1 /* $Cambridge: exim/src/src/acl.c,v 1.18 2005/01/27 10:26:14 ph10 Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2005 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* Code for handling Access Control Lists (ACLs) */
15 /* Default callout timeout */
17 #define CALLOUT_TIMEOUT_DEFAULT 30
19 /* ACL verb codes - keep in step with the table of verbs that follows */
21 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
26 static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
30 /* For each verb, the condition for which "message" is used */
32 static int msgcond[] = { FAIL, OK, OK, FAIL, OK, FAIL, OK };
34 /* ACL condition and modifier codes - keep in step with the table that
37 enum { ACLC_ACL, ACLC_AUTHENTICATED,
38 #ifdef EXPERIMENTAL_BRIGHTMAIL
41 ACLC_CONDITION, ACLC_CONTROL,
42 #ifdef WITH_CONTENT_SCAN
46 #ifdef WITH_OLD_DEMIME
49 ACLC_DNSLISTS, ACLC_DOMAINS, ACLC_ENCRYPTED, ACLC_ENDPASS,
50 ACLC_HOSTS, ACLC_LOCAL_PARTS, ACLC_LOG_MESSAGE, ACLC_LOGWRITE,
51 #ifdef WITH_CONTENT_SCAN
55 #ifdef WITH_CONTENT_SCAN
59 #ifdef WITH_CONTENT_SCAN
62 ACLC_SENDER_DOMAINS, ACLC_SENDERS, ACLC_SET,
63 #ifdef WITH_CONTENT_SCAN
66 #ifdef EXPERIMENTAL_SPF
71 /* ACL conditions/modifiers: "delay", "control", "endpass", "message",
72 "log_message", "logwrite", and "set" are modifiers that look like conditions
73 but always return TRUE. They are used for their side effects. */
75 static uschar *conditions[] = { US"acl", US"authenticated",
76 #ifdef EXPERIMENTAL_BRIGHTMAIL
81 #ifdef WITH_CONTENT_SCAN
85 #ifdef WITH_OLD_DEMIME
88 US"dnslists", US"domains", US"encrypted",
89 US"endpass", US"hosts", US"local_parts", US"log_message", US"logwrite",
90 #ifdef WITH_CONTENT_SCAN
94 #ifdef WITH_CONTENT_SCAN
98 #ifdef WITH_CONTENT_SCAN
101 US"sender_domains", US"senders", US"set",
102 #ifdef WITH_CONTENT_SCAN
105 #ifdef EXPERIMENTAL_SPF
110 /* ACL control names */
112 static uschar *controls[] = { US"error", US"caseful_local_part",
113 US"caselower_local_part", US"enforce_sync", US"no_enforce_sync", US"freeze",
114 US"queue_only", US"submission", US"no_multiline"};
116 /* Flags to indicate for which conditions /modifiers a string expansion is done
117 at the outer level. In the other cases, expansion already occurs in the
118 checking functions. */
120 static uschar cond_expand_at_top[] = {
122 FALSE, /* authenticated */
123 #ifdef EXPERIMENTAL_BRIGHTMAIL
124 TRUE, /* bmi_optin */
126 TRUE, /* condition */
128 #ifdef WITH_CONTENT_SCAN
132 #ifdef WITH_OLD_DEMIME
137 FALSE, /* encrypted */
140 FALSE, /* local_parts */
141 TRUE, /* log_message */
143 #ifdef WITH_CONTENT_SCAN
147 #ifdef WITH_CONTENT_SCAN
148 TRUE, /* mime_regex */
150 FALSE, /* recipients */
151 #ifdef WITH_CONTENT_SCAN
154 FALSE, /* sender_domains */
157 #ifdef WITH_CONTENT_SCAN
160 #ifdef EXPERIMENTAL_SPF
166 /* Flags to identify the modifiers */
168 static uschar cond_modifiers[] = {
170 FALSE, /* authenticated */
171 #ifdef EXPERIMENTAL_BRIGHTMAIL
172 TRUE, /* bmi_optin */
174 FALSE, /* condition */
176 #ifdef WITH_CONTENT_SCAN
180 #ifdef WITH_OLD_DEMIME
183 FALSE, /* dnslists */
185 FALSE, /* encrypted */
188 FALSE, /* local_parts */
189 TRUE, /* log_message */
191 #ifdef WITH_CONTENT_SCAN
195 #ifdef WITH_CONTENT_SCAN
196 FALSE, /* mime_regex */
198 FALSE, /* recipients */
199 #ifdef WITH_CONTENT_SCAN
202 FALSE, /* sender_domains */
205 #ifdef WITH_CONTENT_SCAN
208 #ifdef EXPERIMENTAL_SPF
214 /* Bit map vector of which conditions are not allowed at certain times. For
215 each condition, there's a bitmap of dis-allowed times. */
217 static unsigned int cond_forbids[] = {
220 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* authenticated */
223 #ifdef EXPERIMENTAL_BRIGHTMAIL
224 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
225 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
226 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
227 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
228 (1<<ACL_WHERE_MAILAUTH)|
229 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
230 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA),
235 /* Certain types of control are always allowed, so we let it through
236 always and check in the control processing itself */
240 #ifdef WITH_CONTENT_SCAN
241 (1<<ACL_WHERE_AUTH)| /* decode */
242 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
243 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_PREDATA)|
244 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
245 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
246 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
247 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_RCPT),
252 #ifdef WITH_OLD_DEMIME
253 (1<<ACL_WHERE_AUTH)| /* demime */
254 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
255 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
256 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
257 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
258 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
259 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_MIME),
262 (1<<ACL_WHERE_NOTSMTP), /* dnslists */
264 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_AUTH)| /* domains */
265 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
266 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_PREDATA)|
267 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
268 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
269 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
272 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_CONNECT)| /* encrypted */
277 (1<<ACL_WHERE_NOTSMTP), /* hosts */
279 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_AUTH)| /* local_parts */
280 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
281 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_PREDATA)|
282 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
283 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
284 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
291 #ifdef WITH_CONTENT_SCAN
292 (1<<ACL_WHERE_AUTH)| /* malware */
293 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
294 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
295 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
296 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
297 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
298 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_MIME),
303 #ifdef WITH_CONTENT_SCAN
304 (1<<ACL_WHERE_AUTH)| /* mime_regex */
305 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
306 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_PREDATA)|
307 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
308 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
309 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
310 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_RCPT),
313 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_AUTH)| /* recipients */
314 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
315 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_PREDATA)|
316 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
317 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
318 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
321 #ifdef WITH_CONTENT_SCAN
322 (1<<ACL_WHERE_AUTH)| /* regex */
323 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
324 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
325 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
326 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
327 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
328 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_MIME),
331 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
333 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
334 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
335 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
