_size;
2563 if ((dbdb->bloom[byte] & bit) == 0)
2564 {
2565 dbdb->bloom[byte] |= bit;
2566 seen = FALSE;
2567 }
2568 }
2569
2570 /* If this event has occurred before, do not count it. */
2571
2572 if (seen)
2573 {
2574 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2575 count = 0.0;
2576 }
2577 else
2578 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2579 }
2580
2581 /* If there was no previous ratelimit data block for this key, initialize
2582 the new one, otherwise update the block from the database. The initial rate
2583 is what would be computed by the code below for an infinite interval. */
2584
2585 if (!dbd)
2586 {
2587 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2588 dbd = &dbdb->dbd;
2589 dbd->time_stamp = tv.tv_sec;
2590 dbd->time_usec = tv.tv_usec;
2591 dbd->rate = count;
2592 }
2593 else
2594 {
2595 /* The smoothed rate is computed using an exponentially weighted moving
2596 average adjusted for variable sampling intervals. The standard EWMA for
2597 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2598 where f() is the measured value and f'() is the smoothed value.
2599
2600 Old data decays out of the smoothed value exponentially, such that data n
2601 samples old is multiplied by a^n. The exponential decay time constant p
2602 is defined such that data p samples old is multiplied by 1/e, which means
2603 that a = exp(-1/p). We can maintain the same time constant for a variable
2604 sampling interval i by using a = exp(-i/p).
2605
2606 The rate we are measuring is messages per period, suitable for directly
2607 comparing with the limit. The average rate between now and the previous
2608 message is period / interval, which we feed into the EWMA as the sample.
2609
2610 It turns out that the number of messages required for the smoothed rate
2611 to reach the limit when they are sent in a burst is equal to the limit.
2612 This can be seen by analysing the value of the smoothed rate after N
2613 messages sent at even intervals. Let k = (1 - a) * p/i
2614
2615 rate_1 = (1 - a) * p/i + a * rate_0
2616 = k + a * rate_0
2617 rate_2 = k + a * rate_1
2618 = k + a * k + a^2 * rate_0
2619 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2620 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2621 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2622 = rate_0 * a^N + p/i * (1 - a^N)
2623
2624 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2625
2626 rate_N = p/i + (rate_0 - p/i) * a^N
2627 a^N = (rate_N - p/i) / (rate_0 - p/i)
2628 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2629 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2630
2631 Numerical analysis of the above equation, setting the computed rate to
2632 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2633 rates, p/i, the number of messages N = limit. So limit serves as both the
2634 maximum rate measured in messages per period, and the maximum number of
2635 messages that can be sent in a fast burst. */
2636
2637 double this_time = (double)tv.tv_sec
2638 + (double)tv.tv_usec / 1000000.0;
2639 double prev_time = (double)dbd->time_stamp
2640 + (double)dbd->time_usec / 1000000.0;
2641
2642 /* We must avoid division by zero, and deal gracefully with the clock going
2643 backwards. If we blunder ahead when time is in reverse then the computed
2644 rate will be bogus. To be safe we clamp interval to a very small number. */
2645
2646 double interval = this_time - prev_time <= 0.0 ? 1e-9
2647 : this_time - prev_time;
2648
2649 double i_over_p = interval / period;
2650 double a = exp(-i_over_p);
2651
2652 /* Combine the instantaneous rate (period / interval) with the previous rate
2653 using the smoothing factor a. In order to measure sized events, multiply the
2654 instantaneous rate by the count of bytes or recipients etc. */
2655
2656 dbd->time_stamp = tv.tv_sec;
2657 dbd->time_usec = tv.tv_usec;
2658 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2659
2660 /* When events are very widely spaced the computed rate tends towards zero.
2661 Although this is accurate it turns out not to be useful for our purposes,
2662 especially when the first event after a long silence is the start of a spam
2663 run. A more useful model is that the rate for an isolated event should be the
2664 size of the event per the period size, ignoring the lack of events outside
2665 the current period and regardless of where the event falls in the period. So,
2666 if the interval was so long that the calculated rate is unhelpfully small, we
2667 re-initialize the rate. In the absence of higher-rate bursts, the condition
2668 below is true if the interval is greater than the period. */
2669
2670 if (dbd->rate < count) dbd->rate = count;
2671 }
2672
2673 /* Clients sending at the limit are considered to be over the limit.
