1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Code for handling Access Control Lists (ACLs) */
13 /* Default callout timeout */
15 #define CALLOUT_TIMEOUT_DEFAULT 30
17 /* ACL verb codes - keep in step with the table of verbs that follows */
19 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
24 static uschar *verbs[] = {
25 [ACL_ACCEPT] = US"accept",
26 [ACL_DEFER] = US"defer",
27 [ACL_DENY] = US"deny",
28 [ACL_DISCARD] = US"discard",
29 [ACL_DROP] = US"drop",
30 [ACL_REQUIRE] = US"require",
34 /* For each verb, the conditions for which "message" or "log_message" are used
35 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
36 "accept", the FAIL case is used only after "endpass", but that is selected in
39 static int msgcond[] = {
40 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
41 [ACL_DEFER] = BIT(OK),
43 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
45 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
49 /* ACL condition and modifier codes - keep in step with the table that
56 #ifdef EXPERIMENTAL_BRIGHTMAIL
62 #ifdef EXPERIMENTAL_DCC
65 #ifdef WITH_CONTENT_SCAN
73 #ifdef EXPERIMENTAL_DMARC
83 ACLC_LOG_REJECT_TARGET,
85 #ifdef WITH_CONTENT_SCAN
89 #ifdef WITH_CONTENT_SCAN
95 #ifdef WITH_CONTENT_SCAN
102 #ifdef WITH_CONTENT_SCAN
112 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
113 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
114 modifiers that look like conditions but always return TRUE. They are used for
115 their side effects. */
117 typedef struct condition_def {
120 /* Flag to indicate the condition/modifier has a string expansion done
121 at the outer level. In the other cases, expansion already occurs in the
122 checking functions. */
123 BOOL expand_at_top:1;
127 /* Bit map vector of which conditions and modifiers are not allowed at certain
128 times. For each condition and modifier, there's a bitmap of dis-allowed times.
129 For some, it is easier to specify the negation of a small number of allowed
135 static condition_def conditions[] = {
136 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
138 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
140 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
141 ACL_BIT_PREDATA | ACL_BIT_DATA |
145 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
147 ACL_BIT_NOTSMTP_START),
150 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
151 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
152 ACL_BIT_CONNECT | ACL_BIT_HELO,
154 #ifdef EXPERIMENTAL_BRIGHTMAIL
155 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
157 ACL_BIT_CONNECT | ACL_BIT_HELO |
158 ACL_BIT_DATA | ACL_BIT_MIME |
159 # ifndef DISABLE_PRDR
162 ACL_BIT_ETRN | ACL_BIT_EXPN |
164 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
165 ACL_BIT_VRFY | ACL_BIT_PREDATA |
166 ACL_BIT_NOTSMTP_START,
169 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
170 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
172 /* Certain types of control are always allowed, so we let it through
173 always and check in the control processing itself. */
174 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
176 #ifdef EXPERIMENTAL_DCC
177 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
180 # ifndef DISABLE_PRDR
186 #ifdef WITH_CONTENT_SCAN
187 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
190 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
192 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
193 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
195 #ifdef EXPERIMENTAL_DMARC
196 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
199 /* Explicit key lookups can be made in non-smtp ACLs so pass
200 always and check in the verify processing itself. */
201 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
203 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
205 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
211 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
212 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
216 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
218 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
219 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
221 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
223 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
230 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
231 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
232 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
234 #ifdef WITH_CONTENT_SCAN
235 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
238 # ifndef DISABLE_PRDR
245 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
250 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
258 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
259 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
261 #ifdef WITH_CONTENT_SCAN
262 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
265 # ifndef DISABLE_PRDR
273 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
275 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
276 ACL_BIT_PREDATA | ACL_BIT_DATA |
280 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
281 ACL_BIT_NOTSMTP_START),
283 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
284 ACL_BIT_AUTH | ACL_BIT_CONNECT |
286 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
287 ACL_BIT_ETRN | ACL_BIT_EXPN |
288 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
290 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
291 ACL_BIT_AUTH | ACL_BIT_CONNECT |
293 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
294 ACL_BIT_ETRN | ACL_BIT_EXPN |
295 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
298 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
300 #ifdef WITH_CONTENT_SCAN
301 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
302 (unsigned int) ~(ACL_BIT_DATA |
303 # ifndef DISABLE_PRDR
310 [ACLC_SPF] = { US"spf", TRUE, FALSE,
311 ACL_BIT_AUTH | ACL_BIT_CONNECT |
312 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
313 ACL_BIT_ETRN | ACL_BIT_EXPN |
314 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
315 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
317 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
318 ACL_BIT_AUTH | ACL_BIT_CONNECT |
319 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
320 ACL_BIT_ETRN | ACL_BIT_EXPN |
321 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
322 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
325 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
327 /* Certain types of verify are always allowed, so we let it through
328 always and check in the verify function itself */
329 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
334 /* Return values from decode_control(); used as index so keep in step
335 with the controls_list table that follows! */
338 CONTROL_AUTH_UNADVERTISED,
339 #ifdef EXPERIMENTAL_BRIGHTMAIL
342 CONTROL_CASEFUL_LOCAL_PART,
343 CONTROL_CASELOWER_LOCAL_PART,
344 CONTROL_CUTTHROUGH_DELIVERY,
349 #ifdef EXPERIMENTAL_DMARC
350 CONTROL_DMARC_VERIFY,
351 CONTROL_DMARC_FORENSIC,
354 CONTROL_ENFORCE_SYNC,
355 CONTROL_ERROR, /* pseudo-value for decode errors */
360 CONTROL_NO_CALLOUT_FLUSH,
361 CONTROL_NO_DELAY_FLUSH,
362 CONTROL_NO_ENFORCE_SYNC,
363 #ifdef WITH_CONTENT_SCAN
364 CONTROL_NO_MBOX_UNSPOOL,
366 CONTROL_NO_MULTILINE,
367 CONTROL_NO_PIPELINING,
371 CONTROL_SUPPRESS_LOCAL_FIXUPS,
373 CONTROL_UTF8_DOWNCONVERT,
379 /* Structure listing various control arguments, with their characteristics.
380 For each control, there's a bitmap of dis-allowed times. For some, it is easier
381 to specify the negation of a small number of allowed times. */
383 typedef struct control_def {
385 BOOL has_option; /* Has /option(s) following */
386 unsigned forbids; /* bitmap of dis-allowed times */
389 static control_def controls_list[] = {
390 /* name has_option forbids */
391 [CONTROL_AUTH_UNADVERTISED] =
392 { US"allow_auth_unadvertised", FALSE,
394 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
396 #ifdef EXPERIMENTAL_BRIGHTMAIL
398 { US"bmi_run", FALSE, 0 },
400 [CONTROL_CASEFUL_LOCAL_PART] =
401 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
402 [CONTROL_CASELOWER_LOCAL_PART] =
403 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
404 [CONTROL_CUTTHROUGH_DELIVERY] =
405 { US"cutthrough_delivery", TRUE, 0 },
407 { US"debug", TRUE, 0 },
410 [CONTROL_DKIM_VERIFY] =
411 { US"dkim_disable_verify", FALSE,
412 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
413 # ifndef DISABLE_PRDR
416 ACL_BIT_NOTSMTP_START
420 #ifdef EXPERIMENTAL_DMARC
421 [CONTROL_DMARC_VERIFY] =
422 { US"dmarc_disable_verify", FALSE,
423 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
425 [CONTROL_DMARC_FORENSIC] =
426 { US"dmarc_enable_forensic", FALSE,
427 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
433 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
435 [CONTROL_ENFORCE_SYNC] =
436 { US"enforce_sync", FALSE,
437 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
440 /* Pseudo-value for decode errors */
442 { US"error", FALSE, 0 },
444 [CONTROL_FAKEDEFER] =
445 { US"fakedefer", TRUE,
447 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
448 ACL_BIT_PREDATA | ACL_BIT_DATA |
454 [CONTROL_FAKEREJECT] =
455 { US"fakereject", TRUE,
457 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
458 ACL_BIT_PREDATA | ACL_BIT_DATA |
467 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
468 ACL_BIT_PREDATA | ACL_BIT_DATA |
469 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
470 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
473 [CONTROL_NO_CALLOUT_FLUSH] =
474 { US"no_callout_flush", FALSE,
475 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
477 [CONTROL_NO_DELAY_FLUSH] =
478 { US"no_delay_flush", FALSE,
479 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
482 [CONTROL_NO_ENFORCE_SYNC] =
483 { US"no_enforce_sync", FALSE,
484 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
486 #ifdef WITH_CONTENT_SCAN
487 [CONTROL_NO_MBOX_UNSPOOL] =
488 { US"no_mbox_unspool", FALSE,
490 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
491 ACL_BIT_PREDATA | ACL_BIT_DATA |
492 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
496 [CONTROL_NO_MULTILINE] =
497 { US"no_multiline_responses", FALSE,
498 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
500 [CONTROL_NO_PIPELINING] =
501 { US"no_pipelining", FALSE,
502 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
505 [CONTROL_QUEUE_ONLY] =
506 { US"queue_only", FALSE,
508 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
509 ACL_BIT_PREDATA | ACL_BIT_DATA |
510 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
511 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
515 [CONTROL_SUBMISSION] =
516 { US"submission", TRUE,
518 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
520 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
521 { US"suppress_local_fixups", FALSE,
523 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
524 ACL_BIT_NOTSMTP_START)
527 [CONTROL_UTF8_DOWNCONVERT] =
528 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
533 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
534 caches its result in a tree to avoid repeated DNS queries. The result is an
535 integer code which is used as an index into the following tables of
536 explanatory strings and verification return codes. */
538 static tree_node *csa_cache = NULL;
540 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
541 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
543 /* The acl_verify_csa() return code is translated into an acl_verify() return
544 code using the following table. It is OK unless the client is definitely not
545 authorized. This is because CSA is supposed to be optional for sending sites,
546 so recipients should not be too strict about checking it - especially because
547 DNS problems are quite likely to occur. It's possible to use $csa_status in
548 further ACL conditions to distinguish ok, unknown, and defer if required, but
549 the aim is to make the usual configuration simple. */
551 static int csa_return_code[] = {
554 [CSA_DEFER_SRV] = OK,
555 [CSA_DEFER_ADDR] = OK,
556 [CSA_FAIL_EXPLICIT] = FAIL,
557 [CSA_FAIL_DOMAIN] = FAIL,
558 [CSA_FAIL_NOADDR] = FAIL,
559 [CSA_FAIL_MISMATCH] = FAIL
562 static uschar *csa_status_string[] = {
563 [CSA_UNKNOWN] = US"unknown",
565 [CSA_DEFER_SRV] = US"defer",
566 [CSA_DEFER_ADDR] = US"defer",
567 [CSA_FAIL_EXPLICIT] = US"fail",
568 [CSA_FAIL_DOMAIN] = US"fail",
569 [CSA_FAIL_NOADDR] = US"fail",
570 [CSA_FAIL_MISMATCH] = US"fail"
573 static uschar *csa_reason_string[] = {
574 [CSA_UNKNOWN] = US"unknown",
576 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
577 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
578 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
579 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
580 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
581 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
584 /* Options for the ratelimit condition. Note that there are two variants of
585 the per_rcpt option, depending on the ACL that is used to measure the rate.
586 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
587 so the two variants must have the same internal representation as well as
588 the same configuration string. */
591 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
592 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
595 #define RATE_SET(var,new) \
596 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
598 static uschar *ratelimit_option_string[] = {
599 [RATE_PER_WHAT] = US"?",
600 [RATE_PER_CLASH] = US"!",
601 [RATE_PER_ADDR] = US"per_addr",
602 [RATE_PER_BYTE] = US"per_byte",
603 [RATE_PER_CMD] = US"per_cmd",
604 [RATE_PER_CONN] = US"per_conn",
605 [RATE_PER_MAIL] = US"per_mail",
606 [RATE_PER_RCPT] = US"per_rcpt",
607 [RATE_PER_ALLRCPTS] = US"per_rcpt"
610 /* Enable recursion between acl_check_internal() and acl_check_condition() */
612 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
616 /*************************************************
617 * Find control in list *
618 *************************************************/
620 /* The lists are always in order, so binary chop can be used.
