1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Code for handling Access Control Lists (ACLs) */
15 /* Default callout timeout */
17 #define CALLOUT_TIMEOUT_DEFAULT 30
19 /* Default quota cache TTLs */
21 #define QUOTA_POS_DEFAULT (5*60)
22 #define QUOTA_NEG_DEFAULT (60*60)
25 /* ACL verb codes - keep in step with the table of verbs that follows */
27 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
32 static uschar *verbs[] = {
33 [ACL_ACCEPT] = US"accept",
34 [ACL_DEFER] = US"defer",
35 [ACL_DENY] = US"deny",
36 [ACL_DISCARD] = US"discard",
37 [ACL_DROP] = US"drop",
38 [ACL_REQUIRE] = US"require",
42 /* For each verb, the conditions for which "message" or "log_message" are used
43 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
44 "accept", the FAIL case is used only after "endpass", but that is selected in
47 static int msgcond[] = {
48 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
49 [ACL_DEFER] = BIT(OK),
51 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
53 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
59 /* ACL condition and modifier codes - keep in step with the table that
66 #ifdef EXPERIMENTAL_BRIGHTMAIL
72 #ifdef EXPERIMENTAL_DCC
75 #ifdef WITH_CONTENT_SCAN
93 ACLC_LOG_REJECT_TARGET,
95 #ifdef WITH_CONTENT_SCAN
99 #ifdef WITH_CONTENT_SCAN
105 #ifdef WITH_CONTENT_SCAN
113 #ifdef WITH_CONTENT_SCAN
123 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
124 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
125 modifiers that look like conditions but always return TRUE. They are used for
126 their side effects. Do not invent new modifier names that result in one name
127 being the prefix of another; the binary-search in the list will go wrong. */
129 typedef struct condition_def {
132 /* Flag to indicate the condition/modifier has a string expansion done
133 at the outer level. In the other cases, expansion already occurs in the
134 checking functions. */
135 BOOL expand_at_top:1;
139 /* Bit map vector of which conditions and modifiers are not allowed at certain
140 times. For each condition and modifier, there's a bitmap of dis-allowed times.
141 For some, it is easier to specify the negation of a small number of allowed
147 static condition_def conditions[] = {
148 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
150 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
152 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
153 ACL_BIT_PREDATA | ACL_BIT_DATA |
157 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
159 ACL_BIT_NOTSMTP_START),
162 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
163 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
164 ACL_BIT_CONNECT | ACL_BIT_HELO,
166 #ifdef EXPERIMENTAL_BRIGHTMAIL
167 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
169 ACL_BIT_CONNECT | ACL_BIT_HELO |
170 ACL_BIT_DATA | ACL_BIT_MIME |
171 # ifndef DISABLE_PRDR
174 ACL_BIT_ETRN | ACL_BIT_EXPN |
176 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
177 ACL_BIT_VRFY | ACL_BIT_PREDATA |
178 ACL_BIT_NOTSMTP_START,
181 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
182 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
184 /* Certain types of control are always allowed, so we let it through
185 always and check in the control processing itself. */
186 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
188 #ifdef EXPERIMENTAL_DCC
189 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
192 # ifndef DISABLE_PRDR
198 #ifdef WITH_CONTENT_SCAN
199 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
202 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
204 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
205 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
208 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
211 /* Explicit key lookups can be made in non-smtp ACLs so pass
212 always and check in the verify processing itself. */
213 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
215 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
217 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
223 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
224 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
228 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
230 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
231 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
233 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
235 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
242 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
243 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
244 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
250 # ifndef DISABLE_PRDR
257 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
258 #ifdef WITH_CONTENT_SCAN
259 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
262 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
270 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
271 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
273 #ifdef WITH_CONTENT_SCAN
274 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
277 # ifndef DISABLE_PRDR
285 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
287 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
288 ACL_BIT_PREDATA | ACL_BIT_DATA |
292 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
293 ACL_BIT_NOTSMTP_START),
295 [ACLC_SEEN] = { US"seen", TRUE, FALSE, 0 },
296 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
297 ACL_BIT_AUTH | ACL_BIT_CONNECT |
299 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
300 ACL_BIT_ETRN | ACL_BIT_EXPN |
301 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
303 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
304 ACL_BIT_AUTH | ACL_BIT_CONNECT |
306 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
307 ACL_BIT_ETRN | ACL_BIT_EXPN |
308 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
311 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
313 #ifdef WITH_CONTENT_SCAN
314 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
315 (unsigned int) ~(ACL_BIT_DATA |
316 # ifndef DISABLE_PRDR
323 [ACLC_SPF] = { US"spf", TRUE, FALSE,
324 ACL_BIT_AUTH | ACL_BIT_CONNECT |
325 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
326 ACL_BIT_ETRN | ACL_BIT_EXPN |
327 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
328 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
330 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
331 ACL_BIT_AUTH | ACL_BIT_CONNECT |
332 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
333 ACL_BIT_ETRN | ACL_BIT_EXPN |
334 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
335 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
338 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
340 /* Certain types of verify are always allowed, so we let it through
341 always and check in the verify function itself */
342 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
347 # include "macro_predef.h"
351 for (condition_def * c = conditions; c < conditions + nelem(conditions); c++)
353 uschar buf[64], * p, * s;
354 int n = sprintf(CS buf, "_ACL_%s_", c->is_modifier ? "MOD" : "COND");
355 for (p = buf + n, s = c->name; *s; s++) *p++ = toupper(*s);
357 builtin_macro_create(buf);
365 /* Return values from decode_control(); used as index so keep in step
366 with the controls_list table that follows! */
369 CONTROL_AUTH_UNADVERTISED,
370 #ifdef EXPERIMENTAL_BRIGHTMAIL
373 CONTROL_CASEFUL_LOCAL_PART,
374 CONTROL_CASELOWER_LOCAL_PART,
375 CONTROL_CUTTHROUGH_DELIVERY,
381 CONTROL_DMARC_VERIFY,
382 CONTROL_DMARC_FORENSIC,
385 CONTROL_ENFORCE_SYNC,
386 CONTROL_ERROR, /* pseudo-value for decode errors */
391 CONTROL_NO_CALLOUT_FLUSH,
392 CONTROL_NO_DELAY_FLUSH,
393 CONTROL_NO_ENFORCE_SYNC,
394 #ifdef WITH_CONTENT_SCAN
395 CONTROL_NO_MBOX_UNSPOOL,
397 CONTROL_NO_MULTILINE,
398 CONTROL_NO_PIPELINING,
402 CONTROL_SUPPRESS_LOCAL_FIXUPS,
404 CONTROL_UTF8_DOWNCONVERT,
410 /* Structure listing various control arguments, with their characteristics.
411 For each control, there's a bitmap of dis-allowed times. For some, it is easier
412 to specify the negation of a small number of allowed times. */
414 typedef struct control_def {
416 BOOL has_option; /* Has /option(s) following */
417 unsigned forbids; /* bitmap of dis-allowed times */
420 static control_def controls_list[] = {
421 /* name has_option forbids */
422 [CONTROL_AUTH_UNADVERTISED] =
423 { US"allow_auth_unadvertised", FALSE,
425 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
427 #ifdef EXPERIMENTAL_BRIGHTMAIL
429 { US"bmi_run", FALSE, 0 },
431 [CONTROL_CASEFUL_LOCAL_PART] =
432 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
433 [CONTROL_CASELOWER_LOCAL_PART] =
434 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
435 [CONTROL_CUTTHROUGH_DELIVERY] =
436 { US"cutthrough_delivery", TRUE, 0 },
438 { US"debug", TRUE, 0 },
441 [CONTROL_DKIM_VERIFY] =
442 { US"dkim_disable_verify", FALSE,
443 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
444 # ifndef DISABLE_PRDR
447 ACL_BIT_NOTSMTP_START
452 [CONTROL_DMARC_VERIFY] =
453 { US"dmarc_disable_verify", FALSE,
454 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
456 [CONTROL_DMARC_FORENSIC] =
457 { US"dmarc_enable_forensic", FALSE,
458 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
464 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
466 [CONTROL_ENFORCE_SYNC] =
467 { US"enforce_sync", FALSE,
468 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
471 /* Pseudo-value for decode errors */
473 { US"error", FALSE, 0 },
475 [CONTROL_FAKEDEFER] =
476 { US"fakedefer", TRUE,
478 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
479 ACL_BIT_PREDATA | ACL_BIT_DATA |
485 [CONTROL_FAKEREJECT] =
486 { US"fakereject", TRUE,
488 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
489 ACL_BIT_PREDATA | ACL_BIT_DATA |
498 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
499 ACL_BIT_PREDATA | ACL_BIT_DATA |
500 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
501 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
504 [CONTROL_NO_CALLOUT_FLUSH] =
505 { US"no_callout_flush", FALSE,
506 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
508 [CONTROL_NO_DELAY_FLUSH] =
509 { US"no_delay_flush", FALSE,
510 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
513 [CONTROL_NO_ENFORCE_SYNC] =
514 { US"no_enforce_sync", FALSE,
515 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
517 #ifdef WITH_CONTENT_SCAN
518 [CONTROL_NO_MBOX_UNSPOOL] =
519 { US"no_mbox_unspool", FALSE,
521 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
522 ACL_BIT_PREDATA | ACL_BIT_DATA |
523 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
527 [CONTROL_NO_MULTILINE] =
528 { US"no_multiline_responses", FALSE,
529 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
531 [CONTROL_NO_PIPELINING] =
532 { US"no_pipelining", FALSE,
533 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
539 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
540 ACL_BIT_PREDATA | ACL_BIT_DATA |
541 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
542 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
545 [CONTROL_SUBMISSION] =
546 { US"submission", TRUE,
548 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
550 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
551 { US"suppress_local_fixups", FALSE,
553 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
554 ACL_BIT_NOTSMTP_START)
557 [CONTROL_UTF8_DOWNCONVERT] =
558 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
563 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
564 caches its result in a tree to avoid repeated DNS queries. The result is an
565 integer code which is used as an index into the following tables of
566 explanatory strings and verification return codes. */
568 static tree_node *csa_cache = NULL;
570 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
571 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
573 /* The acl_verify_csa() return code is translated into an acl_verify() return
574 code using the following table. It is OK unless the client is definitely not
575 authorized. This is because CSA is supposed to be optional for sending sites,
576 so recipients should not be too strict about checking it - especially because
577 DNS problems are quite likely to occur. It's possible to use $csa_status in
578 further ACL conditions to distinguish ok, unknown, and defer if required, but
579 the aim is to make the usual configuration simple. */
581 static int csa_return_code[] = {
584 [CSA_DEFER_SRV] = OK,
585 [CSA_DEFER_ADDR] = OK,
586 [CSA_FAIL_EXPLICIT] = FAIL,
587 [CSA_FAIL_DOMAIN] = FAIL,
588 [CSA_FAIL_NOADDR] = FAIL,
589 [CSA_FAIL_MISMATCH] = FAIL
592 static uschar *csa_status_string[] = {
593 [CSA_UNKNOWN] = US"unknown",
595 [CSA_DEFER_SRV] = US"defer",
596 [CSA_DEFER_ADDR] = US"defer",
597 [CSA_FAIL_EXPLICIT] = US"fail",
598 [CSA_FAIL_DOMAIN] = US"fail",
599 [CSA_FAIL_NOADDR] = US"fail",
600 [CSA_FAIL_MISMATCH] = US"fail"
603 static uschar *csa_reason_string[] = {
604 [CSA_UNKNOWN] = US"unknown",
606 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
607 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
608 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
609 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
610 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
611 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
614 /* Options for the ratelimit condition. Note that there are two variants of
615 the per_rcpt option, depending on the ACL that is used to measure the rate.
616 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
617 so the two variants must have the same internal representation as well as
618 the same configuration string. */
621 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
622 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
625 #define RATE_SET(var,new) \
626 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
628 static uschar *ratelimit_option_string[] = {
629 [RATE_PER_WHAT] = US"?",
630 [RATE_PER_CLASH] = US"!",
631 [RATE_PER_ADDR] = US"per_addr",
632 [RATE_PER_BYTE] = US"per_byte",
633 [RATE_PER_CMD] = US"per_cmd",
634 [RATE_PER_CONN] = US"per_conn",
635 [RATE_PER_MAIL] = US"per_mail",
636 [RATE_PER_RCPT] = US"per_rcpt",
637 [RATE_PER_ALLRCPTS] = US"per_rcpt"
640 /* Enable recursion between acl_check_internal() and acl_check_condition() */
642 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
645 static acl_block * acl_current = NULL;
648 /*************************************************
649 * Find control in list *
650 *************************************************/
652 /* The lists are always in order, so binary chop can be used.