2674 This matters for edge cases such as a limit of zero, when the client
2675 should be completely blocked. */
2676
2677 rc = dbd->rate < limit ? FAIL : OK;
2678
2679 /* Update the state if the rate is low or if we are being strict. If we
2680 are in leaky mode and the sender's rate is too high, we do not update
2681 the recorded rate in order to avoid an over-aggressive sender's retry
2682 rate preventing them from getting any email through. If readonly is set,
2683 neither leaky nor strict are set, so we do not do any updates. */
2684
2685 if ((rc == FAIL && leaky) || strict)
2686 {
2687 dbfn_write(dbm, key, dbdb, dbdb_size);
2688 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2689 }
2690 else
2691 {
2692 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2693 readonly? "readonly mode" : "over the limit, but leaky");
2694 }
2695
2696 dbfn_close(dbm);
2697
2698 /* Store the result in the tree for future reference. */
2699
2700 t = store_get(sizeof(tree_node) + Ustrlen(key));
2701 t->data.ptr = dbd;
2702 Ustrcpy(t->name, key);
2703 (void)tree_insertnode(anchor, t);
2704
2705 /* We create the formatted version of the sender's rate very late in
2706 order to ensure that it is done using the correct storage pool. */
2707
2708 store_pool = old_pool;
2709 sender_rate = string_sprintf("%.1f", dbd->rate);
2710
2711 HDEBUG(D_acl)
2712 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2713
2714 return rc;
2715 }
2716
2717
2718
2719 /*************************************************
2720 * The udpsend ACL modifier *
2721 *************************************************/
2722
2723 /* Called by acl_check_condition() below.
2724
2725 Arguments:
2726 arg the option string for udpsend=
2727 log_msgptr for error messages
2728
2729 Returns: OK - Completed.
2730 DEFER - Problem with DNS lookup.
2731 ERROR - Syntax error in options.
2732 */
2733
2734 static int
2735 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2736 {
2737 int sep = 0;
2738 uschar *hostname;
2739 uschar *portstr;
2740 uschar *portend;
2741 host_item *h;
2742 int portnum;
2743 int len;
2744 int r, s;
2745 uschar * errstr;
2746
2747 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2748 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2749
2750 if (!hostname)
2751 {
2752 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2753 return ERROR;
2754 }
2755 if (!portstr)
2756 {
2757 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2758 return ERROR;
2759 }
2760 if (!arg)
2761 {
2762 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2763 return ERROR;
2764 }
2765 portnum = Ustrtol(portstr, &portend, 10);
2766 if (*portend != '\0')
2767 {
2768 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2769 return ERROR;
2770 }
2771
2772 /* Make a single-item host list. */
2773 h = store_get(sizeof(host_item));
2774 memset(h, 0, sizeof(host_item));
2775 h->name = hostname;
2776 h->port = portnum;
2777 h->mx = MX_NONE;
2778
2779 if (string_is_ip_address(hostname, NULL))
2780 h->address = hostname, r = HOST_FOUND;
2781 else
2782 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2783 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2784 {
2785 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2786 return DEFER;
2787 }
2788
2789 HDEBUG(D_acl)
2790 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2791
2792 /*XXX this could better use sendto */
2793 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2794 1, NULL, &errstr, NULL);
2795 if (r < 0) goto defer;
2796 len = Ustrlen(arg);
2797 r = send(s, arg, len, 0);
2798 if (r < 0)
2799 {
2800 errstr = US strerror(errno);
2801 close(s);
2802 goto defer;
2803 }
2804 close(s);
2805 if (r < len)
2806 {
2807 *log_msgptr =
2808 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2809 return DEFER;
2810 }
2811
2812 HDEBUG(D_acl)
2813 debug_printf_indent("udpsend %d bytes\n", r);
2814
2815 return OK;
2816
2817 defer:
2818 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2819 return DEFER;
2820 }
2821
2822
2823
2824 /*************************************************
2825 * Handle conditions/modifiers on an ACL item *
2826 *************************************************/
2827
2828 /* Called from acl_check() below.
