1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Code for handling Access Control Lists (ACLs) */
14 /* Default callout timeout */
16 #define CALLOUT_TIMEOUT_DEFAULT 30
18 /* Default quota cache TTLs */
20 #define QUOTA_POS_DEFAULT (5*60)
21 #define QUOTA_NEG_DEFAULT (60*60)
24 /* ACL verb codes - keep in step with the table of verbs that follows */
26 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
31 static uschar *verbs[] = {
32 [ACL_ACCEPT] = US"accept",
33 [ACL_DEFER] = US"defer",
34 [ACL_DENY] = US"deny",
35 [ACL_DISCARD] = US"discard",
36 [ACL_DROP] = US"drop",
37 [ACL_REQUIRE] = US"require",
41 /* For each verb, the conditions for which "message" or "log_message" are used
42 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
43 "accept", the FAIL case is used only after "endpass", but that is selected in
46 static int msgcond[] = {
47 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
48 [ACL_DEFER] = BIT(OK),
50 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
52 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
56 /* ACL condition and modifier codes - keep in step with the table that
63 #ifdef EXPERIMENTAL_BRIGHTMAIL
69 #ifdef EXPERIMENTAL_DCC
72 #ifdef WITH_CONTENT_SCAN
90 ACLC_LOG_REJECT_TARGET,
92 #ifdef WITH_CONTENT_SCAN
96 #ifdef WITH_CONTENT_SCAN
102 #ifdef WITH_CONTENT_SCAN
109 #ifdef WITH_CONTENT_SCAN
119 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
120 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
121 modifiers that look like conditions but always return TRUE. They are used for
122 their side effects. Do not invent new modifier names that result in one name
123 being the prefix of another; the binary-search in the list will go wrong. */
125 typedef struct condition_def {
128 /* Flag to indicate the condition/modifier has a string expansion done
129 at the outer level. In the other cases, expansion already occurs in the
130 checking functions. */
131 BOOL expand_at_top:1;
135 /* Bit map vector of which conditions and modifiers are not allowed at certain
136 times. For each condition and modifier, there's a bitmap of dis-allowed times.
137 For some, it is easier to specify the negation of a small number of allowed
143 static condition_def conditions[] = {
144 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
146 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
148 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
149 ACL_BIT_PREDATA | ACL_BIT_DATA |
153 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
155 ACL_BIT_NOTSMTP_START),
158 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
159 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
160 ACL_BIT_CONNECT | ACL_BIT_HELO,
162 #ifdef EXPERIMENTAL_BRIGHTMAIL
163 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
165 ACL_BIT_CONNECT | ACL_BIT_HELO |
166 ACL_BIT_DATA | ACL_BIT_MIME |
167 # ifndef DISABLE_PRDR
170 ACL_BIT_ETRN | ACL_BIT_EXPN |
172 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
173 ACL_BIT_VRFY | ACL_BIT_PREDATA |
174 ACL_BIT_NOTSMTP_START,
177 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
178 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
180 /* Certain types of control are always allowed, so we let it through
181 always and check in the control processing itself. */
182 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
184 #ifdef EXPERIMENTAL_DCC
185 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
188 # ifndef DISABLE_PRDR
194 #ifdef WITH_CONTENT_SCAN
195 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
198 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
200 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
201 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
204 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
207 /* Explicit key lookups can be made in non-smtp ACLs so pass
208 always and check in the verify processing itself. */
209 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
211 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
213 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
219 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
220 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
224 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
226 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
227 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
229 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
231 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
238 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
239 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
240 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
242 #ifdef WITH_CONTENT_SCAN
243 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
246 # ifndef DISABLE_PRDR
253 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
254 #ifdef WITH_CONTENT_SCAN
255 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
258 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
266 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
267 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
269 #ifdef WITH_CONTENT_SCAN
270 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
273 # ifndef DISABLE_PRDR
281 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
283 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
284 ACL_BIT_PREDATA | ACL_BIT_DATA |
288 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
289 ACL_BIT_NOTSMTP_START),
291 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
292 ACL_BIT_AUTH | ACL_BIT_CONNECT |
294 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
295 ACL_BIT_ETRN | ACL_BIT_EXPN |
296 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
298 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
299 ACL_BIT_AUTH | ACL_BIT_CONNECT |
301 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
302 ACL_BIT_ETRN | ACL_BIT_EXPN |
303 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
306 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
308 #ifdef WITH_CONTENT_SCAN
309 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
310 (unsigned int) ~(ACL_BIT_DATA |
311 # ifndef DISABLE_PRDR
318 [ACLC_SPF] = { US"spf", TRUE, FALSE,
319 ACL_BIT_AUTH | ACL_BIT_CONNECT |
320 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
321 ACL_BIT_ETRN | ACL_BIT_EXPN |
322 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
323 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
325 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
326 ACL_BIT_AUTH | ACL_BIT_CONNECT |
327 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
328 ACL_BIT_ETRN | ACL_BIT_EXPN |
329 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
330 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
333 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
335 /* Certain types of verify are always allowed, so we let it through
336 always and check in the verify function itself */
337 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
342 /* Return values from decode_control(); used as index so keep in step
343 with the controls_list table that follows! */
346 CONTROL_AUTH_UNADVERTISED,
347 #ifdef EXPERIMENTAL_BRIGHTMAIL
350 CONTROL_CASEFUL_LOCAL_PART,
351 CONTROL_CASELOWER_LOCAL_PART,
352 CONTROL_CUTTHROUGH_DELIVERY,
358 CONTROL_DMARC_VERIFY,
359 CONTROL_DMARC_FORENSIC,
362 CONTROL_ENFORCE_SYNC,
363 CONTROL_ERROR, /* pseudo-value for decode errors */
368 CONTROL_NO_CALLOUT_FLUSH,
369 CONTROL_NO_DELAY_FLUSH,
370 CONTROL_NO_ENFORCE_SYNC,
371 #ifdef WITH_CONTENT_SCAN
372 CONTROL_NO_MBOX_UNSPOOL,
374 CONTROL_NO_MULTILINE,
375 CONTROL_NO_PIPELINING,
379 CONTROL_SUPPRESS_LOCAL_FIXUPS,
381 CONTROL_UTF8_DOWNCONVERT,
387 /* Structure listing various control arguments, with their characteristics.
388 For each control, there's a bitmap of dis-allowed times. For some, it is easier
389 to specify the negation of a small number of allowed times. */
391 typedef struct control_def {
393 BOOL has_option; /* Has /option(s) following */
394 unsigned forbids; /* bitmap of dis-allowed times */
397 static control_def controls_list[] = {
398 /* name has_option forbids */
399 [CONTROL_AUTH_UNADVERTISED] =
400 { US"allow_auth_unadvertised", FALSE,
402 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
404 #ifdef EXPERIMENTAL_BRIGHTMAIL
406 { US"bmi_run", FALSE, 0 },
408 [CONTROL_CASEFUL_LOCAL_PART] =
409 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
410 [CONTROL_CASELOWER_LOCAL_PART] =
411 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
412 [CONTROL_CUTTHROUGH_DELIVERY] =
413 { US"cutthrough_delivery", TRUE, 0 },
415 { US"debug", TRUE, 0 },
418 [CONTROL_DKIM_VERIFY] =
419 { US"dkim_disable_verify", FALSE,
420 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
421 # ifndef DISABLE_PRDR
424 ACL_BIT_NOTSMTP_START
429 [CONTROL_DMARC_VERIFY] =
430 { US"dmarc_disable_verify", FALSE,
431 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
433 [CONTROL_DMARC_FORENSIC] =
434 { US"dmarc_enable_forensic", FALSE,
435 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
441 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
443 [CONTROL_ENFORCE_SYNC] =
444 { US"enforce_sync", FALSE,
445 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
448 /* Pseudo-value for decode errors */
450 { US"error", FALSE, 0 },
452 [CONTROL_FAKEDEFER] =
453 { US"fakedefer", TRUE,
455 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
456 ACL_BIT_PREDATA | ACL_BIT_DATA |
462 [CONTROL_FAKEREJECT] =
463 { US"fakereject", TRUE,
465 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
466 ACL_BIT_PREDATA | ACL_BIT_DATA |
475 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
476 ACL_BIT_PREDATA | ACL_BIT_DATA |
477 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
478 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
481 [CONTROL_NO_CALLOUT_FLUSH] =
482 { US"no_callout_flush", FALSE,
483 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
485 [CONTROL_NO_DELAY_FLUSH] =
486 { US"no_delay_flush", FALSE,
487 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
490 [CONTROL_NO_ENFORCE_SYNC] =
491 { US"no_enforce_sync", FALSE,
492 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
494 #ifdef WITH_CONTENT_SCAN
495 [CONTROL_NO_MBOX_UNSPOOL] =
496 { US"no_mbox_unspool", FALSE,
498 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
499 ACL_BIT_PREDATA | ACL_BIT_DATA |
500 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
504 [CONTROL_NO_MULTILINE] =
505 { US"no_multiline_responses", FALSE,
506 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
508 [CONTROL_NO_PIPELINING] =
509 { US"no_pipelining", FALSE,
510 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
516 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
517 ACL_BIT_PREDATA | ACL_BIT_DATA |
518 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
519 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
522 [CONTROL_SUBMISSION] =
523 { US"submission", TRUE,
525 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
527 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
528 { US"suppress_local_fixups", FALSE,
530 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
531 ACL_BIT_NOTSMTP_START)
534 [CONTROL_UTF8_DOWNCONVERT] =
535 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
540 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
541 caches its result in a tree to avoid repeated DNS queries. The result is an
542 integer code which is used as an index into the following tables of
543 explanatory strings and verification return codes. */
545 static tree_node *csa_cache = NULL;
547 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
548 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
550 /* The acl_verify_csa() return code is translated into an acl_verify() return
551 code using the following table. It is OK unless the client is definitely not
552 authorized. This is because CSA is supposed to be optional for sending sites,
553 so recipients should not be too strict about checking it - especially because
554 DNS problems are quite likely to occur. It's possible to use $csa_status in
555 further ACL conditions to distinguish ok, unknown, and defer if required, but
556 the aim is to make the usual configuration simple. */
558 static int csa_return_code[] = {
561 [CSA_DEFER_SRV] = OK,
562 [CSA_DEFER_ADDR] = OK,
563 [CSA_FAIL_EXPLICIT] = FAIL,
564 [CSA_FAIL_DOMAIN] = FAIL,
565 [CSA_FAIL_NOADDR] = FAIL,
566 [CSA_FAIL_MISMATCH] = FAIL
569 static uschar *csa_status_string[] = {
570 [CSA_UNKNOWN] = US"unknown",
572 [CSA_DEFER_SRV] = US"defer",
573 [CSA_DEFER_ADDR] = US"defer",
574 [CSA_FAIL_EXPLICIT] = US"fail",
575 [CSA_FAIL_DOMAIN] = US"fail",
576 [CSA_FAIL_NOADDR] = US"fail",
577 [CSA_FAIL_MISMATCH] = US"fail"
580 static uschar *csa_reason_string[] = {
581 [CSA_UNKNOWN] = US"unknown",
583 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
584 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
585 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
586 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
587 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
588 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
591 /* Options for the ratelimit condition. Note that there are two variants of
592 the per_rcpt option, depending on the ACL that is used to measure the rate.
593 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
594 so the two variants must have the same internal representation as well as
595 the same configuration string. */
598 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
599 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
602 #define RATE_SET(var,new) \
603 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
605 static uschar *ratelimit_option_string[] = {
606 [RATE_PER_WHAT] = US"?",
607 [RATE_PER_CLASH] = US"!",
608 [RATE_PER_ADDR] = US"per_addr",
609 [RATE_PER_BYTE] = US"per_byte",
610 [RATE_PER_CMD] = US"per_cmd",
611 [RATE_PER_CONN] = US"per_conn",
612 [RATE_PER_MAIL] = US"per_mail",
613 [RATE_PER_RCPT] = US"per_rcpt",
614 [RATE_PER_ALLRCPTS] = US"per_rcpt"
617 /* Enable recursion between acl_check_internal() and acl_check_condition() */
619 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
623 /*************************************************
624 * Find control in list *
625 *************************************************/
627 /* The lists are always in order, so binary chop can be used.