337 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
339 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
340 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
341 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
345 #ifdef WITH_CONTENT_SCAN
346 (1<<ACL_WHERE_AUTH)| /* spam */
347 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
348 (1<<ACL_WHERE_RCPT)|(1<<ACL_WHERE_PREDATA)|
349 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
350 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
351 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
352 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_MIME),
355 #ifdef EXPERIMENTAL_SPF
356 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
358 (1<<ACL_WHERE_MAILAUTH)|
359 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
360 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
363 /* Certain types of verify are always allowed, so we let it through
364 always and check in the verify function itself */
370 /* Return values from decode_control() */
373 #ifdef EXPERIMENTAL_BRIGHTMAIL
376 CONTROL_ERROR, CONTROL_CASEFUL_LOCAL_PART, CONTROL_CASELOWER_LOCAL_PART,
377 CONTROL_ENFORCE_SYNC, CONTROL_NO_ENFORCE_SYNC, CONTROL_FREEZE,
378 CONTROL_QUEUE_ONLY, CONTROL_SUBMISSION,
379 #ifdef WITH_CONTENT_SCAN
380 CONTROL_NO_MBOX_UNSPOOL,
382 CONTROL_FAKEREJECT, CONTROL_NO_MULTILINE };
384 /* Bit map vector of which controls are not allowed at certain times. For
385 each control, there's a bitmap of dis-allowed times. For some, it is easier to
386 specify the negation of a small number of allowed times. */
388 static unsigned int control_forbids[] = {
389 #ifdef EXPERIMENTAL_BRIGHTMAIL
396 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
399 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
401 (1<<ACL_WHERE_NOTSMTP), /* enforce_sync */
403 (1<<ACL_WHERE_NOTSMTP), /* no_enforce_sync */
406 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
407 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
408 (1<<ACL_WHERE_NOTSMTP)),
411 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
412 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
413 (1<<ACL_WHERE_NOTSMTP)),
416 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
417 (1<<ACL_WHERE_PREDATA)),
419 #ifdef WITH_CONTENT_SCAN
421 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
422 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)),
426 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
427 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)),
429 (1<<ACL_WHERE_NOTSMTP) /* no_multiline */
432 /* Structure listing various control arguments, with their characteristics. */
434 typedef struct control_def {
436 int value; /* CONTROL_xxx value */
437 BOOL has_option; /* Has /option(s) following */
440 static control_def controls_list[] = {
441 #ifdef EXPERIMENTAL_BRIGHTMAIL
442 { US"bmi_run", CONTROL_BMI_RUN, FALSE},
444 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE},
445 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE},
446 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE},
447 { US"freeze", CONTROL_FREEZE, FALSE},
448 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE},
449 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE},
450 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE},
451 #ifdef WITH_CONTENT_SCAN
452 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE},
454 { US"fakereject", CONTROL_FAKEREJECT, TRUE},
455 { US"submission", CONTROL_SUBMISSION, TRUE}
458 /* Enable recursion between acl_check_internal() and acl_check_condition() */
460 static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
464 /*************************************************
465 * Pick out name from list *
466 *************************************************/
468 /* Use a binary chop method
475 Returns: offset in list, or -1 if not found
479 acl_checkname(uschar *name, uschar **list, int end)
485 int mid = (start + end)/2;
486 int c = Ustrcmp(name, list[mid]);
487 if (c == 0) return mid;
488 if (c < 0) end = mid; else start = mid + 1;
495 /*************************************************
496 * Read and parse one ACL *
497 *************************************************/
499 /* This function is called both from readconf in order to parse the ACLs in the
500 configuration file, and also when an ACL is encountered dynamically (e.g. as
501 the result of an expansion). It is given a function to call in order to
502 retrieve the lines of the ACL. This function handles skipping comments and
503 blank lines (where relevant).
506 func function to get next line of ACL
507 error where to put an error message
509 Returns: pointer to ACL, or NULL
510 NULL can be legal (empty ACL); in this case error will be NULL
514 acl_read(uschar *(*func)(void), uschar **error)
516 acl_block *yield = NULL;
517 acl_block **lastp = &yield;
518 acl_block *this = NULL;
519 acl_condition_block *cond;
520 acl_condition_block **condp = NULL;
525 while ((s = (*func)()) != NULL)
528 BOOL negated = FALSE;
529 uschar *saveline = s;
532 /* Conditions (but not verbs) are allowed to be negated by an initial
535 while (isspace(*s)) s++;
542 /* Read the name of a verb or a condition, or the start of a new ACL */
544 s = readconf_readname(name, sizeof(name), s);
547 if (negated || name[0] == 0)
549 *error = string_sprintf("malformed ACL name in \"%s\"", saveline);
555 /* If a verb is unrecognized, it may be another condition or modifier that
556 continues the previous verb. */
558 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
563 *error = string_sprintf("unknown ACL verb in \"%s\"", saveline);
574 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
577 this = store_get(sizeof(acl_block));
579 lastp = &(this->next);
582 this->condition = NULL;
583 condp = &(this->condition);
584 if (*s == 0) continue; /* No condition on this line */
590 s = readconf_readname(name, sizeof(name), s); /* Condition name */
593 /* Handle a condition or modifier. */
595 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
598 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
603 /* The modifiers may not be negated */
605 if (negated && cond_modifiers[c])
607 *error = string_sprintf("ACL error: negation is not allowed with "
608 "\"%s\"", conditions[c]);
612 /* ENDPASS may occur only with ACCEPT or DISCARD. */
614 if (c == ACLC_ENDPASS &&
615 this->verb != ACL_ACCEPT &&
616 this->verb != ACL_DISCARD)
618 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
619 conditions[c], verbs[this->verb]);
623 cond = store_get(sizeof(acl_condition_block));
626 cond->u.negated = negated;
629 condp = &(cond->next);
631 /* The "set" modifier is different in that its argument is "name=value"
632 rather than just a value, and we can check the validity of the name, which
633 gives us a variable number to insert into the data block. */
637 if (Ustrncmp(s, "acl_", 4) != 0 || (s[4] != 'c' && s[4] != 'm') ||
638 !isdigit(s[5]) || (!isspace(s[6]) && s[6] != '='))
640 *error = string_sprintf("unrecognized name after \"set\" in ACL "
641 "modifier \"set %s\"", s);
645 cond->u.varnumber = s[5] - '0';
646 if (s[4] == 'm') cond->u.varnumber += ACL_C_MAX;
648 while (isspace(*s)) s++;
651 /* For "set", we are now positioned for the data. For the others, only
652 "endpass" has no data */
654 if (c != ACLC_ENDPASS)
658 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
659 cond_modifiers[c]? US"modifier" : US"condition");
662 while (isspace(*s)) s++;
663 cond->arg = string_copy(s);
672 /*************************************************
674 *************************************************/
676 /* This function is called when a WARN verb's conditions are true. It adds to
677 the message's headers, and/or writes information to the log. In each case, this
678 only happens once (per message for headers, per connection for log).
