1 /* $Cambridge: exim/src/src/acl.c,v 1.88 2010/06/06 00:27:52 pdp Exp $ */
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
7 /* Copyright (c) University of Cambridge 1995 - 2009 */
8 /* See the file NOTICE for conditions of use and distribution. */
10 /* Code for handling Access Control Lists (ACLs) */
15 /* Default callout timeout */
17 #define CALLOUT_TIMEOUT_DEFAULT 30
19 /* ACL verb codes - keep in step with the table of verbs that follows */
21 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
26 static uschar *verbs[] =
27 { US"accept", US"defer", US"deny", US"discard", US"drop", US"require",
30 /* For each verb, the conditions for which "message" or "log_message" are used
31 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
32 "accept", the FAIL case is used only after "endpass", but that is selected in
35 static int msgcond[] = {
36 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* accept */
39 (1<<OK) | (1<<FAIL) | (1<<FAIL_DROP), /* discard */
41 (1<<FAIL) | (1<<FAIL_DROP), /* require */
45 /* ACL condition and modifier codes - keep in step with the table that
46 follows, and the cond_expand_at_top and uschar cond_modifiers tables lower
52 #ifdef EXPERIMENTAL_BRIGHTMAIL
58 #ifdef EXPERIMENTAL_DCC
61 #ifdef WITH_CONTENT_SCAN
65 #ifdef WITH_OLD_DEMIME
79 ACLC_LOG_REJECT_TARGET,
81 #ifdef WITH_CONTENT_SCAN
85 #ifdef WITH_CONTENT_SCAN
90 #ifdef WITH_CONTENT_SCAN
96 #ifdef WITH_CONTENT_SCAN
99 #ifdef EXPERIMENTAL_SPF
105 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
106 "message", "log_message", "log_reject_target", "logwrite", and "set" are
107 modifiers that look like conditions but always return TRUE. They are used for
108 their side effects. */
110 static uschar *conditions[] = {
114 #ifdef EXPERIMENTAL_BRIGHTMAIL
120 #ifdef EXPERIMENTAL_DCC
123 #ifdef WITH_CONTENT_SCAN
127 #ifdef WITH_OLD_DEMIME
141 US"log_reject_target",
143 #ifdef WITH_CONTENT_SCAN
147 #ifdef WITH_CONTENT_SCAN
152 #ifdef WITH_CONTENT_SCAN
155 US"sender_domains", US"senders", US"set",
156 #ifdef WITH_CONTENT_SCAN
159 #ifdef EXPERIMENTAL_SPF
166 /* Return values from decode_control(); keep in step with the table of names
170 CONTROL_AUTH_UNADVERTISED,
171 #ifdef EXPERIMENTAL_BRIGHTMAIL
179 CONTROL_CASEFUL_LOCAL_PART,
180 CONTROL_CASELOWER_LOCAL_PART,
181 CONTROL_ENFORCE_SYNC,
182 CONTROL_NO_ENFORCE_SYNC,
186 CONTROL_SUPPRESS_LOCAL_FIXUPS,
187 #ifdef WITH_CONTENT_SCAN
188 CONTROL_NO_MBOX_UNSPOOL,
192 CONTROL_NO_MULTILINE,
193 CONTROL_NO_PIPELINING,
194 CONTROL_NO_DELAY_FLUSH,
195 CONTROL_NO_CALLOUT_FLUSH
198 /* ACL control names; keep in step with the table above! This list is used for
199 turning ids into names. The actual list of recognized names is in the variable
200 control_def controls_list[] below. The fact that there are two lists is a mess
201 and should be tidied up. */
203 static uschar *controls[] = {
204 US"allow_auth_unadvertised",
205 #ifdef EXPERIMENTAL_BRIGHTMAIL
210 US"dkim_disable_verify",
213 US"caseful_local_part",
214 US"caselower_local_part",
220 US"suppress_local_fixups",
221 #ifdef WITH_CONTENT_SCAN
226 US"no_multiline_responses",
232 /* Flags to indicate for which conditions/modifiers a string expansion is done
233 at the outer level. In the other cases, expansion already occurs in the
234 checking functions. */
236 static uschar cond_expand_at_top[] = {
238 TRUE, /* add_header */
239 FALSE, /* authenticated */
240 #ifdef EXPERIMENTAL_BRIGHTMAIL
241 TRUE, /* bmi_optin */
243 TRUE, /* condition */
246 #ifdef EXPERIMENTAL_DCC
249 #ifdef WITH_CONTENT_SCAN
253 #ifdef WITH_OLD_DEMIME
257 TRUE, /* dkim_signers */
258 TRUE, /* dkim_status */
262 FALSE, /* encrypted */
265 FALSE, /* local_parts */
266 TRUE, /* log_message */
267 TRUE, /* log_reject_target */
269 #ifdef WITH_CONTENT_SCAN
273 #ifdef WITH_CONTENT_SCAN
274 TRUE, /* mime_regex */
276 TRUE, /* ratelimit */
277 FALSE, /* recipients */
278 #ifdef WITH_CONTENT_SCAN
281 FALSE, /* sender_domains */
284 #ifdef WITH_CONTENT_SCAN
287 #ifdef EXPERIMENTAL_SPF
289 TRUE, /* spf_guess */
294 /* Flags to identify the modifiers */
296 static uschar cond_modifiers[] = {
298 TRUE, /* add_header */
299 FALSE, /* authenticated */
300 #ifdef EXPERIMENTAL_BRIGHTMAIL
301 TRUE, /* bmi_optin */
303 FALSE, /* condition */
306 #ifdef EXPERIMENTAL_DCC
309 #ifdef WITH_CONTENT_SCAN
313 #ifdef WITH_OLD_DEMIME
317 FALSE, /* dkim_signers */
318 FALSE, /* dkim_status */
320 FALSE, /* dnslists */
322 FALSE, /* encrypted */
325 FALSE, /* local_parts */
326 TRUE, /* log_message */
327 TRUE, /* log_reject_target */
329 #ifdef WITH_CONTENT_SCAN
333 #ifdef WITH_CONTENT_SCAN
334 FALSE, /* mime_regex */
336 FALSE, /* ratelimit */
337 FALSE, /* recipients */
338 #ifdef WITH_CONTENT_SCAN
341 FALSE, /* sender_domains */
344 #ifdef WITH_CONTENT_SCAN
347 #ifdef EXPERIMENTAL_SPF
349 FALSE, /* spf_guess */
354 /* Bit map vector of which conditions and modifiers are not allowed at certain
355 times. For each condition and modifier, there's a bitmap of dis-allowed times.
356 For some, it is easier to specify the negation of a small number of allowed
359 static unsigned int cond_forbids[] = {
363 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* add_header */
364 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
365 (1<<ACL_WHERE_MIME)|(1<<ACL_WHERE_NOTSMTP)|
367 (1<<ACL_WHERE_NOTSMTP_START)),
369 (1<<ACL_WHERE_NOTSMTP)| /* authenticated */
370 (1<<ACL_WHERE_NOTSMTP_START)|
371 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO),
373 #ifdef EXPERIMENTAL_BRIGHTMAIL
374 (1<<ACL_WHERE_AUTH)| /* bmi_optin */
375 (1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)|
376 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_MIME)|
377 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
378 (1<<ACL_WHERE_MAILAUTH)|
379 (1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_STARTTLS)|
380 (1<<ACL_WHERE_VRFY)|(1<<ACL_WHERE_PREDATA)|
381 (1<<ACL_WHERE_NOTSMTP_START),
388 /* Certain types of control are always allowed, so we let it through
389 always and check in the control processing itself. */
393 #ifdef EXPERIMENTAL_DCC
395 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* dcc */
398 #ifdef WITH_CONTENT_SCAN
400 ~(1<<ACL_WHERE_MIME), /* decode */
403 (1<<ACL_WHERE_NOTQUIT), /* delay */
405 #ifdef WITH_OLD_DEMIME
407 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* demime */
412 ~(1<<ACL_WHERE_DKIM), /* dkim_signers */
415 ~(1<<ACL_WHERE_DKIM), /* dkim_status */
418 (1<<ACL_WHERE_NOTSMTP)| /* dnslists */
419 (1<<ACL_WHERE_NOTSMTP_START),
422 ~(1<<ACL_WHERE_RCPT), /* domains */
424 (1<<ACL_WHERE_NOTSMTP)| /* encrypted */
425 (1<<ACL_WHERE_CONNECT)|
426 (1<<ACL_WHERE_NOTSMTP_START)|
431 (1<<ACL_WHERE_NOTSMTP)| /* hosts */
432 (1<<ACL_WHERE_NOTSMTP_START),
435 ~(1<<ACL_WHERE_RCPT), /* local_parts */
439 0, /* log_reject_target */
443 #ifdef WITH_CONTENT_SCAN
445 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* malware */
450 #ifdef WITH_CONTENT_SCAN
452 ~(1<<ACL_WHERE_MIME), /* mime_regex */
458 ~(1<<ACL_WHERE_RCPT), /* recipients */
460 #ifdef WITH_CONTENT_SCAN
462 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* regex */
463 (1<<ACL_WHERE_MIME)),
466 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* sender_domains */
468 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
469 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
470 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
472 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* senders */
474 (1<<ACL_WHERE_MAILAUTH)|(1<<ACL_WHERE_QUIT)|
475 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
476 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY),
480 #ifdef WITH_CONTENT_SCAN
482 ~((1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)), /* spam */
485 #ifdef EXPERIMENTAL_SPF
486 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf */
488 (1<<ACL_WHERE_MAILAUTH)|
489 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
490 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
491 (1<<ACL_WHERE_NOTSMTP)|
492 (1<<ACL_WHERE_NOTSMTP_START),
494 (1<<ACL_WHERE_AUTH)|(1<<ACL_WHERE_CONNECT)| /* spf_guess */
496 (1<<ACL_WHERE_MAILAUTH)|
497 (1<<ACL_WHERE_ETRN)|(1<<ACL_WHERE_EXPN)|
498 (1<<ACL_WHERE_STARTTLS)|(1<<ACL_WHERE_VRFY)|
499 (1<<ACL_WHERE_NOTSMTP)|
500 (1<<ACL_WHERE_NOTSMTP_START),
503 /* Certain types of verify are always allowed, so we let it through
504 always and check in the verify function itself */
510 /* Bit map vector of which controls are not allowed at certain times. For
511 each control, there's a bitmap of dis-allowed times. For some, it is easier to
512 specify the negation of a small number of allowed times. */
514 static unsigned int control_forbids[] = {
516 ~((1<<ACL_WHERE_CONNECT)|(1<<ACL_WHERE_HELO)), /* allow_auth_unadvertised */
518 #ifdef EXPERIMENTAL_BRIGHTMAIL
525 (1<<ACL_WHERE_DATA)|(1<<ACL_WHERE_NOTSMTP)| /* dkim_disable_verify */
526 (1<<ACL_WHERE_NOTSMTP_START),
532 ~(1<<ACL_WHERE_RCPT), /* caseful_local_part */
535 ~(1<<ACL_WHERE_RCPT), /* caselower_local_part */
537 (1<<ACL_WHERE_NOTSMTP)| /* enforce_sync */
538 (1<<ACL_WHERE_NOTSMTP_START),
540 (1<<ACL_WHERE_NOTSMTP)| /* no_enforce_sync */
541 (1<<ACL_WHERE_NOTSMTP_START),
544 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* freeze */
545 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
546 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
549 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* queue_only */
550 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
551 (1<<ACL_WHERE_NOTSMTP)|(1<<ACL_WHERE_MIME)),
554 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* submission */
555 (1<<ACL_WHERE_PREDATA)),
558 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* suppress_local_fixups */
559 (1<<ACL_WHERE_PREDATA)|
560 (1<<ACL_WHERE_NOTSMTP_START)),
562 #ifdef WITH_CONTENT_SCAN
564 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* no_mbox_unspool */
565 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
566 (1<<ACL_WHERE_MIME)),
570 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakedefer */
571 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
572 (1<<ACL_WHERE_MIME)),
575 ~((1<<ACL_WHERE_MAIL)|(1<<ACL_WHERE_RCPT)| /* fakereject */
576 (1<<ACL_WHERE_PREDATA)|(1<<ACL_WHERE_DATA)|
577 (1<<ACL_WHERE_MIME)),
579 (1<<ACL_WHERE_NOTSMTP)| /* no_multiline */
580 (1<<ACL_WHERE_NOTSMTP_START),
582 (1<<ACL_WHERE_NOTSMTP)| /* no_pipelining */
583 (1<<ACL_WHERE_NOTSMTP_START),
