1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
8
9 /* Code for handling Access Control Lists (ACLs) */
10
11 #include "exim.h"
12
13 #ifndef MACRO_PREDEF
14
15 /* Default callout timeout */
16
17 #define CALLOUT_TIMEOUT_DEFAULT 30
18
19 /* Default quota cache TTLs */
20
21 #define QUOTA_POS_DEFAULT (5*60)
22 #define QUOTA_NEG_DEFAULT (60*60)
23
24
25 /* ACL verb codes - keep in step with the table of verbs that follows */
26
27 enum { ACL_ACCEPT, ACL_DEFER, ACL_DENY, ACL_DISCARD, ACL_DROP, ACL_REQUIRE,
28 ACL_WARN };
29
30 /* ACL verbs */
31
32 static uschar *verbs[] = {
33 [ACL_ACCEPT] = US"accept",
34 [ACL_DEFER] = US"defer",
35 [ACL_DENY] = US"deny",
36 [ACL_DISCARD] = US"discard",
37 [ACL_DROP] = US"drop",
38 [ACL_REQUIRE] = US"require",
39 [ACL_WARN] = US"warn"
40 };
41
42 /* For each verb, the conditions for which "message" or "log_message" are used
43 are held as a bitmap. This is to avoid expanding the strings unnecessarily. For
44 "accept", the FAIL case is used only after "endpass", but that is selected in
45 the code. */
46
47 static int msgcond[] = {
48 [ACL_ACCEPT] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
49 [ACL_DEFER] = BIT(OK),
50 [ACL_DENY] = BIT(OK),
51 [ACL_DISCARD] = BIT(OK) | BIT(FAIL) | BIT(FAIL_DROP),
52 [ACL_DROP] = BIT(OK),
53 [ACL_REQUIRE] = BIT(FAIL) | BIT(FAIL_DROP),
54 [ACL_WARN] = BIT(OK)
55 };
56
57 #endif
58
59 /* ACL condition and modifier codes - keep in step with the table that
60 follows.
61 down. */
62
63 enum { ACLC_ACL,
64 ACLC_ADD_HEADER,
65 ACLC_AUTHENTICATED,
66 #ifdef EXPERIMENTAL_BRIGHTMAIL
67 ACLC_BMI_OPTIN,
68 #endif
69 ACLC_CONDITION,
70 ACLC_CONTINUE,
71 ACLC_CONTROL,
72 #ifdef EXPERIMENTAL_DCC
73 ACLC_DCC,
74 #endif
75 #ifdef WITH_CONTENT_SCAN
76 ACLC_DECODE,
77 #endif
78 ACLC_DELAY,
79 #ifndef DISABLE_DKIM
80 ACLC_DKIM_SIGNER,
81 ACLC_DKIM_STATUS,
82 #endif
83 #ifdef SUPPORT_DMARC
84 ACLC_DMARC_STATUS,
85 #endif
86 ACLC_DNSLISTS,
87 ACLC_DOMAINS,
88 ACLC_ENCRYPTED,
89 ACLC_ENDPASS,
90 ACLC_HOSTS,
91 ACLC_LOCAL_PARTS,
92 ACLC_LOG_MESSAGE,
93 ACLC_LOG_REJECT_TARGET,
94 ACLC_LOGWRITE,
95 #ifdef WITH_CONTENT_SCAN
96 ACLC_MALWARE,
97 #endif
98 ACLC_MESSAGE,
99 #ifdef WITH_CONTENT_SCAN
100 ACLC_MIME_REGEX,
101 #endif
102 ACLC_QUEUE,
103 ACLC_RATELIMIT,
104 ACLC_RECIPIENTS,
105 #ifdef WITH_CONTENT_SCAN
106 ACLC_REGEX,
107 #endif
108 ACLC_REMOVE_HEADER,
109 ACLC_SENDER_DOMAINS,
110 ACLC_SENDERS,
111 ACLC_SET,
112 #ifdef WITH_CONTENT_SCAN
113 ACLC_SPAM,
114 #endif
115 #ifdef SUPPORT_SPF
116 ACLC_SPF,
117 ACLC_SPF_GUESS,
118 #endif
119 ACLC_UDPSEND,
120 ACLC_VERIFY };
121
122 /* ACL conditions/modifiers: "delay", "control", "continue", "endpass",
123 "message", "log_message", "log_reject_target", "logwrite", "queue" and "set" are
124 modifiers that look like conditions but always return TRUE. They are used for
125 their side effects. Do not invent new modifier names that result in one name
126 being the prefix of another; the binary-search in the list will go wrong. */
127
128 typedef struct condition_def {
129 uschar *name;
130
131 /* Flag to indicate the condition/modifier has a string expansion done
132 at the outer level. In the other cases, expansion already occurs in the
133 checking functions. */
134 BOOL expand_at_top:1;
135
136 BOOL is_modifier:1;
137
138 /* Bit map vector of which conditions and modifiers are not allowed at certain
139 times. For each condition and modifier, there's a bitmap of dis-allowed times.