623 name the control name to search for
624 ol the first entry in the control list
625 last one more than the offset of the last entry in the control list
627 Returns: index of a control entry, or -1 if not found
631 find_control(const uschar * name, control_def * ol, int last)
633 for (int first = 0; last > first; )
635 int middle = (first + last)/2;
636 uschar * s = ol[middle].name;
637 int c = Ustrncmp(name, s, Ustrlen(s));
638 if (c == 0) return middle;
639 else if (c > 0) first = middle + 1;
647 /*************************************************
648 * Pick out condition from list *
649 *************************************************/
651 /* Use a binary chop method
655 list list of conditions
658 Returns: offset in list, or -1 if not found
662 acl_checkcondition(uschar * name, condition_def * list, int end)
664 for (int start = 0; start < end; )
666 int mid = (start + end)/2;
667 int c = Ustrcmp(name, list[mid].name);
668 if (c == 0) return mid;
669 if (c < 0) end = mid;
670 else start = mid + 1;
676 /*************************************************
677 * Pick out name from list *
678 *************************************************/
680 /* Use a binary chop method
687 Returns: offset in list, or -1 if not found
691 acl_checkname(uschar *name, uschar **list, int end)
693 for (int start = 0; start < end; )
695 int mid = (start + end)/2;
696 int c = Ustrcmp(name, list[mid]);
697 if (c == 0) return mid;
698 if (c < 0) end = mid; else start = mid + 1;
705 /*************************************************
706 * Read and parse one ACL *
707 *************************************************/
709 /* This function is called both from readconf in order to parse the ACLs in the
710 configuration file, and also when an ACL is encountered dynamically (e.g. as
711 the result of an expansion). It is given a function to call in order to
712 retrieve the lines of the ACL. This function handles skipping comments and
713 blank lines (where relevant).
716 func function to get next line of ACL
717 error where to put an error message
719 Returns: pointer to ACL, or NULL
720 NULL can be legal (empty ACL); in this case error will be NULL
724 acl_read(uschar *(*func)(void), uschar **error)
726 acl_block *yield = NULL;
727 acl_block **lastp = &yield;
728 acl_block *this = NULL;
729 acl_condition_block *cond;
730 acl_condition_block **condp = NULL;
735 while ((s = (*func)()) != NULL)
738 BOOL negated = FALSE;
739 uschar *saveline = s;
742 /* Conditions (but not verbs) are allowed to be negated by an initial
745 while (isspace(*s)) s++;
752 /* Read the name of a verb or a condition, or the start of a new ACL, which
753 can be started by a name, or by a macro definition. */
755 s = readconf_readname(name, sizeof(name), s);
756 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
758 /* If a verb is unrecognized, it may be another condition or modifier that
759 continues the previous verb. */
761 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
765 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
777 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
780 this = store_get(sizeof(acl_block), FALSE);
782 lastp = &(this->next);
784 this->condition = NULL;
786 this->srcline = config_lineno; /* for debug output */
787 this->srcfile = config_filename; /**/
788 condp = &(this->condition);
789 if (*s == 0) continue; /* No condition on this line */
795 s = readconf_readname(name, sizeof(name), s); /* Condition name */
798 /* Handle a condition or modifier. */
800 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
802 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
807 /* The modifiers may not be negated */
809 if (negated && conditions[c].is_modifier)
811 *error = string_sprintf("ACL error: negation is not allowed with "
812 "\"%s\"", conditions[c].name);
816 /* ENDPASS may occur only with ACCEPT or DISCARD. */
818 if (c == ACLC_ENDPASS &&
819 this->verb != ACL_ACCEPT &&
820 this->verb != ACL_DISCARD)
822 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
823 conditions[c].name, verbs[this->verb]);
827 cond = store_get(sizeof(acl_condition_block), FALSE);
830 cond->u.negated = negated;
833 condp = &(cond->next);
835 /* The "set" modifier is different in that its argument is "name=value"
836 rather than just a value, and we can check the validity of the name, which
837 gives us a variable name to insert into the data block. The original ACL
838 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
839 extended to 20 of each type, but after that people successfully argued for
840 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
841 After that, we allow alphanumerics and underscores, but the first character
842 after c or m must be a digit or an underscore. This retains backwards
847 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
848 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
850 uschar * endptr = s+18;
852 if (isalnum(*endptr))
854 *error = string_sprintf("invalid variable name after \"set\" in ACL "
855 "modifier \"set %s\" "
856 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
860 cond->u.varname = string_copyn(s, 18);
862 while (isspace(*s)) s++;
869 if (Ustrncmp(s, "acl_c", 5) != 0 &&
870 Ustrncmp(s, "acl_m", 5) != 0)
872 *error = string_sprintf("invalid variable name after \"set\" in ACL "
873 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
878 if (!isdigit(*endptr) && *endptr != '_')
880 *error = string_sprintf("invalid variable name after \"set\" in ACL "
881 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
886 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
888 if (!isalnum(*endptr) && *endptr != '_')
890 *error = string_sprintf("invalid character \"%c\" in variable name "
891 "in ACL modifier \"set %s\"", *endptr, s);
897 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
899 while (isspace(*s)) s++;
902 /* For "set", we are now positioned for the data. For the others, only
903 "endpass" has no data */
905 if (c != ACLC_ENDPASS)
909 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
910 conditions[c].is_modifier ? US"modifier" : US"condition");
913 while (isspace(*s)) s++;
914 cond->arg = string_copy(s);
923 /*************************************************
924 * Set up added header line(s) *
925 *************************************************/
927 /* This function is called by the add_header modifier, and also from acl_warn()
928 to implement the now-deprecated way of adding header lines using "message" on a
929 "warn" verb. The argument is treated as a sequence of header lines which are
930 added to a chain, provided there isn't an identical one already there.
932 Argument: string of header lines
937 setup_header(const uschar *hstring)
940 int hlen = Ustrlen(hstring);
942 /* Ignore any leading newlines */
943 while (*hstring == '\n') hstring++, hlen--;
945 /* An empty string does nothing; ensure exactly one final newline. */
946 if (hlen <= 0) return;
947 if (hstring[--hlen] != '\n') /* no newline */
948 q = string_sprintf("%s\n", hstring);
949 else if (hstring[hlen-1] == '\n') /* double newline */
951 uschar * s = string_copy(hstring);
952 while(s[--hlen] == '\n')
959 /* Loop for multiple header lines, taking care about continuations */
961 for (p = q; *p; p = q)
965 int newtype = htype_add_bot;
966 header_line **hptr = &acl_added_headers;
968 /* Find next header line within the string */
972 q = Ustrchr(q, '\n'); /* we know there was a newline */
973 if (*++q != ' ' && *q != '\t') break;
976 /* If the line starts with a colon, interpret the instruction for where to
977 add it. This temporarily sets up a new type. */
981 if (strncmpic(p, US":after_received:", 16) == 0)
983 newtype = htype_add_rec;
986 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
988 newtype = htype_add_rfc;
991 else if (strncmpic(p, US":at_start:", 10) == 0)
993 newtype = htype_add_top;
996 else if (strncmpic(p, US":at_end:", 8) == 0)
998 newtype = htype_add_bot;
1001 while (*p == ' ' || *p == '\t') p++;
1004 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1005 to the front of it. */
1007 for (s = p; s < q - 1; s++)
1008 if (*s == ':' || !isgraph(*s)) break;
1010 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1011 hlen = Ustrlen(hdr);
1013 /* See if this line has already been added */
1017 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1018 hptr = &(*hptr)->next;
1021 /* Add if not previously present */
1025 /* The header_line struct itself is not tainted, though it points to
1027 header_line *h = store_get(sizeof(header_line), FALSE);
1040 /*************************************************
1041 * List the added header lines *
1042 *************************************************/
1048 for (header_line * h = acl_added_headers; h; h = h->next)
1051 if (h->text[i-1] == '\n') i--;
1052 g = string_append_listele_n(g, '\n', h->text, i);
1055 return g ? g->s : NULL;
1059 /*************************************************
1060 * Set up removed header line(s) *
1061 *************************************************/
1063 /* This function is called by the remove_header modifier. The argument is
1064 treated as a sequence of header names which are added to a colon separated
1065 list, provided there isn't an identical one already there.
1067 Argument: string of header names
1072 setup_remove_header(const uschar *hnames)
1075 acl_removed_headers = acl_removed_headers
1076 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1077 : string_copy(hnames);
1082 /*************************************************
1084 *************************************************/
1086 /* This function is called when a WARN verb's conditions are true. It adds to
1087 the message's headers, and/or writes information to the log. In each case, this
1088 only happens once (per message for headers, per connection for log).
1090 ** NOTE: The header adding action using the "message" setting is historic, and
1091 its use is now deprecated. The new add_header modifier should be used instead.
1094 where ACL_WHERE_xxxx indicating which ACL this is
1095 user_message message for adding to headers
1096 log_message message for logging, if different
1102 acl_warn(int where, uschar *user_message, uschar *log_message)
1104 if (log_message != NULL && log_message != user_message)
1107 string_item *logged;
1109 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1110 string_printing(log_message));
1112 /* If a sender verification has failed, and the log message is "sender verify
1113 failed", add the failure message. */
1115 if (sender_verified_failed != NULL &&
1116 sender_verified_failed->message != NULL &&
1117 strcmpic(log_message, US"sender verify failed") == 0)
1118 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1120 /* Search previously logged warnings. They are kept in malloc
1121 store so they can be freed at the start of a new message. */
1123 for (logged = acl_warn_logged; logged; logged = logged->next)
1124 if (Ustrcmp(logged->text, text) == 0) break;
1128 int length = Ustrlen(text) + 1;
1129 log_write(0, LOG_MAIN, "%s", text);
1130 logged = store_malloc(sizeof(string_item) + length);
1131 logged->text = US logged + sizeof(string_item);
1132 memcpy(logged->text, text, length);
1133 logged->next = acl_warn_logged;
1134 acl_warn_logged = logged;
1138 /* If there's no user message, we are done. */
1140 if (!user_message) return;
1142 /* If this isn't a message ACL, we can't do anything with a user message.
1145 if (where > ACL_WHERE_NOTSMTP)
1147 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1148 "found in a non-message (%s) ACL: cannot specify header lines here: "
1149 "message ignored", acl_wherenames[where]);
1153 /* The code for setting up header lines is now abstracted into a separate
1154 function so that it can be used for the add_header modifier as well. */
1156 setup_header(user_message);
1161 /*************************************************
1162 * Verify and check reverse DNS *
1163 *************************************************/
1165 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1166 address if this has not yet been done. The host_name_lookup() function checks
1167 that one of these names resolves to an address list that contains the client IP
1168 address, so we don't actually have to do the check here.
1171 user_msgptr pointer for user message
1172 log_msgptr pointer for log message
1174 Returns: OK verification condition succeeded
1175 FAIL verification failed
1176 DEFER there was a problem verifying
1180 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1184 user_msgptr = user_msgptr; /* stop compiler warning */
1186 /* Previous success */
1188 if (sender_host_name != NULL) return OK;
1190 /* Previous failure */
1192 if (host_lookup_failed)
1194 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1198 /* Need to do a lookup */
1201 debug_printf_indent("looking up host name to force name/address consistency check\n");
1203 if ((rc = host_name_lookup()) != OK)
1205 *log_msgptr = rc == DEFER
1206 ? US"host lookup deferred for reverse lookup check"
1207 : string_sprintf("host lookup failed for reverse lookup check%s",
1209 return rc; /* DEFER or FAIL */
1212 host_build_sender_fullhost();
1218 /*************************************************
1219 * Check client IP address matches CSA target *
1220 *************************************************/
1222 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1223 response for address records belonging to the CSA target hostname. The section
1224 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1225 If one of the addresses matches the client's IP address, then the client is
1226 authorized by CSA. If there are target IP addresses but none of them match
1227 then the client is using an unauthorized IP address. If there are no target IP
1228 addresses then the client cannot be using an authorized IP address. (This is
1229 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1232 dnsa the DNS answer block
1233 dnss a DNS scan block for us to use
1234 reset option specifying what portion to scan, as described above
1235 target the target hostname to use for matching RR names
1237 Returns: CSA_OK successfully authorized
1238 CSA_FAIL_MISMATCH addresses found but none matched
1239 CSA_FAIL_NOADDR no target addresses found
1243 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1246 int rc = CSA_FAIL_NOADDR;
1248 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1250 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1252 /* Check this is an address RR for the target hostname. */
1256 && rr->type != T_AAAA
1260 if (strcmpic(target, rr->name) != 0) continue;
1262 rc = CSA_FAIL_MISMATCH;
1264 /* Turn the target address RR into a list of textual IP addresses and scan
1265 the list. There may be more than one if it is an A6 RR. */
1267 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1269 /* If the client IP address matches the target IP address, it's good! */
1271 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1273 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1277 /* If we found some target addresses but none of them matched, the client is
1278 using an unauthorized IP address, otherwise the target has no authorized IP
1286 /*************************************************
1287 * Verify Client SMTP Authorization *
1288 *************************************************/
1290 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1291 to find the CSA SRV record corresponding to the domain argument, or
1292 $sender_helo_name if no argument is provided. It then checks that the
1293 client is authorized, and that its IP address corresponds to the SRV
1294 target's address by calling acl_verify_csa_address() above. The address
1295 should have been returned in the DNS response's ADDITIONAL section, but if
1296 not we perform another DNS lookup to get it.