630 name the control name to search for
631 ol the first entry in the control list
632 last one more than the offset of the last entry in the control list
634 Returns: index of a control entry, or -1 if not found
638 find_control(const uschar * name, control_def * ol, int last)
640 for (int first = 0; last > first; )
642 int middle = (first + last)/2;
643 uschar * s = ol[middle].name;
644 int c = Ustrncmp(name, s, Ustrlen(s));
645 if (c == 0) return middle;
646 else if (c > 0) first = middle + 1;
654 /*************************************************
655 * Pick out condition from list *
656 *************************************************/
658 /* Use a binary chop method
662 list list of conditions
665 Returns: offset in list, or -1 if not found
669 acl_checkcondition(uschar * name, condition_def * list, int end)
671 for (int start = 0; start < end; )
673 int mid = (start + end)/2;
674 int c = Ustrcmp(name, list[mid].name);
675 if (c == 0) return mid;
676 if (c < 0) end = mid;
677 else start = mid + 1;
683 /*************************************************
684 * Pick out name from list *
685 *************************************************/
687 /* Use a binary chop method
694 Returns: offset in list, or -1 if not found
698 acl_checkname(uschar *name, uschar **list, int end)
700 for (int start = 0; start < end; )
702 int mid = (start + end)/2;
703 int c = Ustrcmp(name, list[mid]);
704 if (c == 0) return mid;
705 if (c < 0) end = mid; else start = mid + 1;
712 /*************************************************
713 * Read and parse one ACL *
714 *************************************************/
716 /* This function is called both from readconf in order to parse the ACLs in the
717 configuration file, and also when an ACL is encountered dynamically (e.g. as
718 the result of an expansion). It is given a function to call in order to
719 retrieve the lines of the ACL. This function handles skipping comments and
720 blank lines (where relevant).
723 func function to get next line of ACL
724 error where to put an error message
726 Returns: pointer to ACL, or NULL
727 NULL can be legal (empty ACL); in this case error will be NULL
731 acl_read(uschar *(*func)(void), uschar **error)
733 acl_block *yield = NULL;
734 acl_block **lastp = &yield;
735 acl_block *this = NULL;
736 acl_condition_block *cond;
737 acl_condition_block **condp = NULL;
742 while ((s = (*func)()))
745 BOOL negated = FALSE;
746 uschar *saveline = s;
749 /* Conditions (but not verbs) are allowed to be negated by an initial
752 if (Uskip_whitespace(&s) == '!')
758 /* Read the name of a verb or a condition, or the start of a new ACL, which
759 can be started by a name, or by a macro definition. */
761 s = readconf_readname(name, sizeof(name), s);
762 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
764 /* If a verb is unrecognized, it may be another condition or modifier that
765 continues the previous verb. */
767 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
771 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
783 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
786 this = store_get(sizeof(acl_block), FALSE);
788 lastp = &(this->next);
790 this->condition = NULL;
792 this->srcline = config_lineno; /* for debug output */
793 this->srcfile = config_filename; /**/
794 condp = &(this->condition);
795 if (*s == 0) continue; /* No condition on this line */
801 s = readconf_readname(name, sizeof(name), s); /* Condition name */
804 /* Handle a condition or modifier. */
806 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
808 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
813 /* The modifiers may not be negated */
815 if (negated && conditions[c].is_modifier)
817 *error = string_sprintf("ACL error: negation is not allowed with "
818 "\"%s\"", conditions[c].name);
822 /* ENDPASS may occur only with ACCEPT or DISCARD. */
824 if (c == ACLC_ENDPASS &&
825 this->verb != ACL_ACCEPT &&
826 this->verb != ACL_DISCARD)
828 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
829 conditions[c].name, verbs[this->verb]);
833 cond = store_get(sizeof(acl_condition_block), FALSE);
836 cond->u.negated = negated;
839 condp = &(cond->next);
841 /* The "set" modifier is different in that its argument is "name=value"
842 rather than just a value, and we can check the validity of the name, which
843 gives us a variable name to insert into the data block. The original ACL
844 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
845 extended to 20 of each type, but after that people successfully argued for
846 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
847 After that, we allow alphanumerics and underscores, but the first character
848 after c or m must be a digit or an underscore. This retains backwards
853 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
854 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
856 uschar * endptr = s+18;
858 if (isalnum(*endptr))
860 *error = string_sprintf("invalid variable name after \"set\" in ACL "
861 "modifier \"set %s\" "
862 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
866 cond->u.varname = string_copyn(s, 18);
868 Uskip_whitespace(&s);
875 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
877 *error = string_sprintf("invalid variable name after \"set\" in ACL "
878 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
883 if (!isdigit(*endptr) && *endptr != '_')
885 *error = string_sprintf("invalid variable name after \"set\" in ACL "
886 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
891 while (*endptr && *endptr != '=' && !isspace(*endptr))
893 if (!isalnum(*endptr) && *endptr != '_')
895 *error = string_sprintf("invalid character \"%c\" in variable name "
896 "in ACL modifier \"set %s\"", *endptr, s);
902 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
904 Uskip_whitespace(&s);
907 /* For "set", we are now positioned for the data. For the others, only
908 "endpass" has no data */
910 if (c != ACLC_ENDPASS)
914 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
915 conditions[c].is_modifier ? US"modifier" : US"condition");
918 Uskip_whitespace(&s);
919 cond->arg = string_copy(s);
928 /*************************************************
929 * Set up added header line(s) *
930 *************************************************/
932 /* This function is called by the add_header modifier, and also from acl_warn()
933 to implement the now-deprecated way of adding header lines using "message" on a
934 "warn" verb. The argument is treated as a sequence of header lines which are
935 added to a chain, provided there isn't an identical one already there.
937 Argument: string of header lines
942 setup_header(const uschar *hstring)
945 int hlen = Ustrlen(hstring);
947 /* Ignore any leading newlines */
948 while (*hstring == '\n') hstring++, hlen--;
950 /* An empty string does nothing; ensure exactly one final newline. */
951 if (hlen <= 0) return;
952 if (hstring[--hlen] != '\n') /* no newline */
953 q = string_sprintf("%s\n", hstring);
954 else if (hstring[hlen-1] == '\n') /* double newline */
956 uschar * s = string_copy(hstring);
957 while(s[--hlen] == '\n')
964 /* Loop for multiple header lines, taking care about continuations */
966 for (p = q; *p; p = q)
970 int newtype = htype_add_bot;
971 header_line **hptr = &acl_added_headers;
973 /* Find next header line within the string */
977 q = Ustrchr(q, '\n'); /* we know there was a newline */
978 if (*++q != ' ' && *q != '\t') break;
981 /* If the line starts with a colon, interpret the instruction for where to
982 add it. This temporarily sets up a new type. */
986 if (strncmpic(p, US":after_received:", 16) == 0)
988 newtype = htype_add_rec;
991 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
993 newtype = htype_add_rfc;
996 else if (strncmpic(p, US":at_start:", 10) == 0)
998 newtype = htype_add_top;
1001 else if (strncmpic(p, US":at_end:", 8) == 0)
1003 newtype = htype_add_bot;
1006 while (*p == ' ' || *p == '\t') p++;
1009 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1010 to the front of it. */
1012 for (s = p; s < q - 1; s++)
1013 if (*s == ':' || !isgraph(*s)) break;
1015 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1016 hlen = Ustrlen(hdr);
1018 /* See if this line has already been added */
1022 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1023 hptr = &(*hptr)->next;
1026 /* Add if not previously present */
1030 /* The header_line struct itself is not tainted, though it points to
1031 possibly tainted data. */
1032 header_line * h = store_get(sizeof(header_line), FALSE);
1045 /*************************************************
1046 * List the added header lines *
1047 *************************************************/
1053 for (header_line * h = acl_added_headers; h; h = h->next)
1056 if (h->text[i-1] == '\n') i--;
1057 g = string_append_listele_n(g, '\n', h->text, i);
1060 return g ? g->s : NULL;
1064 /*************************************************
1065 * Set up removed header line(s) *
1066 *************************************************/
1068 /* This function is called by the remove_header modifier. The argument is
1069 treated as a sequence of header names which are added to a colon separated
1070 list, provided there isn't an identical one already there.
1072 Argument: string of header names
1077 setup_remove_header(const uschar *hnames)
1080 acl_removed_headers = acl_removed_headers
1081 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1082 : string_copy(hnames);
1087 /*************************************************
1089 *************************************************/
1091 /* This function is called when a WARN verb's conditions are true. It adds to
1092 the message's headers, and/or writes information to the log. In each case, this
1093 only happens once (per message for headers, per connection for log).
1095 ** NOTE: The header adding action using the "message" setting is historic, and
1096 its use is now deprecated. The new add_header modifier should be used instead.
1099 where ACL_WHERE_xxxx indicating which ACL this is
1100 user_message message for adding to headers
1101 log_message message for logging, if different
1107 acl_warn(int where, uschar *user_message, uschar *log_message)
1109 if (log_message != NULL && log_message != user_message)
1112 string_item *logged;
1114 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1115 string_printing(log_message));
1117 /* If a sender verification has failed, and the log message is "sender verify
1118 failed", add the failure message. */
1120 if (sender_verified_failed != NULL &&
1121 sender_verified_failed->message != NULL &&
1122 strcmpic(log_message, US"sender verify failed") == 0)
1123 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1125 /* Search previously logged warnings. They are kept in malloc
1126 store so they can be freed at the start of a new message. */
1128 for (logged = acl_warn_logged; logged; logged = logged->next)
1129 if (Ustrcmp(logged->text, text) == 0) break;
1133 int length = Ustrlen(text) + 1;
1134 log_write(0, LOG_MAIN, "%s", text);
1135 logged = store_malloc(sizeof(string_item) + length);
1136 logged->text = US logged + sizeof(string_item);
1137 memcpy(logged->text, text, length);
1138 logged->next = acl_warn_logged;
1139 acl_warn_logged = logged;
1143 /* If there's no user message, we are done. */
1145 if (!user_message) return;
1147 /* If this isn't a message ACL, we can't do anything with a user message.
1150 if (where > ACL_WHERE_NOTSMTP)
1152 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1153 "found in a non-message (%s) ACL: cannot specify header lines here: "
1154 "message ignored", acl_wherenames[where]);
1158 /* The code for setting up header lines is now abstracted into a separate
1159 function so that it can be used for the add_header modifier as well. */
1161 setup_header(user_message);
1166 /*************************************************
1167 * Verify and check reverse DNS *
1168 *************************************************/
1170 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1171 address if this has not yet been done. The host_name_lookup() function checks
1172 that one of these names resolves to an address list that contains the client IP
1173 address, so we don't actually have to do the check here.
1176 user_msgptr pointer for user message
1177 log_msgptr pointer for log message
1179 Returns: OK verification condition succeeded
1180 FAIL verification failed
1181 DEFER there was a problem verifying
1185 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1189 /* Previous success */
1191 if (sender_host_name != NULL) return OK;
1193 /* Previous failure */
1195 if (host_lookup_failed)
1197 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1201 /* Need to do a lookup */
1204 debug_printf_indent("looking up host name to force name/address consistency check\n");
1206 if ((rc = host_name_lookup()) != OK)
1208 *log_msgptr = rc == DEFER
1209 ? US"host lookup deferred for reverse lookup check"
1210 : string_sprintf("host lookup failed for reverse lookup check%s",
1212 return rc; /* DEFER or FAIL */
1215 host_build_sender_fullhost();
1221 /*************************************************
1222 * Check client IP address matches CSA target *
1223 *************************************************/
1225 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1226 response for address records belonging to the CSA target hostname. The section
1227 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1228 If one of the addresses matches the client's IP address, then the client is
1229 authorized by CSA. If there are target IP addresses but none of them match
1230 then the client is using an unauthorized IP address. If there are no target IP
1231 addresses then the client cannot be using an authorized IP address. (This is
1232 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1235 dnsa the DNS answer block
1236 dnss a DNS scan block for us to use
1237 reset option specifying what portion to scan, as described above
1238 target the target hostname to use for matching RR names
1240 Returns: CSA_OK successfully authorized
1241 CSA_FAIL_MISMATCH addresses found but none matched
1242 CSA_FAIL_NOADDR no target addresses found
1246 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1249 int rc = CSA_FAIL_NOADDR;
1251 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1253 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1255 /* Check this is an address RR for the target hostname. */
1259 && rr->type != T_AAAA
1263 if (strcmpic(target, rr->name) != 0) continue;
1265 rc = CSA_FAIL_MISMATCH;
1267 /* Turn the target address RR into a list of textual IP addresses and scan
1268 the list. There may be more than one if it is an A6 RR. */
1270 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1272 /* If the client IP address matches the target IP address, it's good! */
1274 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1276 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1280 /* If we found some target addresses but none of them matched, the client is
1281 using an unauthorized IP address, otherwise the target has no authorized IP
1289 /*************************************************
1290 * Verify Client SMTP Authorization *
1291 *************************************************/
1293 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1294 to find the CSA SRV record corresponding to the domain argument, or
1295 $sender_helo_name if no argument is provided. It then checks that the
1296 client is authorized, and that its IP address corresponds to the SRV
1297 target's address by calling acl_verify_csa_address() above. The address
1298 should have been returned in the DNS response's ADDITIONAL section, but if
1299 not we perform another DNS lookup to get it.
