1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Code for handling Access Control Lists (ACLs) */
15 /* Default callout timeout */
17 #define CALLOUT_TIMEOUT_DEFAULT 30
19 /* Default quota cache TTLs */
21 #define QUOTA_POS_DEFAULT (5*60)
22 #define QUOTA_NEG_DEFAULT (60*60)
25 /* ACL verb codes - keep in step with the table of verbs that follows */
27 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
32 static uschar *verbs[] = {
33 [ACL_ACCEPT] = US"accept",
34 [ACL_DEFER] = US"defer",
35 [ACL_DENY] = US"deny",
36 [ACL_DISCARD] = US"discard",
37 [ACL_DROP] = US"drop",
38 [ACL_REQUIRE] = US"require",
42 /* For each verb, the conditions for which "message" or "log_message" are used
43 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
44 "accept", the FAIL case is used only after "endpass", but that is selected in
47 static int msgcond[] = {
48 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
49 [ACL_DEFER] = BIT(OK),
51 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
53 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
59 /* ACL condition and modifier codes - keep in step with the table that
66 #ifdef EXPERIMENTAL_BRIGHTMAIL
72 #ifdef EXPERIMENTAL_DCC
75 #ifdef WITH_CONTENT_SCAN
93 ACLC_LOG_REJECT_TARGET,
95 #ifdef WITH_CONTENT_SCAN
99 #ifdef WITH_CONTENT_SCAN
105 #ifdef WITH_CONTENT_SCAN
112 #ifdef WITH_CONTENT_SCAN
122 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
123 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
124 modifiers that look like conditions but always return TRUE. They are used for
125 their side effects. Do not invent new modifier names that result in one name
126 being the prefix of another; the binary-search in the list will go wrong. */
128 typedef struct condition_def {
131 /* Flag to indicate the condition/modifier has a string expansion done
132 at the outer level. In the other cases, expansion already occurs in the
133 checking functions. */
134 BOOL expand_at_top:1;
138 /* Bit map vector of which conditions and modifiers are not allowed at certain
139 times. For each condition and modifier, there's a bitmap of dis-allowed times.
140 For some, it is easier to specify the negation of a small number of allowed
146 static condition_def conditions[] = {
147 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
149 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
151 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
152 ACL_BIT_PREDATA | ACL_BIT_DATA |
156 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
158 ACL_BIT_NOTSMTP_START),
161 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
162 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
163 ACL_BIT_CONNECT | ACL_BIT_HELO,
165 #ifdef EXPERIMENTAL_BRIGHTMAIL
166 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
168 ACL_BIT_CONNECT | ACL_BIT_HELO |
169 ACL_BIT_DATA | ACL_BIT_MIME |
170 # ifndef DISABLE_PRDR
173 ACL_BIT_ETRN | ACL_BIT_EXPN |
175 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
176 ACL_BIT_VRFY | ACL_BIT_PREDATA |
177 ACL_BIT_NOTSMTP_START,
180 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
181 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
183 /* Certain types of control are always allowed, so we let it through
184 always and check in the control processing itself. */
185 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
187 #ifdef EXPERIMENTAL_DCC
188 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
191 # ifndef DISABLE_PRDR
197 #ifdef WITH_CONTENT_SCAN
198 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
201 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
203 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
204 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
207 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
210 /* Explicit key lookups can be made in non-smtp ACLs so pass
211 always and check in the verify processing itself. */
212 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
214 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
216 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
222 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
223 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
227 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
229 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
230 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
232 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
234 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
241 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
242 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
243 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
245 #ifdef WITH_CONTENT_SCAN
246 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
249 # ifndef DISABLE_PRDR
256 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
257 #ifdef WITH_CONTENT_SCAN
258 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
261 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
269 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
270 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
272 #ifdef WITH_CONTENT_SCAN
273 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
276 # ifndef DISABLE_PRDR
284 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
286 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
287 ACL_BIT_PREDATA | ACL_BIT_DATA |
291 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
292 ACL_BIT_NOTSMTP_START),
294 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
295 ACL_BIT_AUTH | ACL_BIT_CONNECT |
297 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
298 ACL_BIT_ETRN | ACL_BIT_EXPN |
299 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
301 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
302 ACL_BIT_AUTH | ACL_BIT_CONNECT |
304 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
305 ACL_BIT_ETRN | ACL_BIT_EXPN |
306 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
309 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
311 #ifdef WITH_CONTENT_SCAN
312 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
313 (unsigned int) ~(ACL_BIT_DATA |
314 # ifndef DISABLE_PRDR
321 [ACLC_SPF] = { US"spf", TRUE, FALSE,
322 ACL_BIT_AUTH | ACL_BIT_CONNECT |
323 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
324 ACL_BIT_ETRN | ACL_BIT_EXPN |
325 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
326 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
328 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
329 ACL_BIT_AUTH | ACL_BIT_CONNECT |
330 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
331 ACL_BIT_ETRN | ACL_BIT_EXPN |
332 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
333 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
336 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
338 /* Certain types of verify are always allowed, so we let it through
339 always and check in the verify function itself */
340 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
345 # include "macro_predef.h"
349 for (condition_def * c = conditions; c < conditions + nelem(conditions); c++)
351 uschar buf[64], * p, * s;
352 int n = sprintf(CS buf, "_ACL_%s_", c->is_modifier ? "MOD" : "COND");
353 for (p = buf + n, s = c->name; *s; s++) *p++ = toupper(*s);
355 builtin_macro_create(buf);
363 /* Return values from decode_control(); used as index so keep in step
364 with the controls_list table that follows! */
367 CONTROL_AUTH_UNADVERTISED,
368 #ifdef EXPERIMENTAL_BRIGHTMAIL
371 CONTROL_CASEFUL_LOCAL_PART,
372 CONTROL_CASELOWER_LOCAL_PART,
373 CONTROL_CUTTHROUGH_DELIVERY,
379 CONTROL_DMARC_VERIFY,
380 CONTROL_DMARC_FORENSIC,
383 CONTROL_ENFORCE_SYNC,
384 CONTROL_ERROR, /* pseudo-value for decode errors */
389 CONTROL_NO_CALLOUT_FLUSH,
390 CONTROL_NO_DELAY_FLUSH,
391 CONTROL_NO_ENFORCE_SYNC,
392 #ifdef WITH_CONTENT_SCAN
393 CONTROL_NO_MBOX_UNSPOOL,
395 CONTROL_NO_MULTILINE,
396 CONTROL_NO_PIPELINING,
400 CONTROL_SUPPRESS_LOCAL_FIXUPS,
402 CONTROL_UTF8_DOWNCONVERT,
408 /* Structure listing various control arguments, with their characteristics.
409 For each control, there's a bitmap of dis-allowed times. For some, it is easier
410 to specify the negation of a small number of allowed times. */
412 typedef struct control_def {
414 BOOL has_option; /* Has /option(s) following */
415 unsigned forbids; /* bitmap of dis-allowed times */
418 static control_def controls_list[] = {
419 /* name has_option forbids */
420 [CONTROL_AUTH_UNADVERTISED] =
421 { US"allow_auth_unadvertised", FALSE,
423 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
425 #ifdef EXPERIMENTAL_BRIGHTMAIL
427 { US"bmi_run", FALSE, 0 },
429 [CONTROL_CASEFUL_LOCAL_PART] =
430 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
431 [CONTROL_CASELOWER_LOCAL_PART] =
432 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
433 [CONTROL_CUTTHROUGH_DELIVERY] =
434 { US"cutthrough_delivery", TRUE, 0 },
436 { US"debug", TRUE, 0 },
439 [CONTROL_DKIM_VERIFY] =
440 { US"dkim_disable_verify", FALSE,
441 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
442 # ifndef DISABLE_PRDR
445 ACL_BIT_NOTSMTP_START
450 [CONTROL_DMARC_VERIFY] =
451 { US"dmarc_disable_verify", FALSE,
452 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
454 [CONTROL_DMARC_FORENSIC] =
455 { US"dmarc_enable_forensic", FALSE,
456 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
462 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
464 [CONTROL_ENFORCE_SYNC] =
465 { US"enforce_sync", FALSE,
466 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
469 /* Pseudo-value for decode errors */
471 { US"error", FALSE, 0 },
473 [CONTROL_FAKEDEFER] =
474 { US"fakedefer", TRUE,
476 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
477 ACL_BIT_PREDATA | ACL_BIT_DATA |
483 [CONTROL_FAKEREJECT] =
484 { US"fakereject", TRUE,
486 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
487 ACL_BIT_PREDATA | ACL_BIT_DATA |
496 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
497 ACL_BIT_PREDATA | ACL_BIT_DATA |
498 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
499 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
502 [CONTROL_NO_CALLOUT_FLUSH] =
503 { US"no_callout_flush", FALSE,
504 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
506 [CONTROL_NO_DELAY_FLUSH] =
507 { US"no_delay_flush", FALSE,
508 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
511 [CONTROL_NO_ENFORCE_SYNC] =
512 { US"no_enforce_sync", FALSE,
513 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
515 #ifdef WITH_CONTENT_SCAN
516 [CONTROL_NO_MBOX_UNSPOOL] =
517 { US"no_mbox_unspool", FALSE,
519 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
520 ACL_BIT_PREDATA | ACL_BIT_DATA |
521 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
525 [CONTROL_NO_MULTILINE] =
526 { US"no_multiline_responses", FALSE,
527 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
529 [CONTROL_NO_PIPELINING] =
530 { US"no_pipelining", FALSE,
531 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
537 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
538 ACL_BIT_PREDATA | ACL_BIT_DATA |
539 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
540 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
543 [CONTROL_SUBMISSION] =
544 { US"submission", TRUE,
546 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
548 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
549 { US"suppress_local_fixups", FALSE,
551 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
552 ACL_BIT_NOTSMTP_START)
555 [CONTROL_UTF8_DOWNCONVERT] =
556 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
561 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
562 caches its result in a tree to avoid repeated DNS queries. The result is an
563 integer code which is used as an index into the following tables of
564 explanatory strings and verification return codes. */
566 static tree_node *csa_cache = NULL;
568 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
569 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
571 /* The acl_verify_csa() return code is translated into an acl_verify() return
572 code using the following table. It is OK unless the client is definitely not
573 authorized. This is because CSA is supposed to be optional for sending sites,
574 so recipients should not be too strict about checking it - especially because
575 DNS problems are quite likely to occur. It's possible to use $csa_status in
576 further ACL conditions to distinguish ok, unknown, and defer if required, but
577 the aim is to make the usual configuration simple. */
579 static int csa_return_code[] = {
582 [CSA_DEFER_SRV] = OK,
583 [CSA_DEFER_ADDR] = OK,
584 [CSA_FAIL_EXPLICIT] = FAIL,
585 [CSA_FAIL_DOMAIN] = FAIL,
586 [CSA_FAIL_NOADDR] = FAIL,
587 [CSA_FAIL_MISMATCH] = FAIL
590 static uschar *csa_status_string[] = {
591 [CSA_UNKNOWN] = US"unknown",
593 [CSA_DEFER_SRV] = US"defer",
594 [CSA_DEFER_ADDR] = US"defer",
595 [CSA_FAIL_EXPLICIT] = US"fail",
596 [CSA_FAIL_DOMAIN] = US"fail",
597 [CSA_FAIL_NOADDR] = US"fail",
598 [CSA_FAIL_MISMATCH] = US"fail"
601 static uschar *csa_reason_string[] = {
602 [CSA_UNKNOWN] = US"unknown",
604 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
605 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
606 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
607 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
608 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
609 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
612 /* Options for the ratelimit condition. Note that there are two variants of
613 the per_rcpt option, depending on the ACL that is used to measure the rate.
614 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
615 so the two variants must have the same internal representation as well as
616 the same configuration string. */
619 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
620 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
623 #define RATE_SET(var,new) \
624 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
626 static uschar *ratelimit_option_string[] = {
627 [RATE_PER_WHAT] = US"?",
628 [RATE_PER_CLASH] = US"!",
629 [RATE_PER_ADDR] = US"per_addr",
630 [RATE_PER_BYTE] = US"per_byte",
631 [RATE_PER_CMD] = US"per_cmd",
632 [RATE_PER_CONN] = US"per_conn",
633 [RATE_PER_MAIL] = US"per_mail",
634 [RATE_PER_RCPT] = US"per_rcpt",
635 [RATE_PER_ALLRCPTS] = US"per_rcpt"
638 /* Enable recursion between acl_check_internal() and acl_check_condition() */
640 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
644 /*************************************************
645 * Find control in list *
646 *************************************************/
648 /* The lists are always in order, so binary chop can be used.
