1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2022 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
9 /* Code for handling Access Control Lists (ACLs) */
15 /* Default callout timeout */
17 #define CALLOUT_TIMEOUT_DEFAULT 30
19 /* Default quota cache TTLs */
21 #define QUOTA_POS_DEFAULT (5*60)
22 #define QUOTA_NEG_DEFAULT (60*60)
25 /* ACL verb codes - keep in step with the table of verbs that follows */
27 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
32 static uschar *verbs[] = {
33 [ACL_ACCEPT] = US"accept",
34 [ACL_DEFER] = US"defer",
35 [ACL_DENY] = US"deny",
36 [ACL_DISCARD] = US"discard",
37 [ACL_DROP] = US"drop",
38 [ACL_REQUIRE] = US"require",
42 /* For each verb, the conditions for which "message" or "log_message" are used
43 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
44 "accept", the FAIL case is used only after "endpass", but that is selected in
47 static int msgcond[] = {
48 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
49 [ACL_DEFER] = BIT(OK),
51 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
53 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
59 /* ACL condition and modifier codes - keep in step with the table that
66 #ifdef EXPERIMENTAL_BRIGHTMAIL
72 #ifdef EXPERIMENTAL_DCC
75 #ifdef WITH_CONTENT_SCAN
93 ACLC_LOG_REJECT_TARGET,
95 #ifdef WITH_CONTENT_SCAN
99 #ifdef WITH_CONTENT_SCAN
105 #ifdef WITH_CONTENT_SCAN
113 #ifdef WITH_CONTENT_SCAN
123 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
124 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
125 modifiers that look like conditions but always return TRUE. They are used for
126 their side effects. Do not invent new modifier names that result in one name
127 being the prefix of another; the binary-search in the list will go wrong. */
129 typedef struct condition_def {
132 /* Flag to indicate the condition/modifier has a string expansion done
133 at the outer level. In the other cases, expansion already occurs in the
134 checking functions. */
135 BOOL expand_at_top:1;
139 /* Bit map vector of which conditions and modifiers are not allowed at certain
140 times. For each condition and modifier, there's a bitmap of dis-allowed times.
141 For some, it is easier to specify the negation of a small number of allowed
147 static condition_def conditions[] = {
148 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
150 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
152 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
153 ACL_BIT_PREDATA | ACL_BIT_DATA |
157 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
159 ACL_BIT_NOTSMTP_START),
162 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
163 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
164 ACL_BIT_CONNECT | ACL_BIT_HELO,
166 #ifdef EXPERIMENTAL_BRIGHTMAIL
167 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
169 ACL_BIT_CONNECT | ACL_BIT_HELO |
170 ACL_BIT_DATA | ACL_BIT_MIME |
171 # ifndef DISABLE_PRDR
174 ACL_BIT_ETRN | ACL_BIT_EXPN |
176 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
177 ACL_BIT_VRFY | ACL_BIT_PREDATA |
178 ACL_BIT_NOTSMTP_START,
181 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
182 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
184 /* Certain types of control are always allowed, so we let it through
185 always and check in the control processing itself. */
186 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
188 #ifdef EXPERIMENTAL_DCC
189 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
192 # ifndef DISABLE_PRDR
198 #ifdef WITH_CONTENT_SCAN
199 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
202 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
204 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
205 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
208 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
211 /* Explicit key lookups can be made in non-smtp ACLs so pass
212 always and check in the verify processing itself. */
213 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
215 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
217 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
223 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
224 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
228 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
230 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
231 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
233 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
235 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
242 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
243 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
244 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
246 #ifdef WITH_CONTENT_SCAN
247 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
250 # ifndef DISABLE_PRDR
257 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
258 #ifdef WITH_CONTENT_SCAN
259 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
262 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
270 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
271 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
273 #ifdef WITH_CONTENT_SCAN
274 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
277 # ifndef DISABLE_PRDR
285 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
287 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
288 ACL_BIT_PREDATA | ACL_BIT_DATA |
292 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
293 ACL_BIT_NOTSMTP_START),
295 [ACLC_SEEN] = { US"seen", TRUE, FALSE, 0 },
296 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
297 ACL_BIT_AUTH | ACL_BIT_CONNECT |
299 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
300 ACL_BIT_ETRN | ACL_BIT_EXPN |
301 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
303 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
304 ACL_BIT_AUTH | ACL_BIT_CONNECT |
306 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
307 ACL_BIT_ETRN | ACL_BIT_EXPN |
308 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
311 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
313 #ifdef WITH_CONTENT_SCAN
314 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
315 (unsigned int) ~(ACL_BIT_DATA |
316 # ifndef DISABLE_PRDR
323 [ACLC_SPF] = { US"spf", TRUE, FALSE,
324 ACL_BIT_AUTH | ACL_BIT_CONNECT |
325 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
326 ACL_BIT_ETRN | ACL_BIT_EXPN |
327 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
328 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
330 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
331 ACL_BIT_AUTH | ACL_BIT_CONNECT |
332 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
333 ACL_BIT_ETRN | ACL_BIT_EXPN |
334 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
335 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
338 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
340 /* Certain types of verify are always allowed, so we let it through
341 always and check in the verify function itself */
342 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
347 # include "macro_predef.h"
351 for (condition_def * c = conditions; c < conditions + nelem(conditions); c++)
353 uschar buf[64], * p, * s;
354 int n = sprintf(CS buf, "_ACL_%s_", c->is_modifier ? "MOD" : "COND");
355 for (p = buf + n, s = c->name; *s; s++) *p++ = toupper(*s);
357 builtin_macro_create(buf);
365 /* Return values from decode_control(); used as index so keep in step
366 with the controls_list table that follows! */
369 CONTROL_AUTH_UNADVERTISED,
370 #ifdef EXPERIMENTAL_BRIGHTMAIL
373 CONTROL_CASEFUL_LOCAL_PART,
374 CONTROL_CASELOWER_LOCAL_PART,
375 CONTROL_CUTTHROUGH_DELIVERY,
381 CONTROL_DMARC_VERIFY,
382 CONTROL_DMARC_FORENSIC,
385 CONTROL_ENFORCE_SYNC,
386 CONTROL_ERROR, /* pseudo-value for decode errors */
391 CONTROL_NO_CALLOUT_FLUSH,
392 CONTROL_NO_DELAY_FLUSH,
393 CONTROL_NO_ENFORCE_SYNC,
394 #ifdef WITH_CONTENT_SCAN
395 CONTROL_NO_MBOX_UNSPOOL,
397 CONTROL_NO_MULTILINE,
398 CONTROL_NO_PIPELINING,
402 CONTROL_SUPPRESS_LOCAL_FIXUPS,
404 CONTROL_UTF8_DOWNCONVERT,
410 /* Structure listing various control arguments, with their characteristics.
411 For each control, there's a bitmap of dis-allowed times. For some, it is easier
412 to specify the negation of a small number of allowed times. */
414 typedef struct control_def {
416 BOOL has_option; /* Has /option(s) following */
417 unsigned forbids; /* bitmap of dis-allowed times */
420 static control_def controls_list[] = {
421 /* name has_option forbids */
422 [CONTROL_AUTH_UNADVERTISED] =
423 { US"allow_auth_unadvertised", FALSE,
425 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
427 #ifdef EXPERIMENTAL_BRIGHTMAIL
429 { US"bmi_run", FALSE, 0 },
431 [CONTROL_CASEFUL_LOCAL_PART] =
432 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
433 [CONTROL_CASELOWER_LOCAL_PART] =
434 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
435 [CONTROL_CUTTHROUGH_DELIVERY] =
436 { US"cutthrough_delivery", TRUE, 0 },
438 { US"debug", TRUE, 0 },
441 [CONTROL_DKIM_VERIFY] =
442 { US"dkim_disable_verify", FALSE,
443 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
444 # ifndef DISABLE_PRDR
447 ACL_BIT_NOTSMTP_START
452 [CONTROL_DMARC_VERIFY] =
453 { US"dmarc_disable_verify", FALSE,
454 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
456 [CONTROL_DMARC_FORENSIC] =
457 { US"dmarc_enable_forensic", FALSE,
458 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
464 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
466 [CONTROL_ENFORCE_SYNC] =
467 { US"enforce_sync", FALSE,
468 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
471 /* Pseudo-value for decode errors */
473 { US"error", FALSE, 0 },
475 [CONTROL_FAKEDEFER] =
476 { US"fakedefer", TRUE,
478 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
479 ACL_BIT_PREDATA | ACL_BIT_DATA |
485 [CONTROL_FAKEREJECT] =
486 { US"fakereject", TRUE,
488 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
489 ACL_BIT_PREDATA | ACL_BIT_DATA |
498 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
499 ACL_BIT_PREDATA | ACL_BIT_DATA |
500 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
501 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
504 [CONTROL_NO_CALLOUT_FLUSH] =
505 { US"no_callout_flush", FALSE,
506 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
508 [CONTROL_NO_DELAY_FLUSH] =
509 { US"no_delay_flush", FALSE,
510 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
513 [CONTROL_NO_ENFORCE_SYNC] =
514 { US"no_enforce_sync", FALSE,
515 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
517 #ifdef WITH_CONTENT_SCAN
518 [CONTROL_NO_MBOX_UNSPOOL] =
519 { US"no_mbox_unspool", FALSE,
521 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
522 ACL_BIT_PREDATA | ACL_BIT_DATA |
523 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
527 [CONTROL_NO_MULTILINE] =
528 { US"no_multiline_responses", FALSE,
529 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
531 [CONTROL_NO_PIPELINING] =
532 { US"no_pipelining", FALSE,
533 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
539 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
540 ACL_BIT_PREDATA | ACL_BIT_DATA |
541 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
542 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
545 [CONTROL_SUBMISSION] =
546 { US"submission", TRUE,
548 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
550 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
551 { US"suppress_local_fixups", FALSE,
553 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
554 ACL_BIT_NOTSMTP_START)
557 [CONTROL_UTF8_DOWNCONVERT] =
558 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
563 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
564 caches its result in a tree to avoid repeated DNS queries. The result is an
565 integer code which is used as an index into the following tables of
566 explanatory strings and verification return codes. */
568 static tree_node *csa_cache = NULL;
570 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
571 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
573 /* The acl_verify_csa() return code is translated into an acl_verify() return
574 code using the following table. It is OK unless the client is definitely not
575 authorized. This is because CSA is supposed to be optional for sending sites,
576 so recipients should not be too strict about checking it - especially because
577 DNS problems are quite likely to occur. It's possible to use $csa_status in
578 further ACL conditions to distinguish ok, unknown, and defer if required, but
579 the aim is to make the usual configuration simple. */
581 static int csa_return_code[] = {
584 [CSA_DEFER_SRV] = OK,
585 [CSA_DEFER_ADDR] = OK,
586 [CSA_FAIL_EXPLICIT] = FAIL,
587 [CSA_FAIL_DOMAIN] = FAIL,
588 [CSA_FAIL_NOADDR] = FAIL,
589 [CSA_FAIL_MISMATCH] = FAIL
592 static uschar *csa_status_string[] = {
593 [CSA_UNKNOWN] = US"unknown",
595 [CSA_DEFER_SRV] = US"defer",
596 [CSA_DEFER_ADDR] = US"defer",
597 [CSA_FAIL_EXPLICIT] = US"fail",
598 [CSA_FAIL_DOMAIN] = US"fail",
599 [CSA_FAIL_NOADDR] = US"fail",
600 [CSA_FAIL_MISMATCH] = US"fail"
603 static uschar *csa_reason_string[] = {
604 [CSA_UNKNOWN] = US"unknown",
606 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
607 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
608 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
609 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
610 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
611 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
614 /* Options for the ratelimit condition. Note that there are two variants of
615 the per_rcpt option, depending on the ACL that is used to measure the rate.
616 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
617 so the two variants must have the same internal representation as well as
618 the same configuration string. */
621 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
622 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
625 #define RATE_SET(var,new) \
626 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
628 static uschar *ratelimit_option_string[] = {
629 [RATE_PER_WHAT] = US"?",
630 [RATE_PER_CLASH] = US"!",
631 [RATE_PER_ADDR] = US"per_addr",
632 [RATE_PER_BYTE] = US"per_byte",
633 [RATE_PER_CMD] = US"per_cmd",
634 [RATE_PER_CONN] = US"per_conn",
635 [RATE_PER_MAIL] = US"per_mail",
636 [RATE_PER_RCPT] = US"per_rcpt",
637 [RATE_PER_ALLRCPTS] = US"per_rcpt"
640 /* Enable recursion between acl_check_internal() and acl_check_condition() */
642 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
645 static acl_block * acl_current = NULL;
648 /*************************************************
649 * Find control in list *
650 *************************************************/
652 /* The lists are always in order, so binary chop can be used.
