Cutthrough: option to reflect 4xx errors from target to initiator
[exim.git] / src / src / acl.c
index 474b0d1819be12537f84228cb5c9cfc69458fbc2..eff698b34dbfd2cca04ceeef9d26550f67d6d2af 100644 (file)
@@ -88,6 +88,7 @@ enum { ACLC_ACL,
 #ifdef WITH_CONTENT_SCAN
        ACLC_MIME_REGEX,
 #endif
+       ACLC_QUEUE,
        ACLC_RATELIMIT,
        ACLC_RECIPIENTS,
 #ifdef WITH_CONTENT_SCAN
@@ -108,7 +109,7 @@ enum { ACLC_ACL,
        ACLC_VERIFY };
 
 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
-"message", "log_message", "log_reject_target", "logwrite", and "set" are
+"message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
 modifiers that look like conditions but always return TRUE. They are used for
 their side effects. */
 
@@ -152,13 +153,16 @@ static uschar *conditions[] = {
 #ifdef WITH_CONTENT_SCAN
   US"mime_regex",
 #endif
+  US"queue",
   US"ratelimit",
   US"recipients",
 #ifdef WITH_CONTENT_SCAN
   US"regex",
 #endif
   US"remove_header",
-  US"sender_domains", US"senders", US"set",
+  US"sender_domains",
+  US"senders",
+  US"set",
 #ifdef WITH_CONTENT_SCAN
   US"spam",
 #endif
@@ -298,6 +302,7 @@ static uschar cond_expand_at_top[] = {
 #ifdef WITH_CONTENT_SCAN
   TRUE,    /* mime_regex */
 #endif
+  TRUE,    /* queue */
   TRUE,    /* ratelimit */
   FALSE,   /* recipients */
 #ifdef WITH_CONTENT_SCAN
@@ -360,6 +365,7 @@ static uschar cond_modifiers[] = {
 #ifdef WITH_CONTENT_SCAN
   FALSE,   /* mime_regex */
 #endif
+  TRUE,    /* queue */
   FALSE,   /* ratelimit */
   FALSE,   /* recipients */
 #ifdef WITH_CONTENT_SCAN
@@ -507,6 +513,12 @@ static unsigned int cond_forbids[] = {
   ~(1<<ACL_WHERE_MIME),                            /* mime_regex */
   #endif
 
+  (1<<ACL_WHERE_NOTSMTP)|                          /* queue */
+  #ifndef DISABLE_PRDR
+    (1<<ACL_WHERE_PRDR)|
+  #endif
+    (1<<ACL_WHERE_DATA),
+
   0,                                               /* ratelimit */
 
   (unsigned int)
@@ -732,7 +744,7 @@ static control_def controls_list[] = {
   { US"fakereject",              CONTROL_FAKEREJECT,            TRUE },
   { US"submission",              CONTROL_SUBMISSION,            TRUE },
   { US"suppress_local_fixups",   CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE },
-  { US"cutthrough_delivery",     CONTROL_CUTTHROUGH_DELIVERY,   FALSE },
+  { US"cutthrough_delivery",     CONTROL_CUTTHROUGH_DELIVERY,   TRUE },
 #ifdef SUPPORT_I18N
   { US"utf8_downconvert",        CONTROL_UTF8_DOWNCONVERT,      TRUE }
 #endif
@@ -2005,15 +2017,15 @@ message if giving out verification details. */
 if (verify_header_sender)
   {
   int verrno;
-  rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
+
+  if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
     callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
-    &verrno);
-  if (rc != OK)
+    &verrno)) != OK)
     {
     *basic_errno = verrno;
     if (smtp_return_error_details)
       {
-      if (*user_msgptr == NULL && *log_msgptr != NULL)
+      if (!*user_msgptr && *log_msgptr)
         *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
       if (rc == DEFER) acl_temp_details = TRUE;
       }
@@ -2035,10 +2047,9 @@ Therefore, we always do a full sender verify when any kind of callout is
 specified. Caching elsewhere, for instance in the DNS resolver and in the
 callout handling, should ensure that this is not terribly inefficient. */
 