585 (1<<ACL_WHERE_NOTSMTP)| /* no_delay_flush */
586 (1<<ACL_WHERE_NOTSMTP_START),
588 (1<<ACL_WHERE_NOTSMTP)| /* no_callout_flush */
589 (1<<ACL_WHERE_NOTSMTP_START)
592 /* Structure listing various control arguments, with their characteristics. */
594 typedef struct control_def {
596 int value; /* CONTROL_xxx value */
597 BOOL has_option; /* Has /option(s) following */
600 static control_def controls_list[] = {
601 { US"allow_auth_unadvertised", CONTROL_AUTH_UNADVERTISED, FALSE },
602 #ifdef EXPERIMENTAL_BRIGHTMAIL
603 { US"bmi_run", CONTROL_BMI_RUN, FALSE },
605 { US"debug", CONTROL_DEBUG, TRUE },
607 { US"dkim_disable_verify", CONTROL_DKIM_VERIFY, FALSE },
609 { US"caseful_local_part", CONTROL_CASEFUL_LOCAL_PART, FALSE },
610 { US"caselower_local_part", CONTROL_CASELOWER_LOCAL_PART, FALSE },
611 { US"enforce_sync", CONTROL_ENFORCE_SYNC, FALSE },
612 { US"freeze", CONTROL_FREEZE, TRUE },
613 { US"no_callout_flush", CONTROL_NO_CALLOUT_FLUSH, FALSE },
614 { US"no_delay_flush", CONTROL_NO_DELAY_FLUSH, FALSE },
615 { US"no_enforce_sync", CONTROL_NO_ENFORCE_SYNC, FALSE },
616 { US"no_multiline_responses", CONTROL_NO_MULTILINE, FALSE },
617 { US"no_pipelining", CONTROL_NO_PIPELINING, FALSE },
618 { US"queue_only", CONTROL_QUEUE_ONLY, FALSE },
619 #ifdef WITH_CONTENT_SCAN
620 { US"no_mbox_unspool", CONTROL_NO_MBOX_UNSPOOL, FALSE },
622 { US"fakedefer", CONTROL_FAKEDEFER, TRUE },
623 { US"fakereject", CONTROL_FAKEREJECT, TRUE },
624 { US"submission", CONTROL_SUBMISSION, TRUE },
625 { US"suppress_local_fixups", CONTROL_SUPPRESS_LOCAL_FIXUPS, FALSE }
628 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
629 caches its result in a tree to avoid repeated DNS queries. The result is an
630 integer code which is used as an index into the following tables of
631 explanatory strings and verification return codes. */
633 static tree_node *csa_cache = NULL;
635 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
636 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
638 /* The acl_verify_csa() return code is translated into an acl_verify() return
639 code using the following table. It is OK unless the client is definitely not
640 authorized. This is because CSA is supposed to be optional for sending sites,
641 so recipients should not be too strict about checking it - especially because
642 DNS problems are quite likely to occur. It's possible to use $csa_status in
643 further ACL conditions to distinguish ok, unknown, and defer if required, but
644 the aim is to make the usual configuration simple. */
646 static int csa_return_code[] = {
648 FAIL, FAIL, FAIL, FAIL
651 static uschar *csa_status_string[] = {
652 US"unknown", US"ok", US"defer", US"defer",
653 US"fail", US"fail", US"fail", US"fail"
656 static uschar *csa_reason_string[] = {
659 US"deferred (SRV lookup failed)",
660 US"deferred (target address lookup failed)",
661 US"failed (explicit authorization required)",
662 US"failed (host name not authorized)",
663 US"failed (no authorized addresses)",
664 US"failed (client address mismatch)"
667 /* Enable recursion between acl_check_internal() and acl_check_condition() */
669 static int acl_check_internal(int, address_item *, uschar *, int, uschar **,
673 /*************************************************
674 * Pick out name from list *
675 *************************************************/
677 /* Use a binary chop method
684 Returns: offset in list, or -1 if not found
688 acl_checkname(uschar *name, uschar **list, int end)
694 int mid = (start + end)/2;
695 int c = Ustrcmp(name, list[mid]);
696 if (c == 0) return mid;
697 if (c < 0) end = mid; else start = mid + 1;
704 /*************************************************
705 * Read and parse one ACL *
706 *************************************************/
708 /* This function is called both from readconf in order to parse the ACLs in the
709 configuration file, and also when an ACL is encountered dynamically (e.g. as
710 the result of an expansion). It is given a function to call in order to
711 retrieve the lines of the ACL. This function handles skipping comments and
712 blank lines (where relevant).
715 func function to get next line of ACL
716 error where to put an error message
718 Returns: pointer to ACL, or NULL
719 NULL can be legal (empty ACL); in this case error will be NULL
723 acl_read(uschar *(*func)(void), uschar **error)
725 acl_block *yield = NULL;
726 acl_block **lastp = &yield;
727 acl_block *this = NULL;
728 acl_condition_block *cond;
729 acl_condition_block **condp = NULL;
734 while ((s = (*func)()) != NULL)
737 BOOL negated = FALSE;
738 uschar *saveline = s;
741 /* Conditions (but not verbs) are allowed to be negated by an initial
744 while (isspace(*s)) s++;
751 /* Read the name of a verb or a condition, or the start of a new ACL, which
752 can be started by a name, or by a macro definition. */
754 s = readconf_readname(name, sizeof(name), s);
755 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
757 /* If a verb is unrecognized, it may be another condition or modifier that
758 continues the previous verb. */
760 v = acl_checkname(name, verbs, sizeof(verbs)/sizeof(char *));
765 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
777 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
780 this = store_get(sizeof(acl_block));
782 lastp = &(this->next);
785 this->condition = NULL;
786 condp = &(this->condition);
787 if (*s == 0) continue; /* No condition on this line */
793 s = readconf_readname(name, sizeof(name), s); /* Condition name */
796 /* Handle a condition or modifier. */
798 c = acl_checkname(name, conditions, sizeof(conditions)/sizeof(char *));
801 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
806 /* The modifiers may not be negated */
808 if (negated && cond_modifiers[c])
810 *error = string_sprintf("ACL error: negation is not allowed with "
811 "\"%s\"", conditions[c]);
815 /* ENDPASS may occur only with ACCEPT or DISCARD. */
817 if (c == ACLC_ENDPASS &&
818 this->verb != ACL_ACCEPT &&
819 this->verb != ACL_DISCARD)
821 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
822 conditions[c], verbs[this->verb]);
826 cond = store_get(sizeof(acl_condition_block));
829 cond->u.negated = negated;
832 condp = &(cond->next);
834 /* The "set" modifier is different in that its argument is "name=value"
835 rather than just a value, and we can check the validity of the name, which
836 gives us a variable name to insert into the data block. The original ACL
837 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
838 extended to 20 of each type, but after that people successfully argued for
839 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
840 After that, we allow alphanumerics and underscores, but the first character
841 after c or m must be a digit or an underscore. This retains backwards
848 if (Ustrncmp(s, "acl_c", 5) != 0 &&
849 Ustrncmp(s, "acl_m", 5) != 0)
851 *error = string_sprintf("invalid variable name after \"set\" in ACL "
852 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
857 if (!isdigit(*endptr) && *endptr != '_')
859 *error = string_sprintf("invalid variable name after \"set\" in ACL "
860 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
865 while (*endptr != 0 && *endptr != '=' && !isspace(*endptr))
867 if (!isalnum(*endptr) && *endptr != '_')
869 *error = string_sprintf("invalid character \"%c\" in variable name "
870 "in ACL modifier \"set %s\"", *endptr, s);
876 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
878 while (isspace(*s)) s++;
881 /* For "set", we are now positioned for the data. For the others, only
882 "endpass" has no data */
884 if (c != ACLC_ENDPASS)
888 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
889 cond_modifiers[c]? US"modifier" : US"condition");
892 while (isspace(*s)) s++;
893 cond->arg = string_copy(s);
902 /*************************************************
903 * Set up added header line(s) *
904 *************************************************/
906 /* This function is called by the add_header modifier, and also from acl_warn()
907 to implement the now-deprecated way of adding header lines using "message" on a
908 "warn" verb. The argument is treated as a sequence of header lines which are
909 added to a chain, provided there isn't an identical one already there.
911 Argument: string of header lines
916 setup_header(uschar *hstring)
919 int hlen = Ustrlen(hstring);
921 /* An empty string does nothing; otherwise add a final newline if necessary. */
923 if (hlen <= 0) return;
924 if (hstring[hlen-1] != '\n') hstring = string_sprintf("%s\n", hstring);
926 /* Loop for multiple header lines, taking care about continuations */
928 for (p = q = hstring; *p != 0; )
931 int newtype = htype_add_bot;
932 header_line **hptr = &acl_added_headers;
934 /* Find next header line within the string */
938 q = Ustrchr(q, '\n');
939 if (*(++q) != ' ' && *q != '\t') break;
942 /* If the line starts with a colon, interpret the instruction for where to
943 add it. This temporarily sets up a new type. */
947 if (strncmpic(p, US":after_received:", 16) == 0)
949 newtype = htype_add_rec;
952 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
954 newtype = htype_add_rfc;
957 else if (strncmpic(p, US":at_start:", 10) == 0)
959 newtype = htype_add_top;
962 else if (strncmpic(p, US":at_end:", 8) == 0)
964 newtype = htype_add_bot;
967 while (*p == ' ' || *p == '\t') p++;
970 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
971 to the front of it. */
973 for (s = p; s < q - 1; s++)
975 if (*s == ':' || !isgraph(*s)) break;
978 s = string_sprintf("%s%.*s", (*s == ':')? "" : "X-ACL-Warn: ", q - p, p);
981 /* See if this line has already been added */
983 while (*hptr != NULL)
985 if (Ustrncmp((*hptr)->text, s, hlen) == 0) break;
986 hptr = &((*hptr)->next);
989 /* Add if not previously present */
993 header_line *h = store_get(sizeof(header_line));
1002 /* Advance for next header line within the string */
1011 /*************************************************
1013 *************************************************/
1015 /* This function is called when a WARN verb's conditions are true. It adds to
1016 the message's headers, and/or writes information to the log. In each case, this
1017 only happens once (per message for headers, per connection for log).
1019 ** NOTE: The header adding action using the "message" setting is historic, and
1020 its use is now deprecated. The new add_header modifier should be used instead.