655 name the control name to search for
656 ol the first entry in the control list
657 last one more than the offset of the last entry in the control list
659 Returns: index of a control entry, or -1 if not found
663 find_control(const uschar * name, control_def * ol, int last)
665 for (int first = 0; last > first; )
667 int middle = (first + last)/2;
668 uschar * s = ol[middle].name;
669 int c = Ustrncmp(name, s, Ustrlen(s));
670 if (c == 0) return middle;
671 else if (c > 0) first = middle + 1;
679 /*************************************************
680 * Pick out condition from list *
681 *************************************************/
683 /* Use a binary chop method
687 list list of conditions
690 Returns: offset in list, or -1 if not found
694 acl_checkcondition(uschar * name, condition_def * list, int end)
696 for (int start = 0; start < end; )
698 int mid = (start + end)/2;
699 int c = Ustrcmp(name, list[mid].name);
700 if (c == 0) return mid;
701 if (c < 0) end = mid;
702 else start = mid + 1;
708 /*************************************************
709 * Pick out name from list *
710 *************************************************/
712 /* Use a binary chop method
719 Returns: offset in list, or -1 if not found
723 acl_checkname(uschar *name, uschar **list, int end)
725 for (int start = 0; start < end; )
727 int mid = (start + end)/2;
728 int c = Ustrcmp(name, list[mid]);
729 if (c == 0) return mid;
730 if (c < 0) end = mid; else start = mid + 1;
738 acl_varname_to_cond(const uschar ** sp, acl_condition_block * cond, uschar ** error)
740 const uschar * s = *sp, * endptr;
743 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
744 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
747 if (isalnum(*endptr))
749 *error = string_sprintf("invalid variable name after \"set\" in ACL "
750 "modifier \"set %s\" "
751 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
755 cond->u.varname = string_copyn(s, 18);
760 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
762 *error = string_sprintf("invalid variable name after \"set\" in ACL "
763 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
768 if (!isdigit(*endptr) && *endptr != '_')
770 *error = string_sprintf("invalid variable name after \"set\" in ACL "
771 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
776 for ( ; *endptr && *endptr != '=' && !isspace(*endptr); endptr++)
777 if (!isalnum(*endptr) && *endptr != '_')
779 *error = string_sprintf("invalid character \"%c\" in variable name "
780 "in ACL modifier \"set %s\"", *endptr, s);
784 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
787 Uskip_whitespace(&s);
794 acl_data_to_cond(const uschar * s, acl_condition_block * cond,
795 const uschar * name, uschar ** error)
799 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
800 conditions[cond->type].is_modifier ? US"modifier" : US"condition");
803 Uskip_whitespace(&s);
804 cond->arg = string_copy(s);
809 /*************************************************
810 * Read and parse one ACL *
811 *************************************************/
813 /* This function is called both from readconf in order to parse the ACLs in the
814 configuration file, and also when an ACL is encountered dynamically (e.g. as
815 the result of an expansion). It is given a function to call in order to
816 retrieve the lines of the ACL. This function handles skipping comments and
817 blank lines (where relevant).
820 func function to get next line of ACL
821 error where to put an error message
823 Returns: pointer to ACL, or NULL
824 NULL can be legal (empty ACL); in this case error will be NULL
828 acl_read(uschar *(*func)(void), uschar **error)
830 acl_block *yield = NULL;
831 acl_block **lastp = &yield;
832 acl_block *this = NULL;
833 acl_condition_block *cond;
834 acl_condition_block **condp = NULL;
839 while ((s = (*func)()))
842 BOOL negated = FALSE;
843 const uschar * saveline = s;
844 uschar name[EXIM_DRIVERNAME_MAX];
846 /* Conditions (but not verbs) are allowed to be negated by an initial
849 if (Uskip_whitespace(&s) == '!')
855 /* Read the name of a verb or a condition, or the start of a new ACL, which
856 can be started by a name, or by a macro definition. */
858 s = readconf_readname(name, sizeof(name), s);
859 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
861 /* If a verb is unrecognized, it may be another condition or modifier that
862 continues the previous verb. */
864 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
868 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
880 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
883 *lastp = this = store_get(sizeof(acl_block), GET_UNTAINTED);
886 this->condition = NULL;
888 this->srcline = config_lineno; /* for debug output */
889 this->srcfile = config_filename; /**/
890 condp = &this->condition;
891 if (!*s) continue; /* No condition on this line */
897 s = readconf_readname(name, sizeof(name), s); /* Condition name */
900 /* Handle a condition or modifier. */
902 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
904 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
909 /* The modifiers may not be negated */
911 if (negated && conditions[c].is_modifier)
913 *error = string_sprintf("ACL error: negation is not allowed with "
914 "\"%s\"", conditions[c].name);
918 /* ENDPASS may occur only with ACCEPT or DISCARD. */
920 if (c == ACLC_ENDPASS &&
921 this->verb != ACL_ACCEPT &&
922 this->verb != ACL_DISCARD)
924 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
925 conditions[c].name, verbs[this->verb]);
929 cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
932 cond->u.negated = negated;
937 /* The "set" modifier is different in that its argument is "name=value"
938 rather than just a value, and we can check the validity of the name, which
939 gives us a variable name to insert into the data block. The original ACL
940 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
941 extended to 20 of each type, but after that people successfully argued for
942 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
943 After that, we allow alphanumerics and underscores, but the first character
944 after c or m must be a digit or an underscore. This retains backwards
948 if (!acl_varname_to_cond(&s, cond, error)) return NULL;
950 /* For "set", we are now positioned for the data. For the others, only
951 "endpass" has no data */
953 if (c != ACLC_ENDPASS)
954 if (!acl_data_to_cond(s, cond, name, error)) return NULL;
962 /*************************************************
963 * Set up added header line(s) *
964 *************************************************/
966 /* This function is called by the add_header modifier, and also from acl_warn()
967 to implement the now-deprecated way of adding header lines using "message" on a
968 "warn" verb. The argument is treated as a sequence of header lines which are
969 added to a chain, provided there isn't an identical one already there.
971 Argument: string of header lines
976 setup_header(const uschar *hstring)
979 int hlen = Ustrlen(hstring);
981 /* Ignore any leading newlines */
982 while (*hstring == '\n') hstring++, hlen--;
984 /* An empty string does nothing; ensure exactly one final newline. */
985 if (hlen <= 0) return;
986 if (hstring[--hlen] != '\n') /* no newline */
987 q = string_sprintf("%s\n", hstring);
988 else if (hstring[hlen-1] == '\n') /* double newline */
990 uschar * s = string_copy(hstring);
991 while(s[--hlen] == '\n')
998 /* Loop for multiple header lines, taking care about continuations */
1000 for (p = q; *p; p = q)
1004 int newtype = htype_add_bot;
1005 header_line **hptr = &acl_added_headers;
1007 /* Find next header line within the string */
1011 q = Ustrchr(q, '\n'); /* we know there was a newline */
1012 if (*++q != ' ' && *q != '\t') break;
1015 /* If the line starts with a colon, interpret the instruction for where to
1016 add it. This temporarily sets up a new type. */
1020 if (strncmpic(p, US":after_received:", 16) == 0)
1022 newtype = htype_add_rec;
1025 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1027 newtype = htype_add_rfc;
1030 else if (strncmpic(p, US":at_start:", 10) == 0)
1032 newtype = htype_add_top;
1035 else if (strncmpic(p, US":at_end:", 8) == 0)
1037 newtype = htype_add_bot;
1040 while (*p == ' ' || *p == '\t') p++;
1043 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1044 to the front of it. */
1046 for (s = p; s < q - 1; s++)
1047 if (*s == ':' || !isgraph(*s)) break;
1049 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1050 hlen = Ustrlen(hdr);
1052 /* See if this line has already been added */
1056 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1057 hptr = &(*hptr)->next;
1060 /* Add if not previously present */
1064 /* The header_line struct itself is not tainted, though it points to
1065 possibly tainted data. */
1066 header_line * h = store_get(sizeof(header_line), GET_UNTAINTED);
1079 /*************************************************
1080 * List the added header lines *
1081 *************************************************/
1087 for (header_line * h = acl_added_headers; h; h = h->next)
1090 if (h->text[i-1] == '\n') i--;
1091 g = string_append_listele_n(g, '\n', h->text, i);
1094 return g ? g->s : NULL;
1098 /*************************************************
1099 * Set up removed header line(s) *
1100 *************************************************/
1102 /* This function is called by the remove_header modifier. The argument is
1103 treated as a sequence of header names which are added to a colon separated
1104 list, provided there isn't an identical one already there.
1106 Argument: string of header names
1111 setup_remove_header(const uschar *hnames)
1114 acl_removed_headers = acl_removed_headers
1115 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1116 : string_copy(hnames);
1121 /*************************************************
1123 *************************************************/
1125 /* This function is called when a WARN verb's conditions are true. It adds to
1126 the message's headers, and/or writes information to the log. In each case, this
1127 only happens once (per message for headers, per connection for log).
1129 ** NOTE: The header adding action using the "message" setting is historic, and
1130 its use is now deprecated. The new add_header modifier should be used instead.
1133 where ACL_WHERE_xxxx indicating which ACL this is
1134 user_message message for adding to headers
1135 log_message message for logging, if different
1141 acl_warn(int where, uschar *user_message, uschar *log_message)
1143 if (log_message != NULL && log_message != user_message)
1146 string_item *logged;
1148 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1149 string_printing(log_message));
1151 /* If a sender verification has failed, and the log message is "sender verify
1152 failed", add the failure message. */
1154 if (sender_verified_failed != NULL &&
1155 sender_verified_failed->message != NULL &&
1156 strcmpic(log_message, US"sender verify failed") == 0)
1157 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1159 /* Search previously logged warnings. They are kept in malloc
1160 store so they can be freed at the start of a new message. */
1162 for (logged = acl_warn_logged; logged; logged = logged->next)
1163 if (Ustrcmp(logged->text, text) == 0) break;
1167 int length = Ustrlen(text) + 1;
1168 log_write(0, LOG_MAIN, "%s", text);
1169 logged = store_malloc(sizeof(string_item) + length);
1170 logged->text = US logged + sizeof(string_item);
1171 memcpy(logged->text, text, length);
1172 logged->next = acl_warn_logged;
1173 acl_warn_logged = logged;
1177 /* If there's no user message, we are done. */
1179 if (!user_message) return;
1181 /* If this isn't a message ACL, we can't do anything with a user message.
1184 if (where > ACL_WHERE_NOTSMTP)
1186 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1187 "found in a non-message (%s) ACL: cannot specify header lines here: "
1188 "message ignored", acl_wherenames[where]);
1192 /* The code for setting up header lines is now abstracted into a separate
1193 function so that it can be used for the add_header modifier as well. */
1195 setup_header(user_message);
1200 /*************************************************
1201 * Verify and check reverse DNS *
1202 *************************************************/
1204 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1205 address if this has not yet been done. The host_name_lookup() function checks
1206 that one of these names resolves to an address list that contains the client IP
1207 address, so we don't actually have to do the check here.
1210 user_msgptr pointer for user message
1211 log_msgptr pointer for log message
1213 Returns: OK verification condition succeeded
1214 FAIL verification failed
1215 DEFER there was a problem verifying
1219 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1223 /* Previous success */
1225 if (sender_host_name) return OK;
1227 /* Previous failure */
1229 if (host_lookup_failed)
1231 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1235 /* Need to do a lookup */
1238 debug_printf_indent("looking up host name to force name/address consistency check\n");
1240 if ((rc = host_name_lookup()) != OK)
1242 *log_msgptr = rc == DEFER
1243 ? US"host lookup deferred for reverse lookup check"
1244 : string_sprintf("host lookup failed for reverse lookup check%s",
1246 return rc; /* DEFER or FAIL */
1249 host_build_sender_fullhost();
1255 /*************************************************
1256 * Check client IP address matches CSA target *
1257 *************************************************/
1259 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1260 response for address records belonging to the CSA target hostname. The section
1261 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1262 If one of the addresses matches the client's IP address, then the client is
1263 authorized by CSA. If there are target IP addresses but none of them match
1264 then the client is using an unauthorized IP address. If there are no target IP
1265 addresses then the client cannot be using an authorized IP address. (This is
1266 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1269 dnsa the DNS answer block
1270 dnss a DNS scan block for us to use
1271 reset option specifying what portion to scan, as described above
1272 target the target hostname to use for matching RR names
1274 Returns: CSA_OK successfully authorized
1275 CSA_FAIL_MISMATCH addresses found but none matched
1276 CSA_FAIL_NOADDR no target addresses found
1280 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1283 int rc = CSA_FAIL_NOADDR;
1285 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1287 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1289 /* Check this is an address RR for the target hostname. */
1293 && rr->type != T_AAAA
1297 if (strcmpic(target, rr->name) != 0) continue;
1299 rc = CSA_FAIL_MISMATCH;
1301 /* Turn the target address RR into a list of textual IP addresses and scan
1302 the list. There may be more than one if it is an A6 RR. */
1304 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1306 /* If the client IP address matches the target IP address, it's good! */
1308 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1310 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1314 /* If we found some target addresses but none of them matched, the client is
1315 using an unauthorized IP address, otherwise the target has no authorized IP
1323 /*************************************************
1324 * Verify Client SMTP Authorization *
1325 *************************************************/
1327 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1328 to find the CSA SRV record corresponding to the domain argument, or
1329 $sender_helo_name if no argument is provided. It then checks that the
1330 client is authorized, and that its IP address corresponds to the SRV
1331 target's address by calling acl_verify_csa_address() above. The address
1332 should have been returned in the DNS response's ADDITIONAL section, but if
1333 not we perform another DNS lookup to get it.