1299 domain pointer to optional parameter following verify = csa
1301 Returns: CSA_UNKNOWN no valid CSA record found
1302 CSA_OK successfully authorized
1303 CSA_FAIL_* client is definitely not authorized
1304 CSA_DEFER_* there was a DNS problem
1308 acl_verify_csa(const uschar *domain)
1311 const uschar *found;
1312 int priority, weight, port;
1319 /* Work out the domain we are using for the CSA lookup. The default is the
1320 client's HELO domain. If the client has not said HELO, use its IP address
1321 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1323 while (isspace(*domain) && *domain != '\0') ++domain;
1324 if (*domain == '\0') domain = sender_helo_name;
1325 if (domain == NULL) domain = sender_host_address;
1326 if (sender_host_address == NULL) return CSA_UNKNOWN;
1328 /* If we have an address literal, strip off the framing ready for turning it
1329 into a domain. The framing consists of matched square brackets possibly
1330 containing a keyword and a colon before the actual IP address. */
1332 if (domain[0] == '[')
1334 const uschar *start = Ustrchr(domain, ':');
1335 if (start == NULL) start = domain;
1336 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1339 /* Turn domains that look like bare IP addresses into domains in the reverse
1340 DNS. This code also deals with address literals and $sender_host_address. It's
1341 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1342 address literals, but it's probably the most friendly thing to do. This is an
1343 extension to CSA, so we allow it to be turned off for proper conformance. */
1345 if (string_is_ip_address(domain, NULL) != 0)
1347 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1348 dns_build_reverse(domain, target);
1352 /* Find out if we've already done the CSA check for this domain. If we have,
1353 return the same result again. Otherwise build a new cached result structure
1354 for this domain. The name is filled in now, and the value is filled in when
1355 we return from this function. */
1357 t = tree_search(csa_cache, domain);
1358 if (t != NULL) return t->data.val;
1360 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
1361 Ustrcpy(t->name, domain);
1362 (void)tree_insertnode(&csa_cache, t);
1364 /* Now we are ready to do the actual DNS lookup(s). */
1367 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1369 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1372 return t->data.val = CSA_DEFER_SRV;
1374 /* If we found nothing, the client's authorization is unknown. */
1378 return t->data.val = CSA_UNKNOWN;
1380 /* We got something! Go on to look at the reply in more detail. */
1386 /* Scan the reply for well-formed CSA SRV records. */
1388 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1390 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1392 const uschar * p = rr->data;
1394 /* Extract the numerical SRV fields (p is incremented) */
1396 GETSHORT(priority, p);
1397 GETSHORT(weight, p);
1401 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1403 /* Check the CSA version number */
1405 if (priority != 1) continue;
1407 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1408 found by dns_special_lookup() is a parent of the one we asked for), we check
1409 the subdomain assertions in the port field. At the moment there's only one
1410 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1411 SRV records of their own. */
1413 if (Ustrcmp(found, domain) != 0)
1414 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1416 /* This CSA SRV record refers directly to our domain, so we check the value
1417 in the weight field to work out the domain's authorization. 0 and 1 are
1418 unauthorized; 3 means the client is authorized but we can't check the IP
1419 address in order to authenticate it, so we treat it as unknown; values
1420 greater than 3 are undefined. */
1422 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1424 if (weight > 2) continue;
1426 /* Weight == 2, which means the domain is authorized. We must check that the
1427 client's IP address is listed as one of the SRV target addresses. Save the
1428 target hostname then break to scan the additional data for its addresses. */
1430 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1431 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1433 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1438 /* If we didn't break the loop then no appropriate records were found. */
1440 if (!rr) return t->data.val = CSA_UNKNOWN;
1442 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1443 A target of "." indicates there are no valid addresses, so the client cannot
1444 be authorized. (This is an odd configuration because weight=2 target=. is
1445 equivalent to weight=1, but we check for it in order to keep load off the
1446 root name servers.) Note that dn_expand() turns "." into "". */
1448 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1450 /* Scan the additional section of the CSA SRV reply for addresses belonging
1451 to the target. If the name server didn't return any additional data (e.g.
1452 because it does not fully support SRV records), we need to do another lookup
1453 to obtain the target addresses; otherwise we have a definitive result. */
1455 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1456 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1458 /* The DNS lookup type corresponds to the IP version used by the client. */
1461 if (Ustrchr(sender_host_address, ':') != NULL)
1464 #endif /* HAVE_IPV6 */
1468 lookup_dnssec_authenticated = NULL;
1469 switch (dns_lookup(&dnsa, target, type, NULL))
1471 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1474 return t->data.val = CSA_DEFER_ADDR;
1476 /* If the query succeeded, scan the addresses and return the result. */
1479 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1480 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1481 /* else fall through */
1483 /* If the target has no IP addresses, the client cannot have an authorized
1484 IP address. However, if the target site uses A6 records (not AAAA records)
1485 we have to do yet another lookup in order to check them. */
1489 return t->data.val = CSA_FAIL_NOADDR;
1495 /*************************************************
1496 * Handle verification (address & other) *
1497 *************************************************/
1499 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1500 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1501 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1506 unsigned where_allowed; /* bitmap */
1507 BOOL no_options; /* Never has /option(s) following */
1508 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1510 static verify_type_t verify_type_list[] = {
1511 /* name value where no-opt opt-sep */
1512 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, ~0, FALSE, 0 },
1513 { US"certificate", VERIFY_CERT, ~0, TRUE, 0 },
1514 { US"helo", VERIFY_HELO, ~0, TRUE, 0 },
1515 { US"csa", VERIFY_CSA, ~0, FALSE, 0 },
1516 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1517 { US"not_blind", VERIFY_NOT_BLIND, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1518 { US"header_sender", VERIFY_HDR_SNDR, ACL_BIT_DATA | ACL_BIT_NOTSMTP, FALSE, 0 },
1519 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1520 |ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1522 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1523 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BIT_DATA | ACL_BIT_NOTSMTP, TRUE, 0 },
1524 #ifdef EXPERIMENTAL_ARC
1525 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1530 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1531 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1532 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1533 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1539 BOOL has_option; /* Has =option(s) following */
1540 BOOL timeval; /* Has a time value */
1542 static callout_opt_t callout_opt_list[] = {
1543 /* name value flag has-opt has-time */
1544 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1545 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1546 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1547 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1548 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1549 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1550 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1551 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1552 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1553 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1554 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1555 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1556 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1561 /* This function implements the "verify" condition. It is called when
1562 encountered in any ACL, because some tests are almost always permitted. Some
1563 just don't make sense, and always fail (for example, an attempt to test a host
1564 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1567 where where called from
1568 addr the recipient address that the ACL is handling, or NULL
1569 arg the argument of "verify"
1570 user_msgptr pointer for user message
1571 log_msgptr pointer for log message
1572 basic_errno where to put verify errno
1574 Returns: OK verification condition succeeded
1575 FAIL verification failed
1576 DEFER there was a problem verifying
1581 acl_verify(int where, address_item *addr, const uschar *arg,
1582 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1586 int callout_overall = -1;
1587 int callout_connect = -1;
1588 int verify_options = 0;
1590 BOOL verify_header_sender = FALSE;
1591 BOOL defer_ok = FALSE;
1592 BOOL callout_defer_ok = FALSE;
1593 BOOL no_details = FALSE;
1594 BOOL success_on_redirect = FALSE;
1595 address_item *sender_vaddr = NULL;
1596 uschar *verify_sender_address = NULL;
1597 uschar *pm_mailfrom = NULL;
1598 uschar *se_mailfrom = NULL;
1600 /* Some of the verify items have slash-separated options; some do not. Diagnose
1601 an error if options are given for items that don't expect them.
1604 uschar *slash = Ustrchr(arg, '/');
1605 const uschar *list = arg;
1606 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1609 if (!ss) goto BAD_VERIFY;
1611 /* Handle name/address consistency verification in a separate function. */
1613 for (vp = verify_type_list;
1614 CS vp < CS verify_type_list + sizeof(verify_type_list);
1617 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1618 : strcmpic (ss, vp->name) == 0)
1620 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1623 if (vp->no_options && slash)
1625 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1626 "(this verify item has no options)", arg);
1629 if (!(vp->where_allowed & BIT(where)))
1631 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1632 vp->name, acl_wherenames[where]);
1637 case VERIFY_REV_HOST_LKUP:
1638 if (!sender_host_address) return OK;
1639 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1640 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1641 if (strcmpic(ss, US"defer_ok") == 0)
1646 /* TLS certificate verification is done at STARTTLS time; here we just
1647 test whether it was successful or not. (This is for optional verification; for
1648 mandatory verification, the connection doesn't last this long.) */
1650 if (tls_in.certificate_verified) return OK;
1651 *user_msgptr = US"no verified certificate";
1655 /* We can test the result of optional HELO verification that might have
1656 occurred earlier. If not, we can attempt the verification now. */
1658 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1659 return f.helo_verified ? OK : FAIL;
1662 /* Do Client SMTP Authorization checks in a separate function, and turn the
1663 result code into user-friendly strings. */
1665 rc = acl_verify_csa(list);
1666 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1667 csa_reason_string[rc]);
1668 csa_status = csa_status_string[rc];
1669 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1670 return csa_return_code[rc];
1672 #ifdef EXPERIMENTAL_ARC
1674 { /* Do Authenticated Received Chain checks in a separate function. */
1675 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1679 if (!(arc_state = acl_verify_arc())) return DEFER;
1680 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1681 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1683 if (!condlist) condlist = US"none:pass";
1684 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1685 if (Ustrcmp(arc_state, cond) == 0) return OK;
1690 case VERIFY_HDR_SYNTAX:
1691 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1692 a syntax error, we return details of the error to the sender if configured to
1693 send out full details. (But a "message" setting on the ACL can override, as
1696 rc = verify_check_headers(log_msgptr);
1697 if (rc != OK && *log_msgptr)
1698 if (smtp_return_error_details)
1699 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1701 acl_verify_message = *log_msgptr;
1704 case VERIFY_HDR_NAMES_ASCII:
1705 /* Check that all header names are true 7 bit strings
1706 See RFC 5322, 2.2. and RFC 6532, 3. */
1708 rc = verify_check_header_names_ascii(log_msgptr);
1709 if (rc != OK && smtp_return_error_details && *log_msgptr)
1710 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1713 case VERIFY_NOT_BLIND:
1714 /* Check that no recipient of this message is "blind", that is, every envelope
1715 recipient must be mentioned in either To: or Cc:. */
1717 BOOL case_sensitive = TRUE;
1719 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1720 if (strcmpic(ss, US"case_insensitive") == 0)
1721 case_sensitive = FALSE;
1724 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1725 "condition \"verify %s\"", ss, arg);
1729 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1731 *log_msgptr = US"bcc recipient detected";
1732 if (smtp_return_error_details)
1733 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1738 /* The remaining verification tests check recipient and sender addresses,
1739 either from the envelope or from the header. There are a number of
1740 slash-separated options that are common to all of them. */
1742 case VERIFY_HDR_SNDR:
1743 verify_header_sender = TRUE;
1747 /* In the case of a sender, this can optionally be followed by an address to use
1748 in place of the actual sender (rare special-case requirement). */
1752 verify_sender_address = sender_address;
1755 while (isspace(*s)) s++;
1756 if (*s++ != '=') goto BAD_VERIFY;
1757 while (isspace(*s)) s++;
1758 verify_sender_address = string_copy(s);
1769 /* Remaining items are optional; they apply to sender and recipient
1770 verification, including "header sender" verification. */
1772 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
1774 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1775 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1776 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1778 /* These two old options are left for backwards compatibility */
1780 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1782 callout_defer_ok = TRUE;
1783 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1786 else if (strcmpic(ss, US"check_postmaster") == 0)
1789 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1792 /* The callout option has a number of sub-options, comma separated */
1794 else if (strncmpic(ss, US"callout", 7) == 0)
1796 callout = CALLOUT_TIMEOUT_DEFAULT;
1800 while (isspace(*ss)) ss++;
1803 const uschar * sublist = ss;
1808 while (isspace(*sublist)) sublist++;
1809 while ((opt = string_nextinlist(&sublist, &optsep, buffer, sizeof(buffer))))
1812 double period = 1.0F;
1814 for (op= callout_opt_list; op->name; op++)
1815 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1818 verify_options |= op->flag;
1821 opt += Ustrlen(op->name);
1822 while (isspace(*opt)) opt++;
1825 *log_msgptr = string_sprintf("'=' expected after "
1826 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1829 while (isspace(*opt)) opt++;
1831 if (op->timeval && (period = readconf_readtime(opt, 0, FALSE)) < 0)
1833 *log_msgptr = string_sprintf("bad time value in ACL condition "
1834 "\"verify %s\"", arg);
1840 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1841 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1842 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1843 case CALLOUT_MAILFROM:
1844 if (!verify_header_sender)
1846 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1847 "callout option only for verify=header_sender (detected in ACL "
1848 "condition \"%s\")", arg);
1851 se_mailfrom = string_copy(opt);
1853 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1854 case CALLOUT_MAXWAIT: callout_overall = period; break;
1855 case CALLOUT_CONNECT: callout_connect = period; break;
1856 case CALLOUT_TIME: callout = period; break;
1862 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1863 "ACL condition \"%s\"", arg);
1869 /* Option not recognized */
1873 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1874 "condition \"verify %s\"", ss, arg);
1879 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1880 (vopt_callout_recipsender|vopt_callout_recippmaster))
1882 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1883 "for a recipient callout";
1887 /* Handle sender-in-header verification. Default the user message to the log
1888 message if giving out verification details. */
1890 if (verify_header_sender)
1894 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1895 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1898 *basic_errno = verrno;
1899 if (smtp_return_error_details)
1901 if (!*user_msgptr && *log_msgptr)
1902 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1903 if (rc == DEFER) f.acl_temp_details = TRUE;
1908 /* Handle a sender address. The default is to verify *the* sender address, but
1909 optionally a different address can be given, for special requirements. If the
1910 address is empty, we are dealing with a bounce message that has no sender, so
1911 we cannot do any checking. If the real sender address gets rewritten during
1912 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1913 during message reception.