1023 where ACL_WHERE_xxxx indicating which ACL this is
1024 user_message message for adding to headers
1025 log_message message for logging, if different
1031 acl_warn(int where, uschar *user_message, uschar *log_message)
1033 if (log_message != NULL && log_message != user_message)
1036 string_item *logged;
1038 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1039 string_printing(log_message));
1041 /* If a sender verification has failed, and the log message is "sender verify
1042 failed", add the failure message. */
1044 if (sender_verified_failed != NULL &&
1045 sender_verified_failed->message != NULL &&
1046 strcmpic(log_message, US"sender verify failed") == 0)
1047 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1049 /* Search previously logged warnings. They are kept in malloc
1050 store so they can be freed at the start of a new message. */
1052 for (logged = acl_warn_logged; logged != NULL; logged = logged->next)
1053 if (Ustrcmp(logged->text, text) == 0) break;
1057 int length = Ustrlen(text) + 1;
1058 log_write(0, LOG_MAIN, "%s", text);
1059 logged = store_malloc(sizeof(string_item) + length);
1060 logged->text = (uschar *)logged + sizeof(string_item);
1061 memcpy(logged->text, text, length);
1062 logged->next = acl_warn_logged;
1063 acl_warn_logged = logged;
1067 /* If there's no user message, we are done. */
1069 if (user_message == NULL) return;
1071 /* If this isn't a message ACL, we can't do anything with a user message.
1074 if (where > ACL_WHERE_NOTSMTP)
1076 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1077 "found in a non-message (%s) ACL: cannot specify header lines here: "
1078 "message ignored", acl_wherenames[where]);
1082 /* The code for setting up header lines is now abstracted into a separate
1083 function so that it can be used for the add_header modifier as well. */
1085 setup_header(user_message);
1090 /*************************************************
1091 * Verify and check reverse DNS *
1092 *************************************************/
1094 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1095 address if this has not yet been done. The host_name_lookup() function checks
1096 that one of these names resolves to an address list that contains the client IP
1097 address, so we don't actually have to do the check here.
1100 user_msgptr pointer for user message
1101 log_msgptr pointer for log message
1103 Returns: OK verification condition succeeded
1104 FAIL verification failed
1105 DEFER there was a problem verifying
1109 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1113 user_msgptr = user_msgptr; /* stop compiler warning */
1115 /* Previous success */
1117 if (sender_host_name != NULL) return OK;
1119 /* Previous failure */
1121 if (host_lookup_failed)
1123 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1127 /* Need to do a lookup */
1130 debug_printf("looking up host name to force name/address consistency check\n");
1132 if ((rc = host_name_lookup()) != OK)
1134 *log_msgptr = (rc == DEFER)?
1135 US"host lookup deferred for reverse lookup check"
1137 string_sprintf("host lookup failed for reverse lookup check%s",
1139 return rc; /* DEFER or FAIL */
1142 host_build_sender_fullhost();
1148 /*************************************************
1149 * Check client IP address matches CSA target *
1150 *************************************************/
1152 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1153 response for address records belonging to the CSA target hostname. The section
1154 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1155 If one of the addresses matches the client's IP address, then the client is
1156 authorized by CSA. If there are target IP addresses but none of them match
1157 then the client is using an unauthorized IP address. If there are no target IP
1158 addresses then the client cannot be using an authorized IP address. (This is
1159 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1162 dnsa the DNS answer block
1163 dnss a DNS scan block for us to use
1164 reset option specifing what portion to scan, as described above
1165 target the target hostname to use for matching RR names
1167 Returns: CSA_OK successfully authorized
1168 CSA_FAIL_MISMATCH addresses found but none matched
1169 CSA_FAIL_NOADDR no target addresses found
1173 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1179 BOOL target_found = FALSE;
1181 for (rr = dns_next_rr(dnsa, dnss, reset);
1183 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1185 /* Check this is an address RR for the target hostname. */
1189 && rr->type != T_AAAA
1196 if (strcmpic(target, rr->name) != 0) continue;
1198 target_found = TRUE;
1200 /* Turn the target address RR into a list of textual IP addresses and scan
1201 the list. There may be more than one if it is an A6 RR. */
1203 for (da = dns_address_from_rr(dnsa, rr); da != NULL; da = da->next)
1205 /* If the client IP address matches the target IP address, it's good! */
1207 DEBUG(D_acl) debug_printf("CSA target address is %s\n", da->address);
1209 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1213 /* If we found some target addresses but none of them matched, the client is
1214 using an unauthorized IP address, otherwise the target has no authorized IP
1217 if (target_found) return CSA_FAIL_MISMATCH;
1218 else return CSA_FAIL_NOADDR;
1223 /*************************************************
1224 * Verify Client SMTP Authorization *
1225 *************************************************/
1227 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1228 to find the CSA SRV record corresponding to the domain argument, or
1229 $sender_helo_name if no argument is provided. It then checks that the
1230 client is authorized, and that its IP address corresponds to the SRV
1231 target's address by calling acl_verify_csa_address() above. The address
1232 should have been returned in the DNS response's ADDITIONAL section, but if
1233 not we perform another DNS lookup to get it.
1236 domain pointer to optional parameter following verify = csa
1238 Returns: CSA_UNKNOWN no valid CSA record found
1239 CSA_OK successfully authorized
1240 CSA_FAIL_* client is definitely not authorized
1241 CSA_DEFER_* there was a DNS problem
1245 acl_verify_csa(uschar *domain)
1249 int priority, weight, port;
1256 /* Work out the domain we are using for the CSA lookup. The default is the
1257 client's HELO domain. If the client has not said HELO, use its IP address
1258 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1260 while (isspace(*domain) && *domain != '\0') ++domain;
1261 if (*domain == '\0') domain = sender_helo_name;
1262 if (domain == NULL) domain = sender_host_address;
1263 if (sender_host_address == NULL) return CSA_UNKNOWN;
1265 /* If we have an address literal, strip off the framing ready for turning it
1266 into a domain. The framing consists of matched square brackets possibly
1267 containing a keyword and a colon before the actual IP address. */
1269 if (domain[0] == '[')
1271 uschar *start = Ustrchr(domain, ':');
1272 if (start == NULL) start = domain;
1273 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1276 /* Turn domains that look like bare IP addresses into domains in the reverse
1277 DNS. This code also deals with address literals and $sender_host_address. It's
1278 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1279 address literals, but it's probably the most friendly thing to do. This is an
1280 extension to CSA, so we allow it to be turned off for proper conformance. */
1282 if (string_is_ip_address(domain, NULL) != 0)
1284 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1285 dns_build_reverse(domain, target);
1289 /* Find out if we've already done the CSA check for this domain. If we have,
1290 return the same result again. Otherwise build a new cached result structure
1291 for this domain. The name is filled in now, and the value is filled in when
1292 we return from this function. */
1294 t = tree_search(csa_cache, domain);
1295 if (t != NULL) return t->data.val;
1297 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain));
1298 Ustrcpy(t->name, domain);
1299 (void)tree_insertnode(&csa_cache, t);
1301 /* Now we are ready to do the actual DNS lookup(s). */
1304 switch (dns_special_lookup(&dnsa, domain, T_CSA, &found))
1306 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1309 return t->data.val = CSA_DEFER_SRV;
1311 /* If we found nothing, the client's authorization is unknown. */
1315 return t->data.val = CSA_UNKNOWN;
1317 /* We got something! Go on to look at the reply in more detail. */
1323 /* Scan the reply for well-formed CSA SRV records. */
1325 for (rr = dns_next_rr(&dnsa, &dnss, RESET_ANSWERS);
1327 rr = dns_next_rr(&dnsa, &dnss, RESET_NEXT))
1329 if (rr->type != T_SRV) continue;
1331 /* Extract the numerical SRV fields (p is incremented) */
1334 GETSHORT(priority, p);
1335 GETSHORT(weight, p);
1339 debug_printf("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1341 /* Check the CSA version number */
1343 if (priority != 1) continue;
1345 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1346 found by dns_special_lookup() is a parent of the one we asked for), we check
1347 the subdomain assertions in the port field. At the moment there's only one
1348 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1349 SRV records of their own. */
1351 if (found != domain)
1354 return t->data.val = CSA_FAIL_EXPLICIT;
1356 return t->data.val = CSA_UNKNOWN;
1359 /* This CSA SRV record refers directly to our domain, so we check the value
1360 in the weight field to work out the domain's authorization. 0 and 1 are
1361 unauthorized; 3 means the client is authorized but we can't check the IP
1362 address in order to authenticate it, so we treat it as unknown; values
1363 greater than 3 are undefined. */
1365 if (weight < 2) return t->data.val = CSA_FAIL_DOMAIN;
1367 if (weight > 2) continue;
1369 /* Weight == 2, which means the domain is authorized. We must check that the
1370 client's IP address is listed as one of the SRV target addresses. Save the
1371 target hostname then break to scan the additional data for its addresses. */
1373 (void)dn_expand(dnsa.answer, dnsa.answer + dnsa.answerlen, p,
1374 (DN_EXPAND_ARG4_TYPE)target, sizeof(target));
1376 DEBUG(D_acl) debug_printf("CSA target is %s\n", target);
1381 /* If we didn't break the loop then no appropriate records were found. */
1383 if (rr == NULL) return t->data.val = CSA_UNKNOWN;
1385 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1386 A target of "." indicates there are no valid addresses, so the client cannot
1387 be authorized. (This is an odd configuration because weight=2 target=. is
1388 equivalent to weight=1, but we check for it in order to keep load off the
1389 root name servers.) Note that dn_expand() turns "." into "". */
1391 if (Ustrcmp(target, "") == 0) return t->data.val = CSA_FAIL_NOADDR;
1393 /* Scan the additional section of the CSA SRV reply for addresses belonging
1394 to the target. If the name server didn't return any additional data (e.g.
1395 because it does not fully support SRV records), we need to do another lookup
1396 to obtain the target addresses; otherwise we have a definitive result. */
1398 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ADDITIONAL, target);
1399 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1401 /* The DNS lookup type corresponds to the IP version used by the client. */
1404 if (Ustrchr(sender_host_address, ':') != NULL)
1407 #endif /* HAVE_IPV6 */
1411 #if HAVE_IPV6 && defined(SUPPORT_A6)
1415 switch (dns_lookup(&dnsa, target, type, NULL))
1417 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1420 return t->data.val = CSA_DEFER_ADDR;
1422 /* If the query succeeded, scan the addresses and return the result. */
1425 rc = acl_verify_csa_address(&dnsa, &dnss, RESET_ANSWERS, target);
1426 if (rc != CSA_FAIL_NOADDR) return t->data.val = rc;
1427 /* else fall through */
1429 /* If the target has no IP addresses, the client cannot have an authorized
1430 IP address. However, if the target site uses A6 records (not AAAA records)
1431 we have to do yet another lookup in order to check them. */
1436 #if HAVE_IPV6 && defined(SUPPORT_A6)
1437 if (type == T_AAAA) { type = T_A6; goto DNS_LOOKUP_AGAIN; }
1440 return t->data.val = CSA_FAIL_NOADDR;
1446 /*************************************************
1447 * Handle verification (address & other) *
1448 *************************************************/
1450 /* This function implements the "verify" condition. It is called when
1451 encountered in any ACL, because some tests are almost always permitted. Some
1452 just don't make sense, and always fail (for example, an attempt to test a host
1453 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1456 where where called from
1457 addr the recipient address that the ACL is handling, or NULL
1458 arg the argument of "verify"
1459 user_msgptr pointer for user message
1460 log_msgptr pointer for log message
1461 basic_errno where to put verify errno
1463 Returns: OK verification condition succeeded
1464 FAIL verification failed
1465 DEFER there was a problem verifying
1470 acl_verify(int where, address_item *addr, uschar *arg,
1471 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1475 int callout_overall = -1;
1476 int callout_connect = -1;
1477 int verify_options = 0;
1479 BOOL verify_header_sender = FALSE;
1480 BOOL defer_ok = FALSE;
1481 BOOL callout_defer_ok = FALSE;
1482 BOOL no_details = FALSE;
1483 BOOL success_on_redirect = FALSE;
1484 address_item *sender_vaddr = NULL;
1485 uschar *verify_sender_address = NULL;
1486 uschar *pm_mailfrom = NULL;
1487 uschar *se_mailfrom = NULL;
1489 /* Some of the verify items have slash-separated options; some do not. Diagnose
1490 an error if options are given for items that don't expect them. This code has
1491 now got very message. Refactoring to use a table would be a good idea one day.