655 name the control name to search for
656 ol the first entry in the control list
657 last one more than the offset of the last entry in the control list
659 Returns: index of a control entry, or -1 if not found
663 find_control(const uschar * name, control_def * ol, int last)
665 for (int first = 0; last > first; )
667 int middle = (first + last)/2;
668 uschar * s = ol[middle].name;
669 int c = Ustrncmp(name, s, Ustrlen(s));
670 if (c == 0) return middle;
671 else if (c > 0) first = middle + 1;
679 /*************************************************
680 * Pick out condition from list *
681 *************************************************/
683 /* Use a binary chop method
687 list list of conditions
690 Returns: offset in list, or -1 if not found
694 acl_checkcondition(uschar * name, condition_def * list, int end)
696 for (int start = 0; start < end; )
698 int mid = (start + end)/2;
699 int c = Ustrcmp(name, list[mid].name);
700 if (c == 0) return mid;
701 if (c < 0) end = mid;
702 else start = mid + 1;
708 /*************************************************
709 * Pick out name from list *
710 *************************************************/
712 /* Use a binary chop method
719 Returns: offset in list, or -1 if not found
723 acl_checkname(uschar *name, uschar **list, int end)
725 for (int start = 0; start < end; )
727 int mid = (start + end)/2;
728 int c = Ustrcmp(name, list[mid]);
729 if (c == 0) return mid;
730 if (c < 0) end = mid; else start = mid + 1;
738 acl_varname_to_cond(const uschar ** sp, acl_condition_block * cond, uschar ** error)
740 const uschar * s = *sp, * endptr;
743 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
744 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
747 if (isalnum(*endptr))
749 *error = string_sprintf("invalid variable name after \"set\" in ACL "
750 "modifier \"set %s\" "
751 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
755 cond->u.varname = string_copyn(s, 18);
760 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
762 *error = string_sprintf("invalid variable name after \"set\" in ACL "
763 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
768 if (!isdigit(*endptr) && *endptr != '_')
770 *error = string_sprintf("invalid variable name after \"set\" in ACL "
771 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
776 for ( ; *endptr && *endptr != '=' && !isspace(*endptr); endptr++)
777 if (!isalnum(*endptr) && *endptr != '_')
779 *error = string_sprintf("invalid character \"%c\" in variable name "
780 "in ACL modifier \"set %s\"", *endptr, s);
784 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
787 Uskip_whitespace(&s);
794 acl_data_to_cond(const uschar * s, acl_condition_block * cond,
795 const uschar * name, uschar ** error)
799 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
800 conditions[cond->type].is_modifier ? US"modifier" : US"condition");
803 Uskip_whitespace(&s);
804 cond->arg = string_copy(s);
809 /*************************************************
810 * Read and parse one ACL *
811 *************************************************/
813 /* This function is called both from readconf in order to parse the ACLs in the
814 configuration file, and also when an ACL is encountered dynamically (e.g. as
815 the result of an expansion). It is given a function to call in order to
816 retrieve the lines of the ACL. This function handles skipping comments and
817 blank lines (where relevant).
820 func function to get next line of ACL
821 error where to put an error message
823 Returns: pointer to ACL, or NULL
824 NULL can be legal (empty ACL); in this case error will be NULL
828 acl_read(uschar *(*func)(void), uschar **error)
830 acl_block *yield = NULL;
831 acl_block **lastp = &yield;
832 acl_block *this = NULL;
833 acl_condition_block *cond;
834 acl_condition_block **condp = NULL;
839 while ((s = (*func)()))
842 BOOL negated = FALSE;
843 const uschar * saveline = s;
844 uschar name[EXIM_DRIVERNAME_MAX];
846 /* Conditions (but not verbs) are allowed to be negated by an initial
849 if (Uskip_whitespace(&s) == '!')
855 /* Read the name of a verb or a condition, or the start of a new ACL, which
856 can be started by a name, or by a macro definition. */
858 s = readconf_readname(name, sizeof(name), s);
859 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
861 /* If a verb is unrecognized, it may be another condition or modifier that
862 continues the previous verb. */
864 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
868 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
880 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
883 *lastp = this = store_get(sizeof(acl_block), GET_UNTAINTED);
886 this->condition = NULL;
888 this->srcline = config_lineno; /* for debug output */
889 this->srcfile = config_filename; /**/
890 condp = &this->condition;
891 if (!*s) continue; /* No condition on this line */
897 s = readconf_readname(name, sizeof(name), s); /* Condition name */
900 /* Handle a condition or modifier. */
902 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
904 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
909 /* The modifiers may not be negated */
911 if (negated && conditions[c].is_modifier)
913 *error = string_sprintf("ACL error: negation is not allowed with "
914 "\"%s\"", conditions[c].name);
918 /* ENDPASS may occur only with ACCEPT or DISCARD. */
920 if (c == ACLC_ENDPASS &&
921 this->verb != ACL_ACCEPT &&
922 this->verb != ACL_DISCARD)
924 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
925 conditions[c].name, verbs[this->verb]);
929 cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
932 cond->u.negated = negated;
937 /* The "set" modifier is different in that its argument is "name=value"
938 rather than just a value, and we can check the validity of the name, which
939 gives us a variable name to insert into the data block. The original ACL
940 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
941 extended to 20 of each type, but after that people successfully argued for
942 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
943 After that, we allow alphanumerics and underscores, but the first character
944 after c or m must be a digit or an underscore. This retains backwards
948 if (!acl_varname_to_cond(&s, cond, error)) return NULL;
950 /* For "set", we are now positioned for the data. For the others, only
951 "endpass" has no data */
953 if (c != ACLC_ENDPASS)
954 if (!acl_data_to_cond(s, cond, name, error)) return NULL;
962 /*************************************************
963 * Set up added header line(s) *
964 *************************************************/
966 /* This function is called by the add_header modifier, and also from acl_warn()
967 to implement the now-deprecated way of adding header lines using "message" on a
968 "warn" verb. The argument is treated as a sequence of header lines which are
969 added to a chain, provided there isn't an identical one already there.
971 Argument: string of header lines
976 setup_header(const uschar *hstring)
979 int hlen = Ustrlen(hstring);
981 /* Ignore any leading newlines */
982 while (*hstring == '\n') hstring++, hlen--;
984 /* An empty string does nothing; ensure exactly one final newline. */
985 if (hlen <= 0) return;
986 if (hstring[--hlen] != '\n') /* no newline */
987 q = string_sprintf("%s\n", hstring);
988 else if (hstring[hlen-1] == '\n') /* double newline */
990 uschar * s = string_copy(hstring);
991 while(s[--hlen] == '\n')
998 /* Loop for multiple header lines, taking care about continuations */
1000 for (p = q; *p; p = q)
1004 int newtype = htype_add_bot;
1005 header_line **hptr = &acl_added_headers;
1007 /* Find next header line within the string */
1011 q = Ustrchr(q, '\n'); /* we know there was a newline */
1012 if (*++q != ' ' && *q != '\t') break;
1015 /* If the line starts with a colon, interpret the instruction for where to
1016 add it. This temporarily sets up a new type. */
1020 if (strncmpic(p, US":after_received:", 16) == 0)
1022 newtype = htype_add_rec;
1025 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1027 newtype = htype_add_rfc;
1030 else if (strncmpic(p, US":at_start:", 10) == 0)
1032 newtype = htype_add_top;
1035 else if (strncmpic(p, US":at_end:", 8) == 0)
1037 newtype = htype_add_bot;
1040 while (*p == ' ' || *p == '\t') p++;
1043 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1044 to the front of it. */
1046 for (s = p; s < q - 1; s++)
1047 if (*s == ':' || !isgraph(*s)) break;
1049 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1050 hlen = Ustrlen(hdr);
1052 /* See if this line has already been added */
1056 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1057 hptr = &(*hptr)->next;
1060 /* Add if not previously present */
1064 /* The header_line struct itself is not tainted, though it points to
1065 possibly tainted data. */
1066 header_line * h = store_get(sizeof(header_line), GET_UNTAINTED);
1079 /*************************************************
1080 * List the added header lines *
1081 *************************************************/
1087 for (header_line * h = acl_added_headers; h; h = h->next)
1090 if (h->text[i-1] == '\n') i--;
1091 g = string_append_listele_n(g, '\n', h->text, i);
1094 return g ? g->s : NULL;
1098 /*************************************************
1099 * Set up removed header line(s) *
1100 *************************************************/
1102 /* This function is called by the remove_header modifier. The argument is
1103 treated as a sequence of header names which are added to a colon separated
1104 list, provided there isn't an identical one already there.
1106 Argument: string of header names
1111 setup_remove_header(const uschar *hnames)
1114 acl_removed_headers = acl_removed_headers
1115 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1116 : string_copy(hnames);
1121 /*************************************************
1123 *************************************************/
1125 /* This function is called when a WARN verb's conditions are true. It adds to
1126 the message's headers, and/or writes information to the log. In each case, this
1127 only happens once (per message for headers, per connection for log).
1129 ** NOTE: The header adding action using the "message" setting is historic, and
1130 its use is now deprecated. The new add_header modifier should be used instead.
1133 where ACL_WHERE_xxxx indicating which ACL this is
1134 user_message message for adding to headers
1135 log_message message for logging, if different
1141 acl_warn(int where, uschar *user_message, uschar *log_message)
1143 if (log_message != NULL && log_message != user_message)
1146 string_item *logged;
1148 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1149 string_printing(log_message));
1151 /* If a sender verification has failed, and the log message is "sender verify
1152 failed", add the failure message. */
1154 if (sender_verified_failed != NULL &&
1155 sender_verified_failed->message != NULL &&
1156 strcmpic(log_message, US"sender verify failed") == 0)
1157 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1159 /* Search previously logged warnings. They are kept in malloc
1160 store so they can be freed at the start of a new message. */
1162 for (logged = acl_warn_logged; logged; logged = logged->next)
1163 if (Ustrcmp(logged->text, text) == 0) break;
1167 int length = Ustrlen(text) + 1;
1168 log_write(0, LOG_MAIN, "%s", text);
1169 logged = store_malloc(sizeof(string_item) + length);
1170 logged->text = US logged + sizeof(string_item);
1171 memcpy(logged->text, text, length);
1172 logged->next = acl_warn_logged;
1173 acl_warn_logged = logged;
1177 /* If there's no user message, we are done. */
1179 if (!user_message) return;
1181 /* If this isn't a message ACL, we can't do anything with a user message.
1184 if (where > ACL_WHERE_NOTSMTP)
1186 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1187 "found in a non-message (%s) ACL: cannot specify header lines here: "
1188 "message ignored", acl_wherenames[where]);
1192 /* The code for setting up header lines is now abstracted into a separate
1193 function so that it can be used for the add_header modifier as well. */
1195 setup_header(user_message);
1200 /*************************************************
1201 * Verify and check reverse DNS *
1202 *************************************************/
1204 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1205 address if this has not yet been done. The host_name_lookup() function checks
1206 that one of these names resolves to an address list that contains the client IP
1207 address, so we don't actually have to do the check here.
1210 user_msgptr pointer for user message
1211 log_msgptr pointer for log message
1213 Returns: OK verification condition succeeded
1214 FAIL verification failed
1215 DEFER there was a problem verifying
1219 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1223 /* Previous success */
1225 if (sender_host_name) return OK;
1227 /* Previous failure */
1229 if (host_lookup_failed)
1231 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1235 /* Need to do a lookup */
1238 debug_printf_indent("looking up host name to force name/address consistency check\n");
1240 if ((rc = host_name_lookup()) != OK)
1242 *log_msgptr = rc == DEFER
1243 ? US"host lookup deferred for reverse lookup check"
1244 : string_sprintf("host lookup failed for reverse lookup check%s",
1246 return rc; /* DEFER or FAIL */
1249 host_build_sender_fullhost();
1255 /*************************************************
1256 * Check client IP address matches CSA target *
1257 *************************************************/
1259 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1260 response for address records belonging to the CSA target hostname. The section
1261 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1262 If one of the addresses matches the client's IP address, then the client is
1263 authorized by CSA. If there are target IP addresses but none of them match
1264 then the client is using an unauthorized IP address. If there are no target IP
1265 addresses then the client cannot be using an authorized IP address. (This is
1266 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1269 dnsa the DNS answer block
1270 dnss a DNS scan block for us to use
1271 reset option specifying what portion to scan, as described above
1272 target the target hostname to use for matching RR names
1274 Returns: CSA_OK successfully authorized
1275 CSA_FAIL_MISMATCH addresses found but none matched
1276 CSA_FAIL_NOADDR no target addresses found
1280 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1283 int rc = CSA_FAIL_NOADDR;
1285 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1287 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1289 /* Check this is an address RR for the target hostname. */
1293 && rr->type != T_AAAA
1297 if (strcmpic(target, rr->name) != 0) continue;
1299 rc = CSA_FAIL_MISMATCH;
1301 /* Turn the target address RR into a list of textual IP addresses and scan
1302 the list. There may be more than one if it is an A6 RR. */
1304 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1306 /* If the client IP address matches the target IP address, it's good! */
1308 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1310 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1314 /* If we found some target addresses but none of them matched, the client is
1315 using an unauthorized IP address, otherwise the target has no authorized IP
1323 /*************************************************
1324 * Verify Client SMTP Authorization *
1325 *************************************************/
1327 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1328 to find the CSA SRV record corresponding to the domain argument, or
1329 $sender_helo_name if no argument is provided. It then checks that the
1330 client is authorized, and that its IP address corresponds to the SRV
1331 target's address by calling acl_verify_csa_address() above. The address
1332 should have been returned in the DNS response's ADDITIONAL section, but if
1333 not we perform another DNS lookup to get it.