1302 domain pointer to optional parameter following verify = csa
1304 Returns: CSA_UNKNOWN no valid CSA record found
1305 CSA_OK successfully authorized
1306 CSA_FAIL_* client is definitely not authorized
1307 CSA_DEFER_* there was a DNS problem
1311 acl_verify_csa(const uschar *domain)
1314 const uschar *found;
1315 int priority, weight, port;
1316 dns_answer * dnsa = store_get_dns_answer();
1322 /* Work out the domain we are using for the CSA lookup. The default is the
1323 client's HELO domain. If the client has not said HELO, use its IP address
1324 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1326 while (isspace(*domain) && *domain != '\0') ++domain;
1327 if (*domain == '\0') domain = sender_helo_name;
1328 if (domain == NULL) domain = sender_host_address;
1329 if (sender_host_address == NULL) return CSA_UNKNOWN;
1331 /* If we have an address literal, strip off the framing ready for turning it
1332 into a domain. The framing consists of matched square brackets possibly
1333 containing a keyword and a colon before the actual IP address. */
1335 if (domain[0] == '[')
1337 const uschar *start = Ustrchr(domain, ':');
1338 if (start == NULL) start = domain;
1339 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1342 /* Turn domains that look like bare IP addresses into domains in the reverse
1343 DNS. This code also deals with address literals and $sender_host_address. It's
1344 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1345 address literals, but it's probably the most friendly thing to do. This is an
1346 extension to CSA, so we allow it to be turned off for proper conformance. */
1348 if (string_is_ip_address(domain, NULL) != 0)
1350 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1351 domain = dns_build_reverse(domain);
1354 /* Find out if we've already done the CSA check for this domain. If we have,
1355 return the same result again. Otherwise build a new cached result structure
1356 for this domain. The name is filled in now, and the value is filled in when
1357 we return from this function. */
1359 t = tree_search(csa_cache, domain);
1360 if (t != NULL) return t->data.val;
1362 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
1363 Ustrcpy(t->name, domain);
1364 (void)tree_insertnode(&csa_cache, t);
1366 /* Now we are ready to do the actual DNS lookup(s). */
1369 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1371 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1374 return t->data.val = CSA_DEFER_SRV;
1376 /* If we found nothing, the client's authorization is unknown. */
1380 return t->data.val = CSA_UNKNOWN;
1382 /* We got something! Go on to look at the reply in more detail. */
1388 /* Scan the reply for well-formed CSA SRV records. */
1390 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1392 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1394 const uschar * p = rr->data;
1396 /* Extract the numerical SRV fields (p is incremented) */
1398 GETSHORT(priority, p);
1399 GETSHORT(weight, p);
1403 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1405 /* Check the CSA version number */
1407 if (priority != 1) continue;
1409 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1410 found by dns_special_lookup() is a parent of the one we asked for), we check
1411 the subdomain assertions in the port field. At the moment there's only one
1412 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1413 SRV records of their own. */
1415 if (Ustrcmp(found, domain) != 0)
1416 return t->data.val = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1418 /* This CSA SRV record refers directly to our domain, so we check the value
1419 in the weight field to work out the domain's authorization. 0 and 1 are
1420 unauthorized; 3 means the client is authorized but we can't check the IP
1421 address in order to authenticate it, so we treat it as unknown; values
1422 greater than 3 are undefined. */
1424 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1426 if (weight > 2) continue;
1428 /* Weight == 2, which means the domain is authorized. We must check that the
1429 client's IP address is listed as one of the SRV target addresses. Save the
1430 target hostname then break to scan the additional data for its addresses. */
1432 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1433 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1435 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1440 /* If we didn't break the loop then no appropriate records were found. */
1442 if (!rr) return t->data.val = CSA_UNKNOWN;
1444 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1445 A target of "." indicates there are no valid addresses, so the client cannot
1446 be authorized. (This is an odd configuration because weight=2 target=. is
1447 equivalent to weight=1, but we check for it in order to keep load off the
1448 root name servers.) Note that dn_expand() turns "." into "". */
1450 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1452 /* Scan the additional section of the CSA SRV reply for addresses belonging
1453 to the target. If the name server didn't return any additional data (e.g.
1454 because it does not fully support SRV records), we need to do another lookup
1455 to obtain the target addresses; otherwise we have a definitive result. */
1457 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1458 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1460 /* The DNS lookup type corresponds to the IP version used by the client. */
1463 if (Ustrchr(sender_host_address, ':') != NULL)
1466 #endif /* HAVE_IPV6 */
1470 lookup_dnssec_authenticated = NULL;
1471 switch (dns_lookup(dnsa, target, type, NULL))
1473 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1476 return t->data.val = CSA_DEFER_ADDR;
1478 /* If the query succeeded, scan the addresses and return the result. */
1481 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1482 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1483 /* else fall through */
1485 /* If the target has no IP addresses, the client cannot have an authorized
1486 IP address. However, if the target site uses A6 records (not AAAA records)
1487 we have to do yet another lookup in order to check them. */
1491 return t->data.val = CSA_FAIL_NOADDR;
1497 /*************************************************
1498 * Handle verification (address & other) *
1499 *************************************************/
1501 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1502 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1503 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1508 unsigned where_allowed; /* bitmap */
1509 BOOL no_options; /* Never has /option(s) following */
1510 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1512 static verify_type_t verify_type_list[] = {
1513 /* name value where no-opt opt-sep */
1514 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1515 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1516 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1517 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1518 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BITS_HAVEDATA, TRUE, 0 },
1519 { US"not_blind", VERIFY_NOT_BLIND, ACL_BITS_HAVEDATA, FALSE, 0 },
1520 { US"header_sender", VERIFY_HDR_SNDR, ACL_BITS_HAVEDATA, FALSE, 0 },
1521 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1522 | ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1524 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1525 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BITS_HAVEDATA, TRUE, 0 },
1526 #ifdef EXPERIMENTAL_ARC
1527 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1532 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1533 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1534 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1535 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1541 BOOL has_option; /* Has =option(s) following */
1542 BOOL timeval; /* Has a time value */
1544 static callout_opt_t callout_opt_list[] = {
1545 /* name value flag has-opt has-time */
1546 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1547 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1548 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1549 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1550 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1551 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1552 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1553 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1554 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1555 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1556 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1557 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1558 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1564 v_period(const uschar * s, const uschar * arg, uschar ** log_msgptr)
1567 if ((period = readconf_readtime(s, 0, FALSE)) < 0)
1569 *log_msgptr = string_sprintf("bad time value in ACL condition "
1570 "\"verify %s\"", arg);
1577 /* This function implements the "verify" condition. It is called when
1578 encountered in any ACL, because some tests are almost always permitted. Some
1579 just don't make sense, and always fail (for example, an attempt to test a host
1580 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1583 where where called from
1584 addr the recipient address that the ACL is handling, or NULL
1585 arg the argument of "verify"
1586 user_msgptr pointer for user message
1587 log_msgptr pointer for log message
1588 basic_errno where to put verify errno
1590 Returns: OK verification condition succeeded
1591 FAIL verification failed
1592 DEFER there was a problem verifying
1597 acl_verify(int where, address_item *addr, const uschar *arg,
1598 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1602 int callout_overall = -1;
1603 int callout_connect = -1;
1604 int verify_options = 0;
1606 BOOL verify_header_sender = FALSE;
1607 BOOL defer_ok = FALSE;
1608 BOOL callout_defer_ok = FALSE;
1609 BOOL no_details = FALSE;
1610 BOOL success_on_redirect = FALSE;
1612 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
1613 address_item *sender_vaddr = NULL;
1614 uschar *verify_sender_address = NULL;
1615 uschar *pm_mailfrom = NULL;
1616 uschar *se_mailfrom = NULL;
1618 /* Some of the verify items have slash-separated options; some do not. Diagnose
1619 an error if options are given for items that don't expect them.
1622 uschar *slash = Ustrchr(arg, '/');
1623 const uschar *list = arg;
1624 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1627 if (!ss) goto BAD_VERIFY;
1629 /* Handle name/address consistency verification in a separate function. */
1631 for (vp = verify_type_list;
1632 CS vp < CS verify_type_list + sizeof(verify_type_list);
1635 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1636 : strcmpic (ss, vp->name) == 0)
1638 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1641 if (vp->no_options && slash)
1643 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1644 "(this verify item has no options)", arg);
1647 if (!(vp->where_allowed & BIT(where)))
1649 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1650 vp->name, acl_wherenames[where]);
1655 case VERIFY_REV_HOST_LKUP:
1656 if (!sender_host_address) return OK;
1657 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1658 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1659 if (strcmpic(ss, US"defer_ok") == 0)
1664 /* TLS certificate verification is done at STARTTLS time; here we just
1665 test whether it was successful or not. (This is for optional verification; for
1666 mandatory verification, the connection doesn't last this long.) */
1668 if (tls_in.certificate_verified) return OK;
1669 *user_msgptr = US"no verified certificate";
1673 /* We can test the result of optional HELO verification that might have
1674 occurred earlier. If not, we can attempt the verification now. */
1676 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1677 return f.helo_verified ? OK : FAIL;
1680 /* Do Client SMTP Authorization checks in a separate function, and turn the
1681 result code into user-friendly strings. */
1683 rc = acl_verify_csa(list);
1684 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1685 csa_reason_string[rc]);
1686 csa_status = csa_status_string[rc];
1687 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1688 return csa_return_code[rc];
1690 #ifdef EXPERIMENTAL_ARC
1692 { /* Do Authenticated Received Chain checks in a separate function. */
1693 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1697 if (!(arc_state = acl_verify_arc())) return DEFER;
1698 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1699 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1701 if (!condlist) condlist = US"none:pass";
1702 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1703 if (Ustrcmp(arc_state, cond) == 0) return OK;
1708 case VERIFY_HDR_SYNTAX:
1709 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1710 a syntax error, we return details of the error to the sender if configured to
1711 send out full details. (But a "message" setting on the ACL can override, as
1714 rc = verify_check_headers(log_msgptr);
1715 if (rc != OK && *log_msgptr)
1716 if (smtp_return_error_details)
1717 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1719 acl_verify_message = *log_msgptr;
1722 case VERIFY_HDR_NAMES_ASCII:
1723 /* Check that all header names are true 7 bit strings
1724 See RFC 5322, 2.2. and RFC 6532, 3. */
1726 rc = verify_check_header_names_ascii(log_msgptr);
1727 if (rc != OK && smtp_return_error_details && *log_msgptr)
1728 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1731 case VERIFY_NOT_BLIND:
1732 /* Check that no recipient of this message is "blind", that is, every envelope
1733 recipient must be mentioned in either To: or Cc:. */
1735 BOOL case_sensitive = TRUE;
1737 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1738 if (strcmpic(ss, US"case_insensitive") == 0)
1739 case_sensitive = FALSE;
1742 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1743 "condition \"verify %s\"", ss, arg);
1747 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1749 *log_msgptr = US"bcc recipient detected";
1750 if (smtp_return_error_details)
1751 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1756 /* The remaining verification tests check recipient and sender addresses,
1757 either from the envelope or from the header. There are a number of
1758 slash-separated options that are common to all of them. */
1760 case VERIFY_HDR_SNDR:
1761 verify_header_sender = TRUE;
1765 /* In the case of a sender, this can optionally be followed by an address to use
1766 in place of the actual sender (rare special-case requirement). */
1770 verify_sender_address = sender_address;
1773 while (isspace(*s)) s++;
1774 if (*s++ != '=') goto BAD_VERIFY;
1775 while (isspace(*s)) s++;
1776 verify_sender_address = string_copy(s);
1787 /* Remaining items are optional; they apply to sender and recipient
1788 verification, including "header sender" verification. */
1790 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1792 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1793 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1794 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1796 /* These two old options are left for backwards compatibility */
1798 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1800 callout_defer_ok = TRUE;
1801 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1804 else if (strcmpic(ss, US"check_postmaster") == 0)
1807 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1810 /* The callout option has a number of sub-options, comma separated */
1812 else if (strncmpic(ss, US"callout", 7) == 0)
1814 callout = CALLOUT_TIMEOUT_DEFAULT;
1817 while (isspace(*ss)) ss++;
1820 const uschar * sublist = ss;
1823 while (isspace(*sublist)) sublist++;
1824 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1827 double period = 1.0F;
1829 for (op= callout_opt_list; op->name; op++)
1830 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1833 verify_options |= op->flag;
1836 opt += Ustrlen(op->name);
1837 while (isspace(*opt)) opt++;
1840 *log_msgptr = string_sprintf("'=' expected after "
1841 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1844 while (isspace(*opt)) opt++;
1846 if (op->timeval && (period = v_period(opt, arg, log_msgptr)) < 0)
1851 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1852 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1853 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1854 case CALLOUT_MAILFROM:
1855 if (!verify_header_sender)
1857 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1858 "callout option only for verify=header_sender (detected in ACL "
1859 "condition \"%s\")", arg);
1862 se_mailfrom = string_copy(opt);
1864 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1865 case CALLOUT_MAXWAIT: callout_overall = period; break;
1866 case CALLOUT_CONNECT: callout_connect = period; break;
1867 case CALLOUT_TIME: callout = period; break;
1873 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1874 "ACL condition \"%s\"", arg);
1880 /* The quota option has sub-options, comma-separated */
1882 else if (strncmpic(ss, US"quota", 5) == 0)
1887 while (isspace(*ss)) ss++;
1890 const uschar * sublist = ss;
1894 while (isspace(*sublist)) sublist++;
1895 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1896 if (Ustrncmp(opt, "cachepos=", 9) == 0)
1897 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1900 quota_pos_cache = period;
1901 else if (Ustrncmp(opt, "cacheneg=", 9) == 0)
1902 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1905 quota_neg_cache = period;
1906 else if (Ustrcmp(opt, "no_cache") == 0)
1907 quota_pos_cache = quota_neg_cache = 0;
1912 /* Option not recognized */
1916 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1917 "condition \"verify %s\"", ss, arg);
1922 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1923 (vopt_callout_recipsender|vopt_callout_recippmaster))
1925 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1926 "for a recipient callout";
1930 /* Handle quota verification */
1933 if (vp->value != VERIFY_RCPT)
1935 *log_msgptr = US"can only verify quota of recipient";
1939 if ((rc = verify_quota_call(addr->address,
1940 quota_pos_cache, quota_neg_cache, log_msgptr)) != OK)
1942 *basic_errno = errno;
1943 if (smtp_return_error_details)
1945 if (!*user_msgptr && *log_msgptr)
1946 *user_msgptr = string_sprintf("Rejected after %s: %s",
1947 smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]],
1949 if (rc == DEFER) f.acl_temp_details = TRUE;
1956 /* Handle sender-in-header verification. Default the user message to the log
1957 message if giving out verification details. */
1959 if (verify_header_sender)
1963 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1964 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1967 *basic_errno = verrno;
1968 if (smtp_return_error_details)
1970 if (!*user_msgptr && *log_msgptr)
1971 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1972 if (rc == DEFER) f.acl_temp_details = TRUE;
1977 /* Handle a sender address. The default is to verify *the* sender address, but
1978 optionally a different address can be given, for special requirements. If the
1979 address is empty, we are dealing with a bounce message that has no sender, so
1980 we cannot do any checking. If the real sender address gets rewritten during
1981 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1982 during message reception.