-else if (verify_sender_address != NULL)
+else if (verify_sender_address)
   {
-  if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
-       != 0)
+  if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
     {
     *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
       "sender verify callout";
@@ -2054,7 +2065,9 @@ else if (verify_sender_address != NULL)
     callout that was done previously). If the "routed" flag is not set, routing
     must have failed, so we use the saved return code. */
 
-    if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
+    if (testflag(sender_vaddr, af_verify_routed))
+      rc = OK;
+    else
       {
       rc = sender_vaddr->special_action;
       *basic_errno = sender_vaddr->basic_errno;
@@ -2108,22 +2121,21 @@ else if (verify_sender_address != NULL)
 
       HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
 
-      if (rc == OK)
-        {
-        if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
-          {
-          DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
-            verify_sender_address, sender_vaddr->address);
-          }
-        else
-          {
-          DEBUG(D_acl) debug_printf("sender %s verified ok\n",
-            verify_sender_address);
-          }
-        }
-      else *basic_errno = sender_vaddr->basic_errno;
+      if (rc != OK)
+        *basic_errno = sender_vaddr->basic_errno;
+      else
+       DEBUG(D_acl)
+         {
+         if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
+           debug_printf("sender %s verified ok as %s\n",
+             verify_sender_address, sender_vaddr->address);
+         else
+           debug_printf("sender %s verified ok\n",
+             verify_sender_address);
+         }
       }
-    else rc = OK;  /* Null sender */
+    else
+      rc = OK;  /* Null sender */
 
     /* Cache the result code */
 
@@ -2976,8 +2988,6 @@ acl_check_condition(int verb, acl_condition_block *cb, int where,
 {
 uschar *user_message = NULL;
 uschar *log_message = NULL;
-uschar *debug_tag = NULL;
-uschar *debug_opts = NULL;
 int rc = OK;
 #ifdef WITH_CONTENT_SCAN
 int sep = -'/';
@@ -3329,24 +3339,39 @@ for (; cb != NULL; cb = cb->next)
        break;
 
        case CONTROL_DEBUG:
-       while (*p == '/')
          {
-         if (Ustrncmp(p, "/tag=", 5) == 0)
-           {
-           const uschar *pp = p + 5;
-           while (*pp != '\0' && *pp != '/') pp++;
-           debug_tag = string_copyn(p+5, pp-p-5);
-           p = pp;
-           }
-         else if (Ustrncmp(p, "/opts=", 6) == 0)
+         uschar * debug_tag = NULL;
+         uschar * debug_opts = NULL;
+         BOOL kill = FALSE;
+
+         while (*p == '/')
            {
-           const uschar *pp = p + 6;
-           while (*pp != '\0' && *pp != '/') pp++;
-           debug_opts = string_copyn(p+6, pp-p-6);
+           const uschar * pp = p+1;
+           if (Ustrncmp(pp, "tag=", 4) == 0)
+             {
+             for (pp += 4; *pp && *pp != '/';) pp++;
+             debug_tag = string_copyn(p+5, pp-p-5);
+             }
+           else if (Ustrncmp(pp, "opts=", 5) == 0)
+             {
+             for (pp += 5; *pp && *pp != '/';) pp++;
+             debug_opts = string_copyn(p+6, pp-p-6);
+             }
+           else if (Ustrncmp(pp, "kill", 4) == 0)
+             {
+             for (pp += 4; *pp && *pp != '/';) pp++;
+             kill = TRUE;
+             }
+           else
+             while (*pp && *pp != '/') pp++;
            p = pp;
            }
+
+           if (kill)
+             debug_logging_stop();
+           else
+             debug_logging_activate(debug_tag, debug_opts);
          }
-         debug_logging_activate(debug_tag, debug_opts);
        break;
 