1336 domain pointer to optional parameter following verify = csa
1338 Returns: CSA_UNKNOWN no valid CSA record found
1339 CSA_OK successfully authorized
1340 CSA_FAIL_* client is definitely not authorized
1341 CSA_DEFER_* there was a DNS problem
1345 acl_verify_csa(const uschar *domain)
1348 const uschar *found;
1349 int priority, weight, port;
1353 int rc, type, yield;
1354 #define TARGET_SIZE 256
1355 uschar * target = store_get(TARGET_SIZE, GET_TAINTED);
1357 /* Work out the domain we are using for the CSA lookup. The default is the
1358 client's HELO domain. If the client has not said HELO, use its IP address
1359 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1361 while (isspace(*domain) && *domain != '\0') ++domain;
1362 if (*domain == '\0') domain = sender_helo_name;
1363 if (!domain) domain = sender_host_address;
1364 if (!sender_host_address) return CSA_UNKNOWN;
1366 /* If we have an address literal, strip off the framing ready for turning it
1367 into a domain. The framing consists of matched square brackets possibly
1368 containing a keyword and a colon before the actual IP address. */
1370 if (domain[0] == '[')
1372 const uschar *start = Ustrchr(domain, ':');
1373 if (start == NULL) start = domain;
1374 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1377 /* Turn domains that look like bare IP addresses into domains in the reverse
1378 DNS. This code also deals with address literals and $sender_host_address. It's
1379 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1380 address literals, but it's probably the most friendly thing to do. This is an
1381 extension to CSA, so we allow it to be turned off for proper conformance. */
1383 if (string_is_ip_address(domain, NULL) != 0)
1385 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1386 domain = dns_build_reverse(domain);
1389 /* Find out if we've already done the CSA check for this domain. If we have,
1390 return the same result again. Otherwise build a new cached result structure
1391 for this domain. The name is filled in now, and the value is filled in when
1392 we return from this function. */
1394 if ((t = tree_search(csa_cache, domain)))
1397 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), domain);
1398 Ustrcpy(t->name, domain);
1399 (void)tree_insertnode(&csa_cache, t);
1401 /* Now we are ready to do the actual DNS lookup(s). */
1404 dnsa = store_get_dns_answer();
1405 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1407 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1410 yield = CSA_DEFER_SRV;
1413 /* If we found nothing, the client's authorization is unknown. */
1417 yield = CSA_UNKNOWN;
1420 /* We got something! Go on to look at the reply in more detail. */
1426 /* Scan the reply for well-formed CSA SRV records. */
1428 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1430 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1432 const uschar * p = rr->data;
1434 /* Extract the numerical SRV fields (p is incremented) */
1436 GETSHORT(priority, p);
1437 GETSHORT(weight, p);
1441 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1443 /* Check the CSA version number */
1445 if (priority != 1) continue;
1447 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1448 found by dns_special_lookup() is a parent of the one we asked for), we check
1449 the subdomain assertions in the port field. At the moment there's only one
1450 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1451 SRV records of their own. */
1453 if (Ustrcmp(found, domain) != 0)
1455 yield = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1459 /* This CSA SRV record refers directly to our domain, so we check the value
1460 in the weight field to work out the domain's authorization. 0 and 1 are
1461 unauthorized; 3 means the client is authorized but we can't check the IP
1462 address in order to authenticate it, so we treat it as unknown; values
1463 greater than 3 are undefined. */
1467 yield = CSA_FAIL_DOMAIN;
1471 if (weight > 2) continue;
1473 /* Weight == 2, which means the domain is authorized. We must check that the
1474 client's IP address is listed as one of the SRV target addresses. Save the
1475 target hostname then break to scan the additional data for its addresses. */
1477 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1478 (DN_EXPAND_ARG4_TYPE)target, TARGET_SIZE);
1480 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1485 /* If we didn't break the loop then no appropriate records were found. */
1489 yield = CSA_UNKNOWN;
1493 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1494 A target of "." indicates there are no valid addresses, so the client cannot
1495 be authorized. (This is an odd configuration because weight=2 target=. is
1496 equivalent to weight=1, but we check for it in order to keep load off the
1497 root name servers.) Note that dn_expand() turns "." into "". */
1499 if (Ustrcmp(target, "") == 0)
1501 yield = CSA_FAIL_NOADDR;
1505 /* Scan the additional section of the CSA SRV reply for addresses belonging
1506 to the target. If the name server didn't return any additional data (e.g.
1507 because it does not fully support SRV records), we need to do another lookup
1508 to obtain the target addresses; otherwise we have a definitive result. */
1510 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1511 if (rc != CSA_FAIL_NOADDR)
1517 /* The DNS lookup type corresponds to the IP version used by the client. */
1520 if (Ustrchr(sender_host_address, ':') != NULL)
1523 #endif /* HAVE_IPV6 */
1527 lookup_dnssec_authenticated = NULL;
1528 switch (dns_lookup(dnsa, target, type, NULL))
1530 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1533 yield = CSA_DEFER_ADDR;
1536 /* If the query succeeded, scan the addresses and return the result. */
1539 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1540 if (rc != CSA_FAIL_NOADDR)
1545 /* else fall through */
1547 /* If the target has no IP addresses, the client cannot have an authorized
1548 IP address. However, if the target site uses A6 records (not AAAA records)
1549 we have to do yet another lookup in order to check them. */
1553 yield = CSA_FAIL_NOADDR;
1559 store_free_dns_answer(dnsa);
1560 return t->data.val = yield;
1565 /*************************************************
1566 * Handle verification (address & other) *
1567 *************************************************/
1569 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1570 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1571 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1576 unsigned where_allowed; /* bitmap */
1577 BOOL no_options; /* Never has /option(s) following */
1578 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1580 static verify_type_t verify_type_list[] = {
1581 /* name value where no-opt opt-sep */
1582 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1583 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1584 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1585 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1586 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BITS_HAVEDATA, TRUE, 0 },
1587 { US"not_blind", VERIFY_NOT_BLIND, ACL_BITS_HAVEDATA, FALSE, 0 },
1588 { US"header_sender", VERIFY_HDR_SNDR, ACL_BITS_HAVEDATA, FALSE, 0 },
1589 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1590 | ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1592 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1593 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BITS_HAVEDATA, TRUE, 0 },
1594 #ifdef EXPERIMENTAL_ARC
1595 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1600 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1601 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1602 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1603 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1609 BOOL has_option; /* Has =option(s) following */
1610 BOOL timeval; /* Has a time value */
1612 static callout_opt_t callout_opt_list[] = {
1613 /* name value flag has-opt has-time */
1614 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1615 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1616 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1617 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1618 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1619 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1620 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1621 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1622 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1623 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1624 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1625 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1626 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1632 v_period(const uschar * s, const uschar * arg, uschar ** log_msgptr)
1635 if ((period = readconf_readtime(s, 0, FALSE)) < 0)
1637 *log_msgptr = string_sprintf("bad time value in ACL condition "
1638 "\"verify %s\"", arg);
1645 /* This function implements the "verify" condition. It is called when
1646 encountered in any ACL, because some tests are almost always permitted. Some
1647 just don't make sense, and always fail (for example, an attempt to test a host
1648 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1651 where where called from
1652 addr the recipient address that the ACL is handling, or NULL
1653 arg the argument of "verify"
1654 user_msgptr pointer for user message
1655 log_msgptr pointer for log message
1656 basic_errno where to put verify errno
1658 Returns: OK verification condition succeeded
1659 FAIL verification failed
1660 DEFER there was a problem verifying
1665 acl_verify(int where, address_item *addr, const uschar *arg,
1666 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1670 int callout_overall = -1;
1671 int callout_connect = -1;
1672 int verify_options = 0;
1674 BOOL verify_header_sender = FALSE;
1675 BOOL defer_ok = FALSE;
1676 BOOL callout_defer_ok = FALSE;
1677 BOOL no_details = FALSE;
1678 BOOL success_on_redirect = FALSE;
1680 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
1681 address_item *sender_vaddr = NULL;
1682 uschar *verify_sender_address = NULL;
1683 uschar *pm_mailfrom = NULL;
1684 uschar *se_mailfrom = NULL;
1686 /* Some of the verify items have slash-separated options; some do not. Diagnose
1687 an error if options are given for items that don't expect them.