651 name the control name to search for
652 ol the first entry in the control list
653 last one more than the offset of the last entry in the control list
655 Returns: index of a control entry, or -1 if not found
659 find_control(const uschar * name, control_def * ol, int last)
661 for (int first = 0; last > first; )
663 int middle = (first + last)/2;
664 uschar * s = ol[middle].name;
665 int c = Ustrncmp(name, s, Ustrlen(s));
666 if (c == 0) return middle;
667 else if (c > 0) first = middle + 1;
675 /*************************************************
676 * Pick out condition from list *
677 *************************************************/
679 /* Use a binary chop method
683 list list of conditions
686 Returns: offset in list, or -1 if not found
690 acl_checkcondition(uschar * name, condition_def * list, int end)
692 for (int start = 0; start < end; )
694 int mid = (start + end)/2;
695 int c = Ustrcmp(name, list[mid].name);
696 if (c == 0) return mid;
697 if (c < 0) end = mid;
698 else start = mid + 1;
704 /*************************************************
705 * Pick out name from list *
706 *************************************************/
708 /* Use a binary chop method
715 Returns: offset in list, or -1 if not found
719 acl_checkname(uschar *name, uschar **list, int end)
721 for (int start = 0; start < end; )
723 int mid = (start + end)/2;
724 int c = Ustrcmp(name, list[mid]);
725 if (c == 0) return mid;
726 if (c < 0) end = mid; else start = mid + 1;
733 /*************************************************
734 * Read and parse one ACL *
735 *************************************************/
737 /* This function is called both from readconf in order to parse the ACLs in the
738 configuration file, and also when an ACL is encountered dynamically (e.g. as
739 the result of an expansion). It is given a function to call in order to
740 retrieve the lines of the ACL. This function handles skipping comments and
741 blank lines (where relevant).
744 func function to get next line of ACL
745 error where to put an error message
747 Returns: pointer to ACL, or NULL
748 NULL can be legal (empty ACL); in this case error will be NULL
752 acl_read(uschar *(*func)(void), uschar **error)
754 acl_block *yield = NULL;
755 acl_block **lastp = &yield;
756 acl_block *this = NULL;
757 acl_condition_block *cond;
758 acl_condition_block **condp = NULL;
763 while ((s = (*func)()))
766 BOOL negated = FALSE;
767 uschar *saveline = s;
768 uschar name[EXIM_DRIVERNAME_MAX];
770 /* Conditions (but not verbs) are allowed to be negated by an initial
773 if (Uskip_whitespace(&s) == '!')
779 /* Read the name of a verb or a condition, or the start of a new ACL, which
780 can be started by a name, or by a macro definition. */
782 s = readconf_readname(name, sizeof(name), s);
783 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
785 /* If a verb is unrecognized, it may be another condition or modifier that
786 continues the previous verb. */
788 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
792 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
804 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
807 this = store_get(sizeof(acl_block), FALSE);
809 lastp = &(this->next);
811 this->condition = NULL;
813 this->srcline = config_lineno; /* for debug output */
814 this->srcfile = config_filename; /**/
815 condp = &(this->condition);
816 if (*s == 0) continue; /* No condition on this line */
822 s = readconf_readname(name, sizeof(name), s); /* Condition name */
825 /* Handle a condition or modifier. */
827 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
829 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
834 /* The modifiers may not be negated */
836 if (negated && conditions[c].is_modifier)
838 *error = string_sprintf("ACL error: negation is not allowed with "
839 "\"%s\"", conditions[c].name);
843 /* ENDPASS may occur only with ACCEPT or DISCARD. */
845 if (c == ACLC_ENDPASS &&
846 this->verb != ACL_ACCEPT &&
847 this->verb != ACL_DISCARD)
849 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
850 conditions[c].name, verbs[this->verb]);
854 cond = store_get(sizeof(acl_condition_block), FALSE);
857 cond->u.negated = negated;
860 condp = &(cond->next);
862 /* The "set" modifier is different in that its argument is "name=value"
863 rather than just a value, and we can check the validity of the name, which
864 gives us a variable name to insert into the data block. The original ACL
865 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
866 extended to 20 of each type, but after that people successfully argued for
867 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
868 After that, we allow alphanumerics and underscores, but the first character
869 after c or m must be a digit or an underscore. This retains backwards
874 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
875 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
877 uschar * endptr = s+18;
879 if (isalnum(*endptr))
881 *error = string_sprintf("invalid variable name after \"set\" in ACL "
882 "modifier \"set %s\" "
883 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
887 cond->u.varname = string_copyn(s, 18);
889 Uskip_whitespace(&s);
896 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
898 *error = string_sprintf("invalid variable name after \"set\" in ACL "
899 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
904 if (!isdigit(*endptr) && *endptr != '_')
906 *error = string_sprintf("invalid variable name after \"set\" in ACL "
907 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
912 while (*endptr && *endptr != '=' && !isspace(*endptr))
914 if (!isalnum(*endptr) && *endptr != '_')
916 *error = string_sprintf("invalid character \"%c\" in variable name "
917 "in ACL modifier \"set %s\"", *endptr, s);
923 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
925 Uskip_whitespace(&s);
928 /* For "set", we are now positioned for the data. For the others, only
929 "endpass" has no data */
931 if (c != ACLC_ENDPASS)
935 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
936 conditions[c].is_modifier ? US"modifier" : US"condition");
939 Uskip_whitespace(&s);
940 cond->arg = string_copy(s);
949 /*************************************************
950 * Set up added header line(s) *
951 *************************************************/
953 /* This function is called by the add_header modifier, and also from acl_warn()
954 to implement the now-deprecated way of adding header lines using "message" on a
955 "warn" verb. The argument is treated as a sequence of header lines which are
956 added to a chain, provided there isn't an identical one already there.
958 Argument: string of header lines
963 setup_header(const uschar *hstring)
966 int hlen = Ustrlen(hstring);
968 /* Ignore any leading newlines */
969 while (*hstring == '\n') hstring++, hlen--;
971 /* An empty string does nothing; ensure exactly one final newline. */
972 if (hlen <= 0) return;
973 if (hstring[--hlen] != '\n') /* no newline */
974 q = string_sprintf("%s\n", hstring);
975 else if (hstring[hlen-1] == '\n') /* double newline */
977 uschar * s = string_copy(hstring);
978 while(s[--hlen] == '\n')
985 /* Loop for multiple header lines, taking care about continuations */
987 for (p = q; *p; p = q)
991 int newtype = htype_add_bot;
992 header_line **hptr = &acl_added_headers;
994 /* Find next header line within the string */
998 q = Ustrchr(q, '\n'); /* we know there was a newline */
999 if (*++q != ' ' && *q != '\t') break;
1002 /* If the line starts with a colon, interpret the instruction for where to
1003 add it. This temporarily sets up a new type. */
1007 if (strncmpic(p, US":after_received:", 16) == 0)
1009 newtype = htype_add_rec;
1012 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1014 newtype = htype_add_rfc;
1017 else if (strncmpic(p, US":at_start:", 10) == 0)
1019 newtype = htype_add_top;
1022 else if (strncmpic(p, US":at_end:", 8) == 0)
1024 newtype = htype_add_bot;
1027 while (*p == ' ' || *p == '\t') p++;
1030 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1031 to the front of it. */
1033 for (s = p; s < q - 1; s++)
1034 if (*s == ':' || !isgraph(*s)) break;
1036 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1037 hlen = Ustrlen(hdr);
1039 /* See if this line has already been added */
1043 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1044 hptr = &(*hptr)->next;
1047 /* Add if not previously present */
1051 /* The header_line struct itself is not tainted, though it points to
1052 possibly tainted data. */
1053 header_line * h = store_get(sizeof(header_line), FALSE);
1066 /*************************************************
1067 * List the added header lines *
1068 *************************************************/
1074 for (header_line * h = acl_added_headers; h; h = h->next)
1077 if (h->text[i-1] == '\n') i--;
1078 g = string_append_listele_n(g, '\n', h->text, i);
1081 return g ? g->s : NULL;
1085 /*************************************************
1086 * Set up removed header line(s) *
1087 *************************************************/
1089 /* This function is called by the remove_header modifier. The argument is
1090 treated as a sequence of header names which are added to a colon separated
1091 list, provided there isn't an identical one already there.
1093 Argument: string of header names
1098 setup_remove_header(const uschar *hnames)
1101 acl_removed_headers = acl_removed_headers
1102 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1103 : string_copy(hnames);
1108 /*************************************************
1110 *************************************************/
1112 /* This function is called when a WARN verb's conditions are true. It adds to
1113 the message's headers, and/or writes information to the log. In each case, this
1114 only happens once (per message for headers, per connection for log).
1116 ** NOTE: The header adding action using the "message" setting is historic, and
1117 its use is now deprecated. The new add_header modifier should be used instead.
1120 where ACL_WHERE_xxxx indicating which ACL this is
1121 user_message message for adding to headers
1122 log_message message for logging, if different
1128 acl_warn(int where, uschar *user_message, uschar *log_message)
1130 if (log_message != NULL && log_message != user_message)
1133 string_item *logged;
1135 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1136 string_printing(log_message));
1138 /* If a sender verification has failed, and the log message is "sender verify
1139 failed", add the failure message. */
1141 if (sender_verified_failed != NULL &&
1142 sender_verified_failed->message != NULL &&
1143 strcmpic(log_message, US"sender verify failed") == 0)
1144 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1146 /* Search previously logged warnings. They are kept in malloc
1147 store so they can be freed at the start of a new message. */
1149 for (logged = acl_warn_logged; logged; logged = logged->next)
1150 if (Ustrcmp(logged->text, text) == 0) break;
1154 int length = Ustrlen(text) + 1;
1155 log_write(0, LOG_MAIN, "%s", text);
1156 logged = store_malloc(sizeof(string_item) + length);
1157 logged->text = US logged + sizeof(string_item);
1158 memcpy(logged->text, text, length);
1159 logged->next = acl_warn_logged;
1160 acl_warn_logged = logged;
1164 /* If there's no user message, we are done. */
1166 if (!user_message) return;
1168 /* If this isn't a message ACL, we can't do anything with a user message.
1171 if (where > ACL_WHERE_NOTSMTP)
1173 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1174 "found in a non-message (%s) ACL: cannot specify header lines here: "
1175 "message ignored", acl_wherenames[where]);
1179 /* The code for setting up header lines is now abstracted into a separate
1180 function so that it can be used for the add_header modifier as well. */
1182 setup_header(user_message);
1187 /*************************************************
1188 * Verify and check reverse DNS *
1189 *************************************************/
1191 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1192 address if this has not yet been done. The host_name_lookup() function checks
1193 that one of these names resolves to an address list that contains the client IP
1194 address, so we don't actually have to do the check here.
1197 user_msgptr pointer for user message
1198 log_msgptr pointer for log message
1200 Returns: OK verification condition succeeded
1201 FAIL verification failed
1202 DEFER there was a problem verifying
1206 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1210 /* Previous success */
1212 if (sender_host_name != NULL) return OK;
1214 /* Previous failure */
1216 if (host_lookup_failed)
1218 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1222 /* Need to do a lookup */
1225 debug_printf_indent("looking up host name to force name/address consistency check\n");
1227 if ((rc = host_name_lookup()) != OK)
1229 *log_msgptr = rc == DEFER
1230 ? US"host lookup deferred for reverse lookup check"
1231 : string_sprintf("host lookup failed for reverse lookup check%s",
1233 return rc; /* DEFER or FAIL */
1236 host_build_sender_fullhost();
1242 /*************************************************
1243 * Check client IP address matches CSA target *
1244 *************************************************/
1246 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1247 response for address records belonging to the CSA target hostname. The section
1248 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1249 If one of the addresses matches the client's IP address, then the client is
1250 authorized by CSA. If there are target IP addresses but none of them match
1251 then the client is using an unauthorized IP address. If there are no target IP
1252 addresses then the client cannot be using an authorized IP address. (This is
1253 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1256 dnsa the DNS answer block
1257 dnss a DNS scan block for us to use
1258 reset option specifying what portion to scan, as described above
1259 target the target hostname to use for matching RR names
1261 Returns: CSA_OK successfully authorized
1262 CSA_FAIL_MISMATCH addresses found but none matched
1263 CSA_FAIL_NOADDR no target addresses found
1267 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1270 int rc = CSA_FAIL_NOADDR;
1272 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1274 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1276 /* Check this is an address RR for the target hostname. */
1280 && rr->type != T_AAAA
1284 if (strcmpic(target, rr->name) != 0) continue;
1286 rc = CSA_FAIL_MISMATCH;
1288 /* Turn the target address RR into a list of textual IP addresses and scan
1289 the list. There may be more than one if it is an A6 RR. */
1291 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1293 /* If the client IP address matches the target IP address, it's good! */
1295 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1297 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1301 /* If we found some target addresses but none of them matched, the client is
1302 using an unauthorized IP address, otherwise the target has no authorized IP
1310 /*************************************************
1311 * Verify Client SMTP Authorization *
1312 *************************************************/
1314 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1315 to find the CSA SRV record corresponding to the domain argument, or
1316 $sender_helo_name if no argument is provided. It then checks that the
1317 client is authorized, and that its IP address corresponds to the SRV
1318 target's address by calling acl_verify_csa_address() above. The address
1319 should have been returned in the DNS response's ADDITIONAL section, but if
1320 not we perform another DNS lookup to get it.