1915 A list of verified "sender" addresses is kept to try to avoid doing to much
1916 work repetitively when there are multiple recipients in a message and they all
1917 require sender verification. However, when callouts are involved, it gets too
1918 complicated because different recipients may require different callout options.
1919 Therefore, we always do a full sender verify when any kind of callout is
1920 specified. Caching elsewhere, for instance in the DNS resolver and in the
1921 callout handling, should ensure that this is not terribly inefficient. */
1923 else if (verify_sender_address)
1925 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1927 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1928 "sender verify callout";
1932 sender_vaddr = verify_checked_sender(verify_sender_address);
1933 if (sender_vaddr != NULL && /* Previously checked */
1934 callout <= 0) /* No callout needed this time */
1936 /* If the "routed" flag is set, it means that routing worked before, so
1937 this check can give OK (the saved return code value, if set, belongs to a
1938 callout that was done previously). If the "routed" flag is not set, routing
1939 must have failed, so we use the saved return code. */
1941 if (testflag(sender_vaddr, af_verify_routed))
1945 rc = sender_vaddr->special_action;
1946 *basic_errno = sender_vaddr->basic_errno;
1948 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
1951 /* Do a new verification, and cache the result. The cache is used to avoid
1952 verifying the sender multiple times for multiple RCPTs when callouts are not
1953 specified (see comments above).
1955 The cache is also used on failure to give details in response to the first
1956 RCPT that gets bounced for this reason. However, this can be suppressed by
1957 the no_details option, which sets the flag that says "this detail has already
1958 been sent". The cache normally contains just one address, but there may be
1959 more in esoteric circumstances. */
1964 uschar *save_address_data = deliver_address_data;
1966 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1968 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
1970 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
1971 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
1974 if (no_details) setflag(sender_vaddr, af_sverify_told);
1975 if (verify_sender_address[0] != 0)
1977 /* If this is the real sender address, save the unrewritten version
1978 for use later in receive. Otherwise, set a flag so that rewriting the
1979 sender in verify_address() does not update sender_address. */
1981 if (verify_sender_address == sender_address)
1982 sender_address_unrewritten = sender_address;
1984 verify_options |= vopt_fake_sender;
1986 if (success_on_redirect)
1987 verify_options |= vopt_success_on_redirect;
1989 /* The recipient, qualify, and expn options are never set in
1992 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1993 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1995 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
1998 *basic_errno = sender_vaddr->basic_errno;
2002 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2003 debug_printf_indent("sender %s verified ok as %s\n",
2004 verify_sender_address, sender_vaddr->address);
2006 debug_printf_indent("sender %s verified ok\n",
2007 verify_sender_address);
2011 rc = OK; /* Null sender */
2013 /* Cache the result code */
2015 if (routed) setflag(sender_vaddr, af_verify_routed);
2016 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2017 sender_vaddr->special_action = rc;
2018 sender_vaddr->next = sender_verified_list;
2019 sender_verified_list = sender_vaddr;
2021 /* Restore the recipient address data, which might have been clobbered by
2022 the sender verification. */
2024 deliver_address_data = save_address_data;
2027 /* Put the sender address_data value into $sender_address_data */
2029 sender_address_data = sender_vaddr->prop.address_data;
2032 /* A recipient address just gets a straightforward verify; again we must handle
2033 the DEFER overrides. */
2039 if (success_on_redirect)
2040 verify_options |= vopt_success_on_redirect;
2042 /* We must use a copy of the address for verification, because it might
2046 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2047 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2048 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2050 *basic_errno = addr2.basic_errno;
2051 *log_msgptr = addr2.message;
2052 *user_msgptr = (addr2.user_message != NULL)?
2053 addr2.user_message : addr2.message;
2055 /* Allow details for temporary error if the address is so flagged. */
2056 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2058 /* Make $address_data visible */
2059 deliver_address_data = addr2.prop.address_data;
2062 /* We have a result from the relevant test. Handle defer overrides first. */
2064 if (rc == DEFER && (defer_ok ||
2065 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
2067 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2068 defer_ok? "defer_ok" : "callout_defer_ok");
2072 /* If we've failed a sender, set up a recipient message, and point
2073 sender_verified_failed to the address item that actually failed. */
2075 if (rc != OK && verify_sender_address != NULL)
2078 *log_msgptr = *user_msgptr = US"Sender verify failed";
2079 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2080 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2083 *log_msgptr = US"Could not complete sender verify callout";
2084 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2088 sender_verified_failed = sender_vaddr;
2091 /* Verifying an address messes up the values of $domain and $local_part,
2092 so reset them before returning if this is a RCPT ACL. */
2096 deliver_domain = addr->domain;
2097 deliver_localpart = addr->local_part;
2101 /* Syntax errors in the verify argument come here. */
2104 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2105 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2106 "or \"reverse_host_lookup\" at start of ACL condition "
2107 "\"verify %s\"", arg);
2114 /*************************************************
2115 * Check argument for control= modifier *
2116 *************************************************/
2118 /* Called from acl_check_condition() below
2121 arg the argument string for control=
2122 pptr set to point to the terminating character
2123 where which ACL we are in
2124 log_msgptr for error messages
2126 Returns: CONTROL_xxx value
2130 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2135 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2136 || ( arg[len = Ustrlen((d = controls_list+idx)->name)] != 0
2137 && (!d->has_option || arg[len] != '/')
2140 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2141 return CONTROL_ERROR;
2151 /*************************************************
2152 * Return a ratelimit error *
2153 *************************************************/
2155 /* Called from acl_ratelimit() below
2158 log_msgptr for error messages
2159 format format string
2160 ... supplementary arguments
2166 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2170 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2172 va_start(ap, format);
2173 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2176 gstring_release_unused(g);
2177 *log_msgptr = string_from_gstring(g);
2184 /*************************************************
2185 * Handle rate limiting *
2186 *************************************************/
2188 /* Called by acl_check_condition() below to calculate the result
2189 of the ACL ratelimit condition.
2191 Note that the return value might be slightly unexpected: if the
2192 sender's rate is above the limit then the result is OK. This is
2193 similar to the dnslists condition, and is so that you can write
2194 ACL clauses like: defer ratelimit = 15 / 1h
2197 arg the option string for ratelimit=
2198 where ACL_WHERE_xxxx indicating which ACL this is
2199 log_msgptr for error messages
2201 Returns: OK - Sender's rate is above limit
2202 FAIL - Sender's rate is below limit
2203 DEFER - Problem opening ratelimit database
2204 ERROR - Syntax error in options.
2208 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2210 double limit, period, count;
2213 uschar *unique = NULL;
2215 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2216 BOOL noupdate = FALSE, badacl = FALSE;
2217 int mode = RATE_PER_WHAT;
2219 tree_node **anchor, *t;
2220 open_db dbblock, *dbm;
2222 dbdata_ratelimit *dbd;
2223 dbdata_ratelimit_unique *dbdb;
2226 /* Parse the first two options and record their values in expansion
2227 variables. These variables allow the configuration to have informative
2228 error messages based on rate limits obtained from a table lookup. */
2230 /* First is the maximum number of messages per period / maximum burst
2231 size, which must be greater than or equal to zero. Zero is useful for
2232 rate measurement as opposed to rate limiting. */
2234 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2235 return ratelimit_error(log_msgptr, "sender rate limit not set");
2237 limit = Ustrtod(sender_rate_limit, &ss);
2238 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2239 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2240 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2242 if (limit < 0.0 || *ss != '\0')
2243 return ratelimit_error(log_msgptr,
2244 "\"%s\" is not a positive number", sender_rate_limit);
2246 /* Second is the rate measurement period / exponential smoothing time
2247 constant. This must be strictly greater than zero, because zero leads to
2248 run-time division errors. */
2250 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2251 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2253 return ratelimit_error(log_msgptr,
2254 "\"%s\" is not a time value", sender_rate_period);
2256 /* By default we are counting one of something, but the per_rcpt,
2257 per_byte, and count options can change this. */
2261 /* Parse the other options. */
2263 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size)))
2265 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2266 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2267 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2268 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2269 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2270 else if (strcmpic(ss, US"per_conn") == 0)
2272 RATE_SET(mode, PER_CONN);
2273 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2276 else if (strcmpic(ss, US"per_mail") == 0)
2278 RATE_SET(mode, PER_MAIL);
2279 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2281 else if (strcmpic(ss, US"per_rcpt") == 0)
2283 /* If we are running in the RCPT ACL, then we'll count the recipients
2284 one by one, but if we are running when we have accumulated the whole
2285 list then we'll add them all in one batch. */
2286 if (where == ACL_WHERE_RCPT)
2287 RATE_SET(mode, PER_RCPT);
2288 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2289 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2290 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2291 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2293 else if (strcmpic(ss, US"per_byte") == 0)
2295 /* If we have not yet received the message data and there was no SIZE
2296 declaration on the MAIL command, then it's safe to just use a value of
2297 zero and let the recorded rate decay as if nothing happened. */
2298 RATE_SET(mode, PER_MAIL);
2299 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2300 else count = message_size < 0 ? 0.0 : (double)message_size;
2302 else if (strcmpic(ss, US"per_addr") == 0)
2304 RATE_SET(mode, PER_RCPT);
2305 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2306 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2308 else if (strncmpic(ss, US"count=", 6) == 0)
2311 count = Ustrtod(ss+6, &e);
2312 if (count < 0.0 || *e != '\0')
2313 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2315 else if (strncmpic(ss, US"unique=", 7) == 0)
2316 unique = string_copy(ss + 7);
2318 key = string_copy(ss);
2320 key = string_sprintf("%s/%s", key, ss);
2323 /* Sanity check. When the badacl flag is set the update mode must either
2324 be readonly (which is the default if it is omitted) or, for backwards
2325 compatibility, a combination of noupdate and strict or leaky. */
2327 if (mode == RATE_PER_CLASH)
2328 return ratelimit_error(log_msgptr, "conflicting per_* options");
2329 if (leaky + strict + readonly > 1)
2330 return ratelimit_error(log_msgptr, "conflicting update modes");
2331 if (badacl && (leaky || strict) && !noupdate)
2332 return ratelimit_error(log_msgptr,
2333 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2334 ratelimit_option_string[mode], acl_wherenames[where]);
2336 /* Set the default values of any unset options. In readonly mode we
2337 perform the rate computation without any increment so that its value
2338 decays to eventually allow over-limit senders through. */
2340 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2341 if (badacl) readonly = TRUE;
2342 if (readonly) count = 0.0;
2343 if (!strict && !readonly) leaky = TRUE;
2344 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2346 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2347 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2348 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2349 are added to the key because they alter the meaning of the stored data. */
2352 key = !sender_host_address ? US"" : sender_host_address;
2354 key = string_sprintf("%s/%s/%s%s",
2356 ratelimit_option_string[mode],
2357 unique == NULL ? "" : "unique/",
2361 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2363 /* See if we have already computed the rate by looking in the relevant tree.