1336 domain pointer to optional parameter following verify = csa
1338 Returns: CSA_UNKNOWN no valid CSA record found
1339 CSA_OK successfully authorized
1340 CSA_FAIL_* client is definitely not authorized
1341 CSA_DEFER_* there was a DNS problem
1345 acl_verify_csa(const uschar *domain)
1348 const uschar *found;
1349 int priority, weight, port;
1353 int rc, type, yield;
1354 #define TARGET_SIZE 256
1355 uschar * target = store_get(TARGET_SIZE, GET_TAINTED);
1357 /* Work out the domain we are using for the CSA lookup. The default is the
1358 client's HELO domain. If the client has not said HELO, use its IP address
1359 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1361 while (isspace(*domain) && *domain != '\0') ++domain;
1362 if (*domain == '\0') domain = sender_helo_name;
1363 if (!domain) domain = sender_host_address;
1364 if (!sender_host_address) return CSA_UNKNOWN;
1366 /* If we have an address literal, strip off the framing ready for turning it
1367 into a domain. The framing consists of matched square brackets possibly
1368 containing a keyword and a colon before the actual IP address. */
1370 if (domain[0] == '[')
1372 const uschar *start = Ustrchr(domain, ':');
1373 if (start == NULL) start = domain;
1374 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1377 /* Turn domains that look like bare IP addresses into domains in the reverse
1378 DNS. This code also deals with address literals and $sender_host_address. It's
1379 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1380 address literals, but it's probably the most friendly thing to do. This is an
1381 extension to CSA, so we allow it to be turned off for proper conformance. */
1383 if (string_is_ip_address(domain, NULL) != 0)
1385 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1386 domain = dns_build_reverse(domain);
1389 /* Find out if we've already done the CSA check for this domain. If we have,
1390 return the same result again. Otherwise build a new cached result structure
1391 for this domain. The name is filled in now, and the value is filled in when
1392 we return from this function. */
1394 if ((t = tree_search(csa_cache, domain)))
1397 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), domain);
1398 Ustrcpy(t->name, domain);
1399 (void)tree_insertnode(&csa_cache, t);
1401 /* Now we are ready to do the actual DNS lookup(s). */
1404 dnsa = store_get_dns_answer();
1405 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1407 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1410 yield = CSA_DEFER_SRV;
1413 /* If we found nothing, the client's authorization is unknown. */
1417 yield = CSA_UNKNOWN;
1420 /* We got something! Go on to look at the reply in more detail. */
1426 /* Scan the reply for well-formed CSA SRV records. */
1428 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1430 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1432 const uschar * p = rr->data;
1434 /* Extract the numerical SRV fields (p is incremented) */
1436 GETSHORT(priority, p);
1437 GETSHORT(weight, p);
1441 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1443 /* Check the CSA version number */
1445 if (priority != 1) continue;
1447 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1448 found by dns_special_lookup() is a parent of the one we asked for), we check
1449 the subdomain assertions in the port field. At the moment there's only one
1450 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1451 SRV records of their own. */
1453 if (Ustrcmp(found, domain) != 0)
1455 yield = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1459 /* This CSA SRV record refers directly to our domain, so we check the value
1460 in the weight field to work out the domain's authorization. 0 and 1 are
1461 unauthorized; 3 means the client is authorized but we can't check the IP
1462 address in order to authenticate it, so we treat it as unknown; values
1463 greater than 3 are undefined. */
1467 yield = CSA_FAIL_DOMAIN;
1471 if (weight > 2) continue;
1473 /* Weight == 2, which means the domain is authorized. We must check that the
1474 client's IP address is listed as one of the SRV target addresses. Save the
1475 target hostname then break to scan the additional data for its addresses. */
1477 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1478 (DN_EXPAND_ARG4_TYPE)target, TARGET_SIZE);
1480 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1485 /* If we didn't break the loop then no appropriate records were found. */
1489 yield = CSA_UNKNOWN;
1493 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1494 A target of "." indicates there are no valid addresses, so the client cannot
1495 be authorized. (This is an odd configuration because weight=2 target=. is
1496 equivalent to weight=1, but we check for it in order to keep load off the
1497 root name servers.) Note that dn_expand() turns "." into "". */
1499 if (Ustrcmp(target, "") == 0)
1501 yield = CSA_FAIL_NOADDR;
1505 /* Scan the additional section of the CSA SRV reply for addresses belonging
1506 to the target. If the name server didn't return any additional data (e.g.
1507 because it does not fully support SRV records), we need to do another lookup
1508 to obtain the target addresses; otherwise we have a definitive result. */
1510 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1511 if (rc != CSA_FAIL_NOADDR)
1517 /* The DNS lookup type corresponds to the IP version used by the client. */
1520 if (Ustrchr(sender_host_address, ':') != NULL)
1523 #endif /* HAVE_IPV6 */
1527 lookup_dnssec_authenticated = NULL;
1528 switch (dns_lookup(dnsa, target, type, NULL))
1530 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1533 yield = CSA_DEFER_ADDR;
1536 /* If the query succeeded, scan the addresses and return the result. */
1539 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1540 if (rc != CSA_FAIL_NOADDR)
1545 /* else fall through */
1547 /* If the target has no IP addresses, the client cannot have an authorized
1548 IP address. However, if the target site uses A6 records (not AAAA records)
1549 we have to do yet another lookup in order to check them. */
1553 yield = CSA_FAIL_NOADDR;
1559 store_free_dns_answer(dnsa);
1560 return t->data.val = yield;
1565 /*************************************************
1566 * Handle verification (address & other) *
1567 *************************************************/
1569 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1570 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1571 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1576 unsigned where_allowed; /* bitmap */
1577 BOOL no_options; /* Never has /option(s) following */
1578 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1580 static verify_type_t verify_type_list[] = {
1581 /* name value where no-opt opt-sep */
1582 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1583 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1584 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1585 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1586 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BITS_HAVEDATA, TRUE, 0 },
1587 { US"not_blind", VERIFY_NOT_BLIND, ACL_BITS_HAVEDATA, FALSE, 0 },
1588 { US"header_sender", VERIFY_HDR_SNDR, ACL_BITS_HAVEDATA, FALSE, 0 },
1589 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1590 | ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1592 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1593 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BITS_HAVEDATA, TRUE, 0 },
1594 #ifdef EXPERIMENTAL_ARC
1595 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1600 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1601 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1602 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1603 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1609 BOOL has_option; /* Has =option(s) following */
1610 BOOL timeval; /* Has a time value */
1612 static callout_opt_t callout_opt_list[] = {
1613 /* name value flag has-opt has-time */
1614 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1615 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1616 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1617 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1618 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1619 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1620 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1621 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1622 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1623 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1624 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1625 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1626 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1632 v_period(const uschar * s, const uschar * arg, uschar ** log_msgptr)
1635 if ((period = readconf_readtime(s, 0, FALSE)) < 0)
1637 *log_msgptr = string_sprintf("bad time value in ACL condition "
1638 "\"verify %s\"", arg);
1645 /* This function implements the "verify" condition. It is called when
1646 encountered in any ACL, because some tests are almost always permitted. Some
1647 just don't make sense, and always fail (for example, an attempt to test a host
1648 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1651 where where called from
1652 addr the recipient address that the ACL is handling, or NULL
1653 arg the argument of "verify"
1654 user_msgptr pointer for user message
1655 log_msgptr pointer for log message
1656 basic_errno where to put verify errno
1658 Returns: OK verification condition succeeded
1659 FAIL verification failed
1660 DEFER there was a problem verifying
1665 acl_verify(int where, address_item *addr, const uschar *arg,
1666 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1670 int callout_overall = -1;
1671 int callout_connect = -1;
1672 int verify_options = 0;
1674 BOOL verify_header_sender = FALSE;
1675 BOOL defer_ok = FALSE;
1676 BOOL callout_defer_ok = FALSE;
1677 BOOL no_details = FALSE;
1678 BOOL success_on_redirect = FALSE;
1680 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
1681 address_item *sender_vaddr = NULL;
1682 uschar *verify_sender_address = NULL;
1683 uschar *pm_mailfrom = NULL;
1684 uschar *se_mailfrom = NULL;
1686 /* Some of the verify items have slash-separated options; some do not. Diagnose
1687 an error if options are given for items that don't expect them.
1690 uschar *slash = Ustrchr(arg, '/');
1691 const uschar *list = arg;
1692 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1695 if (!ss) goto BAD_VERIFY;
1697 /* Handle name/address consistency verification in a separate function. */
1699 for (vp = verify_type_list;
1700 CS vp < CS verify_type_list + sizeof(verify_type_list);
1703 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1704 : strcmpic (ss, vp->name) == 0)
1706 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1709 if (vp->no_options && slash)
1711 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1712 "(this verify item has no options)", arg);
1715 if (!(vp->where_allowed & BIT(where)))
1717 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1718 vp->name, acl_wherenames[where]);
1723 case VERIFY_REV_HOST_LKUP:
1724 if (!sender_host_address) return OK;
1725 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1726 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1727 if (strcmpic(ss, US"defer_ok") == 0)
1732 /* TLS certificate verification is done at STARTTLS time; here we just
1733 test whether it was successful or not. (This is for optional verification; for
1734 mandatory verification, the connection doesn't last this long.) */
1736 if (tls_in.certificate_verified) return OK;
1737 *user_msgptr = US"no verified certificate";
1741 /* We can test the result of optional HELO verification that might have
1742 occurred earlier. If not, we can attempt the verification now. */
1744 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1745 return f.helo_verified ? OK : FAIL;
1748 /* Do Client SMTP Authorization checks in a separate function, and turn the
1749 result code into user-friendly strings. */
1751 rc = acl_verify_csa(list);
1752 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1753 csa_reason_string[rc]);
1754 csa_status = csa_status_string[rc];
1755 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1756 return csa_return_code[rc];
1758 #ifdef EXPERIMENTAL_ARC
1760 { /* Do Authenticated Received Chain checks in a separate function. */
1761 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1765 if (!(arc_state = acl_verify_arc())) return DEFER;
1766 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1767 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1769 if (!condlist) condlist = US"none:pass";
1770 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1771 if (Ustrcmp(arc_state, cond) == 0) return OK;
1776 case VERIFY_HDR_SYNTAX:
1777 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1778 a syntax error, we return details of the error to the sender if configured to
1779 send out full details. (But a "message" setting on the ACL can override, as
1782 rc = verify_check_headers(log_msgptr);
1783 if (rc != OK && *log_msgptr)
1784 if (smtp_return_error_details)
1785 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1787 acl_verify_message = *log_msgptr;
1790 case VERIFY_HDR_NAMES_ASCII:
1791 /* Check that all header names are true 7 bit strings
1792 See RFC 5322, 2.2. and RFC 6532, 3. */
1794 rc = verify_check_header_names_ascii(log_msgptr);
1795 if (rc != OK && smtp_return_error_details && *log_msgptr)
1796 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1799 case VERIFY_NOT_BLIND:
1800 /* Check that no recipient of this message is "blind", that is, every envelope
1801 recipient must be mentioned in either To: or Cc:. */
1803 BOOL case_sensitive = TRUE;
1805 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1806 if (strcmpic(ss, US"case_insensitive") == 0)
1807 case_sensitive = FALSE;
1810 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1811 "condition \"verify %s\"", ss, arg);
1815 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1817 *log_msgptr = US"bcc recipient detected";
1818 if (smtp_return_error_details)
1819 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1824 /* The remaining verification tests check recipient and sender addresses,
1825 either from the envelope or from the header. There are a number of
1826 slash-separated options that are common to all of them. */
1828 case VERIFY_HDR_SNDR:
1829 verify_header_sender = TRUE;
1833 /* In the case of a sender, this can optionally be followed by an address to use
1834 in place of the actual sender (rare special-case requirement). */
1838 verify_sender_address = sender_address;
1841 while (isspace(*s)) s++;
1842 if (*s++ != '=') goto BAD_VERIFY;
1843 while (isspace(*s)) s++;
1844 verify_sender_address = string_copy(s);
1855 /* Remaining items are optional; they apply to sender and recipient
1856 verification, including "header sender" verification. */
1858 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1860 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1861 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1862 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1864 /* These two old options are left for backwards compatibility */
1866 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1868 callout_defer_ok = TRUE;
1869 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1872 else if (strcmpic(ss, US"check_postmaster") == 0)
1875 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1878 /* The callout option has a number of sub-options, comma separated */
1880 else if (strncmpic(ss, US"callout", 7) == 0)
1882 callout = CALLOUT_TIMEOUT_DEFAULT;
1885 while (isspace(*ss)) ss++;
1888 const uschar * sublist = ss;
1891 while (isspace(*sublist)) sublist++;
1892 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1895 double period = 1.0F;
1897 for (op= callout_opt_list; op->name; op++)
1898 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1901 verify_options |= op->flag;
1904 opt += Ustrlen(op->name);
1905 while (isspace(*opt)) opt++;
1908 *log_msgptr = string_sprintf("'=' expected after "
1909 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1912 while (isspace(*opt)) opt++;
1914 if (op->timeval && (period = v_period(opt, arg, log_msgptr)) < 0)
1919 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1920 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1921 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1922 case CALLOUT_MAILFROM:
1923 if (!verify_header_sender)
1925 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1926 "callout option only for verify=header_sender (detected in ACL "
1927 "condition \"%s\")", arg);
1930 se_mailfrom = string_copy(opt);
1932 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1933 case CALLOUT_MAXWAIT: callout_overall = period; break;
1934 case CALLOUT_CONNECT: callout_connect = period; break;
1935 case CALLOUT_TIME: callout = period; break;
1941 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1942 "ACL condition \"%s\"", arg);
1948 /* The quota option has sub-options, comma-separated */
1950 else if (strncmpic(ss, US"quota", 5) == 0)
1955 while (isspace(*ss)) ss++;
1958 const uschar * sublist = ss;
1962 while (isspace(*sublist)) sublist++;
1963 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1964 if (Ustrncmp(opt, "cachepos=", 9) == 0)
1965 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1968 quota_pos_cache = period;
1969 else if (Ustrncmp(opt, "cacheneg=", 9) == 0)
1970 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1973 quota_neg_cache = period;
1974 else if (Ustrcmp(opt, "no_cache") == 0)
1975 quota_pos_cache = quota_neg_cache = 0;
1980 /* Option not recognized */
1984 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1985 "condition \"verify %s\"", ss, arg);
1990 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1991 (vopt_callout_recipsender|vopt_callout_recippmaster))
1993 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1994 "for a recipient callout";
1998 /* Handle quota verification */
2001 if (vp->value != VERIFY_RCPT)
2003 *log_msgptr = US"can only verify quota of recipient";
2007 if ((rc = verify_quota_call(addr->address,
2008 quota_pos_cache, quota_neg_cache, log_msgptr)) != OK)
2010 *basic_errno = errno;
2011 if (smtp_return_error_details)
2013 if (!*user_msgptr && *log_msgptr)
2014 *user_msgptr = string_sprintf("Rejected after %s: %s",
2015 smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]],
2017 if (rc == DEFER) f.acl_temp_details = TRUE;
2024 /* Handle sender-in-header verification. Default the user message to the log
2025 message if giving out verification details. */
2027 if (verify_header_sender)
2031 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
2032 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2035 *basic_errno = verrno;
2036 if (smtp_return_error_details)
2038 if (!*user_msgptr && *log_msgptr)
2039 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2040 if (rc == DEFER) f.acl_temp_details = TRUE;
2045 /* Handle a sender address. The default is to verify *the* sender address, but
2046 optionally a different address can be given, for special requirements. If the
2047 address is empty, we are dealing with a bounce message that has no sender, so
2048 we cannot do any checking. If the real sender address gets rewritten during
2049 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2050 during message reception.