2829
2830 Arguments:
2831 verb ACL verb
2832 cb ACL condition block - if NULL, result is OK
2833 where where called from
2834 addr the address being checked for RCPT, or NULL
2835 level the nesting level
2836 epp pointer to pass back TRUE if "endpass" encountered
2837 (applies only to "accept" and "discard")
2838 user_msgptr user message pointer
2839 log_msgptr log message pointer
2840 basic_errno pointer to where to put verify error
2841
2842 Returns: OK - all conditions are met
2843 DISCARD - an "acl" condition returned DISCARD - only allowed
2844 for "accept" or "discard" verbs
2845 FAIL - at least one condition fails
2846 FAIL_DROP - an "acl" condition returned FAIL_DROP
2847 DEFER - can't tell at the moment (typically, lookup defer,
2848 but can be temporary callout problem)
2849 ERROR - ERROR from nested ACL or expansion failure or other
2850 error
2851 */
2852
2853 static int
2854 acl_check_condition(int verb, acl_condition_block *cb, int where,
2855 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2856 uschar **log_msgptr, int *basic_errno)
2857 {
2858 uschar *user_message = NULL;
2859 uschar *log_message = NULL;
2860 int rc = OK;
2861 #ifdef WITH_CONTENT_SCAN
2862 int sep = -'/';
2863 #endif
2864
2865 for (; cb; cb = cb->next)
2866 {
2867 const uschar *arg;
2868 int control_type;
2869
2870 /* The message and log_message items set up messages to be used in
2871 case of rejection. They are expanded later. */
2872
2873 if (cb->type == ACLC_MESSAGE)
2874 {
2875 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2876 user_message = cb->arg;
2877 continue;
2878 }
2879
2880 if (cb->type == ACLC_LOG_MESSAGE)
2881 {
2882 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2883 log_message = cb->arg;
2884 continue;
2885 }
2886
2887 /* The endpass "condition" just sets a flag to show it occurred. This is
2888 checked at compile time to be on an "accept" or "discard" item. */
2889
2890 if (cb->type == ACLC_ENDPASS)
2891 {
2892 *epp = TRUE;
2893 continue;
2894 }
2895
2896 /* For other conditions and modifiers, the argument is expanded now for some
2897 of them, but not for all, because expansion happens down in some lower level
2898 checking functions in some cases. */
2899
2900 if (!conditions[cb->type].expand_at_top)
2901 arg = cb->arg;
2902 else if (!(arg = expand_string(cb->arg)))
2903 {
2904 if (f.expand_string_forcedfail) continue;
2905 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2906 cb->arg, expand_string_message);
2907 return f.search_find_defer ? DEFER : ERROR;
2908 }
2909
2910 /* Show condition, and expanded condition if it's different */
2911
2912 HDEBUG(D_acl)
2913 {
2914 int lhswidth = 0;
2915 debug_printf_indent("check %s%s %n",
2916 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2917 conditions[cb->type].name, &lhswidth);
2918
2919 if (cb->type == ACLC_SET)
2920 {
2921 #ifndef DISABLE_DKIM
2922 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2923 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2924 {
2925 debug_printf("%s ", cb->u.varname);
2926 lhswidth += 19;
2927 }
2928 else
2929 #endif
2930 {
2931 debug_printf("acl_%s ", cb->u.varname);
2932 lhswidth += 5 + Ustrlen(cb->u.varname);
2933 }
2934 }
2935
2936 debug_printf("= %s\n", cb->arg);
2937
2938 if (arg != cb->arg)
2939 debug_printf("%.*s= %s\n", lhswidth,
2940 US" ", CS arg);
2941 }
2942
2943 /* Check that this condition makes sense at this time */
2944
2945 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2946 {
2947 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2948 conditions[cb->type].is_modifier ? "use" : "test",
2949 conditions[cb->type].name, acl_wherenames[where]);
2950 return ERROR;
2951 }
2952
2953 /* Run the appropriate test for each condition, or take the appropriate
2954 action for the remaining modifiers. */
2955
2956 switch(cb->type)
2957 {
2958 case ACLC_ADD_HEADER:
2959 setup_header(arg);
2960 break;
2961
2962 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2963 "discard" verb. */
2964
2965 case ACLC_ACL:
2966 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2967 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2968 {
2969 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2970 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2971 verbs[verb]);
2972 return ERROR;
2973 }
2974 break;
2975
2976 case ACLC_AUTHENTICATED:
2977 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2978 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2979 break;
2980
2981 #ifdef EXPERIMENTAL_BRIGHTMAIL
2982 case ACLC_BMI_OPTIN:
2983 {
2984 int old_pool = store_pool;
2985 store_pool = POOL_PERM;
2986 bmi_current_optin = string_copy(arg);
2987 store_pool = old_pool;
2988 }
2989 break;
2990 #endif
2991
2992 case ACLC_CONDITION:
2993 /* The true/false parsing here should be kept in sync with that used in
2994 expand.c when dealing with ECOND_BOOL so that we don't have too many
2995 different definitions of what can be a boolean. */
2996 if (*arg == '-'