681 where ACL_WHERE_xxxx indicating which ACL this is
682 user_message message for adding to headers
683 log_message message for logging, if different
689 acl_warn(int where, uschar *user_message, uschar *log_message)
693 if (log_message != NULL && log_message != user_message)
698 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
699 string_printing(log_message));
701 /* If a sender verification has failed, and the log message is "sender verify
702 failed", add the failure message. */
704 if (sender_verified_failed != NULL &&
705 sender_verified_failed->message != NULL &&
706 strcmpic(log_message, US"sender verify failed") == 0)
707 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
709 /* Search previously logged warnings. They are kept in malloc store so they
710 can be freed at the start of a new message. */
712 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
713 if (Ustrcmp(logged->text, text) == 0) break;
717 int length = Ustrlen(text) + 1;
718 log_write(0, LOG_MAIN, "%s", text);
719 logged = store_malloc(sizeof(string_item) + length);
720 logged->text = (uschar *)logged + sizeof(string_item);
721 memcpy(logged->text, text, length);
722 logged->next = acl_warn_logged;
723 acl_warn_logged = logged;
727 /* If there's no user message, we are done. */
729 if (user_message == NULL) return;
731 /* If this isn't a message ACL, we can't do anything with a user message.
734 if (where > ACL_WHERE_NOTSMTP)
736 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
737 "found in a non-message (%s) ACL: cannot specify header lines here: "
738 "message ignored", acl_wherenames[where]);
742 /* Treat the user message as a sequence of one or more header lines. */
744 hlen = Ustrlen(user_message);
747 uschar *text, *p, *q;
749 /* Add a final newline if not present */
751 text = ((user_message)[hlen-1] == '\n')? user_message :
752 string_sprintf("%s\n", user_message);
754 /* Loop for multiple header lines, taking care about continuations */
756 for (p = q = text; *p != 0; )
759 int newtype = htype_add_bot;
760 header_line **hptr = &acl_warn_headers;
762 /* Find next header line within the string */
766 q = Ustrchr(q, '\n');
767 if (*(++q) != ' ' && *q != '\t') break;
770 /* If the line starts with a colon, interpret the instruction for where to
771 add it. This temporarily sets up a new type. */
775 if (strncmpic(p, US":after_received:", 16) == 0)
777 newtype = htype_add_rec;
780 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
782 newtype = htype_add_rfc;
785 else if (strncmpic(p, US":at_start:", 10) == 0)
787 newtype = htype_add_top;
790 else if (strncmpic(p, US":at_end:", 8) == 0)
792 newtype = htype_add_bot;
795 while (*p == ' ' || *p == '\t') p++;
798 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
799 to the front of it. */
801 for (s = p; s < q - 1; s++)
803 if (*s == ':' || !isgraph(*s)) break;
806 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
809 /* See if this line has already been added */
811 while (*hptr != NULL)
813 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
814 hptr = &((*hptr)->next);
817 /* Add if not previously present */
821 header_line *h = store_get(sizeof(header_line));
830 /* Advance for next header line within the string */
839 /*************************************************
840 * Verify and check reverse DNS *
841 *************************************************/
843 /* Called from acl_verify() below. We look up the host name(s) of the client IP
844 address if this has not yet been done. The host_name_lookup() function checks
845 that one of these names resolves to an address list that contains the client IP
846 address, so we don't actually have to do the check here.
849 user_msgptr pointer for user message
850 log_msgptr pointer for log message
852 Returns: OK verification condition succeeded
853 FAIL verification failed
854 DEFER there was a problem verifying
858 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
862 user_msgptr = user_msgptr; /* stop compiler warning */
864 /* Previous success */
866 if (sender_host_name != NULL) return OK;
868 /* Previous failure */
870 if (host_lookup_failed)
872 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
876 /* Need to do a lookup */
879 debug_printf("looking up host name to force name/address consistency check\n");
881 if ((rc = host_name_lookup()) != OK)
883 *log_msgptr = (rc == DEFER)?
884 US"host lookup deferred for reverse lookup check"
886 string_sprintf("host lookup failed for reverse lookup check%s",
888 return rc; /* DEFER or FAIL */
891 host_build_sender_fullhost();
897 /*************************************************
898 * Handle verification (address & other) *
899 *************************************************/
901 /* This function implements the "verify" condition. It is called when
902 encountered in any ACL, because some tests are almost always permitted. Some
903 just don't make sense, and always fail (for example, an attempt to test a host
904 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
907 where where called from
908 addr the recipient address that the ACL is handling, or NULL
909 arg the argument of "verify"
910 user_msgptr pointer for user message
911 log_msgptr pointer for log message
912 basic_errno where to put verify errno
914 Returns: OK verification condition succeeded
915 FAIL verification failed
916 DEFER there was a problem verifying
921 acl_verify(int where, address_item *addr, uschar *arg,
922 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
926 int callout_overall = -1;
927 int callout_connect = -1;
928 int verify_options = 0;
930 BOOL verify_header_sender = FALSE;
931 BOOL defer_ok = FALSE;
932 BOOL callout_defer_ok = FALSE;
933 BOOL no_details = FALSE;
934 address_item *sender_vaddr = NULL;
935 uschar *verify_sender_address = NULL;
936 uschar *pm_mailfrom = NULL;
937 uschar *se_mailfrom = NULL;
939 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
941 if (ss == NULL) goto BAD_VERIFY;
943 /* Handle name/address consistency verification in a separate function. */
945 if (strcmpic(ss, US"reverse_host_lookup") == 0)
947 if (sender_host_address == NULL) return OK;
948 return acl_verify_reverse(user_msgptr, log_msgptr);
951 /* TLS certificate verification is done at STARTTLS time; here we just
952 test whether it was successful or not. (This is for optional verification; for
953 mandatory verification, the connection doesn't last this long.) */
955 if (strcmpic(ss, US"certificate") == 0)
957 if (tls_certificate_verified) return OK;
958 *user_msgptr = US"no verified certificate";
962 /* We can test the result of optional HELO verification */
964 if (strcmpic(ss, US"helo") == 0) return helo_verified? OK : FAIL;
966 /* Handle header verification options - permitted only after DATA or a non-SMTP
969 if (strncmpic(ss, US"header_", 7) == 0)
971 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP)
973 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
974 "(only possible in ACL for DATA)", acl_wherenames[where]);
978 /* Check that all relevant header lines have the correct syntax. If there is
979 a syntax error, we return details of the error to the sender if configured to
980 send out full details. (But a "message" setting on the ACL can override, as
983 if (strcmpic(ss+7, US"syntax") == 0)
985 int rc = verify_check_headers(log_msgptr);
986 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
987 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
991 /* Check that there is at least one verifiable sender address in the relevant
992 header lines. This can be followed by callout and defer options, just like
993 sender and recipient. */
995 else if (strcmpic(ss+7, US"sender") == 0) verify_header_sender = TRUE;
997 /* Unknown verify argument starting with "header_" */
999 else goto BAD_VERIFY;
1002 /* Otherwise, first item in verify argument must be "sender" or "recipient".