1690 uschar *slash = Ustrchr(arg, '/');
1691 const uschar *list = arg;
1692 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1695 if (!ss) goto BAD_VERIFY;
1697 /* Handle name/address consistency verification in a separate function. */
1699 for (vp = verify_type_list;
1700 CS vp < CS verify_type_list + sizeof(verify_type_list);
1703 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1704 : strcmpic (ss, vp->name) == 0)
1706 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1709 if (vp->no_options && slash)
1711 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1712 "(this verify item has no options)", arg);
1715 if (!(vp->where_allowed & BIT(where)))
1717 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1718 vp->name, acl_wherenames[where]);
1723 case VERIFY_REV_HOST_LKUP:
1724 if (!sender_host_address) return OK;
1725 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1726 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1727 if (strcmpic(ss, US"defer_ok") == 0)
1732 /* TLS certificate verification is done at STARTTLS time; here we just
1733 test whether it was successful or not. (This is for optional verification; for
1734 mandatory verification, the connection doesn't last this long.) */
1736 if (tls_in.certificate_verified) return OK;
1737 *user_msgptr = US"no verified certificate";
1741 /* We can test the result of optional HELO verification that might have
1742 occurred earlier. If not, we can attempt the verification now. */
1744 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1745 return f.helo_verified ? OK : FAIL;
1748 /* Do Client SMTP Authorization checks in a separate function, and turn the
1749 result code into user-friendly strings. */
1751 rc = acl_verify_csa(list);
1752 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1753 csa_reason_string[rc]);
1754 csa_status = csa_status_string[rc];
1755 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1756 return csa_return_code[rc];
1758 #ifdef EXPERIMENTAL_ARC
1760 { /* Do Authenticated Received Chain checks in a separate function. */
1761 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1765 if (!(arc_state = acl_verify_arc())) return DEFER;
1766 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1767 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1769 if (!condlist) condlist = US"none:pass";
1770 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1771 if (Ustrcmp(arc_state, cond) == 0) return OK;
1776 case VERIFY_HDR_SYNTAX:
1777 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1778 a syntax error, we return details of the error to the sender if configured to
1779 send out full details. (But a "message" setting on the ACL can override, as
1782 rc = verify_check_headers(log_msgptr);
1783 if (rc != OK && *log_msgptr)
1784 if (smtp_return_error_details)
1785 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1787 acl_verify_message = *log_msgptr;
1790 case VERIFY_HDR_NAMES_ASCII:
1791 /* Check that all header names are true 7 bit strings
1792 See RFC 5322, 2.2. and RFC 6532, 3. */
1794 rc = verify_check_header_names_ascii(log_msgptr);
1795 if (rc != OK && smtp_return_error_details && *log_msgptr)
1796 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1799 case VERIFY_NOT_BLIND:
1800 /* Check that no recipient of this message is "blind", that is, every envelope
1801 recipient must be mentioned in either To: or Cc:. */
1803 BOOL case_sensitive = TRUE;
1805 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1806 if (strcmpic(ss, US"case_insensitive") == 0)
1807 case_sensitive = FALSE;
1810 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1811 "condition \"verify %s\"", ss, arg);
1815 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1817 *log_msgptr = US"bcc recipient detected";
1818 if (smtp_return_error_details)
1819 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1824 /* The remaining verification tests check recipient and sender addresses,
1825 either from the envelope or from the header. There are a number of
1826 slash-separated options that are common to all of them. */
1828 case VERIFY_HDR_SNDR:
1829 verify_header_sender = TRUE;
1833 /* In the case of a sender, this can optionally be followed by an address to use
1834 in place of the actual sender (rare special-case requirement). */
1838 verify_sender_address = sender_address;
1841 while (isspace(*s)) s++;
1842 if (*s++ != '=') goto BAD_VERIFY;
1843 while (isspace(*s)) s++;
1844 verify_sender_address = string_copy(s);
1855 /* Remaining items are optional; they apply to sender and recipient
1856 verification, including "header sender" verification. */
1858 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1860 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1861 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1862 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1864 /* These two old options are left for backwards compatibility */
1866 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1868 callout_defer_ok = TRUE;
1869 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1872 else if (strcmpic(ss, US"check_postmaster") == 0)
1875 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1878 /* The callout option has a number of sub-options, comma separated */
1880 else if (strncmpic(ss, US"callout", 7) == 0)
1882 callout = CALLOUT_TIMEOUT_DEFAULT;
1885 while (isspace(*ss)) ss++;
1888 const uschar * sublist = ss;
1891 while (isspace(*sublist)) sublist++;
1892 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1895 double period = 1.0F;
1897 for (op= callout_opt_list; op->name; op++)
1898 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1901 verify_options |= op->flag;
1904 opt += Ustrlen(op->name);
1905 while (isspace(*opt)) opt++;
1908 *log_msgptr = string_sprintf("'=' expected after "
1909 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1912 while (isspace(*opt)) opt++;
1914 if (op->timeval && (period = v_period(opt, arg, log_msgptr)) < 0)
1919 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1920 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1921 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1922 case CALLOUT_MAILFROM:
1923 if (!verify_header_sender)
1925 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1926 "callout option only for verify=header_sender (detected in ACL "
1927 "condition \"%s\")", arg);
1930 se_mailfrom = string_copy(opt);
1932 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1933 case CALLOUT_MAXWAIT: callout_overall = period; break;
1934 case CALLOUT_CONNECT: callout_connect = period; break;
1935 case CALLOUT_TIME: callout = period; break;
1941 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1942 "ACL condition \"%s\"", arg);
1948 /* The quota option has sub-options, comma-separated */
1950 else if (strncmpic(ss, US"quota", 5) == 0)
1955 while (isspace(*ss)) ss++;
1958 const uschar * sublist = ss;
1962 while (isspace(*sublist)) sublist++;
1963 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1964 if (Ustrncmp(opt, "cachepos=", 9) == 0)
1965 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1968 quota_pos_cache = period;
1969 else if (Ustrncmp(opt, "cacheneg=", 9) == 0)
1970 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1973 quota_neg_cache = period;
1974 else if (Ustrcmp(opt, "no_cache") == 0)
1975 quota_pos_cache = quota_neg_cache = 0;
1980 /* Option not recognized */
1984 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1985 "condition \"verify %s\"", ss, arg);
1990 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1991 (vopt_callout_recipsender|vopt_callout_recippmaster))
1993 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1994 "for a recipient callout";
1998 /* Handle quota verification */
2001 if (vp->value != VERIFY_RCPT)
2003 *log_msgptr = US"can only verify quota of recipient";
2007 if ((rc = verify_quota_call(addr->address,
2008 quota_pos_cache, quota_neg_cache, log_msgptr)) != OK)
2010 *basic_errno = errno;
2011 if (smtp_return_error_details)
2013 if (!*user_msgptr && *log_msgptr)
2014 *user_msgptr = string_sprintf("Rejected after %s: %s",
2015 smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]],
2017 if (rc == DEFER) f.acl_temp_details = TRUE;
2024 /* Handle sender-in-header verification. Default the user message to the log
2025 message if giving out verification details. */
2027 if (verify_header_sender)
2031 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
2032 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2035 *basic_errno = verrno;
2036 if (smtp_return_error_details)
2038 if (!*user_msgptr && *log_msgptr)
2039 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2040 if (rc == DEFER) f.acl_temp_details = TRUE;
2045 /* Handle a sender address. The default is to verify *the* sender address, but
2046 optionally a different address can be given, for special requirements. If the
2047 address is empty, we are dealing with a bounce message that has no sender, so
2048 we cannot do any checking. If the real sender address gets rewritten during
2049 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2050 during message reception.
2052 A list of verified "sender" addresses is kept to try to avoid doing to much
2053 work repetitively when there are multiple recipients in a message and they all
2054 require sender verification. However, when callouts are involved, it gets too
2055 complicated because different recipients may require different callout options.
2056 Therefore, we always do a full sender verify when any kind of callout is
2057 specified. Caching elsewhere, for instance in the DNS resolver and in the
2058 callout handling, should ensure that this is not terribly inefficient. */
2060 else if (verify_sender_address)
2062 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
2064 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2065 "sender verify callout";
2069 sender_vaddr = verify_checked_sender(verify_sender_address);
2070 if ( sender_vaddr /* Previously checked */
2071 && callout <= 0) /* No callout needed this time */
2073 /* If the "routed" flag is set, it means that routing worked before, so
2074 this check can give OK (the saved return code value, if set, belongs to a
2075 callout that was done previously). If the "routed" flag is not set, routing
2076 must have failed, so we use the saved return code. */
2078 if (testflag(sender_vaddr, af_verify_routed))
2082 rc = sender_vaddr->special_action;
2083 *basic_errno = sender_vaddr->basic_errno;
2085 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
2088 /* Do a new verification, and cache the result. The cache is used to avoid
2089 verifying the sender multiple times for multiple RCPTs when callouts are not
2090 specified (see comments above).
2092 The cache is also used on failure to give details in response to the first
2093 RCPT that gets bounced for this reason. However, this can be suppressed by
2094 the no_details option, which sets the flag that says "this detail has already
2095 been sent". The cache normally contains just one address, but there may be
2096 more in esoteric circumstances. */
2101 uschar *save_address_data = deliver_address_data;
2103 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2105 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2107 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2108 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2111 if (no_details) setflag(sender_vaddr, af_sverify_told);
2112 if (verify_sender_address[0] != 0)
2114 /* If this is the real sender address, save the unrewritten version
2115 for use later in receive. Otherwise, set a flag so that rewriting the
2116 sender in verify_address() does not update sender_address. */
2118 if (verify_sender_address == sender_address)
2119 sender_address_unrewritten = sender_address;
2121 verify_options |= vopt_fake_sender;
2123 if (success_on_redirect)
2124 verify_options |= vopt_success_on_redirect;
2126 /* The recipient, qualify, and expn options are never set in
2129 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2130 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2132 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2135 *basic_errno = sender_vaddr->basic_errno;
2138 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2139 debug_printf_indent("sender %s verified ok as %s\n",
2140 verify_sender_address, sender_vaddr->address);
2142 debug_printf_indent("sender %s verified ok\n",
2143 verify_sender_address);
2146 rc = OK; /* Null sender */
2148 /* Cache the result code */
2150 if (routed) setflag(sender_vaddr, af_verify_routed);
2151 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2152 sender_vaddr->special_action = rc;
2153 sender_vaddr->next = sender_verified_list;
2154 sender_verified_list = sender_vaddr;
2156 /* Restore the recipient address data, which might have been clobbered by
2157 the sender verification. */
2159 deliver_address_data = save_address_data;
2162 /* Put the sender address_data value into $sender_address_data */
2164 sender_address_data = sender_vaddr->prop.address_data;
2167 /* A recipient address just gets a straightforward verify; again we must handle
2168 the DEFER overrides. */
2174 if (success_on_redirect)
2175 verify_options |= vopt_success_on_redirect;
2177 /* We must use a copy of the address for verification, because it might
2181 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2182 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2183 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2185 *basic_errno = addr2.basic_errno;
2186 *log_msgptr = addr2.message;
2187 *user_msgptr = addr2.user_message ? addr2.user_message : addr2.message;
2189 /* Allow details for temporary error if the address is so flagged. */
2190 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2192 /* Make $address_data visible */
2193 deliver_address_data = addr2.prop.address_data;
2196 /* We have a result from the relevant test. Handle defer overrides first. */
2200 || callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER
2203 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2204 defer_ok? "defer_ok" : "callout_defer_ok");
2208 /* If we've failed a sender, set up a recipient message, and point
2209 sender_verified_failed to the address item that actually failed. */
2211 if (rc != OK && verify_sender_address)
2214 *log_msgptr = *user_msgptr = US"Sender verify failed";
2215 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2216 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2219 *log_msgptr = US"Could not complete sender verify callout";
2220 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2224 sender_verified_failed = sender_vaddr;
2227 /* Verifying an address messes up the values of $domain and $local_part,
2228 so reset them before returning if this is a RCPT ACL. */
2232 deliver_domain = addr->domain;
2233 deliver_localpart = addr->local_part;
2237 /* Syntax errors in the verify argument come here. */
2240 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2241 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2242 "or \"reverse_host_lookup\" at start of ACL condition "
2243 "\"verify %s\"", arg);
2250 /*************************************************
2251 * Check argument for control= modifier *
2252 *************************************************/
2254 /* Called from acl_check_condition() below.
2255 To handle the case "queue_only" we accept an _ in the
2256 initial / option-switch position.
2259 arg the argument string for control=
2260 pptr set to point to the terminating character
2261 where which ACL we are in
2262 log_msgptr for error messages
2264 Returns: CONTROL_xxx value
2268 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2274 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2275 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2276 && (!d->has_option || c != '/' && c != '_')
2279 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2280 return CONTROL_ERROR;
2290 /*************************************************
2291 * Return a ratelimit error *
2292 *************************************************/
2294 /* Called from acl_ratelimit() below
2297 log_msgptr for error messages
2298 format format string
2299 ... supplementary arguments
2305 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2309 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2311 va_start(ap, format);
2312 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2315 gstring_release_unused(g);
2316 *log_msgptr = string_from_gstring(g);
2323 /*************************************************
2324 * Handle rate limiting *
2325 *************************************************/
2327 /* Called by acl_check_condition() below to calculate the result
2328 of the ACL ratelimit condition.
2330 Note that the return value might be slightly unexpected: if the
2331 sender's rate is above the limit then the result is OK. This is
2332 similar to the dnslists condition, and is so that you can write
2333 ACL clauses like: defer ratelimit = 15 / 1h
2336 arg the option string for ratelimit=
2337 where ACL_WHERE_xxxx indicating which ACL this is
2338 log_msgptr for error messages
2340 Returns: OK - Sender's rate is above limit
2341 FAIL - Sender's rate is below limit
2342 DEFER - Problem opening ratelimit database
2343 ERROR - Syntax error in options.
2347 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2349 double limit, period, count;
2352 uschar *unique = NULL;
2354 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2355 BOOL noupdate = FALSE, badacl = FALSE;
2356 int mode = RATE_PER_WHAT;
2358 tree_node **anchor, *t;
2359 open_db dbblock, *dbm;
2361 dbdata_ratelimit *dbd;
2362 dbdata_ratelimit_unique *dbdb;
2365 /* Parse the first two options and record their values in expansion
2366 variables. These variables allow the configuration to have informative
2367 error messages based on rate limits obtained from a table lookup. */
2369 /* First is the maximum number of messages per period / maximum burst
2370 size, which must be greater than or equal to zero. Zero is useful for
2371 rate measurement as opposed to rate limiting. */
2373 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2374 return ratelimit_error(log_msgptr, "sender rate limit not set");
2376 limit = Ustrtod(sender_rate_limit, &ss);
2377 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2378 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2379 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2381 if (limit < 0.0 || *ss != '\0')
2382 return ratelimit_error(log_msgptr,
2383 "\"%s\" is not a positive number", sender_rate_limit);
2385 /* Second is the rate measurement period / exponential smoothing time
2386 constant. This must be strictly greater than zero, because zero leads to
2387 run-time division errors. */
2389 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2390 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2392 return ratelimit_error(log_msgptr,
2393 "\"%s\" is not a time value", sender_rate_period);
2395 /* By default we are counting one of something, but the per_rcpt,
2396 per_byte, and count options can change this. */
2400 /* Parse the other options. */
2402 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2404 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2405 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2406 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2407 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2408 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2409 else if (strcmpic(ss, US"per_conn") == 0)
2411 RATE_SET(mode, PER_CONN);
2412 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2415 else if (strcmpic(ss, US"per_mail") == 0)
2417 RATE_SET(mode, PER_MAIL);
2418 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2420 else if (strcmpic(ss, US"per_rcpt") == 0)
2422 /* If we are running in the RCPT ACL, then we'll count the recipients
2423 one by one, but if we are running when we have accumulated the whole
2424 list then we'll add them all in one batch. */
2425 if (where == ACL_WHERE_RCPT)
2426 RATE_SET(mode, PER_RCPT);
2427 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2429 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2430 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2432 else if (strcmpic(ss, US"per_byte") == 0)
2434 /* If we have not yet received the message data and there was no SIZE
2435 declaration on the MAIL command, then it's safe to just use a value of
2436 zero and let the recorded rate decay as if nothing happened. */
2437 RATE_SET(mode, PER_MAIL);
2438 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2439 else count = message_size < 0 ? 0.0 : (double)message_size;
2441 else if (strcmpic(ss, US"per_addr") == 0)
2443 RATE_SET(mode, PER_RCPT);
2444 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2445 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2447 else if (strncmpic(ss, US"count=", 6) == 0)
2450 count = Ustrtod(ss+6, &e);
2451 if (count < 0.0 || *e != '\0')
2452 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2454 else if (strncmpic(ss, US"unique=", 7) == 0)
2455 unique = string_copy(ss + 7);
2457 key = string_copy(ss);
2459 key = string_sprintf("%s/%s", key, ss);
2462 /* Sanity check. When the badacl flag is set the update mode must either
2463 be readonly (which is the default if it is omitted) or, for backwards
2464 compatibility, a combination of noupdate and strict or leaky. */
2466 if (mode == RATE_PER_CLASH)
2467 return ratelimit_error(log_msgptr, "conflicting per_* options");
2468 if (leaky + strict + readonly > 1)
2469 return ratelimit_error(log_msgptr, "conflicting update modes");
2470 if (badacl && (leaky || strict) && !noupdate)
2471 return ratelimit_error(log_msgptr,
2472 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2473 ratelimit_option_string[mode], acl_wherenames[where]);
2475 /* Set the default values of any unset options. In readonly mode we
2476 perform the rate computation without any increment so that its value
2477 decays to eventually allow over-limit senders through. */
2479 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2480 if (badacl) readonly = TRUE;
2481 if (readonly) count = 0.0;
2482 if (!strict && !readonly) leaky = TRUE;
2483 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2485 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2486 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2487 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2488 are added to the key because they alter the meaning of the stored data. */
2491 key = !sender_host_address ? US"" : sender_host_address;
2493 key = string_sprintf("%s/%s/%s%s",
2495 ratelimit_option_string[mode],
2496 unique == NULL ? "" : "unique/",
2500 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2502 /* See if we have already computed the rate by looking in the relevant tree.
