Lookups: avoid leaking user/passwd from server spec to log. Bug 3066

[exim.git] / src / src / acl.c

diff --git a/src/src/acl.c b/src/src/acl.c
index 0078aca7dc6cbdac91445ced0646b32c8692c10c..f4d65464e44047b5d1b4bd07c1975411a7236fee 100644 (file)
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -2,9 +2,10 @@
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) The Exim Maintainers 2020 - 2022 */
+/* Copyright (c) The Exim Maintainers 2020 - 2023 */

 /* Copyright (c) University of Cambridge 1995 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */
 /* Copyright (c) University of Cambridge 1995 - 2018 */
 /* See the file NOTICE for conditions of use and distribution. */

+/* SPDX-License-Identifier: GPL-2.0-or-later */

 
 /* Code for handling Access Control Lists (ACLs) */
 
 
 /* Code for handling Access Control Lists (ACLs) */
 


@@ -202,7 +203,14 @@ static condition_def conditions[] = {
   [ACLC_DELAY] =               { US"delay",            TRUE, TRUE, ACL_BIT_NOTQUIT },
 #ifndef DISABLE_DKIM
   [ACLC_DKIM_SIGNER] =         { US"dkim_signers",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
   [ACLC_DELAY] =               { US"delay",            TRUE, TRUE, ACL_BIT_NOTQUIT },
 #ifndef DISABLE_DKIM
   [ACLC_DKIM_SIGNER] =         { US"dkim_signers",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },

-  [ACLC_DKIM_STATUS] =         { US"dkim_status",      TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
+  [ACLC_DKIM_STATUS] =         { US"dkim_status",      TRUE, FALSE,
+                                 (unsigned int)
+                                 ~(ACL_BIT_DKIM | ACL_BIT_DATA | ACL_BIT_MIME
+# ifndef DISABLE_PRDR
+                                 | ACL_BIT_PRDR
+# endif
+      ),
+  },

 #endif
 #ifdef SUPPORT_DMARC
   [ACLC_DMARC_STATUS] =                { US"dmarc_status",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
 #endif
 #ifdef SUPPORT_DMARC
   [ACLC_DMARC_STATUS] =                { US"dmarc_status",     TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },


@@ -222,7 +230,7 @@ static condition_def conditions[] = {
   },
   [ACLC_ENCRYPTED] =           { US"encrypted",        FALSE, FALSE,
                                  ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
   },
   [ACLC_ENCRYPTED] =           { US"encrypted",        FALSE, FALSE,
                                  ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |

-                                   ACL_BIT_HELO,
+                                   ACL_BIT_CONNECT

   },
 
   [ACLC_ENDPASS] =             { US"endpass",  TRUE, TRUE,     0 },
   },
 
   [ACLC_ENDPASS] =             { US"endpass",  TRUE, TRUE,     0 },


@@ -734,6 +742,78 @@ return -1;
 }
 
 
 }
 
 

+static BOOL
+acl_varname_to_cond(const uschar ** sp, acl_condition_block * cond, uschar ** error)
+{
+const uschar * s = *sp, * endptr;
+
+#ifndef DISABLE_DKIM
+if (  Ustrncmp(s, "dkim_verify_status", 18) == 0
+   || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
+  {
+  endptr = s+18;
+  if (isalnum(*endptr))
+    {
+    *error = string_sprintf("invalid variable name after \"set\" in ACL "
+      "modifier \"set %s\" "
+      "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
+      s);
+    return FALSE;
+    }
+  cond->u.varname = string_copyn(s, 18);
+  }
+else
+#endif
+  {
+  if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
+    {
+    *error = string_sprintf("invalid variable name after \"set\" in ACL "
+      "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
+    return FALSE;
+    }
+
+  endptr = s + 5;
+  if (!isdigit(*endptr) && *endptr != '_')
+    {
+    *error = string_sprintf("invalid variable name after \"set\" in ACL "
+      "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
+      s);
+    return FALSE;
+    }
+
+  for ( ; *endptr && *endptr != '=' && !isspace(*endptr); endptr++)
+    if (!isalnum(*endptr) && *endptr != '_')
+      {
+      *error = string_sprintf("invalid character \"%c\" in variable name "
+       "in ACL modifier \"set %s\"", *endptr, s);
+      return FALSE;
+      }
+
+  cond->u.varname = string_copyn(s + 4, endptr - s - 4);
+  }
+s = endptr;
+Uskip_whitespace(&s);
+*sp = s;
+return TRUE;
+}
+
+
+static BOOL
+acl_data_to_cond(const uschar * s, acl_condition_block * cond,
+  const uschar * name, uschar ** error)
+{
+if (*s++ != '=')
+  {
+  *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
+    conditions[cond->type].is_modifier ? US"modifier" : US"condition");
+  return FALSE;;
+  }
+Uskip_whitespace(&s);
+cond->arg = string_copy(s);
+return TRUE;
+}
+
+