140 For some, it is easier to specify the negation of a small number of allowed
141 times. */
142 unsigned forbids;
143
144 } condition_def;
145
146 static condition_def conditions[] = {
147 [ACLC_ACL] = { US"acl", FALSE, FALSE, 0 },
148
149 [ACLC_ADD_HEADER] = { US"add_header", TRUE, TRUE,
150 (unsigned int)
151 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
152 ACL_BIT_PREDATA | ACL_BIT_DATA |
153 #ifndef DISABLE_PRDR
154 ACL_BIT_PRDR |
155 #endif
156 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
157 ACL_BIT_DKIM |
158 ACL_BIT_NOTSMTP_START),
159 },
160
161 [ACLC_AUTHENTICATED] = { US"authenticated", FALSE, FALSE,
162 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
163 ACL_BIT_CONNECT | ACL_BIT_HELO,
164 },
165 #ifdef EXPERIMENTAL_BRIGHTMAIL
166 [ACLC_BMI_OPTIN] = { US"bmi_optin", TRUE, TRUE,
167 ACL_BIT_AUTH |
168 ACL_BIT_CONNECT | ACL_BIT_HELO |
169 ACL_BIT_DATA | ACL_BIT_MIME |
170 # ifndef DISABLE_PRDR
171 ACL_BIT_PRDR |
172 # endif
173 ACL_BIT_ETRN | ACL_BIT_EXPN |
174 ACL_BIT_MAILAUTH |
175 ACL_BIT_MAIL | ACL_BIT_STARTTLS |
176 ACL_BIT_VRFY | ACL_BIT_PREDATA |
177 ACL_BIT_NOTSMTP_START,
178 },
179 #endif
180 [ACLC_CONDITION] = { US"condition", TRUE, FALSE, 0 },
181 [ACLC_CONTINUE] = { US"continue", TRUE, TRUE, 0 },
182
183 /* Certain types of control are always allowed, so we let it through
184 always and check in the control processing itself. */
185 [ACLC_CONTROL] = { US"control", TRUE, TRUE, 0 },
186
187 #ifdef EXPERIMENTAL_DCC
188 [ACLC_DCC] = { US"dcc", TRUE, FALSE,
189 (unsigned int)
190 ~(ACL_BIT_DATA |
191 # ifndef DISABLE_PRDR
192 ACL_BIT_PRDR |
193 # endif
194 ACL_BIT_NOTSMTP),
195 },
196 #endif
197 #ifdef WITH_CONTENT_SCAN
198 [ACLC_DECODE] = { US"decode", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
199
200 #endif
201 [ACLC_DELAY] = { US"delay", TRUE, TRUE, ACL_BIT_NOTQUIT },
202 #ifndef DISABLE_DKIM
203 [ACLC_DKIM_SIGNER] = { US"dkim_signers", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
204 [ACLC_DKIM_STATUS] = { US"dkim_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DKIM },
205 #endif
206 #ifdef SUPPORT_DMARC
207 [ACLC_DMARC_STATUS] = { US"dmarc_status", TRUE, FALSE, (unsigned int) ~ACL_BIT_DATA },
208 #endif
209
210 /* Explicit key lookups can be made in non-smtp ACLs so pass
211 always and check in the verify processing itself. */
212 [ACLC_DNSLISTS] = { US"dnslists", TRUE, FALSE, 0 },
213
214 [ACLC_DOMAINS] = { US"domains", FALSE, FALSE,
215 (unsigned int)
216 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
217 #ifndef DISABLE_PRDR
218 |ACL_BIT_PRDR
219 #endif
220 ),
221 },
222 [ACLC_ENCRYPTED] = { US"encrypted", FALSE, FALSE,
223 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START |
224 ACL_BIT_HELO,
225 },
226
227 [ACLC_ENDPASS] = { US"endpass", TRUE, TRUE, 0 },
228
229 [ACLC_HOSTS] = { US"hosts", FALSE, FALSE,
230 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
231 },
232 [ACLC_LOCAL_PARTS] = { US"local_parts", FALSE, FALSE,
233 (unsigned int)
234 ~(ACL_BIT_RCPT | ACL_BIT_VRFY
235 #ifndef DISABLE_PRDR
236 | ACL_BIT_PRDR
237 #endif
238 ),
239 },
240
241 [ACLC_LOG_MESSAGE] = { US"log_message", TRUE, TRUE, 0 },
242 [ACLC_LOG_REJECT_TARGET] = { US"log_reject_target", TRUE, TRUE, 0 },
243 [ACLC_LOGWRITE] = { US"logwrite", TRUE, TRUE, 0 },
244
245 #ifdef WITH_CONTENT_SCAN
246 [ACLC_MALWARE] = { US"malware", TRUE, FALSE,
247 (unsigned int)
248 ~(ACL_BIT_DATA |
249 # ifndef DISABLE_PRDR
250 ACL_BIT_PRDR |
251 # endif
252 ACL_BIT_NOTSMTP),
253 },
254 #endif
255
256 [ACLC_MESSAGE] = { US"message", TRUE, TRUE, 0 },
257 #ifdef WITH_CONTENT_SCAN
258 [ACLC_MIME_REGEX] = { US"mime_regex", TRUE, FALSE, (unsigned int) ~ACL_BIT_MIME },
259 #endif
260
261 [ACLC_QUEUE] = { US"queue", TRUE, TRUE,
262 ACL_BIT_NOTSMTP |
263 #ifndef DISABLE_PRDR
264 ACL_BIT_PRDR |
265 #endif
266 ACL_BIT_DATA,
267 },
268
269 [ACLC_RATELIMIT] = { US"ratelimit", TRUE, FALSE, 0 },
270 [ACLC_RECIPIENTS] = { US"recipients", FALSE, FALSE, (unsigned int) ~ACL_BIT_RCPT },
271
272 #ifdef WITH_CONTENT_SCAN
273 [ACLC_REGEX] = { US"regex", TRUE, FALSE,
274 (unsigned int)
275 ~(ACL_BIT_DATA |
276 # ifndef DISABLE_PRDR
277 ACL_BIT_PRDR |
278 # endif
279 ACL_BIT_NOTSMTP |
280 ACL_BIT_MIME),
281 },
282
283 #endif
284 [ACLC_REMOVE_HEADER] = { US"remove_header", TRUE, TRUE,
285 (unsigned int)
286 ~(ACL_BIT_MAIL|ACL_BIT_RCPT |
287 ACL_BIT_PREDATA | ACL_BIT_DATA |
288 #ifndef DISABLE_PRDR
289 ACL_BIT_PRDR |
290 #endif
291 ACL_BIT_MIME | ACL_BIT_NOTSMTP |
292 ACL_BIT_NOTSMTP_START),
293 },
294 [ACLC_SENDER_DOMAINS] = { US"sender_domains", FALSE, FALSE,
295 ACL_BIT_AUTH | ACL_BIT_CONNECT |
296 ACL_BIT_HELO |
297 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
298 ACL_BIT_ETRN | ACL_BIT_EXPN |
299 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
300 },
301 [ACLC_SENDERS] = { US"senders", FALSE, FALSE,
302 ACL_BIT_AUTH | ACL_BIT_CONNECT |
303 ACL_BIT_HELO |
304 ACL_BIT_MAILAUTH | ACL_BIT_QUIT |
305 ACL_BIT_ETRN | ACL_BIT_EXPN |
306 ACL_BIT_STARTTLS | ACL_BIT_VRFY,
307 },
308
309 [ACLC_SET] = { US"set", TRUE, TRUE, 0 },
310
311 #ifdef WITH_CONTENT_SCAN
312 [ACLC_SPAM] = { US"spam", TRUE, FALSE,
313 (unsigned int) ~(ACL_BIT_DATA |
314 # ifndef DISABLE_PRDR
315 ACL_BIT_PRDR |
316 # endif
317 ACL_BIT_NOTSMTP),
318 },
319 #endif
320 #ifdef SUPPORT_SPF
321 [ACLC_SPF] = { US"spf", TRUE, FALSE,
322 ACL_BIT_AUTH | ACL_BIT_CONNECT |
323 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
324 ACL_BIT_ETRN | ACL_BIT_EXPN |
325 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
326 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
327 },
328 [ACLC_SPF_GUESS] = { US"spf_guess", TRUE, FALSE,
329 ACL_BIT_AUTH | ACL_BIT_CONNECT |
330 ACL_BIT_HELO | ACL_BIT_MAILAUTH |
331 ACL_BIT_ETRN | ACL_BIT_EXPN |
332 ACL_BIT_STARTTLS | ACL_BIT_VRFY |
333 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START,
334 },
335 #endif
336 [ACLC_UDPSEND] = { US"udpsend", TRUE, TRUE, 0 },
337
338 /* Certain types of verify are always allowed, so we let it through
339 always and check in the verify function itself */