2052 A list of verified "sender" addresses is kept to try to avoid doing to much
2053 work repetitively when there are multiple recipients in a message and they all
2054 require sender verification. However, when callouts are involved, it gets too
2055 complicated because different recipients may require different callout options.
2056 Therefore, we always do a full sender verify when any kind of callout is
2057 specified. Caching elsewhere, for instance in the DNS resolver and in the
2058 callout handling, should ensure that this is not terribly inefficient. */
2060 else if (verify_sender_address)
2062 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
2064 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2065 "sender verify callout";
2069 sender_vaddr = verify_checked_sender(verify_sender_address);
2070 if ( sender_vaddr /* Previously checked */
2071 && callout <= 0) /* No callout needed this time */
2073 /* If the "routed" flag is set, it means that routing worked before, so
2074 this check can give OK (the saved return code value, if set, belongs to a
2075 callout that was done previously). If the "routed" flag is not set, routing
2076 must have failed, so we use the saved return code. */
2078 if (testflag(sender_vaddr, af_verify_routed))
2082 rc = sender_vaddr->special_action;
2083 *basic_errno = sender_vaddr->basic_errno;
2085 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
2088 /* Do a new verification, and cache the result. The cache is used to avoid
2089 verifying the sender multiple times for multiple RCPTs when callouts are not
2090 specified (see comments above).
2092 The cache is also used on failure to give details in response to the first
2093 RCPT that gets bounced for this reason. However, this can be suppressed by
2094 the no_details option, which sets the flag that says "this detail has already
2095 been sent". The cache normally contains just one address, but there may be
2096 more in esoteric circumstances. */
2101 uschar *save_address_data = deliver_address_data;
2103 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2105 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2107 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2108 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2111 if (no_details) setflag(sender_vaddr, af_sverify_told);
2112 if (verify_sender_address[0] != 0)
2114 /* If this is the real sender address, save the unrewritten version
2115 for use later in receive. Otherwise, set a flag so that rewriting the
2116 sender in verify_address() does not update sender_address. */
2118 if (verify_sender_address == sender_address)
2119 sender_address_unrewritten = sender_address;
2121 verify_options |= vopt_fake_sender;
2123 if (success_on_redirect)
2124 verify_options |= vopt_success_on_redirect;
2126 /* The recipient, qualify, and expn options are never set in
2129 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2130 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2132 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2135 *basic_errno = sender_vaddr->basic_errno;
2138 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2139 debug_printf_indent("sender %s verified ok as %s\n",
2140 verify_sender_address, sender_vaddr->address);
2142 debug_printf_indent("sender %s verified ok\n",
2143 verify_sender_address);
2146 rc = OK; /* Null sender */
2148 /* Cache the result code */
2150 if (routed) setflag(sender_vaddr, af_verify_routed);
2151 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2152 sender_vaddr->special_action = rc;
2153 sender_vaddr->next = sender_verified_list;
2154 sender_verified_list = sender_vaddr;
2156 /* Restore the recipient address data, which might have been clobbered by
2157 the sender verification. */
2159 deliver_address_data = save_address_data;
2162 /* Put the sender address_data value into $sender_address_data */
2164 sender_address_data = sender_vaddr->prop.address_data;
2167 /* A recipient address just gets a straightforward verify; again we must handle
2168 the DEFER overrides. */
2174 if (success_on_redirect)
2175 verify_options |= vopt_success_on_redirect;
2177 /* We must use a copy of the address for verification, because it might
2181 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2182 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2183 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2185 *basic_errno = addr2.basic_errno;
2186 *log_msgptr = addr2.message;
2187 *user_msgptr = addr2.user_message ? addr2.user_message : addr2.message;
2189 /* Allow details for temporary error if the address is so flagged. */
2190 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2192 /* Make $address_data visible */
2193 deliver_address_data = addr2.prop.address_data;
2196 /* We have a result from the relevant test. Handle defer overrides first. */
2200 || callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER
2203 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2204 defer_ok? "defer_ok" : "callout_defer_ok");
2208 /* If we've failed a sender, set up a recipient message, and point
2209 sender_verified_failed to the address item that actually failed. */
2211 if (rc != OK && verify_sender_address)
2214 *log_msgptr = *user_msgptr = US"Sender verify failed";
2215 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2216 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2219 *log_msgptr = US"Could not complete sender verify callout";
2220 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2224 sender_verified_failed = sender_vaddr;
2227 /* Verifying an address messes up the values of $domain and $local_part,
2228 so reset them before returning if this is a RCPT ACL. */
2232 deliver_domain = addr->domain;
2233 deliver_localpart = addr->local_part;
2237 /* Syntax errors in the verify argument come here. */
2240 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2241 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2242 "or \"reverse_host_lookup\" at start of ACL condition "
2243 "\"verify %s\"", arg);
2250 /*************************************************
2251 * Check argument for control= modifier *
2252 *************************************************/
2254 /* Called from acl_check_condition() below.
2255 To handle the case "queue_only" we accept an _ in the
2256 initial / option-switch position.
2259 arg the argument string for control=
2260 pptr set to point to the terminating character
2261 where which ACL we are in
2262 log_msgptr for error messages
2264 Returns: CONTROL_xxx value
2268 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2274 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2275 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2276 && (!d->has_option || c != '/' && c != '_')
2279 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2280 return CONTROL_ERROR;
2290 /*************************************************
2291 * Return a ratelimit error *
2292 *************************************************/
2294 /* Called from acl_ratelimit() below
2297 log_msgptr for error messages
2298 format format string
2299 ... supplementary arguments
2305 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2309 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2311 va_start(ap, format);
2312 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2315 gstring_release_unused(g);
2316 *log_msgptr = string_from_gstring(g);
2323 /*************************************************
2324 * Handle rate limiting *
2325 *************************************************/
2327 /* Called by acl_check_condition() below to calculate the result
2328 of the ACL ratelimit condition.
2330 Note that the return value might be slightly unexpected: if the
2331 sender's rate is above the limit then the result is OK. This is
2332 similar to the dnslists condition, and is so that you can write
2333 ACL clauses like: defer ratelimit = 15 / 1h
2336 arg the option string for ratelimit=
2337 where ACL_WHERE_xxxx indicating which ACL this is
2338 log_msgptr for error messages
2340 Returns: OK - Sender's rate is above limit
2341 FAIL - Sender's rate is below limit
2342 DEFER - Problem opening ratelimit database
2343 ERROR - Syntax error in options.
2347 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2349 double limit, period, count;
2352 uschar *unique = NULL;
2354 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2355 BOOL noupdate = FALSE, badacl = FALSE;
2356 int mode = RATE_PER_WHAT;
2358 tree_node **anchor, *t;
2359 open_db dbblock, *dbm;
2361 dbdata_ratelimit *dbd;
2362 dbdata_ratelimit_unique *dbdb;
2365 /* Parse the first two options and record their values in expansion
2366 variables. These variables allow the configuration to have informative
2367 error messages based on rate limits obtained from a table lookup. */
2369 /* First is the maximum number of messages per period / maximum burst
2370 size, which must be greater than or equal to zero. Zero is useful for
2371 rate measurement as opposed to rate limiting. */
2373 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2374 return ratelimit_error(log_msgptr, "sender rate limit not set");
2376 limit = Ustrtod(sender_rate_limit, &ss);
2377 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2378 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2379 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2381 if (limit < 0.0 || *ss != '\0')
2382 return ratelimit_error(log_msgptr,
2383 "\"%s\" is not a positive number", sender_rate_limit);
2385 /* Second is the rate measurement period / exponential smoothing time
2386 constant. This must be strictly greater than zero, because zero leads to
2387 run-time division errors. */
2389 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2390 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2392 return ratelimit_error(log_msgptr,
2393 "\"%s\" is not a time value", sender_rate_period);
2395 /* By default we are counting one of something, but the per_rcpt,
2396 per_byte, and count options can change this. */
2400 /* Parse the other options. */
2402 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2404 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2405 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2406 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2407 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2408 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2409 else if (strcmpic(ss, US"per_conn") == 0)
2411 RATE_SET(mode, PER_CONN);
2412 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2415 else if (strcmpic(ss, US"per_mail") == 0)
2417 RATE_SET(mode, PER_MAIL);
2418 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2420 else if (strcmpic(ss, US"per_rcpt") == 0)
2422 /* If we are running in the RCPT ACL, then we'll count the recipients
2423 one by one, but if we are running when we have accumulated the whole
2424 list then we'll add them all in one batch. */
2425 if (where == ACL_WHERE_RCPT)
2426 RATE_SET(mode, PER_RCPT);
2427 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2428 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2429 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2430 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2432 else if (strcmpic(ss, US"per_byte") == 0)
2434 /* If we have not yet received the message data and there was no SIZE
2435 declaration on the MAIL command, then it's safe to just use a value of
2436 zero and let the recorded rate decay as if nothing happened. */
2437 RATE_SET(mode, PER_MAIL);
2438 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2439 else count = message_size < 0 ? 0.0 : (double)message_size;
2441 else if (strcmpic(ss, US"per_addr") == 0)
2443 RATE_SET(mode, PER_RCPT);
2444 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2445 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2447 else if (strncmpic(ss, US"count=", 6) == 0)
2450 count = Ustrtod(ss+6, &e);
2451 if (count < 0.0 || *e != '\0')
2452 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2454 else if (strncmpic(ss, US"unique=", 7) == 0)
2455 unique = string_copy(ss + 7);
2457 key = string_copy(ss);
2459 key = string_sprintf("%s/%s", key, ss);
2462 /* Sanity check. When the badacl flag is set the update mode must either
2463 be readonly (which is the default if it is omitted) or, for backwards
2464 compatibility, a combination of noupdate and strict or leaky. */
2466 if (mode == RATE_PER_CLASH)
2467 return ratelimit_error(log_msgptr, "conflicting per_* options");
2468 if (leaky + strict + readonly > 1)
2469 return ratelimit_error(log_msgptr, "conflicting update modes");
2470 if (badacl && (leaky || strict) && !noupdate)
2471 return ratelimit_error(log_msgptr,
2472 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2473 ratelimit_option_string[mode], acl_wherenames[where]);
2475 /* Set the default values of any unset options. In readonly mode we
2476 perform the rate computation without any increment so that its value
2477 decays to eventually allow over-limit senders through. */
2479 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2480 if (badacl) readonly = TRUE;
2481 if (readonly) count = 0.0;
2482 if (!strict && !readonly) leaky = TRUE;
2483 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2485 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2486 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2487 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2488 are added to the key because they alter the meaning of the stored data. */
2491 key = !sender_host_address ? US"" : sender_host_address;
2493 key = string_sprintf("%s/%s/%s%s",
2495 ratelimit_option_string[mode],
2496 unique == NULL ? "" : "unique/",
2500 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2502 /* See if we have already computed the rate by looking in the relevant tree.
2503 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2504 pool so that they survive across resets. In readonly mode we only remember the
2505 result for the rest of this command in case a later command changes it. After
2506 this bit of logic the code is independent of the per_* mode. */
2508 old_pool = store_pool;
2511 anchor = &ratelimiters_cmd;
2515 anchor = &ratelimiters_conn;
2516 store_pool = POOL_PERM;
2520 case RATE_PER_ALLRCPTS:
2521 anchor = &ratelimiters_mail;
2526 anchor = &ratelimiters_cmd;
2529 anchor = NULL; /* silence an "unused" complaint */
2530 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2531 "internal ACL error: unknown ratelimit mode %d", mode);
2535 if ((t = tree_search(*anchor, key)))
2538 /* The following few lines duplicate some of the code below. */
2539 rc = (dbd->rate < limit)? FAIL : OK;
2540 store_pool = old_pool;
2541 sender_rate = string_sprintf("%.1f", dbd->rate);
2543 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2547 /* We aren't using a pre-computed rate, so get a previously recorded rate
2548 from the database, which will be updated and written back if required. */
2550 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2552 store_pool = old_pool;
2554 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2555 *log_msgptr = US"ratelimit database not available";
2558 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2561 gettimeofday(&tv, NULL);
2565 /* Locate the basic ratelimit block inside the DB data. */
2566 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2569 /* Forget the old Bloom filter if it is too old, so that we count each
2570 repeating event once per period. We don't simply clear and re-use the old
2571 filter because we want its size to change if the limit changes. Note that
2572 we keep the dbd pointer for copying the rate into the new data block. */
2574 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2576 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2582 if(unique && dbdb_size < sizeof(*dbdb))
2584 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2589 /* Allocate a new data block if the database lookup failed
2590 or the Bloom filter passed its age limit. */
2596 /* No Bloom filter. This basic ratelimit block is initialized below. */
2597 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2598 dbdb_size = sizeof(*dbd);
2599 dbdb = store_get(dbdb_size, GET_UNTAINTED);
2604 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2606 /* See the long comment below for an explanation of the magic number 2.