2997 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2998 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2999 rc = (Uatoi(arg) == 0)? FAIL : OK;
3000 else
3001 rc = (strcmpic(arg, US"no") == 0 ||
3002 strcmpic(arg, US"false") == 0)? FAIL :
3003 (strcmpic(arg, US"yes") == 0 ||
3004 strcmpic(arg, US"true") == 0)? OK : DEFER;
3005 if (rc == DEFER)
3006 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3007 break;
3008
3009 case ACLC_CONTINUE: /* Always succeeds */
3010 break;
3011
3012 case ACLC_CONTROL:
3013 {
3014 const uschar *p = NULL;
3015 control_type = decode_control(arg, &p, where, log_msgptr);
3016
3017 /* Check if this control makes sense at this time */
3018
3019 if (controls_list[control_type].forbids & (1 << where))
3020 {
3021 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3022 controls_list[control_type].name, acl_wherenames[where]);
3023 return ERROR;
3024 }
3025
3026 switch(control_type)
3027 {
3028 case CONTROL_AUTH_UNADVERTISED:
3029 f.allow_auth_unadvertised = TRUE;
3030 break;
3031
3032 #ifdef EXPERIMENTAL_BRIGHTMAIL
3033 case CONTROL_BMI_RUN:
3034 bmi_run = 1;
3035 break;
3036 #endif
3037
3038 #ifndef DISABLE_DKIM
3039 case CONTROL_DKIM_VERIFY:
3040 f.dkim_disable_verify = TRUE;
3041 #ifdef EXPERIMENTAL_DMARC
3042 /* Since DKIM was blocked, skip DMARC too */
3043 f.dmarc_disable_verify = TRUE;
3044 f.dmarc_enable_forensic = FALSE;
3045 #endif
3046 break;
3047 #endif
3048
3049 #ifdef EXPERIMENTAL_DMARC
3050 case CONTROL_DMARC_VERIFY:
3051 f.dmarc_disable_verify = TRUE;
3052 break;
3053
3054 case CONTROL_DMARC_FORENSIC:
3055 f.dmarc_enable_forensic = TRUE;
3056 break;
3057 #endif
3058
3059 case CONTROL_DSCP:
3060 if (*p == '/')
3061 {
3062 int fd, af, level, optname, value;
3063 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3064 a socket; we can accept that, we'll just debug-log failures anyway. */
3065 fd = fileno(smtp_in);
3066 af = ip_get_address_family(fd);
3067 if (af < 0)
3068 {
3069 HDEBUG(D_acl)
3070 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3071 strerror(errno));
3072 break;
3073 }
3074 if (dscp_lookup(p+1, af, &level, &optname, &value))
3075 {
3076 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3077 {
3078 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3079 p+1, strerror(errno));
3080 }
3081 else
3082 {
3083 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3084 }
3085 }
3086 else
3087 {
3088 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3089 return ERROR;
3090 }
3091 }
3092 else
3093 {
3094 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3095 return ERROR;
3096 }
3097 break;
3098
3099 case CONTROL_ERROR:
3100 return ERROR;
3101
3102 case CONTROL_CASEFUL_LOCAL_PART:
3103 deliver_localpart = addr->cc_local_part;
3104 break;
3105
3106 case CONTROL_CASELOWER_LOCAL_PART:
3107 deliver_localpart = addr->lc_local_part;
3108 break;
3109
3110 case CONTROL_ENFORCE_SYNC:
3111 smtp_enforce_sync = TRUE;
3112 break;
3113
3114 case CONTROL_NO_ENFORCE_SYNC:
3115 smtp_enforce_sync = FALSE;
3116 break;
3117
3118 #ifdef WITH_CONTENT_SCAN
3119 case CONTROL_NO_MBOX_UNSPOOL:
3120 f.no_mbox_unspool = TRUE;
3121 break;
3122 #endif
3123
3124 case CONTROL_NO_MULTILINE:
3125 f.no_multiline_responses = TRUE;
3126 break;
3127
3128 case CONTROL_NO_PIPELINING:
3129 f.pipelining_enable = FALSE;
3130 break;
3131
3132 case CONTROL_NO_DELAY_FLUSH:
3133 f.disable_delay_flush = TRUE;
3134 break;
3135
3136 case CONTROL_NO_CALLOUT_FLUSH:
3137 f.disable_callout_flush = TRUE;
3138 break;
3139
3140 case CONTROL_FAKEREJECT:
3141 cancel_cutthrough_connection(TRUE, US"fakereject");
3142 case CONTROL_FAKEDEFER:
3143 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3144 if (*p == '/')
3145 {
3146 const uschar *pp = p + 1;
3147 while (*pp != 0) pp++;
3148 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3149 p = pp;
3150 }
3151 else
3152 {
3153 /* Explicitly reset to default string */
3154 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3155 }
3156 break;
3157
3158 case CONTROL_FREEZE:
3159 f.deliver_freeze = TRUE;
3160 deliver_frozen_at = time(NULL);
3161 freeze_tell = freeze_tell_config; /* Reset to configured value */
3162 if (Ustrncmp(p, "/no_tell", 8) == 0)
3163 {
3164 p += 8;
3165 freeze_tell = NULL;
3166 }
3167 if (*p != 0)
3168 {
3169 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3170 return ERROR;
3171 }
3172 cancel_cutthrough_connection(TRUE, US"item frozen");
3173 break;
3174
3175 case CONTROL_QUEUE_ONLY:
3176 f.queue_only_policy = TRUE;
3177 cancel_cutthrough_connection(TRUE, US"queueing forced");
3178 break;
3179
3180 #if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
3181 case CONTROL_REQUIRETLS:
3182 tls_requiretls |= REQUIRETLS_MSG;
3183 break;
3184 #endif
3185 case CONTROL_SUBMISSION:
3186 originator_name = US"";
3187 f.submission_mode = TRUE;
3188 while (*p == '/')
3189 {
3190 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3191 {
3192 p += 14;
3193 f.active_local_sender_retain = TRUE;