340 [ACLC_VERIFY] = { US"verify", TRUE, FALSE, 0 },
341 };
342
343
344 #ifdef MACRO_PREDEF
345 # include "macro_predef.h"
346 void
features_acl(void)347 features_acl(void)
348 {
349 for (condition_def * c = conditions; c < conditions + nelem(conditions); c++)
350 {
351 uschar buf[64], * p, * s;
352 int n = sprintf(CS buf, "_ACL_%s_", c->is_modifier ? "MOD" : "COND");
353 for (p = buf + n, s = c->name; *s; s++) *p++ = toupper(*s);
354 *p = '\0';
355 builtin_macro_create(buf);
356 }
357 }
358 #endif
359
360
361 #ifndef MACRO_PREDEF
362
363 /* Return values from decode_control(); used as index so keep in step
364 with the controls_list table that follows! */
365
366 enum {
367 CONTROL_AUTH_UNADVERTISED,
368 #ifdef EXPERIMENTAL_BRIGHTMAIL
369 CONTROL_BMI_RUN,
370 #endif
371 CONTROL_CASEFUL_LOCAL_PART,
372 CONTROL_CASELOWER_LOCAL_PART,
373 CONTROL_CUTTHROUGH_DELIVERY,
374 CONTROL_DEBUG,
375 #ifndef DISABLE_DKIM
376 CONTROL_DKIM_VERIFY,
377 #endif
378 #ifdef SUPPORT_DMARC
379 CONTROL_DMARC_VERIFY,
380 CONTROL_DMARC_FORENSIC,
381 #endif
382 CONTROL_DSCP,
383 CONTROL_ENFORCE_SYNC,
384 CONTROL_ERROR, /* pseudo-value for decode errors */
385 CONTROL_FAKEDEFER,
386 CONTROL_FAKEREJECT,
387 CONTROL_FREEZE,
388
389 CONTROL_NO_CALLOUT_FLUSH,
390 CONTROL_NO_DELAY_FLUSH,
391 CONTROL_NO_ENFORCE_SYNC,
392 #ifdef WITH_CONTENT_SCAN
393 CONTROL_NO_MBOX_UNSPOOL,
394 #endif
395 CONTROL_NO_MULTILINE,
396 CONTROL_NO_PIPELINING,
397
398 CONTROL_QUEUE,
399 CONTROL_SUBMISSION,
400 CONTROL_SUPPRESS_LOCAL_FIXUPS,
401 #ifdef SUPPORT_I18N
402 CONTROL_UTF8_DOWNCONVERT,
403 #endif
404 };
405
406
407
408 /* Structure listing various control arguments, with their characteristics.
409 For each control, there's a bitmap of dis-allowed times. For some, it is easier
410 to specify the negation of a small number of allowed times. */
411
412 typedef struct control_def {
413 uschar *name;
414 BOOL has_option; /* Has /option(s) following */
415 unsigned forbids; /* bitmap of dis-allowed times */
416 } control_def;
417
418 static control_def controls_list[] = {
419 /* name has_option forbids */
420 [CONTROL_AUTH_UNADVERTISED] =
421 { US"allow_auth_unadvertised", FALSE,
422 (unsigned)
423 ~(ACL_BIT_CONNECT | ACL_BIT_HELO)
424 },
425 #ifdef EXPERIMENTAL_BRIGHTMAIL
426 [CONTROL_BMI_RUN] =
427 { US"bmi_run", FALSE, 0 },
428 #endif
429 [CONTROL_CASEFUL_LOCAL_PART] =
430 { US"caseful_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
431 [CONTROL_CASELOWER_LOCAL_PART] =
432 { US"caselower_local_part", FALSE, (unsigned) ~ACL_BIT_RCPT },
433 [CONTROL_CUTTHROUGH_DELIVERY] =
434 { US"cutthrough_delivery", TRUE, 0 },
435 [CONTROL_DEBUG] =
436 { US"debug", TRUE, 0 },
437
438 #ifndef DISABLE_DKIM
439 [CONTROL_DKIM_VERIFY] =
440 { US"dkim_disable_verify", FALSE,
441 ACL_BIT_DATA | ACL_BIT_NOTSMTP |
442 # ifndef DISABLE_PRDR
443 ACL_BIT_PRDR |
444 # endif
445 ACL_BIT_NOTSMTP_START
446 },
447 #endif
448
449 #ifdef SUPPORT_DMARC
450 [CONTROL_DMARC_VERIFY] =
451 { US"dmarc_disable_verify", FALSE,
452 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
453 },
454 [CONTROL_DMARC_FORENSIC] =
455 { US"dmarc_enable_forensic", FALSE,
456 ACL_BIT_DATA | ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
457 },
458 #endif
459
460 [CONTROL_DSCP] =
461 { US"dscp", TRUE,
462 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START | ACL_BIT_NOTQUIT
463 },
464 [CONTROL_ENFORCE_SYNC] =
465 { US"enforce_sync", FALSE,
466 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
467 },
468
469 /* Pseudo-value for decode errors */
470 [CONTROL_ERROR] =
471 { US"error", FALSE, 0 },
472
473 [CONTROL_FAKEDEFER] =
474 { US"fakedefer", TRUE,
475 (unsigned)
476 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
477 ACL_BIT_PREDATA | ACL_BIT_DATA |
478 #ifndef DISABLE_PRDR
479 ACL_BIT_PRDR |
480 #endif
481 ACL_BIT_MIME)
482 },
483 [CONTROL_FAKEREJECT] =
484 { US"fakereject", TRUE,
485 (unsigned)
486 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
487 ACL_BIT_PREDATA | ACL_BIT_DATA |
488 #ifndef DISABLE_PRDR
489 ACL_BIT_PRDR |
490 #endif
491 ACL_BIT_MIME)
492 },
493 [CONTROL_FREEZE] =
494 { US"freeze", TRUE,
495 (unsigned)
496 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
497 ACL_BIT_PREDATA | ACL_BIT_DATA |
498 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
499 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
500 },
501
502 [CONTROL_NO_CALLOUT_FLUSH] =
503 { US"no_callout_flush", FALSE,
504 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
505 },
506 [CONTROL_NO_DELAY_FLUSH] =
507 { US"no_delay_flush", FALSE,
508 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
509 },
510
511 [CONTROL_NO_ENFORCE_SYNC] =
512 { US"no_enforce_sync", FALSE,
513 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
514 },
515 #ifdef WITH_CONTENT_SCAN
516 [CONTROL_NO_MBOX_UNSPOOL] =
517 { US"no_mbox_unspool", FALSE,
518 (unsigned)
519 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
520 ACL_BIT_PREDATA | ACL_BIT_DATA |
521 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
522 ACL_BIT_MIME)
523 },
524 #endif
525 [CONTROL_NO_MULTILINE] =
526 { US"no_multiline_responses", FALSE,
527 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
528 },
529 [CONTROL_NO_PIPELINING] =
530 { US"no_pipelining", FALSE,
531 ACL_BIT_NOTSMTP | ACL_BIT_NOTSMTP_START
532 },
533
534 [CONTROL_QUEUE] =
535 { US"queue", TRUE,
536 (unsigned)
537 ~(ACL_BIT_MAIL | ACL_BIT_RCPT |
538 ACL_BIT_PREDATA | ACL_BIT_DATA |
539 // ACL_BIT_PRDR| /* Not allow one user to freeze for all */
540 ACL_BIT_NOTSMTP | ACL_BIT_MIME)
541 },
542
543 [CONTROL_SUBMISSION] =
544 { US"submission", TRUE,
545 (unsigned)
546 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA)
547 },
548 [CONTROL_SUPPRESS_LOCAL_FIXUPS] =
549 { US"suppress_local_fixups", FALSE,
550 (unsigned)
551 ~(ACL_BIT_MAIL | ACL_BIT_RCPT | ACL_BIT_PREDATA |
552 ACL_BIT_NOTSMTP_START)
553 },
554 #ifdef SUPPORT_I18N
555 [CONTROL_UTF8_DOWNCONVERT] =
556 { US"utf8_downconvert", TRUE, (unsigned) ~(ACL_BIT_RCPT | ACL_BIT_VRFY)
557 }
558 #endif
559 };
560
561 /* Support data structures for Client SMTP Authorization. acl_verify_csa()