1984 A list of verified "sender" addresses is kept to try to avoid doing to much
1985 work repetitively when there are multiple recipients in a message and they all
1986 require sender verification. However, when callouts are involved, it gets too
1987 complicated because different recipients may require different callout options.
1988 Therefore, we always do a full sender verify when any kind of callout is
1989 specified. Caching elsewhere, for instance in the DNS resolver and in the
1990 callout handling, should ensure that this is not terribly inefficient. */
1992 else if (verify_sender_address)
1994 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
1996 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1997 "sender verify callout";
2001 sender_vaddr = verify_checked_sender(verify_sender_address);
2002 if ( sender_vaddr /* Previously checked */
2003 && callout <= 0) /* No callout needed this time */
2005 /* If the "routed" flag is set, it means that routing worked before, so
2006 this check can give OK (the saved return code value, if set, belongs to a
2007 callout that was done previously). If the "routed" flag is not set, routing
2008 must have failed, so we use the saved return code. */
2010 if (testflag(sender_vaddr, af_verify_routed))
2014 rc = sender_vaddr->special_action;
2015 *basic_errno = sender_vaddr->basic_errno;
2017 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
2020 /* Do a new verification, and cache the result. The cache is used to avoid
2021 verifying the sender multiple times for multiple RCPTs when callouts are not
2022 specified (see comments above).
2024 The cache is also used on failure to give details in response to the first
2025 RCPT that gets bounced for this reason. However, this can be suppressed by
2026 the no_details option, which sets the flag that says "this detail has already
2027 been sent". The cache normally contains just one address, but there may be
2028 more in esoteric circumstances. */
2033 uschar *save_address_data = deliver_address_data;
2035 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2037 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2039 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2040 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2043 if (no_details) setflag(sender_vaddr, af_sverify_told);
2044 if (verify_sender_address[0] != 0)
2046 /* If this is the real sender address, save the unrewritten version
2047 for use later in receive. Otherwise, set a flag so that rewriting the
2048 sender in verify_address() does not update sender_address. */
2050 if (verify_sender_address == sender_address)
2051 sender_address_unrewritten = sender_address;
2053 verify_options |= vopt_fake_sender;
2055 if (success_on_redirect)
2056 verify_options |= vopt_success_on_redirect;
2058 /* The recipient, qualify, and expn options are never set in
2061 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2062 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2064 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2067 *basic_errno = sender_vaddr->basic_errno;
2070 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2071 debug_printf_indent("sender %s verified ok as %s\n",
2072 verify_sender_address, sender_vaddr->address);
2074 debug_printf_indent("sender %s verified ok\n",
2075 verify_sender_address);
2078 rc = OK; /* Null sender */
2080 /* Cache the result code */
2082 if (routed) setflag(sender_vaddr, af_verify_routed);
2083 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2084 sender_vaddr->special_action = rc;
2085 sender_vaddr->next = sender_verified_list;
2086 sender_verified_list = sender_vaddr;
2088 /* Restore the recipient address data, which might have been clobbered by
2089 the sender verification. */
2091 deliver_address_data = save_address_data;
2094 /* Put the sender address_data value into $sender_address_data */
2096 sender_address_data = sender_vaddr->prop.address_data;
2099 /* A recipient address just gets a straightforward verify; again we must handle
2100 the DEFER overrides. */
2106 if (success_on_redirect)
2107 verify_options |= vopt_success_on_redirect;
2109 /* We must use a copy of the address for verification, because it might
2113 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2114 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2115 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2117 *basic_errno = addr2.basic_errno;
2118 *log_msgptr = addr2.message;
2119 *user_msgptr = addr2.user_message ? addr2.user_message : addr2.message;
2121 /* Allow details for temporary error if the address is so flagged. */
2122 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2124 /* Make $address_data visible */
2125 deliver_address_data = addr2.prop.address_data;
2128 /* We have a result from the relevant test. Handle defer overrides first. */
2132 || callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER
2135 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2136 defer_ok? "defer_ok" : "callout_defer_ok");
2140 /* If we've failed a sender, set up a recipient message, and point
2141 sender_verified_failed to the address item that actually failed. */
2143 if (rc != OK && verify_sender_address)
2146 *log_msgptr = *user_msgptr = US"Sender verify failed";
2147 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2148 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2151 *log_msgptr = US"Could not complete sender verify callout";
2152 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2156 sender_verified_failed = sender_vaddr;
2159 /* Verifying an address messes up the values of $domain and $local_part,
2160 so reset them before returning if this is a RCPT ACL. */
2164 deliver_domain = addr->domain;
2165 deliver_localpart = addr->local_part;
2169 /* Syntax errors in the verify argument come here. */
2172 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2173 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2174 "or \"reverse_host_lookup\" at start of ACL condition "
2175 "\"verify %s\"", arg);
2182 /*************************************************
2183 * Check argument for control= modifier *
2184 *************************************************/
2186 /* Called from acl_check_condition() below.
2187 To handle the case "queue_only" we accept an _ in the
2188 initial / option-switch position.
2191 arg the argument string for control=
2192 pptr set to point to the terminating character
2193 where which ACL we are in
2194 log_msgptr for error messages
2196 Returns: CONTROL_xxx value
2200 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2206 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2207 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2208 && (!d->has_option || c != '/' && c != '_')
2211 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2212 return CONTROL_ERROR;
2222 /*************************************************
2223 * Return a ratelimit error *
2224 *************************************************/
2226 /* Called from acl_ratelimit() below
2229 log_msgptr for error messages
2230 format format string
2231 ... supplementary arguments
2237 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2241 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2243 va_start(ap, format);
2244 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2247 gstring_release_unused(g);
2248 *log_msgptr = string_from_gstring(g);
2255 /*************************************************
2256 * Handle rate limiting *
2257 *************************************************/
2259 /* Called by acl_check_condition() below to calculate the result
2260 of the ACL ratelimit condition.
2262 Note that the return value might be slightly unexpected: if the
2263 sender's rate is above the limit then the result is OK. This is
2264 similar to the dnslists condition, and is so that you can write
2265 ACL clauses like: defer ratelimit = 15 / 1h
2268 arg the option string for ratelimit=
2269 where ACL_WHERE_xxxx indicating which ACL this is
2270 log_msgptr for error messages
2272 Returns: OK - Sender's rate is above limit
2273 FAIL - Sender's rate is below limit
2274 DEFER - Problem opening ratelimit database
2275 ERROR - Syntax error in options.
2279 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2281 double limit, period, count;
2284 uschar *unique = NULL;
2286 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2287 BOOL noupdate = FALSE, badacl = FALSE;
2288 int mode = RATE_PER_WHAT;
2290 tree_node **anchor, *t;
2291 open_db dbblock, *dbm;
2293 dbdata_ratelimit *dbd;
2294 dbdata_ratelimit_unique *dbdb;
2297 /* Parse the first two options and record their values in expansion
2298 variables. These variables allow the configuration to have informative
2299 error messages based on rate limits obtained from a table lookup. */
2301 /* First is the maximum number of messages per period / maximum burst
2302 size, which must be greater than or equal to zero. Zero is useful for
2303 rate measurement as opposed to rate limiting. */
2305 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2306 return ratelimit_error(log_msgptr, "sender rate limit not set");
2308 limit = Ustrtod(sender_rate_limit, &ss);
2309 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2310 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2311 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2313 if (limit < 0.0 || *ss != '\0')
2314 return ratelimit_error(log_msgptr,
2315 "\"%s\" is not a positive number", sender_rate_limit);
2317 /* Second is the rate measurement period / exponential smoothing time
2318 constant. This must be strictly greater than zero, because zero leads to
2319 run-time division errors. */
2321 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2322 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2324 return ratelimit_error(log_msgptr,
2325 "\"%s\" is not a time value", sender_rate_period);
2327 /* By default we are counting one of something, but the per_rcpt,
2328 per_byte, and count options can change this. */
2332 /* Parse the other options. */
2334 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2336 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2337 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2338 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2339 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2340 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2341 else if (strcmpic(ss, US"per_conn") == 0)
2343 RATE_SET(mode, PER_CONN);
2344 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2347 else if (strcmpic(ss, US"per_mail") == 0)
2349 RATE_SET(mode, PER_MAIL);
2350 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2352 else if (strcmpic(ss, US"per_rcpt") == 0)
2354 /* If we are running in the RCPT ACL, then we'll count the recipients
2355 one by one, but if we are running when we have accumulated the whole
2356 list then we'll add them all in one batch. */
2357 if (where == ACL_WHERE_RCPT)
2358 RATE_SET(mode, PER_RCPT);
2359 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2360 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2361 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2362 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2364 else if (strcmpic(ss, US"per_byte") == 0)
2366 /* If we have not yet received the message data and there was no SIZE
2367 declaration on the MAIL command, then it's safe to just use a value of
2368 zero and let the recorded rate decay as if nothing happened. */
2369 RATE_SET(mode, PER_MAIL);
2370 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2371 else count = message_size < 0 ? 0.0 : (double)message_size;
2373 else if (strcmpic(ss, US"per_addr") == 0)
2375 RATE_SET(mode, PER_RCPT);
2376 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2377 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2379 else if (strncmpic(ss, US"count=", 6) == 0)
2382 count = Ustrtod(ss+6, &e);
2383 if (count < 0.0 || *e != '\0')
2384 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2386 else if (strncmpic(ss, US"unique=", 7) == 0)
2387 unique = string_copy(ss + 7);
2389 key = string_copy(ss);
2391 key = string_sprintf("%s/%s", key, ss);
2394 /* Sanity check. When the badacl flag is set the update mode must either
2395 be readonly (which is the default if it is omitted) or, for backwards
2396 compatibility, a combination of noupdate and strict or leaky. */
2398 if (mode == RATE_PER_CLASH)
2399 return ratelimit_error(log_msgptr, "conflicting per_* options");
2400 if (leaky + strict + readonly > 1)
2401 return ratelimit_error(log_msgptr, "conflicting update modes");
2402 if (badacl && (leaky || strict) && !noupdate)
2403 return ratelimit_error(log_msgptr,
2404 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2405 ratelimit_option_string[mode], acl_wherenames[where]);
2407 /* Set the default values of any unset options. In readonly mode we
2408 perform the rate computation without any increment so that its value
2409 decays to eventually allow over-limit senders through. */
2411 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2412 if (badacl) readonly = TRUE;
2413 if (readonly) count = 0.0;
2414 if (!strict && !readonly) leaky = TRUE;
2415 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2417 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2418 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2419 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2420 are added to the key because they alter the meaning of the stored data. */
2423 key = !sender_host_address ? US"" : sender_host_address;
2425 key = string_sprintf("%s/%s/%s%s",
2427 ratelimit_option_string[mode],
2428 unique == NULL ? "" : "unique/",
2432 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2434 /* See if we have already computed the rate by looking in the relevant tree.