1323 domain pointer to optional parameter following verify = csa
1325 Returns: CSA_UNKNOWN no valid CSA record found
1326 CSA_OK successfully authorized
1327 CSA_FAIL_* client is definitely not authorized
1328 CSA_DEFER_* there was a DNS problem
1332 acl_verify_csa(const uschar *domain)
1335 const uschar *found;
1336 int priority, weight, port;
1340 int rc, type, yield;
1341 #define TARGET_SIZE 256
1342 uschar * target = store_get(TARGET_SIZE, TRUE);
1344 /* Work out the domain we are using for the CSA lookup. The default is the
1345 client's HELO domain. If the client has not said HELO, use its IP address
1346 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1348 while (isspace(*domain) && *domain != '\0') ++domain;
1349 if (*domain == '\0') domain = sender_helo_name;
1350 if (!domain) domain = sender_host_address;
1351 if (!sender_host_address) return CSA_UNKNOWN;
1353 /* If we have an address literal, strip off the framing ready for turning it
1354 into a domain. The framing consists of matched square brackets possibly
1355 containing a keyword and a colon before the actual IP address. */
1357 if (domain[0] == '[')
1359 const uschar *start = Ustrchr(domain, ':');
1360 if (start == NULL) start = domain;
1361 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1364 /* Turn domains that look like bare IP addresses into domains in the reverse
1365 DNS. This code also deals with address literals and $sender_host_address. It's
1366 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1367 address literals, but it's probably the most friendly thing to do. This is an
1368 extension to CSA, so we allow it to be turned off for proper conformance. */
1370 if (string_is_ip_address(domain, NULL) != 0)
1372 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1373 domain = dns_build_reverse(domain);
1376 /* Find out if we've already done the CSA check for this domain. If we have,
1377 return the same result again. Otherwise build a new cached result structure
1378 for this domain. The name is filled in now, and the value is filled in when
1379 we return from this function. */
1381 if ((t = tree_search(csa_cache, domain)))
1384 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
1385 Ustrcpy(t->name, domain);
1386 (void)tree_insertnode(&csa_cache, t);
1388 /* Now we are ready to do the actual DNS lookup(s). */
1391 dnsa = store_get_dns_answer();
1392 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1394 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1397 yield = CSA_DEFER_SRV;
1400 /* If we found nothing, the client's authorization is unknown. */
1404 yield = CSA_UNKNOWN;
1407 /* We got something! Go on to look at the reply in more detail. */
1413 /* Scan the reply for well-formed CSA SRV records. */
1415 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1417 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1419 const uschar * p = rr->data;
1421 /* Extract the numerical SRV fields (p is incremented) */
1423 GETSHORT(priority, p);
1424 GETSHORT(weight, p);
1428 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1430 /* Check the CSA version number */
1432 if (priority != 1) continue;
1434 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1435 found by dns_special_lookup() is a parent of the one we asked for), we check
1436 the subdomain assertions in the port field. At the moment there's only one
1437 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1438 SRV records of their own. */
1440 if (Ustrcmp(found, domain) != 0)
1442 yield = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1446 /* This CSA SRV record refers directly to our domain, so we check the value
1447 in the weight field to work out the domain's authorization. 0 and 1 are
1448 unauthorized; 3 means the client is authorized but we can't check the IP
1449 address in order to authenticate it, so we treat it as unknown; values
1450 greater than 3 are undefined. */
1454 yield = CSA_FAIL_DOMAIN;
1458 if (weight > 2) continue;
1460 /* Weight == 2, which means the domain is authorized. We must check that the
1461 client's IP address is listed as one of the SRV target addresses. Save the
1462 target hostname then break to scan the additional data for its addresses. */
1464 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1465 (DN_EXPAND_ARG4_TYPE)target, TARGET_SIZE);
1467 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1472 /* If we didn't break the loop then no appropriate records were found. */
1476 yield = CSA_UNKNOWN;
1480 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1481 A target of "." indicates there are no valid addresses, so the client cannot
1482 be authorized. (This is an odd configuration because weight=2 target=. is
1483 equivalent to weight=1, but we check for it in order to keep load off the
1484 root name servers.) Note that dn_expand() turns "." into "". */
1486 if (Ustrcmp(target, "") == 0)
1488 yield = CSA_FAIL_NOADDR;
1492 /* Scan the additional section of the CSA SRV reply for addresses belonging
1493 to the target. If the name server didn't return any additional data (e.g.
1494 because it does not fully support SRV records), we need to do another lookup
1495 to obtain the target addresses; otherwise we have a definitive result. */
1497 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1498 if (rc != CSA_FAIL_NOADDR)
1504 /* The DNS lookup type corresponds to the IP version used by the client. */
1507 if (Ustrchr(sender_host_address, ':') != NULL)
1510 #endif /* HAVE_IPV6 */
1514 lookup_dnssec_authenticated = NULL;
1515 switch (dns_lookup(dnsa, target, type, NULL))
1517 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1520 yield = CSA_DEFER_ADDR;
1523 /* If the query succeeded, scan the addresses and return the result. */
1526 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1527 if (rc != CSA_FAIL_NOADDR)
1532 /* else fall through */
1534 /* If the target has no IP addresses, the client cannot have an authorized
1535 IP address. However, if the target site uses A6 records (not AAAA records)
1536 we have to do yet another lookup in order to check them. */
1540 yield = CSA_FAIL_NOADDR;
1546 store_free_dns_answer(dnsa);
1547 return t->data.val = yield;
1552 /*************************************************
1553 * Handle verification (address & other) *
1554 *************************************************/
1556 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1557 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1558 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1563 unsigned where_allowed; /* bitmap */
1564 BOOL no_options; /* Never has /option(s) following */
1565 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1567 static verify_type_t verify_type_list[] = {
1568 /* name value where no-opt opt-sep */
1569 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1570 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1571 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1572 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1573 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BITS_HAVEDATA, TRUE, 0 },
1574 { US"not_blind", VERIFY_NOT_BLIND, ACL_BITS_HAVEDATA, FALSE, 0 },
1575 { US"header_sender", VERIFY_HDR_SNDR, ACL_BITS_HAVEDATA, FALSE, 0 },
1576 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1577 | ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1579 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1580 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BITS_HAVEDATA, TRUE, 0 },
1581 #ifdef EXPERIMENTAL_ARC
1582 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1587 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1588 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1589 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1590 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1596 BOOL has_option; /* Has =option(s) following */
1597 BOOL timeval; /* Has a time value */
1599 static callout_opt_t callout_opt_list[] = {
1600 /* name value flag has-opt has-time */
1601 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1602 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1603 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1604 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1605 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1606 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1607 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1608 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1609 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1610 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1611 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1612 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1613 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1619 v_period(const uschar * s, const uschar * arg, uschar ** log_msgptr)
1622 if ((period = readconf_readtime(s, 0, FALSE)) < 0)
1624 *log_msgptr = string_sprintf("bad time value in ACL condition "
1625 "\"verify %s\"", arg);
1632 /* This function implements the "verify" condition. It is called when
1633 encountered in any ACL, because some tests are almost always permitted. Some
1634 just don't make sense, and always fail (for example, an attempt to test a host
1635 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1638 where where called from
1639 addr the recipient address that the ACL is handling, or NULL
1640 arg the argument of "verify"
1641 user_msgptr pointer for user message
1642 log_msgptr pointer for log message
1643 basic_errno where to put verify errno
1645 Returns: OK verification condition succeeded
1646 FAIL verification failed
1647 DEFER there was a problem verifying
1652 acl_verify(int where, address_item *addr, const uschar *arg,
1653 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1657 int callout_overall = -1;
1658 int callout_connect = -1;
1659 int verify_options = 0;
1661 BOOL verify_header_sender = FALSE;
1662 BOOL defer_ok = FALSE;
1663 BOOL callout_defer_ok = FALSE;
1664 BOOL no_details = FALSE;
1665 BOOL success_on_redirect = FALSE;
1667 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
1668 address_item *sender_vaddr = NULL;
1669 uschar *verify_sender_address = NULL;
1670 uschar *pm_mailfrom = NULL;
1671 uschar *se_mailfrom = NULL;
1673 /* Some of the verify items have slash-separated options; some do not. Diagnose
1674 an error if options are given for items that don't expect them.
1677 uschar *slash = Ustrchr(arg, '/');
1678 const uschar *list = arg;
1679 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1682 if (!ss) goto BAD_VERIFY;
1684 /* Handle name/address consistency verification in a separate function. */
1686 for (vp = verify_type_list;
1687 CS vp < CS verify_type_list + sizeof(verify_type_list);
1690 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1691 : strcmpic (ss, vp->name) == 0)
1693 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1696 if (vp->no_options && slash)
1698 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1699 "(this verify item has no options)", arg);
1702 if (!(vp->where_allowed & BIT(where)))
1704 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1705 vp->name, acl_wherenames[where]);
1710 case VERIFY_REV_HOST_LKUP:
1711 if (!sender_host_address) return OK;
1712 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1713 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1714 if (strcmpic(ss, US"defer_ok") == 0)
1719 /* TLS certificate verification is done at STARTTLS time; here we just
1720 test whether it was successful or not. (This is for optional verification; for
1721 mandatory verification, the connection doesn't last this long.) */
1723 if (tls_in.certificate_verified) return OK;
1724 *user_msgptr = US"no verified certificate";
1728 /* We can test the result of optional HELO verification that might have
1729 occurred earlier. If not, we can attempt the verification now. */
1731 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1732 return f.helo_verified ? OK : FAIL;
1735 /* Do Client SMTP Authorization checks in a separate function, and turn the
1736 result code into user-friendly strings. */
1738 rc = acl_verify_csa(list);
1739 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1740 csa_reason_string[rc]);
1741 csa_status = csa_status_string[rc];
1742 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1743 return csa_return_code[rc];
1745 #ifdef EXPERIMENTAL_ARC
1747 { /* Do Authenticated Received Chain checks in a separate function. */
1748 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1752 if (!(arc_state = acl_verify_arc())) return DEFER;
1753 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1754 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1756 if (!condlist) condlist = US"none:pass";
1757 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1758 if (Ustrcmp(arc_state, cond) == 0) return OK;
1763 case VERIFY_HDR_SYNTAX:
1764 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1765 a syntax error, we return details of the error to the sender if configured to
1766 send out full details. (But a "message" setting on the ACL can override, as
1769 rc = verify_check_headers(log_msgptr);
1770 if (rc != OK && *log_msgptr)
1771 if (smtp_return_error_details)
1772 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1774 acl_verify_message = *log_msgptr;
1777 case VERIFY_HDR_NAMES_ASCII:
1778 /* Check that all header names are true 7 bit strings
1779 See RFC 5322, 2.2. and RFC 6532, 3. */
1781 rc = verify_check_header_names_ascii(log_msgptr);
1782 if (rc != OK && smtp_return_error_details && *log_msgptr)
1783 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1786 case VERIFY_NOT_BLIND:
1787 /* Check that no recipient of this message is "blind", that is, every envelope
1788 recipient must be mentioned in either To: or Cc:. */
1790 BOOL case_sensitive = TRUE;
1792 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1793 if (strcmpic(ss, US"case_insensitive") == 0)
1794 case_sensitive = FALSE;
1797 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1798 "condition \"verify %s\"", ss, arg);
1802 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1804 *log_msgptr = US"bcc recipient detected";
1805 if (smtp_return_error_details)
1806 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1811 /* The remaining verification tests check recipient and sender addresses,
1812 either from the envelope or from the header. There are a number of
1813 slash-separated options that are common to all of them. */
1815 case VERIFY_HDR_SNDR:
1816 verify_header_sender = TRUE;
1820 /* In the case of a sender, this can optionally be followed by an address to use
1821 in place of the actual sender (rare special-case requirement). */
1825 verify_sender_address = sender_address;
1828 while (isspace(*s)) s++;
1829 if (*s++ != '=') goto BAD_VERIFY;
1830 while (isspace(*s)) s++;
1831 verify_sender_address = string_copy(s);
1842 /* Remaining items are optional; they apply to sender and recipient
1843 verification, including "header sender" verification. */
1845 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1847 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1848 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1849 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1851 /* These two old options are left for backwards compatibility */
1853 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1855 callout_defer_ok = TRUE;
1856 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1859 else if (strcmpic(ss, US"check_postmaster") == 0)
1862 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1865 /* The callout option has a number of sub-options, comma separated */
1867 else if (strncmpic(ss, US"callout", 7) == 0)
1869 callout = CALLOUT_TIMEOUT_DEFAULT;
1872 while (isspace(*ss)) ss++;
1875 const uschar * sublist = ss;
1878 while (isspace(*sublist)) sublist++;
1879 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1882 double period = 1.0F;
1884 for (op= callout_opt_list; op->name; op++)
1885 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1888 verify_options |= op->flag;
1891 opt += Ustrlen(op->name);
1892 while (isspace(*opt)) opt++;
1895 *log_msgptr = string_sprintf("'=' expected after "
1896 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1899 while (isspace(*opt)) opt++;
1901 if (op->timeval && (period = v_period(opt, arg, log_msgptr)) < 0)
1906 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1907 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1908 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1909 case CALLOUT_MAILFROM:
1910 if (!verify_header_sender)
1912 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1913 "callout option only for verify=header_sender (detected in ACL "
1914 "condition \"%s\")", arg);
1917 se_mailfrom = string_copy(opt);
1919 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1920 case CALLOUT_MAXWAIT: callout_overall = period; break;
1921 case CALLOUT_CONNECT: callout_connect = period; break;
1922 case CALLOUT_TIME: callout = period; break;
1928 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1929 "ACL condition \"%s\"", arg);
1935 /* The quota option has sub-options, comma-separated */
1937 else if (strncmpic(ss, US"quota", 5) == 0)
1942 while (isspace(*ss)) ss++;
1945 const uschar * sublist = ss;
1949 while (isspace(*sublist)) sublist++;
1950 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1951 if (Ustrncmp(opt, "cachepos=", 9) == 0)
1952 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1955 quota_pos_cache = period;
1956 else if (Ustrncmp(opt, "cacheneg=", 9) == 0)
1957 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1960 quota_neg_cache = period;
1961 else if (Ustrcmp(opt, "no_cache") == 0)
1962 quota_pos_cache = quota_neg_cache = 0;
1967 /* Option not recognized */
1971 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1972 "condition \"verify %s\"", ss, arg);
1977 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1978 (vopt_callout_recipsender|vopt_callout_recippmaster))
1980 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1981 "for a recipient callout";
1985 /* Handle quota verification */
1988 if (vp->value != VERIFY_RCPT)
1990 *log_msgptr = US"can only verify quota of recipient";
1994 if ((rc = verify_quota_call(addr->address,
1995 quota_pos_cache, quota_neg_cache, log_msgptr)) != OK)
1997 *basic_errno = errno;
1998 if (smtp_return_error_details)
2000 if (!*user_msgptr && *log_msgptr)
2001 *user_msgptr = string_sprintf("Rejected after %s: %s",
2002 smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]],
2004 if (rc == DEFER) f.acl_temp_details = TRUE;
2011 /* Handle sender-in-header verification. Default the user message to the log
2012 message if giving out verification details. */
2014 if (verify_header_sender)
2018 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
2019 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2022 *basic_errno = verrno;
2023 if (smtp_return_error_details)
2025 if (!*user_msgptr && *log_msgptr)
2026 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2027 if (rc == DEFER) f.acl_temp_details = TRUE;
2032 /* Handle a sender address. The default is to verify *the* sender address, but
2033 optionally a different address can be given, for special requirements. If the
2034 address is empty, we are dealing with a bounce message that has no sender, so
2035 we cannot do any checking. If the real sender address gets rewritten during
2036 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2037 during message reception.