2503 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2504 pool so that they survive across resets. In readonly mode we only remember the
2505 result for the rest of this command in case a later command changes it. After
2506 this bit of logic the code is independent of the per_* mode. */
2508 old_pool = store_pool;
2511 anchor = &ratelimiters_cmd;
2515 anchor = &ratelimiters_conn;
2516 store_pool = POOL_PERM;
2520 case RATE_PER_ALLRCPTS:
2521 anchor = &ratelimiters_mail;
2526 anchor = &ratelimiters_cmd;
2529 anchor = NULL; /* silence an "unused" complaint */
2530 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2531 "internal ACL error: unknown ratelimit mode %d", mode);
2535 if ((t = tree_search(*anchor, key)))
2538 /* The following few lines duplicate some of the code below. */
2539 rc = (dbd->rate < limit)? FAIL : OK;
2540 store_pool = old_pool;
2541 sender_rate = string_sprintf("%.1f", dbd->rate);
2543 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2547 /* We aren't using a pre-computed rate, so get a previously recorded rate
2548 from the database, which will be updated and written back if required. */
2550 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2552 store_pool = old_pool;
2554 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2558 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2561 gettimeofday(&tv, NULL);
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2574 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2576 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2582 if(unique && dbdb_size < sizeof(*dbdb))
2584 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2589 /* Allocate a new data block if the database lookup failed
2590 or the Bloom filter passed its age limit. */
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size, GET_UNTAINTED);
2604 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size, GET_UNTAINTED);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2629 /* If we are counting unique events, find out if this event is new or not.
2630 If the client repeats the event during the current period then it should be
2631 counted. We skip this code in readonly mode for efficiency, because any
2632 changes to the filter will be discarded and because count is already set to
2635 if (unique && !readonly)
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2671 unsigned n, hash, hinc;
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2688 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2691 for (n = 0; n < 8; n++, hash += hinc)
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2697 dbdb->bloom[byte] |= bit;
2702 /* If this event has occurred before, do not count it. */
2706 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2710 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2713 /* If there was no previous ratelimit data block for this key, initialize
2714 the new one, otherwise update the block from the database. The initial rate
2715 is what would be computed by the code below for an infinite interval. */
2719 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2747 rate_1 = (1 - a) * p/i + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
2776 rate will be bogus. To be safe we clamp interval to a very small number. */
2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-initialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2802 if (dbd->rate < count) dbd->rate = count;
2805 /* Clients sending at the limit are considered to be over the limit.
2806 This matters for edge cases such as a limit of zero, when the client
2807 should be completely blocked. */
2809 rc = dbd->rate < limit ? FAIL : OK;
2811 /* Update the state if the rate is low or if we are being strict. If we
2812 are in leaky mode and the sender's rate is too high, we do not update
2813 the recorded rate in order to avoid an over-aggressive sender's retry
2814 rate preventing them from getting any email through. If readonly is set,
2815 neither leaky nor strict are set, so we do not do any updates. */
2817 if ((rc == FAIL && leaky) || strict)
2819 dbfn_write(dbm, key, dbdb, dbdb_size);
2820 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2824 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2825 readonly? "readonly mode" : "over the limit, but leaky");
2830 /* Store the result in the tree for future reference. Take the taint status
2831 from the key for consistency even though it's unlikely we'll ever expand this. */
2833 t = store_get(sizeof(tree_node) + Ustrlen(key), key);
2835 Ustrcpy(t->name, key);
2836 (void)tree_insertnode(anchor, t);
2838 /* We create the formatted version of the sender's rate very late in
2839 order to ensure that it is done using the correct storage pool. */
2841 store_pool = old_pool;
2842 sender_rate = string_sprintf("%.1f", dbd->rate);
2845 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2852 /*************************************************
2853 * Handle a check for previously-seen *
2854 *************************************************/
2857 ACL clauses like: seen = -5m / key=$foo / readonly
2859 Return is true for condition-true - but the semantics
2860 depend heavily on the actual use-case.
2862 Negative times test for seen-before, positive for seen-more-recently-than
2863 (the given interval before current time).
2865 All are subject to history not having been cleaned from the DB.
2867 Default for seen-before is to create if not present, and to
2868 update if older than 10d (with the seen-test time).
2869 Default for seen-since is to always create or update.
2872 key=value. Default key is $sender_host_address
2875 refresh=<interval>: update an existing DB entry older than given
2876 amount. Default refresh lacking this option is 10d.
2877 The update sets the record timestamp to the seen-test time.
2879 XXX do we need separate nocreate, noupdate controls?
2882 arg the option string for seen=
2883 where ACL_WHERE_xxxx indicating which ACL this is
2884 log_msgptr for error messages
2886 Returns: OK - Condition is true
2887 FAIL - Condition is false
2888 DEFER - Problem opening history database
2889 ERROR - Syntax error in options
2893 acl_seen(const uschar * arg, int where, uschar ** log_msgptr)
2895 enum { SEEN_DEFAULT, SEEN_READONLY, SEEN_WRITE };
2897 const uschar * list = arg;
2898 int slash = '/', interval, mode = SEEN_DEFAULT, yield = FAIL;
2900 int refresh = 10 * 24 * 60 * 60; /* 10 days */
2901 const uschar * ele, * key = sender_host_address;
2902 open_db dbblock, * dbm;
2906 /* Parse the first element, the time-relation. */
2908 if (!(ele = string_nextinlist(&list, &slash, NULL, 0)))
2910 if ((before = *ele == '-'))
2912 if ((interval = readconf_readtime(ele, 0, FALSE)) < 0)
2915 /* Remaining elements are options */
2917 while ((ele = string_nextinlist(&list, &slash, NULL, 0)))
2918 if (Ustrncmp(ele, "key=", 4) == 0)
2920 else if (Ustrcmp(ele, "readonly") == 0)
2921 mode = SEEN_READONLY;
2922 else if (Ustrcmp(ele, "write") == 0)
2924 else if (Ustrncmp(ele, "refresh=", 8) == 0)
2926 if ((refresh = readconf_readtime(ele + 8, 0, FALSE)) < 0)
2932 if (!(dbm = dbfn_open(US"seen", O_RDWR, &dbblock, TRUE, TRUE)))
2934 HDEBUG(D_acl) debug_printf_indent("database for 'seen' not available\n");
2935 *log_msgptr = US"database for 'seen' not available";
2939 dbd = dbfn_read_with_length(dbm, key, NULL);
2941 if (dbd) /* an existing record */
2943 time_t diff = now - dbd->time_stamp; /* time since the record was written */
2945 if (before ? diff >= interval : diff < interval)
2948 if (mode == SEEN_READONLY)
2949 { HDEBUG(D_acl) debug_printf_indent("seen db not written (readonly)\n"); }
2950 else if (mode == SEEN_WRITE || !before)
2952 dbd->time_stamp = now;
2953 dbfn_write(dbm, key, dbd, sizeof(*dbd));
2954 HDEBUG(D_acl) debug_printf_indent("seen db written (update)\n");
2956 else if (diff >= refresh)
2958 dbd->time_stamp = now - interval;
2959 dbfn_write(dbm, key, dbd, sizeof(*dbd));
2960 HDEBUG(D_acl) debug_printf_indent("seen db written (refresh)\n");
2964 { /* No record found, yield always FAIL */
2965 if (mode != SEEN_READONLY)
2967 dbdata_seen d = {.time_stamp = now};
2968 dbfn_write(dbm, key, &d, sizeof(*dbd));
2969 HDEBUG(D_acl) debug_printf_indent("seen db written (create)\n");
2972 HDEBUG(D_acl) debug_printf_indent("seen db not written (readonly)\n");
2980 *log_msgptr = string_sprintf("failed to parse '%s'", arg);
2983 *log_msgptr = string_sprintf("unrecognised option '%s' in '%s'", ele, arg);
2989 /*************************************************
2990 * The udpsend ACL modifier *
2991 *************************************************/
2993 /* Called by acl_check_condition() below.
2996 arg the option string for udpsend=
2997 log_msgptr for error messages
2999 Returns: OK - Completed.
3000 DEFER - Problem with DNS lookup.
3001 ERROR - Syntax error in options.
3005 acl_udpsend(const uschar *arg, uschar **log_msgptr)
3017 hostname = string_nextinlist(&arg, &sep, NULL, 0);
3018 portstr = string_nextinlist(&arg, &sep, NULL, 0);
3022 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
3027 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
3032 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
3035 portnum = Ustrtol(portstr, &portend, 10);
3036 if (*portend != '\0')
3038 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
3042 /* Make a single-item host list. */
3043 h = store_get(sizeof(host_item), GET_UNTAINTED);
3044 memset(h, 0, sizeof(host_item));
3049 if (string_is_ip_address(hostname, NULL))
3050 h->address = hostname, r = HOST_FOUND;
3052 r = host_find_byname(h, NULL, 0, NULL, FALSE);
3053 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
3055 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
3060 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
3062 /*XXX this could better use sendto */
3063 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
3064 1, NULL, &errstr, NULL);
3065 if (r < 0) goto defer;
3067 r = send(s, arg, len, 0);
3070 errstr = US strerror(errno);
3078 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
3083 debug_printf_indent("udpsend %d bytes\n", r);
3088 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
3094 /*************************************************
3095 * Handle conditions/modifiers on an ACL item *
3096 *************************************************/
3098 /* Called from acl_check() below.