1003 In the case of a sender, this can optionally be followed by an address to use
1004 in place of the actual sender (rare special-case requirement). */
1006 else if (strncmpic(ss, US"sender", 6) == 0)
1009 if (where > ACL_WHERE_NOTSMTP)
1011 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1012 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1013 acl_wherenames[where]);
1017 verify_sender_address = sender_address;
1020 while (isspace(*s)) s++;
1021 if (*s++ != '=') goto BAD_VERIFY;
1022 while (isspace(*s)) s++;
1023 verify_sender_address = string_copy(s);
1028 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1031 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1032 "(only possible for RCPT)", acl_wherenames[where]);
1037 /* Remaining items are optional */
1039 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1042 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1043 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1045 /* These two old options are left for backwards compatibility */
1047 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1049 callout_defer_ok = TRUE;
1050 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1053 else if (strcmpic(ss, US"check_postmaster") == 0)
1056 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1059 /* The callout option has a number of sub-options, comma separated */
1061 else if (strncmpic(ss, US"callout", 7) == 0)
1063 callout = CALLOUT_TIMEOUT_DEFAULT;
1067 while (isspace(*ss)) ss++;
1073 while (isspace(*ss)) ss++;
1075 /* This callout option handling code has become a mess as new options
1076 have been added in an ad hoc manner. It should be tidied up into some
1077 kind of table-driven thing. */
1079 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1082 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1083 else if (strcmpic(opt, US"no_cache") == 0)
1084 verify_options |= vopt_callout_no_cache;
1085 else if (strcmpic(opt, US"random") == 0)
1086 verify_options |= vopt_callout_random;
1087 else if (strcmpic(opt, US"use_sender") == 0)
1088 verify_options |= vopt_callout_recipsender;
1089 else if (strcmpic(opt, US"use_postmaster") == 0)
1090 verify_options |= vopt_callout_recippmaster;
1091 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
1093 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1095 if (!verify_header_sender)
1097 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1098 "callout option only for verify=header_sender (detected in ACL "
1099 "condition \"%s\")", arg);
1103 while (isspace(*opt)) opt++;
1106 *log_msgptr = string_sprintf("'=' expected after "
1107 "\"mailfrom\" in ACL condition \"%s\"", arg);
1110 while (isspace(*opt)) opt++;
1111 se_mailfrom = string_copy(opt);
1114 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1117 while (isspace(*opt)) opt++;
1120 *log_msgptr = string_sprintf("'=' expected after "
1121 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1124 while (isspace(*opt)) opt++;
1125 pm_mailfrom = string_copy(opt);
1128 else if (strncmpic(opt, US"maxwait", 7) == 0)
1131 while (isspace(*opt)) opt++;
1134 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1135 "ACL condition \"%s\"", arg);
1138 while (isspace(*opt)) opt++;
1139 callout_overall = readconf_readtime(opt, 0, FALSE);
1140 if (callout_overall < 0)
1142 *log_msgptr = string_sprintf("bad time value in ACL condition "
1143 "\"verify %s\"", arg);
1147 else if (strncmpic(opt, US"connect", 7) == 0)
1150 while (isspace(*opt)) opt++;
1153 *log_msgptr = string_sprintf("'=' expected after "
1154 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1157 while (isspace(*opt)) opt++;
1158 callout_connect = readconf_readtime(opt, 0, FALSE);
1159 if (callout_connect < 0)
1161 *log_msgptr = string_sprintf("bad time value in ACL condition "
1162 "\"verify %s\"", arg);
1166 else /* Plain time is callout connect/command timeout */
1168 callout = readconf_readtime(opt, 0, FALSE);
1171 *log_msgptr = string_sprintf("bad time value in ACL condition "
1172 "\"verify %s\"", arg);
1180 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1181 "ACL condition \"%s\"", arg);
1187 /* Option not recognized */
1191 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1192 "condition \"verify %s\"", ss, arg);
1197 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1198 (vopt_callout_recipsender|vopt_callout_recippmaster))
1200 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1201 "for a recipient callout";
1205 /* Handle sender-in-header verification. Default the user message to the log
1206 message if giving out verification details. */
1208 if (verify_header_sender)
1211 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1212 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1216 *basic_errno = verrno;
1217 if (smtp_return_error_details)
1219 if (*user_msgptr == NULL && *log_msgptr != NULL)
1220 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1221 if (rc == DEFER) acl_temp_details = TRUE;
1226 /* Handle a sender address. The default is to verify *the* sender address, but
1227 optionally a different address can be given, for special requirements. If the
1228 address is empty, we are dealing with a bounce message that has no sender, so
1229 we cannot do any checking. If the real sender address gets rewritten during
1230 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1231 during message reception.
1233 A list of verified "sender" addresses is kept to try to avoid doing to much
1234 work repetitively when there are multiple recipients in a message and they all
1235 require sender verification. However, when callouts are involved, it gets too
1236 complicated because different recipients may require different callout options.
1237 Therefore, we always do a full sender verify when any kind of callout is
1238 specified. Caching elsewhere, for instance in the DNS resolver and in the
1239 callout handling, should ensure that this is not terribly inefficient. */
1241 else if (verify_sender_address != NULL)
1243 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1246 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1247 "sender verify callout";
1251 sender_vaddr = verify_checked_sender(verify_sender_address);
1252 if (sender_vaddr != NULL && /* Previously checked */
1253 callout <= 0) /* No callout needed this time */
1255 /* If the "routed" flag is set, it means that routing worked before, so
1256 this check can give OK (the saved return code value, if set, belongs to a
1257 callout that was done previously). If the "routed" flag is not set, routing
1258 must have failed, so we use the saved return code. */
1260 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1262 rc = sender_vaddr->special_action;
1263 *basic_errno = sender_vaddr->basic_errno;
1265 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1268 /* Do a new verification, and cache the result. The cache is used to avoid
1269 verifying the sender multiple times for multiple RCPTs when callouts are not
1270 specified (see comments above).