3194 f.active_local_from_check = FALSE;
3195 }
3196 else if (Ustrncmp(p, "/domain=", 8) == 0)
3197 {
3198 const uschar *pp = p + 8;
3199 while (*pp != 0 && *pp != '/') pp++;
3200 submission_domain = string_copyn(p+8, pp-p-8);
3201 p = pp;
3202 }
3203 /* The name= option must be last, because it swallows the rest of
3204 the string. */
3205 else if (Ustrncmp(p, "/name=", 6) == 0)
3206 {
3207 const uschar *pp = p + 6;
3208 while (*pp != 0) pp++;
3209 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3210 big_buffer, big_buffer_size));
3211 p = pp;
3212 }
3213 else break;
3214 }
3215 if (*p != 0)
3216 {
3217 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3218 return ERROR;
3219 }
3220 break;
3221
3222 case CONTROL_DEBUG:
3223 {
3224 uschar * debug_tag = NULL;
3225 uschar * debug_opts = NULL;
3226 BOOL kill = FALSE;
3227
3228 while (*p == '/')
3229 {
3230 const uschar * pp = p+1;
3231 if (Ustrncmp(pp, "tag=", 4) == 0)
3232 {
3233 for (pp += 4; *pp && *pp != '/';) pp++;
3234 debug_tag = string_copyn(p+5, pp-p-5);
3235 }
3236 else if (Ustrncmp(pp, "opts=", 5) == 0)
3237 {
3238 for (pp += 5; *pp && *pp != '/';) pp++;
3239 debug_opts = string_copyn(p+6, pp-p-6);
3240 }
3241 else if (Ustrncmp(pp, "kill", 4) == 0)
3242 {
3243 for (pp += 4; *pp && *pp != '/';) pp++;
3244 kill = TRUE;
3245 }
3246 else
3247 while (*pp && *pp != '/') pp++;
3248 p = pp;
3249 }
3250
3251 if (kill)
3252 debug_logging_stop();
3253 else
3254 debug_logging_activate(debug_tag, debug_opts);
3255 }
3256 break;
3257
3258 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3259 f.suppress_local_fixups = TRUE;
3260 break;
3261
3262 case CONTROL_CUTTHROUGH_DELIVERY:
3263 {
3264 uschar * ignored = NULL;
3265 #ifndef DISABLE_PRDR
3266 if (prdr_requested)
3267 #else
3268 if (0)
3269 #endif
3270 /* Too hard to think about for now. We might in future cutthrough
3271 the case where both sides handle prdr and this-node prdr acl
3272 is "accept" */
3273 ignored = US"PRDR active";
3274 else
3275 {
3276 if (f.deliver_freeze)
3277 ignored = US"frozen";
3278 else if (f.queue_only_policy)
3279 ignored = US"queue-only";
3280 else if (fake_response == FAIL)
3281 ignored = US"fakereject";
3282 else
3283 {
3284 if (rcpt_count == 1)
3285 {
3286 cutthrough.delivery = TRUE; /* control accepted */
3287 while (*p == '/')
3288 {
3289 const uschar * pp = p+1;
3290 if (Ustrncmp(pp, "defer=", 6) == 0)
3291 {
3292 pp += 6;
3293 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3294 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3295 }
3296 else
3297 while (*pp && *pp != '/') pp++;
3298 p = pp;
3299 }
3300 }
3301 else
3302 ignored = US"nonfirst rcpt";
3303 }
3304 }
3305 DEBUG(D_acl) if (ignored)
3306 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3307 }
3308 break;
3309
3310 #ifdef SUPPORT_I18N
3311 case CONTROL_UTF8_DOWNCONVERT:
3312 if (*p == '/')
3313 {
3314 if (p[1] == '1')
3315 {
3316 message_utf8_downconvert = 1;
3317 addr->prop.utf8_downcvt = TRUE;
3318 addr->prop.utf8_downcvt_maybe = FALSE;
3319 p += 2;
3320 break;
3321 }
3322 if (p[1] == '0')
3323 {
3324 message_utf8_downconvert = 0;
3325 addr->prop.utf8_downcvt = FALSE;
3326 addr->prop.utf8_downcvt_maybe = FALSE;
3327 p += 2;
3328 break;
3329 }
3330 if (p[1] == '-' && p[2] == '1')
3331 {
3332 message_utf8_downconvert = -1;
3333 addr->prop.utf8_downcvt = FALSE;
3334 addr->prop.utf8_downcvt_maybe = TRUE;
3335 p += 3;
3336 break;
3337 }
3338 *log_msgptr = US"bad option value for control=utf8_downconvert";
3339 }
3340 else
3341 {
3342 message_utf8_downconvert = 1;
3343 addr->prop.utf8_downcvt = TRUE;
3344 addr->prop.utf8_downcvt_maybe = FALSE;
3345 break;
3346 }
3347 return ERROR;
3348 #endif
3349
3350 }
3351 break;
3352 }
3353
3354 #ifdef EXPERIMENTAL_DCC
3355 case ACLC_DCC:
3356 {
3357 /* Separate the regular expression and any optional parameters. */
3358 const uschar * list = arg;
3359 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3360 /* Run the dcc backend. */
3361 rc = dcc_process(&ss);
3362 /* Modify return code based upon the existence of options. */
3363 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3364 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3365 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3366 }
3367 break;
3368 #endif
3369
3370 #ifdef WITH_CONTENT_SCAN
3371 case ACLC_DECODE:
3372 rc = mime_decode(&arg);
3373 break;
3374 #endif
3375
3376 case ACLC_DELAY:
3377 {
3378 int delay = readconf_readtime(arg, 0, FALSE);
3379 if (delay < 0)
3380 {
3381 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3382 "modifier: \"%s\" is not a time value", arg);
3383 return ERROR;
3384 }
3385 else
3386 {
3387 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3388 delay);
3389 if (host_checking)
3390 {
3391 HDEBUG(D_acl)
3392 debug_printf_indent("delay skipped in -bh checking mode\n");
3393 }
3394
3395 /* NOTE 1: Remember that we may be
3396 dealing with stdin/stdout here, in addition to TCP/IP connections.