3102 cb ACL condition block - if NULL, result is OK
3103 where where called from
3104 addr the address being checked for RCPT, or NULL
3105 level the nesting level
3106 epp pointer to pass back TRUE if "endpass" encountered
3107 (applies only to "accept" and "discard")
3108 user_msgptr user message pointer
3109 log_msgptr log message pointer
3110 basic_errno pointer to where to put verify error
3112 Returns: OK - all conditions are met
3113 DISCARD - an "acl" condition returned DISCARD - only allowed
3114 for "accept" or "discard" verbs
3115 FAIL - at least one condition fails
3116 FAIL_DROP - an "acl" condition returned FAIL_DROP
3117 DEFER - can't tell at the moment (typically, lookup defer,
3118 but can be temporary callout problem)
3119 ERROR - ERROR from nested ACL or expansion failure or other
3124 acl_check_condition(int verb, acl_condition_block *cb, int where,
3125 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
3126 uschar **log_msgptr, int *basic_errno)
3128 uschar * user_message = NULL;
3129 uschar * log_message = NULL;
3132 for (; cb; cb = cb->next)
3136 BOOL textonly = FALSE;
3138 /* The message and log_message items set up messages to be used in
3139 case of rejection. They are expanded later. */
3141 if (cb->type == ACLC_MESSAGE)
3143 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
3144 user_message = cb->arg;
3148 if (cb->type == ACLC_LOG_MESSAGE)
3150 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
3151 log_message = cb->arg;
3155 /* The endpass "condition" just sets a flag to show it occurred. This is
3156 checked at compile time to be on an "accept" or "discard" item. */
3158 if (cb->type == ACLC_ENDPASS)
3164 /* For other conditions and modifiers, the argument is expanded now for some
3165 of them, but not for all, because expansion happens down in some lower level
3166 checking functions in some cases. */
3168 if (!conditions[cb->type].expand_at_top)
3171 else if (!(arg = expand_string_2(cb->arg, &textonly)))
3173 if (f.expand_string_forcedfail) continue;
3174 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3175 cb->arg, expand_string_message);
3176 return f.search_find_defer ? DEFER : ERROR;
3179 /* Show condition, and expanded condition if it's different */
3184 debug_printf_indent("check %s%s %n",
3185 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
3186 conditions[cb->type].name, &lhswidth);
3188 if (cb->type == ACLC_SET)
3190 #ifndef DISABLE_DKIM
3191 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
3192 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3194 debug_printf("%s ", cb->u.varname);
3200 debug_printf("acl_%s ", cb->u.varname);
3201 lhswidth += 5 + Ustrlen(cb->u.varname);
3205 debug_printf("= %s\n", cb->arg);
3208 debug_printf("%.*s= %s\n", lhswidth,
3212 /* Check that this condition makes sense at this time */
3214 if ((conditions[cb->type].forbids & (1 << where)) != 0)
3216 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3217 conditions[cb->type].is_modifier ? "use" : "test",
3218 conditions[cb->type].name, acl_wherenames[where]);
3222 /* Run the appropriate test for each condition, or take the appropriate
3223 action for the remaining modifiers. */
3227 case ACLC_ADD_HEADER:
3231 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3235 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
3236 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3238 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3239 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3245 case ACLC_AUTHENTICATED:
3246 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
3247 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
3250 #ifdef EXPERIMENTAL_BRIGHTMAIL
3251 case ACLC_BMI_OPTIN:
3253 int old_pool = store_pool;
3254 store_pool = POOL_PERM;
3255 bmi_current_optin = string_copy(arg);
3256 store_pool = old_pool;
3261 case ACLC_CONDITION:
3262 /* The true/false parsing here should be kept in sync with that used in
3263 expand.c when dealing with ECOND_BOOL so that we don't have too many
3264 different definitions of what can be a boolean. */
3266 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3267 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3268 rc = (Uatoi(arg) == 0)? FAIL : OK;
3270 rc = (strcmpic(arg, US"no") == 0 ||
3271 strcmpic(arg, US"false") == 0)? FAIL :
3272 (strcmpic(arg, US"yes") == 0 ||
3273 strcmpic(arg, US"true") == 0)? OK : DEFER;
3275 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3278 case ACLC_CONTINUE: /* Always succeeds */
3283 const uschar *p = NULL;
3284 control_type = decode_control(arg, &p, where, log_msgptr);
3286 /* Check if this control makes sense at this time */
3288 if (controls_list[control_type].forbids & (1 << where))
3290 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3291 controls_list[control_type].name, acl_wherenames[where]);
3295 switch(control_type)
3297 case CONTROL_AUTH_UNADVERTISED:
3298 f.allow_auth_unadvertised = TRUE;
3301 #ifdef EXPERIMENTAL_BRIGHTMAIL
3302 case CONTROL_BMI_RUN:
3307 #ifndef DISABLE_DKIM
3308 case CONTROL_DKIM_VERIFY:
3309 f.dkim_disable_verify = TRUE;
3310 # ifdef SUPPORT_DMARC
3311 /* Since DKIM was blocked, skip DMARC too */
3312 f.dmarc_disable_verify = TRUE;
3313 f.dmarc_enable_forensic = FALSE;
3318 #ifdef SUPPORT_DMARC
3319 case CONTROL_DMARC_VERIFY:
3320 f.dmarc_disable_verify = TRUE;
3323 case CONTROL_DMARC_FORENSIC:
3324 f.dmarc_enable_forensic = TRUE;
3331 int fd, af, level, optname, value;
3332 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3333 a socket; we can accept that, we'll just debug-log failures anyway. */
3334 fd = fileno(smtp_in);
3335 if ((af = ip_get_address_family(fd)) < 0)
3338 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3342 if (dscp_lookup(p+1, af, &level, &optname, &value))
3343 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3345 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3346 p+1, strerror(errno));
3350 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3354 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3360 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3368 case CONTROL_CASEFUL_LOCAL_PART:
3369 deliver_localpart = addr->cc_local_part;
3372 case CONTROL_CASELOWER_LOCAL_PART:
3373 deliver_localpart = addr->lc_local_part;
3376 case CONTROL_ENFORCE_SYNC:
3377 smtp_enforce_sync = TRUE;
3380 case CONTROL_NO_ENFORCE_SYNC:
3381 smtp_enforce_sync = FALSE;
3384 #ifdef WITH_CONTENT_SCAN
3385 case CONTROL_NO_MBOX_UNSPOOL:
3386 f.no_mbox_unspool = TRUE;
3390 case CONTROL_NO_MULTILINE:
3391 f.no_multiline_responses = TRUE;
3394 case CONTROL_NO_PIPELINING:
3395 f.pipelining_enable = FALSE;
3398 case CONTROL_NO_DELAY_FLUSH:
3399 f.disable_delay_flush = TRUE;
3402 case CONTROL_NO_CALLOUT_FLUSH:
3403 f.disable_callout_flush = TRUE;
3406 case CONTROL_FAKEREJECT:
3407 cancel_cutthrough_connection(TRUE, US"fakereject");
3408 case CONTROL_FAKEDEFER:
3409 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3412 const uschar *pp = p + 1;
3414 /* The entire control= line was expanded at top so no need to expand
3415 the part after the / */
3416 fake_response_text = string_copyn(p+1, pp-p-1);
3419 else /* Explicitly reset to default string */
3420 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3423 case CONTROL_FREEZE:
3424 f.deliver_freeze = TRUE;
3425 deliver_frozen_at = time(NULL);
3426 freeze_tell = freeze_tell_config; /* Reset to configured value */
3427 if (Ustrncmp(p, "/no_tell", 8) == 0)
3434 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3437 cancel_cutthrough_connection(TRUE, US"item frozen");
3441 f.queue_only_policy = TRUE;
3442 if (Ustrcmp(p, "_only") == 0)
3444 else while (*p == '/')
3445 if (Ustrncmp(p, "/only", 5) == 0)
3446 { p += 5; f.queue_smtp = FALSE; }
3447 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3448 { p += 17; f.queue_smtp = TRUE; }
3451 cancel_cutthrough_connection(TRUE, US"queueing forced");
3454 case CONTROL_SUBMISSION:
3455 originator_name = US"";
3456 f.submission_mode = TRUE;
3459 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3462 f.active_local_sender_retain = TRUE;
3463 f.active_local_from_check = FALSE;
3465 else if (Ustrncmp(p, "/domain=", 8) == 0)
3467 const uschar *pp = p + 8;
3468 while (*pp && *pp != '/') pp++;
3469 submission_domain = string_copyn(p+8, pp-p-8);
3472 /* The name= option must be last, because it swallows the rest of
3474 else if (Ustrncmp(p, "/name=", 6) == 0)
3476 const uschar *pp = p + 6;
3478 submission_name = parse_fix_phrase(p+6, pp-p-6);
3485 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3492 uschar * debug_tag = NULL, * debug_opts = NULL;
3493 BOOL kill = FALSE, stop = FALSE;
3497 const uschar * pp = p+1;
3498 if (Ustrncmp(pp, "tag=", 4) == 0)
3500 for (pp += 4; *pp && *pp != '/';) pp++;
3501 debug_tag = string_copyn(p+5, pp-p-5);
3503 else if (Ustrncmp(pp, "opts=", 5) == 0)
3505 for (pp += 5; *pp && *pp != '/';) pp++;
3506 debug_opts = string_copyn(p+6, pp-p-6);
3508 else if (Ustrncmp(pp, "kill", 4) == 0)
3513 else if (Ustrncmp(pp, "stop", 4) == 0)
3518 else if (Ustrncmp(pp, "pretrigger=", 11) == 0)
3519 debug_pretrigger_setup(pp+11);
3520 else if (Ustrncmp(pp, "trigger=", 8) == 0)
3522 if (Ustrncmp(pp += 8, "now", 3) == 0)
3525 debug_trigger_fire();
3527 else if (Ustrncmp(pp, "paniclog", 8) == 0)
3530 dtrigger_selector |= BIT(DTi_panictrigger);
3533 while (*pp && *pp != '/') pp++;
3538 debug_logging_stop(TRUE);
3540 debug_logging_stop(FALSE);
3541 else if (debug_tag || debug_opts)
3542 debug_logging_activate(debug_tag, debug_opts);
3546 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3547 f.suppress_local_fixups = TRUE;
3550 case CONTROL_CUTTHROUGH_DELIVERY:
3552 uschar * ignored = NULL;
3553 #ifndef DISABLE_PRDR
3558 /* Too hard to think about for now. We might in future cutthrough
3559 the case where both sides handle prdr and this-node prdr acl
3561 ignored = US"PRDR active";
3562 else if (f.deliver_freeze)
3563 ignored = US"frozen";
3564 else if (f.queue_only_policy)
3565 ignored = US"queue-only";
3566 else if (fake_response == FAIL)
3567 ignored = US"fakereject";
3568 else if (rcpt_count != 1)
3569 ignored = US"nonfirst rcpt";
3570 else if (cutthrough.delivery)
3571 ignored = US"repeated";
3572 else if (cutthrough.callout_hold_only)
3575 debug_printf_indent(" cutthrough request upgrades callout hold\n");
3576 cutthrough.callout_hold_only = FALSE;
3577 cutthrough.delivery = TRUE; /* control accepted */
3581 cutthrough.delivery = TRUE; /* control accepted */
3584 const uschar * pp = p+1;
3585 if (Ustrncmp(pp, "defer=", 6) == 0)
3588 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3589 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3592 while (*pp && *pp != '/') pp++;
3597 DEBUG(D_acl) if (ignored)
3598 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3603 case CONTROL_UTF8_DOWNCONVERT:
3608 message_utf8_downconvert = 1;
3609 addr->prop.utf8_downcvt = TRUE;
3610 addr->prop.utf8_downcvt_maybe = FALSE;
3616 message_utf8_downconvert = 0;
3617 addr->prop.utf8_downcvt = FALSE;
3618 addr->prop.utf8_downcvt_maybe = FALSE;
3622 if (p[1] == '-' && p[2] == '1')
3624 message_utf8_downconvert = -1;
3625 addr->prop.utf8_downcvt = FALSE;
3626 addr->prop.utf8_downcvt_maybe = TRUE;
3630 *log_msgptr = US"bad option value for control=utf8_downconvert";
3634 message_utf8_downconvert = 1;
3635 addr->prop.utf8_downcvt = TRUE;
3636 addr->prop.utf8_downcvt_maybe = FALSE;
3646 #ifdef EXPERIMENTAL_DCC
3649 /* Separate the regular expression and any optional parameters. */
3650 const uschar * list = arg;
3652 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3653 /* Run the dcc backend. */
3654 rc = dcc_process(&ss);
3655 /* Modify return code based upon the existence of options. */
3656 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3657 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3658 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3663 #ifdef WITH_CONTENT_SCAN
3665 rc = mime_decode(&arg);
3671 int delay = readconf_readtime(arg, 0, FALSE);
3674 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3675 "modifier: \"%s\" is not a time value", arg);
3680 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3685 debug_printf_indent("delay skipped in -bh checking mode\n");
3688 /* NOTE 1: Remember that we may be
3689 dealing with stdin/stdout here, in addition to TCP/IP connections.
3690 Also, delays may be specified for non-SMTP input, where smtp_out and
3691 smtp_in will be NULL. Whatever is done must work in all cases.