2607 The filter has a minimum size in case the rate limit is very small;
2608 this is determined by the definition of dbdata_ratelimit_unique. */
2610 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2611 if (extra < 0) extra = 0;
2612 dbdb_size = sizeof(*dbdb) + extra;
2613 dbdb = store_get(dbdb_size, GET_UNTAINTED);
2614 dbdb->bloom_epoch = tv.tv_sec;
2615 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2616 memset(dbdb->bloom, 0, dbdb->bloom_size);
2618 /* Preserve any basic ratelimit data (which is our longer-term memory)
2619 by copying it from the discarded block. */
2629 /* If we are counting unique events, find out if this event is new or not.
2630 If the client repeats the event during the current period then it should be
2631 counted. We skip this code in readonly mode for efficiency, because any
2632 changes to the filter will be discarded and because count is already set to
2635 if (unique && !readonly)
2637 /* We identify unique events using a Bloom filter. (You can find my
2638 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2639 With the per_addr option, an "event" is a recipient address, though the
2640 user can use the unique option to define their own events. We only count
2641 an event if we have not seen it before.
2643 We size the filter according to the rate limit, which (in leaky mode)
2644 is the limit on the population of the filter. We allow 16 bits of space
2645 per entry (see the construction code above) and we set (up to) 8 of them
2646 when inserting an element (see the loop below). The probability of a false
2647 positive (an event we have not seen before but which we fail to count) is
2651 allzero = exp(-numhash * pop / size)
2652 = exp(-0.5 * pop / limit)
2653 fpr = pow(1 - allzero, numhash)
2655 For senders at the limit the fpr is 0.06% or 1 in 1700
2656 and for senders at half the limit it is 0.0006% or 1 in 170000
2658 In strict mode the Bloom filter can fill up beyond the normal limit, in
2659 which case the false positive rate will rise. This means that the
2660 measured rate for very fast senders can bogusly drop off after a while.
2662 At twice the limit, the fpr is 2.5% or 1 in 40
2663 At four times the limit, it is 31% or 1 in 3.2
2665 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2666 decay below the limit, and if this is more than one then the Bloom filter
2667 will be discarded before the decay gets that far. The false positive rate
2668 at this threshold is 9.3% or 1 in 10.7. */
2671 unsigned n, hash, hinc;
2675 /* Instead of using eight independent hash values, we combine two values
2676 using the formula h1 + n * h2. This does not harm the Bloom filter's
2677 performance, and means the amount of hash we need is independent of the
2678 number of bits we set in the filter. */
2680 md5_start(&md5info);
2681 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2682 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2683 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2685 /* Scan the bits corresponding to this event. A zero bit means we have
2686 not seen it before. Ensure all bits are set to record this event. */
2688 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2691 for (n = 0; n < 8; n++, hash += hinc)
2693 int bit = 1 << (hash % 8);
2694 int byte = (hash / 8) % dbdb->bloom_size;
2695 if ((dbdb->bloom[byte] & bit) == 0)
2697 dbdb->bloom[byte] |= bit;
2702 /* If this event has occurred before, do not count it. */
2706 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2710 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2713 /* If there was no previous ratelimit data block for this key, initialize
2714 the new one, otherwise update the block from the database. The initial rate
2715 is what would be computed by the code below for an infinite interval. */
2719 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2721 dbd->time_stamp = tv.tv_sec;
2722 dbd->time_usec = tv.tv_usec;
2727 /* The smoothed rate is computed using an exponentially weighted moving
2728 average adjusted for variable sampling intervals. The standard EWMA for
2729 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2730 where f() is the measured value and f'() is the smoothed value.
2732 Old data decays out of the smoothed value exponentially, such that data n
2733 samples old is multiplied by a^n. The exponential decay time constant p
2734 is defined such that data p samples old is multiplied by 1/e, which means
2735 that a = exp(-1/p). We can maintain the same time constant for a variable
2736 sampling interval i by using a = exp(-i/p).
2738 The rate we are measuring is messages per period, suitable for directly
2739 comparing with the limit. The average rate between now and the previous
2740 message is period / interval, which we feed into the EWMA as the sample.
2742 It turns out that the number of messages required for the smoothed rate
2743 to reach the limit when they are sent in a burst is equal to the limit.
2744 This can be seen by analysing the value of the smoothed rate after N
2745 messages sent at even intervals. Let k = (1 - a) * p/i
2747 rate_1 = (1 - a) * p/i + a * rate_0
2749 rate_2 = k + a * rate_1
2750 = k + a * k + a^2 * rate_0
2751 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2752 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2753 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2754 = rate_0 * a^N + p/i * (1 - a^N)
2756 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2758 rate_N = p/i + (rate_0 - p/i) * a^N
2759 a^N = (rate_N - p/i) / (rate_0 - p/i)
2760 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2761 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2763 Numerical analysis of the above equation, setting the computed rate to
2764 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2765 rates, p/i, the number of messages N = limit. So limit serves as both the
2766 maximum rate measured in messages per period, and the maximum number of
2767 messages that can be sent in a fast burst. */
2769 double this_time = (double)tv.tv_sec
2770 + (double)tv.tv_usec / 1000000.0;
2771 double prev_time = (double)dbd->time_stamp
2772 + (double)dbd->time_usec / 1000000.0;
2774 /* We must avoid division by zero, and deal gracefully with the clock going
2775 backwards. If we blunder ahead when time is in reverse then the computed
2776 rate will be bogus. To be safe we clamp interval to a very small number. */
2778 double interval = this_time - prev_time <= 0.0 ? 1e-9
2779 : this_time - prev_time;
2781 double i_over_p = interval / period;
2782 double a = exp(-i_over_p);
2784 /* Combine the instantaneous rate (period / interval) with the previous rate
2785 using the smoothing factor a. In order to measure sized events, multiply the
2786 instantaneous rate by the count of bytes or recipients etc. */
2788 dbd->time_stamp = tv.tv_sec;
2789 dbd->time_usec = tv.tv_usec;
2790 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2792 /* When events are very widely spaced the computed rate tends towards zero.
2793 Although this is accurate it turns out not to be useful for our purposes,
2794 especially when the first event after a long silence is the start of a spam
2795 run. A more useful model is that the rate for an isolated event should be the
2796 size of the event per the period size, ignoring the lack of events outside
2797 the current period and regardless of where the event falls in the period. So,
2798 if the interval was so long that the calculated rate is unhelpfully small, we
2799 re-initialize the rate. In the absence of higher-rate bursts, the condition
2800 below is true if the interval is greater than the period. */
2802 if (dbd->rate < count) dbd->rate = count;
2805 /* Clients sending at the limit are considered to be over the limit.
2806 This matters for edge cases such as a limit of zero, when the client
2807 should be completely blocked. */
2809 rc = dbd->rate < limit ? FAIL : OK;
2811 /* Update the state if the rate is low or if we are being strict. If we
2812 are in leaky mode and the sender's rate is too high, we do not update
2813 the recorded rate in order to avoid an over-aggressive sender's retry
2814 rate preventing them from getting any email through. If readonly is set,
2815 neither leaky nor strict are set, so we do not do any updates. */
2817 if ((rc == FAIL && leaky) || strict)
2819 dbfn_write(dbm, key, dbdb, dbdb_size);
2820 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2824 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2825 readonly? "readonly mode" : "over the limit, but leaky");
2830 /* Store the result in the tree for future reference. Take the taint status
2831 from the key for consistency even though it's unlikely we'll ever expand this. */
2833 t = store_get(sizeof(tree_node) + Ustrlen(key), key);
2835 Ustrcpy(t->name, key);
2836 (void)tree_insertnode(anchor, t);
2838 /* We create the formatted version of the sender's rate very late in
2839 order to ensure that it is done using the correct storage pool. */
2841 store_pool = old_pool;
2842 sender_rate = string_sprintf("%.1f", dbd->rate);
2845 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2852 /*************************************************
2853 * Handle a check for previously-seen *
2854 *************************************************/
2857 ACL clauses like: seen = -5m / key=$foo / readonly
2859 Return is true for condition-true - but the semantics
2860 depend heavily on the actual use-case.
2862 Negative times test for seen-before, positive for seen-more-recently-than
2863 (the given interval before current time).
2865 All are subject to history not having been cleaned from the DB.
2867 Default for seen-before is to create if not present, and to
2868 update if older than 10d (with the seen-test time).
2869 Default for seen-since is to always create or update.
2872 key=value. Default key is $sender_host_address
2875 refresh=<interval>: update an existing DB entry older than given
2876 amount. Default refresh lacking this option is 10d.
2877 The update sets the record timestamp to the seen-test time.
2879 XXX do we need separate nocreate, noupdate controls?
2882 arg the option string for seen=
2883 where ACL_WHERE_xxxx indicating which ACL this is
2884 log_msgptr for error messages
2886 Returns: OK - Condition is true
2887 FAIL - Condition is false
2888 DEFER - Problem opening history database
2889 ERROR - Syntax error in options
2893 acl_seen(const uschar * arg, int where, uschar ** log_msgptr)
2895 enum { SEEN_DEFAULT, SEEN_READONLY, SEEN_WRITE };
2897 const uschar * list = arg;
2898 int slash = '/', interval, mode = SEEN_DEFAULT, yield = FAIL;
2900 int refresh = 10 * 24 * 60 * 60; /* 10 days */
2901 const uschar * ele, * key = sender_host_address;
2902 open_db dbblock, * dbm;
2906 /* Parse the first element, the time-relation. */
2908 if (!(ele = string_nextinlist(&list, &slash, NULL, 0)))
2910 if ((before = *ele == '-'))
2912 if ((interval = readconf_readtime(ele, 0, FALSE)) < 0)
2915 /* Remaining elements are options */
2917 while ((ele = string_nextinlist(&list, &slash, NULL, 0)))
2918 if (Ustrncmp(ele, "key=", 4) == 0)
2920 else if (Ustrcmp(ele, "readonly") == 0)
2921 mode = SEEN_READONLY;
2922 else if (Ustrcmp(ele, "write") == 0)
2924 else if (Ustrncmp(ele, "refresh=", 8) == 0)
2926 if ((refresh = readconf_readtime(ele + 8, 0, FALSE)) < 0)
2932 if (!(dbm = dbfn_open(US"seen", O_RDWR, &dbblock, TRUE, TRUE)))
2934 HDEBUG(D_acl) debug_printf_indent("database for 'seen' not available\n");
2935 *log_msgptr = US"database for 'seen' not available";
2939 dbd = dbfn_read_with_length(dbm, key, NULL);
2941 if (dbd) /* an existing record */
2943 time_t diff = now - dbd->time_stamp; /* time since the record was written */
2945 if (before ? diff >= interval : diff < interval)
2948 if (mode == SEEN_READONLY)
2949 { HDEBUG(D_acl) debug_printf_indent("seen db not written (readonly)\n"); }
2950 else if (mode == SEEN_WRITE || !before)
2952 dbd->time_stamp = now;
2953 dbfn_write(dbm, key, dbd, sizeof(*dbd));
2954 HDEBUG(D_acl) debug_printf_indent("seen db written (update)\n");
2956 else if (diff >= refresh)
2958 dbd->time_stamp = now - interval;
2959 dbfn_write(dbm, key, dbd, sizeof(*dbd));
2960 HDEBUG(D_acl) debug_printf_indent("seen db written (refresh)\n");
2964 { /* No record found, yield always FAIL */
2965 if (mode != SEEN_READONLY)
2967 dbdata_seen d = {.time_stamp = now};
2968 dbfn_write(dbm, key, &d, sizeof(*dbd));
2969 HDEBUG(D_acl) debug_printf_indent("seen db written (create)\n");
2972 HDEBUG(D_acl) debug_printf_indent("seen db not written (readonly)\n");
2980 *log_msgptr = string_sprintf("failed to parse '%s'", arg);
2983 *log_msgptr = string_sprintf("unrecognised option '%s' in '%s'", ele, arg);
2989 /*************************************************
2990 * The udpsend ACL modifier *
2991 *************************************************/
2993 /* Called by acl_check_condition() below.