562 caches its result in a tree to avoid repeated DNS queries. The result is an
563 integer code which is used as an index into the following tables of
564 explanatory strings and verification return codes. */
565
566 static tree_node *csa_cache = NULL;
567
568 enum { CSA_UNKNOWN, CSA_OK, CSA_DEFER_SRV, CSA_DEFER_ADDR,
569 CSA_FAIL_EXPLICIT, CSA_FAIL_DOMAIN, CSA_FAIL_NOADDR, CSA_FAIL_MISMATCH };
570
571 /* The acl_verify_csa() return code is translated into an acl_verify() return
572 code using the following table. It is OK unless the client is definitely not
573 authorized. This is because CSA is supposed to be optional for sending sites,
574 so recipients should not be too strict about checking it - especially because
575 DNS problems are quite likely to occur. It's possible to use $csa_status in
576 further ACL conditions to distinguish ok, unknown, and defer if required, but
577 the aim is to make the usual configuration simple. */
578
579 static int csa_return_code[] = {
580 [CSA_UNKNOWN] = OK,
581 [CSA_OK] = OK,
582 [CSA_DEFER_SRV] = OK,
583 [CSA_DEFER_ADDR] = OK,
584 [CSA_FAIL_EXPLICIT] = FAIL,
585 [CSA_FAIL_DOMAIN] = FAIL,
586 [CSA_FAIL_NOADDR] = FAIL,
587 [CSA_FAIL_MISMATCH] = FAIL
588 };
589
590 static uschar *csa_status_string[] = {
591 [CSA_UNKNOWN] = US"unknown",
592 [CSA_OK] = US"ok",
593 [CSA_DEFER_SRV] = US"defer",
594 [CSA_DEFER_ADDR] = US"defer",
595 [CSA_FAIL_EXPLICIT] = US"fail",
596 [CSA_FAIL_DOMAIN] = US"fail",
597 [CSA_FAIL_NOADDR] = US"fail",
598 [CSA_FAIL_MISMATCH] = US"fail"
599 };
600
601 static uschar *csa_reason_string[] = {
602 [CSA_UNKNOWN] = US"unknown",
603 [CSA_OK] = US"ok",
604 [CSA_DEFER_SRV] = US"deferred (SRV lookup failed)",
605 [CSA_DEFER_ADDR] = US"deferred (target address lookup failed)",
606 [CSA_FAIL_EXPLICIT] = US"failed (explicit authorization required)",
607 [CSA_FAIL_DOMAIN] = US"failed (host name not authorized)",
608 [CSA_FAIL_NOADDR] = US"failed (no authorized addresses)",
609 [CSA_FAIL_MISMATCH] = US"failed (client address mismatch)"
610 };
611
612 /* Options for the ratelimit condition. Note that there are two variants of
613 the per_rcpt option, depending on the ACL that is used to measure the rate.
614 However any ACL must be able to look up per_rcpt rates in /noupdate mode,
615 so the two variants must have the same internal representation as well as
616 the same configuration string. */
617
618 enum {
619 RATE_PER_WHAT, RATE_PER_CLASH, RATE_PER_ADDR, RATE_PER_BYTE, RATE_PER_CMD,
620 RATE_PER_CONN, RATE_PER_MAIL, RATE_PER_RCPT, RATE_PER_ALLRCPTS
621 };
622
623 #define RATE_SET(var,new) \
624 (((var) == RATE_PER_WHAT) ? ((var) = RATE_##new) : ((var) = RATE_PER_CLASH))
625
626 static uschar *ratelimit_option_string[] = {
627 [RATE_PER_WHAT] = US"?",
628 [RATE_PER_CLASH] = US"!",
629 [RATE_PER_ADDR] = US"per_addr",
630 [RATE_PER_BYTE] = US"per_byte",
631 [RATE_PER_CMD] = US"per_cmd",
632 [RATE_PER_CONN] = US"per_conn",
633 [RATE_PER_MAIL] = US"per_mail",
634 [RATE_PER_RCPT] = US"per_rcpt",
635 [RATE_PER_ALLRCPTS] = US"per_rcpt"
636 };
637
638 /* Enable recursion between acl_check_internal() and acl_check_condition() */
639
640 static int acl_check_wargs(int, address_item *, const uschar *, uschar **,
641 uschar **);
642
643
644 /*************************************************
645 * Find control in list *
646 *************************************************/
647
648 /* The lists are always in order, so binary chop can be used.
649
650 Arguments:
651 name the control name to search for
652 ol the first entry in the control list
653 last one more than the offset of the last entry in the control list
654
655 Returns: index of a control entry, or -1 if not found
656 */
657
658 static int
find_control(const uschar * name,control_def * ol,int last)659 find_control(const uschar * name, control_def * ol, int last)
660 {
661 for (int first = 0; last > first; )
662 {
663 int middle = (first + last)/2;
664 uschar * s = ol[middle].name;
665 int c = Ustrncmp(name, s, Ustrlen(s));
666 if (c == 0) return middle;
667 else if (c > 0) first = middle + 1;
668 else last = middle;
669 }
670 return -1;
671 }
672
673
674
675 /*************************************************
676 * Pick out condition from list *
677 *************************************************/
678
679 /* Use a binary chop method
680
681 Arguments:
682 name name to find
683 list list of conditions
684 end size of list
685
686 Returns: offset in list, or -1 if not found
687 */
688
689 static int
acl_checkcondition(uschar * name,condition_def * list,int end)690 acl_checkcondition(uschar * name, condition_def * list, int end)
691 {
692 for (int start = 0; start < end; )
693 {
694 int mid = (start + end)/2;
695 int c = Ustrcmp(name, list[mid].name);
696 if (c == 0) return mid;
697 if (c < 0) end = mid;
698 else start = mid + 1;
699 }
700 return -1;
701 }
702
703
704 /*************************************************
705 * Pick out name from list *
706 *************************************************/
707
708 /* Use a binary chop method
709
710 Arguments:
711 name name to find
712 list list of names
713 end size of list
714
715 Returns: offset in list, or -1 if not found
716 */
717
718 static int
acl_checkname(uschar * name,uschar ** list,int end)719 acl_checkname(uschar *name, uschar **list, int end)
720 {
721 for (int start = 0; start < end; )
722 {
723 int mid = (start + end)/2;
724 int c = Ustrcmp(name, list[mid]);
725 if (c == 0) return mid;
726 if (c < 0) end = mid; else start = mid + 1;
727 }
728
729 return -1;
730 }
731
732
733 /*************************************************
734 * Read and parse one ACL *
735 *************************************************/
736
737 /* This function is called both from readconf in order to parse the ACLs in the
738 configuration file, and also when an ACL is encountered dynamically (e.g. as
739 the result of an expansion). It is given a function to call in order to
740 retrieve the lines of the ACL. This function handles skipping comments and
741 blank lines (where relevant).