 /*************************************************
 *            Read and parse one ACL              *
 *************************************************/
 /*************************************************
 *            Read and parse one ACL              *
 *************************************************/


@@ -760,7 +840,7 @@ acl_block **lastp = &yield;
 acl_block *this = NULL;
 acl_condition_block *cond;
 acl_condition_block **condp = NULL;
 acl_block *this = NULL;
 acl_condition_block *cond;
 acl_condition_block **condp = NULL;

-uschar * s;
+const uschar * s;

 
 *error = NULL;
 
 
 *error = NULL;
 


@@ -768,7 +848,7 @@ while ((s = (*func)()))
   {
   int v, c;
   BOOL negated = FALSE;
   {
   int v, c;
   BOOL negated = FALSE;

-  uschar *saveline = s;
+  const uschar * saveline = s;

   uschar name[EXIM_DRIVERNAME_MAX];
 
   /* Conditions (but not verbs) are allowed to be negated by an initial
   uschar name[EXIM_DRIVERNAME_MAX];
 
   /* Conditions (but not verbs) are allowed to be negated by an initial


@@ -808,16 +888,15 @@ while ((s = (*func)()))
       *error = string_sprintf("malformed ACL line \"%s\"", saveline);
       return NULL;
       }
       *error = string_sprintf("malformed ACL line \"%s\"", saveline);
       return NULL;
       }

-    this = store_get(sizeof(acl_block), GET_UNTAINTED);
-    *lastp = this;
-    lastp = &(this->next);
+    *lastp = this = store_get(sizeof(acl_block), GET_UNTAINTED);
+    lastp = &this->next;

     this->next = NULL;
     this->condition = NULL;
     this->verb = v;
     this->srcline = config_lineno;     /* for debug output */
     this->srcfile = config_filename;   /**/
     this->next = NULL;
     this->condition = NULL;
     this->verb = v;
     this->srcline = config_lineno;     /* for debug output */
     this->srcfile = config_filename;   /**/

-    condp = &(this->condition);
-    if (*s == 0) continue;               /* No condition on this line */
+    condp = &this->condition;
+    if (!*s) continue;               /* No condition on this line */

     if (*s == '!')
       {
       negated = TRUE;
     if (*s == '!')
       {
       negated = TRUE;


@@ -861,7 +940,7 @@ while ((s = (*func)()))
   cond->u.negated = negated;
 
   *condp = cond;
   cond->u.negated = negated;
 
   *condp = cond;

-  condp = &(cond->next);
+  condp = &cond->next;

 
   /* The "set" modifier is different in that its argument is "name=value"
   rather than just a value, and we can check the validity of the name, which
 
   /* The "set" modifier is different in that its argument is "name=value"
   rather than just a value, and we can check the validity of the name, which


@@ -874,75 +953,13 @@ while ((s = (*func)()))
   compatibility. */
 
   if (c == ACLC_SET)
   compatibility. */
 
   if (c == ACLC_SET)