2364 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2365 pool so that they survive across resets. In readonly mode we only remember the
2366 result for the rest of this command in case a later command changes it. After
2367 this bit of logic the code is independent of the per_* mode. */
2369 old_pool = store_pool;
2372 anchor = &ratelimiters_cmd;
2376 anchor = &ratelimiters_conn;
2377 store_pool = POOL_PERM;
2381 case RATE_PER_ALLRCPTS:
2382 anchor = &ratelimiters_mail;
2387 anchor = &ratelimiters_cmd;
2390 anchor = NULL; /* silence an "unused" complaint */
2391 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2392 "internal ACL error: unknown ratelimit mode %d", mode);
2396 if ((t = tree_search(*anchor, key)))
2399 /* The following few lines duplicate some of the code below. */
2400 rc = (dbd->rate < limit)? FAIL : OK;
2401 store_pool = old_pool;
2402 sender_rate = string_sprintf("%.1f", dbd->rate);
2404 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2408 /* We aren't using a pre-computed rate, so get a previously recorded rate
2409 from the database, which will be updated and written back if required. */
2411 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2413 store_pool = old_pool;
2415 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2416 *log_msgptr = US"ratelimit database not available";
2419 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2422 gettimeofday(&tv, NULL);
2426 /* Locate the basic ratelimit block inside the DB data. */
2427 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2430 /* Forget the old Bloom filter if it is too old, so that we count each
2431 repeating event once per period. We don't simply clear and re-use the old
2432 filter because we want its size to change if the limit changes. Note that
2433 we keep the dbd pointer for copying the rate into the new data block. */
2435 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2437 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2443 if(unique && dbdb_size < sizeof(*dbdb))
2445 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2450 /* Allocate a new data block if the database lookup failed
2451 or the Bloom filter passed its age limit. */
2457 /* No Bloom filter. This basic ratelimit block is initialized below. */
2458 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2459 dbdb_size = sizeof(*dbd);
2460 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2465 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2467 /* See the long comment below for an explanation of the magic number 2.
2468 The filter has a minimum size in case the rate limit is very small;
2469 this is determined by the definition of dbdata_ratelimit_unique. */
2471 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2472 if (extra < 0) extra = 0;
2473 dbdb_size = sizeof(*dbdb) + extra;
2474 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2475 dbdb->bloom_epoch = tv.tv_sec;
2476 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2477 memset(dbdb->bloom, 0, dbdb->bloom_size);
2479 /* Preserve any basic ratelimit data (which is our longer-term memory)
2480 by copying it from the discarded block. */
2490 /* If we are counting unique events, find out if this event is new or not.
2491 If the client repeats the event during the current period then it should be
2492 counted. We skip this code in readonly mode for efficiency, because any
2493 changes to the filter will be discarded and because count is already set to
2496 if (unique && !readonly)
2498 /* We identify unique events using a Bloom filter. (You can find my
2499 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2500 With the per_addr option, an "event" is a recipient address, though the
2501 user can use the unique option to define their own events. We only count
2502 an event if we have not seen it before.
2504 We size the filter according to the rate limit, which (in leaky mode)
2505 is the limit on the population of the filter. We allow 16 bits of space
2506 per entry (see the construction code above) and we set (up to) 8 of them
2507 when inserting an element (see the loop below). The probability of a false
2508 positive (an event we have not seen before but which we fail to count) is
2512 allzero = exp(-numhash * pop / size)
2513 = exp(-0.5 * pop / limit)
2514 fpr = pow(1 - allzero, numhash)
2516 For senders at the limit the fpr is 0.06% or 1 in 1700
2517 and for senders at half the limit it is 0.0006% or 1 in 170000
2519 In strict mode the Bloom filter can fill up beyond the normal limit, in
2520 which case the false positive rate will rise. This means that the
2521 measured rate for very fast senders can bogusly drop off after a while.
2523 At twice the limit, the fpr is 2.5% or 1 in 40
2524 At four times the limit, it is 31% or 1 in 3.2
2526 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2527 decay below the limit, and if this is more than one then the Bloom filter
2528 will be discarded before the decay gets that far. The false positive rate
2529 at this threshold is 9.3% or 1 in 10.7. */
2532 unsigned n, hash, hinc;
2536 /* Instead of using eight independent hash values, we combine two values
2537 using the formula h1 + n * h2. This does not harm the Bloom filter's
2538 performance, and means the amount of hash we need is independent of the
2539 number of bits we set in the filter. */
2541 md5_start(&md5info);
2542 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2543 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2544 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2546 /* Scan the bits corresponding to this event. A zero bit means we have
2547 not seen it before. Ensure all bits are set to record this event. */
2549 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2552 for (n = 0; n < 8; n++, hash += hinc)
2554 int bit = 1 << (hash % 8);
2555 int byte = (hash / 8) % dbdb->bloom_size;
2556 if ((dbdb->bloom[byte] & bit) == 0)
2558 dbdb->bloom[byte] |= bit;
2563 /* If this event has occurred before, do not count it. */
2567 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2571 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2574 /* If there was no previous ratelimit data block for this key, initialize
2575 the new one, otherwise update the block from the database. The initial rate
2576 is what would be computed by the code below for an infinite interval. */
2580 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2582 dbd->time_stamp = tv.tv_sec;
2583 dbd->time_usec = tv.tv_usec;
2588 /* The smoothed rate is computed using an exponentially weighted moving
2589 average adjusted for variable sampling intervals. The standard EWMA for
2590 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2591 where f() is the measured value and f'() is the smoothed value.
2593 Old data decays out of the smoothed value exponentially, such that data n
2594 samples old is multiplied by a^n. The exponential decay time constant p
2595 is defined such that data p samples old is multiplied by 1/e, which means
2596 that a = exp(-1/p). We can maintain the same time constant for a variable
2597 sampling interval i by using a = exp(-i/p).
2599 The rate we are measuring is messages per period, suitable for directly
2600 comparing with the limit. The average rate between now and the previous
2601 message is period / interval, which we feed into the EWMA as the sample.
2603 It turns out that the number of messages required for the smoothed rate
2604 to reach the limit when they are sent in a burst is equal to the limit.
2605 This can be seen by analysing the value of the smoothed rate after N
2606 messages sent at even intervals. Let k = (1 - a) * p/i
2608 rate_1 = (1 - a) * p/i + a * rate_0
2610 rate_2 = k + a * rate_1
2611 = k + a * k + a^2 * rate_0
2612 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2613 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2614 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2615 = rate_0 * a^N + p/i * (1 - a^N)
2617 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2619 rate_N = p/i + (rate_0 - p/i) * a^N
2620 a^N = (rate_N - p/i) / (rate_0 - p/i)
2621 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2622 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2624 Numerical analysis of the above equation, setting the computed rate to
2625 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2626 rates, p/i, the number of messages N = limit. So limit serves as both the
2627 maximum rate measured in messages per period, and the maximum number of
2628 messages that can be sent in a fast burst. */
2630 double this_time = (double)tv.tv_sec
2631 + (double)tv.tv_usec / 1000000.0;
2632 double prev_time = (double)dbd->time_stamp
2633 + (double)dbd->time_usec / 1000000.0;
2635 /* We must avoid division by zero, and deal gracefully with the clock going
2636 backwards. If we blunder ahead when time is in reverse then the computed
2637 rate will be bogus. To be safe we clamp interval to a very small number. */
2639 double interval = this_time - prev_time <= 0.0 ? 1e-9
2640 : this_time - prev_time;
2642 double i_over_p = interval / period;
2643 double a = exp(-i_over_p);
2645 /* Combine the instantaneous rate (period / interval) with the previous rate
2646 using the smoothing factor a. In order to measure sized events, multiply the
2647 instantaneous rate by the count of bytes or recipients etc. */
2649 dbd->time_stamp = tv.tv_sec;
2650 dbd->time_usec = tv.tv_usec;
2651 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2653 /* When events are very widely spaced the computed rate tends towards zero.
2654 Although this is accurate it turns out not to be useful for our purposes,
2655 especially when the first event after a long silence is the start of a spam
2656 run. A more useful model is that the rate for an isolated event should be the
2657 size of the event per the period size, ignoring the lack of events outside
2658 the current period and regardless of where the event falls in the period. So,
2659 if the interval was so long that the calculated rate is unhelpfully small, we
2660 re-initialize the rate. In the absence of higher-rate bursts, the condition
2661 below is true if the interval is greater than the period. */
2663 if (dbd->rate < count) dbd->rate = count;
2666 /* Clients sending at the limit are considered to be over the limit.
2667 This matters for edge cases such as a limit of zero, when the client
2668 should be completely blocked. */
2670 rc = dbd->rate < limit ? FAIL : OK;
2672 /* Update the state if the rate is low or if we are being strict. If we
2673 are in leaky mode and the sender's rate is too high, we do not update
2674 the recorded rate in order to avoid an over-aggressive sender's retry
2675 rate preventing them from getting any email through. If readonly is set,
2676 neither leaky nor strict are set, so we do not do any updates. */
2678 if ((rc == FAIL && leaky) || strict)
2680 dbfn_write(dbm, key, dbdb, dbdb_size);
2681 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2685 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2686 readonly? "readonly mode" : "over the limit, but leaky");
2691 /* Store the result in the tree for future reference. Take the taint status
2692 from the key for consistency even though it's unlikely we'll ever expand this. */
2694 t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
2696 Ustrcpy(t->name, key);
2697 (void)tree_insertnode(anchor, t);
2699 /* We create the formatted version of the sender's rate very late in
2700 order to ensure that it is done using the correct storage pool. */
2702 store_pool = old_pool;
2703 sender_rate = string_sprintf("%.1f", dbd->rate);
2706 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2713 /*************************************************
2714 * The udpsend ACL modifier *
2715 *************************************************/
2717 /* Called by acl_check_condition() below.
2720 arg the option string for udpsend=
2721 log_msgptr for error messages
2723 Returns: OK - Completed.
2724 DEFER - Problem with DNS lookup.
2725 ERROR - Syntax error in options.
2729 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2741 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2742 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2746 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2751 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2756 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2759 portnum = Ustrtol(portstr, &portend, 10);
2760 if (*portend != '\0')
2762 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2766 /* Make a single-item host list. */
2767 h = store_get(sizeof(host_item), FALSE);
2768 memset(h, 0, sizeof(host_item));
2773 if (string_is_ip_address(hostname, NULL))
2774 h->address = hostname, r = HOST_FOUND;
2776 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2777 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2779 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2784 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2786 /*XXX this could better use sendto */
2787 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2788 1, NULL, &errstr, NULL);
2789 if (r < 0) goto defer;
2791 r = send(s, arg, len, 0);
2794 errstr = US strerror(errno);
2802 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2807 debug_printf_indent("udpsend %d bytes\n", r);
2812 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2818 /*************************************************
2819 * Handle conditions/modifiers on an ACL item *
2820 *************************************************/
2822 /* Called from acl_check() below.