742
743 Arguments:
744 func function to get next line of ACL
745 error where to put an error message
746
747 Returns: pointer to ACL, or NULL
748 NULL can be legal (empty ACL); in this case error will be NULL
749 */
750
751 acl_block *
acl_read(uschar * (* func)(void),uschar ** error)752 acl_read(uschar *(*func)(void), uschar **error)
753 {
754 acl_block *yield = NULL;
755 acl_block **lastp = &yield;
756 acl_block *this = NULL;
757 acl_condition_block *cond;
758 acl_condition_block **condp = NULL;
759 uschar * s;
760
761 *error = NULL;
762
763 while ((s = (*func)()))
764 {
765 int v, c;
766 BOOL negated = FALSE;
767 uschar *saveline = s;
768 uschar name[EXIM_DRIVERNAME_MAX];
769
770 /* Conditions (but not verbs) are allowed to be negated by an initial
771 exclamation mark. */
772
773 if (Uskip_whitespace(&s) == '!')
774 {
775 negated = TRUE;
776 s++;
777 }
778
779 /* Read the name of a verb or a condition, or the start of a new ACL, which
780 can be started by a name, or by a macro definition. */
781
782 s = readconf_readname(name, sizeof(name), s);
783 if (*s == ':' || (isupper(name[0]) && *s == '=')) return yield;
784
785 /* If a verb is unrecognized, it may be another condition or modifier that
786 continues the previous verb. */
787
788 if ((v = acl_checkname(name, verbs, nelem(verbs))) < 0)
789 {
790 if (!this)
791 {
792 *error = string_sprintf("unknown ACL verb \"%s\" in \"%s\"", name,
793 saveline);
794 return NULL;
795 }
796 }
797
798 /* New verb */
799
800 else
801 {
802 if (negated)
803 {
804 *error = string_sprintf("malformed ACL line \"%s\"", saveline);
805 return NULL;
806 }
807 this = store_get(sizeof(acl_block), FALSE);
808 *lastp = this;
809 lastp = &(this->next);
810 this->next = NULL;
811 this->condition = NULL;
812 this->verb = v;
813 this->srcline = config_lineno; /* for debug output */
814 this->srcfile = config_filename; /**/
815 condp = &(this->condition);
816 if (*s == 0) continue; /* No condition on this line */
817 if (*s == '!')
818 {
819 negated = TRUE;
820 s++;
821 }
822 s = readconf_readname(name, sizeof(name), s); /* Condition name */
823 }
824
825 /* Handle a condition or modifier. */
826
827 if ((c = acl_checkcondition(name, conditions, nelem(conditions))) < 0)
828 {
829 *error = string_sprintf("unknown ACL condition/modifier in \"%s\"",
830 saveline);
831 return NULL;
832 }
833
834 /* The modifiers may not be negated */
835
836 if (negated && conditions[c].is_modifier)
837 {
838 *error = string_sprintf("ACL error: negation is not allowed with "
839 "\"%s\"", conditions[c].name);
840 return NULL;
841 }
842
843 /* ENDPASS may occur only with ACCEPT or DISCARD. */
844
845 if (c == ACLC_ENDPASS &&
846 this->verb != ACL_ACCEPT &&
847 this->verb != ACL_DISCARD)
848 {
849 *error = string_sprintf("ACL error: \"%s\" is not allowed with \"%s\"",
850 conditions[c].name, verbs[this->verb]);
851 return NULL;
852 }
853
854 cond = store_get(sizeof(acl_condition_block), FALSE);
855 cond->next = NULL;
856 cond->type = c;
857 cond->u.negated = negated;
858
859 *condp = cond;
860 condp = &(cond->next);
861
862 /* The "set" modifier is different in that its argument is "name=value"
863 rather than just a value, and we can check the validity of the name, which
864 gives us a variable name to insert into the data block. The original ACL
865 variable names were acl_c0 ... acl_c9 and acl_m0 ... acl_m9. This was
866 extended to 20 of each type, but after that people successfully argued for
867 arbitrary names. In the new scheme, the names must start with acl_c or acl_m.
868 After that, we allow alphanumerics and underscores, but the first character
869 after c or m must be a digit or an underscore. This retains backwards
870 compatibility. */
871
872 if (c == ACLC_SET)
873 #ifndef DISABLE_DKIM
874 if ( Ustrncmp(s, "dkim_verify_status", 18) == 0
875 || Ustrncmp(s, "dkim_verify_reason", 18) == 0)
876 {
877 uschar * endptr = s+18;
878
879 if (isalnum(*endptr))
880 {
881 *error = string_sprintf("invalid variable name after \"set\" in ACL "
882 "modifier \"set %s\" "
883 "(only \"dkim_verify_status\" or \"dkim_verify_reason\" permitted)",
884 s);
885 return NULL;
886 }
887 cond->u.varname = string_copyn(s, 18);
888 s = endptr;
889 Uskip_whitespace(&s);
890 }
891 else
892 #endif
893 {
894 uschar *endptr;
895
896 if (Ustrncmp(s, "acl_c", 5) != 0 && Ustrncmp(s, "acl_m", 5) != 0)
897 {
898 *error = string_sprintf("invalid variable name after \"set\" in ACL "
899 "modifier \"set %s\" (must start \"acl_c\" or \"acl_m\")", s);
900 return NULL;
901 }
902
903 endptr = s + 5;
904 if (!isdigit(*endptr) && *endptr != '_')
905 {
906 *error = string_sprintf("invalid variable name after \"set\" in ACL "
907 "modifier \"set %s\" (digit or underscore must follow acl_c or acl_m)",
908 s);
909 return NULL;
910 }
911
912 while (*endptr && *endptr != '=' && !isspace(*endptr))
913 {
914 if (!isalnum(*endptr) && *endptr != '_')
915 {
916 *error = string_sprintf("invalid character \"%c\" in variable name "
917 "in ACL modifier \"set %s\"", *endptr, s);
918 return NULL;
919 }
920 endptr++;
921 }
922
923 cond->u.varname = string_copyn(s + 4, endptr - s - 4);
924 s = endptr;
925 Uskip_whitespace(&s);
926 }
927
928 /* For "set", we are now positioned for the data. For the others, only
929 "endpass" has no data */
930
931 if (c != ACLC_ENDPASS)
932 {
933 if (*s++ != '=')
934 {
935 *error = string_sprintf("\"=\" missing after ACL \"%s\" %s", name,
936 conditions[c].is_modifier ? US"modifier" : US"condition");
937 return NULL;
938 }
939 Uskip_whitespace(&s);
940 cond->arg = string_copy(s);
941 }
942 }
943
944 return yield;
945 }
946
947
948
949 /*************************************************
950 * Set up added header line(s) *
951 *************************************************/
952
953 /* This function is called by the add_header modifier, and also from acl_warn()
954 to implement the now-deprecated way of adding header lines using "message" on a
955 "warn" verb. The argument is treated as a sequence of header lines which are
956 added to a chain, provided there isn't an identical one already there.