-#ifndef DISABLE_DKIM
-    if (  Ustrncmp(s, "dkim_verify_status", 18) == 0
-       || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
-      {
-      uschar * endptr = s+18;
-
-      if (isalnum(*endptr))
-       {
-       *error = string_sprintf("invalid variable name after \"set\" in ACL "
-         "modifier \"set %s\" "
-         "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
-         s);
-       return NULL;
-       }
-      cond->u.varname = string_copyn(s, 18);
-      s = endptr;
-      Uskip_whitespace(&s);
-      }
-    else
-#endif
-    {
-    uschar *endptr;
-
-    if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
-      {
-      *error = string_sprintf("invalid variable name after \"set\" in ACL "
-       "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
-      return NULL;
-      }
-
-    endptr = s + 5;
-    if (!isdigit(*endptr) && *endptr != '_')
-      {
-      *error = string_sprintf("invalid variable name after \"set\" in ACL "
-       "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
-       s);
-      return NULL;
-      }
-
-    while (*endptr && *endptr != '=' && !isspace(*endptr))
-      {
-      if (!isalnum(*endptr) && *endptr != '_')
-       {
-       *error = string_sprintf("invalid character \"%c\" in variable name "
-         "in ACL modifier \"set %s\"", *endptr, s);
-       return NULL;
-       }
-      endptr++;
-      }
-
-    cond->u.varname = string_copyn(s + 4, endptr - s - 4);
-    s = endptr;
-    Uskip_whitespace(&s);
-    }
+    if (!acl_varname_to_cond(&s, cond, error)) return NULL;

 
   /* For "set", we are now positioned for the data. For the others, only
   "endpass" has no data */
 
   if (c != ACLC_ENDPASS)
 
   /* For "set", we are now positioned for the data. For the others, only
   "endpass" has no data */
 
   if (c != ACLC_ENDPASS)

-    {
-    if (*s++ != '=')
-      {
-      *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
-        conditions[c].is_modifier ? US"modifier" : US"condition");
-      return NULL;
-      }
-    Uskip_whitespace(&s);
-    cond->arg = string_copy(s);
-    }
+    if (!acl_data_to_cond(s, cond, name, error)) return NULL;

   }
 
 return yield;
   }
 
 return yield;


@@ -1082,7 +1099,7 @@ for (header_line * h = acl_added_headers; h; h = h->next)
   g = string_append_listele_n(g, '\n', h->text, i);
   }
 
   g = string_append_listele_n(g, '\n', h->text, i);
   }
 

-return g ? g->s : NULL;
+return string_from_gstring(g);

 }
 
 
 }
 
 


@@ -1129,9 +1146,9 @@ Returns:         nothing
 */
 
 static void
 */
 
 static void

-acl_warn(int where, uschar *user_message, uschar *log_message)
+acl_warn(int where, uschar * user_message, uschar * log_message)

 {
 {

-if (log_message != NULL && log_message != user_message)
+if (log_message && log_message != user_message)

   {
   uschar *text;
   string_item *logged;
   {
   uschar *text;
   string_item *logged;


@@ -1142,9 +1159,9 @@ if (log_message != NULL && log_message != user_message)
   /* If a sender verification has failed, and the log message is "sender verify
   failed", add the failure message. */
 
   /* If a sender verification has failed, and the log message is "sender verify
   failed", add the failure message. */
 

-  if (sender_verified_failed != NULL &&
-      sender_verified_failed->message != NULL &&
-      strcmpic(log_message, US"sender verify failed") == 0)
+  if (  sender_verified_failed
+     && sender_verified_failed->message
+     && strcmpic(log_message, US"sender verify failed") == 0)

     text = string_sprintf("%s: %s", text, sender_verified_failed->message);
 
   /* Search previously logged warnings. They are kept in malloc
     text = string_sprintf("%s: %s", text, sender_verified_failed->message);
 
   /* Search previously logged warnings. They are kept in malloc


@@ -1424,6 +1441,7 @@ for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
 
   /* Extract the numerical SRV fields (p is incremented) */
 
 
   /* Extract the numerical SRV fields (p is incremented) */
 

+  if (rr_bad_size(rr, 3 * sizeof(uint16_t))) continue;