2826 cb ACL condition block - if NULL, result is OK
2827 where where called from
2828 addr the address being checked for RCPT, or NULL
2829 level the nesting level
2830 epp pointer to pass back TRUE if "endpass" encountered
2831 (applies only to "accept" and "discard")
2832 user_msgptr user message pointer
2833 log_msgptr log message pointer
2834 basic_errno pointer to where to put verify error
2836 Returns: OK - all conditions are met
2837 DISCARD - an "acl" condition returned DISCARD - only allowed
2838 for "accept" or "discard" verbs
2839 FAIL - at least one condition fails
2840 FAIL_DROP - an "acl" condition returned FAIL_DROP
2841 DEFER - can't tell at the moment (typically, lookup defer,
2842 but can be temporary callout problem)
2843 ERROR - ERROR from nested ACL or expansion failure or other
2848 acl_check_condition(int verb, acl_condition_block *cb, int where,
2849 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2850 uschar **log_msgptr, int *basic_errno)
2852 uschar *user_message = NULL;
2853 uschar *log_message = NULL;
2855 #ifdef WITH_CONTENT_SCAN
2859 for (; cb; cb = cb->next)
2864 /* The message and log_message items set up messages to be used in
2865 case of rejection. They are expanded later. */
2867 if (cb->type == ACLC_MESSAGE)
2869 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2870 user_message = cb->arg;
2874 if (cb->type == ACLC_LOG_MESSAGE)
2876 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2877 log_message = cb->arg;
2881 /* The endpass "condition" just sets a flag to show it occurred. This is
2882 checked at compile time to be on an "accept" or "discard" item. */
2884 if (cb->type == ACLC_ENDPASS)
2890 /* For other conditions and modifiers, the argument is expanded now for some
2891 of them, but not for all, because expansion happens down in some lower level
2892 checking functions in some cases. */
2894 if (!conditions[cb->type].expand_at_top)
2896 else if (!(arg = expand_string(cb->arg)))
2898 if (f.expand_string_forcedfail) continue;
2899 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2900 cb->arg, expand_string_message);
2901 return f.search_find_defer ? DEFER : ERROR;
2904 /* Show condition, and expanded condition if it's different */
2909 debug_printf_indent("check %s%s %n",
2910 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2911 conditions[cb->type].name, &lhswidth);
2913 if (cb->type == ACLC_SET)
2915 #ifndef DISABLE_DKIM
2916 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2917 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2919 debug_printf("%s ", cb->u.varname);
2925 debug_printf("acl_%s ", cb->u.varname);
2926 lhswidth += 5 + Ustrlen(cb->u.varname);
2930 debug_printf("= %s\n", cb->arg);
2933 debug_printf("%.*s= %s\n", lhswidth,
2937 /* Check that this condition makes sense at this time */
2939 if ((conditions[cb->type].forbids & (1 << where)) != 0)
2941 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2942 conditions[cb->type].is_modifier ? "use" : "test",
2943 conditions[cb->type].name, acl_wherenames[where]);
2947 /* Run the appropriate test for each condition, or take the appropriate
2948 action for the remaining modifiers. */
2952 case ACLC_ADD_HEADER:
2956 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2960 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
2961 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2963 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2964 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2970 case ACLC_AUTHENTICATED:
2971 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
2972 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
2975 #ifdef EXPERIMENTAL_BRIGHTMAIL
2976 case ACLC_BMI_OPTIN:
2978 int old_pool = store_pool;
2979 store_pool = POOL_PERM;
2980 bmi_current_optin = string_copy(arg);
2981 store_pool = old_pool;
2986 case ACLC_CONDITION:
2987 /* The true/false parsing here should be kept in sync with that used in
2988 expand.c when dealing with ECOND_BOOL so that we don't have too many
2989 different definitions of what can be a boolean. */
2991 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
2992 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2993 rc = (Uatoi(arg) == 0)? FAIL : OK;
2995 rc = (strcmpic(arg, US"no") == 0 ||
2996 strcmpic(arg, US"false") == 0)? FAIL :
2997 (strcmpic(arg, US"yes") == 0 ||
2998 strcmpic(arg, US"true") == 0)? OK : DEFER;
3000 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3003 case ACLC_CONTINUE: /* Always succeeds */
3008 const uschar *p = NULL;
3009 control_type = decode_control(arg, &p, where, log_msgptr);
3011 /* Check if this control makes sense at this time */
3013 if (controls_list[control_type].forbids & (1 << where))
3015 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3016 controls_list[control_type].name, acl_wherenames[where]);
3020 switch(control_type)
3022 case CONTROL_AUTH_UNADVERTISED:
3023 f.allow_auth_unadvertised = TRUE;
3026 #ifdef EXPERIMENTAL_BRIGHTMAIL
3027 case CONTROL_BMI_RUN:
3032 #ifndef DISABLE_DKIM
3033 case CONTROL_DKIM_VERIFY:
3034 f.dkim_disable_verify = TRUE;
3035 #ifdef EXPERIMENTAL_DMARC
3036 /* Since DKIM was blocked, skip DMARC too */
3037 f.dmarc_disable_verify = TRUE;
3038 f.dmarc_enable_forensic = FALSE;
3043 #ifdef EXPERIMENTAL_DMARC
3044 case CONTROL_DMARC_VERIFY:
3045 f.dmarc_disable_verify = TRUE;
3048 case CONTROL_DMARC_FORENSIC:
3049 f.dmarc_enable_forensic = TRUE;
3056 int fd, af, level, optname, value;
3057 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3058 a socket; we can accept that, we'll just debug-log failures anyway. */
3059 fd = fileno(smtp_in);
3060 af = ip_get_address_family(fd);
3064 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3068 if (dscp_lookup(p+1, af, &level, &optname, &value))
3070 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3072 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3073 p+1, strerror(errno));
3077 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3082 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3088 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3096 case CONTROL_CASEFUL_LOCAL_PART:
3097 deliver_localpart = addr->cc_local_part;
3100 case CONTROL_CASELOWER_LOCAL_PART:
3101 deliver_localpart = addr->lc_local_part;
3104 case CONTROL_ENFORCE_SYNC:
3105 smtp_enforce_sync = TRUE;
3108 case CONTROL_NO_ENFORCE_SYNC:
3109 smtp_enforce_sync = FALSE;
3112 #ifdef WITH_CONTENT_SCAN
3113 case CONTROL_NO_MBOX_UNSPOOL:
3114 f.no_mbox_unspool = TRUE;
3118 case CONTROL_NO_MULTILINE:
3119 f.no_multiline_responses = TRUE;
3122 case CONTROL_NO_PIPELINING:
3123 f.pipelining_enable = FALSE;
3126 case CONTROL_NO_DELAY_FLUSH:
3127 f.disable_delay_flush = TRUE;
3130 case CONTROL_NO_CALLOUT_FLUSH:
3131 f.disable_callout_flush = TRUE;
3134 case CONTROL_FAKEREJECT:
3135 cancel_cutthrough_connection(TRUE, US"fakereject");
3136 case CONTROL_FAKEDEFER:
3137 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3140 const uschar *pp = p + 1;
3142 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3147 /* Explicitly reset to default string */
3148 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3152 case CONTROL_FREEZE:
3153 f.deliver_freeze = TRUE;
3154 deliver_frozen_at = time(NULL);
3155 freeze_tell = freeze_tell_config; /* Reset to configured value */
3156 if (Ustrncmp(p, "/no_tell", 8) == 0)
3163 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3166 cancel_cutthrough_connection(TRUE, US"item frozen");
3169 case CONTROL_QUEUE_ONLY:
3170 f.queue_only_policy = TRUE;
3171 cancel_cutthrough_connection(TRUE, US"queueing forced");
3174 case CONTROL_SUBMISSION:
3175 originator_name = US"";
3176 f.submission_mode = TRUE;
3179 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3182 f.active_local_sender_retain = TRUE;
3183 f.active_local_from_check = FALSE;
3185 else if (Ustrncmp(p, "/domain=", 8) == 0)
3187 const uschar *pp = p + 8;
3188 while (*pp && *pp != '/') pp++;
3189 submission_domain = string_copyn(p+8, pp-p-8);
3192 /* The name= option must be last, because it swallows the rest of
3194 else if (Ustrncmp(p, "/name=", 6) == 0)
3196 const uschar *pp = p + 6;
3198 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
3199 big_buffer, big_buffer_size));
3206 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3213 uschar * debug_tag = NULL;
3214 uschar * debug_opts = NULL;
3219 const uschar * pp = p+1;
3220 if (Ustrncmp(pp, "tag=", 4) == 0)
3222 for (pp += 4; *pp && *pp != '/';) pp++;
3223 debug_tag = string_copyn(p+5, pp-p-5);
3225 else if (Ustrncmp(pp, "opts=", 5) == 0)
3227 for (pp += 5; *pp && *pp != '/';) pp++;
3228 debug_opts = string_copyn(p+6, pp-p-6);
3230 else if (Ustrncmp(pp, "kill", 4) == 0)
3232 for (pp += 4; *pp && *pp != '/';) pp++;
3236 while (*pp && *pp != '/') pp++;
3241 debug_logging_stop();
3243 debug_logging_activate(debug_tag, debug_opts);
3247 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3248 f.suppress_local_fixups = TRUE;
3251 case CONTROL_CUTTHROUGH_DELIVERY:
3253 uschar * ignored = NULL;
3254 #ifndef DISABLE_PRDR
3259 /* Too hard to think about for now. We might in future cutthrough
3260 the case where both sides handle prdr and this-node prdr acl
3262 ignored = US"PRDR active";
3265 if (f.deliver_freeze)
3266 ignored = US"frozen";
3267 else if (f.queue_only_policy)
3268 ignored = US"queue-only";
3269 else if (fake_response == FAIL)
3270 ignored = US"fakereject";
3273 if (rcpt_count == 1)
3275 cutthrough.delivery = TRUE; /* control accepted */
3278 const uschar * pp = p+1;
3279 if (Ustrncmp(pp, "defer=", 6) == 0)
3282 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3283 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3286 while (*pp && *pp != '/') pp++;
3291 ignored = US"nonfirst rcpt";
3294 DEBUG(D_acl) if (ignored)
3295 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3300 case CONTROL_UTF8_DOWNCONVERT:
3305 message_utf8_downconvert = 1;
3306 addr->prop.utf8_downcvt = TRUE;
3307 addr->prop.utf8_downcvt_maybe = FALSE;
3313 message_utf8_downconvert = 0;
3314 addr->prop.utf8_downcvt = FALSE;
3315 addr->prop.utf8_downcvt_maybe = FALSE;
3319 if (p[1] == '-' && p[2] == '1')
3321 message_utf8_downconvert = -1;
3322 addr->prop.utf8_downcvt = FALSE;
3323 addr->prop.utf8_downcvt_maybe = TRUE;
3327 *log_msgptr = US"bad option value for control=utf8_downconvert";
3331 message_utf8_downconvert = 1;
3332 addr->prop.utf8_downcvt = TRUE;
3333 addr->prop.utf8_downcvt_maybe = FALSE;
3343 #ifdef EXPERIMENTAL_DCC
3346 /* Separate the regular expression and any optional parameters. */
3347 const uschar * list = arg;
3348 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3349 /* Run the dcc backend. */
3350 rc = dcc_process(&ss);
3351 /* Modify return code based upon the existence of options. */
3352 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3353 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3354 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3359 #ifdef WITH_CONTENT_SCAN
3361 rc = mime_decode(&arg);
3367 int delay = readconf_readtime(arg, 0, FALSE);
3370 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3371 "modifier: \"%s\" is not a time value", arg);
3376 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3381 debug_printf_indent("delay skipped in -bh checking mode\n");
3384 /* NOTE 1: Remember that we may be
3385 dealing with stdin/stdout here, in addition to TCP/IP connections.
3386 Also, delays may be specified for non-SMTP input, where smtp_out and
3387 smtp_in will be NULL. Whatever is done must work in all cases.