2435 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2436 pool so that they survive across resets. In readonly mode we only remember the
2437 result for the rest of this command in case a later command changes it. After
2438 this bit of logic the code is independent of the per_* mode. */
2440 old_pool = store_pool;
2443 anchor = &ratelimiters_cmd;
2447 anchor = &ratelimiters_conn;
2448 store_pool = POOL_PERM;
2452 case RATE_PER_ALLRCPTS:
2453 anchor = &ratelimiters_mail;
2458 anchor = &ratelimiters_cmd;
2461 anchor = NULL; /* silence an "unused" complaint */
2462 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2463 "internal ACL error: unknown ratelimit mode %d", mode);
2467 if ((t = tree_search(*anchor, key)))
2470 /* The following few lines duplicate some of the code below. */
2471 rc = (dbd->rate < limit)? FAIL : OK;
2472 store_pool = old_pool;
2473 sender_rate = string_sprintf("%.1f", dbd->rate);
2475 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2479 /* We aren't using a pre-computed rate, so get a previously recorded rate
2480 from the database, which will be updated and written back if required. */
2482 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2484 store_pool = old_pool;
2486 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2487 *log_msgptr = US"ratelimit database not available";
2490 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2493 gettimeofday(&tv, NULL);
2497 /* Locate the basic ratelimit block inside the DB data. */
2498 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2501 /* Forget the old Bloom filter if it is too old, so that we count each
2502 repeating event once per period. We don't simply clear and re-use the old
2503 filter because we want its size to change if the limit changes. Note that
2504 we keep the dbd pointer for copying the rate into the new data block. */
2506 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2508 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2514 if(unique && dbdb_size < sizeof(*dbdb))
2516 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2521 /* Allocate a new data block if the database lookup failed
2522 or the Bloom filter passed its age limit. */
2528 /* No Bloom filter. This basic ratelimit block is initialized below. */
2529 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2530 dbdb_size = sizeof(*dbd);
2531 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2536 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2538 /* See the long comment below for an explanation of the magic number 2.
2539 The filter has a minimum size in case the rate limit is very small;
2540 this is determined by the definition of dbdata_ratelimit_unique. */
2542 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2543 if (extra < 0) extra = 0;
2544 dbdb_size = sizeof(*dbdb) + extra;
2545 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2546 dbdb->bloom_epoch = tv.tv_sec;
2547 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2548 memset(dbdb->bloom, 0, dbdb->bloom_size);
2550 /* Preserve any basic ratelimit data (which is our longer-term memory)
2551 by copying it from the discarded block. */
2561 /* If we are counting unique events, find out if this event is new or not.
2562 If the client repeats the event during the current period then it should be
2563 counted. We skip this code in readonly mode for efficiency, because any
2564 changes to the filter will be discarded and because count is already set to
2567 if (unique && !readonly)
2569 /* We identify unique events using a Bloom filter. (You can find my
2570 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2571 With the per_addr option, an "event" is a recipient address, though the
2572 user can use the unique option to define their own events. We only count
2573 an event if we have not seen it before.
2575 We size the filter according to the rate limit, which (in leaky mode)
2576 is the limit on the population of the filter. We allow 16 bits of space
2577 per entry (see the construction code above) and we set (up to) 8 of them
2578 when inserting an element (see the loop below). The probability of a false
2579 positive (an event we have not seen before but which we fail to count) is
2583 allzero = exp(-numhash * pop / size)
2584 = exp(-0.5 * pop / limit)
2585 fpr = pow(1 - allzero, numhash)
2587 For senders at the limit the fpr is 0.06% or 1 in 1700
2588 and for senders at half the limit it is 0.0006% or 1 in 170000
2590 In strict mode the Bloom filter can fill up beyond the normal limit, in
2591 which case the false positive rate will rise. This means that the
2592 measured rate for very fast senders can bogusly drop off after a while.
2594 At twice the limit, the fpr is 2.5% or 1 in 40
2595 At four times the limit, it is 31% or 1 in 3.2
2597 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2598 decay below the limit, and if this is more than one then the Bloom filter
2599 will be discarded before the decay gets that far. The false positive rate
2600 at this threshold is 9.3% or 1 in 10.7. */
2603 unsigned n, hash, hinc;
2607 /* Instead of using eight independent hash values, we combine two values
2608 using the formula h1 + n * h2. This does not harm the Bloom filter's
2609 performance, and means the amount of hash we need is independent of the
2610 number of bits we set in the filter. */
2612 md5_start(&md5info);
2613 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2614 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2615 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2617 /* Scan the bits corresponding to this event. A zero bit means we have
2618 not seen it before. Ensure all bits are set to record this event. */
2620 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2623 for (n = 0; n < 8; n++, hash += hinc)
2625 int bit = 1 << (hash % 8);
2626 int byte = (hash / 8) % dbdb->bloom_size;
2627 if ((dbdb->bloom[byte] & bit) == 0)
2629 dbdb->bloom[byte] |= bit;
2634 /* If this event has occurred before, do not count it. */
2638 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2642 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2645 /* If there was no previous ratelimit data block for this key, initialize
2646 the new one, otherwise update the block from the database. The initial rate
2647 is what would be computed by the code below for an infinite interval. */
2651 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2653 dbd->time_stamp = tv.tv_sec;
2654 dbd->time_usec = tv.tv_usec;
2659 /* The smoothed rate is computed using an exponentially weighted moving
2660 average adjusted for variable sampling intervals. The standard EWMA for
2661 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2662 where f() is the measured value and f'() is the smoothed value.
2664 Old data decays out of the smoothed value exponentially, such that data n
2665 samples old is multiplied by a^n. The exponential decay time constant p
2666 is defined such that data p samples old is multiplied by 1/e, which means
2667 that a = exp(-1/p). We can maintain the same time constant for a variable
2668 sampling interval i by using a = exp(-i/p).
2670 The rate we are measuring is messages per period, suitable for directly
2671 comparing with the limit. The average rate between now and the previous
2672 message is period / interval, which we feed into the EWMA as the sample.
2674 It turns out that the number of messages required for the smoothed rate
2675 to reach the limit when they are sent in a burst is equal to the limit.
2676 This can be seen by analysing the value of the smoothed rate after N
2677 messages sent at even intervals. Let k = (1 - a) * p/i
2679 rate_1 = (1 - a) * p/i + a * rate_0
2681 rate_2 = k + a * rate_1
2682 = k + a * k + a^2 * rate_0
2683 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2684 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2685 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2686 = rate_0 * a^N + p/i * (1 - a^N)
2688 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2690 rate_N = p/i + (rate_0 - p/i) * a^N
2691 a^N = (rate_N - p/i) / (rate_0 - p/i)
2692 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2693 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2695 Numerical analysis of the above equation, setting the computed rate to
2696 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2697 rates, p/i, the number of messages N = limit. So limit serves as both the
2698 maximum rate measured in messages per period, and the maximum number of
2699 messages that can be sent in a fast burst. */
2701 double this_time = (double)tv.tv_sec
2702 + (double)tv.tv_usec / 1000000.0;
2703 double prev_time = (double)dbd->time_stamp
2704 + (double)dbd->time_usec / 1000000.0;
2706 /* We must avoid division by zero, and deal gracefully with the clock going
2707 backwards. If we blunder ahead when time is in reverse then the computed
2708 rate will be bogus. To be safe we clamp interval to a very small number. */
2710 double interval = this_time - prev_time <= 0.0 ? 1e-9
2711 : this_time - prev_time;
2713 double i_over_p = interval / period;
2714 double a = exp(-i_over_p);
2716 /* Combine the instantaneous rate (period / interval) with the previous rate
2717 using the smoothing factor a. In order to measure sized events, multiply the
2718 instantaneous rate by the count of bytes or recipients etc. */
2720 dbd->time_stamp = tv.tv_sec;
2721 dbd->time_usec = tv.tv_usec;
2722 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2724 /* When events are very widely spaced the computed rate tends towards zero.
2725 Although this is accurate it turns out not to be useful for our purposes,
2726 especially when the first event after a long silence is the start of a spam
2727 run. A more useful model is that the rate for an isolated event should be the
2728 size of the event per the period size, ignoring the lack of events outside
2729 the current period and regardless of where the event falls in the period. So,
2730 if the interval was so long that the calculated rate is unhelpfully small, we
2731 re-initialize the rate. In the absence of higher-rate bursts, the condition
2732 below is true if the interval is greater than the period. */
2734 if (dbd->rate < count) dbd->rate = count;
2737 /* Clients sending at the limit are considered to be over the limit.
2738 This matters for edge cases such as a limit of zero, when the client
2739 should be completely blocked. */
2741 rc = dbd->rate < limit ? FAIL : OK;
2743 /* Update the state if the rate is low or if we are being strict. If we
2744 are in leaky mode and the sender's rate is too high, we do not update
2745 the recorded rate in order to avoid an over-aggressive sender's retry
2746 rate preventing them from getting any email through. If readonly is set,
2747 neither leaky nor strict are set, so we do not do any updates. */
2749 if ((rc == FAIL && leaky) || strict)
2751 dbfn_write(dbm, key, dbdb, dbdb_size);
2752 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2756 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2757 readonly? "readonly mode" : "over the limit, but leaky");
2762 /* Store the result in the tree for future reference. Take the taint status
2763 from the key for consistency even though it's unlikely we'll ever expand this. */
2765 t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
2767 Ustrcpy(t->name, key);
2768 (void)tree_insertnode(anchor, t);
2770 /* We create the formatted version of the sender's rate very late in
2771 order to ensure that it is done using the correct storage pool. */
2773 store_pool = old_pool;
2774 sender_rate = string_sprintf("%.1f", dbd->rate);
2777 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2784 /*************************************************
2785 * The udpsend ACL modifier *
2786 *************************************************/
2788 /* Called by acl_check_condition() below.
2791 arg the option string for udpsend=
2792 log_msgptr for error messages
2794 Returns: OK - Completed.
2795 DEFER - Problem with DNS lookup.
2796 ERROR - Syntax error in options.
2800 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2812 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2813 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2817 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2822 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2827 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2830 portnum = Ustrtol(portstr, &portend, 10);
2831 if (*portend != '\0')
2833 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2837 /* Make a single-item host list. */
2838 h = store_get(sizeof(host_item), FALSE);
2839 memset(h, 0, sizeof(host_item));
2844 if (string_is_ip_address(hostname, NULL))
2845 h->address = hostname, r = HOST_FOUND;
2847 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2848 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2850 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2855 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2857 /*XXX this could better use sendto */
2858 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2859 1, NULL, &errstr, NULL);
2860 if (r < 0) goto defer;
2862 r = send(s, arg, len, 0);
2865 errstr = US strerror(errno);
2873 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2878 debug_printf_indent("udpsend %d bytes\n", r);
2883 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2889 /*************************************************
2890 * Handle conditions/modifiers on an ACL item *
2891 *************************************************/
2893 /* Called from acl_check() below.