   GETSHORT(priority, p);
   GETSHORT(weight, p);
   GETSHORT(port, p);
   GETSHORT(priority, p);
   GETSHORT(weight, p);
   GETSHORT(port, p);


@@ -1633,6 +1651,30 @@ return period;
 
 
 
 
 
 

+static BOOL
+sender_helo_verified_internal(void)
+{
+/* We can test the result of optional HELO verification that might have
+occurred earlier. If not, we can attempt the verification now. */
+
+if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
+return f.helo_verified;
+}
+
+static int
+sender_helo_verified_cond(void)
+{
+return sender_helo_verified_internal() ? OK : FAIL;
+}
+
+uschar *
+sender_helo_verified_boolstr(void)
+{
+return sender_helo_verified_internal() ? US"yes" : US"no";
+}
+
+
+

 /* This function implements the "verify" condition. It is called when
 encountered in any ACL, because some tests are almost always permitted. Some
 just don't make sense, and always fail (for example, an attempt to test a host
 /* This function implements the "verify" condition. It is called when
 encountered in any ACL, because some tests are almost always permitted. Some
 just don't make sense, and always fail (for example, an attempt to test a host


@@ -1669,10 +1711,10 @@ BOOL no_details = FALSE;
 BOOL success_on_redirect = FALSE;
 BOOL quota = FALSE;
 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
 BOOL success_on_redirect = FALSE;
 BOOL quota = FALSE;
 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;

-address_item *sender_vaddr = NULL;
-uschar *verify_sender_address = NULL;
-uschar *pm_mailfrom = NULL;
-uschar *se_mailfrom = NULL;
+address_item * sender_vaddr = NULL;
+const uschar * verify_sender_address = NULL;
+uschar * pm_mailfrom = NULL;
+uschar * se_mailfrom = NULL;

 
 /* Some of the verify items have slash-separated options; some do not. Diagnose
 an error if options are given for items that don't expect them.
 
 /* Some of the verify items have slash-separated options; some do not. Diagnose
 an error if options are given for items that don't expect them.


@@ -1729,11 +1771,7 @@ switch(vp->value)
     return FAIL;
 
   case VERIFY_HELO:
     return FAIL;
 
   case VERIFY_HELO:

-    /* We can test the result of optional HELO verification that might have
-    occurred earlier. If not, we can attempt the verification now. */
-
-    if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
-    return f.helo_verified ? OK : FAIL;
+    return sender_helo_verified_cond();

 
   case VERIFY_CSA:
     /* Do Client SMTP Authorization checks in a separate function, and turn the
 
   case VERIFY_CSA:
     /* Do Client SMTP Authorization checks in a separate function, and turn the


@@ -2520,6 +2558,7 @@ else switch(mode)
     anchor = NULL; /* silence an "unused" complaint */
     log_write(0, LOG_MAIN|LOG_PANIC_DIE,
       "internal ACL error: unknown ratelimit mode %d", mode);
     anchor = NULL; /* silence an "unused" complaint */
     log_write(0, LOG_MAIN|LOG_PANIC_DIE,
       "internal ACL error: unknown ratelimit mode %d", mode);

+    /*NOTREACHED*/

     break;
   }
 
     break;
   }
 


@@ -3116,12 +3155,9 @@ acl_check_condition(int verb, acl_condition_block *cb, int where,
   address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
   uschar **log_msgptr, int *basic_errno)
 {
   address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
   uschar **log_msgptr, int *basic_errno)
 {

-uschar *user_message = NULL;
-uschar *log_message = NULL;
+uschar * user_message = NULL;
+uschar * log_message = NULL;

 int rc = OK;
 int rc = OK;

-#ifdef WITH_CONTENT_SCAN
-int sep = -'/';
-#endif

 
 for (; cb; cb = cb->next)
   {
 
 for (; cb; cb = cb->next)
   {


@@ -3400,7 +3436,7 @@ for (; cb; cb = cb->next)
        case CONTROL_FAKEREJECT:
          cancel_cutthrough_connection(TRUE, US"fakereject");
        case CONTROL_FAKEDEFER:
        case CONTROL_FAKEREJECT:
          cancel_cutthrough_connection(TRUE, US"fakereject");
        case CONTROL_FAKEDEFER:

-         fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
+         fake_response = control_type == CONTROL_FAKEDEFER ? DEFER : FAIL;

          if (*p == '/')
            {
            const uschar *pp = p + 1;
          if (*p == '/')
            {
            const uschar *pp = p + 1;


@@ -3637,12 +3673,13 @@ for (; cb; cb = cb->next)
       break;
       }
 
       break;
       }
 

-    #ifdef EXPERIMENTAL_DCC
+#ifdef EXPERIMENTAL_DCC

     case ACLC_DCC:
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
     case ACLC_DCC:
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;

-      uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
+      int sep = -'/';
+      uschar * ss = string_nextinlist(&list, &sep, NULL, 0);

       /* Run the dcc backend. */
       rc = dcc_process(&ss);
       /* Modify return code based upon the existence of options. */
       /* Run the dcc backend. */
       rc = dcc_process(&ss);
       /* Modify return code based upon the existence of options. */


@@ -3651,13 +3688,13 @@ for (; cb; cb = cb->next)
           rc = FAIL;   /* FAIL so that the message is passed to the next ACL */
       break;
       }
           rc = FAIL;   /* FAIL so that the message is passed to the next ACL */
       break;
       }

-    #endif
+#endif

 
 

-    #ifdef WITH_CONTENT_SCAN
+#ifdef WITH_CONTENT_SCAN

     case ACLC_DECODE:
       rc = mime_decode(&arg);
       break;
     case ACLC_DECODE:
       rc = mime_decode(&arg);
       break;

-    #endif
+#endif

 
     case ACLC_DELAY:
       {
 
     case ACLC_DELAY:
       {


@@ -3734,8 +3771,14 @@ for (; cb; cb = cb->next)
       break;
 
     case ACLC_DKIM_STATUS:
       break;
 
     case ACLC_DKIM_STATUS:

-      rc = match_isinlist(dkim_verify_status,
-                         &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
+      {                /* return good for any match */
+      const uschar * s = dkim_verify_status ? dkim_verify_status : US"none";
+      int sep = 0;
+      for (uschar * ss; ss = string_nextinlist(&s, &sep, NULL, 0); )
+       if (   (rc = match_isinlist(ss, &arg,
+                                   0, NULL, NULL, MCL_STRING, TRUE, NULL))
+           == OK) break;
+      }

       break;
 #endif
 
       break;
 #endif
 


@@ -3744,8 +3787,9 @@ for (; cb; cb = cb->next)
       if (!f.dmarc_has_been_checked)
        dmarc_process();
       f.dmarc_has_been_checked = TRUE;
       if (!f.dmarc_has_been_checked)
        dmarc_process();
       f.dmarc_has_been_checked = TRUE;

+

       /* used long way of dmarc_exim_expand_query() in case we need more
       /* used long way of dmarc_exim_expand_query() in case we need more

-       * view into the process in the future. */
+      view into the process in the future. */

       rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
                          &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
       break;
       rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
                          &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
       break;


@@ -3804,11 +3848,10 @@ for (; cb; cb = cb->next)
 
     case ACLC_LOG_REJECT_TARGET:
       {
 
     case ACLC_LOG_REJECT_TARGET:
       {

-      int logbits = 0;
-      int sep = 0;
-      const uschar *s = arg;
-      uschar * ss;
-      while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
+      int logbits = 0, sep = 0;
+      const uschar * s = arg;
+
+      for (uschar * ss; ss = string_nextinlist(&s, &sep, NULL, 0); )

         {
         if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
         else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
         {
         if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
         else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;


@@ -3856,17 +3899,16 @@ for (; cb; cb = cb->next)
       break;
       }
 
       break;
       }
 

-    #ifdef WITH_CONTENT_SCAN
+#ifdef WITH_CONTENT_SCAN

     case ACLC_MALWARE:                 /* Run the malware backend. */
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
     case ACLC_MALWARE:                 /* Run the malware backend. */
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;