1494 uschar *slash = Ustrchr(arg, '/');
1496 uschar *ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size);
1498 if (ss == NULL) goto BAD_VERIFY;
1500 /* Handle name/address consistency verification in a separate function. */
1502 if (strcmpic(ss, US"reverse_host_lookup") == 0)
1504 if (slash != NULL) goto NO_OPTIONS;
1505 if (sender_host_address == NULL) return OK;
1506 return acl_verify_reverse(user_msgptr, log_msgptr);
1509 /* TLS certificate verification is done at STARTTLS time; here we just
1510 test whether it was successful or not. (This is for optional verification; for
1511 mandatory verification, the connection doesn't last this long.) */
1513 if (strcmpic(ss, US"certificate") == 0)
1515 if (slash != NULL) goto NO_OPTIONS;
1516 if (tls_certificate_verified) return OK;
1517 *user_msgptr = US"no verified certificate";
1521 /* We can test the result of optional HELO verification that might have
1522 occurred earlier. If not, we can attempt the verification now. */
1524 if (strcmpic(ss, US"helo") == 0)
1526 if (slash != NULL) goto NO_OPTIONS;
1527 if (!helo_verified && !helo_verify_failed) smtp_verify_helo();
1528 return helo_verified? OK : FAIL;
1531 /* Do Client SMTP Authorization checks in a separate function, and turn the
1532 result code into user-friendly strings. */
1534 if (strcmpic(ss, US"csa") == 0)
1536 rc = acl_verify_csa(list);
1537 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1538 csa_reason_string[rc]);
1539 csa_status = csa_status_string[rc];
1540 DEBUG(D_acl) debug_printf("CSA result %s\n", csa_status);
1541 return csa_return_code[rc];
1544 /* Check that all relevant header lines have the correct syntax. If there is
1545 a syntax error, we return details of the error to the sender if configured to
1546 send out full details. (But a "message" setting on the ACL can override, as
1549 if (strcmpic(ss, US"header_syntax") == 0)
1551 if (slash != NULL) goto NO_OPTIONS;
1552 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
1553 rc = verify_check_headers(log_msgptr);
1554 if (rc != OK && smtp_return_error_details && *log_msgptr != NULL)
1555 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1559 /* Check that no recipient of this message is "blind", that is, every envelope
1560 recipient must be mentioned in either To: or Cc:. */
1562 if (strcmpic(ss, US"not_blind") == 0)
1564 if (slash != NULL) goto NO_OPTIONS;
1565 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
1566 rc = verify_check_notblind();
1569 *log_msgptr = string_sprintf("bcc recipient detected");
1570 if (smtp_return_error_details)
1571 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1576 /* The remaining verification tests check recipient and sender addresses,
1577 either from the envelope or from the header. There are a number of
1578 slash-separated options that are common to all of them. */
1581 /* Check that there is at least one verifiable sender address in the relevant
1582 header lines. This can be followed by callout and defer options, just like
1583 sender and recipient. */
1585 if (strcmpic(ss, US"header_sender") == 0)
1587 if (where != ACL_WHERE_DATA && where != ACL_WHERE_NOTSMTP) goto WRONG_ACL;
1588 verify_header_sender = TRUE;
1591 /* Otherwise, first item in verify argument must be "sender" or "recipient".
1592 In the case of a sender, this can optionally be followed by an address to use
1593 in place of the actual sender (rare special-case requirement). */
1595 else if (strncmpic(ss, US"sender", 6) == 0)
1598 if (where > ACL_WHERE_NOTSMTP)
1600 *log_msgptr = string_sprintf("cannot verify sender in ACL for %s "
1601 "(only possible for MAIL, RCPT, PREDATA, or DATA)",
1602 acl_wherenames[where]);
1606 verify_sender_address = sender_address;
1609 while (isspace(*s)) s++;
1610 if (*s++ != '=') goto BAD_VERIFY;
1611 while (isspace(*s)) s++;
1612 verify_sender_address = string_copy(s);
1617 if (strcmpic(ss, US"recipient") != 0) goto BAD_VERIFY;
1620 *log_msgptr = string_sprintf("cannot verify recipient in ACL for %s "
1621 "(only possible for RCPT)", acl_wherenames[where]);
1626 /* Remaining items are optional; they apply to sender and recipient
1627 verification, including "header sender" verification. */
1629 while ((ss = string_nextinlist(&list, &sep, big_buffer, big_buffer_size))
1632 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1633 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1634 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1636 /* These two old options are left for backwards compatibility */
1638 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1640 callout_defer_ok = TRUE;
1641 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1644 else if (strcmpic(ss, US"check_postmaster") == 0)
1647 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1650 /* The callout option has a number of sub-options, comma separated */
1652 else if (strncmpic(ss, US"callout", 7) == 0)
1654 callout = CALLOUT_TIMEOUT_DEFAULT;
1658 while (isspace(*ss)) ss++;
1664 while (isspace(*ss)) ss++;
1666 /* This callout option handling code has become a mess as new options
1667 have been added in an ad hoc manner. It should be tidied up into some
1668 kind of table-driven thing. */
1670 while ((opt = string_nextinlist(&ss, &optsep, buffer, sizeof(buffer)))
1673 if (strcmpic(opt, US"defer_ok") == 0) callout_defer_ok = TRUE;
1674 else if (strcmpic(opt, US"no_cache") == 0)
1675 verify_options |= vopt_callout_no_cache;
1676 else if (strcmpic(opt, US"random") == 0)
1677 verify_options |= vopt_callout_random;
1678 else if (strcmpic(opt, US"use_sender") == 0)
1679 verify_options |= vopt_callout_recipsender;
1680 else if (strcmpic(opt, US"use_postmaster") == 0)
1681 verify_options |= vopt_callout_recippmaster;
1682 else if (strcmpic(opt, US"postmaster") == 0) pm_mailfrom = US"";
1683 else if (strcmpic(opt, US"fullpostmaster") == 0)
1686 verify_options |= vopt_callout_fullpm;
1689 else if (strncmpic(opt, US"mailfrom", 8) == 0)
1691 if (!verify_header_sender)
1693 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1694 "callout option only for verify=header_sender (detected in ACL "
1695 "condition \"%s\")", arg);
1699 while (isspace(*opt)) opt++;
1702 *log_msgptr = string_sprintf("'=' expected after "
1703 "\"mailfrom\" in ACL condition \"%s\"", arg);
1706 while (isspace(*opt)) opt++;
1707 se_mailfrom = string_copy(opt);
1710 else if (strncmpic(opt, US"postmaster_mailfrom", 19) == 0)
1713 while (isspace(*opt)) opt++;
1716 *log_msgptr = string_sprintf("'=' expected after "
1717 "\"postmaster_mailfrom\" in ACL condition \"%s\"", arg);
1720 while (isspace(*opt)) opt++;
1721 pm_mailfrom = string_copy(opt);
1724 else if (strncmpic(opt, US"maxwait", 7) == 0)
1727 while (isspace(*opt)) opt++;
1730 *log_msgptr = string_sprintf("'=' expected after \"maxwait\" in "
1731 "ACL condition \"%s\"", arg);
1734 while (isspace(*opt)) opt++;
1735 callout_overall = readconf_readtime(opt, 0, FALSE);
1736 if (callout_overall < 0)
1738 *log_msgptr = string_sprintf("bad time value in ACL condition "
1739 "\"verify %s\"", arg);
1743 else if (strncmpic(opt, US"connect", 7) == 0)
1746 while (isspace(*opt)) opt++;
1749 *log_msgptr = string_sprintf("'=' expected after "
1750 "\"callout_overaall\" in ACL condition \"%s\"", arg);
1753 while (isspace(*opt)) opt++;
1754 callout_connect = readconf_readtime(opt, 0, FALSE);
1755 if (callout_connect < 0)
1757 *log_msgptr = string_sprintf("bad time value in ACL condition "
1758 "\"verify %s\"", arg);
1762 else /* Plain time is callout connect/command timeout */
1764 callout = readconf_readtime(opt, 0, FALSE);
1767 *log_msgptr = string_sprintf("bad time value in ACL condition "
1768 "\"verify %s\"", arg);
1776 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1777 "ACL condition \"%s\"", arg);
1783 /* Option not recognized */
1787 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1788 "condition \"verify %s\"", ss, arg);
1793 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1794 (vopt_callout_recipsender|vopt_callout_recippmaster))
1796 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1797 "for a recipient callout";
1801 /* Handle sender-in-header verification. Default the user message to the log
1802 message if giving out verification details. */
1804 if (verify_header_sender)
1807 rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
1808 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
1812 *basic_errno = verrno;
1813 if (smtp_return_error_details)
1815 if (*user_msgptr == NULL && *log_msgptr != NULL)
1816 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1817 if (rc == DEFER) acl_temp_details = TRUE;
1822 /* Handle a sender address. The default is to verify *the* sender address, but
1823 optionally a different address can be given, for special requirements. If the
1824 address is empty, we are dealing with a bounce message that has no sender, so
1825 we cannot do any checking. If the real sender address gets rewritten during
1826 verification (e.g. DNS widening), set the flag to stop it being rewritten again
1827 during message reception.
1829 A list of verified "sender" addresses is kept to try to avoid doing to much
1830 work repetitively when there are multiple recipients in a message and they all
1831 require sender verification. However, when callouts are involved, it gets too
1832 complicated because different recipients may require different callout options.
1833 Therefore, we always do a full sender verify when any kind of callout is
1834 specified. Caching elsewhere, for instance in the DNS resolver and in the
1835 callout handling, should ensure that this is not terribly inefficient. */
1837 else if (verify_sender_address != NULL)
1839 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster))
1842 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
1843 "sender verify callout";
1847 sender_vaddr = verify_checked_sender(verify_sender_address);
1848 if (sender_vaddr != NULL && /* Previously checked */
1849 callout <= 0) /* No callout needed this time */
1851 /* If the "routed" flag is set, it means that routing worked before, so
1852 this check can give OK (the saved return code value, if set, belongs to a
1853 callout that was done previously). If the "routed" flag is not set, routing
1854 must have failed, so we use the saved return code. */
1856 if (testflag(sender_vaddr, af_verify_routed)) rc = OK; else
1858 rc = sender_vaddr->special_action;
1859 *basic_errno = sender_vaddr->basic_errno;
1861 HDEBUG(D_acl) debug_printf("using cached sender verify result\n");
1864 /* Do a new verification, and cache the result. The cache is used to avoid
1865 verifying the sender multiple times for multiple RCPTs when callouts are not
1866 specified (see comments above).