3693 NOTE 2: The added feature of flushing the output before a delay must
3694 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3699 if (smtp_out && !f.disable_delay_flush)
3702 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3708 p.fd = fileno(smtp_out);
3709 p.events = POLLRDHUP;
3712 if (poll(&p, n, delay*1000) > 0)
3713 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3716 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3717 TCP/IP connection has gone away without reading from it. This means
3718 that we cannot shorten the delay below if the client goes away,
3719 because we cannot discover that the client has closed its end of the
3720 connection. (The connection is actually in a half-closed state,
3721 waiting for the server to close its end.) It would be nice to be able
3722 to detect this state, so that the Exim process is not held up
3723 unnecessarily. However, it seems that we can't. The poll() function
3724 does not do the right thing, and in any case it is not always
3727 while (delay > 0) delay = sleep(delay);
3734 #ifndef DISABLE_DKIM
3735 case ACLC_DKIM_SIGNER:
3736 if (dkim_cur_signer)
3737 rc = match_isinlist(dkim_cur_signer,
3738 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3743 case ACLC_DKIM_STATUS:
3744 rc = match_isinlist(dkim_verify_status,
3745 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3749 #ifdef SUPPORT_DMARC
3750 case ACLC_DMARC_STATUS:
3751 if (!f.dmarc_has_been_checked)
3753 f.dmarc_has_been_checked = TRUE;
3754 /* used long way of dmarc_exim_expand_query() in case we need more
3755 * view into the process in the future. */
3756 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3757 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3762 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3766 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3767 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3770 /* The value in tls_cipher is the full cipher name, for example,
3771 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3772 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3773 what may in practice come out of the SSL library - which at the time of
3774 writing is poorly documented. */
3776 case ACLC_ENCRYPTED:
3777 if (!tls_in.cipher) rc = FAIL;
3780 uschar *endcipher = NULL;
3781 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3782 if (!cipher) cipher = tls_in.cipher; else
3784 endcipher = Ustrchr(++cipher, ':');
3785 if (endcipher) *endcipher = 0;
3787 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3788 if (endcipher) *endcipher = ':';
3792 /* Use verify_check_this_host() instead of verify_check_host() so that
3793 we can pass over &host_data to catch any looked up data. Once it has been
3794 set, it retains its value so that it's still there if another ACL verb
3795 comes through here and uses the cache. However, we must put it into
3796 permanent store in case it is also expected to be used in a subsequent
3797 message in the same SMTP connection. */
3800 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3801 sender_host_address ? sender_host_address : US"", CUSS &host_data);
3802 if (rc == DEFER) *log_msgptr = search_error_message;
3803 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3806 case ACLC_LOCAL_PARTS:
3807 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3808 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3809 CUSS &deliver_localpart_data);
3812 case ACLC_LOG_REJECT_TARGET:
3814 int logbits = 0, sep = 0;
3815 const uschar * s = arg;
3817 for (uschar * ss; ss = string_nextinlist(&s, &sep, NULL, 0); )
3819 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3820 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3821 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3824 logbits |= LOG_MAIN|LOG_REJECT;
3825 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3826 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3829 log_reject_target = logbits;
3836 const uschar *s = arg;
3842 if (Ustrncmp(s, "main", 4) == 0)
3843 { logbits |= LOG_MAIN; s += 4; }
3844 else if (Ustrncmp(s, "panic", 5) == 0)
3845 { logbits |= LOG_PANIC; s += 5; }
3846 else if (Ustrncmp(s, "reject", 6) == 0)
3847 { logbits |= LOG_REJECT; s += 6; }
3850 logbits = LOG_MAIN|LOG_PANIC;
3851 s = string_sprintf(":unknown log name in \"%s\" in "
3852 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3858 while (isspace(*s)) s++;
3860 if (logbits == 0) logbits = LOG_MAIN;
3861 log_write(0, logbits, "%s", string_printing(s));
3865 #ifdef WITH_CONTENT_SCAN
3866 case ACLC_MALWARE: /* Run the malware backend. */
3868 /* Separate the regular expression and any optional parameters. */
3869 const uschar * list = arg;
3870 BOOL defer_ok = FALSE;
3871 int timeout = 0, sep = -'/';
3872 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3874 for (uschar * opt; opt = string_nextinlist(&list, &sep, NULL, 0); )
3875 if (strcmpic(opt, US"defer_ok") == 0)
3877 else if ( strncmpic(opt, US"tmo=", 4) == 0
3878 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3881 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3885 rc = malware(ss, textonly, timeout);
3886 if (rc == DEFER && defer_ok)
3887 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3891 case ACLC_MIME_REGEX:
3892 rc = mime_regex(&arg, textonly);
3897 if (is_tainted(arg))
3899 *log_msgptr = string_sprintf("Tainted name '%s' for queue not permitted",
3903 if (Ustrchr(arg, '/'))
3905 *log_msgptr = string_sprintf(
3906 "Directory separator not permitted in queue name: '%s'", arg);
3909 queue_name = string_copy_perm(arg, FALSE);
3912 case ACLC_RATELIMIT:
3913 rc = acl_ratelimit(arg, where, log_msgptr);
3916 case ACLC_RECIPIENTS:
3917 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3918 CUSS &recipient_data);
3921 #ifdef WITH_CONTENT_SCAN
3923 rc = regex(&arg, textonly);
3927 case ACLC_REMOVE_HEADER:
3928 setup_remove_header(arg);
3932 rc = acl_seen(arg, where, log_msgptr);
3935 case ACLC_SENDER_DOMAINS:
3938 sdomain = Ustrrchr(sender_address, '@');
3939 sdomain = sdomain ? sdomain + 1 : US"";
3940 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3941 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3946 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3947 sender_address_cache, -1, 0, CUSS &sender_data);
3950 /* Connection variables must persist forever; message variables not */
3954 int old_pool = store_pool;
3955 if ( cb->u.varname[0] != 'm'
3956 #ifndef DISABLE_EVENT
3957 || event_name /* An event is being delivered */
3960 store_pool = POOL_PERM;
3961 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3962 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3963 dkim_verify_status = string_copy(arg);
3964 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3965 dkim_verify_reason = string_copy(arg);
3968 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3969 store_pool = old_pool;
3973 #ifdef WITH_CONTENT_SCAN
3976 /* Separate the regular expression and any optional parameters. */
3977 const uschar * list = arg;
3979 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3981 rc = spam(CUSS &ss);
3982 /* Modify return code based upon the existence of options. */
3983 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3984 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3985 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3992 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3995 case ACLC_SPF_GUESS:
3996 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
4001 rc = acl_udpsend(arg, log_msgptr);
4004 /* If the verb is WARN, discard any user message from verification, because
4005 such messages are SMTP responses, not header additions. The latter come
4006 only from explicit "message" modifiers. However, put the user message into
4007 $acl_verify_message so it can be used in subsequent conditions or modifiers
4008 (until something changes it). */
4011 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
4013 acl_verify_message = *user_msgptr;
4014 if (verb == ACL_WARN) *user_msgptr = NULL;
4018 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
4019 "condition %d", cb->type);
4023 /* If a condition was negated, invert OK/FAIL. */
4025 if (!conditions[cb->type].is_modifier && cb->u.negated)
4026 if (rc == OK) rc = FAIL;
4027 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
4029 if (rc != OK) break; /* Conditions loop */
4033 /* If the result is the one for which "message" and/or "log_message" are used,
4034 handle the values of these modifiers. If there isn't a log message set, we make
4035 it the same as the user message.
4037 "message" is a user message that will be included in an SMTP response. Unless
4038 it is empty, it overrides any previously set user message.
4040 "log_message" is a non-user message, and it adds to any existing non-user
4041 message that is already set.
4043 Most verbs have but a single return for which the messages are relevant, but
4044 for "discard", it's useful to have the log message both when it succeeds and
4045 when it fails. For "accept", the message is used in the OK case if there is no
4046 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
4049 if (*epp && rc == OK) user_message = NULL;
4051 if ((BIT(rc) & msgcond[verb]) != 0)
4054 uschar *old_user_msgptr = *user_msgptr;
4055 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
4057 /* If the verb is "warn", messages generated by conditions (verification or
4058 nested ACLs) are always discarded. This also happens for acceptance verbs
4059 when they actually do accept. Only messages specified at this level are used.
4060 However, the value of an existing message is available in $acl_verify_message
4061 during expansions. */
4063 if (verb == ACL_WARN ||
4064 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
4065 *log_msgptr = *user_msgptr = NULL;
4069 acl_verify_message = old_user_msgptr;
4070 expmessage = expand_string(user_message);
4073 if (!f.expand_string_forcedfail)
4074 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
4075 user_message, expand_string_message);
4077 else if (expmessage[0] != 0) *user_msgptr = expmessage;
4082 acl_verify_message = old_log_msgptr;
4083 expmessage = expand_string(log_message);
4086 if (!f.expand_string_forcedfail)
4087 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
4088 log_message, expand_string_message);
4090 else if (expmessage[0] != 0)
4092 *log_msgptr = (*log_msgptr == NULL)? expmessage :
4093 string_sprintf("%s: %s", expmessage, *log_msgptr);
4097 /* If no log message, default it to the user message */
4099 if (!*log_msgptr) *log_msgptr = *user_msgptr;
4102 acl_verify_message = NULL;
4110 /*************************************************
4111 * Get line from a literal ACL *
4112 *************************************************/
4114 /* This function is passed to acl_read() in order to extract individual lines
4115 of a literal ACL, which we access via static pointers. We can destroy the
4116 contents because this is called only once (the compiled ACL is remembered).
4118 This code is intended to treat the data in the same way as lines in the main
4119 Exim configuration file. That is:
4121 . Leading spaces are ignored.
4123 . A \ at the end of a line is a continuation - trailing spaces after the \
4124 are permitted (this is because I don't believe in making invisible things
4125 significant). Leading spaces on the continued part of a line are ignored.
4127 . Physical lines starting (significantly) with # are totally ignored, and
4128 may appear within a sequence of backslash-continued lines.
4130 . Blank lines are ignored, but will end a sequence of continuations.
4133 Returns: a pointer to the next line
4137 static uschar *acl_text; /* Current pointer in the text */
4138 static uschar *acl_text_end; /* Points one past the terminating '0' */
4146 /* This loop handles leading blank lines and comments. */
4150 Uskip_whitespace(&acl_text); /* Leading spaces/empty lines */
4151 if (!*acl_text) return NULL; /* No more data */
4152 yield = acl_text; /* Potential data line */
4154 while (*acl_text && *acl_text != '\n') acl_text++;
4156 /* If we hit the end before a newline, we have the whole logical line. If
4157 it's a comment, there's no more data to be given. Otherwise, yield it. */
4159 if (!*acl_text) return *yield == '#' ? NULL : yield;
4161 /* After reaching a newline, end this loop if the physical line does not
4162 start with '#'. If it does, it's a comment, and the loop continues. */
4164 if (*yield != '#') break;
4167 /* This loop handles continuations. We know we have some real data, ending in
4168 newline. See if there is a continuation marker at the end (ignoring trailing
4169 white space). We know that *yield is not white space, so no need to test for
4170 cont > yield in the backwards scanning loop. */
4175 for (cont = acl_text - 1; isspace(*cont); cont--);
4177 /* If no continuation follows, we are done. Mark the end of the line and
4186 /* We have encountered a continuation. Skip over whitespace at the start of
4187 the next line, and indeed the whole of the next line or lines if they are
4192 while (*(++acl_text) == ' ' || *acl_text == '\t');
4193 if (*acl_text != '#') break;
4194 while (*(++acl_text) != 0 && *acl_text != '\n');
4197 /* We have the start of a continuation line. Move all the rest of the data
4198 to join onto the previous line, and then find its end. If the end is not a
4199 newline, we are done. Otherwise loop to look for another continuation. */
4201 memmove(cont, acl_text, acl_text_end - acl_text);
4202 acl_text_end -= acl_text - cont;
4204 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
4205 if (*acl_text == 0) return yield;
4208 /* Control does not reach here */
4215 /************************************************/
4216 /* For error messages, a string describing the config location
4217 associated with current processing. NULL if not in an ACL. */
4220 acl_current_verb(void)
4222 if (acl_current) return string_sprintf(" (ACL %s, %s %d)",
4223 verbs[acl_current->verb], acl_current->srcfile, acl_current->srcline);
4227 /*************************************************
4228 * Check access using an ACL *
4229 *************************************************/
4231 /* This function is called from address_check. It may recurse via
4232 acl_check_condition() - hence the use of a level to stop looping. The ACL is
4233 passed as a string which is expanded. A forced failure implies no access check
4234 is required. If the result is a single word, it is taken as the name of an ACL
4235 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4236 text, complete with newlines, and parsed as such. In both cases, the ACL check
4237 is then run. This function uses an auxiliary function for acl_read() to call
4238 for reading individual lines of a literal ACL. This is acl_getline(), which
4239 appears immediately above.
4242 where where called from
4243 addr address item when called from RCPT; otherwise NULL
4244 s the input string; NULL is the same as an empty ACL => DENY
4245 user_msgptr where to put a user error (for SMTP response)
4246 log_msgptr where to put a logging message (not for SMTP response)
4248 Returns: OK access is granted
4249 DISCARD access is apparently granted...
4250 FAIL access is denied
4251 FAIL_DROP access is denied; drop the connection
4252 DEFER can't tell at the moment
4257 acl_check_internal(int where, address_item *addr, uschar *s,
4258 uschar **user_msgptr, uschar **log_msgptr)
4261 acl_block *acl = NULL;
4262 uschar *acl_name = US"inline ACL";
4265 /* Catch configuration loops */
4269 *log_msgptr = US"ACL nested too deep: possible loop";
4275 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
4279 /* At top level, we expand the incoming string. At lower levels, it has already
4280 been expanded as part of condition processing. */
4284 if (!(ss = expand_string(s)))
4286 if (f.expand_string_forcedfail) return OK;
4287 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4288 expand_string_message);
4294 while (isspace(*ss)) ss++;
4296 /* If we can't find a named ACL, the default is to parse it as an inline one.