2039 A list of verified "sender" addresses is kept to try to avoid doing to much
2040 work repetitively when there are multiple recipients in a message and they all
2041 require sender verification. However, when callouts are involved, it gets too
2042 complicated because different recipients may require different callout options.
2043 Therefore, we always do a full sender verify when any kind of callout is
2044 specified. Caching elsewhere, for instance in the DNS resolver and in the
2045 callout handling, should ensure that this is not terribly inefficient. */
2047 else if (verify_sender_address)
2049 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
2051 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2052 "sender verify callout";
2056 sender_vaddr = verify_checked_sender(verify_sender_address);
2057 if ( sender_vaddr /* Previously checked */
2058 && callout <= 0) /* No callout needed this time */
2060 /* If the "routed" flag is set, it means that routing worked before, so
2061 this check can give OK (the saved return code value, if set, belongs to a
2062 callout that was done previously). If the "routed" flag is not set, routing
2063 must have failed, so we use the saved return code. */
2065 if (testflag(sender_vaddr, af_verify_routed))
2069 rc = sender_vaddr->special_action;
2070 *basic_errno = sender_vaddr->basic_errno;
2072 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
2075 /* Do a new verification, and cache the result. The cache is used to avoid
2076 verifying the sender multiple times for multiple RCPTs when callouts are not
2077 specified (see comments above).
2079 The cache is also used on failure to give details in response to the first
2080 RCPT that gets bounced for this reason. However, this can be suppressed by
2081 the no_details option, which sets the flag that says "this detail has already
2082 been sent". The cache normally contains just one address, but there may be
2083 more in esoteric circumstances. */
2088 uschar *save_address_data = deliver_address_data;
2090 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2092 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2094 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2095 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2098 if (no_details) setflag(sender_vaddr, af_sverify_told);
2099 if (verify_sender_address[0] != 0)
2101 /* If this is the real sender address, save the unrewritten version
2102 for use later in receive. Otherwise, set a flag so that rewriting the
2103 sender in verify_address() does not update sender_address. */
2105 if (verify_sender_address == sender_address)
2106 sender_address_unrewritten = sender_address;
2108 verify_options |= vopt_fake_sender;
2110 if (success_on_redirect)
2111 verify_options |= vopt_success_on_redirect;
2113 /* The recipient, qualify, and expn options are never set in
2116 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2117 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2119 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2122 *basic_errno = sender_vaddr->basic_errno;
2125 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2126 debug_printf_indent("sender %s verified ok as %s\n",
2127 verify_sender_address, sender_vaddr->address);
2129 debug_printf_indent("sender %s verified ok\n",
2130 verify_sender_address);
2133 rc = OK; /* Null sender */
2135 /* Cache the result code */
2137 if (routed) setflag(sender_vaddr, af_verify_routed);
2138 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2139 sender_vaddr->special_action = rc;
2140 sender_vaddr->next = sender_verified_list;
2141 sender_verified_list = sender_vaddr;
2143 /* Restore the recipient address data, which might have been clobbered by
2144 the sender verification. */
2146 deliver_address_data = save_address_data;
2149 /* Put the sender address_data value into $sender_address_data */
2151 sender_address_data = sender_vaddr->prop.address_data;
2154 /* A recipient address just gets a straightforward verify; again we must handle
2155 the DEFER overrides. */
2161 if (success_on_redirect)
2162 verify_options |= vopt_success_on_redirect;
2164 /* We must use a copy of the address for verification, because it might
2168 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2169 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2170 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2172 *basic_errno = addr2.basic_errno;
2173 *log_msgptr = addr2.message;
2174 *user_msgptr = addr2.user_message ? addr2.user_message : addr2.message;
2176 /* Allow details for temporary error if the address is so flagged. */
2177 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2179 /* Make $address_data visible */
2180 deliver_address_data = addr2.prop.address_data;
2183 /* We have a result from the relevant test. Handle defer overrides first. */
2187 || callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER
2190 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2191 defer_ok? "defer_ok" : "callout_defer_ok");
2195 /* If we've failed a sender, set up a recipient message, and point
2196 sender_verified_failed to the address item that actually failed. */
2198 if (rc != OK && verify_sender_address)
2201 *log_msgptr = *user_msgptr = US"Sender verify failed";
2202 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2203 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2206 *log_msgptr = US"Could not complete sender verify callout";
2207 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2211 sender_verified_failed = sender_vaddr;
2214 /* Verifying an address messes up the values of $domain and $local_part,
2215 so reset them before returning if this is a RCPT ACL. */
2219 deliver_domain = addr->domain;
2220 deliver_localpart = addr->local_part;
2224 /* Syntax errors in the verify argument come here. */
2227 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2228 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2229 "or \"reverse_host_lookup\" at start of ACL condition "
2230 "\"verify %s\"", arg);
2237 /*************************************************
2238 * Check argument for control= modifier *
2239 *************************************************/
2241 /* Called from acl_check_condition() below.
2242 To handle the case "queue_only" we accept an _ in the
2243 initial / option-switch position.
2246 arg the argument string for control=
2247 pptr set to point to the terminating character
2248 where which ACL we are in
2249 log_msgptr for error messages
2251 Returns: CONTROL_xxx value
2255 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2261 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2262 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2263 && (!d->has_option || c != '/' && c != '_')
2266 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2267 return CONTROL_ERROR;
2277 /*************************************************
2278 * Return a ratelimit error *
2279 *************************************************/
2281 /* Called from acl_ratelimit() below
2284 log_msgptr for error messages
2285 format format string
2286 ... supplementary arguments
2292 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2296 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2298 va_start(ap, format);
2299 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2302 gstring_release_unused(g);
2303 *log_msgptr = string_from_gstring(g);
2310 /*************************************************
2311 * Handle rate limiting *
2312 *************************************************/
2314 /* Called by acl_check_condition() below to calculate the result
2315 of the ACL ratelimit condition.
2317 Note that the return value might be slightly unexpected: if the
2318 sender's rate is above the limit then the result is OK. This is
2319 similar to the dnslists condition, and is so that you can write
2320 ACL clauses like: defer ratelimit = 15 / 1h
2323 arg the option string for ratelimit=
2324 where ACL_WHERE_xxxx indicating which ACL this is
2325 log_msgptr for error messages
2327 Returns: OK - Sender's rate is above limit
2328 FAIL - Sender's rate is below limit
2329 DEFER - Problem opening ratelimit database
2330 ERROR - Syntax error in options.
2334 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2336 double limit, period, count;
2339 uschar *unique = NULL;
2341 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2342 BOOL noupdate = FALSE, badacl = FALSE;
2343 int mode = RATE_PER_WHAT;
2345 tree_node **anchor, *t;
2346 open_db dbblock, *dbm;
2348 dbdata_ratelimit *dbd;
2349 dbdata_ratelimit_unique *dbdb;
2352 /* Parse the first two options and record their values in expansion
2353 variables. These variables allow the configuration to have informative
2354 error messages based on rate limits obtained from a table lookup. */
2356 /* First is the maximum number of messages per period / maximum burst
2357 size, which must be greater than or equal to zero. Zero is useful for
2358 rate measurement as opposed to rate limiting. */
2360 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2361 return ratelimit_error(log_msgptr, "sender rate limit not set");
2363 limit = Ustrtod(sender_rate_limit, &ss);
2364 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2365 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2366 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2368 if (limit < 0.0 || *ss != '\0')
2369 return ratelimit_error(log_msgptr,
2370 "\"%s\" is not a positive number", sender_rate_limit);
2372 /* Second is the rate measurement period / exponential smoothing time
2373 constant. This must be strictly greater than zero, because zero leads to
2374 run-time division errors. */
2376 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2377 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2379 return ratelimit_error(log_msgptr,
2380 "\"%s\" is not a time value", sender_rate_period);
2382 /* By default we are counting one of something, but the per_rcpt,
2383 per_byte, and count options can change this. */
2387 /* Parse the other options. */
2389 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2391 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2392 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2393 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2394 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2395 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2396 else if (strcmpic(ss, US"per_conn") == 0)
2398 RATE_SET(mode, PER_CONN);
2399 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2402 else if (strcmpic(ss, US"per_mail") == 0)
2404 RATE_SET(mode, PER_MAIL);
2405 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2407 else if (strcmpic(ss, US"per_rcpt") == 0)
2409 /* If we are running in the RCPT ACL, then we'll count the recipients
2410 one by one, but if we are running when we have accumulated the whole
2411 list then we'll add them all in one batch. */
2412 if (where == ACL_WHERE_RCPT)
2413 RATE_SET(mode, PER_RCPT);
2414 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2415 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2416 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2417 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2419 else if (strcmpic(ss, US"per_byte") == 0)
2421 /* If we have not yet received the message data and there was no SIZE
2422 declaration on the MAIL command, then it's safe to just use a value of
2423 zero and let the recorded rate decay as if nothing happened. */
2424 RATE_SET(mode, PER_MAIL);
2425 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2426 else count = message_size < 0 ? 0.0 : (double)message_size;
2428 else if (strcmpic(ss, US"per_addr") == 0)
2430 RATE_SET(mode, PER_RCPT);
2431 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2432 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2434 else if (strncmpic(ss, US"count=", 6) == 0)
2437 count = Ustrtod(ss+6, &e);
2438 if (count < 0.0 || *e != '\0')
2439 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2441 else if (strncmpic(ss, US"unique=", 7) == 0)
2442 unique = string_copy(ss + 7);
2444 key = string_copy(ss);
2446 key = string_sprintf("%s/%s", key, ss);
2449 /* Sanity check. When the badacl flag is set the update mode must either
2450 be readonly (which is the default if it is omitted) or, for backwards
2451 compatibility, a combination of noupdate and strict or leaky. */
2453 if (mode == RATE_PER_CLASH)
2454 return ratelimit_error(log_msgptr, "conflicting per_* options");
2455 if (leaky + strict + readonly > 1)
2456 return ratelimit_error(log_msgptr, "conflicting update modes");
2457 if (badacl && (leaky || strict) && !noupdate)
2458 return ratelimit_error(log_msgptr,
2459 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2460 ratelimit_option_string[mode], acl_wherenames[where]);
2462 /* Set the default values of any unset options. In readonly mode we
2463 perform the rate computation without any increment so that its value
2464 decays to eventually allow over-limit senders through. */
2466 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2467 if (badacl) readonly = TRUE;
2468 if (readonly) count = 0.0;
2469 if (!strict && !readonly) leaky = TRUE;
2470 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2472 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2473 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2474 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2475 are added to the key because they alter the meaning of the stored data. */
2478 key = !sender_host_address ? US"" : sender_host_address;
2480 key = string_sprintf("%s/%s/%s%s",
2482 ratelimit_option_string[mode],
2483 unique == NULL ? "" : "unique/",
2487 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2489 /* See if we have already computed the rate by looking in the relevant tree.