1272 The cache is also used on failure to give details in response to the first
1273 RCPT that gets bounced for this reason. However, this can be suppressed by
1274 the no_details option, which sets the flag that says "this detail has already
1275 been sent". The cache normally contains just one address, but there may be
1276 more in esoteric circumstances. */
1281 uschar *save_address_data = deliver_address_data;
1283 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1284 if (no_details) setflag(sender_vaddr, af_sverify_told);
1285 if (verify_sender_address[0] != 0)
1287 /* If this is the real sender address, save the unrewritten version
1288 for use later in receive. Otherwise, set a flag so that rewriting the
1289 sender in verify_address() does not update sender_address. */
1291 if (verify_sender_address == sender_address)
1292 sender_address_unrewritten = sender_address;
1294 verify_options |= vopt_fake_sender;
1296 /* The recipient, qualify, and expn options are never set in
1299 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1300 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1302 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1306 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1308 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1309 verify_sender_address, sender_vaddr->address);
1313 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1314 verify_sender_address);
1317 else *basic_errno = sender_vaddr->basic_errno;
1319 else rc = OK; /* Null sender */
1321 /* Cache the result code */
1323 if (routed) setflag(sender_vaddr, af_verify_routed);
1324 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1325 sender_vaddr->special_action = rc;
1326 sender_vaddr->next = sender_verified_list;
1327 sender_verified_list = sender_vaddr;
1329 /* Restore the recipient address data, which might have been clobbered by
1330 the sender verification. */
1332 deliver_address_data = save_address_data;
1335 /* Put the sender address_data value into $sender_address_data */
1337 sender_address_data = sender_vaddr->p.address_data;
1340 /* A recipient address just gets a straightforward verify; again we must handle
1341 the DEFER overrides. */
1347 /* We must use a copy of the address for verification, because it might
1351 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
1352 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
1353 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1355 *log_msgptr = addr2.message;
1356 *user_msgptr = (addr2.user_message != NULL)?
1357 addr2.user_message : addr2.message;
1358 *basic_errno = addr2.basic_errno;
1360 /* Make $address_data visible */
1361 deliver_address_data = addr2.p.address_data;
1364 /* We have a result from the relevant test. Handle defer overrides first. */
1366 if (rc == DEFER && (defer_ok ||
1367 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1369 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1370 defer_ok? "defer_ok" : "callout_defer_ok");
1374 /* If we've failed a sender, set up a recipient message, and point
1375 sender_verified_failed to the address item that actually failed. */
1377 if (rc != OK && verify_sender_address != NULL)
1381 *log_msgptr = *user_msgptr = US"Sender verify failed";
1383 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1385 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1389 *log_msgptr = US"Could not complete sender verify callout";
1390 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1394 sender_verified_failed = sender_vaddr;
1397 /* Verifying an address messes up the values of $domain and $local_part,
1398 so reset them before returning if this is a RCPT ACL. */
1402 deliver_domain = addr->domain;
1403 deliver_localpart = addr->local_part;
1407 /* Syntax errors in the verify argument come here. */
1410 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
1411 "\"header_syntax\" or \"header_sender\" at start of ACL condition "
1412 "\"verify %s\"", arg);
1419 /*************************************************
1420 * Check argument for control= modifier *
1421 *************************************************/
1423 /* Called from acl_check_condition() below
1426 arg the argument string for control=
1427 pptr set to point to the terminating character
1428 where which ACL we are in
1429 log_msgptr for error messages
1431 Returns: CONTROL_xxx value
1435 decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
1440 for (d = controls_list;
1441 d < controls_list + sizeof(controls_list)/sizeof(control_def);
1444 len = Ustrlen(d->name);
1445 if (Ustrncmp(d->name, arg, len) == 0) break;
1448 if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
1449 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
1451 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
1452 return CONTROL_ERROR;
1461 /*************************************************
1462 * Handle conditions/modifiers on an ACL item *
1463 *************************************************/
1465 /* Called from acl_check() below.
1469 cb ACL condition block - if NULL, result is OK
1470 where where called from
1471 addr the address being checked for RCPT, or NULL
1472 level the nesting level
1473 epp pointer to pass back TRUE if "endpass" encountered
1474 (applies only to "accept" and "discard")
1475 user_msgptr user message pointer
1476 log_msgptr log message pointer
1477 basic_errno pointer to where to put verify error
1479 Returns: OK - all conditions are met
1480 DISCARD - an "acl" condition returned DISCARD - only allowed
1481 for "accept" or "discard" verbs
1482 FAIL - at least one condition fails
1483 FAIL_DROP - an "acl" condition returned FAIL_DROP
1484 DEFER - can't tell at the moment (typically, lookup defer,
1485 but can be temporary callout problem)
1486 ERROR - ERROR from nested ACL or expansion failure or other
1491 acl_check_condition(int verb, acl_condition_block *cb, int where,
1492 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
1493 uschar **log_msgptr, int *basic_errno)
1495 uschar *user_message = NULL;
1496 uschar *log_message = NULL;
1499 #ifdef WITH_CONTENT_SCAN
1503 for (; cb != NULL; cb = cb->next)
1508 /* The message and log_message items set up messages to be used in
1509 case of rejection. They are expanded later. */
1511 if (cb->type == ACLC_MESSAGE)
1513 user_message = cb->arg;
1517 if (cb->type == ACLC_LOG_MESSAGE)
1519 log_message = cb->arg;
1523 /* The endpass "condition" just sets a flag to show it occurred. This is
1524 checked at compile time to be on an "accept" or "discard" item. */
1526 if (cb->type == ACLC_ENDPASS)
1532 /* For other conditions and modifiers, the argument is expanded now for some
1533 of them, but not for all, because expansion happens down in some lower level
1534 checking functions in some cases. */
1536 if (cond_expand_at_top[cb->type])
1538 arg = expand_string(cb->arg);
1541 if (expand_string_forcedfail) continue;
1542 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
1543 cb->arg, expand_string_message);
1544 return search_find_defer? DEFER : ERROR;
1549 /* Show condition, and expanded condition if it's different */
1554 debug_printf("check %s%s %n",
1555 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
1556 conditions[cb->type], &lhswidth);
1558 if (cb->type == ACLC_SET)
1560 int n = cb->u.varnumber;
1561 int t = (n < ACL_C_MAX)? 'c' : 'm';
1562 if (n >= ACL_C_MAX) n -= ACL_C_MAX;
1563 debug_printf("acl_%c%d ", t, n);
1567 debug_printf("= %s\n", cb->arg);
1570 debug_printf("%.*s= %s\n", lhswidth,
1574 /* Check that this condition makes sense at this time */
1576 if ((cond_forbids[cb->type] & (1 << where)) != 0)
1578 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
1579 cond_modifiers[cb->type]? "use" : "test",
1580 conditions[cb->type], acl_wherenames[where]);
1584 /* Run the appropriate test for each condition, or take the appropriate
1585 action for the remaining modifiers. */
1589 /* A nested ACL that returns "discard" makes sense only for an "accept" or