3397 Also, delays may be specified for non-SMTP input, where smtp_out and
3398 smtp_in will be NULL. Whatever is done must work in all cases.
3399
3400 NOTE 2: The added feature of flushing the output before a delay must
3401 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3402 */
3403
3404 else
3405 {
3406 if (smtp_out && !f.disable_delay_flush)
3407 mac_smtp_fflush();
3408
3409 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3410 {
3411 struct pollfd p;
3412 nfds_t n = 0;
3413 if (smtp_out)
3414 {
3415 p.fd = fileno(smtp_out);
3416 p.events = POLLRDHUP;
3417 n = 1;
3418 }
3419 if (poll(&p, n, delay*1000) > 0)
3420 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3421 }
3422 #else
3423 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3424 TCP/IP connection has gone away without reading from it. This means
3425 that we cannot shorten the delay below if the client goes away,
3426 because we cannot discover that the client has closed its end of the
3427 connection. (The connection is actually in a half-closed state,
3428 waiting for the server to close its end.) It would be nice to be able
3429 to detect this state, so that the Exim process is not held up
3430 unnecessarily. However, it seems that we can't. The poll() function
3431 does not do the right thing, and in any case it is not always
3432 available. */
3433
3434 while (delay > 0) delay = sleep(delay);
3435 #endif
3436 }
3437 }
3438 }
3439 break;
3440
3441 #ifndef DISABLE_DKIM
3442 case ACLC_DKIM_SIGNER:
3443 if (dkim_cur_signer)
3444 rc = match_isinlist(dkim_cur_signer,
3445 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3446 else
3447 rc = FAIL;
3448 break;
3449
3450 case ACLC_DKIM_STATUS:
3451 rc = match_isinlist(dkim_verify_status,
3452 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3453 break;
3454 #endif
3455
3456 #ifdef EXPERIMENTAL_DMARC
3457 case ACLC_DMARC_STATUS:
3458 if (!f.dmarc_has_been_checked)
3459 dmarc_process();
3460 f.dmarc_has_been_checked = TRUE;
3461 /* used long way of dmarc_exim_expand_query() in case we need more
3462 * view into the process in the future. */
3463 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3464 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3465 break;
3466 #endif
3467
3468 case ACLC_DNSLISTS:
3469 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3470 break;
3471
3472 case ACLC_DOMAINS:
3473 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3474 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3475 break;
3476
3477 /* The value in tls_cipher is the full cipher name, for example,
3478 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3479 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3480 what may in practice come out of the SSL library - which at the time of
3481 writing is poorly documented. */
3482
3483 case ACLC_ENCRYPTED:
3484 if (tls_in.cipher == NULL) rc = FAIL; else
3485 {
3486 uschar *endcipher = NULL;
3487 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3488 if (cipher == NULL) cipher = tls_in.cipher; else
3489 {
3490 endcipher = Ustrchr(++cipher, ':');
3491 if (endcipher != NULL) *endcipher = 0;
3492 }
3493 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3494 if (endcipher != NULL) *endcipher = ':';
3495 }
3496 break;
3497
3498 /* Use verify_check_this_host() instead of verify_check_host() so that
3499 we can pass over &host_data to catch any looked up data. Once it has been
3500 set, it retains its value so that it's still there if another ACL verb
3501 comes through here and uses the cache. However, we must put it into
3502 permanent store in case it is also expected to be used in a subsequent
3503 message in the same SMTP connection. */
3504
3505 case ACLC_HOSTS:
3506 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3507 (sender_host_address == NULL)? US"" : sender_host_address,
3508 CUSS &host_data);
3509 if (rc == DEFER) *log_msgptr = search_error_message;
3510 if (host_data) host_data = string_copy_malloc(host_data);
3511 break;
3512
3513 case ACLC_LOCAL_PARTS:
3514 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3515 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3516 CUSS &deliver_localpart_data);
3517 break;
3518
3519 case ACLC_LOG_REJECT_TARGET:
3520 {
3521 int logbits = 0;
3522 int sep = 0;
3523 const uschar *s = arg;
3524 uschar *ss;
3525 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
3526 {
3527 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3528 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3529 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3530 else
3531 {
3532 logbits |= LOG_MAIN|LOG_REJECT;
3533 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3534 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3535 }
3536 }
3537 log_reject_target = logbits;
3538 }
3539 break;
3540
3541 case ACLC_LOGWRITE:
3542 {
3543 int logbits = 0;
3544 const uschar *s = arg;
3545 if (*s == ':')
3546 {
3547 s++;
3548 while (*s != ':')
3549 {
3550 if (Ustrncmp(s, "main", 4) == 0)
3551 { logbits |= LOG_MAIN; s += 4; }
3552 else if (Ustrncmp(s, "panic", 5) == 0)
3553 { logbits |= LOG_PANIC; s += 5; }
3554 else if (Ustrncmp(s, "reject", 6) == 0)