2490 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2491 pool so that they survive across resets. In readonly mode we only remember the
2492 result for the rest of this command in case a later command changes it. After
2493 this bit of logic the code is independent of the per_* mode. */
2495 old_pool = store_pool;
2498 anchor = &ratelimiters_cmd;
2502 anchor = &ratelimiters_conn;
2503 store_pool = POOL_PERM;
2507 case RATE_PER_ALLRCPTS:
2508 anchor = &ratelimiters_mail;
2513 anchor = &ratelimiters_cmd;
2516 anchor = NULL; /* silence an "unused" complaint */
2517 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2518 "internal ACL error: unknown ratelimit mode %d", mode);
2522 if ((t = tree_search(*anchor, key)))
2525 /* The following few lines duplicate some of the code below. */
2526 rc = (dbd->rate < limit)? FAIL : OK;
2527 store_pool = old_pool;
2528 sender_rate = string_sprintf("%.1f", dbd->rate);
2530 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2534 /* We aren't using a pre-computed rate, so get a previously recorded rate
2535 from the database, which will be updated and written back if required. */
2537 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2539 store_pool = old_pool;
2541 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2542 *log_msgptr = US"ratelimit database not available";
2545 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2548 gettimeofday(&tv, NULL);
2552 /* Locate the basic ratelimit block inside the DB data. */
2553 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2556 /* Forget the old Bloom filter if it is too old, so that we count each
2557 repeating event once per period. We don't simply clear and re-use the old
2558 filter because we want its size to change if the limit changes. Note that
2559 we keep the dbd pointer for copying the rate into the new data block. */
2561 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2563 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2569 if(unique && dbdb_size < sizeof(*dbdb))
2571 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2576 /* Allocate a new data block if the database lookup failed
2577 or the Bloom filter passed its age limit. */
2583 /* No Bloom filter. This basic ratelimit block is initialized below. */
2584 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2585 dbdb_size = sizeof(*dbd);
2586 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2591 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2593 /* See the long comment below for an explanation of the magic number 2.
2594 The filter has a minimum size in case the rate limit is very small;
2595 this is determined by the definition of dbdata_ratelimit_unique. */
2597 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2598 if (extra < 0) extra = 0;
2599 dbdb_size = sizeof(*dbdb) + extra;
2600 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2601 dbdb->bloom_epoch = tv.tv_sec;
2602 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2603 memset(dbdb->bloom, 0, dbdb->bloom_size);
2605 /* Preserve any basic ratelimit data (which is our longer-term memory)
2606 by copying it from the discarded block. */
2616 /* If we are counting unique events, find out if this event is new or not.
2617 If the client repeats the event during the current period then it should be
2618 counted. We skip this code in readonly mode for efficiency, because any
2619 changes to the filter will be discarded and because count is already set to
2622 if (unique && !readonly)
2624 /* We identify unique events using a Bloom filter. (You can find my
2625 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2626 With the per_addr option, an "event" is a recipient address, though the
2627 user can use the unique option to define their own events. We only count
2628 an event if we have not seen it before.
2630 We size the filter according to the rate limit, which (in leaky mode)
2631 is the limit on the population of the filter. We allow 16 bits of space
2632 per entry (see the construction code above) and we set (up to) 8 of them
2633 when inserting an element (see the loop below). The probability of a false
2634 positive (an event we have not seen before but which we fail to count) is
2638 allzero = exp(-numhash * pop / size)
2639 = exp(-0.5 * pop / limit)
2640 fpr = pow(1 - allzero, numhash)
2642 For senders at the limit the fpr is 0.06% or 1 in 1700
2643 and for senders at half the limit it is 0.0006% or 1 in 170000
2645 In strict mode the Bloom filter can fill up beyond the normal limit, in
2646 which case the false positive rate will rise. This means that the
2647 measured rate for very fast senders can bogusly drop off after a while.
2649 At twice the limit, the fpr is 2.5% or 1 in 40
2650 At four times the limit, it is 31% or 1 in 3.2
2652 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2653 decay below the limit, and if this is more than one then the Bloom filter
2654 will be discarded before the decay gets that far. The false positive rate
2655 at this threshold is 9.3% or 1 in 10.7. */
2658 unsigned n, hash, hinc;
2662 /* Instead of using eight independent hash values, we combine two values
2663 using the formula h1 + n * h2. This does not harm the Bloom filter's
2664 performance, and means the amount of hash we need is independent of the
2665 number of bits we set in the filter. */
2667 md5_start(&md5info);
2668 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2669 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2670 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2672 /* Scan the bits corresponding to this event. A zero bit means we have
2673 not seen it before. Ensure all bits are set to record this event. */
2675 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2678 for (n = 0; n < 8; n++, hash += hinc)
2680 int bit = 1 << (hash % 8);
2681 int byte = (hash / 8) % dbdb->bloom_size;
2682 if ((dbdb->bloom[byte] & bit) == 0)
2684 dbdb->bloom[byte] |= bit;
2689 /* If this event has occurred before, do not count it. */
2693 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2697 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2700 /* If there was no previous ratelimit data block for this key, initialize
2701 the new one, otherwise update the block from the database. The initial rate
2702 is what would be computed by the code below for an infinite interval. */
2706 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2708 dbd->time_stamp = tv.tv_sec;
2709 dbd->time_usec = tv.tv_usec;
2714 /* The smoothed rate is computed using an exponentially weighted moving
2715 average adjusted for variable sampling intervals. The standard EWMA for
2716 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2717 where f() is the measured value and f'() is the smoothed value.
2719 Old data decays out of the smoothed value exponentially, such that data n
2720 samples old is multiplied by a^n. The exponential decay time constant p
2721 is defined such that data p samples old is multiplied by 1/e, which means
2722 that a = exp(-1/p). We can maintain the same time constant for a variable
2723 sampling interval i by using a = exp(-i/p).
2725 The rate we are measuring is messages per period, suitable for directly
2726 comparing with the limit. The average rate between now and the previous
2727 message is period / interval, which we feed into the EWMA as the sample.
2729 It turns out that the number of messages required for the smoothed rate
2730 to reach the limit when they are sent in a burst is equal to the limit.
2731 This can be seen by analysing the value of the smoothed rate after N
2732 messages sent at even intervals. Let k = (1 - a) * p/i
2734 rate_1 = (1 - a) * p/i + a * rate_0
2736 rate_2 = k + a * rate_1
2737 = k + a * k + a^2 * rate_0
2738 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2739 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2740 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2741 = rate_0 * a^N + p/i * (1 - a^N)
2743 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2745 rate_N = p/i + (rate_0 - p/i) * a^N
2746 a^N = (rate_N - p/i) / (rate_0 - p/i)
2747 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2748 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2750 Numerical analysis of the above equation, setting the computed rate to
2751 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2752 rates, p/i, the number of messages N = limit. So limit serves as both the
2753 maximum rate measured in messages per period, and the maximum number of
2754 messages that can be sent in a fast burst. */
2756 double this_time = (double)tv.tv_sec
2757 + (double)tv.tv_usec / 1000000.0;
2758 double prev_time = (double)dbd->time_stamp
2759 + (double)dbd->time_usec / 1000000.0;
2761 /* We must avoid division by zero, and deal gracefully with the clock going
2762 backwards. If we blunder ahead when time is in reverse then the computed
2763 rate will be bogus. To be safe we clamp interval to a very small number. */
2765 double interval = this_time - prev_time <= 0.0 ? 1e-9
2766 : this_time - prev_time;
2768 double i_over_p = interval / period;
2769 double a = exp(-i_over_p);
2771 /* Combine the instantaneous rate (period / interval) with the previous rate
2772 using the smoothing factor a. In order to measure sized events, multiply the
2773 instantaneous rate by the count of bytes or recipients etc. */
2775 dbd->time_stamp = tv.tv_sec;
2776 dbd->time_usec = tv.tv_usec;
2777 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2779 /* When events are very widely spaced the computed rate tends towards zero.
2780 Although this is accurate it turns out not to be useful for our purposes,
2781 especially when the first event after a long silence is the start of a spam
2782 run. A more useful model is that the rate for an isolated event should be the
2783 size of the event per the period size, ignoring the lack of events outside
2784 the current period and regardless of where the event falls in the period. So,
2785 if the interval was so long that the calculated rate is unhelpfully small, we
2786 re-initialize the rate. In the absence of higher-rate bursts, the condition
2787 below is true if the interval is greater than the period. */
2789 if (dbd->rate < count) dbd->rate = count;
2792 /* Clients sending at the limit are considered to be over the limit.
2793 This matters for edge cases such as a limit of zero, when the client
2794 should be completely blocked. */
2796 rc = dbd->rate < limit ? FAIL : OK;
2798 /* Update the state if the rate is low or if we are being strict. If we
2799 are in leaky mode and the sender's rate is too high, we do not update
2800 the recorded rate in order to avoid an over-aggressive sender's retry
2801 rate preventing them from getting any email through. If readonly is set,
2802 neither leaky nor strict are set, so we do not do any updates. */
2804 if ((rc == FAIL && leaky) || strict)
2806 dbfn_write(dbm, key, dbdb, dbdb_size);
2807 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2811 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2812 readonly? "readonly mode" : "over the limit, but leaky");
2817 /* Store the result in the tree for future reference. Take the taint status
2818 from the key for consistency even though it's unlikely we'll ever expand this. */
2820 t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
2822 Ustrcpy(t->name, key);
2823 (void)tree_insertnode(anchor, t);
2825 /* We create the formatted version of the sender's rate very late in
2826 order to ensure that it is done using the correct storage pool. */
2828 store_pool = old_pool;
2829 sender_rate = string_sprintf("%.1f", dbd->rate);
2832 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2839 /*************************************************
2840 * The udpsend ACL modifier *
2841 *************************************************/
2843 /* Called by acl_check_condition() below.
2846 arg the option string for udpsend=
2847 log_msgptr for error messages
2849 Returns: OK - Completed.
2850 DEFER - Problem with DNS lookup.
2851 ERROR - Syntax error in options.
2855 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2867 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2868 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2872 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2877 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2882 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2885 portnum = Ustrtol(portstr, &portend, 10);
2886 if (*portend != '\0')
2888 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2892 /* Make a single-item host list. */
2893 h = store_get(sizeof(host_item), FALSE);
2894 memset(h, 0, sizeof(host_item));
2899 if (string_is_ip_address(hostname, NULL))
2900 h->address = hostname, r = HOST_FOUND;
2902 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2903 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2905 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2910 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2912 /*XXX this could better use sendto */
2913 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2914 1, NULL, &errstr, NULL);
2915 if (r < 0) goto defer;
2917 r = send(s, arg, len, 0);
2920 errstr = US strerror(errno);
2928 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2933 debug_printf_indent("udpsend %d bytes\n", r);
2938 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2944 /*************************************************
2945 * Handle conditions/modifiers on an ACL item *
2946 *************************************************/
2948 /* Called from acl_check() below.