1593 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
1594 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
1596 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
1597 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
1603 case ACLC_AUTHENTICATED:
1604 rc = (sender_host_authenticated == NULL)? FAIL :
1605 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
1609 #ifdef EXPERIMENTAL_BRIGHTMAIL
1610 case ACLC_BMI_OPTIN:
1612 int old_pool = store_pool;
1613 store_pool = POOL_PERM;
1614 bmi_current_optin = string_copy(arg);
1615 store_pool = old_pool;
1620 case ACLC_CONDITION:
1621 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
1622 rc = (Uatoi(arg) == 0)? FAIL : OK;
1624 rc = (strcmpic(arg, US"no") == 0 ||
1625 strcmpic(arg, US"false") == 0)? FAIL :
1626 (strcmpic(arg, US"yes") == 0 ||
1627 strcmpic(arg, US"true") == 0)? OK : DEFER;
1629 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
1633 control_type = decode_control(arg, &p, where, log_msgptr);
1635 /* Check if this control makes sense at this time */
1637 if ((control_forbids[control_type] & (1 << where)) != 0)
1639 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
1640 controls[control_type], acl_wherenames[where]);
1644 switch(control_type)
1646 #ifdef EXPERIMENTAL_BRIGHTMAIL
1647 case CONTROL_BMI_RUN:
1655 case CONTROL_CASEFUL_LOCAL_PART:
1656 deliver_localpart = addr->cc_local_part;
1659 case CONTROL_CASELOWER_LOCAL_PART:
1660 deliver_localpart = addr->lc_local_part;
1663 case CONTROL_ENFORCE_SYNC:
1664 smtp_enforce_sync = TRUE;
1667 case CONTROL_NO_ENFORCE_SYNC:
1668 smtp_enforce_sync = FALSE;
1671 #ifdef WITH_CONTENT_SCAN
1672 case CONTROL_NO_MBOX_UNSPOOL:
1673 no_mbox_unspool = TRUE;
1677 case CONTROL_NO_MULTILINE:
1678 no_multiline_responses = TRUE;
1681 case CONTROL_FAKEREJECT:
1686 while (*pp != 0) pp++;
1687 fake_reject_text = expand_string(string_copyn(p+1, pp-p));
1692 /* Explicitly reset to default string */
1693 fake_reject_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
1697 case CONTROL_FREEZE:
1698 deliver_freeze = TRUE;
1699 deliver_frozen_at = time(NULL);
1702 case CONTROL_QUEUE_ONLY:
1703 queue_only_policy = TRUE;
1706 case CONTROL_SUBMISSION:
1707 submission_mode = TRUE;
1710 if (Ustrncmp(p, "/sender_retain", 14) == 0)
1713 active_local_sender_retain = TRUE;
1714 active_local_from_check = FALSE;
1716 else if (Ustrncmp(p, "/domain=", 8) == 0)
1719 while (*pp != 0 && *pp != '/') pp++;
1720 submission_domain = string_copyn(p+8, pp-p);
1727 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
1734 #ifdef WITH_CONTENT_SCAN
1736 rc = mime_decode(&arg);
1742 int delay = readconf_readtime(arg, 0, FALSE);
1745 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
1746 "modifier: \"%s\" is not a time value", arg);
1751 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
1756 debug_printf("delay skipped in -bh checking mode\n");
1760 while (delay > 0) delay = sleep(delay);
1766 #ifdef WITH_OLD_DEMIME
1773 rc = verify_check_dnsbl(&arg);
1777 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
1778 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
1781 /* The value in tls_cipher is the full cipher name, for example,
1782 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
1783 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
1784 what may in practice come out of the SSL library - which at the time of
1785 writing is poorly documented. */
1787 case ACLC_ENCRYPTED:
1788 if (tls_cipher == NULL) rc = FAIL; else
1790 uschar *endcipher = NULL;
1791 uschar *cipher = Ustrchr(tls_cipher, ':');
1792 if (cipher == NULL) cipher = tls_cipher; else
1794 endcipher = Ustrchr(++cipher, ':');
1795 if (endcipher != NULL) *endcipher = 0;
1797 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
1798 if (endcipher != NULL) *endcipher = ':';
1802 /* Use verify_check_this_host() instead of verify_check_host() so that
1803 we can pass over &host_data to catch any looked up data. Once it has been
1804 set, it retains its value so that it's still there if another ACL verb
1805 comes through here and uses the cache. However, we must put it into
1806 permanent store in case it is also expected to be used in a subsequent
1807 message in the same SMTP connection. */
1810 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
1811 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
1812 if (host_data != NULL) host_data = string_copy_malloc(host_data);
1815 case ACLC_LOCAL_PARTS:
1816 rc = match_isinlist(addr->cc_local_part, &arg, 0,
1817 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
1818 &deliver_localpart_data);
1830 if (Ustrncmp(s, "main", 4) == 0)
1831 { logbits |= LOG_MAIN; s += 4; }
1832 else if (Ustrncmp(s, "panic", 5) == 0)
1833 { logbits |= LOG_PANIC; s += 5; }
1834 else if (Ustrncmp(s, "reject", 6) == 0)
1835 { logbits |= LOG_REJECT; s += 6; }
1838 logbits = LOG_MAIN|LOG_PANIC;
1839 s = string_sprintf(":unknown log name in \"%s\" in "
1840 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
1846 while (isspace(*s)) s++;
1847 if (logbits == 0) logbits = LOG_MAIN;
1848 log_write(0, logbits, "%s", string_printing(s));
1852 #ifdef WITH_CONTENT_SCAN
1855 /* Seperate the regular expression and any optional parameters. */
1856 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
1857 /* Run the malware backend. */
1859 /* Modify return code based upon the existance of options. */
1860 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
1862 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
1864 /* FAIL so that the message is passed to the next ACL */
1871 case ACLC_MIME_REGEX:
1872 rc = mime_regex(&arg);
1876 case ACLC_RECIPIENTS:
1877 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
1881 #ifdef WITH_CONTENT_SCAN
1887 case ACLC_SENDER_DOMAINS:
1890 sdomain = Ustrrchr(sender_address, '@');
1891 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
1892 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
1893 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
1898 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
1899 sender_address_cache, -1, 0, &sender_data);
1902 /* Connection variables must persist forever */
1906 int old_pool = store_pool;
1907 if (cb->u.varnumber < ACL_C_MAX) store_pool = POOL_PERM;
1908 acl_var[cb->u.varnumber] = string_copy(arg);
1909 store_pool = old_pool;
1913 #ifdef WITH_CONTENT_SCAN
1916 /* Seperate the regular expression and any optional parameters. */
1917 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
1918 /* Run the spam backend. */
1920 /* Modify return code based upon the existance of options. */
1921 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
1923 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
1925 /* FAIL so that the message is passed to the next ACL */
1933 #ifdef EXPERIMENTAL_SPF
1935 rc = spf_process(&arg, sender_address);
1939 /* If the verb is WARN, discard any user message from verification, because
1940 such messages are SMTP responses, not header additions. The latter come
1941 only from explicit "message" modifiers. */
1944 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
1945 if (verb == ACL_WARN) *user_msgptr = NULL;
1949 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
1950 "condition %d", cb->type);
1954 /* If a condition was negated, invert OK/FAIL. */
1956 if (!cond_modifiers[cb->type] && cb->u.negated)
1958 if (rc == OK) rc = FAIL;
1959 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
1962 if (rc != OK) break; /* Conditions loop */
1966 /* If the result is the one for which "message" and/or "log_message" are used,
1967 handle the values of these options. Most verbs have but a single return for
1968 which the messages are relevant, but for "discard", it's useful to have the log
1969 message both when it succeeds and when it fails. Also, for an "accept" that
1970 appears in a QUIT ACL, we want to handle the user message. Since only "accept"
1971 and "warn" are permitted in that ACL, we don't need to test the verb.