3389 NOTE 2: The added feature of flushing the output before a delay must
3390 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3395 if (smtp_out && !f.disable_delay_flush)
3398 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3404 p.fd = fileno(smtp_out);
3405 p.events = POLLRDHUP;
3408 if (poll(&p, n, delay*1000) > 0)
3409 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3412 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3413 TCP/IP connection has gone away without reading from it. This means
3414 that we cannot shorten the delay below if the client goes away,
3415 because we cannot discover that the client has closed its end of the
3416 connection. (The connection is actually in a half-closed state,
3417 waiting for the server to close its end.) It would be nice to be able
3418 to detect this state, so that the Exim process is not held up
3419 unnecessarily. However, it seems that we can't. The poll() function
3420 does not do the right thing, and in any case it is not always
3423 while (delay > 0) delay = sleep(delay);
3430 #ifndef DISABLE_DKIM
3431 case ACLC_DKIM_SIGNER:
3432 if (dkim_cur_signer)
3433 rc = match_isinlist(dkim_cur_signer,
3434 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3439 case ACLC_DKIM_STATUS:
3440 rc = match_isinlist(dkim_verify_status,
3441 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3445 #ifdef EXPERIMENTAL_DMARC
3446 case ACLC_DMARC_STATUS:
3447 if (!f.dmarc_has_been_checked)
3449 f.dmarc_has_been_checked = TRUE;
3450 /* used long way of dmarc_exim_expand_query() in case we need more
3451 * view into the process in the future. */
3452 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3453 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3458 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3462 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3463 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3466 /* The value in tls_cipher is the full cipher name, for example,
3467 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3468 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3469 what may in practice come out of the SSL library - which at the time of
3470 writing is poorly documented. */
3472 case ACLC_ENCRYPTED:
3473 if (tls_in.cipher == NULL) rc = FAIL; else
3475 uschar *endcipher = NULL;
3476 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3477 if (cipher == NULL) cipher = tls_in.cipher; else
3479 endcipher = Ustrchr(++cipher, ':');
3480 if (endcipher != NULL) *endcipher = 0;
3482 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3483 if (endcipher != NULL) *endcipher = ':';
3487 /* Use verify_check_this_host() instead of verify_check_host() so that
3488 we can pass over &host_data to catch any looked up data. Once it has been
3489 set, it retains its value so that it's still there if another ACL verb
3490 comes through here and uses the cache. However, we must put it into
3491 permanent store in case it is also expected to be used in a subsequent
3492 message in the same SMTP connection. */
3495 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3496 (sender_host_address == NULL)? US"" : sender_host_address,
3498 if (rc == DEFER) *log_msgptr = search_error_message;
3499 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3502 case ACLC_LOCAL_PARTS:
3503 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3504 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3505 CUSS &deliver_localpart_data);
3508 case ACLC_LOG_REJECT_TARGET:
3512 const uschar *s = arg;
3514 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size)))
3516 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3517 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3518 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3521 logbits |= LOG_MAIN|LOG_REJECT;
3522 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3523 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3526 log_reject_target = logbits;
3533 const uschar *s = arg;
3539 if (Ustrncmp(s, "main", 4) == 0)
3540 { logbits |= LOG_MAIN; s += 4; }
3541 else if (Ustrncmp(s, "panic", 5) == 0)
3542 { logbits |= LOG_PANIC; s += 5; }
3543 else if (Ustrncmp(s, "reject", 6) == 0)
3544 { logbits |= LOG_REJECT; s += 6; }
3547 logbits = LOG_MAIN|LOG_PANIC;
3548 s = string_sprintf(":unknown log name in \"%s\" in "
3549 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3555 while (isspace(*s)) s++;
3557 if (logbits == 0) logbits = LOG_MAIN;
3558 log_write(0, logbits, "%s", string_printing(s));
3562 #ifdef WITH_CONTENT_SCAN
3563 case ACLC_MALWARE: /* Run the malware backend. */
3565 /* Separate the regular expression and any optional parameters. */
3566 const uschar * list = arg;
3567 uschar * ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3569 BOOL defer_ok = FALSE;
3572 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3573 if (strcmpic(opt, US"defer_ok") == 0)
3575 else if ( strncmpic(opt, US"tmo=", 4) == 0
3576 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3579 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3583 rc = malware(ss, timeout);
3584 if (rc == DEFER && defer_ok)
3585 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3589 case ACLC_MIME_REGEX:
3590 rc = mime_regex(&arg);
3595 if (Ustrchr(arg, '/'))
3597 *log_msgptr = string_sprintf(
3598 "Directory separator not permitted in queue name: '%s'", arg);
3601 queue_name = string_copy_perm(arg, FALSE);
3604 case ACLC_RATELIMIT:
3605 rc = acl_ratelimit(arg, where, log_msgptr);
3608 case ACLC_RECIPIENTS:
3609 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3610 CUSS &recipient_data);
3613 #ifdef WITH_CONTENT_SCAN
3619 case ACLC_REMOVE_HEADER:
3620 setup_remove_header(arg);
3623 case ACLC_SENDER_DOMAINS:
3626 sdomain = Ustrrchr(sender_address, '@');
3627 sdomain = sdomain ? sdomain + 1 : US"";
3628 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3629 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3634 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3635 sender_address_cache, -1, 0, CUSS &sender_data);
3638 /* Connection variables must persist forever */
3642 int old_pool = store_pool;
3643 if ( cb->u.varname[0] == 'c'
3644 #ifndef DISABLE_DKIM
3645 || cb->u.varname[0] == 'd'
3647 #ifndef DISABLE_EVENT
3648 || event_name /* An event is being delivered */
3651 store_pool = POOL_PERM;
3652 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3653 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3654 dkim_verify_status = string_copy(arg);
3655 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3656 dkim_verify_reason = string_copy(arg);
3659 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3660 store_pool = old_pool;
3664 #ifdef WITH_CONTENT_SCAN
3667 /* Separate the regular expression and any optional parameters. */
3668 const uschar * list = arg;
3669 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
3671 rc = spam(CUSS &ss);
3672 /* Modify return code based upon the existence of options. */
3673 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size)))
3674 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3675 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3682 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3684 case ACLC_SPF_GUESS:
3685 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3690 rc = acl_udpsend(arg, log_msgptr);
3693 /* If the verb is WARN, discard any user message from verification, because
3694 such messages are SMTP responses, not header additions. The latter come
3695 only from explicit "message" modifiers. However, put the user message into
3696 $acl_verify_message so it can be used in subsequent conditions or modifiers
3697 (until something changes it). */
3700 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3702 acl_verify_message = *user_msgptr;
3703 if (verb == ACL_WARN) *user_msgptr = NULL;
3707 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3708 "condition %d", cb->type);
3712 /* If a condition was negated, invert OK/FAIL. */
3714 if (!conditions[cb->type].is_modifier && cb->u.negated)
3715 if (rc == OK) rc = FAIL;
3716 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3718 if (rc != OK) break; /* Conditions loop */
3722 /* If the result is the one for which "message" and/or "log_message" are used,
3723 handle the values of these modifiers. If there isn't a log message set, we make
3724 it the same as the user message.
3726 "message" is a user message that will be included in an SMTP response. Unless
3727 it is empty, it overrides any previously set user message.
3729 "log_message" is a non-user message, and it adds to any existing non-user
3730 message that is already set.
3732 Most verbs have but a single return for which the messages are relevant, but
3733 for "discard", it's useful to have the log message both when it succeeds and
3734 when it fails. For "accept", the message is used in the OK case if there is no
3735 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3738 if (*epp && rc == OK) user_message = NULL;
3740 if ((BIT(rc) & msgcond[verb]) != 0)
3743 uschar *old_user_msgptr = *user_msgptr;
3744 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3746 /* If the verb is "warn", messages generated by conditions (verification or
3747 nested ACLs) are always discarded. This also happens for acceptance verbs
3748 when they actually do accept. Only messages specified at this level are used.
3749 However, the value of an existing message is available in $acl_verify_message
3750 during expansions. */
3752 if (verb == ACL_WARN ||
3753 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3754 *log_msgptr = *user_msgptr = NULL;
3758 acl_verify_message = old_user_msgptr;
3759 expmessage = expand_string(user_message);
3762 if (!f.expand_string_forcedfail)
3763 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3764 user_message, expand_string_message);
3766 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3771 acl_verify_message = old_log_msgptr;
3772 expmessage = expand_string(log_message);
3775 if (!f.expand_string_forcedfail)
3776 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3777 log_message, expand_string_message);
3779 else if (expmessage[0] != 0)
3781 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3782 string_sprintf("%s: %s", expmessage, *log_msgptr);
3786 /* If no log message, default it to the user message */
3788 if (!*log_msgptr) *log_msgptr = *user_msgptr;
3791 acl_verify_message = NULL;
3799 /*************************************************
3800 * Get line from a literal ACL *
3801 *************************************************/
3803 /* This function is passed to acl_read() in order to extract individual lines
3804 of a literal ACL, which we access via static pointers. We can destroy the
3805 contents because this is called only once (the compiled ACL is remembered).
3807 This code is intended to treat the data in the same way as lines in the main
3808 Exim configuration file. That is:
3810 . Leading spaces are ignored.
3812 . A \ at the end of a line is a continuation - trailing spaces after the \
3813 are permitted (this is because I don't believe in making invisible things
3814 significant). Leading spaces on the continued part of a line are ignored.
3816 . Physical lines starting (significantly) with # are totally ignored, and
3817 may appear within a sequence of backslash-continued lines.
3819 . Blank lines are ignored, but will end a sequence of continuations.
3822 Returns: a pointer to the next line
3826 static uschar *acl_text; /* Current pointer in the text */
3827 static uschar *acl_text_end; /* Points one past the terminating '0' */
3835 /* This loop handles leading blank lines and comments. */
3839 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3840 if (*acl_text == 0) return NULL; /* No more data */
3841 yield = acl_text; /* Potential data line */
3843 while (*acl_text && *acl_text != '\n') acl_text++;
3845 /* If we hit the end before a newline, we have the whole logical line. If
3846 it's a comment, there's no more data to be given. Otherwise, yield it. */
3848 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3850 /* After reaching a newline, end this loop if the physical line does not
3851 start with '#'. If it does, it's a comment, and the loop continues. */
3853 if (*yield != '#') break;
3856 /* This loop handles continuations. We know we have some real data, ending in
3857 newline. See if there is a continuation marker at the end (ignoring trailing
3858 white space). We know that *yield is not white space, so no need to test for
3859 cont > yield in the backwards scanning loop. */
3864 for (cont = acl_text - 1; isspace(*cont); cont--);
3866 /* If no continuation follows, we are done. Mark the end of the line and
3875 /* We have encountered a continuation. Skip over whitespace at the start of
3876 the next line, and indeed the whole of the next line or lines if they are
3881 while (*(++acl_text) == ' ' || *acl_text == '\t');
3882 if (*acl_text != '#') break;
3883 while (*(++acl_text) != 0 && *acl_text != '\n');
3886 /* We have the start of a continuation line. Move all the rest of the data
3887 to join onto the previous line, and then find its end. If the end is not a
3888 newline, we are done. Otherwise loop to look for another continuation. */
3890 memmove(cont, acl_text, acl_text_end - acl_text);
3891 acl_text_end -= acl_text - cont;
3893 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3894 if (*acl_text == 0) return yield;
3897 /* Control does not reach here */
3904 /*************************************************
3905 * Check access using an ACL *
3906 *************************************************/
3908 /* This function is called from address_check. It may recurse via
3909 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3910 passed as a string which is expanded. A forced failure implies no access check
3911 is required. If the result is a single word, it is taken as the name of an ACL
3912 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3913 text, complete with newlines, and parsed as such. In both cases, the ACL check
3914 is then run. This function uses an auxiliary function for acl_read() to call
3915 for reading individual lines of a literal ACL. This is acl_getline(), which
3916 appears immediately above.