2996 arg the option string for udpsend=
2997 log_msgptr for error messages
2999 Returns: OK - Completed.
3000 DEFER - Problem with DNS lookup.
3001 ERROR - Syntax error in options.
3005 acl_udpsend(const uschar *arg, uschar **log_msgptr)
3017 hostname = string_nextinlist(&arg, &sep, NULL, 0);
3018 portstr = string_nextinlist(&arg, &sep, NULL, 0);
3022 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
3027 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
3032 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
3035 portnum = Ustrtol(portstr, &portend, 10);
3036 if (*portend != '\0')
3038 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
3042 /* Make a single-item host list. */
3043 h = store_get(sizeof(host_item), GET_UNTAINTED);
3044 memset(h, 0, sizeof(host_item));
3049 if (string_is_ip_address(hostname, NULL))
3050 h->address = hostname, r = HOST_FOUND;
3052 r = host_find_byname(h, NULL, 0, NULL, FALSE);
3053 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
3055 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
3060 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
3062 /*XXX this could better use sendto */
3063 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
3064 1, NULL, &errstr, NULL);
3065 if (r < 0) goto defer;
3067 r = send(s, arg, len, 0);
3070 errstr = US strerror(errno);
3078 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
3083 debug_printf_indent("udpsend %d bytes\n", r);
3088 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
3094 /*************************************************
3095 * Handle conditions/modifiers on an ACL item *
3096 *************************************************/
3098 /* Called from acl_check() below.
3102 cb ACL condition block - if NULL, result is OK
3103 where where called from
3104 addr the address being checked for RCPT, or NULL
3105 level the nesting level
3106 epp pointer to pass back TRUE if "endpass" encountered
3107 (applies only to "accept" and "discard")
3108 user_msgptr user message pointer
3109 log_msgptr log message pointer
3110 basic_errno pointer to where to put verify error
3112 Returns: OK - all conditions are met
3113 DISCARD - an "acl" condition returned DISCARD - only allowed
3114 for "accept" or "discard" verbs
3115 FAIL - at least one condition fails
3116 FAIL_DROP - an "acl" condition returned FAIL_DROP
3117 DEFER - can't tell at the moment (typically, lookup defer,
3118 but can be temporary callout problem)
3119 ERROR - ERROR from nested ACL or expansion failure or other
3124 acl_check_condition(int verb, acl_condition_block *cb, int where,
3125 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
3126 uschar **log_msgptr, int *basic_errno)
3128 uschar *user_message = NULL;
3129 uschar *log_message = NULL;
3131 #ifdef WITH_CONTENT_SCAN
3135 for (; cb; cb = cb->next)
3139 BOOL textonly = FALSE;
3141 /* The message and log_message items set up messages to be used in
3142 case of rejection. They are expanded later. */
3144 if (cb->type == ACLC_MESSAGE)
3146 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
3147 user_message = cb->arg;
3151 if (cb->type == ACLC_LOG_MESSAGE)
3153 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
3154 log_message = cb->arg;
3158 /* The endpass "condition" just sets a flag to show it occurred. This is
3159 checked at compile time to be on an "accept" or "discard" item. */
3161 if (cb->type == ACLC_ENDPASS)
3167 /* For other conditions and modifiers, the argument is expanded now for some
3168 of them, but not for all, because expansion happens down in some lower level
3169 checking functions in some cases. */
3171 if (!conditions[cb->type].expand_at_top)
3174 else if (!(arg = expand_string_2(cb->arg, &textonly)))
3176 if (f.expand_string_forcedfail) continue;
3177 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3178 cb->arg, expand_string_message);
3179 return f.search_find_defer ? DEFER : ERROR;
3182 /* Show condition, and expanded condition if it's different */
3187 debug_printf_indent("check %s%s %n",
3188 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
3189 conditions[cb->type].name, &lhswidth);
3191 if (cb->type == ACLC_SET)
3193 #ifndef DISABLE_DKIM
3194 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
3195 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3197 debug_printf("%s ", cb->u.varname);
3203 debug_printf("acl_%s ", cb->u.varname);
3204 lhswidth += 5 + Ustrlen(cb->u.varname);
3208 debug_printf("= %s\n", cb->arg);
3211 debug_printf("%.*s= %s\n", lhswidth,
3215 /* Check that this condition makes sense at this time */
3217 if ((conditions[cb->type].forbids & (1 << where)) != 0)
3219 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3220 conditions[cb->type].is_modifier ? "use" : "test",
3221 conditions[cb->type].name, acl_wherenames[where]);
3225 /* Run the appropriate test for each condition, or take the appropriate
3226 action for the remaining modifiers. */
3230 case ACLC_ADD_HEADER:
3234 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3238 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
3239 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3241 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3242 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3248 case ACLC_AUTHENTICATED:
3249 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
3250 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
3253 #ifdef EXPERIMENTAL_BRIGHTMAIL
3254 case ACLC_BMI_OPTIN:
3256 int old_pool = store_pool;
3257 store_pool = POOL_PERM;
3258 bmi_current_optin = string_copy(arg);
3259 store_pool = old_pool;
3264 case ACLC_CONDITION:
3265 /* The true/false parsing here should be kept in sync with that used in
3266 expand.c when dealing with ECOND_BOOL so that we don't have too many
3267 different definitions of what can be a boolean. */
3269 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3270 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3271 rc = (Uatoi(arg) == 0)? FAIL : OK;
3273 rc = (strcmpic(arg, US"no") == 0 ||
3274 strcmpic(arg, US"false") == 0)? FAIL :
3275 (strcmpic(arg, US"yes") == 0 ||
3276 strcmpic(arg, US"true") == 0)? OK : DEFER;
3278 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3281 case ACLC_CONTINUE: /* Always succeeds */
3286 const uschar *p = NULL;
3287 control_type = decode_control(arg, &p, where, log_msgptr);
3289 /* Check if this control makes sense at this time */
3291 if (controls_list[control_type].forbids & (1 << where))
3293 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3294 controls_list[control_type].name, acl_wherenames[where]);
3298 switch(control_type)
3300 case CONTROL_AUTH_UNADVERTISED:
3301 f.allow_auth_unadvertised = TRUE;
3304 #ifdef EXPERIMENTAL_BRIGHTMAIL
3305 case CONTROL_BMI_RUN:
3310 #ifndef DISABLE_DKIM
3311 case CONTROL_DKIM_VERIFY:
3312 f.dkim_disable_verify = TRUE;
3313 # ifdef SUPPORT_DMARC
3314 /* Since DKIM was blocked, skip DMARC too */
3315 f.dmarc_disable_verify = TRUE;
3316 f.dmarc_enable_forensic = FALSE;
3321 #ifdef SUPPORT_DMARC
3322 case CONTROL_DMARC_VERIFY:
3323 f.dmarc_disable_verify = TRUE;
3326 case CONTROL_DMARC_FORENSIC:
3327 f.dmarc_enable_forensic = TRUE;
3334 int fd, af, level, optname, value;
3335 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3336 a socket; we can accept that, we'll just debug-log failures anyway. */
3337 fd = fileno(smtp_in);
3338 if ((af = ip_get_address_family(fd)) < 0)
3341 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3345 if (dscp_lookup(p+1, af, &level, &optname, &value))
3346 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3348 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3349 p+1, strerror(errno));
3353 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3357 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3363 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3371 case CONTROL_CASEFUL_LOCAL_PART:
3372 deliver_localpart = addr->cc_local_part;
3375 case CONTROL_CASELOWER_LOCAL_PART:
3376 deliver_localpart = addr->lc_local_part;
3379 case CONTROL_ENFORCE_SYNC:
3380 smtp_enforce_sync = TRUE;
3383 case CONTROL_NO_ENFORCE_SYNC:
3384 smtp_enforce_sync = FALSE;
3387 #ifdef WITH_CONTENT_SCAN
3388 case CONTROL_NO_MBOX_UNSPOOL:
3389 f.no_mbox_unspool = TRUE;
3393 case CONTROL_NO_MULTILINE:
3394 f.no_multiline_responses = TRUE;
3397 case CONTROL_NO_PIPELINING:
3398 f.pipelining_enable = FALSE;
3401 case CONTROL_NO_DELAY_FLUSH:
3402 f.disable_delay_flush = TRUE;
3405 case CONTROL_NO_CALLOUT_FLUSH:
3406 f.disable_callout_flush = TRUE;
3409 case CONTROL_FAKEREJECT:
3410 cancel_cutthrough_connection(TRUE, US"fakereject");
3411 case CONTROL_FAKEDEFER:
3412 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3415 const uschar *pp = p + 1;
3417 /* The entire control= line was expanded at top so no need to expand
3418 the part after the / */
3419 fake_response_text = string_copyn(p+1, pp-p-1);
3422 else /* Explicitly reset to default string */
3423 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3426 case CONTROL_FREEZE:
3427 f.deliver_freeze = TRUE;
3428 deliver_frozen_at = time(NULL);
3429 freeze_tell = freeze_tell_config; /* Reset to configured value */
3430 if (Ustrncmp(p, "/no_tell", 8) == 0)
3437 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3440 cancel_cutthrough_connection(TRUE, US"item frozen");
3444 f.queue_only_policy = TRUE;
3445 if (Ustrcmp(p, "_only") == 0)
3447 else while (*p == '/')
3448 if (Ustrncmp(p, "/only", 5) == 0)
3449 { p += 5; f.queue_smtp = FALSE; }
3450 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3451 { p += 17; f.queue_smtp = TRUE; }
3454 cancel_cutthrough_connection(TRUE, US"queueing forced");
3457 case CONTROL_SUBMISSION:
3458 originator_name = US"";
3459 f.submission_mode = TRUE;
3462 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3465 f.active_local_sender_retain = TRUE;
3466 f.active_local_from_check = FALSE;
3468 else if (Ustrncmp(p, "/domain=", 8) == 0)
3470 const uschar *pp = p + 8;
3471 while (*pp && *pp != '/') pp++;
3472 submission_domain = string_copyn(p+8, pp-p-8);
3475 /* The name= option must be last, because it swallows the rest of
3477 else if (Ustrncmp(p, "/name=", 6) == 0)
3479 const uschar *pp = p + 6;
3481 submission_name = parse_fix_phrase(p+6, pp-p-6);
3488 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3495 uschar * debug_tag = NULL, * debug_opts = NULL;
3496 BOOL kill = FALSE, stop = FALSE;
3500 const uschar * pp = p+1;
3501 if (Ustrncmp(pp, "tag=", 4) == 0)
3503 for (pp += 4; *pp && *pp != '/';) pp++;
3504 debug_tag = string_copyn(p+5, pp-p-5);
3506 else if (Ustrncmp(pp, "opts=", 5) == 0)
3508 for (pp += 5; *pp && *pp != '/';) pp++;
3509 debug_opts = string_copyn(p+6, pp-p-6);
3511 else if (Ustrncmp(pp, "kill", 4) == 0)
3516 else if (Ustrncmp(pp, "stop", 4) == 0)
3521 else if (Ustrncmp(pp, "pretrigger=", 11) == 0)
3522 debug_pretrigger_setup(pp+11);
3523 else if (Ustrncmp(pp, "trigger=", 8) == 0)
3525 if (Ustrncmp(pp += 8, "now", 3) == 0)
3528 debug_trigger_fire();
3530 else if (Ustrncmp(pp, "paniclog", 8) == 0)
3533 dtrigger_selector |= BIT(DTi_panictrigger);
3536 while (*pp && *pp != '/') pp++;
3541 debug_logging_stop(TRUE);
3543 debug_logging_stop(FALSE);
3544 else if (debug_tag || debug_opts)
3545 debug_logging_activate(debug_tag, debug_opts);
3549 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3550 f.suppress_local_fixups = TRUE;
3553 case CONTROL_CUTTHROUGH_DELIVERY:
3555 uschar * ignored = NULL;
3556 #ifndef DISABLE_PRDR
3561 /* Too hard to think about for now. We might in future cutthrough
3562 the case where both sides handle prdr and this-node prdr acl
3564 ignored = US"PRDR active";
3565 else if (f.deliver_freeze)
3566 ignored = US"frozen";
3567 else if (f.queue_only_policy)
3568 ignored = US"queue-only";
3569 else if (fake_response == FAIL)
3570 ignored = US"fakereject";
3571 else if (rcpt_count != 1)
3572 ignored = US"nonfirst rcpt";
3573 else if (cutthrough.delivery)
3574 ignored = US"repeated";
3575 else if (cutthrough.callout_hold_only)
3578 debug_printf_indent(" cutthrough request upgrades callout hold\n");
3579 cutthrough.callout_hold_only = FALSE;
3580 cutthrough.delivery = TRUE; /* control accepted */
3584 cutthrough.delivery = TRUE; /* control accepted */
3587 const uschar * pp = p+1;
3588 if (Ustrncmp(pp, "defer=", 6) == 0)
3591 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3592 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3595 while (*pp && *pp != '/') pp++;
3600 DEBUG(D_acl) if (ignored)
3601 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3606 case CONTROL_UTF8_DOWNCONVERT:
3611 message_utf8_downconvert = 1;
3612 addr->prop.utf8_downcvt = TRUE;
3613 addr->prop.utf8_downcvt_maybe = FALSE;
3619 message_utf8_downconvert = 0;
3620 addr->prop.utf8_downcvt = FALSE;
3621 addr->prop.utf8_downcvt_maybe = FALSE;
3625 if (p[1] == '-' && p[2] == '1')
3627 message_utf8_downconvert = -1;
3628 addr->prop.utf8_downcvt = FALSE;
3629 addr->prop.utf8_downcvt_maybe = TRUE;
3633 *log_msgptr = US"bad option value for control=utf8_downconvert";
3637 message_utf8_downconvert = 1;
3638 addr->prop.utf8_downcvt = TRUE;
3639 addr->prop.utf8_downcvt_maybe = FALSE;
3649 #ifdef EXPERIMENTAL_DCC
3652 /* Separate the regular expression and any optional parameters. */
3653 const uschar * list = arg;
3654 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3655 /* Run the dcc backend. */
3656 rc = dcc_process(&ss);
3657 /* Modify return code based upon the existence of options. */
3658 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3659 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3660 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3665 #ifdef WITH_CONTENT_SCAN
3667 rc = mime_decode(&arg);
3673 int delay = readconf_readtime(arg, 0, FALSE);
3676 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3677 "modifier: \"%s\" is not a time value", arg);
3682 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3687 debug_printf_indent("delay skipped in -bh checking mode\n");
3690 /* NOTE 1: Remember that we may be
3691 dealing with stdin/stdout here, in addition to TCP/IP connections.
