DKIM: support list-version of $dkim_verify_status, and data ACL

[exim.git] / src / src / acl.c

diff --git a/src/src/acl.c b/src/src/acl.c
index 1e7d28a907d4857f1df27b32c8f8f65e2fa9cbcb..8431efc84cb70a47c57871c72536c14bdbe0ebf6 100644 (file)
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -5,6 +5,7 @@
 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
 /* Copyright (c) University of Cambridge 1995 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
 
 /* Code for handling Access Control Lists (ACLs) */
 
@@ -202,7 +203,14 @@ static condition_def conditions[] = {
   [ACLC_DELAY] =               { US"delay",            TRUE, TRUE, ACL_BIT_NOTQUIT },
 #ifndef DISABLE_DKIM
   [ACLC_DKIM_SIGNER] =         { US"dkim_signers",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
-  [ACLC_DKIM_STATUS] =         { US"dkim_status",      TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
+  [ACLC_DKIM_STATUS] =         { US"dkim_status",      TRUE, FALSE,
+                                 (unsigned int)
+                                 ~(ACL_BIT_DKIM | ACL_BIT_DATA | ACL_BIT_MIME
+# ifndef DISABLE_PRDR
+                                 | ACL_BIT_PRDR
+# endif
+      ),
+  },
 #endif
 #ifdef SUPPORT_DMARC
   [ACLC_DMARC_STATUS] =                { US"dmarc_status",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
@@ -222,7 +230,7 @@ static condition_def conditions[] = {
   },
   [ACLC_ENCRYPTED] =           { US"encrypted",        FALSE, FALSE,
                                  ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
-                                   ACL_BIT_HELO,
+                                   ACL_BIT_CONNECT
   },
 
   [ACLC_ENDPASS] =             { US"endpass",  TRUE, TRUE,     0 },
@@ -1091,7 +1099,7 @@ for (header_line * h = acl_added_headers; h; h = h->next)
   g = string_append_listele_n(g, '\n', h->text, i);
   }
 
-return g ? g->s : NULL;
+return string_from_gstring(g);
 }
 
 
@@ -1642,6 +1650,30 @@ return period;
 
 
 
+static BOOL
+sender_helo_verified_internal(void)
+{
+/* We can test the result of optional HELO verification that might have
+occurred earlier. If not, we can attempt the verification now. */
+
+if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
+return f.helo_verified;
+}
+
+static int
+sender_helo_verified_cond(void)
+{
+return sender_helo_verified_internal() ? OK : FAIL;
+}
+
+uschar *
+sender_helo_verified_boolstr(void)
+{
+return sender_helo_verified_internal() ? US"yes" : US"no";
+}
+
+
+
 /* This function implements the "verify" condition. It is called when
 encountered in any ACL, because some tests are almost always permitted. Some
 just don't make sense, and always fail (for example, an attempt to test a host
@@ -1738,11 +1770,7 @@ switch(vp->value)
     return FAIL;
 
   case VERIFY_HELO:
-    /* We can test the result of optional HELO verification that might have
-    occurred earlier. If not, we can attempt the verification now. */
-
-    if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
-    return f.helo_verified ? OK : FAIL;
+    return sender_helo_verified_cond();
 
   case VERIFY_CSA:
     /* Do Client SMTP Authorization checks in a separate function, and turn the
@@ -2529,6 +2557,7 @@ else switch(mode)
     anchor = NULL; /* silence an "unused" complaint */
     log_write(0, LOG_MAIN|LOG_PANIC_DIE,
       "internal ACL error: unknown ratelimit mode %d", mode);
+    /*NOTREACHED*/
     break;
   }
 
@@ -3406,7 +3435,7 @@ for (; cb; cb = cb->next)
        case CONTROL_FAKEREJECT:
          cancel_cutthrough_connection(TRUE, US"fakereject");
        case CONTROL_FAKEDEFER:
-         fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
+         fake_response = control_type == CONTROL_FAKEDEFER ? DEFER : FAIL;
          if (*p == '/')
            {
            const uschar *pp = p + 1;
@@ -3741,8 +3770,14 @@ for (; cb; cb = cb->next)
       break;
 
     case ACLC_DKIM_STATUS:
-      rc = match_isinlist(dkim_verify_status,
-                         &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
+      {                /* return good for any match */
+      const uschar * s = dkim_verify_status ? dkim_verify_status : US"none";
+      int sep = 0;
+      for (uschar * ss; ss = string_nextinlist(&s, &sep, NULL, 0); )
+       if (   (rc = match_isinlist(ss, &arg,
+                                   0, NULL, NULL, MCL_STRING, TRUE, NULL))
+           == OK) break;
+      }
       break;
 #endif
 
@@ -3751,8 +3786,9 @@ for (; cb; cb = cb->next)
       if (!f.dmarc_has_been_checked)
        dmarc_process();
       f.dmarc_has_been_checked = TRUE;
+
       /* used long way of dmarc_exim_expand_query() in case we need more
-       * view into the process in the future. */
+      view into the process in the future. */
       rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
                          &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
       break;