2952 cb ACL condition block - if NULL, result is OK
2953 where where called from
2954 addr the address being checked for RCPT, or NULL
2955 level the nesting level
2956 epp pointer to pass back TRUE if "endpass" encountered
2957 (applies only to "accept" and "discard")
2958 user_msgptr user message pointer
2959 log_msgptr log message pointer
2960 basic_errno pointer to where to put verify error
2962 Returns: OK - all conditions are met
2963 DISCARD - an "acl" condition returned DISCARD - only allowed
2964 for "accept" or "discard" verbs
2965 FAIL - at least one condition fails
2966 FAIL_DROP - an "acl" condition returned FAIL_DROP
2967 DEFER - can't tell at the moment (typically, lookup defer,
2968 but can be temporary callout problem)
2969 ERROR - ERROR from nested ACL or expansion failure or other
2974 acl_check_condition(int verb, acl_condition_block *cb, int where,
2975 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2976 uschar **log_msgptr, int *basic_errno)
2978 uschar *user_message = NULL;
2979 uschar *log_message = NULL;
2981 #ifdef WITH_CONTENT_SCAN
2985 for (; cb; cb = cb->next)
2990 /* The message and log_message items set up messages to be used in
2991 case of rejection. They are expanded later. */
2993 if (cb->type == ACLC_MESSAGE)
2995 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2996 user_message = cb->arg;
3000 if (cb->type == ACLC_LOG_MESSAGE)
3002 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
3003 log_message = cb->arg;
3007 /* The endpass "condition" just sets a flag to show it occurred. This is
3008 checked at compile time to be on an "accept" or "discard" item. */
3010 if (cb->type == ACLC_ENDPASS)
3016 /* For other conditions and modifiers, the argument is expanded now for some
3017 of them, but not for all, because expansion happens down in some lower level
3018 checking functions in some cases. */
3020 if (!conditions[cb->type].expand_at_top)
3022 else if (!(arg = expand_string(cb->arg)))
3024 if (f.expand_string_forcedfail) continue;
3025 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3026 cb->arg, expand_string_message);
3027 return f.search_find_defer ? DEFER : ERROR;
3030 /* Show condition, and expanded condition if it's different */
3035 debug_printf_indent("check %s%s %n",
3036 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
3037 conditions[cb->type].name, &lhswidth);
3039 if (cb->type == ACLC_SET)
3041 #ifndef DISABLE_DKIM
3042 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
3043 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3045 debug_printf("%s ", cb->u.varname);
3051 debug_printf("acl_%s ", cb->u.varname);
3052 lhswidth += 5 + Ustrlen(cb->u.varname);
3056 debug_printf("= %s\n", cb->arg);
3059 debug_printf("%.*s= %s\n", lhswidth,
3063 /* Check that this condition makes sense at this time */
3065 if ((conditions[cb->type].forbids & (1 << where)) != 0)
3067 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3068 conditions[cb->type].is_modifier ? "use" : "test",
3069 conditions[cb->type].name, acl_wherenames[where]);
3073 /* Run the appropriate test for each condition, or take the appropriate
3074 action for the remaining modifiers. */
3078 case ACLC_ADD_HEADER:
3082 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3086 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
3087 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3089 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3090 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3096 case ACLC_AUTHENTICATED:
3097 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
3098 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
3101 #ifdef EXPERIMENTAL_BRIGHTMAIL
3102 case ACLC_BMI_OPTIN:
3104 int old_pool = store_pool;
3105 store_pool = POOL_PERM;
3106 bmi_current_optin = string_copy(arg);
3107 store_pool = old_pool;
3112 case ACLC_CONDITION:
3113 /* The true/false parsing here should be kept in sync with that used in
3114 expand.c when dealing with ECOND_BOOL so that we don't have too many
3115 different definitions of what can be a boolean. */
3117 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3118 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3119 rc = (Uatoi(arg) == 0)? FAIL : OK;
3121 rc = (strcmpic(arg, US"no") == 0 ||
3122 strcmpic(arg, US"false") == 0)? FAIL :
3123 (strcmpic(arg, US"yes") == 0 ||
3124 strcmpic(arg, US"true") == 0)? OK : DEFER;
3126 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3129 case ACLC_CONTINUE: /* Always succeeds */
3134 const uschar *p = NULL;
3135 control_type = decode_control(arg, &p, where, log_msgptr);
3137 /* Check if this control makes sense at this time */
3139 if (controls_list[control_type].forbids & (1 << where))
3141 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3142 controls_list[control_type].name, acl_wherenames[where]);
3146 switch(control_type)
3148 case CONTROL_AUTH_UNADVERTISED:
3149 f.allow_auth_unadvertised = TRUE;
3152 #ifdef EXPERIMENTAL_BRIGHTMAIL
3153 case CONTROL_BMI_RUN:
3158 #ifndef DISABLE_DKIM
3159 case CONTROL_DKIM_VERIFY:
3160 f.dkim_disable_verify = TRUE;
3161 # ifdef SUPPORT_DMARC
3162 /* Since DKIM was blocked, skip DMARC too */
3163 f.dmarc_disable_verify = TRUE;
3164 f.dmarc_enable_forensic = FALSE;
3169 #ifdef SUPPORT_DMARC
3170 case CONTROL_DMARC_VERIFY:
3171 f.dmarc_disable_verify = TRUE;
3174 case CONTROL_DMARC_FORENSIC:
3175 f.dmarc_enable_forensic = TRUE;
3182 int fd, af, level, optname, value;
3183 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3184 a socket; we can accept that, we'll just debug-log failures anyway. */
3185 fd = fileno(smtp_in);
3186 if ((af = ip_get_address_family(fd)) < 0)
3189 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3193 if (dscp_lookup(p+1, af, &level, &optname, &value))
3194 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3196 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3197 p+1, strerror(errno));
3201 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3205 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3211 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3219 case CONTROL_CASEFUL_LOCAL_PART:
3220 deliver_localpart = addr->cc_local_part;
3223 case CONTROL_CASELOWER_LOCAL_PART:
3224 deliver_localpart = addr->lc_local_part;
3227 case CONTROL_ENFORCE_SYNC:
3228 smtp_enforce_sync = TRUE;
3231 case CONTROL_NO_ENFORCE_SYNC:
3232 smtp_enforce_sync = FALSE;
3235 #ifdef WITH_CONTENT_SCAN
3236 case CONTROL_NO_MBOX_UNSPOOL:
3237 f.no_mbox_unspool = TRUE;
3241 case CONTROL_NO_MULTILINE:
3242 f.no_multiline_responses = TRUE;
3245 case CONTROL_NO_PIPELINING:
3246 f.pipelining_enable = FALSE;
3249 case CONTROL_NO_DELAY_FLUSH:
3250 f.disable_delay_flush = TRUE;
3253 case CONTROL_NO_CALLOUT_FLUSH:
3254 f.disable_callout_flush = TRUE;
3257 case CONTROL_FAKEREJECT:
3258 cancel_cutthrough_connection(TRUE, US"fakereject");
3259 case CONTROL_FAKEDEFER:
3260 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3263 const uschar *pp = p + 1;
3265 /* The entire control= line was expanded at top so no need to expand
3266 the part after the / */
3267 fake_response_text = string_copyn(p+1, pp-p-1);
3270 else /* Explicitly reset to default string */
3271 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3274 case CONTROL_FREEZE:
3275 f.deliver_freeze = TRUE;
3276 deliver_frozen_at = time(NULL);
3277 freeze_tell = freeze_tell_config; /* Reset to configured value */
3278 if (Ustrncmp(p, "/no_tell", 8) == 0)
3285 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3288 cancel_cutthrough_connection(TRUE, US"item frozen");
3292 f.queue_only_policy = TRUE;
3293 if (Ustrcmp(p, "_only") == 0)
3295 else while (*p == '/')
3296 if (Ustrncmp(p, "/only", 5) == 0)
3297 { p += 5; f.queue_smtp = FALSE; }
3298 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3299 { p += 17; f.queue_smtp = TRUE; }
3302 cancel_cutthrough_connection(TRUE, US"queueing forced");
3305 case CONTROL_SUBMISSION:
3306 originator_name = US"";
3307 f.submission_mode = TRUE;
3310 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3313 f.active_local_sender_retain = TRUE;
3314 f.active_local_from_check = FALSE;
3316 else if (Ustrncmp(p, "/domain=", 8) == 0)
3318 const uschar *pp = p + 8;
3319 while (*pp && *pp != '/') pp++;
3320 submission_domain = string_copyn(p+8, pp-p-8);
3323 /* The name= option must be last, because it swallows the rest of
3325 else if (Ustrncmp(p, "/name=", 6) == 0)
3327 const uschar *pp = p + 6;
3329 submission_name = parse_fix_phrase(p+6, pp-p-6);
3336 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3343 uschar * debug_tag = NULL;
3344 uschar * debug_opts = NULL;
3349 const uschar * pp = p+1;
3350 if (Ustrncmp(pp, "tag=", 4) == 0)
3352 for (pp += 4; *pp && *pp != '/';) pp++;
3353 debug_tag = string_copyn(p+5, pp-p-5);
3355 else if (Ustrncmp(pp, "opts=", 5) == 0)
3357 for (pp += 5; *pp && *pp != '/';) pp++;
3358 debug_opts = string_copyn(p+6, pp-p-6);
3360 else if (Ustrncmp(pp, "kill", 4) == 0)
3362 for (pp += 4; *pp && *pp != '/';) pp++;
3366 while (*pp && *pp != '/') pp++;
3371 debug_logging_stop();
3373 debug_logging_activate(debug_tag, debug_opts);
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 f.suppress_local_fixups = TRUE;
3381 case CONTROL_CUTTHROUGH_DELIVERY:
3383 uschar * ignored = NULL;
3384 #ifndef DISABLE_PRDR
3389 /* Too hard to think about for now. We might in future cutthrough
3390 the case where both sides handle prdr and this-node prdr acl
3392 ignored = US"PRDR active";
3393 else if (f.deliver_freeze)
3394 ignored = US"frozen";
3395 else if (f.queue_only_policy)
3396 ignored = US"queue-only";
3397 else if (fake_response == FAIL)
3398 ignored = US"fakereject";
3399 else if (rcpt_count != 1)
3400 ignored = US"nonfirst rcpt";
3401 else if (cutthrough.delivery)
3402 ignored = US"repeated";
3403 else if (cutthrough.callout_hold_only)
3406 debug_printf_indent(" cutthrough request upgrades callout hold\n");
3407 cutthrough.callout_hold_only = FALSE;
3408 cutthrough.delivery = TRUE; /* control accepted */
3412 cutthrough.delivery = TRUE; /* control accepted */
3415 const uschar * pp = p+1;
3416 if (Ustrncmp(pp, "defer=", 6) == 0)
3419 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3420 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3423 while (*pp && *pp != '/') pp++;
3428 DEBUG(D_acl) if (ignored)
3429 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3434 case CONTROL_UTF8_DOWNCONVERT:
3439 message_utf8_downconvert = 1;
3440 addr->prop.utf8_downcvt = TRUE;
3441 addr->prop.utf8_downcvt_maybe = FALSE;
3447 message_utf8_downconvert = 0;
3448 addr->prop.utf8_downcvt = FALSE;
3449 addr->prop.utf8_downcvt_maybe = FALSE;
3453 if (p[1] == '-' && p[2] == '1')
3455 message_utf8_downconvert = -1;
3456 addr->prop.utf8_downcvt = FALSE;
3457 addr->prop.utf8_downcvt_maybe = TRUE;
3461 *log_msgptr = US"bad option value for control=utf8_downconvert";
3465 message_utf8_downconvert = 1;
3466 addr->prop.utf8_downcvt = TRUE;
3467 addr->prop.utf8_downcvt_maybe = FALSE;
3477 #ifdef EXPERIMENTAL_DCC
3480 /* Separate the regular expression and any optional parameters. */
3481 const uschar * list = arg;
3482 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3483 /* Run the dcc backend. */
3484 rc = dcc_process(&ss);
3485 /* Modify return code based upon the existence of options. */
3486 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3487 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3488 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3493 #ifdef WITH_CONTENT_SCAN
3495 rc = mime_decode(&arg);
3501 int delay = readconf_readtime(arg, 0, FALSE);
3504 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3505 "modifier: \"%s\" is not a time value", arg);
3510 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3515 debug_printf_indent("delay skipped in -bh checking mode\n");
3518 /* NOTE 1: Remember that we may be
3519 dealing with stdin/stdout here, in addition to TCP/IP connections.