4297 (Unless it begins with a slash; non-existent files give rise to an error.) */
4301 if (is_tainted(acl_text) && !f.running_in_test_harness)
4303 log_write(0, LOG_MAIN|LOG_PANIC,
4304 "attempt to use tainted ACL text \"%s\"", acl_text);
4305 /* Avoid leaking info to an attacker */
4306 *log_msgptr = US"internal configuration error";
4310 /* Handle the case of a string that does not contain any spaces. Look for a
4311 named ACL among those read from the configuration, or a previously read file.
4312 It is possible that the pointer to the ACL is NULL if the configuration
4313 contains a name with no data. If not found, and the text begins with '/',
4314 read an ACL from a file, and save it so it can be re-used. */
4316 if (Ustrchr(ss, ' ') == NULL)
4318 tree_node * t = tree_search(acl_anchor, ss);
4321 if (!(acl = (acl_block *)(t->data.ptr)))
4323 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
4326 acl_name = string_sprintf("ACL \"%s\"", ss);
4327 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
4330 else if (*ss == '/')
4332 struct stat statbuf;
4333 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4335 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4339 if (fstat(fd, &statbuf) != 0)
4341 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4346 /* If the string being used as a filename is tainted, so is the file content */
4347 acl_text = store_get(statbuf.st_size + 1, ss);
4348 acl_text_end = acl_text + statbuf.st_size + 1;
4350 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4352 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4353 ss, strerror(errno));
4356 acl_text[statbuf.st_size] = 0;
4359 acl_name = string_sprintf("ACL \"%s\"", ss);
4360 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4364 /* Parse an ACL that is still in text form. If it came from a file, remember it
4365 in the ACL tree, having read it into the POOL_PERM store pool so that it
4366 persists between multiple messages. */
4370 int old_pool = store_pool;
4371 if (fd >= 0) store_pool = POOL_PERM;
4372 acl = acl_read(acl_getline, log_msgptr);
4373 store_pool = old_pool;
4374 if (!acl && *log_msgptr) return ERROR;
4377 tree_node * t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), ss);
4378 Ustrcpy(t->name, ss);
4380 (void)tree_insertnode(&acl_anchor, t);
4384 /* Now we have an ACL to use. It's possible it may be NULL. */
4386 while ((acl_current = acl))
4389 int basic_errno = 0;
4390 BOOL endpass_seen = FALSE;
4391 BOOL acl_quit_check = acl_level == 0
4392 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4394 *log_msgptr = *user_msgptr = NULL;
4395 f.acl_temp_details = FALSE;
4397 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4398 verbs[acl->verb], acl->srcfile, acl->srcline);
4400 /* Clear out any search error message from a previous check before testing
4403 search_error_message = NULL;
4404 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4405 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4407 /* Handle special returns: DEFER causes a return except on a WARN verb;
4408 ERROR always causes a return. */
4413 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4414 verbs[acl->verb], acl_name);
4415 if (basic_errno != ERRNO_CALLOUTDEFER)
4417 if (search_error_message != NULL && *search_error_message != 0)
4418 *log_msgptr = search_error_message;
4419 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4422 f.acl_temp_details = TRUE;
4423 if (acl->verb != ACL_WARN) return DEFER;
4426 default: /* Paranoia */
4428 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4429 verbs[acl->verb], acl_name);
4433 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4434 verbs[acl->verb], acl_name);
4438 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4439 verbs[acl->verb], acl_name);
4442 /* DISCARD and DROP can happen only from a nested ACL condition, and
4443 DISCARD can happen only for an "accept" or "discard" verb. */
4446 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4447 verbs[acl->verb], acl_name);
4451 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4452 verbs[acl->verb], acl_name);
4456 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4457 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4458 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4463 if (cond == OK || cond == DISCARD)
4465 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4470 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4478 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4479 if (acl_quit_check) goto badquit;
4480 f.acl_temp_details = TRUE;
4488 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4489 if (acl_quit_check) goto badquit;
4495 if (cond == OK || cond == DISCARD)
4497 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4498 if (acl_quit_check) goto badquit;
4504 debug_printf_indent("discard: endpass encountered - denying access\n");
4512 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4513 if (acl_quit_check) goto badquit;
4521 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4522 if (acl_quit_check) goto badquit;
4529 acl_warn(where, *user_msgptr, *log_msgptr);
4530 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4531 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4532 "condition test deferred%s%s", host_and_ident(TRUE),
4533 *log_msgptr ? US": " : US"",
4534 *log_msgptr ? *log_msgptr : US"");
4535 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4539 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4544 /* Pass to the next ACL item */
4549 /* We have reached the end of the ACL. This is an implicit DENY. */
4551 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4555 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4556 "('%s' verb used incorrectly)", verbs[acl->verb]);
4563 /* Same args as acl_check_internal() above, but the string s is
4564 the name of an ACL followed optionally by up to 9 space-separated arguments.
4565 The name and args are separately expanded. Args go into $acl_arg globals. */
4567 acl_check_wargs(int where, address_item *addr, const uschar *s,
4568 uschar **user_msgptr, uschar **log_msgptr)
4571 uschar * tmp_arg[9]; /* must match acl_arg[] */
4572 uschar * sav_arg[9]; /* must match acl_arg[] */
4578 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4581 for (i = 0; i < 9; i++)
4583 while (*s && isspace(*s)) s++;
4585 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4592 sav_narg = acl_narg;
4594 for (i = 0; i < acl_narg; i++)
4596 sav_arg[i] = acl_arg[i];
4597 acl_arg[i] = tmp_arg[i];
4601 sav_arg[i] = acl_arg[i];
4602 acl_arg[i++] = NULL;
4606 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4609 acl_narg = sav_narg;
4610 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4614 if (f.expand_string_forcedfail) return ERROR;
4615 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4616 tmp, expand_string_message);
4617 return f.search_find_defer ? DEFER : ERROR;
4622 /*************************************************
4623 * Check access using an ACL *
4624 *************************************************/
4626 /* Alternate interface for ACL, used by expansions */
4628 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4631 address_item *addr = NULL;
4634 *user_msgptr = *log_msgptr = NULL;
4635 sender_verified_failed = NULL;
4636 ratelimiters_cmd = NULL;
4637 log_reject_target = LOG_MAIN|LOG_REJECT;
4639 if (where == ACL_WHERE_RCPT)
4641 adb = address_defaults;
4643 addr->address = expand_string(US"$local_part@$domain");
4644 addr->domain = deliver_domain;
4645 addr->local_part = deliver_localpart;
4646 addr->cc_local_part = deliver_localpart;
4647 addr->lc_local_part = deliver_localpart;
4651 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4658 /* This is the external interface for ACL checks. It sets up an address and the
4659 expansions for $domain and $local_part when called after RCPT, then calls
4660 acl_check_internal() to do the actual work.
4663 where ACL_WHERE_xxxx indicating where called from
4664 recipient RCPT address for RCPT check, else NULL
4665 s the input string; NULL is the same as an empty ACL => DENY
4666 user_msgptr where to put a user error (for SMTP response)
4667 log_msgptr where to put a logging message (not for SMTP response)
4669 Returns: OK access is granted by an ACCEPT verb
4670 DISCARD access is granted by a DISCARD verb
4671 FAIL access is denied
4672 FAIL_DROP access is denied; drop the connection
4673 DEFER can't tell at the moment
4676 int acl_where = ACL_WHERE_UNKNOWN;
4679 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4680 uschar **log_msgptr)
4684 address_item *addr = NULL;
4686 *user_msgptr = *log_msgptr = NULL;
4687 sender_verified_failed = NULL;
4688 ratelimiters_cmd = NULL;
4689 log_reject_target = LOG_MAIN|LOG_REJECT;
4691 #ifndef DISABLE_PRDR
4692 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4694 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4697 adb = address_defaults;
4699 addr->address = recipient;
4700 if (deliver_split_address(addr) == DEFER)
4702 *log_msgptr = US"defer in percent_hack_domains check";
4706 if ((addr->prop.utf8_msg = message_smtputf8))
4708 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4709 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4712 deliver_domain = addr->domain;
4713 deliver_localpart = addr->local_part;
4718 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4720 acl_where = ACL_WHERE_UNKNOWN;
4722 /* Cutthrough - if requested,
4723 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4724 and rcpt acl returned accept,
4725 and first recipient (cancel on any subsequents)
4726 open one now and run it up to RCPT acceptance.
4727 A failed verify should cancel cutthrough request,
4728 and will pass the fail to the originator.
4729 Initial implementation: dual-write to spool.
4730 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4732 Cease cutthrough copy on rxd final dot; do not send one.
4734 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4736 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4737 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4738 If temp-reject, close the conn (and keep the spooled copy).
4739 If conn-failure, no action (and keep the spooled copy).
4743 case ACL_WHERE_RCPT:
4744 #ifndef DISABLE_PRDR
4745 case ACL_WHERE_PRDR:
4748 if (f.host_checking_callout) /* -bhc mode */
4749 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4752 && cutthrough.delivery
4753 && rcpt_count > cutthrough.nrcpt
4756 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4757 if (cutthrough.defer_pass)
4759 uschar * s = addr->message;
4760 /* Horrid kludge to recover target's SMTP message */
4762 do --s; while (!isdigit(*s));
4763 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4764 f.acl_temp_details = TRUE;
4768 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4772 else HDEBUG(D_acl) if (cutthrough.delivery)
4773 if (rcpt_count <= cutthrough.nrcpt)
4774 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4776 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4779 case ACL_WHERE_PREDATA:
4781 cutthrough_predata();
4783 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4786 case ACL_WHERE_QUIT:
4787 case ACL_WHERE_NOTQUIT:
4788 /* Drop cutthrough conns, and drop heldopen verify conns if
4789 the previous was not DATA */
4792 smtp_connection_had[SMTP_HBUFF_PREV(SMTP_HBUFF_PREV(smtp_ch_index))];
4793 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4795 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4803 deliver_domain = deliver_localpart = deliver_address_data =
4804 deliver_domain_data = sender_address_data = NULL;
4806 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4807 ACL, which is really in the middle of an SMTP command. */
4811 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4813 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4814 "ACL", acl_wherenames[where]);
4820 /* A DROP response is not permitted from MAILAUTH */
4822 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4824 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4825 "ACL", acl_wherenames[where]);
4829 /* Before giving a response, take a look at the length of any user message, and
4830 split it up into multiple lines if possible. */
4832 *user_msgptr = string_split_message(*user_msgptr);
4833 if (fake_response != OK)
4834 fake_response_text = string_split_message(fake_response_text);
4840 /*************************************************
4841 * Create ACL variable *
4842 *************************************************/
4844 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4845 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4848 name pointer to the variable's name, starting with c or m
4850 Returns the pointer to variable's tree node
4854 acl_var_create(uschar * name)
4856 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4857 if (!(node = tree_search(*root, name)))
4859 node = store_get(sizeof(tree_node) + Ustrlen(name), name);
4860 Ustrcpy(node->name, name);
4861 (void)tree_insertnode(root, node);
4863 node->data.ptr = NULL;
4869 /*************************************************
4870 * Write an ACL variable in spool format *
4871 *************************************************/
4873 /* This function is used as a callback for tree_walk when writing variables to
4874 the spool file. To retain spool file compatibility, what is written is -aclc or
4875 -aclm followed by the rest of the name and the data length, space separated,
4876 then the value itself, starting on a new line, and terminated by an additional
4877 newline. When we had only numbered ACL variables, the first line might look
4878 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4882 name of the variable
4883 value of the variable
4884 ctx FILE pointer (as a void pointer)
4890 acl_var_write(uschar * name, uschar * value, void * ctx)
4892 FILE * f = (FILE *)ctx;
4894 if (is_tainted(value))
4896 int q = quoter_for_address(value);
4898 if (is_real_quoter(q)) fprintf(f, "(%s)", lookup_list[q]->name);
4900 fprintf(f, "acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4907 acl_standalone_setvar(const uschar * s)
4909 acl_condition_block * cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
4910 uschar * errstr = NULL, * log_msg = NULL;
4915 cond->type = ACLC_SET;
4916 if (!acl_varname_to_cond(&s, cond, &errstr)) return errstr;
4917 if (!acl_data_to_cond(s, cond, US"'-be'", &errstr)) return errstr;
4919 if (acl_check_condition(ACL_WARN, cond, ACL_WHERE_UNKNOWN,
4920 NULL, 0, &endpass_seen, &errstr, &log_msg, &e) != OK)
4921 return string_sprintf("oops: %s", errstr);
4922 return string_sprintf("variable %s set", cond->u.varname);
4926 #endif /* !MACRO_PREDEF */