957
958 Argument: string of header lines
959 Returns: nothing
960 */
961
962 static void
setup_header(const uschar * hstring)963 setup_header(const uschar *hstring)
964 {
965 const uschar *p, *q;
966 int hlen = Ustrlen(hstring);
967
968 /* Ignore any leading newlines */
969 while (*hstring == '\n') hstring++, hlen--;
970
971 /* An empty string does nothing; ensure exactly one final newline. */
972 if (hlen <= 0) return;
973 if (hstring[--hlen] != '\n') /* no newline */
974 q = string_sprintf("%s\n", hstring);
975 else if (hstring[hlen-1] == '\n') /* double newline */
976 {
977 uschar * s = string_copy(hstring);
978 while(s[--hlen] == '\n')
979 s[hlen+1] = '\0';
980 q = s;
981 }
982 else
983 q = hstring;
984
985 /* Loop for multiple header lines, taking care about continuations */
986
987 for (p = q; *p; p = q)
988 {
989 const uschar *s;
990 uschar * hdr;
991 int newtype = htype_add_bot;
992 header_line **hptr = &acl_added_headers;
993
994 /* Find next header line within the string */
995
996 for (;;)
997 {
998 q = Ustrchr(q, '\n'); /* we know there was a newline */
999 if (*++q != ' ' && *q != '\t') break;
1000 }
1001
1002 /* If the line starts with a colon, interpret the instruction for where to
1003 add it. This temporarily sets up a new type. */
1004
1005 if (*p == ':')
1006 {
1007 if (strncmpic(p, US":after_received:", 16) == 0)
1008 {
1009 newtype = htype_add_rec;
1010 p += 16;
1011 }
1012 else if (strncmpic(p, US":at_start_rfc:", 14) == 0)
1013 {
1014 newtype = htype_add_rfc;
1015 p += 14;
1016 }
1017 else if (strncmpic(p, US":at_start:", 10) == 0)
1018 {
1019 newtype = htype_add_top;
1020 p += 10;
1021 }
1022 else if (strncmpic(p, US":at_end:", 8) == 0)
1023 {
1024 newtype = htype_add_bot;
1025 p += 8;
1026 }
1027 while (*p == ' ' || *p == '\t') p++;
1028 }
1029
1030 /* See if this line starts with a header name, and if not, add X-ACL-Warn:
1031 to the front of it. */
1032
1033 for (s = p; s < q - 1; s++)
1034 if (*s == ':' || !isgraph(*s)) break;
1035
1036 hdr = string_sprintf("%s%.*s", *s == ':' ? "" : "X-ACL-Warn: ", (int) (q - p), p);
1037 hlen = Ustrlen(hdr);
1038
1039 /* See if this line has already been added */
1040
1041 while (*hptr)
1042 {
1043 if (Ustrncmp((*hptr)->text, hdr, hlen) == 0) break;
1044 hptr = &(*hptr)->next;
1045 }
1046
1047 /* Add if not previously present */
1048
1049 if (!*hptr)
1050 {
1051 /* The header_line struct itself is not tainted, though it points to
1052 possibly tainted data. */
1053 header_line * h = store_get(sizeof(header_line), FALSE);
1054 h->text = hdr;
1055 h->next = NULL;
1056 h->type = newtype;
1057 h->slen = hlen;
1058 *hptr = h;
1059 hptr = &h->next;
1060 }
1061 }
1062 }
1063
1064
1065
1066 /*************************************************
1067 * List the added header lines *
1068 *************************************************/
1069 uschar *
fn_hdrs_added(void)1070 fn_hdrs_added(void)
1071 {
1072 gstring * g = NULL;
1073
1074 for (header_line * h = acl_added_headers; h; h = h->next)
1075 {
1076 int i = h->slen;
1077 if (h->text[i-1] == '\n') i--;
1078 g = string_append_listele_n(g, '\n', h->text, i);
1079 }
1080
1081 return g ? g->s : NULL;
1082 }
1083
1084
1085 /*************************************************
1086 * Set up removed header line(s) *
1087 *************************************************/
1088
1089 /* This function is called by the remove_header modifier. The argument is
1090 treated as a sequence of header names which are added to a colon separated
1091 list, provided there isn't an identical one already there.
1092
1093 Argument: string of header names
1094 Returns: nothing
1095 */
1096
1097 static void
setup_remove_header(const uschar * hnames)1098 setup_remove_header(const uschar *hnames)
1099 {
1100 if (*hnames)
1101 acl_removed_headers = acl_removed_headers
1102 ? string_sprintf("%s : %s", acl_removed_headers, hnames)
1103 : string_copy(hnames);
1104 }
1105
1106
1107
1108 /*************************************************
1109 * Handle warnings *
1110 *************************************************/
1111
1112 /* This function is called when a WARN verb's conditions are true. It adds to
1113 the message's headers, and/or writes information to the log. In each case, this
1114 only happens once (per message for headers, per connection for log).
1115
1116 ** NOTE: The header adding action using the "message" setting is historic, and
1117 its use is now deprecated. The new add_header modifier should be used instead.