2897 cb ACL condition block - if NULL, result is OK
2898 where where called from
2899 addr the address being checked for RCPT, or NULL
2900 level the nesting level
2901 epp pointer to pass back TRUE if "endpass" encountered
2902 (applies only to "accept" and "discard")
2903 user_msgptr user message pointer
2904 log_msgptr log message pointer
2905 basic_errno pointer to where to put verify error
2907 Returns: OK - all conditions are met
2908 DISCARD - an "acl" condition returned DISCARD - only allowed
2909 for "accept" or "discard" verbs
2910 FAIL - at least one condition fails
2911 FAIL_DROP - an "acl" condition returned FAIL_DROP
2912 DEFER - can't tell at the moment (typically, lookup defer,
2913 but can be temporary callout problem)
2914 ERROR - ERROR from nested ACL or expansion failure or other
2919 acl_check_condition(int verb, acl_condition_block *cb, int where,
2920 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2921 uschar **log_msgptr, int *basic_errno)
2923 uschar *user_message = NULL;
2924 uschar *log_message = NULL;
2926 #ifdef WITH_CONTENT_SCAN
2930 for (; cb; cb = cb->next)
2935 /* The message and log_message items set up messages to be used in
2936 case of rejection. They are expanded later. */
2938 if (cb->type == ACLC_MESSAGE)
2940 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2941 user_message = cb->arg;
2945 if (cb->type == ACLC_LOG_MESSAGE)
2947 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
2948 log_message = cb->arg;
2952 /* The endpass "condition" just sets a flag to show it occurred. This is
2953 checked at compile time to be on an "accept" or "discard" item. */
2955 if (cb->type == ACLC_ENDPASS)
2961 /* For other conditions and modifiers, the argument is expanded now for some
2962 of them, but not for all, because expansion happens down in some lower level
2963 checking functions in some cases. */
2965 if (!conditions[cb->type].expand_at_top)
2967 else if (!(arg = expand_string(cb->arg)))
2969 if (f.expand_string_forcedfail) continue;
2970 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2971 cb->arg, expand_string_message);
2972 return f.search_find_defer ? DEFER : ERROR;
2975 /* Show condition, and expanded condition if it's different */
2980 debug_printf_indent("check %s%s %n",
2981 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
2982 conditions[cb->type].name, &lhswidth);
2984 if (cb->type == ACLC_SET)
2986 #ifndef DISABLE_DKIM
2987 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
2988 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
2990 debug_printf("%s ", cb->u.varname);
2996 debug_printf("acl_%s ", cb->u.varname);
2997 lhswidth += 5 + Ustrlen(cb->u.varname);
3001 debug_printf("= %s\n", cb->arg);
3004 debug_printf("%.*s= %s\n", lhswidth,
3008 /* Check that this condition makes sense at this time */
3010 if ((conditions[cb->type].forbids & (1 << where)) != 0)
3012 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3013 conditions[cb->type].is_modifier ? "use" : "test",
3014 conditions[cb->type].name, acl_wherenames[where]);
3018 /* Run the appropriate test for each condition, or take the appropriate
3019 action for the remaining modifiers. */
3023 case ACLC_ADD_HEADER:
3027 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3031 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
3032 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3034 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3035 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3041 case ACLC_AUTHENTICATED:
3042 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
3043 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
3046 #ifdef EXPERIMENTAL_BRIGHTMAIL
3047 case ACLC_BMI_OPTIN:
3049 int old_pool = store_pool;
3050 store_pool = POOL_PERM;
3051 bmi_current_optin = string_copy(arg);
3052 store_pool = old_pool;
3057 case ACLC_CONDITION:
3058 /* The true/false parsing here should be kept in sync with that used in
3059 expand.c when dealing with ECOND_BOOL so that we don't have too many
3060 different definitions of what can be a boolean. */
3062 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3063 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3064 rc = (Uatoi(arg) == 0)? FAIL : OK;
3066 rc = (strcmpic(arg, US"no") == 0 ||
3067 strcmpic(arg, US"false") == 0)? FAIL :
3068 (strcmpic(arg, US"yes") == 0 ||
3069 strcmpic(arg, US"true") == 0)? OK : DEFER;
3071 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3074 case ACLC_CONTINUE: /* Always succeeds */
3079 const uschar *p = NULL;
3080 control_type = decode_control(arg, &p, where, log_msgptr);
3082 /* Check if this control makes sense at this time */
3084 if (controls_list[control_type].forbids & (1 << where))
3086 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3087 controls_list[control_type].name, acl_wherenames[where]);
3091 switch(control_type)
3093 case CONTROL_AUTH_UNADVERTISED:
3094 f.allow_auth_unadvertised = TRUE;
3097 #ifdef EXPERIMENTAL_BRIGHTMAIL
3098 case CONTROL_BMI_RUN:
3103 #ifndef DISABLE_DKIM
3104 case CONTROL_DKIM_VERIFY:
3105 f.dkim_disable_verify = TRUE;
3106 # ifdef SUPPORT_DMARC
3107 /* Since DKIM was blocked, skip DMARC too */
3108 f.dmarc_disable_verify = TRUE;
3109 f.dmarc_enable_forensic = FALSE;
3114 #ifdef SUPPORT_DMARC
3115 case CONTROL_DMARC_VERIFY:
3116 f.dmarc_disable_verify = TRUE;
3119 case CONTROL_DMARC_FORENSIC:
3120 f.dmarc_enable_forensic = TRUE;
3127 int fd, af, level, optname, value;
3128 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3129 a socket; we can accept that, we'll just debug-log failures anyway. */
3130 fd = fileno(smtp_in);
3131 if ((af = ip_get_address_family(fd)) < 0)
3134 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3138 if (dscp_lookup(p+1, af, &level, &optname, &value))
3139 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3141 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3142 p+1, strerror(errno));
3146 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3150 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3156 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3164 case CONTROL_CASEFUL_LOCAL_PART:
3165 deliver_localpart = addr->cc_local_part;
3168 case CONTROL_CASELOWER_LOCAL_PART:
3169 deliver_localpart = addr->lc_local_part;
3172 case CONTROL_ENFORCE_SYNC:
3173 smtp_enforce_sync = TRUE;
3176 case CONTROL_NO_ENFORCE_SYNC:
3177 smtp_enforce_sync = FALSE;
3180 #ifdef WITH_CONTENT_SCAN
3181 case CONTROL_NO_MBOX_UNSPOOL:
3182 f.no_mbox_unspool = TRUE;
3186 case CONTROL_NO_MULTILINE:
3187 f.no_multiline_responses = TRUE;
3190 case CONTROL_NO_PIPELINING:
3191 f.pipelining_enable = FALSE;
3194 case CONTROL_NO_DELAY_FLUSH:
3195 f.disable_delay_flush = TRUE;
3198 case CONTROL_NO_CALLOUT_FLUSH:
3199 f.disable_callout_flush = TRUE;
3202 case CONTROL_FAKEREJECT:
3203 cancel_cutthrough_connection(TRUE, US"fakereject");
3204 case CONTROL_FAKEDEFER:
3205 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3208 const uschar *pp = p + 1;
3210 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
3213 else /* Explicitly reset to default string */
3214 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3217 case CONTROL_FREEZE:
3218 f.deliver_freeze = TRUE;
3219 deliver_frozen_at = time(NULL);
3220 freeze_tell = freeze_tell_config; /* Reset to configured value */
3221 if (Ustrncmp(p, "/no_tell", 8) == 0)
3228 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3231 cancel_cutthrough_connection(TRUE, US"item frozen");
3235 f.queue_only_policy = TRUE;
3236 if (Ustrcmp(p, "_only") == 0)
3238 else while (*p == '/')
3239 if (Ustrncmp(p, "/only", 5) == 0)
3240 { p += 5; f.queue_smtp = FALSE; }
3241 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3242 { p += 17; f.queue_smtp = TRUE; }
3245 cancel_cutthrough_connection(TRUE, US"queueing forced");
3248 case CONTROL_SUBMISSION:
3249 originator_name = US"";
3250 f.submission_mode = TRUE;
3253 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3256 f.active_local_sender_retain = TRUE;
3257 f.active_local_from_check = FALSE;
3259 else if (Ustrncmp(p, "/domain=", 8) == 0)
3261 const uschar *pp = p + 8;
3262 while (*pp && *pp != '/') pp++;
3263 submission_domain = string_copyn(p+8, pp-p-8);
3266 /* The name= option must be last, because it swallows the rest of
3268 else if (Ustrncmp(p, "/name=", 6) == 0)
3270 const uschar *pp = p + 6;
3272 submission_name = parse_fix_phrase(p+6, pp-p-6);
3279 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3286 uschar * debug_tag = NULL;
3287 uschar * debug_opts = NULL;
3292 const uschar * pp = p+1;
3293 if (Ustrncmp(pp, "tag=", 4) == 0)
3295 for (pp += 4; *pp && *pp != '/';) pp++;
3296 debug_tag = string_copyn(p+5, pp-p-5);
3298 else if (Ustrncmp(pp, "opts=", 5) == 0)
3300 for (pp += 5; *pp && *pp != '/';) pp++;
3301 debug_opts = string_copyn(p+6, pp-p-6);
3303 else if (Ustrncmp(pp, "kill", 4) == 0)
3305 for (pp += 4; *pp && *pp != '/';) pp++;
3309 while (*pp && *pp != '/') pp++;
3314 debug_logging_stop();
3316 debug_logging_activate(debug_tag, debug_opts);
3320 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3321 f.suppress_local_fixups = TRUE;
3324 case CONTROL_CUTTHROUGH_DELIVERY:
3326 uschar * ignored = NULL;
3327 #ifndef DISABLE_PRDR
3332 /* Too hard to think about for now. We might in future cutthrough
3333 the case where both sides handle prdr and this-node prdr acl
3335 ignored = US"PRDR active";
3336 else if (f.deliver_freeze)
3337 ignored = US"frozen";
3338 else if (f.queue_only_policy)
3339 ignored = US"queue-only";
3340 else if (fake_response == FAIL)
3341 ignored = US"fakereject";
3342 else if (rcpt_count != 1)
3343 ignored = US"nonfirst rcpt";
3344 else if (cutthrough.delivery)
3345 ignored = US"repeated";
3346 else if (cutthrough.callout_hold_only)
3349 debug_printf_indent(" cutthrough request upgrades callout hold\n");
3350 cutthrough.callout_hold_only = FALSE;
3351 cutthrough.delivery = TRUE; /* control accepted */
3355 cutthrough.delivery = TRUE; /* control accepted */
3358 const uschar * pp = p+1;
3359 if (Ustrncmp(pp, "defer=", 6) == 0)
3362 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3363 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3366 while (*pp && *pp != '/') pp++;
3371 DEBUG(D_acl) if (ignored)
3372 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3377 case CONTROL_UTF8_DOWNCONVERT:
3382 message_utf8_downconvert = 1;
3383 addr->prop.utf8_downcvt = TRUE;
3384 addr->prop.utf8_downcvt_maybe = FALSE;
3390 message_utf8_downconvert = 0;
3391 addr->prop.utf8_downcvt = FALSE;
3392 addr->prop.utf8_downcvt_maybe = FALSE;
3396 if (p[1] == '-' && p[2] == '1')
3398 message_utf8_downconvert = -1;
3399 addr->prop.utf8_downcvt = FALSE;
3400 addr->prop.utf8_downcvt_maybe = TRUE;
3404 *log_msgptr = US"bad option value for control=utf8_downconvert";
3408 message_utf8_downconvert = 1;
3409 addr->prop.utf8_downcvt = TRUE;
3410 addr->prop.utf8_downcvt_maybe = FALSE;
3420 #ifdef EXPERIMENTAL_DCC
3423 /* Separate the regular expression and any optional parameters. */
3424 const uschar * list = arg;
3425 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3426 /* Run the dcc backend. */
3427 rc = dcc_process(&ss);
3428 /* Modify return code based upon the existence of options. */
3429 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3430 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3431 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3436 #ifdef WITH_CONTENT_SCAN
3438 rc = mime_decode(&arg);
3444 int delay = readconf_readtime(arg, 0, FALSE);
3447 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3448 "modifier: \"%s\" is not a time value", arg);
3453 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3458 debug_printf_indent("delay skipped in -bh checking mode\n");
3461 /* NOTE 1: Remember that we may be
3462 dealing with stdin/stdout here, in addition to TCP/IP connections.
