* Exim - an Internet mail transport agent *
*************************************************/
-/* Copyright (c) The Exim Maintainers 2020 - 2022 */
+/* Copyright (c) The Exim Maintainers 2020 - 2023 */
/* Copyright (c) University of Cambridge 1995 - 2018 */
/* See the file NOTICE for conditions of use and distribution. */
-/* SPDX-License-Identifier: GPL-2.0-only */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
/* Code for handling Access Control Lists (ACLs) */
[ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
#ifndef DISABLE_DKIM
[ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
- [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
+ [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE,
+ (unsigned int)
+ ~(ACL_BIT_DKIM | ACL_BIT_DATA | ACL_BIT_MIME
+# ifndef DISABLE_PRDR
+ | ACL_BIT_PRDR
+# endif
+ ),
+ },
#endif
#ifdef SUPPORT_DMARC
[ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
},
[ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
- ACL_BIT_HELO,
+ ACL_BIT_CONNECT
},
[ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
static BOOL
acl_data_to_cond(const uschar * s, acl_condition_block * cond,
- const uschar * name, uschar ** error)
+ const uschar * name, BOOL taint, uschar ** error)
{
if (*s++ != '=')
{
return FALSE;;
}
Uskip_whitespace(&s);
-cond->arg = string_copy(s);
+cond->arg = taint ? string_copy_taint(s, GET_TAINTED) : string_copy(s);
return TRUE;
}
"endpass" has no data */
if (c != ACLC_ENDPASS)
- if (!acl_data_to_cond(s, cond, name, error)) return NULL;
+ if (!acl_data_to_cond(s, cond, name, FALSE, error)) return NULL;
}
return yield;
g = string_append_listele_n(g, '\n', h->text, i);
}
-return g ? g->s : NULL;
+return string_from_gstring(g);
}
*/
static void
-acl_warn(int where, uschar *user_message, uschar *log_message)
+acl_warn(int where, uschar * user_message, uschar * log_message)
{
-if (log_message != NULL && log_message != user_message)
+if (log_message && log_message != user_message)
{
uschar *text;
string_item *logged;
/* If a sender verification has failed, and the log message is "sender verify
failed", add the failure message. */
- if (sender_verified_failed != NULL &&
- sender_verified_failed->message != NULL &&
- strcmpic(log_message, US"sender verify failed") == 0)
+ if ( sender_verified_failed
+ && sender_verified_failed->message
+ && strcmpic(log_message, US"sender verify failed") == 0)
text = string_sprintf("%s: %s", text, sender_verified_failed->message);
/* Search previously logged warnings. They are kept in malloc
/* Extract the numerical SRV fields (p is incremented) */
+ if (rr_bad_size(rr, 3 * sizeof(uint16_t))) continue;
GETSHORT(priority, p);
GETSHORT(weight, p);
GETSHORT(port, p);
+static BOOL
+sender_helo_verified_internal(void)
+{
+/* We can test the result of optional HELO verification that might have
+occurred earlier. If not, we can attempt the verification now. */
+
+if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
+return f.helo_verified;
+}
+
+static int
+sender_helo_verified_cond(void)
+{
+return sender_helo_verified_internal() ? OK : FAIL;
+}
+
+uschar *
+sender_helo_verified_boolstr(void)
+{
+return sender_helo_verified_internal() ? US"yes" : US"no";
+}
+
+
+
/* This function implements the "verify" condition. It is called when
encountered in any ACL, because some tests are almost always permitted. Some
just don't make sense, and always fail (for example, an attempt to test a host
BOOL success_on_redirect = FALSE;
BOOL quota = FALSE;
int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
-address_item *sender_vaddr = NULL;
-uschar *verify_sender_address = NULL;
-uschar *pm_mailfrom = NULL;
-uschar *se_mailfrom = NULL;
+address_item * sender_vaddr = NULL;
+const uschar * verify_sender_address = NULL;
+uschar * pm_mailfrom = NULL;
+uschar * se_mailfrom = NULL;
/* Some of the verify items have slash-separated options; some do not. Diagnose
an error if options are given for items that don't expect them.
return FAIL;
case VERIFY_HELO:
- /* We can test the result of optional HELO verification that might have
- occurred earlier. If not, we can attempt the verification now. */
-
- if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
- return f.helo_verified ? OK : FAIL;
+ return sender_helo_verified_cond();
case VERIFY_CSA:
/* Do Client SMTP Authorization checks in a separate function, and turn the
anchor = NULL; /* silence an "unused" complaint */
log_write(0, LOG_MAIN|LOG_PANIC_DIE,
"internal ACL error: unknown ratelimit mode %d", mode);
+ /*NOTREACHED*/
break;
}
case CONTROL_FAKEREJECT:
cancel_cutthrough_connection(TRUE, US"fakereject");
case CONTROL_FAKEDEFER:
- fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
+ fake_response = control_type == CONTROL_FAKEDEFER ? DEFER : FAIL;
if (*p == '/')
{
const uschar *pp = p + 1;
break;
case ACLC_DKIM_STATUS:
- rc = match_isinlist(dkim_verify_status,
- &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
+ { /* return good for any match */
+ const uschar * s = dkim_verify_status ? dkim_verify_status : US"none";
+ int sep = 0;
+ for (uschar * ss; ss = string_nextinlist(&s, &sep, NULL, 0); )
+ if ( (rc = match_isinlist(ss, &arg,
+ 0, NULL, NULL, MCL_STRING, TRUE, NULL))
+ == OK) break;
+ }
break;
#endif
if (!f.dmarc_has_been_checked)
dmarc_process();
f.dmarc_has_been_checked = TRUE;
+
/* used long way of dmarc_exim_expand_query() in case we need more
- * view into the process in the future. */
+ view into the process in the future. */
rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
&arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
break;
CUSS &recipient_data);
break;
- #ifdef WITH_CONTENT_SCAN
+#ifdef WITH_CONTENT_SCAN
case ACLC_REGEX:
rc = regex(&arg, textonly);
break;
- #endif
+#endif
case ACLC_REMOVE_HEADER:
setup_remove_header(arg);
int acl_where = ACL_WHERE_UNKNOWN;
int
-acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
- uschar **log_msgptr)
+acl_check(int where, const uschar * recipient, uschar * s,
+ uschar ** user_msgptr, uschar ** log_msgptr)
{
int rc;
address_item adb;
uschar *
-acl_standalone_setvar(const uschar * s)
+acl_standalone_setvar(const uschar * s, BOOL taint)
{
acl_condition_block * cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
uschar * errstr = NULL, * log_msg = NULL;
cond->next = NULL;
cond->type = ACLC_SET;
if (!acl_varname_to_cond(&s, cond, &errstr)) return errstr;
-if (!acl_data_to_cond(s, cond, US"'-be'", &errstr)) return errstr;
+if (!acl_data_to_cond(s, cond, US"'-be'", taint, &errstr)) return errstr;
if (acl_check_condition(ACL_WARN, cond, ACL_WHERE_UNKNOWN,
NULL, 0, &endpass_seen, &errstr, &log_msg, &e) != OK)
git://git.exim.org / exim.git / blobdiff