1868 The cache is also used on failure to give details in response to the first
1869 RCPT that gets bounced for this reason. However, this can be suppressed by
1870 the no_details option, which sets the flag that says "this detail has already
1871 been sent". The cache normally contains just one address, but there may be
1872 more in esoteric circumstances. */
1877 uschar *save_address_data = deliver_address_data;
1879 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
1880 if (no_details) setflag(sender_vaddr, af_sverify_told);
1881 if (verify_sender_address[0] != 0)
1883 /* If this is the real sender address, save the unrewritten version
1884 for use later in receive. Otherwise, set a flag so that rewriting the
1885 sender in verify_address() does not update sender_address. */
1887 if (verify_sender_address == sender_address)
1888 sender_address_unrewritten = sender_address;
1890 verify_options |= vopt_fake_sender;
1892 if (success_on_redirect)
1893 verify_options |= vopt_success_on_redirect;
1895 /* The recipient, qualify, and expn options are never set in
1898 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
1899 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
1901 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1905 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
1907 DEBUG(D_acl) debug_printf("sender %s verified ok as %s\n",
1908 verify_sender_address, sender_vaddr->address);
1912 DEBUG(D_acl) debug_printf("sender %s verified ok\n",
1913 verify_sender_address);
1916 else *basic_errno = sender_vaddr->basic_errno;
1918 else rc = OK; /* Null sender */
1920 /* Cache the result code */
1922 if (routed) setflag(sender_vaddr, af_verify_routed);
1923 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
1924 sender_vaddr->special_action = rc;
1925 sender_vaddr->next = sender_verified_list;
1926 sender_verified_list = sender_vaddr;
1928 /* Restore the recipient address data, which might have been clobbered by
1929 the sender verification. */
1931 deliver_address_data = save_address_data;
1934 /* Put the sender address_data value into $sender_address_data */
1936 sender_address_data = sender_vaddr->p.address_data;
1939 /* A recipient address just gets a straightforward verify; again we must handle
1940 the DEFER overrides. */
1946 if (success_on_redirect)
1947 verify_options |= vopt_success_on_redirect;
1949 /* We must use a copy of the address for verification, because it might
1953 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
1954 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
1955 HDEBUG(D_acl) debug_printf("----------- end verify ------------\n");
1957 *basic_errno = addr2.basic_errno;
1958 *log_msgptr = addr2.message;
1959 *user_msgptr = (addr2.user_message != NULL)?
1960 addr2.user_message : addr2.message;
1962 /* Allow details for temporary error if the address is so flagged. */
1963 if (testflag((&addr2), af_pass_message)) acl_temp_details = TRUE;
1965 /* Make $address_data visible */
1966 deliver_address_data = addr2.p.address_data;
1969 /* We have a result from the relevant test. Handle defer overrides first. */
1971 if (rc == DEFER && (defer_ok ||
1972 (callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER)))
1974 HDEBUG(D_acl) debug_printf("verify defer overridden by %s\n",
1975 defer_ok? "defer_ok" : "callout_defer_ok");
1979 /* If we've failed a sender, set up a recipient message, and point
1980 sender_verified_failed to the address item that actually failed. */
1982 if (rc != OK && verify_sender_address != NULL)
1986 *log_msgptr = *user_msgptr = US"Sender verify failed";
1988 else if (*basic_errno != ERRNO_CALLOUTDEFER)
1990 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
1994 *log_msgptr = US"Could not complete sender verify callout";
1995 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
1999 sender_verified_failed = sender_vaddr;
2002 /* Verifying an address messes up the values of $domain and $local_part,
2003 so reset them before returning if this is a RCPT ACL. */
2007 deliver_domain = addr->domain;
2008 deliver_localpart = addr->local_part;
2012 /* Syntax errors in the verify argument come here. */
2015 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2016 "\"helo\", \"header_syntax\", \"header_sender\" or "
2017 "\"reverse_host_lookup\" at start of ACL condition "
2018 "\"verify %s\"", arg);
2021 /* Options supplied when not allowed come here */
2024 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
2025 "(this verify item has no options)", arg);
2028 /* Calls in the wrong ACL come here */
2031 *log_msgptr = string_sprintf("cannot check header contents in ACL for %s "
2032 "(only possible in ACL for DATA)", acl_wherenames[where]);
2039 /*************************************************
2040 * Check argument for control= modifier *
2041 *************************************************/
2043 /* Called from acl_check_condition() below
2046 arg the argument string for control=
2047 pptr set to point to the terminating character
2048 where which ACL we are in
2049 log_msgptr for error messages
2051 Returns: CONTROL_xxx value
2055 decode_control(uschar *arg, uschar **pptr, int where, uschar **log_msgptr)
2060 for (d = controls_list;
2061 d < controls_list + sizeof(controls_list)/sizeof(control_def);
2064 len = Ustrlen(d->name);
2065 if (Ustrncmp(d->name, arg, len) == 0) break;
2068 if (d >= controls_list + sizeof(controls_list)/sizeof(control_def) ||
2069 (arg[len] != 0 && (!d->has_option || arg[len] != '/')))
2071 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2072 return CONTROL_ERROR;
2081 /*************************************************
2082 * Handle rate limiting *
2083 *************************************************/
2085 /* Called by acl_check_condition() below to calculate the result
2086 of the ACL ratelimit condition.
2088 Note that the return value might be slightly unexpected: if the
2089 sender's rate is above the limit then the result is OK. This is
2090 similar to the dnslists condition, and is so that you can write
2091 ACL clauses like: defer ratelimit = 15 / 1h
2094 arg the option string for ratelimit=
2095 where ACL_WHERE_xxxx indicating which ACL this is
2096 log_msgptr for error messages
2098 Returns: OK - Sender's rate is above limit
2099 FAIL - Sender's rate is below limit
2100 DEFER - Problem opening ratelimit database
2101 ERROR - Syntax error in options.
2105 acl_ratelimit(uschar *arg, int where, uschar **log_msgptr)
2107 double limit, period;
2111 BOOL leaky = FALSE, strict = FALSE, noupdate = FALSE;
2112 BOOL per_byte = FALSE, per_cmd = FALSE, per_conn = FALSE, per_mail = FALSE;
2114 tree_node **anchor, *t;
2115 open_db dbblock, *dbm;
2116 dbdata_ratelimit *dbd;
2119 /* Parse the first two options and record their values in expansion
2120 variables. These variables allow the configuration to have informative
2121 error messages based on rate limits obtained from a table lookup. */
2123 /* First is the maximum number of messages per period and maximum burst
2124 size, which must be greater than or equal to zero. Zero is useful for
2125 rate measurement as opposed to rate limiting. */
2127 sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0);
2128 if (sender_rate_limit == NULL)
2132 limit = Ustrtod(sender_rate_limit, &ss);
2133 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2134 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2135 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2137 if (limit < 0.0 || *ss != 0)
2139 *log_msgptr = string_sprintf("syntax error in argument for "
2140 "\"ratelimit\" condition: \"%s\" is not a positive number",
2145 /* Second is the rate measurement period and exponential smoothing time
2146 constant. This must be strictly greater than zero, because zero leads to
2147 run-time division errors. */
2149 sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0);
2150 if (sender_rate_period == NULL) period = -1.0;
2151 else period = readconf_readtime(sender_rate_period, 0, FALSE);
2154 *log_msgptr = string_sprintf("syntax error in argument for "
2155 "\"ratelimit\" condition: \"%s\" is not a time value",
2156 sender_rate_period);
2160 /* Parse the other options. Should we check if the per_* options are being
2161 used in ACLs where they don't make sense, e.g. per_mail in the connect ACL? */
2163 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2166 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2167 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2168 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2169 else if (strcmpic(ss, US"per_byte") == 0) per_byte = TRUE;
2170 else if (strcmpic(ss, US"per_cmd") == 0) per_cmd = TRUE;
2171 else if (strcmpic(ss, US"per_rcpt") == 0) per_cmd = TRUE; /* alias */
2172 else if (strcmpic(ss, US"per_conn") == 0) per_conn = TRUE;
2173 else if (strcmpic(ss, US"per_mail") == 0) per_mail = TRUE;
2174 else key = string_sprintf("%s", ss);
2177 if (leaky + strict > 1 || per_byte + per_cmd + per_conn + per_mail > 1)
2179 *log_msgptr = US"conflicting options for \"ratelimit\" condition";
2183 /* Default option values */
2185 if (!strict) leaky = TRUE;
2186 if (!per_byte && !per_cmd && !per_conn) per_mail = TRUE;
2188 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2189 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2190 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2191 are added to the key because they alter the meaning of the stored data. */
2194 key = (sender_host_address == NULL)? US"" : sender_host_address;
2196 key = string_sprintf("%s/%s/%s/%s",
2198 per_byte? US"per_byte" :
2199 per_cmd? US"per_cmd" :
2200 per_mail? US"per_mail" : US"per_conn",
2201 strict? US"strict" : US"leaky",
2204 HDEBUG(D_acl) debug_printf("ratelimit condition limit=%.0f period=%.0f key=%s\n",
2205 limit, period, key);
2207 /* See if we have already computed the rate by looking in the relevant tree.
2208 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2209 pool so that they survive across resets. */
2212 old_pool = store_pool;
2216 anchor = &ratelimiters_conn;
2217 store_pool = POOL_PERM;
2219 else if (per_mail || per_byte)
2220 anchor = &ratelimiters_mail;
2222 anchor = &ratelimiters_cmd;
2224 if (anchor != NULL && (t = tree_search(*anchor, key)) != NULL)
2227 /* The following few lines duplicate some of the code below. */
2228 rc = (dbd->rate < limit)? FAIL : OK;
2229 store_pool = old_pool;
2230 sender_rate = string_sprintf("%.1f", dbd->rate);
2232 debug_printf("ratelimit found pre-computed rate %s\n", sender_rate);
2236 /* We aren't using a pre-computed rate, so get a previously recorded
2237 rate from the database, update it, and write it back when required. If there's
2238 no previous rate for this key, create one. */
2240 dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE);
2243 store_pool = old_pool;
2245 HDEBUG(D_acl) debug_printf("ratelimit database not available\n");
2246 *log_msgptr = US"ratelimit database not available";
2249 dbd = dbfn_read(dbm, key);
2251 gettimeofday(&tv, NULL);
2255 HDEBUG(D_acl) debug_printf("ratelimit initializing new key's data\n");
2256 dbd = store_get(sizeof(dbdata_ratelimit));
2257 dbd->time_stamp = tv.tv_sec;
2258 dbd->time_usec = tv.tv_usec;
2263 /* The smoothed rate is computed using an exponentially weighted moving
2264 average adjusted for variable sampling intervals. The standard EWMA for
2265 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2266 where f() is the measured value and f'() is the smoothed value.
2268 Old data decays out of the smoothed value exponentially, such that data n
2269 samples old is multiplied by a^n. The exponential decay time constant p
2270 is defined such that data p samples old is multiplied by 1/e, which means
2271 that a = exp(-1/p). We can maintain the same time constant for a variable
2272 sampling interval i by using a = exp(-i/p).
2274 The rate we are measuring is messages per period, suitable for directly
2275 comparing with the limit. The average rate between now and the previous
2276 message is period / interval, which we feed into the EWMA as the sample.
2278 It turns out that the number of messages required for the smoothed rate
2279 to reach the limit when they are sent in a burst is equal to the limit.