3555 { logbits |= LOG_REJECT; s += 6; }
3556 else
3557 {
3558 logbits = LOG_MAIN|LOG_PANIC;
3559 s = string_sprintf(":unknown log name in \"%s\" in "
3560 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3561 }
3562 if (*s == ',') s++;
3563 }
3564 s++;
3565 }
3566 while (isspace(*s)) s++;
3567
3568 if (logbits == 0) logbits = LOG_MAIN;
3569 log_write(0, logbits, "%s", string_printing(s));
3570 }
3571 break;
3572
3573 #ifdef WITH_CONTENT_SCAN
3574 case ACLC_MALWARE: /* Run the malware backend. */
3575 {
3576 /* Separate the regular expression and any optional parameters. */
3577 const uschar * list = arg;
3578 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3579 uschar *opt;
3580 BOOL defer_ok = FALSE;
3581 int timeout = 0;
3582
3583 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3584 if (strcmpic(opt, US"defer_ok") == 0)
3585 defer_ok = TRUE;
3586 else if ( strncmpic(opt, US"tmo=", 4) == 0
3587 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3588 )
3589 {
3590 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3591 return ERROR;
3592 }
3593
3594 rc = malware(ss, timeout);
3595 if (rc == DEFER && defer_ok)
3596 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3597 }
3598 break;
3599
3600 case ACLC_MIME_REGEX:
3601 rc = mime_regex(&arg);
3602 break;
3603 #endif
3604
3605 case ACLC_QUEUE:
3606 if (Ustrchr(arg, '/'))
3607 {
3608 *log_msgptr = string_sprintf(
3609 "Directory separator not permitted in queue name: '%s'", arg);
3610 return ERROR;
3611 }
3612 queue_name = string_copy_malloc(arg);
3613 break;
3614
3615 case ACLC_RATELIMIT:
3616 rc = acl_ratelimit(arg, where, log_msgptr);
3617 break;
3618
3619 case ACLC_RECIPIENTS:
3620 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3621 CUSS &recipient_data);
3622 break;
3623
3624 #ifdef WITH_CONTENT_SCAN
3625 case ACLC_REGEX:
3626 rc = regex(&arg);
3627 break;
3628 #endif
3629
3630 case ACLC_REMOVE_HEADER:
3631 setup_remove_header(arg);
3632 break;
3633
3634 case ACLC_SENDER_DOMAINS:
3635 {
3636 uschar *sdomain;
3637 sdomain = Ustrrchr(sender_address, '@');
3638 sdomain = sdomain ? sdomain + 1 : US"";
3639 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3640 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3641 }
3642 break;
3643
3644 case ACLC_SENDERS:
3645 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3646 sender_address_cache, -1, 0, CUSS &sender_data);
3647 break;
3648
3649 /* Connection variables must persist forever */
3650
3651 case ACLC_SET:
3652 {
3653 int old_pool = store_pool;
3654 if ( cb->u.varname[0] == 'c'
3655 #ifndef DISABLE_DKIM
3656 || cb->u.varname[0] == 'd'
3657 #endif
3658 #ifndef DISABLE_EVENT
3659 || event_name /* An event is being delivered */
3660 #endif
3661 )
3662 store_pool = POOL_PERM;
3663 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3664 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3665 dkim_verify_status = string_copy(arg);
3666 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3667 dkim_verify_reason = string_copy(arg);
3668 else
3669 #endif
3670 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3671 store_pool = old_pool;
3672 }
3673 break;
3674
3675 #ifdef WITH_CONTENT_SCAN
3676 case ACLC_SPAM:
3677 {
3678 /* Separate the regular expression and any optional parameters. */
3679 const uschar * list = arg;
3680 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3681
3682 rc = spam(CUSS &ss);
3683 /* Modify return code based upon the existence of options. */
3684 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3685 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3686 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3687 }
3688 break;
3689 #endif
3690
3691 #ifdef SUPPORT_SPF
3692 case ACLC_SPF:
3693 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3694 break;
3695 case ACLC_SPF_GUESS:
3696 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3697 break;
3698 #endif
3699
3700 case ACLC_UDPSEND:
3701 rc = acl_udpsend(arg, log_msgptr);
3702 break;
3703
3704 /* If the verb is WARN, discard any user message from verification, because
3705 such messages are SMTP responses, not header additions. The latter come
3706 only from explicit "message" modifiers. However, put the user message into
3707 $acl_verify_message so it can be used in subsequent conditions or modifiers
3708 (until something changes it). */
3709
3710 case ACLC_VERIFY:
3711 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3712 if (*user_msgptr)
3713 acl_verify_message = *user_msgptr;
3714 if (verb == ACL_WARN) *user_msgptr = NULL;
3715 break;
3716
3717 default:
3718 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3719 "condition %d", cb->type);
3720 break;
3721 }
3722
3723 /* If a condition was negated, invert OK/FAIL. */
3724
3725 if (!conditions[cb->type].is_modifier && cb->u.negated)
3726 if (rc == OK) rc = FAIL;
3727 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3728
3729 if (rc != OK) break; /* Conditions loop */
3730 }
3731
3732
3733 /* If the result is the one for which "message" and/or "log_message" are used,
3734 handle the values of these modifiers. If there isn't a log message set, we make
3735 it the same as the user message.