3520 Also, delays may be specified for non-SMTP input, where smtp_out and
3521 smtp_in will be NULL. Whatever is done must work in all cases.
3523 NOTE 2: The added feature of flushing the output before a delay must
3524 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3529 if (smtp_out && !f.disable_delay_flush)
3532 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3538 p.fd = fileno(smtp_out);
3539 p.events = POLLRDHUP;
3542 if (poll(&p, n, delay*1000) > 0)
3543 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3546 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3547 TCP/IP connection has gone away without reading from it. This means
3548 that we cannot shorten the delay below if the client goes away,
3549 because we cannot discover that the client has closed its end of the
3550 connection. (The connection is actually in a half-closed state,
3551 waiting for the server to close its end.) It would be nice to be able
3552 to detect this state, so that the Exim process is not held up
3553 unnecessarily. However, it seems that we can't. The poll() function
3554 does not do the right thing, and in any case it is not always
3557 while (delay > 0) delay = sleep(delay);
3564 #ifndef DISABLE_DKIM
3565 case ACLC_DKIM_SIGNER:
3566 if (dkim_cur_signer)
3567 rc = match_isinlist(dkim_cur_signer,
3568 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3573 case ACLC_DKIM_STATUS:
3574 rc = match_isinlist(dkim_verify_status,
3575 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3579 #ifdef SUPPORT_DMARC
3580 case ACLC_DMARC_STATUS:
3581 if (!f.dmarc_has_been_checked)
3583 f.dmarc_has_been_checked = TRUE;
3584 /* used long way of dmarc_exim_expand_query() in case we need more
3585 * view into the process in the future. */
3586 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3587 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3592 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3596 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3597 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3600 /* The value in tls_cipher is the full cipher name, for example,
3601 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3602 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3603 what may in practice come out of the SSL library - which at the time of
3604 writing is poorly documented. */
3606 case ACLC_ENCRYPTED:
3607 if (tls_in.cipher == NULL) rc = FAIL; else
3609 uschar *endcipher = NULL;
3610 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3611 if (!cipher) cipher = tls_in.cipher; else
3613 endcipher = Ustrchr(++cipher, ':');
3614 if (endcipher) *endcipher = 0;
3616 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3617 if (endcipher) *endcipher = ':';
3621 /* Use verify_check_this_host() instead of verify_check_host() so that
3622 we can pass over &host_data to catch any looked up data. Once it has been
3623 set, it retains its value so that it's still there if another ACL verb
3624 comes through here and uses the cache. However, we must put it into
3625 permanent store in case it is also expected to be used in a subsequent
3626 message in the same SMTP connection. */
3629 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3630 sender_host_address ? sender_host_address : US"", CUSS &host_data);
3631 if (rc == DEFER) *log_msgptr = search_error_message;
3632 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3635 case ACLC_LOCAL_PARTS:
3636 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3637 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3638 CUSS &deliver_localpart_data);
3641 case ACLC_LOG_REJECT_TARGET:
3645 const uschar *s = arg;
3647 while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
3649 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3650 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3651 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3654 logbits |= LOG_MAIN|LOG_REJECT;
3655 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3656 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3659 log_reject_target = logbits;
3666 const uschar *s = arg;
3672 if (Ustrncmp(s, "main", 4) == 0)
3673 { logbits |= LOG_MAIN; s += 4; }
3674 else if (Ustrncmp(s, "panic", 5) == 0)
3675 { logbits |= LOG_PANIC; s += 5; }
3676 else if (Ustrncmp(s, "reject", 6) == 0)
3677 { logbits |= LOG_REJECT; s += 6; }
3680 logbits = LOG_MAIN|LOG_PANIC;
3681 s = string_sprintf(":unknown log name in \"%s\" in "
3682 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3688 while (isspace(*s)) s++;
3690 if (logbits == 0) logbits = LOG_MAIN;
3691 log_write(0, logbits, "%s", string_printing(s));
3695 #ifdef WITH_CONTENT_SCAN
3696 case ACLC_MALWARE: /* Run the malware backend. */
3698 /* Separate the regular expression and any optional parameters. */
3699 const uschar * list = arg;
3700 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3702 BOOL defer_ok = FALSE;
3705 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3706 if (strcmpic(opt, US"defer_ok") == 0)
3708 else if ( strncmpic(opt, US"tmo=", 4) == 0
3709 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3712 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3716 rc = malware(ss, timeout);
3717 if (rc == DEFER && defer_ok)
3718 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3722 case ACLC_MIME_REGEX:
3723 rc = mime_regex(&arg);
3730 if ((m = is_tainted2(arg, 0, "Tainted name '%s' for queue not permitted", arg)))
3735 if (Ustrchr(arg, '/'))
3737 *log_msgptr = string_sprintf(
3738 "Directory separator not permitted in queue name: '%s'", arg);
3741 queue_name = string_copy_perm(arg, FALSE);
3745 case ACLC_RATELIMIT:
3746 rc = acl_ratelimit(arg, where, log_msgptr);
3749 case ACLC_RECIPIENTS:
3750 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3751 CUSS &recipient_data);
3754 #ifdef WITH_CONTENT_SCAN
3760 case ACLC_REMOVE_HEADER:
3761 setup_remove_header(arg);
3764 case ACLC_SENDER_DOMAINS:
3767 sdomain = Ustrrchr(sender_address, '@');
3768 sdomain = sdomain ? sdomain + 1 : US"";
3769 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3770 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3775 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3776 sender_address_cache, -1, 0, CUSS &sender_data);
3779 /* Connection variables must persist forever; message variables not */
3783 int old_pool = store_pool;
3784 if ( cb->u.varname[0] != 'm'
3785 #ifndef DISABLE_EVENT
3786 || event_name /* An event is being delivered */
3789 store_pool = POOL_PERM;
3790 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3791 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3792 dkim_verify_status = string_copy(arg);
3793 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3794 dkim_verify_reason = string_copy(arg);
3797 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3798 store_pool = old_pool;
3802 #ifdef WITH_CONTENT_SCAN
3805 /* Separate the regular expression and any optional parameters. */
3806 const uschar * list = arg;
3807 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3809 rc = spam(CUSS &ss);
3810 /* Modify return code based upon the existence of options. */
3811 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3812 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3813 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3820 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3822 case ACLC_SPF_GUESS:
3823 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3828 rc = acl_udpsend(arg, log_msgptr);
3831 /* If the verb is WARN, discard any user message from verification, because
3832 such messages are SMTP responses, not header additions. The latter come
3833 only from explicit "message" modifiers. However, put the user message into
3834 $acl_verify_message so it can be used in subsequent conditions or modifiers
3835 (until something changes it). */
3838 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3840 acl_verify_message = *user_msgptr;
3841 if (verb == ACL_WARN) *user_msgptr = NULL;
3845 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3846 "condition %d", cb->type);
3850 /* If a condition was negated, invert OK/FAIL. */
3852 if (!conditions[cb->type].is_modifier && cb->u.negated)
3853 if (rc == OK) rc = FAIL;
3854 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3856 if (rc != OK) break; /* Conditions loop */
3860 /* If the result is the one for which "message" and/or "log_message" are used,
3861 handle the values of these modifiers. If there isn't a log message set, we make
3862 it the same as the user message.
3864 "message" is a user message that will be included in an SMTP response. Unless
3865 it is empty, it overrides any previously set user message.
3867 "log_message" is a non-user message, and it adds to any existing non-user
3868 message that is already set.
3870 Most verbs have but a single return for which the messages are relevant, but
3871 for "discard", it's useful to have the log message both when it succeeds and
3872 when it fails. For "accept", the message is used in the OK case if there is no
3873 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3876 if (*epp && rc == OK) user_message = NULL;
3878 if ((BIT(rc) & msgcond[verb]) != 0)
3881 uschar *old_user_msgptr = *user_msgptr;
3882 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3884 /* If the verb is "warn", messages generated by conditions (verification or
3885 nested ACLs) are always discarded. This also happens for acceptance verbs
3886 when they actually do accept. Only messages specified at this level are used.
3887 However, the value of an existing message is available in $acl_verify_message
3888 during expansions. */
3890 if (verb == ACL_WARN ||
3891 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3892 *log_msgptr = *user_msgptr = NULL;
3896 acl_verify_message = old_user_msgptr;
3897 expmessage = expand_string(user_message);
3900 if (!f.expand_string_forcedfail)
3901 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3902 user_message, expand_string_message);
3904 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3909 acl_verify_message = old_log_msgptr;
3910 expmessage = expand_string(log_message);
3913 if (!f.expand_string_forcedfail)
3914 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3915 log_message, expand_string_message);
3917 else if (expmessage[0] != 0)
3919 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3920 string_sprintf("%s: %s", expmessage, *log_msgptr);
3924 /* If no log message, default it to the user message */
3926 if (!*log_msgptr) *log_msgptr = *user_msgptr;
3929 acl_verify_message = NULL;
3937 /*************************************************
3938 * Get line from a literal ACL *
3939 *************************************************/
3941 /* This function is passed to acl_read() in order to extract individual lines
3942 of a literal ACL, which we access via static pointers. We can destroy the
3943 contents because this is called only once (the compiled ACL is remembered).
3945 This code is intended to treat the data in the same way as lines in the main
3946 Exim configuration file. That is:
3948 . Leading spaces are ignored.
3950 . A \ at the end of a line is a continuation - trailing spaces after the \
3951 are permitted (this is because I don't believe in making invisible things
3952 significant). Leading spaces on the continued part of a line are ignored.
3954 . Physical lines starting (significantly) with # are totally ignored, and
3955 may appear within a sequence of backslash-continued lines.
3957 . Blank lines are ignored, but will end a sequence of continuations.
3960 Returns: a pointer to the next line
3964 static uschar *acl_text; /* Current pointer in the text */
3965 static uschar *acl_text_end; /* Points one past the terminating '0' */
3973 /* This loop handles leading blank lines and comments. */
3977 Uskip_whitespace(&acl_text); /* Leading spaces/empty lines */
3978 if (!*acl_text) return NULL; /* No more data */
3979 yield = acl_text; /* Potential data line */
3981 while (*acl_text && *acl_text != '\n') acl_text++;
3983 /* If we hit the end before a newline, we have the whole logical line. If
3984 it's a comment, there's no more data to be given. Otherwise, yield it. */
3986 if (!*acl_text) return *yield == '#' ? NULL : yield;
3988 /* After reaching a newline, end this loop if the physical line does not
3989 start with '#'. If it does, it's a comment, and the loop continues. */
3991 if (*yield != '#') break;
3994 /* This loop handles continuations. We know we have some real data, ending in
3995 newline. See if there is a continuation marker at the end (ignoring trailing
3996 white space). We know that *yield is not white space, so no need to test for
3997 cont > yield in the backwards scanning loop. */
4002 for (cont = acl_text - 1; isspace(*cont); cont--);
4004 /* If no continuation follows, we are done. Mark the end of the line and
4013 /* We have encountered a continuation. Skip over whitespace at the start of
4014 the next line, and indeed the whole of the next line or lines if they are
4019 while (*(++acl_text) == ' ' || *acl_text == '\t');
4020 if (*acl_text != '#') break;
4021 while (*(++acl_text) != 0 && *acl_text != '\n');
4024 /* We have the start of a continuation line. Move all the rest of the data
4025 to join onto the previous line, and then find its end. If the end is not a
4026 newline, we are done. Otherwise loop to look for another continuation. */
4028 memmove(cont, acl_text, acl_text_end - acl_text);
4029 acl_text_end -= acl_text - cont;
4031 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
4032 if (*acl_text == 0) return yield;
4035 /* Control does not reach here */
4042 /*************************************************
4043 * Check access using an ACL *
4044 *************************************************/
4046 /* This function is called from address_check. It may recurse via
4047 acl_check_condition() - hence the use of a level to stop looping. The ACL is
4048 passed as a string which is expanded. A forced failure implies no access check
4049 is required. If the result is a single word, it is taken as the name of an ACL
4050 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4051 text, complete with newlines, and parsed as such. In both cases, the ACL check
4052 is then run. This function uses an auxiliary function for acl_read() to call
4053 for reading individual lines of a literal ACL. This is acl_getline(), which
4054 appears immediately above.