2280 This can be seen by analysing the value of the smoothed rate after N
2281 messages sent at even intervals. Let k = (1 - a) * p/i
2283 rate_1 = (1 - a) * p/i + a * rate_0
2285 rate_2 = k + a * rate_1
2286 = k + a * k + a^2 * rate_0
2287 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2288 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2289 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2290 = rate_0 * a^N + p/i * (1 - a^N)
2292 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2294 rate_N = p/i + (rate_0 - p/i) * a^N
2295 a^N = (rate_N - p/i) / (rate_0 - p/i)
2296 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2297 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2299 Numerical analysis of the above equation, setting the computed rate to
2300 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2301 rates, p/i, the number of messages N = limit. So limit serves as both the
2302 maximum rate measured in messages per period, and the maximum number of
2303 messages that can be sent in a fast burst. */
2305 double this_time = (double)tv.tv_sec
2306 + (double)tv.tv_usec / 1000000.0;
2307 double prev_time = (double)dbd->time_stamp
2308 + (double)dbd->time_usec / 1000000.0;
2310 /* We must avoid division by zero, and deal gracefully with the clock going
2311 backwards. If we blunder ahead when time is in reverse then the computed
2312 rate will be bogus. To be safe we clamp interval to a very small number. */
2314 double interval = this_time - prev_time <= 0.0 ? 1e-9
2315 : this_time - prev_time;
2317 double i_over_p = interval / period;
2318 double a = exp(-i_over_p);
2320 dbd->time_stamp = tv.tv_sec;
2321 dbd->time_usec = tv.tv_usec;
2323 /* If we are measuring the rate in bytes per period, multiply the
2324 measured rate by the message size. If we don't know the message size
2325 then it's safe to just use a value of zero and let the recorded rate
2326 decay as if nothing happened. */
2329 dbd->rate = (message_size < 0 ? 0.0 : (double)message_size)
2330 * (1 - a) / i_over_p + a * dbd->rate;
2331 else if (per_cmd && where == ACL_WHERE_NOTSMTP)
2332 dbd->rate = (double)recipients_count
2333 * (1 - a) / i_over_p + a * dbd->rate;
2335 dbd->rate = (1 - a) / i_over_p + a * dbd->rate;
2338 /* Clients sending at the limit are considered to be over the limit. This
2339 matters for edge cases such the first message sent by a client (which gets
2340 the initial rate of 0.0) when the rate limit is zero (i.e. the client should
2341 be completely blocked). */
2343 rc = (dbd->rate < limit)? FAIL : OK;
2345 /* Update the state if the rate is low or if we are being strict. If we
2346 are in leaky mode and the sender's rate is too high, we do not update
2347 the recorded rate in order to avoid an over-aggressive sender's retry
2348 rate preventing them from getting any email through. If noupdate is set,
2349 do not do any updates. */
2351 if ((rc == FAIL || !leaky) && !noupdate)
2353 dbfn_write(dbm, key, dbd, sizeof(dbdata_ratelimit));
2354 HDEBUG(D_acl) debug_printf("ratelimit db updated\n");
2358 HDEBUG(D_acl) debug_printf("ratelimit db not updated: %s\n",
2359 noupdate? "noupdate set" : "over the limit, but leaky");
2364 /* Store the result in the tree for future reference, if necessary. */
2366 if (anchor != NULL && !noupdate)
2368 t = store_get(sizeof(tree_node) + Ustrlen(key));
2370 Ustrcpy(t->name, key);
2371 (void)tree_insertnode(anchor, t);
2374 /* We create the formatted version of the sender's rate very late in
2375 order to ensure that it is done using the correct storage pool. */
2377 store_pool = old_pool;
2378 sender_rate = string_sprintf("%.1f", dbd->rate);
2381 debug_printf("ratelimit computed rate %s\n", sender_rate);
2388 /*************************************************
2389 * Handle conditions/modifiers on an ACL item *
2390 *************************************************/
2392 /* Called from acl_check() below.
2396 cb ACL condition block - if NULL, result is OK
2397 where where called from
2398 addr the address being checked for RCPT, or NULL
2399 level the nesting level
2400 epp pointer to pass back TRUE if "endpass" encountered
2401 (applies only to "accept" and "discard")
2402 user_msgptr user message pointer
2403 log_msgptr log message pointer
2404 basic_errno pointer to where to put verify error
2406 Returns: OK - all conditions are met
2407 DISCARD - an "acl" condition returned DISCARD - only allowed
2408 for "accept" or "discard" verbs
2409 FAIL - at least one condition fails
2410 FAIL_DROP - an "acl" condition returned FAIL_DROP
2411 DEFER - can't tell at the moment (typically, lookup defer,
2412 but can be temporary callout problem)
2413 ERROR - ERROR from nested ACL or expansion failure or other
2418 acl_check_condition(int verb, acl_condition_block *cb, int where,
2419 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2420 uschar **log_msgptr, int *basic_errno)
2422 uschar *user_message = NULL;
2423 uschar *log_message = NULL;
2424 uschar *debug_tag = NULL;
2425 uschar *debug_opts = NULL;
2428 #ifdef WITH_CONTENT_SCAN
2432 for (; cb != NULL; cb = cb->next)
2437 /* The message and log_message items set up messages to be used in
2438 case of rejection. They are expanded later. */
2440 if (cb->type == ACLC_MESSAGE)
2442 user_message = cb->arg;
2446 if (cb->type == ACLC_LOG_MESSAGE)
2448 log_message = cb->arg;
2452 /* The endpass "condition" just sets a flag to show it occurred. This is
2453 checked at compile time to be on an "accept" or "discard" item. */
2455 if (cb->type == ACLC_ENDPASS)
2461 /* For other conditions and modifiers, the argument is expanded now for some
2462 of them, but not for all, because expansion happens down in some lower level
2463 checking functions in some cases. */
2465 if (cond_expand_at_top[cb->type])
2467 arg = expand_string(cb->arg);
2470 if (expand_string_forcedfail) continue;
2471 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
2472 cb->arg, expand_string_message);
2473 return search_find_defer? DEFER : ERROR;
2478 /* Show condition, and expanded condition if it's different */
2483 debug_printf("check %s%s %n",
2484 (!cond_modifiers[cb->type] && cb->u.negated)? "!":"",
2485 conditions[cb->type], &lhswidth);
2487 if (cb->type == ACLC_SET)
2489 debug_printf("acl_%s ", cb->u.varname);
2490 lhswidth += 5 + Ustrlen(cb->u.varname);
2493 debug_printf("= %s\n", cb->arg);
2496 debug_printf("%.*s= %s\n", lhswidth,
2500 /* Check that this condition makes sense at this time */
2502 if ((cond_forbids[cb->type] & (1 << where)) != 0)
2504 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
2505 cond_modifiers[cb->type]? "use" : "test",
2506 conditions[cb->type], acl_wherenames[where]);
2510 /* Run the appropriate test for each condition, or take the appropriate
2511 action for the remaining modifiers. */
2515 case ACLC_ADD_HEADER:
2519 /* A nested ACL that returns "discard" makes sense only for an "accept" or
2523 rc = acl_check_internal(where, addr, arg, level+1, user_msgptr, log_msgptr);
2524 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
2526 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
2527 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
2533 case ACLC_AUTHENTICATED:
2534 rc = (sender_host_authenticated == NULL)? FAIL :
2535 match_isinlist(sender_host_authenticated, &arg, 0, NULL, NULL, MCL_STRING,
2539 #ifdef EXPERIMENTAL_BRIGHTMAIL
2540 case ACLC_BMI_OPTIN:
2542 int old_pool = store_pool;
2543 store_pool = POOL_PERM;
2544 bmi_current_optin = string_copy(arg);
2545 store_pool = old_pool;
2550 case ACLC_CONDITION:
2551 /* The true/false parsing here should be kept in sync with that used in
2552 expand.c when dealing with ECOND_BOOL so that we don't have too many
2553 different definitions of what can be a boolean. */
2554 if (Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
2555 rc = (Uatoi(arg) == 0)? FAIL : OK;
2557 rc = (strcmpic(arg, US"no") == 0 ||
2558 strcmpic(arg, US"false") == 0)? FAIL :
2559 (strcmpic(arg, US"yes") == 0 ||
2560 strcmpic(arg, US"true") == 0)? OK : DEFER;
2562 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
2565 case ACLC_CONTINUE: /* Always succeeds */
2569 control_type = decode_control(arg, &p, where, log_msgptr);
2571 /* Check if this control makes sense at this time */
2573 if ((control_forbids[control_type] & (1 << where)) != 0)
2575 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
2576 controls[control_type], acl_wherenames[where]);
2580 switch(control_type)
2582 case CONTROL_AUTH_UNADVERTISED:
2583 allow_auth_unadvertised = TRUE;
2586 #ifdef EXPERIMENTAL_BRIGHTMAIL
2587 case CONTROL_BMI_RUN:
2592 #ifndef DISABLE_DKIM
2593 case CONTROL_DKIM_VERIFY:
2594 dkim_disable_verify = TRUE;
2601 case CONTROL_CASEFUL_LOCAL_PART:
2602 deliver_localpart = addr->cc_local_part;
2605 case CONTROL_CASELOWER_LOCAL_PART:
2606 deliver_localpart = addr->lc_local_part;
2609 case CONTROL_ENFORCE_SYNC:
2610 smtp_enforce_sync = TRUE;
2613 case CONTROL_NO_ENFORCE_SYNC:
2614 smtp_enforce_sync = FALSE;
2617 #ifdef WITH_CONTENT_SCAN
2618 case CONTROL_NO_MBOX_UNSPOOL:
2619 no_mbox_unspool = TRUE;
2623 case CONTROL_NO_MULTILINE:
2624 no_multiline_responses = TRUE;
2627 case CONTROL_NO_PIPELINING:
2628 pipelining_enable = FALSE;
2631 case CONTROL_NO_DELAY_FLUSH:
2632 disable_delay_flush = TRUE;
2635 case CONTROL_NO_CALLOUT_FLUSH:
2636 disable_callout_flush = TRUE;
2639 case CONTROL_FAKEDEFER:
2640 case CONTROL_FAKEREJECT:
2641 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
2645 while (*pp != 0) pp++;
2646 fake_response_text = expand_string(string_copyn(p+1, pp-p-1));
2651 /* Explicitly reset to default string */
2652 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
2656 case CONTROL_FREEZE:
2657 deliver_freeze = TRUE;
2658 deliver_frozen_at = time(NULL);
2659 freeze_tell = freeze_tell_config; /* Reset to configured value */
2660 if (Ustrncmp(p, "/no_tell", 8) == 0)
2667 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2672 case CONTROL_QUEUE_ONLY:
2673 queue_only_policy = TRUE;
2676 case CONTROL_SUBMISSION:
2677 originator_name = US"";
2678 submission_mode = TRUE;
2681 if (Ustrncmp(p, "/sender_retain", 14) == 0)
2684 active_local_sender_retain = TRUE;
2685 active_local_from_check = FALSE;
2687 else if (Ustrncmp(p, "/domain=", 8) == 0)
2690 while (*pp != 0 && *pp != '/') pp++;
2691 submission_domain = string_copyn(p+8, pp-p-8);
2694 /* The name= option must be last, because it swallows the rest of
2696 else if (Ustrncmp(p, "/name=", 6) == 0)
2699 while (*pp != 0) pp++;
2700 submission_name = string_copy(parse_fix_phrase(p+6, pp-p-6,
2701 big_buffer, big_buffer_size));
2708 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2716 if (Ustrncmp(p, "/tag=", 5) == 0)
2719 while (*pp != '\0' && *pp != '/') pp++;
2720 debug_tag = string_copyn(p+5, pp-p-5);
2723 else if (Ustrncmp(p, "/opts=", 6) == 0)
2726 while (*pp != '\0' && *pp != '/') pp++;
2727 debug_opts = string_copyn(p+6, pp-p-6);
2731 debug_logging_activate(debug_tag, debug_opts);
2734 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
2735 suppress_local_fixups = TRUE;
2740 #ifdef EXPERIMENTAL_DCC
2743 /* Seperate the regular expression and any optional parameters. */
2744 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2745 /* Run the dcc backend. */
2746 rc = dcc_process(&ss);
2747 /* Modify return code based upon the existance of options. */
2748 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2750 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2752 /* FAIL so that the message is passed to the next ACL */
2760 #ifdef WITH_CONTENT_SCAN
2762 rc = mime_decode(&arg);
2768 int delay = readconf_readtime(arg, 0, FALSE);
2771 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
2772 "modifier: \"%s\" is not a time value", arg);
2777 HDEBUG(D_acl) debug_printf("delay modifier requests %d-second delay\n",
2782 debug_printf("delay skipped in -bh checking mode\n");
2785 /* It appears to be impossible to detect that a TCP/IP connection has
2786 gone away without reading from it. This means that we cannot shorten
2787 the delay below if the client goes away, because we cannot discover
2788 that the client has closed its end of the connection. (The connection
2789 is actually in a half-closed state, waiting for the server to close its
2790 end.) It would be nice to be able to detect this state, so that the
2791 Exim process is not held up unnecessarily. However, it seems that we
2792 can't. The poll() function does not do the right thing, and in any case
2793 it is not always available.