3463 Also, delays may be specified for non-SMTP input, where smtp_out and
3464 smtp_in will be NULL. Whatever is done must work in all cases.
3466 NOTE 2: The added feature of flushing the output before a delay must
3467 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3472 if (smtp_out && !f.disable_delay_flush)
3475 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3481 p.fd = fileno(smtp_out);
3482 p.events = POLLRDHUP;
3485 if (poll(&p, n, delay*1000) > 0)
3486 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3489 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3490 TCP/IP connection has gone away without reading from it. This means
3491 that we cannot shorten the delay below if the client goes away,
3492 because we cannot discover that the client has closed its end of the
3493 connection. (The connection is actually in a half-closed state,
3494 waiting for the server to close its end.) It would be nice to be able
3495 to detect this state, so that the Exim process is not held up
3496 unnecessarily. However, it seems that we can't. The poll() function
3497 does not do the right thing, and in any case it is not always
3500 while (delay > 0) delay = sleep(delay);
3507 #ifndef DISABLE_DKIM
3508 case ACLC_DKIM_SIGNER:
3509 if (dkim_cur_signer)
3510 rc = match_isinlist(dkim_cur_signer,
3511 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3516 case ACLC_DKIM_STATUS:
3517 rc = match_isinlist(dkim_verify_status,
3518 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3522 #ifdef SUPPORT_DMARC
3523 case ACLC_DMARC_STATUS:
3524 if (!f.dmarc_has_been_checked)
3526 f.dmarc_has_been_checked = TRUE;
3527 /* used long way of dmarc_exim_expand_query() in case we need more
3528 * view into the process in the future. */
3529 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3530 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
3535 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3539 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3540 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3543 /* The value in tls_cipher is the full cipher name, for example,
3544 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3545 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3546 what may in practice come out of the SSL library - which at the time of
3547 writing is poorly documented. */
3549 case ACLC_ENCRYPTED:
3550 if (tls_in.cipher == NULL) rc = FAIL; else
3552 uschar *endcipher = NULL;
3553 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3554 if (!cipher) cipher = tls_in.cipher; else
3556 endcipher = Ustrchr(++cipher, ':');
3557 if (endcipher) *endcipher = 0;
3559 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3560 if (endcipher) *endcipher = ':';
3564 /* Use verify_check_this_host() instead of verify_check_host() so that
3565 we can pass over &host_data to catch any looked up data. Once it has been
3566 set, it retains its value so that it's still there if another ACL verb
3567 comes through here and uses the cache. However, we must put it into
3568 permanent store in case it is also expected to be used in a subsequent
3569 message in the same SMTP connection. */
3572 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3573 sender_host_address ? sender_host_address : US"", CUSS &host_data);
3574 if (rc == DEFER) *log_msgptr = search_error_message;
3575 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3578 case ACLC_LOCAL_PARTS:
3579 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3580 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3581 CUSS &deliver_localpart_data);
3584 case ACLC_LOG_REJECT_TARGET:
3588 const uschar *s = arg;
3590 while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
3592 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3593 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3594 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3597 logbits |= LOG_MAIN|LOG_REJECT;
3598 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3599 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3602 log_reject_target = logbits;
3609 const uschar *s = arg;
3615 if (Ustrncmp(s, "main", 4) == 0)
3616 { logbits |= LOG_MAIN; s += 4; }
3617 else if (Ustrncmp(s, "panic", 5) == 0)
3618 { logbits |= LOG_PANIC; s += 5; }
3619 else if (Ustrncmp(s, "reject", 6) == 0)
3620 { logbits |= LOG_REJECT; s += 6; }
3623 logbits = LOG_MAIN|LOG_PANIC;
3624 s = string_sprintf(":unknown log name in \"%s\" in "
3625 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3631 while (isspace(*s)) s++;
3633 if (logbits == 0) logbits = LOG_MAIN;
3634 log_write(0, logbits, "%s", string_printing(s));
3638 #ifdef WITH_CONTENT_SCAN
3639 case ACLC_MALWARE: /* Run the malware backend. */
3641 /* Separate the regular expression and any optional parameters. */
3642 const uschar * list = arg;
3643 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3645 BOOL defer_ok = FALSE;
3648 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3649 if (strcmpic(opt, US"defer_ok") == 0)
3651 else if ( strncmpic(opt, US"tmo=", 4) == 0
3652 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3655 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3659 rc = malware(ss, timeout);
3660 if (rc == DEFER && defer_ok)
3661 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3665 case ACLC_MIME_REGEX:
3666 rc = mime_regex(&arg);
3671 if (is_tainted(arg))
3673 *log_msgptr = string_sprintf("Tainted name '%s' for queue not permitted",
3677 if (Ustrchr(arg, '/'))
3679 *log_msgptr = string_sprintf(
3680 "Directory separator not permitted in queue name: '%s'", arg);
3683 queue_name = string_copy_perm(arg, FALSE);
3686 case ACLC_RATELIMIT:
3687 rc = acl_ratelimit(arg, where, log_msgptr);
3690 case ACLC_RECIPIENTS:
3691 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3692 CUSS &recipient_data);
3695 #ifdef WITH_CONTENT_SCAN
3701 case ACLC_REMOVE_HEADER:
3702 setup_remove_header(arg);
3705 case ACLC_SENDER_DOMAINS:
3708 sdomain = Ustrrchr(sender_address, '@');
3709 sdomain = sdomain ? sdomain + 1 : US"";
3710 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3711 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3716 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3717 sender_address_cache, -1, 0, CUSS &sender_data);
3720 /* Connection variables must persist forever; message variables not */
3724 int old_pool = store_pool;
3725 if ( cb->u.varname[0] != 'm'
3726 #ifndef DISABLE_EVENT
3727 || event_name /* An event is being delivered */
3730 store_pool = POOL_PERM;
3731 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3732 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3733 dkim_verify_status = string_copy(arg);
3734 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3735 dkim_verify_reason = string_copy(arg);
3738 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3739 store_pool = old_pool;
3743 #ifdef WITH_CONTENT_SCAN
3746 /* Separate the regular expression and any optional parameters. */
3747 const uschar * list = arg;
3748 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3750 rc = spam(CUSS &ss);
3751 /* Modify return code based upon the existence of options. */
3752 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3753 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3754 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3761 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3763 case ACLC_SPF_GUESS:
3764 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3769 rc = acl_udpsend(arg, log_msgptr);
3772 /* If the verb is WARN, discard any user message from verification, because
3773 such messages are SMTP responses, not header additions. The latter come
3774 only from explicit "message" modifiers. However, put the user message into
3775 $acl_verify_message so it can be used in subsequent conditions or modifiers
3776 (until something changes it). */
3779 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3781 acl_verify_message = *user_msgptr;
3782 if (verb == ACL_WARN) *user_msgptr = NULL;
3786 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3787 "condition %d", cb->type);
3791 /* If a condition was negated, invert OK/FAIL. */
3793 if (!conditions[cb->type].is_modifier && cb->u.negated)
3794 if (rc == OK) rc = FAIL;
3795 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3797 if (rc != OK) break; /* Conditions loop */
3801 /* If the result is the one for which "message" and/or "log_message" are used,
3802 handle the values of these modifiers. If there isn't a log message set, we make
3803 it the same as the user message.
3805 "message" is a user message that will be included in an SMTP response. Unless
3806 it is empty, it overrides any previously set user message.
3808 "log_message" is a non-user message, and it adds to any existing non-user
3809 message that is already set.
3811 Most verbs have but a single return for which the messages are relevant, but
3812 for "discard", it's useful to have the log message both when it succeeds and
3813 when it fails. For "accept", the message is used in the OK case if there is no
3814 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3817 if (*epp && rc == OK) user_message = NULL;
3819 if ((BIT(rc) & msgcond[verb]) != 0)
3822 uschar *old_user_msgptr = *user_msgptr;
3823 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3825 /* If the verb is "warn", messages generated by conditions (verification or
3826 nested ACLs) are always discarded. This also happens for acceptance verbs
3827 when they actually do accept. Only messages specified at this level are used.
3828 However, the value of an existing message is available in $acl_verify_message
3829 during expansions. */
3831 if (verb == ACL_WARN ||
3832 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3833 *log_msgptr = *user_msgptr = NULL;
3837 acl_verify_message = old_user_msgptr;
3838 expmessage = expand_string(user_message);
3841 if (!f.expand_string_forcedfail)
3842 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3843 user_message, expand_string_message);
3845 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3850 acl_verify_message = old_log_msgptr;
3851 expmessage = expand_string(log_message);
3854 if (!f.expand_string_forcedfail)
3855 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3856 log_message, expand_string_message);
3858 else if (expmessage[0] != 0)
3860 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3861 string_sprintf("%s: %s", expmessage, *log_msgptr);
3865 /* If no log message, default it to the user message */
3867 if (!*log_msgptr) *log_msgptr = *user_msgptr;
3870 acl_verify_message = NULL;
3878 /*************************************************
3879 * Get line from a literal ACL *
3880 *************************************************/
3882 /* This function is passed to acl_read() in order to extract individual lines
3883 of a literal ACL, which we access via static pointers. We can destroy the
3884 contents because this is called only once (the compiled ACL is remembered).
3886 This code is intended to treat the data in the same way as lines in the main
3887 Exim configuration file. That is:
3889 . Leading spaces are ignored.
3891 . A \ at the end of a line is a continuation - trailing spaces after the \
3892 are permitted (this is because I don't believe in making invisible things
3893 significant). Leading spaces on the continued part of a line are ignored.
3895 . Physical lines starting (significantly) with # are totally ignored, and
3896 may appear within a sequence of backslash-continued lines.
3898 . Blank lines are ignored, but will end a sequence of continuations.
3901 Returns: a pointer to the next line
3905 static uschar *acl_text; /* Current pointer in the text */
3906 static uschar *acl_text_end; /* Points one past the terminating '0' */
3914 /* This loop handles leading blank lines and comments. */
3918 Uskip_whitespace(&acl_text); /* Leading spaces/empty lines */
3919 if (!*acl_text) return NULL; /* No more data */
3920 yield = acl_text; /* Potential data line */
3922 while (*acl_text && *acl_text != '\n') acl_text++;
3924 /* If we hit the end before a newline, we have the whole logical line. If
3925 it's a comment, there's no more data to be given. Otherwise, yield it. */
3927 if (!*acl_text) return *yield == '#' ? NULL : yield;
3929 /* After reaching a newline, end this loop if the physical line does not
3930 start with '#'. If it does, it's a comment, and the loop continues. */
3932 if (*yield != '#') break;
3935 /* This loop handles continuations. We know we have some real data, ending in
3936 newline. See if there is a continuation marker at the end (ignoring trailing
3937 white space). We know that *yield is not white space, so no need to test for
3938 cont > yield in the backwards scanning loop. */
3943 for (cont = acl_text - 1; isspace(*cont); cont--);
3945 /* If no continuation follows, we are done. Mark the end of the line and
3954 /* We have encountered a continuation. Skip over whitespace at the start of
3955 the next line, and indeed the whole of the next line or lines if they are
3960 while (*(++acl_text) == ' ' || *acl_text == '\t');
3961 if (*acl_text != '#') break;
3962 while (*(++acl_text) != 0 && *acl_text != '\n');
3965 /* We have the start of a continuation line. Move all the rest of the data
3966 to join onto the previous line, and then find its end. If the end is not a
3967 newline, we are done. Otherwise loop to look for another continuation. */
3969 memmove(cont, acl_text, acl_text_end - acl_text);
3970 acl_text_end -= acl_text - cont;
3972 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3973 if (*acl_text == 0) return yield;
3976 /* Control does not reach here */
3983 /*************************************************
3984 * Check access using an ACL *
3985 *************************************************/
3987 /* This function is called from address_check. It may recurse via
3988 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3989 passed as a string which is expanded. A forced failure implies no access check
3990 is required. If the result is a single word, it is taken as the name of an ACL
3991 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3992 text, complete with newlines, and parsed as such. In both cases, the ACL check
3993 is then run. This function uses an auxiliary function for acl_read() to call
3994 for reading individual lines of a literal ACL. This is acl_getline(), which
3995 appears immediately above.