4057 where where called from
4058 addr address item when called from RCPT; otherwise NULL
4059 s the input string; NULL is the same as an empty ACL => DENY
4060 user_msgptr where to put a user error (for SMTP response)
4061 log_msgptr where to put a logging message (not for SMTP response)
4063 Returns: OK access is granted
4064 DISCARD access is apparently granted...
4065 FAIL access is denied
4066 FAIL_DROP access is denied; drop the connection
4067 DEFER can't tell at the moment
4072 acl_check_internal(int where, address_item *addr, uschar *s,
4073 uschar **user_msgptr, uschar **log_msgptr)
4076 acl_block *acl = NULL;
4077 uschar *acl_name = US"inline ACL";
4080 /* Catch configuration loops */
4084 *log_msgptr = US"ACL nested too deep: possible loop";
4090 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
4094 /* At top level, we expand the incoming string. At lower levels, it has already
4095 been expanded as part of condition processing. */
4099 if (!(ss = expand_string(s)))
4101 if (f.expand_string_forcedfail) return OK;
4102 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4103 expand_string_message);
4109 while (isspace(*ss)) ss++;
4111 /* If we can't find a named ACL, the default is to parse it as an inline one.
4112 (Unless it begins with a slash; non-existent files give rise to an error.) */
4116 if ( !f.running_in_test_harness
4117 && is_tainted2(acl_text, LOG_MAIN|LOG_PANIC,
4118 "Tainted ACL text \"%s\"", acl_text))
4120 /* Avoid leaking info to an attacker */
4121 *log_msgptr = US"internal configuration error";
4125 /* Handle the case of a string that does not contain any spaces. Look for a
4126 named ACL among those read from the configuration, or a previously read file.
4127 It is possible that the pointer to the ACL is NULL if the configuration
4128 contains a name with no data. If not found, and the text begins with '/',
4129 read an ACL from a file, and save it so it can be re-used. */
4131 if (Ustrchr(ss, ' ') == NULL)
4133 tree_node * t = tree_search(acl_anchor, ss);
4136 if (!(acl = (acl_block *)(t->data.ptr)))
4138 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
4141 acl_name = string_sprintf("ACL \"%s\"", ss);
4142 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
4145 else if (*ss == '/')
4147 struct stat statbuf;
4148 if (is_tainted2(ss, LOG_MAIN|LOG_PANIC, "Tainted ACL file name '%s'", ss))
4150 /* Avoid leaking info to an attacker */
4151 *log_msgptr = US"internal configuration error";
4154 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4156 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4160 if (fstat(fd, &statbuf) != 0)
4162 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4167 /* If the string being used as a filename is tainted, so is the file content */
4168 acl_text = store_get(statbuf.st_size + 1, is_tainted(ss));
4169 acl_text_end = acl_text + statbuf.st_size + 1;
4171 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4173 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4174 ss, strerror(errno));
4177 acl_text[statbuf.st_size] = 0;
4180 acl_name = string_sprintf("ACL \"%s\"", ss);
4181 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4185 /* Parse an ACL that is still in text form. If it came from a file, remember it
4186 in the ACL tree, having read it into the POOL_PERM store pool so that it
4187 persists between multiple messages. */
4191 int old_pool = store_pool;
4192 if (fd >= 0) store_pool = POOL_PERM;
4193 acl = acl_read(acl_getline, log_msgptr);
4194 store_pool = old_pool;
4195 if (!acl && *log_msgptr) return ERROR;
4198 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), is_tainted(ss));
4199 Ustrcpy(t->name, ss);
4201 (void)tree_insertnode(&acl_anchor, t);
4205 /* Now we have an ACL to use. It's possible it may be NULL. */
4210 int basic_errno = 0;
4211 BOOL endpass_seen = FALSE;
4212 BOOL acl_quit_check = acl_level == 0
4213 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4215 *log_msgptr = *user_msgptr = NULL;
4216 f.acl_temp_details = FALSE;
4218 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4219 verbs[acl->verb], acl->srcfile, acl->srcline);
4221 /* Clear out any search error message from a previous check before testing
4224 search_error_message = NULL;
4225 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4226 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4228 /* Handle special returns: DEFER causes a return except on a WARN verb;
4229 ERROR always causes a return. */
4234 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4235 verbs[acl->verb], acl_name);
4236 if (basic_errno != ERRNO_CALLOUTDEFER)
4238 if (search_error_message != NULL && *search_error_message != 0)
4239 *log_msgptr = search_error_message;
4240 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4243 f.acl_temp_details = TRUE;
4244 if (acl->verb != ACL_WARN) return DEFER;
4247 default: /* Paranoia */
4249 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4250 verbs[acl->verb], acl_name);
4254 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4255 verbs[acl->verb], acl_name);
4259 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4260 verbs[acl->verb], acl_name);
4263 /* DISCARD and DROP can happen only from a nested ACL condition, and
4264 DISCARD can happen only for an "accept" or "discard" verb. */
4267 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4268 verbs[acl->verb], acl_name);
4272 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4273 verbs[acl->verb], acl_name);
4277 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4278 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4279 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4284 if (cond == OK || cond == DISCARD)
4286 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4291 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4299 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4300 if (acl_quit_check) goto badquit;
4301 f.acl_temp_details = TRUE;
4309 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4310 if (acl_quit_check) goto badquit;
4316 if (cond == OK || cond == DISCARD)
4318 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4319 if (acl_quit_check) goto badquit;
4325 debug_printf_indent("discard: endpass encountered - denying access\n");
4333 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4334 if (acl_quit_check) goto badquit;
4342 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4343 if (acl_quit_check) goto badquit;
4350 acl_warn(where, *user_msgptr, *log_msgptr);
4351 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4352 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4353 "condition test deferred%s%s", host_and_ident(TRUE),
4354 (*log_msgptr == NULL)? US"" : US": ",
4355 (*log_msgptr == NULL)? US"" : *log_msgptr);
4356 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4360 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4365 /* Pass to the next ACL item */
4370 /* We have reached the end of the ACL. This is an implicit DENY. */
4372 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4376 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4377 "('%s' verb used incorrectly)", verbs[acl->verb]);
4384 /* Same args as acl_check_internal() above, but the string s is
4385 the name of an ACL followed optionally by up to 9 space-separated arguments.
4386 The name and args are separately expanded. Args go into $acl_arg globals. */
4388 acl_check_wargs(int where, address_item *addr, const uschar *s,
4389 uschar **user_msgptr, uschar **log_msgptr)
4392 uschar * tmp_arg[9]; /* must match acl_arg[] */
4393 uschar * sav_arg[9]; /* must match acl_arg[] */
4399 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4402 for (i = 0; i < 9; i++)
4404 while (*s && isspace(*s)) s++;
4406 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4413 sav_narg = acl_narg;
4415 for (i = 0; i < acl_narg; i++)
4417 sav_arg[i] = acl_arg[i];
4418 acl_arg[i] = tmp_arg[i];
4422 sav_arg[i] = acl_arg[i];
4423 acl_arg[i++] = NULL;
4427 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4430 acl_narg = sav_narg;
4431 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4435 if (f.expand_string_forcedfail) return ERROR;
4436 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4437 tmp, expand_string_message);
4438 return f.search_find_defer ? DEFER : ERROR;
4443 /*************************************************
4444 * Check access using an ACL *
4445 *************************************************/
4447 /* Alternate interface for ACL, used by expansions */
4449 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4452 address_item *addr = NULL;
4455 *user_msgptr = *log_msgptr = NULL;
4456 sender_verified_failed = NULL;
4457 ratelimiters_cmd = NULL;
4458 log_reject_target = LOG_MAIN|LOG_REJECT;
4460 if (where == ACL_WHERE_RCPT)
4462 adb = address_defaults;
4464 addr->address = expand_string(US"$local_part@$domain");
4465 addr->domain = deliver_domain;
4466 addr->local_part = deliver_localpart;
4467 addr->cc_local_part = deliver_localpart;
4468 addr->lc_local_part = deliver_localpart;
4472 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4479 /* This is the external interface for ACL checks. It sets up an address and the
4480 expansions for $domain and $local_part when called after RCPT, then calls
4481 acl_check_internal() to do the actual work.
4484 where ACL_WHERE_xxxx indicating where called from
4485 recipient RCPT address for RCPT check, else NULL
4486 s the input string; NULL is the same as an empty ACL => DENY
4487 user_msgptr where to put a user error (for SMTP response)
4488 log_msgptr where to put a logging message (not for SMTP response)
4490 Returns: OK access is granted by an ACCEPT verb
4491 DISCARD access is granted by a DISCARD verb
4492 FAIL access is denied
4493 FAIL_DROP access is denied; drop the connection
4494 DEFER can't tell at the moment
4497 int acl_where = ACL_WHERE_UNKNOWN;
4500 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4501 uschar **log_msgptr)
4505 address_item *addr = NULL;
4507 *user_msgptr = *log_msgptr = NULL;
4508 sender_verified_failed = NULL;
4509 ratelimiters_cmd = NULL;
4510 log_reject_target = LOG_MAIN|LOG_REJECT;
4512 #ifndef DISABLE_PRDR
4513 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4515 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4518 adb = address_defaults;
4520 addr->address = recipient;
4521 if (deliver_split_address(addr) == DEFER)
4523 *log_msgptr = US"defer in percent_hack_domains check";
4527 if ((addr->prop.utf8_msg = message_smtputf8))
4529 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4530 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4533 deliver_domain = addr->domain;
4534 deliver_localpart = addr->local_part;
4539 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4541 acl_where = ACL_WHERE_UNKNOWN;
4543 /* Cutthrough - if requested,
4544 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4545 and rcpt acl returned accept,
4546 and first recipient (cancel on any subsequents)
4547 open one now and run it up to RCPT acceptance.
4548 A failed verify should cancel cutthrough request,
4549 and will pass the fail to the originator.
4550 Initial implementation: dual-write to spool.
4551 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4553 Cease cutthrough copy on rxd final dot; do not send one.
4555 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4557 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4558 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4559 If temp-reject, close the conn (and keep the spooled copy).
4560 If conn-failure, no action (and keep the spooled copy).
4564 case ACL_WHERE_RCPT:
4565 #ifndef DISABLE_PRDR
4566 case ACL_WHERE_PRDR:
4569 if (f.host_checking_callout) /* -bhc mode */
4570 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4573 && cutthrough.delivery
4574 && rcpt_count > cutthrough.nrcpt
4577 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4578 if (cutthrough.defer_pass)
4580 uschar * s = addr->message;
4581 /* Horrid kludge to recover target's SMTP message */
4583 do --s; while (!isdigit(*s));
4584 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4585 f.acl_temp_details = TRUE;
4589 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4593 else HDEBUG(D_acl) if (cutthrough.delivery)
4594 if (rcpt_count <= cutthrough.nrcpt)
4595 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4597 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4600 case ACL_WHERE_PREDATA:
4602 cutthrough_predata();
4604 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4607 case ACL_WHERE_QUIT:
4608 case ACL_WHERE_NOTQUIT:
4609 /* Drop cutthrough conns, and drop heldopen verify conns if
4610 the previous was not DATA */
4613 smtp_connection_had[SMTP_HBUFF_PREV(SMTP_HBUFF_PREV(smtp_ch_index))];
4614 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4616 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4624 deliver_domain = deliver_localpart = deliver_address_data =
4625 deliver_domain_data = sender_address_data = NULL;
4627 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4628 ACL, which is really in the middle of an SMTP command. */
4632 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4634 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4635 "ACL", acl_wherenames[where]);
4641 /* A DROP response is not permitted from MAILAUTH */
4643 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4645 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4646 "ACL", acl_wherenames[where]);
4650 /* Before giving a response, take a look at the length of any user message, and
4651 split it up into multiple lines if possible. */
4653 *user_msgptr = string_split_message(*user_msgptr);
4654 if (fake_response != OK)
4655 fake_response_text = string_split_message(fake_response_text);
4661 /*************************************************
4662 * Create ACL variable *
4663 *************************************************/
4665 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4666 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4669 name pointer to the variable's name, starting with c or m
4671 Returns the pointer to variable's tree node
4675 acl_var_create(uschar * name)
4677 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4678 if (!(node = tree_search(*root, name)))
4680 node = store_get(sizeof(tree_node) + Ustrlen(name), is_tainted(name));
4681 Ustrcpy(node->name, name);
4682 (void)tree_insertnode(root, node);
4684 node->data.ptr = NULL;
4690 /*************************************************
4691 * Write an ACL variable in spool format *
4692 *************************************************/
4694 /* This function is used as a callback for tree_walk when writing variables to
4695 the spool file. To retain spool file compatibility, what is written is -aclc or
4696 -aclm followed by the rest of the name and the data length, space separated,
4697 then the value itself, starting on a new line, and terminated by an additional
4698 newline. When we had only numbered ACL variables, the first line might look
4699 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4703 name of the variable
4704 value of the variable
4705 ctx FILE pointer (as a void pointer)
4711 acl_var_write(uschar *name, uschar *value, void *ctx)
4713 FILE *f = (FILE *)ctx;
4714 if (is_tainted(value)) putc('-', f);
4715 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4718 #endif /* !MACRO_PREDEF */