2795 NOTE 1: If ever this state of affairs changes, remember that we may be
2796 dealing with stdin/stdout here, in addition to TCP/IP connections.
2797 Also, delays may be specified for non-SMTP input, where smtp_out and
2798 smtp_in will be NULL. Whatever is done must work in all cases.
2800 NOTE 2: The added feature of flushing the output before a delay must
2801 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
2806 if (smtp_out != NULL && !disable_delay_flush) mac_smtp_fflush();
2807 while (delay > 0) delay = sleep(delay);
2813 #ifdef WITH_OLD_DEMIME
2819 #ifndef DISABLE_DKIM
2820 case ACLC_DKIM_SIGNER:
2821 if (dkim_cur_signer != NULL)
2822 rc = match_isinlist(dkim_cur_signer,
2823 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
2828 case ACLC_DKIM_STATUS:
2829 rc = match_isinlist(dkim_exim_expand_query(DKIM_VERIFY_STATUS),
2830 &arg,0,NULL,NULL,MCL_STRING,TRUE,NULL);
2835 rc = verify_check_dnsbl(&arg);
2839 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
2840 addr->domain_cache, MCL_DOMAIN, TRUE, &deliver_domain_data);
2843 /* The value in tls_cipher is the full cipher name, for example,
2844 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
2845 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
2846 what may in practice come out of the SSL library - which at the time of
2847 writing is poorly documented. */
2849 case ACLC_ENCRYPTED:
2850 if (tls_cipher == NULL) rc = FAIL; else
2852 uschar *endcipher = NULL;
2853 uschar *cipher = Ustrchr(tls_cipher, ':');
2854 if (cipher == NULL) cipher = tls_cipher; else
2856 endcipher = Ustrchr(++cipher, ':');
2857 if (endcipher != NULL) *endcipher = 0;
2859 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
2860 if (endcipher != NULL) *endcipher = ':';
2864 /* Use verify_check_this_host() instead of verify_check_host() so that
2865 we can pass over &host_data to catch any looked up data. Once it has been
2866 set, it retains its value so that it's still there if another ACL verb
2867 comes through here and uses the cache. However, we must put it into
2868 permanent store in case it is also expected to be used in a subsequent
2869 message in the same SMTP connection. */
2872 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
2873 (sender_host_address == NULL)? US"" : sender_host_address, &host_data);
2874 if (host_data != NULL) host_data = string_copy_malloc(host_data);
2877 case ACLC_LOCAL_PARTS:
2878 rc = match_isinlist(addr->cc_local_part, &arg, 0,
2879 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
2880 &deliver_localpart_data);
2883 case ACLC_LOG_REJECT_TARGET:
2889 while ((ss = string_nextinlist(&s, &sep, big_buffer, big_buffer_size))
2892 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
2893 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
2894 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
2897 logbits |= LOG_MAIN|LOG_REJECT;
2898 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
2899 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
2902 log_reject_target = logbits;
2915 if (Ustrncmp(s, "main", 4) == 0)
2916 { logbits |= LOG_MAIN; s += 4; }
2917 else if (Ustrncmp(s, "panic", 5) == 0)
2918 { logbits |= LOG_PANIC; s += 5; }
2919 else if (Ustrncmp(s, "reject", 6) == 0)
2920 { logbits |= LOG_REJECT; s += 6; }
2923 logbits = LOG_MAIN|LOG_PANIC;
2924 s = string_sprintf(":unknown log name in \"%s\" in "
2925 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
2931 while (isspace(*s)) s++;
2934 if (logbits == 0) logbits = LOG_MAIN;
2935 log_write(0, logbits, "%s", string_printing(s));
2939 #ifdef WITH_CONTENT_SCAN
2942 /* Separate the regular expression and any optional parameters. */
2943 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
2944 /* Run the malware backend. */
2946 /* Modify return code based upon the existance of options. */
2947 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
2949 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
2951 /* FAIL so that the message is passed to the next ACL */
2958 case ACLC_MIME_REGEX:
2959 rc = mime_regex(&arg);
2963 case ACLC_RATELIMIT:
2964 rc = acl_ratelimit(arg, where, log_msgptr);
2967 case ACLC_RECIPIENTS:
2968 rc = match_address_list(addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
2972 #ifdef WITH_CONTENT_SCAN
2978 case ACLC_SENDER_DOMAINS:
2981 sdomain = Ustrrchr(sender_address, '@');
2982 sdomain = (sdomain == NULL)? US"" : sdomain + 1;
2983 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
2984 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
2989 rc = match_address_list(sender_address, TRUE, TRUE, &arg,
2990 sender_address_cache, -1, 0, &sender_data);
2993 /* Connection variables must persist forever */
2997 int old_pool = store_pool;
2998 if (cb->u.varname[0] == 'c') store_pool = POOL_PERM;
2999 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3000 store_pool = old_pool;
3004 #ifdef WITH_CONTENT_SCAN
3007 /* Seperate the regular expression and any optional parameters. */
3008 uschar *ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size);
3009 /* Run the spam backend. */
3011 /* Modify return code based upon the existance of options. */
3012 while ((ss = string_nextinlist(&arg, &sep, big_buffer, big_buffer_size))
3014 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3016 /* FAIL so that the message is passed to the next ACL */
3024 #ifdef EXPERIMENTAL_SPF
3026 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3028 case ACLC_SPF_GUESS:
3029 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3033 /* If the verb is WARN, discard any user message from verification, because
3034 such messages are SMTP responses, not header additions. The latter come
3035 only from explicit "message" modifiers. However, put the user message into
3036 $acl_verify_message so it can be used in subsequent conditions or modifiers
3037 (until something changes it). */
3040 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3041 acl_verify_message = *user_msgptr;
3042 if (verb == ACL_WARN) *user_msgptr = NULL;
3046 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3047 "condition %d", cb->type);
3051 /* If a condition was negated, invert OK/FAIL. */
3053 if (!cond_modifiers[cb->type] && cb->u.negated)
3055 if (rc == OK) rc = FAIL;
3056 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3059 if (rc != OK) break; /* Conditions loop */
3063 /* If the result is the one for which "message" and/or "log_message" are used,
3064 handle the values of these modifiers. If there isn't a log message set, we make
3065 it the same as the user message.
3067 "message" is a user message that will be included in an SMTP response. Unless
3068 it is empty, it overrides any previously set user message.
3070 "log_message" is a non-user message, and it adds to any existing non-user
3071 message that is already set.
3073 Most verbs have but a single return for which the messages are relevant, but
3074 for "discard", it's useful to have the log message both when it succeeds and
3075 when it fails. For "accept", the message is used in the OK case if there is no
3076 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3079 if (*epp && rc == OK) user_message = NULL;
3081 if (((1<<rc) & msgcond[verb]) != 0)
3084 uschar *old_user_msgptr = *user_msgptr;
3085 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3087 /* If the verb is "warn", messages generated by conditions (verification or
3088 nested ACLs) are always discarded. This also happens for acceptance verbs
3089 when they actually do accept. Only messages specified at this level are used.
3090 However, the value of an existing message is available in $acl_verify_message
3091 during expansions. */
3093 if (verb == ACL_WARN ||
3094 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3095 *log_msgptr = *user_msgptr = NULL;
3097 if (user_message != NULL)
3099 acl_verify_message = old_user_msgptr;
3100 expmessage = expand_string(user_message);
3101 if (expmessage == NULL)
3103 if (!expand_string_forcedfail)
3104 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3105 user_message, expand_string_message);
3107 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3110 if (log_message != NULL)
3112 acl_verify_message = old_log_msgptr;
3113 expmessage = expand_string(log_message);
3114 if (expmessage == NULL)
3116 if (!expand_string_forcedfail)
3117 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3118 log_message, expand_string_message);
3120 else if (expmessage[0] != 0)
3122 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3123 string_sprintf("%s: %s", expmessage, *log_msgptr);
3127 /* If no log message, default it to the user message */
3129 if (*log_msgptr == NULL) *log_msgptr = *user_msgptr;
3132 acl_verify_message = NULL;
3140 /*************************************************
3141 * Get line from a literal ACL *
3142 *************************************************/
3144 /* This function is passed to acl_read() in order to extract individual lines
3145 of a literal ACL, which we access via static pointers. We can destroy the
3146 contents because this is called only once (the compiled ACL is remembered).
3148 This code is intended to treat the data in the same way as lines in the main
3149 Exim configuration file. That is:
3151 . Leading spaces are ignored.
3153 . A \ at the end of a line is a continuation - trailing spaces after the \
3154 are permitted (this is because I don't believe in making invisible things
3155 significant). Leading spaces on the continued part of a line are ignored.
3157 . Physical lines starting (significantly) with # are totally ignored, and
3158 may appear within a sequence of backslash-continued lines.
3160 . Blank lines are ignored, but will end a sequence of continuations.