3919 where where called from
3920 addr address item when called from RCPT; otherwise NULL
3921 s the input string; NULL is the same as an empty ACL => DENY
3922 user_msgptr where to put a user error (for SMTP response)
3923 log_msgptr where to put a logging message (not for SMTP response)
3925 Returns: OK access is granted
3926 DISCARD access is apparently granted...
3927 FAIL access is denied
3928 FAIL_DROP access is denied; drop the connection
3929 DEFER can't tell at the moment
3934 acl_check_internal(int where, address_item *addr, uschar *s,
3935 uschar **user_msgptr, uschar **log_msgptr)
3938 acl_block *acl = NULL;
3939 uschar *acl_name = US"inline ACL";
3942 /* Catch configuration loops */
3946 *log_msgptr = US"ACL nested too deep: possible loop";
3952 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
3956 /* At top level, we expand the incoming string. At lower levels, it has already
3957 been expanded as part of condition processing. */
3961 if (!(ss = expand_string(s)))
3963 if (f.expand_string_forcedfail) return OK;
3964 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3965 expand_string_message);
3971 while (isspace(*ss)) ss++;
3973 /* If we can't find a named ACL, the default is to parse it as an inline one.
3974 (Unless it begins with a slash; non-existent files give rise to an error.) */
3978 /* Handle the case of a string that does not contain any spaces. Look for a
3979 named ACL among those read from the configuration, or a previously read file.
3980 It is possible that the pointer to the ACL is NULL if the configuration
3981 contains a name with no data. If not found, and the text begins with '/',
3982 read an ACL from a file, and save it so it can be re-used. */
3984 if (Ustrchr(ss, ' ') == NULL)
3986 tree_node * t = tree_search(acl_anchor, ss);
3989 if (!(acl = (acl_block *)(t->data.ptr)))
3991 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
3994 acl_name = string_sprintf("ACL \"%s\"", ss);
3995 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
3998 else if (*ss == '/')
4000 struct stat statbuf;
4003 log_write(0, LOG_MAIN|LOG_PANIC,
4004 "attempt to open tainted ACL file name \"%s\"", ss);
4005 /* Avoid leaking info to an attacker */
4006 *log_msgptr = US"internal configuration error";
4009 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4011 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4015 if (fstat(fd, &statbuf) != 0)
4017 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4022 /* If the string being used as a filename is tainted, so is the file content */
4023 acl_text = store_get(statbuf.st_size + 1, is_tainted(ss));
4024 acl_text_end = acl_text + statbuf.st_size + 1;
4026 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4028 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4029 ss, strerror(errno));
4032 acl_text[statbuf.st_size] = 0;
4035 acl_name = string_sprintf("ACL \"%s\"", ss);
4036 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4040 /* Parse an ACL that is still in text form. If it came from a file, remember it
4041 in the ACL tree, having read it into the POOL_PERM store pool so that it
4042 persists between multiple messages. */
4046 int old_pool = store_pool;
4047 if (fd >= 0) store_pool = POOL_PERM;
4048 acl = acl_read(acl_getline, log_msgptr);
4049 store_pool = old_pool;
4050 if (!acl && *log_msgptr) return ERROR;
4053 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), is_tainted(ss));
4054 Ustrcpy(t->name, ss);
4056 (void)tree_insertnode(&acl_anchor, t);
4060 /* Now we have an ACL to use. It's possible it may be NULL. */
4065 int basic_errno = 0;
4066 BOOL endpass_seen = FALSE;
4067 BOOL acl_quit_check = acl_level == 0
4068 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4070 *log_msgptr = *user_msgptr = NULL;
4071 f.acl_temp_details = FALSE;
4073 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4074 verbs[acl->verb], acl->srcfile, acl->srcline);
4076 /* Clear out any search error message from a previous check before testing
4079 search_error_message = NULL;
4080 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4081 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4083 /* Handle special returns: DEFER causes a return except on a WARN verb;
4084 ERROR always causes a return. */
4089 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4090 verbs[acl->verb], acl_name);
4091 if (basic_errno != ERRNO_CALLOUTDEFER)
4093 if (search_error_message != NULL && *search_error_message != 0)
4094 *log_msgptr = search_error_message;
4095 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4098 f.acl_temp_details = TRUE;
4099 if (acl->verb != ACL_WARN) return DEFER;
4102 default: /* Paranoia */
4104 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4105 verbs[acl->verb], acl_name);
4109 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4110 verbs[acl->verb], acl_name);
4114 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4115 verbs[acl->verb], acl_name);
4118 /* DISCARD and DROP can happen only from a nested ACL condition, and
4119 DISCARD can happen only for an "accept" or "discard" verb. */
4122 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4123 verbs[acl->verb], acl_name);
4127 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4128 verbs[acl->verb], acl_name);
4132 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4133 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4134 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4139 if (cond == OK || cond == DISCARD)
4141 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4146 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4154 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4155 if (acl_quit_check) goto badquit;
4156 f.acl_temp_details = TRUE;
4164 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4165 if (acl_quit_check) goto badquit;
4171 if (cond == OK || cond == DISCARD)
4173 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4174 if (acl_quit_check) goto badquit;
4180 debug_printf_indent("discard: endpass encountered - denying access\n");
4188 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4189 if (acl_quit_check) goto badquit;
4197 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4198 if (acl_quit_check) goto badquit;
4205 acl_warn(where, *user_msgptr, *log_msgptr);
4206 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4207 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4208 "condition test deferred%s%s", host_and_ident(TRUE),
4209 (*log_msgptr == NULL)? US"" : US": ",
4210 (*log_msgptr == NULL)? US"" : *log_msgptr);
4211 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4215 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4220 /* Pass to the next ACL item */
4225 /* We have reached the end of the ACL. This is an implicit DENY. */
4227 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4231 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4232 "('%s' verb used incorrectly)", verbs[acl->verb]);
4239 /* Same args as acl_check_internal() above, but the string s is
4240 the name of an ACL followed optionally by up to 9 space-separated arguments.
4241 The name and args are separately expanded. Args go into $acl_arg globals. */
4243 acl_check_wargs(int where, address_item *addr, const uschar *s,
4244 uschar **user_msgptr, uschar **log_msgptr)
4247 uschar * tmp_arg[9]; /* must match acl_arg[] */
4248 uschar * sav_arg[9]; /* must match acl_arg[] */
4254 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4257 for (i = 0; i < 9; i++)
4259 while (*s && isspace(*s)) s++;
4261 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4268 sav_narg = acl_narg;
4270 for (i = 0; i < acl_narg; i++)
4272 sav_arg[i] = acl_arg[i];
4273 acl_arg[i] = tmp_arg[i];
4277 sav_arg[i] = acl_arg[i];
4278 acl_arg[i++] = NULL;
4282 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4285 acl_narg = sav_narg;
4286 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4290 if (f.expand_string_forcedfail) return ERROR;
4291 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4292 tmp, expand_string_message);
4293 return f.search_find_defer ? DEFER : ERROR;
4298 /*************************************************
4299 * Check access using an ACL *
4300 *************************************************/
4302 /* Alternate interface for ACL, used by expansions */
4304 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4307 address_item *addr = NULL;
4310 *user_msgptr = *log_msgptr = NULL;
4311 sender_verified_failed = NULL;
4312 ratelimiters_cmd = NULL;
4313 log_reject_target = LOG_MAIN|LOG_REJECT;
4315 if (where == ACL_WHERE_RCPT)
4317 adb = address_defaults;
4319 addr->address = expand_string(US"$local_part@$domain");
4320 addr->domain = deliver_domain;
4321 addr->local_part = deliver_localpart;
4322 addr->cc_local_part = deliver_localpart;
4323 addr->lc_local_part = deliver_localpart;
4327 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4334 /* This is the external interface for ACL checks. It sets up an address and the
4335 expansions for $domain and $local_part when called after RCPT, then calls
4336 acl_check_internal() to do the actual work.
4339 where ACL_WHERE_xxxx indicating where called from
4340 recipient RCPT address for RCPT check, else NULL
4341 s the input string; NULL is the same as an empty ACL => DENY
4342 user_msgptr where to put a user error (for SMTP response)
4343 log_msgptr where to put a logging message (not for SMTP response)
4345 Returns: OK access is granted by an ACCEPT verb
4346 DISCARD access is granted by a DISCARD verb
4347 FAIL access is denied
4348 FAIL_DROP access is denied; drop the connection
4349 DEFER can't tell at the moment
4352 int acl_where = ACL_WHERE_UNKNOWN;
4355 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4356 uschar **log_msgptr)
4360 address_item *addr = NULL;
4362 *user_msgptr = *log_msgptr = NULL;
4363 sender_verified_failed = NULL;
4364 ratelimiters_cmd = NULL;
4365 log_reject_target = LOG_MAIN|LOG_REJECT;
4367 #ifndef DISABLE_PRDR
4368 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4370 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4373 adb = address_defaults;
4375 addr->address = recipient;
4376 if (deliver_split_address(addr) == DEFER)
4378 *log_msgptr = US"defer in percent_hack_domains check";
4382 if ((addr->prop.utf8_msg = message_smtputf8))
4384 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4385 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4388 deliver_domain = addr->domain;
4389 deliver_localpart = addr->local_part;
4394 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4396 acl_where = ACL_WHERE_UNKNOWN;
4398 /* Cutthrough - if requested,
4399 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4400 and rcpt acl returned accept,
4401 and first recipient (cancel on any subsequents)
4402 open one now and run it up to RCPT acceptance.
4403 A failed verify should cancel cutthrough request,
4404 and will pass the fail to the originator.
4405 Initial implementation: dual-write to spool.
4406 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4408 Cease cutthrough copy on rxd final dot; do not send one.
4410 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4412 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4413 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4414 If temp-reject, close the conn (and keep the spooled copy).
4415 If conn-failure, no action (and keep the spooled copy).
4419 case ACL_WHERE_RCPT:
4420 #ifndef DISABLE_PRDR
4421 case ACL_WHERE_PRDR:
4424 if (f.host_checking_callout) /* -bhc mode */
4425 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4428 && cutthrough.delivery
4429 && rcpt_count > cutthrough.nrcpt
4432 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4433 if (cutthrough.defer_pass)
4435 uschar * s = addr->message;
4436 /* Horrid kludge to recover target's SMTP message */
4438 do --s; while (!isdigit(*s));
4439 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4440 f.acl_temp_details = TRUE;
4444 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4448 else HDEBUG(D_acl) if (cutthrough.delivery)
4449 if (rcpt_count <= cutthrough.nrcpt)
4450 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4452 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4455 case ACL_WHERE_PREDATA:
4457 cutthrough_predata();
4459 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4462 case ACL_WHERE_QUIT:
4463 case ACL_WHERE_NOTQUIT:
4464 /* Drop cutthrough conns, and drop heldopen verify conns if
4465 the previous was not DATA */
4467 uschar prev = smtp_connection_had[smtp_ch_index-2];
4468 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4470 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4478 deliver_domain = deliver_localpart = deliver_address_data =
4479 deliver_domain_data = sender_address_data = NULL;
4481 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4482 ACL, which is really in the middle of an SMTP command. */
4486 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4488 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4489 "ACL", acl_wherenames[where]);
4495 /* A DROP response is not permitted from MAILAUTH */
4497 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4499 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4500 "ACL", acl_wherenames[where]);
4504 /* Before giving a response, take a look at the length of any user message, and
4505 split it up into multiple lines if possible. */
4507 *user_msgptr = string_split_message(*user_msgptr);
4508 if (fake_response != OK)
4509 fake_response_text = string_split_message(fake_response_text);
4515 /*************************************************
4516 * Create ACL variable *
4517 *************************************************/
4519 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4520 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4523 name pointer to the variable's name, starting with c or m
4525 Returns the pointer to variable's tree node
4529 acl_var_create(uschar * name)
4531 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4532 if (!(node = tree_search(*root, name)))
4534 node = store_get(sizeof(tree_node) + Ustrlen(name), is_tainted(name));
4535 Ustrcpy(node->name, name);
4536 (void)tree_insertnode(root, node);
4538 node->data.ptr = NULL;
4544 /*************************************************
4545 * Write an ACL variable in spool format *
4546 *************************************************/
4548 /* This function is used as a callback for tree_walk when writing variables to
4549 the spool file. To retain spool file compatibility, what is written is -aclc or
4550 -aclm followed by the rest of the name and the data length, space separated,
4551 then the value itself, starting on a new line, and terminated by an additional
4552 newline. When we had only numbered ACL variables, the first line might look
4553 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4557 name of the variable
4558 value of the variable
4559 ctx FILE pointer (as a void pointer)
4565 acl_var_write(uschar *name, uschar *value, void *ctx)
4567 FILE *f = (FILE *)ctx;
4568 if (is_tainted(value)) putc('-', f);
4569 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);