3736
3737 "message" is a user message that will be included in an SMTP response. Unless
3738 it is empty, it overrides any previously set user message.
3739
3740 "log_message" is a non-user message, and it adds to any existing non-user
3741 message that is already set.
3742
3743 Most verbs have but a single return for which the messages are relevant, but
3744 for "discard", it's useful to have the log message both when it succeeds and
3745 when it fails. For "accept", the message is used in the OK case if there is no
3746 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3747 present. */
3748
3749 if (*epp && rc == OK) user_message = NULL;
3750
3751 if ((BIT(rc) & msgcond[verb]) != 0)
3752 {
3753 uschar *expmessage;
3754 uschar *old_user_msgptr = *user_msgptr;
3755 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3756
3757 /* If the verb is "warn", messages generated by conditions (verification or
3758 nested ACLs) are always discarded. This also happens for acceptance verbs
3759 when they actually do accept. Only messages specified at this level are used.
3760 However, the value of an existing message is available in $acl_verify_message
3761 during expansions. */
3762
3763 if (verb == ACL_WARN ||
3764 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3765 *log_msgptr = *user_msgptr = NULL;
3766
3767 if (user_message)
3768 {
3769 acl_verify_message = old_user_msgptr;
3770 expmessage = expand_string(user_message);
3771 if (!expmessage)
3772 {
3773 if (!f.expand_string_forcedfail)
3774 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3775 user_message, expand_string_message);
3776 }
3777 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3778 }
3779
3780 if (log_message)
3781 {
3782 acl_verify_message = old_log_msgptr;
3783 expmessage = expand_string(log_message);
3784 if (!expmessage)
3785 {
3786 if (!f.expand_string_forcedfail)
3787 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3788 log_message, expand_string_message);
3789 }
3790 else if (expmessage[0] != 0)
3791 {
3792 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3793 string_sprintf("%s: %s", expmessage, *log_msgptr);
3794 }
3795 }
3796
3797 /* If no log message, default it to the user message */
3798
3799 if (!*log_msgptr) *log_msgptr = *user_msgptr;
3800 }
3801
3802 acl_verify_message = NULL;
3803 return rc;
3804 }
3805
3806
3807
3808
3809
3810 /*************************************************
3811 * Get line from a literal ACL *
3812 *************************************************/
3813
3814 /* This function is passed to acl_read() in order to extract individual lines
3815 of a literal ACL, which we access via static pointers. We can destroy the
3816 contents because this is called only once (the compiled ACL is remembered).
3817
3818 This code is intended to treat the data in the same way as lines in the main
3819 Exim configuration file. That is:
3820
3821 . Leading spaces are ignored.
3822
3823 . A \ at the end of a line is a continuation - trailing spaces after the \
3824 are permitted (this is because I don't believe in making invisible things
3825 significant). Leading spaces on the continued part of a line are ignored.
3826
3827 . Physical lines starting (significantly) with # are totally ignored, and
3828 may appear within a sequence of backslash-continued lines.
3829
3830 . Blank lines are ignored, but will end a sequence of continuations.
3831
3832 Arguments: none
3833 Returns: a pointer to the next line
3834 */
3835
3836
3837 static uschar *acl_text; /* Current pointer in the text */
3838 static uschar *acl_text_end; /* Points one past the terminating '0' */
3839
3840
3841 static uschar *
3842 acl_getline(void)
3843 {
3844 uschar *yield;
3845
3846 /* This loop handles leading blank lines and comments. */