3163 Returns: a pointer to the next line
3167 static uschar *acl_text; /* Current pointer in the text */
3168 static uschar *acl_text_end; /* Points one past the terminating '0' */
3176 /* This loop handles leading blank lines and comments. */
3180 while (isspace(*acl_text)) acl_text++; /* Leading spaces/empty lines */
3181 if (*acl_text == 0) return NULL; /* No more data */
3182 yield = acl_text; /* Potential data line */
3184 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3186 /* If we hit the end before a newline, we have the whole logical line. If
3187 it's a comment, there's no more data to be given. Otherwise, yield it. */
3189 if (*acl_text == 0) return (*yield == '#')? NULL : yield;
3191 /* After reaching a newline, end this loop if the physical line does not
3192 start with '#'. If it does, it's a comment, and the loop continues. */
3194 if (*yield != '#') break;
3197 /* This loop handles continuations. We know we have some real data, ending in
3198 newline. See if there is a continuation marker at the end (ignoring trailing
3199 white space). We know that *yield is not white space, so no need to test for
3200 cont > yield in the backwards scanning loop. */
3205 for (cont = acl_text - 1; isspace(*cont); cont--);
3207 /* If no continuation follows, we are done. Mark the end of the line and
3216 /* We have encountered a continuation. Skip over whitespace at the start of
3217 the next line, and indeed the whole of the next line or lines if they are
3222 while (*(++acl_text) == ' ' || *acl_text == '\t');
3223 if (*acl_text != '#') break;
3224 while (*(++acl_text) != 0 && *acl_text != '\n');
3227 /* We have the start of a continuation line. Move all the rest of the data
3228 to join onto the previous line, and then find its end. If the end is not a
3229 newline, we are done. Otherwise loop to look for another continuation. */
3231 memmove(cont, acl_text, acl_text_end - acl_text);
3232 acl_text_end -= acl_text - cont;
3234 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
3235 if (*acl_text == 0) return yield;
3238 /* Control does not reach here */
3245 /*************************************************
3246 * Check access using an ACL *
3247 *************************************************/
3249 /* This function is called from address_check. It may recurse via
3250 acl_check_condition() - hence the use of a level to stop looping. The ACL is
3251 passed as a string which is expanded. A forced failure implies no access check
3252 is required. If the result is a single word, it is taken as the name of an ACL
3253 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
3254 text, complete with newlines, and parsed as such. In both cases, the ACL check
3255 is then run. This function uses an auxiliary function for acl_read() to call
3256 for reading individual lines of a literal ACL. This is acl_getline(), which
3257 appears immediately above.
3260 where where called from
3261 addr address item when called from RCPT; otherwise NULL
3262 s the input string; NULL is the same as an empty ACL => DENY
3263 level the nesting level
3264 user_msgptr where to put a user error (for SMTP response)
3265 log_msgptr where to put a logging message (not for SMTP response)
3267 Returns: OK access is granted
3268 DISCARD access is apparently granted...
3269 FAIL access is denied
3270 FAIL_DROP access is denied; drop the connection
3271 DEFER can't tell at the moment
3276 acl_check_internal(int where, address_item *addr, uschar *s, int level,
3277 uschar **user_msgptr, uschar **log_msgptr)
3280 acl_block *acl = NULL;
3281 uschar *acl_name = US"inline ACL";
3284 /* Catch configuration loops */
3288 *log_msgptr = US"ACL nested too deep: possible loop";
3294 HDEBUG(D_acl) debug_printf("ACL is NULL: implicit DENY\n");
3298 /* At top level, we expand the incoming string. At lower levels, it has already
3299 been expanded as part of condition processing. */
3303 ss = expand_string(s);
3306 if (expand_string_forcedfail) return OK;
3307 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
3308 expand_string_message);
3314 while (isspace(*ss))ss++;
3316 /* If we can't find a named ACL, the default is to parse it as an inline one.
3317 (Unless it begins with a slash; non-existent files give rise to an error.) */
3321 /* Handle the case of a string that does not contain any spaces. Look for a
3322 named ACL among those read from the configuration, or a previously read file.
3323 It is possible that the pointer to the ACL is NULL if the configuration
3324 contains a name with no data. If not found, and the text begins with '/',
3325 read an ACL from a file, and save it so it can be re-used. */
3327 if (Ustrchr(ss, ' ') == NULL)
3329 tree_node *t = tree_search(acl_anchor, ss);
3332 acl = (acl_block *)(t->data.ptr);
3335 HDEBUG(D_acl) debug_printf("ACL \"%s\" is empty: implicit DENY\n", ss);
3338 acl_name = string_sprintf("ACL \"%s\"", ss);
3339 HDEBUG(D_acl) debug_printf("using ACL \"%s\"\n", ss);
3342 else if (*ss == '/')
3344 struct stat statbuf;
3345 fd = Uopen(ss, O_RDONLY, 0);
3348 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
3353 if (fstat(fd, &statbuf) != 0)
3355 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
3360 acl_text = store_get(statbuf.st_size + 1);
3361 acl_text_end = acl_text + statbuf.st_size + 1;
3363 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
3365 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
3366 ss, strerror(errno));
3369 acl_text[statbuf.st_size] = 0;
3372 acl_name = string_sprintf("ACL \"%s\"", ss);
3373 HDEBUG(D_acl) debug_printf("read ACL from file %s\n", ss);
3377 /* Parse an ACL that is still in text form. If it came from a file, remember it
3378 in the ACL tree, having read it into the POOL_PERM store pool so that it
3379 persists between multiple messages. */
3383 int old_pool = store_pool;
3384 if (fd >= 0) store_pool = POOL_PERM;
3385 acl = acl_read(acl_getline, log_msgptr);
3386 store_pool = old_pool;
3387 if (acl == NULL && *log_msgptr != NULL) return ERROR;
3390 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss));
3391 Ustrcpy(t->name, ss);
3393 (void)tree_insertnode(&acl_anchor, t);
3397 /* Now we have an ACL to use. It's possible it may be NULL. */
3402 int basic_errno = 0;
3403 BOOL endpass_seen = FALSE;
3405 *log_msgptr = *user_msgptr = NULL;
3406 acl_temp_details = FALSE;
3408 if ((where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT) &&
3409 acl->verb != ACL_ACCEPT &&
3410 acl->verb != ACL_WARN)
3412 *log_msgptr = string_sprintf("\"%s\" is not allowed in a QUIT or not-QUIT ACL",
3417 HDEBUG(D_acl) debug_printf("processing \"%s\"\n", verbs[acl->verb]);
3419 /* Clear out any search error message from a previous check before testing
3422 search_error_message = NULL;
3423 cond = acl_check_condition(acl->verb, acl->condition, where, addr, level,
3424 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
3426 /* Handle special returns: DEFER causes a return except on a WARN verb;
3427 ERROR always causes a return. */
3432 HDEBUG(D_acl) debug_printf("%s: condition test deferred\n", verbs[acl->verb]);
3433 if (basic_errno != ERRNO_CALLOUTDEFER)
3435 if (search_error_message != NULL && *search_error_message != 0)
3436 *log_msgptr = search_error_message;
3437 if (smtp_return_error_details) acl_temp_details = TRUE;
3441 acl_temp_details = TRUE;
3443 if (acl->verb != ACL_WARN) return DEFER;
3446 default: /* Paranoia */
3448 HDEBUG(D_acl) debug_printf("%s: condition test error\n", verbs[acl->verb]);
3452 HDEBUG(D_acl) debug_printf("%s: condition test succeeded\n",
3457 HDEBUG(D_acl) debug_printf("%s: condition test failed\n", verbs[acl->verb]);
3460 /* DISCARD and DROP can happen only from a nested ACL condition, and
3461 DISCARD can happen only for an "accept" or "discard" verb. */
3464 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"discard\"\n",
3469 HDEBUG(D_acl) debug_printf("%s: condition test yielded \"drop\"\n",
3474 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
3475 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
3476 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
3481 if (cond == OK || cond == DISCARD) return cond;
3484 HDEBUG(D_acl) debug_printf("accept: endpass encountered - denying access\n");
3492 acl_temp_details = TRUE;
3498 if (cond == OK) return FAIL;
3502 if (cond == OK || cond == DISCARD) return DISCARD;
3505 HDEBUG(D_acl) debug_printf("discard: endpass encountered - denying access\n");
3511 if (cond == OK) return FAIL_DROP;
3515 if (cond != OK) return cond;
3520 acl_warn(where, *user_msgptr, *log_msgptr);
3521 else if (cond == DEFER && (log_extra_selector & LX_acl_warn_skipped) != 0)
3522 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
3523 "condition test deferred%s%s", host_and_ident(TRUE),
3524 (*log_msgptr == NULL)? US"" : US": ",
3525 (*log_msgptr == NULL)? US"" : *log_msgptr);
3526 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
3530 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
3535 /* Pass to the next ACL item */
3540 /* We have reached the end of the ACL. This is an implicit DENY. */
3542 HDEBUG(D_acl) debug_printf("end of %s: implicit DENY\n", acl_name);
3547 /*************************************************
3548 * Check access using an ACL *
3549 *************************************************/
3551 /* This is the external interface for ACL checks. It sets up an address and the
3552 expansions for $domain and $local_part when called after RCPT, then calls
3553 acl_check_internal() to do the actual work.
3556 where ACL_WHERE_xxxx indicating where called from
3557 recipient RCPT address for RCPT check, else NULL
3558 s the input string; NULL is the same as an empty ACL => DENY
3559 user_msgptr where to put a user error (for SMTP response)
3560 log_msgptr where to put a logging message (not for SMTP response)
3562 Returns: OK access is granted by an ACCEPT verb
3563 DISCARD access is granted by a DISCARD verb
3564 FAIL access is denied
3565 FAIL_DROP access is denied; drop the connection
3566 DEFER can't tell at the moment
3571 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
3572 uschar **log_msgptr)
3576 address_item *addr = NULL;
3578 *user_msgptr = *log_msgptr = NULL;
3579 sender_verified_failed = NULL;
3580 ratelimiters_cmd = NULL;
3581 log_reject_target = LOG_MAIN|LOG_REJECT;
3583 if (where == ACL_WHERE_RCPT)
3585 adb = address_defaults;
3587 addr->address = recipient;
3588 if (deliver_split_address(addr) == DEFER)
3590 *log_msgptr = US"defer in percent_hack_domains check";
3593 deliver_domain = addr->domain;
3594 deliver_localpart = addr->local_part;
3597 rc = acl_check_internal(where, addr, s, 0, user_msgptr, log_msgptr);
3599 deliver_domain = deliver_localpart = deliver_address_data =
3600 sender_address_data = NULL;
3602 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
3603 ACL, which is really in the middle of an SMTP command. */
3607 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
3609 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
3610 "ACL", acl_wherenames[where]);
3616 /* A DROP response is not permitted from MAILAUTH */
3618 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
3620 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
3621 "ACL", acl_wherenames[where]);
3625 /* Before giving a response, take a look at the length of any user message, and
3626 split it up into multiple lines if possible. */
3628 *user_msgptr = string_split_message(*user_msgptr);
3629 if (fake_response != OK)
3630 fake_response_text = string_split_message(fake_response_text);
3637 /*************************************************
3638 * Create ACL variable *
3639 *************************************************/
3641 /* Create an ACL variable or reuse an existing one. ACL variables are in a
3642 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
3645 name pointer to the variable's name, starting with c or m
3647 Returns the pointer to variable's tree node
3651 acl_var_create(uschar *name)
3653 tree_node *node, **root;
3654 root = (name[0] == 'c')? &acl_var_c : &acl_var_m;
3655 node = tree_search(*root, name);
3658 node = store_get(sizeof(tree_node) + Ustrlen(name));
3659 Ustrcpy(node->name, name);
3660 (void)tree_insertnode(root, node);
3662 node->data.ptr = NULL;
3668 /*************************************************
3669 * Write an ACL variable in spool format *
3670 *************************************************/
3672 /* This function is used as a callback for tree_walk when writing variables to
3673 the spool file. To retain spool file compatibility, what is written is -aclc or
3674 -aclm followed by the rest of the name and the data length, space separated,
3675 then the value itself, starting on a new line, and terminated by an additional
3676 newline. When we had only numbered ACL variables, the first line might look
3677 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
3681 name of the variable
3682 value of the variable
3683 ctx FILE pointer (as a void pointer)
3689 acl_var_write(uschar *name, uschar *value, void *ctx)
3691 FILE *f = (FILE *)ctx;
3692 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);