        case CONTROL_SUPPRESS_LOCAL_FIXUPS:
@@ -3373,7 +3398,23 @@ for (; cb != NULL; cb = cb->next)
            *log_msgptr = US"fakereject";
          else
            {
-           if (rcpt_count == 1) cutthrough.delivery = TRUE;
+           if (rcpt_count == 1)
+             {
+             cutthrough.delivery = TRUE;
+             while (*p == '/')
+               {
+               const uschar * pp = p+1;
+               if (Ustrncmp(pp, "defer=", 6) == 0)
+                 {
+                 pp += 6;
+                 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
+                 /* else if (Ustrncmp(pp, "spool") == 0) ;     default */
+                 }
+               else
+                 while (*pp && *pp != '/') pp++;
+               p = pp;
+               }
+             }
            break;
            }
          *log_msgptr = string_sprintf("\"control=%s\" on %s item",
@@ -3518,7 +3559,7 @@ for (; cb != NULL; cb = cb->next)
       rc = match_isinlist(dkim_cur_signer,
                           &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
     else
-       rc = FAIL;
+      rc = FAIL;
     break;
 
     case ACLC_DKIM_STATUS:
@@ -3677,6 +3718,10 @@ for (; cb != NULL; cb = cb->next)
     break;
     #endif
 
+    case ACLC_QUEUE:
+    queue_name = string_copy_malloc(arg);
+    break;
+
     case ACLC_RATELIMIT:
     rc = acl_ratelimit(arg, where, log_msgptr);
     break;
@@ -4473,32 +4518,50 @@ If temp-reject, close the conn (and keep the spooled copy).
 If conn-failure, no action (and keep the spooled copy).
 */
 switch (where)
-{
-case ACL_WHERE_RCPT:
+  {
+  case ACL_WHERE_RCPT:
 #ifndef DISABLE_PRDR
-case ACL_WHERE_PRDR:
+  case ACL_WHERE_PRDR:
 #endif
-  if (host_checking_callout)   /* -bhc mode */
-    cancel_cutthrough_connection("host-checking mode");
-  else if (rc == OK && cutthrough.delivery && rcpt_count > cutthrough.nrcpt)
-    rc = open_cutthrough_connection(addr);
-  break;
+    if (host_checking_callout) /* -bhc mode */
+      cancel_cutthrough_connection("host-checking mode");
+
+    else if (  rc == OK
+           && cutthrough.delivery
+           && rcpt_count > cutthrough.nrcpt
+           && (rc = open_cutthrough_connection(addr)) == DEFER
+           )
+      if (cutthrough.defer_pass)
+       {
+       uschar * s = addr->message;
+       /* Horrid kludge to recover target's SMTP message */
+       while (*s) s++;
+       do --s; while (!isdigit(*s));
+       if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
+       acl_temp_details = TRUE;
+       }
+       else
+       {
+       HDEBUG(D_acl) debug_printf("cutthrough defer; will spool\n");
+       rc = OK;
+       }
+    break;
 
-case ACL_WHERE_PREDATA:
-  if (rc == OK)
-    cutthrough_predata();
-  else
-    cancel_cutthrough_connection("predata acl not ok");
-  break;
+  case ACL_WHERE_PREDATA:
+    if (rc == OK)
+      cutthrough_predata();
+    else
+      cancel_cutthrough_connection("predata acl not ok");
+    break;
 
-case ACL_WHERE_QUIT:
-case ACL_WHERE_NOTQUIT:
-  cancel_cutthrough_connection("quit or notquit");
-  break;
+  case ACL_WHERE_QUIT:
+  case ACL_WHERE_NOTQUIT:
+    cancel_cutthrough_connection("quit or notquit");
+    break;
 
-default:
-  break;
-}
+  default:
+    break;
+  }
 
 deliver_domain = deliver_localpart = deliver_address_data =
   sender_address_data = NULL;