3692 Also, delays may be specified for non-SMTP input, where smtp_out and
3693 smtp_in will be NULL. Whatever is done must work in all cases.
3695 NOTE 2: The added feature of flushing the output before a delay must
3696 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3701 if (smtp_out && !f.disable_delay_flush)
3704 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3710 p.fd = fileno(smtp_out);
3711 p.events = POLLRDHUP;
3714 if (poll(&p, n, delay*1000) > 0)
3715 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3718 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3719 TCP/IP connection has gone away without reading from it. This means
3720 that we cannot shorten the delay below if the client goes away,
3721 because we cannot discover that the client has closed its end of the
3722 connection. (The connection is actually in a half-closed state,
3723 waiting for the server to close its end.) It would be nice to be able
3724 to detect this state, so that the Exim process is not held up
3725 unnecessarily. However, it seems that we can't. The poll() function
3726 does not do the right thing, and in any case it is not always
3729 while (delay > 0) delay = sleep(delay);
3736 #ifndef DISABLE_DKIM
3737 case ACLC_DKIM_SIGNER:
3738 if (dkim_cur_signer)
3739 rc = match_isinlist(dkim_cur_signer,
3740 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3745 case ACLC_DKIM_STATUS:
3746 rc = match_isinlist(dkim_verify_status,
3747 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3751 #ifdef SUPPORT_DMARC
3752 case ACLC_DMARC_STATUS:
3753 if (!f.dmarc_has_been_checked)
3755 f.dmarc_has_been_checked = TRUE;
3756 /* used long way of dmarc_exim_expand_query() in case we need more
3757 * view into the process in the future. */
3758 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3759 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3764 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3768 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3769 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3772 /* The value in tls_cipher is the full cipher name, for example,
3773 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3774 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3775 what may in practice come out of the SSL library - which at the time of
3776 writing is poorly documented. */
3778 case ACLC_ENCRYPTED:
3779 if (!tls_in.cipher) rc = FAIL;
3782 uschar *endcipher = NULL;
3783 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3784 if (!cipher) cipher = tls_in.cipher; else
3786 endcipher = Ustrchr(++cipher, ':');
3787 if (endcipher) *endcipher = 0;
3789 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3790 if (endcipher) *endcipher = ':';
3794 /* Use verify_check_this_host() instead of verify_check_host() so that
3795 we can pass over &host_data to catch any looked up data. Once it has been
3796 set, it retains its value so that it's still there if another ACL verb
3797 comes through here and uses the cache. However, we must put it into
3798 permanent store in case it is also expected to be used in a subsequent
3799 message in the same SMTP connection. */
3802 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3803 sender_host_address ? sender_host_address : US"", CUSS &host_data);
3804 if (rc == DEFER) *log_msgptr = search_error_message;
3805 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3808 case ACLC_LOCAL_PARTS:
3809 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3810 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3811 CUSS &deliver_localpart_data);
3814 case ACLC_LOG_REJECT_TARGET:
3818 const uschar *s = arg;
3820 while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
3822 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3823 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3824 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3827 logbits |= LOG_MAIN|LOG_REJECT;
3828 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3829 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3832 log_reject_target = logbits;
3839 const uschar *s = arg;
3845 if (Ustrncmp(s, "main", 4) == 0)
3846 { logbits |= LOG_MAIN; s += 4; }
3847 else if (Ustrncmp(s, "panic", 5) == 0)
3848 { logbits |= LOG_PANIC; s += 5; }
3849 else if (Ustrncmp(s, "reject", 6) == 0)
3850 { logbits |= LOG_REJECT; s += 6; }
3853 logbits = LOG_MAIN|LOG_PANIC;
3854 s = string_sprintf(":unknown log name in \"%s\" in "
3855 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3861 while (isspace(*s)) s++;
3863 if (logbits == 0) logbits = LOG_MAIN;
3864 log_write(0, logbits, "%s", string_printing(s));
3868 #ifdef WITH_CONTENT_SCAN
3869 case ACLC_MALWARE: /* Run the malware backend. */
3871 /* Separate the regular expression and any optional parameters. */
3872 const uschar * list = arg;
3873 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3875 BOOL defer_ok = FALSE;
3878 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3879 if (strcmpic(opt, US"defer_ok") == 0)
3881 else if ( strncmpic(opt, US"tmo=", 4) == 0
3882 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3885 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3889 rc = malware(ss, textonly, timeout);
3890 if (rc == DEFER && defer_ok)
3891 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3895 case ACLC_MIME_REGEX:
3896 rc = mime_regex(&arg, textonly);
3901 if (is_tainted(arg))
3903 *log_msgptr = string_sprintf("Tainted name '%s' for queue not permitted",
3907 if (Ustrchr(arg, '/'))
3909 *log_msgptr = string_sprintf(
3910 "Directory separator not permitted in queue name: '%s'", arg);
3913 queue_name = string_copy_perm(arg, FALSE);
3916 case ACLC_RATELIMIT:
3917 rc = acl_ratelimit(arg, where, log_msgptr);
3920 case ACLC_RECIPIENTS:
3921 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3922 CUSS &recipient_data);
3925 #ifdef WITH_CONTENT_SCAN
3927 rc = regex(&arg, textonly);
3931 case ACLC_REMOVE_HEADER:
3932 setup_remove_header(arg);
3936 rc = acl_seen(arg, where, log_msgptr);
3939 case ACLC_SENDER_DOMAINS:
3942 sdomain = Ustrrchr(sender_address, '@');
3943 sdomain = sdomain ? sdomain + 1 : US"";
3944 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3945 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3950 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3951 sender_address_cache, -1, 0, CUSS &sender_data);
3954 /* Connection variables must persist forever; message variables not */
3958 int old_pool = store_pool;
3959 if ( cb->u.varname[0] != 'm'
3960 #ifndef DISABLE_EVENT
3961 || event_name /* An event is being delivered */
3964 store_pool = POOL_PERM;
3965 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3966 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3967 dkim_verify_status = string_copy(arg);
3968 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3969 dkim_verify_reason = string_copy(arg);
3972 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3973 store_pool = old_pool;
3977 #ifdef WITH_CONTENT_SCAN
3980 /* Separate the regular expression and any optional parameters. */
3981 const uschar * list = arg;
3982 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3984 rc = spam(CUSS &ss);
3985 /* Modify return code based upon the existence of options. */
3986 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3987 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3988 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3995 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3998 case ACLC_SPF_GUESS:
3999 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
4004 rc = acl_udpsend(arg, log_msgptr);
4007 /* If the verb is WARN, discard any user message from verification, because
4008 such messages are SMTP responses, not header additions. The latter come
4009 only from explicit "message" modifiers. However, put the user message into
4010 $acl_verify_message so it can be used in subsequent conditions or modifiers
4011 (until something changes it). */
4014 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
4016 acl_verify_message = *user_msgptr;
4017 if (verb == ACL_WARN) *user_msgptr = NULL;
4021 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
4022 "condition %d", cb->type);
4026 /* If a condition was negated, invert OK/FAIL. */
4028 if (!conditions[cb->type].is_modifier && cb->u.negated)
4029 if (rc == OK) rc = FAIL;
4030 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
4032 if (rc != OK) break; /* Conditions loop */
4036 /* If the result is the one for which "message" and/or "log_message" are used,
4037 handle the values of these modifiers. If there isn't a log message set, we make
4038 it the same as the user message.
4040 "message" is a user message that will be included in an SMTP response. Unless
4041 it is empty, it overrides any previously set user message.
4043 "log_message" is a non-user message, and it adds to any existing non-user
4044 message that is already set.
4046 Most verbs have but a single return for which the messages are relevant, but
4047 for "discard", it's useful to have the log message both when it succeeds and
4048 when it fails. For "accept", the message is used in the OK case if there is no
4049 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
4052 if (*epp && rc == OK) user_message = NULL;
4054 if ((BIT(rc) & msgcond[verb]) != 0)
4057 uschar *old_user_msgptr = *user_msgptr;
4058 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
4060 /* If the verb is "warn", messages generated by conditions (verification or
4061 nested ACLs) are always discarded. This also happens for acceptance verbs
4062 when they actually do accept. Only messages specified at this level are used.
4063 However, the value of an existing message is available in $acl_verify_message
4064 during expansions. */
4066 if (verb == ACL_WARN ||
4067 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
4068 *log_msgptr = *user_msgptr = NULL;
4072 acl_verify_message = old_user_msgptr;
4073 expmessage = expand_string(user_message);
4076 if (!f.expand_string_forcedfail)
4077 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
4078 user_message, expand_string_message);
4080 else if (expmessage[0] != 0) *user_msgptr = expmessage;
4085 acl_verify_message = old_log_msgptr;
4086 expmessage = expand_string(log_message);
4089 if (!f.expand_string_forcedfail)
4090 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
4091 log_message, expand_string_message);
4093 else if (expmessage[0] != 0)
4095 *log_msgptr = (*log_msgptr == NULL)? expmessage :
4096 string_sprintf("%s: %s", expmessage, *log_msgptr);
4100 /* If no log message, default it to the user message */
4102 if (!*log_msgptr) *log_msgptr = *user_msgptr;
4105 acl_verify_message = NULL;
4113 /*************************************************
4114 * Get line from a literal ACL *
4115 *************************************************/
4117 /* This function is passed to acl_read() in order to extract individual lines
4118 of a literal ACL, which we access via static pointers. We can destroy the
4119 contents because this is called only once (the compiled ACL is remembered).
4121 This code is intended to treat the data in the same way as lines in the main
4122 Exim configuration file. That is:
4124 . Leading spaces are ignored.
4126 . A \ at the end of a line is a continuation - trailing spaces after the \
4127 are permitted (this is because I don't believe in making invisible things
4128 significant). Leading spaces on the continued part of a line are ignored.
4130 . Physical lines starting (significantly) with # are totally ignored, and
4131 may appear within a sequence of backslash-continued lines.
4133 . Blank lines are ignored, but will end a sequence of continuations.
4136 Returns: a pointer to the next line
4140 static uschar *acl_text; /* Current pointer in the text */
4141 static uschar *acl_text_end; /* Points one past the terminating '0' */
4149 /* This loop handles leading blank lines and comments. */
4153 Uskip_whitespace(&acl_text); /* Leading spaces/empty lines */
4154 if (!*acl_text) return NULL; /* No more data */
4155 yield = acl_text; /* Potential data line */
4157 while (*acl_text && *acl_text != '\n') acl_text++;
4159 /* If we hit the end before a newline, we have the whole logical line. If
4160 it's a comment, there's no more data to be given. Otherwise, yield it. */
4162 if (!*acl_text) return *yield == '#' ? NULL : yield;
4164 /* After reaching a newline, end this loop if the physical line does not
4165 start with '#'. If it does, it's a comment, and the loop continues. */
4167 if (*yield != '#') break;
4170 /* This loop handles continuations. We know we have some real data, ending in
4171 newline. See if there is a continuation marker at the end (ignoring trailing
4172 white space). We know that *yield is not white space, so no need to test for
4173 cont > yield in the backwards scanning loop. */
4178 for (cont = acl_text - 1; isspace(*cont); cont--);
4180 /* If no continuation follows, we are done. Mark the end of the line and
4189 /* We have encountered a continuation. Skip over whitespace at the start of
4190 the next line, and indeed the whole of the next line or lines if they are
4195 while (*(++acl_text) == ' ' || *acl_text == '\t');
4196 if (*acl_text != '#') break;
4197 while (*(++acl_text) != 0 && *acl_text != '\n');
4200 /* We have the start of a continuation line. Move all the rest of the data
4201 to join onto the previous line, and then find its end. If the end is not a
4202 newline, we are done. Otherwise loop to look for another continuation. */
4204 memmove(cont, acl_text, acl_text_end - acl_text);
4205 acl_text_end -= acl_text - cont;
4207 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
4208 if (*acl_text == 0) return yield;
4211 /* Control does not reach here */
4218 /************************************************/
4219 /* For error messages, a string describing the config location
4220 associated with current processing. NULL if not in an ACL. */
4223 acl_current_verb(void)
4225 if (acl_current) return string_sprintf(" (ACL %s, %s %d)",
4226 verbs[acl_current->verb], acl_current->srcfile, acl_current->srcline);
4230 /*************************************************
4231 * Check access using an ACL *
4232 *************************************************/
4234 /* This function is called from address_check. It may recurse via
4235 acl_check_condition() - hence the use of a level to stop looping. The ACL is
4236 passed as a string which is expanded. A forced failure implies no access check
4237 is required. If the result is a single word, it is taken as the name of an ACL
4238 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4239 text, complete with newlines, and parsed as such. In both cases, the ACL check
4240 is then run. This function uses an auxiliary function for acl_read() to call
4241 for reading individual lines of a literal ACL. This is acl_getline(), which
4242 appears immediately above.