1118
1119 Arguments:
1120 where ACL_WHERE_xxxx indicating which ACL this is
1121 user_message message for adding to headers
1122 log_message message for logging, if different
1123
1124 Returns: nothing
1125 */
1126
1127 static void
acl_warn(int where,uschar * user_message,uschar * log_message)1128 acl_warn(int where, uschar *user_message, uschar *log_message)
1129 {
1130 if (log_message != NULL && log_message != user_message)
1131 {
1132 uschar *text;
1133 string_item *logged;
1134
1135 text = string_sprintf("%s Warning: %s", host_and_ident(TRUE),
1136 string_printing(log_message));
1137
1138 /* If a sender verification has failed, and the log message is "sender verify
1139 failed", add the failure message. */
1140
1141 if (sender_verified_failed != NULL &&
1142 sender_verified_failed->message != NULL &&
1143 strcmpic(log_message, US"sender verify failed") == 0)
1144 text = string_sprintf("%s: %s", text, sender_verified_failed->message);
1145
1146 /* Search previously logged warnings. They are kept in malloc
1147 store so they can be freed at the start of a new message. */
1148
1149 for (logged = acl_warn_logged; logged; logged = logged->next)
1150 if (Ustrcmp(logged->text, text) == 0) break;
1151
1152 if (!logged)
1153 {
1154 int length = Ustrlen(text) + 1;
1155 log_write(0, LOG_MAIN, "%s", text);
1156 logged = store_malloc(sizeof(string_item) + length);
1157 logged->text = US logged + sizeof(string_item);
1158 memcpy(logged->text, text, length);
1159 logged->next = acl_warn_logged;
1160 acl_warn_logged = logged;
1161 }
1162 }
1163
1164 /* If there's no user message, we are done. */
1165
1166 if (!user_message) return;
1167
1168 /* If this isn't a message ACL, we can't do anything with a user message.
1169 Log an error. */
1170
1171 if (where > ACL_WHERE_NOTSMTP)
1172 {
1173 log_write(0, LOG_MAIN|LOG_PANIC, "ACL \"warn\" with \"message\" setting "
1174 "found in a non-message (%s) ACL: cannot specify header lines here: "
1175 "message ignored", acl_wherenames[where]);
1176 return;
1177 }
1178
1179 /* The code for setting up header lines is now abstracted into a separate
1180 function so that it can be used for the add_header modifier as well. */
1181
1182 setup_header(user_message);
1183 }
1184
1185
1186
1187 /*************************************************
1188 * Verify and check reverse DNS *
1189 *************************************************/
1190
1191 /* Called from acl_verify() below. We look up the host name(s) of the client IP
1192 address if this has not yet been done. The host_name_lookup() function checks
1193 that one of these names resolves to an address list that contains the client IP
1194 address, so we don't actually have to do the check here.
1195
1196 Arguments:
1197 user_msgptr pointer for user message
1198 log_msgptr pointer for log message
1199
1200 Returns: OK verification condition succeeded
1201 FAIL verification failed
1202 DEFER there was a problem verifying
1203 */
1204
1205 static int
acl_verify_reverse(uschar ** user_msgptr,uschar ** log_msgptr)1206 acl_verify_reverse(uschar **user_msgptr, uschar **log_msgptr)
1207 {
1208 int rc;
1209
1210 /* Previous success */
1211
1212 if (sender_host_name != NULL) return OK;
1213
1214 /* Previous failure */
1215
1216 if (host_lookup_failed)
1217 {
1218 *log_msgptr = string_sprintf("host lookup failed%s", host_lookup_msg);
1219 return FAIL;
1220 }
1221
1222 /* Need to do a lookup */
1223
1224 HDEBUG(D_acl)
1225 debug_printf_indent("looking up host name to force name/address consistency check\n");
1226
1227 if ((rc = host_name_lookup()) != OK)
1228 {
1229 *log_msgptr = rc == DEFER
1230 ? US"host lookup deferred for reverse lookup check"
1231 : string_sprintf("host lookup failed for reverse lookup check%s",
1232 host_lookup_msg);
1233 return rc; /* DEFER or FAIL */
1234 }
1235
1236 host_build_sender_fullhost();
1237 return OK;
1238 }
1239
1240
1241
1242 /*************************************************
1243 * Check client IP address matches CSA target *
1244 *************************************************/
1245
1246 /* Called from acl_verify_csa() below. This routine scans a section of a DNS
1247 response for address records belonging to the CSA target hostname. The section
1248 is specified by the reset argument, either RESET_ADDITIONAL or RESET_ANSWERS.
1249 If one of the addresses matches the client's IP address, then the client is
1250 authorized by CSA. If there are target IP addresses but none of them match
1251 then the client is using an unauthorized IP address. If there are no target IP
1252 addresses then the client cannot be using an authorized IP address. (This is
1253 an odd configuration - why didn't the SRV record have a weight of 1 instead?)
1254
1255 Arguments:
1256 dnsa the DNS answer block
1257 dnss a DNS scan block for us to use
1258 reset option specifying what portion to scan, as described above
1259 target the target hostname to use for matching RR names
1260
1261 Returns: CSA_OK successfully authorized
1262 CSA_FAIL_MISMATCH addresses found but none matched
1263 CSA_FAIL_NOADDR no target addresses found
1264 */
1265
1266 static int
acl_verify_csa_address(dns_answer * dnsa,dns_scan * dnss,int reset,uschar * target)1267 acl_verify_csa_address(dns_answer *dnsa, dns_scan *dnss, int reset,
1268 uschar *target)
1269 {
1270 int rc = CSA_FAIL_NOADDR;
1271
1272 for (dns_record * rr = dns_next_rr(dnsa, dnss, reset);
1273 rr;
1274 rr = dns_next_rr(dnsa, dnss, RESET_NEXT))
1275 {
1276 /* Check this is an address RR for the target hostname. */
1277
1278 if (rr->type != T_A
1279 #if HAVE_IPV6
1280 && rr->type != T_AAAA
1281 #endif
1282 ) continue;
1283
1284 if (strcmpic(target, rr->name) != 0) continue;
1285
1286 rc = CSA_FAIL_MISMATCH;
1287
1288 /* Turn the target address RR into a list of textual IP addresses and scan
1289 the list. There may be more than one if it is an A6 RR. */
1290
1291 for (dns_address * da = dns_address_from_rr(dnsa, rr); da; da = da->next)
1292 {
1293 /* If the client IP address matches the target IP address, it's good! */
1294
1295 DEBUG(D_acl) debug_printf_indent("CSA target address is %s\n", da->address);
1296
1297 if (strcmpic(sender_host_address, da->address) == 0) return CSA_OK;
1298 }
1299 }
1300
1301 /* If we found some target addresses but none of them matched, the client is
1302 using an unauthorized IP address, otherwise the target has no authorized IP
1303 addresses. */
1304
1305 return rc;
1306 }
1307
1308
1309
1310 /*************************************************
1311 * Verify Client SMTP Authorization *
1312 *************************************************/
1313
1314 /* Called from acl_verify() below. This routine calls dns_lookup_special()
1315 to find the CSA SRV record corresponding to the domain argument, or
1316 $sender_helo_name if no argument is provided. It then checks that the
1317 client is authorized, and that its IP address corresponds to the SRV
1318 target's address by calling acl_verify_csa_address() above. The address
1319 should have been returned in the DNS response's ADDITIONAL section, but if
1320 not we perform another DNS lookup to get it.