1973 These modifiers act in different ways:
1975 "message" is a user message that will be included in an SMTP response. Unless
1976 it is empty, it overrides any previously set user message.
1978 "log_message" is a non-user message, and it adds to any existing non-user
1979 message that is already set.
1981 If there isn't a log message set, we make it the same as the user message. */
1983 if (((rc == FAIL_DROP)? FAIL : rc) == msgcond[verb] ||
1984 (verb == ACL_DISCARD && rc == OK) ||
1985 (where == ACL_WHERE_QUIT))
1989 /* If the verb is "warn", messages generated by conditions (verification or
1990 nested ACLs) are discarded. Only messages specified at this level are used.
1991 However, the value of an existing message is available in $acl_verify_message
1992 during expansions. */
1994 uschar *old_user_msgptr = *user_msgptr;
1995 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
1997 if (verb == ACL_WARN) *log_msgptr = *user_msgptr = NULL;
1999 if (user_message != NULL)
2001 acl_verify_message = old_user_msgptr;
2002 expmessage = expand_string(user_message);
2003 if (expmessage == NULL)
2005 if (!expand_string_forcedfail)
2006 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2007 user_message, expand_string_message);
2009 else if (expmessage[0] != 0) *user_msgptr = expmessage;
2012 if (log_message != NULL)
2014 acl_verify_message = old_log_msgptr;
2015 expmessage = expand_string(log_message);
2016 if (expmessage == NULL)
2018 if (!expand_string_forcedfail)
2019 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
2020 log_message, expand_string_message);
2022 else if (expmessage[0] != 0)
2024 *log_msgptr = (*log_msgptr == NULL)? expmessage :
2025 string_sprintf("%s: %s", expmessage, *log_msgptr);
2029 /* If no log message, default it to the user message */
2031 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
2034 acl_verify_message = NULL;
2042 /*************************************************
2043 * Get line from a literal ACL *
2044 *************************************************/
2046 /* This function is passed to acl_read() in order to extract individual lines
2047 of a literal ACL, which we access via static pointers. We can destroy the
2048 contents because this is called only once (the compiled ACL is remembered).
2050 This code is intended to treat the data in the same way as lines in the main
2051 Exim configuration file. That is:
2053 . Leading spaces are ignored.
2055 . A \ at the end of a line is a continuation - trailing spaces after the \
2056 are permitted (this is because I don't believe in making invisible things
2057 significant). Leading spaces on the continued part of a line are ignored.
2059 . Physical lines starting (significantly) with # are totally ignored, and
2060 may appear within a sequence of backslash-continued lines.
2062 . Blank lines are ignored, but will end a sequence of continuations.
2065 Returns: a pointer to the next line
2069 static uschar *acl_text; /* Current pointer in the text */
2070 static uschar *acl_text_end; /* Points one past the terminating '0' */
2078 /* This loop handles leading blank lines and comments. */
2082 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
2083 if (*acl_text == 0) return NULL; /* No more data */
2084 yield = acl_text; /* Potential data line */
2086 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
2088 /* If we hit the end before a newline, we have the whole logical line. If
2089 it's a comment, there's no more data to be given. Otherwise, yield it. */
2091 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
2093 /* After reaching a newline, end this loop if the physical line does not
2094 start with '#'. If it does, it's a comment, and the loop continues. */
2096 if (*yield != '#') break;
2099 /* This loop handles continuations. We know we have some real data, ending in
2100 newline. See if there is a continuation marker at the end (ignoring trailing
2101 white space). We know that *yield is not white space, so no need to test for
2102 cont > yield in the backwards scanning loop. */
2107 for (cont = acl_text - 1; isspace(*cont); cont--);
2109 /* If no continuation follows, we are done. Mark the end of the line and
2118 /* We have encountered a continuation. Skip over whitespace at the start of
2119 the next line, and indeed the whole of the next line or lines if they are
2124 while (*(++acl_text) == ' ' || *acl_text == '\t');
2125 if (*acl_text != '#') break;
2126 while (*(++acl_text) != 0 && *acl_text != '\n');
2129 /* We have the start of a continuation line. Move all the rest of the data
2130 to join onto the previous line, and then find its end. If the end is not a
2131 newline, we are done. Otherwise loop to look for another continuation. */
2133 memmove(cont, acl_text, acl_text_end - acl_text);
2134 acl_text_end -= acl_text - cont;
2136 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
2137 if (*acl_text == 0) return yield;
2140 /* Control does not reach here */
2147 /*************************************************
2148 * Check access using an ACL *
2149 *************************************************/
2151 /* This function is called from address_check. It may recurse via
2152 acl_check_condition() - hence the use of a level to stop looping. The ACL is
2153 passed as a string which is expanded. A forced failure implies no access check
2154 is required. If the result is a single word, it is taken as the name of an ACL
2155 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
2156 text, complete with newlines, and parsed as such. In both cases, the ACL check
2157 is then run. This function uses an auxiliary function for acl_read() to call
2158 for reading individual lines of a literal ACL. This is acl_getline(), which
2159 appears immediately above.
2162 where where called from
2163 addr address item when called from RCPT; otherwise NULL
2164 s the input string; NULL is the same as an empty ACL => DENY
2165 level the nesting level
2166 user_msgptr where to put a user error (for SMTP response)
2167 log_msgptr where to put a logging message (not for SMTP response)
2169 Returns: OK access is granted
2170 DISCARD access is apparently granted...
2171 FAIL access is denied
2172 FAIL_DROP access is denied; drop the connection
2173 DEFER can't tell at the moment
2178 acl_check_internal(int where, address_item *addr, uschar *s, int level,
2179 uschar **user_msgptr, uschar **log_msgptr)
2182 acl_block *acl = NULL;
2183 uschar *acl_name = US"inline ACL";
2186 /* Catch configuration loops */
2190 *log_msgptr = US"ACL nested too deep: possible loop";
2196 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
2200 /* At top level, we expand the incoming string. At lower levels, it has already
2201 been expanded as part of condition processing. */
2205 ss = expand_string(s);
2208 if (expand_string_forcedfail) return OK;
2209 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
2210 expand_string_message);
2216 while (isspace(*ss))ss++;
2218 /* If we can't find a named ACL, the default is to parse it as an inline one.