-      uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
-      uschar * opt;

       BOOL defer_ok = FALSE;
       BOOL defer_ok = FALSE;

-      int timeout = 0;
+      int timeout = 0, sep = -'/';
+      uschar * ss = string_nextinlist(&list, &sep, NULL, 0);

 
 

-      while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
+      for (uschar * opt; opt = string_nextinlist(&list, &sep, NULL, 0); )

         if (strcmpic(opt, US"defer_ok") == 0)
          defer_ok = TRUE;
        else if (  strncmpic(opt, US"tmo=", 4) == 0
         if (strcmpic(opt, US"defer_ok") == 0)
          defer_ok = TRUE;
        else if (  strncmpic(opt, US"tmo=", 4) == 0


@@ -3886,7 +3928,7 @@ for (; cb; cb = cb->next)
     case ACLC_MIME_REGEX:
       rc = mime_regex(&arg, textonly);
       break;
     case ACLC_MIME_REGEX:
       rc = mime_regex(&arg, textonly);
       break;

-    #endif
+#endif

 
     case ACLC_QUEUE:
       if (is_tainted(arg))
 
     case ACLC_QUEUE:
       if (is_tainted(arg))


@@ -3913,11 +3955,11 @@ for (; cb; cb = cb->next)
        CUSS &recipient_data);
       break;
 
        CUSS &recipient_data);
       break;
 

-    #ifdef WITH_CONTENT_SCAN
+#ifdef WITH_CONTENT_SCAN

     case ACLC_REGEX:
       rc = regex(&arg, textonly);
       break;
     case ACLC_REGEX:
       rc = regex(&arg, textonly);
       break;

-    #endif
+#endif

 
     case ACLC_REMOVE_HEADER:
       setup_remove_header(arg);
 
     case ACLC_REMOVE_HEADER:
       setup_remove_header(arg);


@@ -3970,7 +4012,8 @@ for (; cb; cb = cb->next)
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;
       {
       /* Separate the regular expression and any optional parameters. */
       const uschar * list = arg;

-      uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
+      int sep = -'/';
+      uschar * ss = string_nextinlist(&list, &sep, NULL, 0);

 
       rc = spam(CUSS &ss);
       /* Modify return code based upon the existence of options. */
 
       rc = spam(CUSS &ss);
       /* Modify return code based upon the existence of options. */


@@ -4670,8 +4713,8 @@ Returns:       OK         access is granted by an ACCEPT verb
 int acl_where = ACL_WHERE_UNKNOWN;
 
 int
 int acl_where = ACL_WHERE_UNKNOWN;
 
 int

-acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
-  uschar **log_msgptr)
+acl_check(int where, const uschar * recipient, uschar * s,
+  uschar ** user_msgptr, uschar ** log_msgptr)

 {
 int rc;
 address_item adb;
 {
 int rc;
 address_item adb;


@@ -4894,6 +4937,29 @@ if (is_tainted(value))
 fprintf(f, "acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
 }
 
 fprintf(f, "acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
 }
 

+
+
+
+uschar *
+acl_standalone_setvar(const uschar * s)
+{
+acl_condition_block * cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
+uschar * errstr = NULL, * log_msg = NULL;
+BOOL endpass_seen;
+int e;
+
+cond->next = NULL;
+cond->type = ACLC_SET;
+if (!acl_varname_to_cond(&s, cond, &errstr)) return errstr;
+if (!acl_data_to_cond(s, cond, US"'-be'", &errstr)) return errstr;
+
+if (acl_check_condition(ACL_WARN, cond, ACL_WHERE_UNKNOWN,
+                           NULL, 0, &endpass_seen, &errstr, &log_msg, &e) != OK)
+  return string_sprintf("oops: %s", errstr);
+return string_sprintf("variable %s set", cond->u.varname);
+}
+
+

 #endif /* !MACRO_PREDEF */
 /* vi: aw ai sw=2
 */
 #endif /* !MACRO_PREDEF */
 /* vi: aw ai sw=2
 */