3998 where where called from
3999 addr address item when called from RCPT; otherwise NULL
4000 s the input string; NULL is the same as an empty ACL => DENY
4001 user_msgptr where to put a user error (for SMTP response)
4002 log_msgptr where to put a logging message (not for SMTP response)
4004 Returns: OK access is granted
4005 DISCARD access is apparently granted...
4006 FAIL access is denied
4007 FAIL_DROP access is denied; drop the connection
4008 DEFER can't tell at the moment
4013 acl_check_internal(int where, address_item *addr, uschar *s,
4014 uschar **user_msgptr, uschar **log_msgptr)
4017 acl_block *acl = NULL;
4018 uschar *acl_name = US"inline ACL";
4021 /* Catch configuration loops */
4025 *log_msgptr = US"ACL nested too deep: possible loop";
4031 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
4035 /* At top level, we expand the incoming string. At lower levels, it has already
4036 been expanded as part of condition processing. */
4040 if (!(ss = expand_string(s)))
4042 if (f.expand_string_forcedfail) return OK;
4043 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4044 expand_string_message);
4050 while (isspace(*ss)) ss++;
4052 /* If we can't find a named ACL, the default is to parse it as an inline one.
4053 (Unless it begins with a slash; non-existent files give rise to an error.) */
4057 /* Handle the case of a string that does not contain any spaces. Look for a
4058 named ACL among those read from the configuration, or a previously read file.
4059 It is possible that the pointer to the ACL is NULL if the configuration
4060 contains a name with no data. If not found, and the text begins with '/',
4061 read an ACL from a file, and save it so it can be re-used. */
4063 if (Ustrchr(ss, ' ') == NULL)
4065 tree_node * t = tree_search(acl_anchor, ss);
4068 if (!(acl = (acl_block *)(t->data.ptr)))
4070 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
4073 acl_name = string_sprintf("ACL \"%s\"", ss);
4074 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
4077 else if (*ss == '/')
4079 struct stat statbuf;
4082 log_write(0, LOG_MAIN|LOG_PANIC,
4083 "attempt to open tainted ACL file name \"%s\"", ss);
4084 /* Avoid leaking info to an attacker */
4085 *log_msgptr = US"internal configuration error";
4088 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4090 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4094 if (fstat(fd, &statbuf) != 0)
4096 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4101 /* If the string being used as a filename is tainted, so is the file content */
4102 acl_text = store_get(statbuf.st_size + 1, is_tainted(ss));
4103 acl_text_end = acl_text + statbuf.st_size + 1;
4105 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4107 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4108 ss, strerror(errno));
4111 acl_text[statbuf.st_size] = 0;
4114 acl_name = string_sprintf("ACL \"%s\"", ss);
4115 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4119 /* Parse an ACL that is still in text form. If it came from a file, remember it
4120 in the ACL tree, having read it into the POOL_PERM store pool so that it
4121 persists between multiple messages. */
4125 int old_pool = store_pool;
4126 if (fd >= 0) store_pool = POOL_PERM;
4127 acl = acl_read(acl_getline, log_msgptr);
4128 store_pool = old_pool;
4129 if (!acl && *log_msgptr) return ERROR;
4132 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), is_tainted(ss));
4133 Ustrcpy(t->name, ss);
4135 (void)tree_insertnode(&acl_anchor, t);
4139 /* Now we have an ACL to use. It's possible it may be NULL. */
4144 int basic_errno = 0;
4145 BOOL endpass_seen = FALSE;
4146 BOOL acl_quit_check = acl_level == 0
4147 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4149 *log_msgptr = *user_msgptr = NULL;
4150 f.acl_temp_details = FALSE;
4152 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4153 verbs[acl->verb], acl->srcfile, acl->srcline);
4155 /* Clear out any search error message from a previous check before testing
4158 search_error_message = NULL;
4159 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4160 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4162 /* Handle special returns: DEFER causes a return except on a WARN verb;
4163 ERROR always causes a return. */
4168 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4169 verbs[acl->verb], acl_name);
4170 if (basic_errno != ERRNO_CALLOUTDEFER)
4172 if (search_error_message != NULL && *search_error_message != 0)
4173 *log_msgptr = search_error_message;
4174 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4177 f.acl_temp_details = TRUE;
4178 if (acl->verb != ACL_WARN) return DEFER;
4181 default: /* Paranoia */
4183 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4184 verbs[acl->verb], acl_name);
4188 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4189 verbs[acl->verb], acl_name);
4193 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4194 verbs[acl->verb], acl_name);
4197 /* DISCARD and DROP can happen only from a nested ACL condition, and
4198 DISCARD can happen only for an "accept" or "discard" verb. */
4201 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4202 verbs[acl->verb], acl_name);
4206 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4207 verbs[acl->verb], acl_name);
4211 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4212 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4213 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4218 if (cond == OK || cond == DISCARD)
4220 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4225 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4233 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4234 if (acl_quit_check) goto badquit;
4235 f.acl_temp_details = TRUE;
4243 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4244 if (acl_quit_check) goto badquit;
4250 if (cond == OK || cond == DISCARD)
4252 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4253 if (acl_quit_check) goto badquit;
4259 debug_printf_indent("discard: endpass encountered - denying access\n");
4267 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4268 if (acl_quit_check) goto badquit;
4276 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4277 if (acl_quit_check) goto badquit;
4284 acl_warn(where, *user_msgptr, *log_msgptr);
4285 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4286 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4287 "condition test deferred%s%s", host_and_ident(TRUE),
4288 (*log_msgptr == NULL)? US"" : US": ",
4289 (*log_msgptr == NULL)? US"" : *log_msgptr);
4290 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4294 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4299 /* Pass to the next ACL item */
4304 /* We have reached the end of the ACL. This is an implicit DENY. */
4306 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4310 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4311 "('%s' verb used incorrectly)", verbs[acl->verb]);
4318 /* Same args as acl_check_internal() above, but the string s is
4319 the name of an ACL followed optionally by up to 9 space-separated arguments.
4320 The name and args are separately expanded. Args go into $acl_arg globals. */
4322 acl_check_wargs(int where, address_item *addr, const uschar *s,
4323 uschar **user_msgptr, uschar **log_msgptr)
4326 uschar * tmp_arg[9]; /* must match acl_arg[] */
4327 uschar * sav_arg[9]; /* must match acl_arg[] */
4333 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4336 for (i = 0; i < 9; i++)
4338 while (*s && isspace(*s)) s++;
4340 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4347 sav_narg = acl_narg;
4349 for (i = 0; i < acl_narg; i++)
4351 sav_arg[i] = acl_arg[i];
4352 acl_arg[i] = tmp_arg[i];
4356 sav_arg[i] = acl_arg[i];
4357 acl_arg[i++] = NULL;
4361 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4364 acl_narg = sav_narg;
4365 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4369 if (f.expand_string_forcedfail) return ERROR;
4370 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4371 tmp, expand_string_message);
4372 return f.search_find_defer ? DEFER : ERROR;
4377 /*************************************************
4378 * Check access using an ACL *
4379 *************************************************/
4381 /* Alternate interface for ACL, used by expansions */
4383 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4386 address_item *addr = NULL;
4389 *user_msgptr = *log_msgptr = NULL;
4390 sender_verified_failed = NULL;
4391 ratelimiters_cmd = NULL;
4392 log_reject_target = LOG_MAIN|LOG_REJECT;
4394 if (where == ACL_WHERE_RCPT)
4396 adb = address_defaults;
4398 addr->address = expand_string(US"$local_part@$domain");
4399 addr->domain = deliver_domain;
4400 addr->local_part = deliver_localpart;
4401 addr->cc_local_part = deliver_localpart;
4402 addr->lc_local_part = deliver_localpart;
4406 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4413 /* This is the external interface for ACL checks. It sets up an address and the
4414 expansions for $domain and $local_part when called after RCPT, then calls
4415 acl_check_internal() to do the actual work.
4418 where ACL_WHERE_xxxx indicating where called from
4419 recipient RCPT address for RCPT check, else NULL
4420 s the input string; NULL is the same as an empty ACL => DENY
4421 user_msgptr where to put a user error (for SMTP response)
4422 log_msgptr where to put a logging message (not for SMTP response)
4424 Returns: OK access is granted by an ACCEPT verb
4425 DISCARD access is granted by a DISCARD verb
4426 FAIL access is denied
4427 FAIL_DROP access is denied; drop the connection
4428 DEFER can't tell at the moment
4431 int acl_where = ACL_WHERE_UNKNOWN;
4434 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4435 uschar **log_msgptr)
4439 address_item *addr = NULL;
4441 *user_msgptr = *log_msgptr = NULL;
4442 sender_verified_failed = NULL;
4443 ratelimiters_cmd = NULL;
4444 log_reject_target = LOG_MAIN|LOG_REJECT;
4446 #ifndef DISABLE_PRDR
4447 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4449 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4452 adb = address_defaults;
4454 addr->address = recipient;
4455 if (deliver_split_address(addr) == DEFER)
4457 *log_msgptr = US"defer in percent_hack_domains check";
4461 if ((addr->prop.utf8_msg = message_smtputf8))
4463 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4464 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4467 deliver_domain = addr->domain;
4468 deliver_localpart = addr->local_part;
4473 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4475 acl_where = ACL_WHERE_UNKNOWN;
4477 /* Cutthrough - if requested,
4478 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4479 and rcpt acl returned accept,
4480 and first recipient (cancel on any subsequents)
4481 open one now and run it up to RCPT acceptance.
4482 A failed verify should cancel cutthrough request,
4483 and will pass the fail to the originator.
4484 Initial implementation: dual-write to spool.
4485 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4487 Cease cutthrough copy on rxd final dot; do not send one.
4489 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4491 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4492 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4493 If temp-reject, close the conn (and keep the spooled copy).
4494 If conn-failure, no action (and keep the spooled copy).
4498 case ACL_WHERE_RCPT:
4499 #ifndef DISABLE_PRDR
4500 case ACL_WHERE_PRDR:
4503 if (f.host_checking_callout) /* -bhc mode */
4504 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4507 && cutthrough.delivery
4508 && rcpt_count > cutthrough.nrcpt
4511 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4512 if (cutthrough.defer_pass)
4514 uschar * s = addr->message;
4515 /* Horrid kludge to recover target's SMTP message */
4517 do --s; while (!isdigit(*s));
4518 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4519 f.acl_temp_details = TRUE;
4523 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4527 else HDEBUG(D_acl) if (cutthrough.delivery)
4528 if (rcpt_count <= cutthrough.nrcpt)
4529 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4531 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4534 case ACL_WHERE_PREDATA:
4536 cutthrough_predata();
4538 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4541 case ACL_WHERE_QUIT:
4542 case ACL_WHERE_NOTQUIT:
4543 /* Drop cutthrough conns, and drop heldopen verify conns if
4544 the previous was not DATA */
4547 smtp_connection_had[SMTP_HBUFF_PREV(SMTP_HBUFF_PREV(smtp_ch_index))];
4548 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4550 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4558 deliver_domain = deliver_localpart = deliver_address_data =
4559 deliver_domain_data = sender_address_data = NULL;
4561 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4562 ACL, which is really in the middle of an SMTP command. */
4566 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4568 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4569 "ACL", acl_wherenames[where]);
4575 /* A DROP response is not permitted from MAILAUTH */
4577 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4579 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4580 "ACL", acl_wherenames[where]);
4584 /* Before giving a response, take a look at the length of any user message, and
4585 split it up into multiple lines if possible. */
4587 *user_msgptr = string_split_message(*user_msgptr);
4588 if (fake_response != OK)
4589 fake_response_text = string_split_message(fake_response_text);
4595 /*************************************************
4596 * Create ACL variable *
4597 *************************************************/
4599 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4600 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4603 name pointer to the variable's name, starting with c or m
4605 Returns the pointer to variable's tree node
4609 acl_var_create(uschar * name)
4611 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4612 if (!(node = tree_search(*root, name)))
4614 node = store_get(sizeof(tree_node) + Ustrlen(name), is_tainted(name));
4615 Ustrcpy(node->name, name);
4616 (void)tree_insertnode(root, node);
4618 node->data.ptr = NULL;
4624 /*************************************************
4625 * Write an ACL variable in spool format *
4626 *************************************************/
4628 /* This function is used as a callback for tree_walk when writing variables to
4629 the spool file. To retain spool file compatibility, what is written is -aclc or
4630 -aclm followed by the rest of the name and the data length, space separated,
4631 then the value itself, starting on a new line, and terminated by an additional
4632 newline. When we had only numbered ACL variables, the first line might look
4633 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4637 name of the variable
4638 value of the variable
4639 ctx FILE pointer (as a void pointer)
4645 acl_var_write(uschar *name, uschar *value, void *ctx)
4647 FILE *f = (FILE *)ctx;
4648 if (is_tainted(value)) putc('-', f);
4649 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
git://git.exim.org / users / heiko / exim.git / blob