2219 (Unless it begins with a slash; non-existent files give rise to an error.) */
2223 /* Handle the case of a string that does not contain any spaces. Look for a
2224 named ACL among those read from the configuration, or a previously read file.
2225 It is possible that the pointer to the ACL is NULL if the configuration
2226 contains a name with no data. If not found, and the text begins with '/',
2227 read an ACL from a file, and save it so it can be re-used. */
2229 if (Ustrchr(ss, ' ') == NULL)
2231 tree_node *t = tree_search(acl_anchor, ss);
2234 acl = (acl_block *)(t->data.ptr);
2237 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
2240 acl_name = string_sprintf("ACL \"%s\"", ss);
2241 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
2244 else if (*ss == '/')
2246 struct stat statbuf;
2247 fd = Uopen(ss, O_RDONLY, 0);
2250 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
2255 if (fstat(fd, &statbuf) != 0)
2257 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
2262 acl_text = store_get(statbuf.st_size + 1);
2263 acl_text_end = acl_text + statbuf.st_size + 1;
2265 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
2267 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
2268 ss, strerror(errno));
2271 acl_text[statbuf.st_size] = 0;
2274 acl_name = string_sprintf("ACL \"%s\"", ss);
2275 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
2279 /* Parse an ACL that is still in text form. If it came from a file, remember it
2280 in the ACL tree, having read it into the POOL_PERM store pool so that it
2281 persists between multiple messages. */
2285 int old_pool = store_pool;
2286 if (fd >= 0) store_pool = POOL_PERM;
2287 acl = acl_read(acl_getline, log_msgptr);
2288 store_pool = old_pool;
2289 if (acl == NULL && *log_msgptr != NULL) return ERROR;
2292 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
2293 Ustrcpy(t->name, ss);
2295 (void)tree_insertnode(&acl_anchor, t);
2299 /* Now we have an ACL to use. It's possible it may be NULL. */
2304 int basic_errno = 0;
2305 BOOL endpass_seen = FALSE;
2307 *log_msgptr = *user_msgptr = NULL;
2308 acl_temp_details = FALSE;
2310 if (where == ACL_WHERE_QUIT &&
2311 acl->verb != ACL_ACCEPT &&
2312 acl->verb != ACL_WARN)
2314 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT ACL",
2319 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
2321 /* Clear out any search error message from a previous check before testing
2324 search_error_message = NULL;
2325 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
2326 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
2328 /* Handle special returns: DEFER causes a return except on a WARN verb;
2329 ERROR always causes a return. */
2334 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
2335 if (basic_errno != ERRNO_CALLOUTDEFER)
2337 if (search_error_message != NULL && *search_error_message != 0)
2338 *log_msgptr = search_error_message;
2339 if (smtp_return_error_details) acl_temp_details = TRUE;
2343 acl_temp_details = TRUE;
2345 if (acl->verb != ACL_WARN) return DEFER;
2348 default: /* Paranoia */
2350 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
2354 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
2359 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
2362 /* DISCARD and DROP can happen only from a nested ACL condition, and
2363 DISCARD can happen only for an "accept" or "discard" verb. */
2366 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
2371 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
2376 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
2377 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
2378 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
2383 if (cond == OK || cond == DISCARD) return cond;
2386 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
2394 acl_temp_details = TRUE;
2400 if (cond == OK) return FAIL;
2404 if (cond == OK || cond == DISCARD) return DISCARD;
2407 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
2413 if (cond == OK) return FAIL_DROP;
2417 if (cond != OK) return cond;
2422 acl_warn(where, *user_msgptr, *log_msgptr);
2423 else if (cond == DEFER)
2424 acl_warn(where, NULL, string_sprintf("ACL \"warn\" statement skipped: "
2425 "condition test deferred: %s",
2426 (*log_msgptr == NULL)? US"" : *log_msgptr));
2427 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
2431 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
2436 /* Pass to the next ACL item */
2441 /* We have reached the end of the ACL. This is an implicit DENY. */
2443 HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
2448 /*************************************************
2449 * Check access using an ACL *
2450 *************************************************/
2452 /* This is the external interface for ACL checks. It sets up an address and the
2453 expansions for $domain and $local_part when called after RCPT, then calls
2454 acl_check_internal() to do the actual work.
2457 where ACL_WHERE_xxxx indicating where called from
2458 data_string RCPT address, or SMTP command argument, or NULL
2459 s the input string; NULL is the same as an empty ACL => DENY
2460 user_msgptr where to put a user error (for SMTP response)
2461 log_msgptr where to put a logging message (not for SMTP response)
2463 Returns: OK access is granted by an ACCEPT verb
2464 DISCARD access is granted by a DISCARD verb
2465 FAIL access is denied
2466 FAIL_DROP access is denied; drop the connection
2467 DEFER can't tell at the moment
2472 acl_check(int where, uschar *data_string, uschar *s, uschar **user_msgptr,
2473 uschar **log_msgptr)
2479 *user_msgptr = *log_msgptr = NULL;
2480 sender_verified_failed = NULL;
2482 if (where == ACL_WHERE_RCPT)
2484 adb = address_defaults;
2486 addr->address = data_string;
2487 if (deliver_split_address(addr) == DEFER)
2489 *log_msgptr = US"defer in percent_hack_domains check";
2492 deliver_domain = addr->domain;
2493 deliver_localpart = addr->local_part;
2498 smtp_command_argument = data_string;
2501 rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
2503 smtp_command_argument = deliver_domain =
2504 deliver_localpart = deliver_address_data = sender_address_data = NULL;
2506 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
2507 ACL, which is really in the middle of an SMTP command. */
2511 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
2513 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
2514 "ACL", acl_wherenames[where]);
2520 /* A DROP response is not permitted from MAILAUTH */
2522 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
2524 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
2525 "ACL", acl_wherenames[where]);
2529 /* Before giving an error response, take a look at the length of any user
2530 message, and split it up into multiple lines if possible. */
2532 if (rc != OK && *user_msgptr != NULL && Ustrlen(*user_msgptr) > 75)
2534 uschar *s = *user_msgptr = string_copy(*user_msgptr);
2540 while (i < 75 && *ss != 0 && *ss != '\n') ss++, i++;
2541 if (*ss == 0) break;
2548 while (--t > s + 35)
2552 if (t[-1] == ':') { tt = t; break; }
2553 if (tt == NULL) tt = t;
2557 if (tt == NULL) /* Can't split behind - try ahead */
2562 if (*t == ' ' || *t == '\n')
2568 if (tt == NULL) break; /* Can't find anywhere to split */