4245 where where called from
4246 addr address item when called from RCPT; otherwise NULL
4247 s the input string; NULL is the same as an empty ACL => DENY
4248 user_msgptr where to put a user error (for SMTP response)
4249 log_msgptr where to put a logging message (not for SMTP response)
4251 Returns: OK access is granted
4252 DISCARD access is apparently granted...
4253 FAIL access is denied
4254 FAIL_DROP access is denied; drop the connection
4255 DEFER can't tell at the moment
4260 acl_check_internal(int where, address_item *addr, uschar *s,
4261 uschar **user_msgptr, uschar **log_msgptr)
4264 acl_block *acl = NULL;
4265 uschar *acl_name = US"inline ACL";
4268 /* Catch configuration loops */
4272 *log_msgptr = US"ACL nested too deep: possible loop";
4278 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
4282 /* At top level, we expand the incoming string. At lower levels, it has already
4283 been expanded as part of condition processing. */
4287 if (!(ss = expand_string(s)))
4289 if (f.expand_string_forcedfail) return OK;
4290 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4291 expand_string_message);
4297 while (isspace(*ss)) ss++;
4299 /* If we can't find a named ACL, the default is to parse it as an inline one.
4300 (Unless it begins with a slash; non-existent files give rise to an error.) */
4304 if (is_tainted(acl_text) && !f.running_in_test_harness)
4306 log_write(0, LOG_MAIN|LOG_PANIC,
4307 "attempt to use tainted ACL text \"%s\"", acl_text);
4308 /* Avoid leaking info to an attacker */
4309 *log_msgptr = US"internal configuration error";
4313 /* Handle the case of a string that does not contain any spaces. Look for a
4314 named ACL among those read from the configuration, or a previously read file.
4315 It is possible that the pointer to the ACL is NULL if the configuration
4316 contains a name with no data. If not found, and the text begins with '/',
4317 read an ACL from a file, and save it so it can be re-used. */
4319 if (Ustrchr(ss, ' ') == NULL)
4321 tree_node * t = tree_search(acl_anchor, ss);
4324 if (!(acl = (acl_block *)(t->data.ptr)))
4326 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
4329 acl_name = string_sprintf("ACL \"%s\"", ss);
4330 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
4333 else if (*ss == '/')
4335 struct stat statbuf;
4336 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4338 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4342 if (fstat(fd, &statbuf) != 0)
4344 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4349 /* If the string being used as a filename is tainted, so is the file content */
4350 acl_text = store_get(statbuf.st_size + 1, ss);
4351 acl_text_end = acl_text + statbuf.st_size + 1;
4353 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4355 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4356 ss, strerror(errno));
4359 acl_text[statbuf.st_size] = 0;
4362 acl_name = string_sprintf("ACL \"%s\"", ss);
4363 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4367 /* Parse an ACL that is still in text form. If it came from a file, remember it
4368 in the ACL tree, having read it into the POOL_PERM store pool so that it
4369 persists between multiple messages. */
4373 int old_pool = store_pool;
4374 if (fd >= 0) store_pool = POOL_PERM;
4375 acl = acl_read(acl_getline, log_msgptr);
4376 store_pool = old_pool;
4377 if (!acl && *log_msgptr) return ERROR;
4380 tree_node * t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), ss);
4381 Ustrcpy(t->name, ss);
4383 (void)tree_insertnode(&acl_anchor, t);
4387 /* Now we have an ACL to use. It's possible it may be NULL. */
4389 while ((acl_current = acl))
4392 int basic_errno = 0;
4393 BOOL endpass_seen = FALSE;
4394 BOOL acl_quit_check = acl_level == 0
4395 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4397 *log_msgptr = *user_msgptr = NULL;
4398 f.acl_temp_details = FALSE;
4400 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4401 verbs[acl->verb], acl->srcfile, acl->srcline);
4403 /* Clear out any search error message from a previous check before testing
4406 search_error_message = NULL;
4407 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4408 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4410 /* Handle special returns: DEFER causes a return except on a WARN verb;
4411 ERROR always causes a return. */
4416 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4417 verbs[acl->verb], acl_name);
4418 if (basic_errno != ERRNO_CALLOUTDEFER)
4420 if (search_error_message != NULL && *search_error_message != 0)
4421 *log_msgptr = search_error_message;
4422 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4425 f.acl_temp_details = TRUE;
4426 if (acl->verb != ACL_WARN) return DEFER;
4429 default: /* Paranoia */
4431 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4432 verbs[acl->verb], acl_name);
4436 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4437 verbs[acl->verb], acl_name);
4441 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4442 verbs[acl->verb], acl_name);
4445 /* DISCARD and DROP can happen only from a nested ACL condition, and
4446 DISCARD can happen only for an "accept" or "discard" verb. */
4449 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4450 verbs[acl->verb], acl_name);
4454 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4455 verbs[acl->verb], acl_name);
4459 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4460 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4461 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4466 if (cond == OK || cond == DISCARD)
4468 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4473 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4481 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4482 if (acl_quit_check) goto badquit;
4483 f.acl_temp_details = TRUE;
4491 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4492 if (acl_quit_check) goto badquit;
4498 if (cond == OK || cond == DISCARD)
4500 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4501 if (acl_quit_check) goto badquit;
4507 debug_printf_indent("discard: endpass encountered - denying access\n");
4515 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4516 if (acl_quit_check) goto badquit;
4524 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4525 if (acl_quit_check) goto badquit;
4532 acl_warn(where, *user_msgptr, *log_msgptr);
4533 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4534 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4535 "condition test deferred%s%s", host_and_ident(TRUE),
4536 *log_msgptr ? US": " : US"",
4537 *log_msgptr ? *log_msgptr : US"");
4538 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4542 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4547 /* Pass to the next ACL item */
4552 /* We have reached the end of the ACL. This is an implicit DENY. */
4554 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4558 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4559 "('%s' verb used incorrectly)", verbs[acl->verb]);
4566 /* Same args as acl_check_internal() above, but the string s is
4567 the name of an ACL followed optionally by up to 9 space-separated arguments.
4568 The name and args are separately expanded. Args go into $acl_arg globals. */
4570 acl_check_wargs(int where, address_item *addr, const uschar *s,
4571 uschar **user_msgptr, uschar **log_msgptr)
4574 uschar * tmp_arg[9]; /* must match acl_arg[] */
4575 uschar * sav_arg[9]; /* must match acl_arg[] */
4581 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4584 for (i = 0; i < 9; i++)
4586 while (*s && isspace(*s)) s++;
4588 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4595 sav_narg = acl_narg;
4597 for (i = 0; i < acl_narg; i++)
4599 sav_arg[i] = acl_arg[i];
4600 acl_arg[i] = tmp_arg[i];
4604 sav_arg[i] = acl_arg[i];
4605 acl_arg[i++] = NULL;
4609 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4612 acl_narg = sav_narg;
4613 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4617 if (f.expand_string_forcedfail) return ERROR;
4618 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4619 tmp, expand_string_message);
4620 return f.search_find_defer ? DEFER : ERROR;
4625 /*************************************************
4626 * Check access using an ACL *
4627 *************************************************/
4629 /* Alternate interface for ACL, used by expansions */
4631 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4634 address_item *addr = NULL;
4637 *user_msgptr = *log_msgptr = NULL;
4638 sender_verified_failed = NULL;
4639 ratelimiters_cmd = NULL;
4640 log_reject_target = LOG_MAIN|LOG_REJECT;
4642 if (where == ACL_WHERE_RCPT)
4644 adb = address_defaults;
4646 addr->address = expand_string(US"$local_part@$domain");
4647 addr->domain = deliver_domain;
4648 addr->local_part = deliver_localpart;
4649 addr->cc_local_part = deliver_localpart;
4650 addr->lc_local_part = deliver_localpart;
4654 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4661 /* This is the external interface for ACL checks. It sets up an address and the
4662 expansions for $domain and $local_part when called after RCPT, then calls
4663 acl_check_internal() to do the actual work.
4666 where ACL_WHERE_xxxx indicating where called from
4667 recipient RCPT address for RCPT check, else NULL
4668 s the input string; NULL is the same as an empty ACL => DENY
4669 user_msgptr where to put a user error (for SMTP response)
4670 log_msgptr where to put a logging message (not for SMTP response)
4672 Returns: OK access is granted by an ACCEPT verb
4673 DISCARD access is granted by a DISCARD verb
4674 FAIL access is denied
4675 FAIL_DROP access is denied; drop the connection
4676 DEFER can't tell at the moment
4679 int acl_where = ACL_WHERE_UNKNOWN;
4682 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4683 uschar **log_msgptr)
4687 address_item *addr = NULL;
4689 *user_msgptr = *log_msgptr = NULL;
4690 sender_verified_failed = NULL;
4691 ratelimiters_cmd = NULL;
4692 log_reject_target = LOG_MAIN|LOG_REJECT;
4694 #ifndef DISABLE_PRDR
4695 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4697 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4700 adb = address_defaults;
4702 addr->address = recipient;
4703 if (deliver_split_address(addr) == DEFER)
4705 *log_msgptr = US"defer in percent_hack_domains check";
4709 if ((addr->prop.utf8_msg = message_smtputf8))
4711 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4712 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4715 deliver_domain = addr->domain;
4716 deliver_localpart = addr->local_part;
4721 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4723 acl_where = ACL_WHERE_UNKNOWN;
4725 /* Cutthrough - if requested,
4726 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4727 and rcpt acl returned accept,
4728 and first recipient (cancel on any subsequents)
4729 open one now and run it up to RCPT acceptance.
4730 A failed verify should cancel cutthrough request,
4731 and will pass the fail to the originator.
4732 Initial implementation: dual-write to spool.
4733 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4735 Cease cutthrough copy on rxd final dot; do not send one.
4737 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4739 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4740 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4741 If temp-reject, close the conn (and keep the spooled copy).
4742 If conn-failure, no action (and keep the spooled copy).
4746 case ACL_WHERE_RCPT:
4747 #ifndef DISABLE_PRDR
4748 case ACL_WHERE_PRDR:
4751 if (f.host_checking_callout) /* -bhc mode */
4752 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4755 && cutthrough.delivery
4756 && rcpt_count > cutthrough.nrcpt
4759 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4760 if (cutthrough.defer_pass)
4762 uschar * s = addr->message;
4763 /* Horrid kludge to recover target's SMTP message */
4765 do --s; while (!isdigit(*s));
4766 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4767 f.acl_temp_details = TRUE;
4771 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4775 else HDEBUG(D_acl) if (cutthrough.delivery)
4776 if (rcpt_count <= cutthrough.nrcpt)
4777 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4779 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4782 case ACL_WHERE_PREDATA:
4784 cutthrough_predata();
4786 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4789 case ACL_WHERE_QUIT:
4790 case ACL_WHERE_NOTQUIT:
4791 /* Drop cutthrough conns, and drop heldopen verify conns if
4792 the previous was not DATA */
4795 smtp_connection_had[SMTP_HBUFF_PREV(SMTP_HBUFF_PREV(smtp_ch_index))];
4796 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4798 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4806 deliver_domain = deliver_localpart = deliver_address_data =
4807 deliver_domain_data = sender_address_data = NULL;
4809 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4810 ACL, which is really in the middle of an SMTP command. */
4814 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4816 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4817 "ACL", acl_wherenames[where]);
4823 /* A DROP response is not permitted from MAILAUTH */
4825 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4827 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4828 "ACL", acl_wherenames[where]);
4832 /* Before giving a response, take a look at the length of any user message, and
4833 split it up into multiple lines if possible. */
4835 *user_msgptr = string_split_message(*user_msgptr);
4836 if (fake_response != OK)
4837 fake_response_text = string_split_message(fake_response_text);
4843 /*************************************************
4844 * Create ACL variable *
4845 *************************************************/
4847 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4848 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4851 name pointer to the variable's name, starting with c or m
4853 Returns the pointer to variable's tree node
4857 acl_var_create(uschar * name)
4859 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4860 if (!(node = tree_search(*root, name)))
4862 node = store_get(sizeof(tree_node) + Ustrlen(name), name);
4863 Ustrcpy(node->name, name);
4864 (void)tree_insertnode(root, node);
4866 node->data.ptr = NULL;
4872 /*************************************************
4873 * Write an ACL variable in spool format *
4874 *************************************************/
4876 /* This function is used as a callback for tree_walk when writing variables to
4877 the spool file. To retain spool file compatibility, what is written is -aclc or
4878 -aclm followed by the rest of the name and the data length, space separated,
4879 then the value itself, starting on a new line, and terminated by an additional
4880 newline. When we had only numbered ACL variables, the first line might look
4881 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4885 name of the variable
4886 value of the variable
4887 ctx FILE pointer (as a void pointer)
4893 acl_var_write(uschar * name, uschar * value, void * ctx)
4895 FILE * f = (FILE *)ctx;
4897 if (is_tainted(value))
4899 int q = quoter_for_address(value);
4901 if (is_real_quoter(q)) fprintf(f, "(%s)", lookup_list[q]->name);
4903 fprintf(f, "acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4910 acl_standalone_setvar(const uschar * s)
4912 acl_condition_block * cond = store_get(sizeof(acl_condition_block), GET_UNTAINTED);
4913 uschar * errstr = NULL, * log_msg = NULL;
4918 cond->type = ACLC_SET;
4919 if (!acl_varname_to_cond(&s, cond, &errstr)) return errstr;
4920 if (!acl_data_to_cond(s, cond, US"'-be'", &errstr)) return errstr;
4922 if (acl_check_condition(ACL_WARN, cond, ACL_WHERE_UNKNOWN,
4923 NULL, 0, &endpass_seen, &errstr, &log_msg, &e) != OK)
4924 return string_sprintf("oops: %s", errstr);
4925 return string_sprintf("variable %s set", cond->u.varname);
4929 #endif /* !MACRO_PREDEF */