1321
1322 Arguments:
1323 domain pointer to optional parameter following verify = csa
1324
1325 Returns: CSA_UNKNOWN no valid CSA record found
1326 CSA_OK successfully authorized
1327 CSA_FAIL_* client is definitely not authorized
1328 CSA_DEFER_* there was a DNS problem
1329 */
1330
1331 static int
acl_verify_csa(const uschar * domain)1332 acl_verify_csa(const uschar *domain)
1333 {
1334 tree_node *t;
1335 const uschar *found;
1336 int priority, weight, port;
1337 dns_answer * dnsa;
1338 dns_scan dnss;
1339 dns_record *rr;
1340 int rc, type, yield;
1341 #define TARGET_SIZE 256
1342 uschar * target = store_get(TARGET_SIZE, TRUE);
1343
1344 /* Work out the domain we are using for the CSA lookup. The default is the
1345 client's HELO domain. If the client has not said HELO, use its IP address
1346 instead. If it's a local client (exim -bs), CSA isn't applicable. */
1347
1348 while (isspace(*domain) && *domain != '\0') ++domain;
1349 if (*domain == '\0') domain = sender_helo_name;
1350 if (!domain) domain = sender_host_address;
1351 if (!sender_host_address) return CSA_UNKNOWN;
1352
1353 /* If we have an address literal, strip off the framing ready for turning it
1354 into a domain. The framing consists of matched square brackets possibly
1355 containing a keyword and a colon before the actual IP address. */
1356
1357 if (domain[0] == '[')
1358 {
1359 const uschar *start = Ustrchr(domain, ':');
1360 if (start == NULL) start = domain;
1361 domain = string_copyn(start + 1, Ustrlen(start) - 2);
1362 }
1363
1364 /* Turn domains that look like bare IP addresses into domains in the reverse
1365 DNS. This code also deals with address literals and $sender_host_address. It's
1366 not quite kosher to treat bare domains such as EHLO 192.0.2.57 the same as
1367 address literals, but it's probably the most friendly thing to do. This is an
1368 extension to CSA, so we allow it to be turned off for proper conformance. */
1369
1370 if (string_is_ip_address(domain, NULL) != 0)
1371 {
1372 if (!dns_csa_use_reverse) return CSA_UNKNOWN;
1373 domain = dns_build_reverse(domain);
1374 }
1375
1376 /* Find out if we've already done the CSA check for this domain. If we have,
1377 return the same result again. Otherwise build a new cached result structure
1378 for this domain. The name is filled in now, and the value is filled in when
1379 we return from this function. */
1380
1381 if ((t = tree_search(csa_cache, domain)))
1382 return t->data.val;
1383
1384 t = store_get_perm(sizeof(tree_node) + Ustrlen(domain), is_tainted(domain));
1385 Ustrcpy(t->name, domain);
1386 (void)tree_insertnode(&csa_cache, t);
1387
1388 /* Now we are ready to do the actual DNS lookup(s). */
1389
1390 found = domain;
1391 dnsa = store_get_dns_answer();
1392 switch (dns_special_lookup(dnsa, domain, T_CSA, &found))
1393 {
1394 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1395
1396 default:
1397 yield = CSA_DEFER_SRV;
1398 goto out;
1399
1400 /* If we found nothing, the client's authorization is unknown. */
1401
1402 case DNS_NOMATCH:
1403 case DNS_NODATA:
1404 yield = CSA_UNKNOWN;
1405 goto out;
1406
1407 /* We got something! Go on to look at the reply in more detail. */
1408
1409 case DNS_SUCCEED:
1410 break;
1411 }
1412
1413 /* Scan the reply for well-formed CSA SRV records. */
1414
1415 for (rr = dns_next_rr(dnsa, &dnss, RESET_ANSWERS);
1416 rr;
1417 rr = dns_next_rr(dnsa, &dnss, RESET_NEXT)) if (rr->type == T_SRV)
1418 {
1419 const uschar * p = rr->data;
1420
1421 /* Extract the numerical SRV fields (p is incremented) */
1422
1423 GETSHORT(priority, p);
1424 GETSHORT(weight, p);
1425 GETSHORT(port, p);
1426
1427 DEBUG(D_acl)
1428 debug_printf_indent("CSA priority=%d weight=%d port=%d\n", priority, weight, port);
1429
1430 /* Check the CSA version number */
1431
1432 if (priority != 1) continue;
1433
1434 /* If the domain does not have a CSA SRV record of its own (i.e. the domain
1435 found by dns_special_lookup() is a parent of the one we asked for), we check
1436 the subdomain assertions in the port field. At the moment there's only one
1437 assertion: legitimate SMTP clients are all explicitly authorized with CSA
1438 SRV records of their own. */
1439
1440 if (Ustrcmp(found, domain) != 0)
1441 {
1442 yield = port & 1 ? CSA_FAIL_EXPLICIT : CSA_UNKNOWN;
1443 goto out;
1444 }
1445
1446 /* This CSA SRV record refers directly to our domain, so we check the value
1447 in the weight field to work out the domain's authorization. 0 and 1 are
1448 unauthorized; 3 means the client is authorized but we can't check the IP
1449 address in order to authenticate it, so we treat it as unknown; values
1450 greater than 3 are undefined. */
1451
1452 if (weight < 2)
1453 {
1454 yield = CSA_FAIL_DOMAIN;
1455 goto out;
1456 }
1457
1458 if (weight > 2) continue;
1459
1460 /* Weight == 2, which means the domain is authorized. We must check that the
1461 client's IP address is listed as one of the SRV target addresses. Save the
1462 target hostname then break to scan the additional data for its addresses. */
1463
1464 (void)dn_expand(dnsa->answer, dnsa->answer + dnsa->answerlen, p,
1465 (DN_EXPAND_ARG4_TYPE)target, TARGET_SIZE);
1466
1467 DEBUG(D_acl) debug_printf_indent("CSA target is %s\n", target);
1468
1469 break;
1470 }
1471
1472 /* If we didn't break the loop then no appropriate records were found. */
1473
1474 if (!rr)
1475 {
1476 yield = CSA_UNKNOWN;
1477 goto out;
1478 }
1479
1480 /* Do not check addresses if the target is ".", in accordance with RFC 2782.
1481 A target of "." indicates there are no valid addresses, so the client cannot
1482 be authorized. (This is an odd configuration because weight=2 target=. is
1483 equivalent to weight=1, but we check for it in order to keep load off the
1484 root name servers.) Note that dn_expand() turns "." into "". */
1485
1486 if (Ustrcmp(target, "") == 0)
1487 {
1488 yield = CSA_FAIL_NOADDR;
1489 goto out;
1490 }
1491
1492 /* Scan the additional section of the CSA SRV reply for addresses belonging
1493 to the target. If the name server didn't return any additional data (e.g.
1494 because it does not fully support SRV records), we need to do another lookup
1495 to obtain the target addresses; otherwise we have a definitive result. */
1496
1497 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ADDITIONAL, target);
1498 if (rc != CSA_FAIL_NOADDR)
1499 {
1500 yield = rc;
1501 goto out;
1502 }
1503
1504 /* The DNS lookup type corresponds to the IP version used by the client. */
1505
1506 #if HAVE_IPV6
1507 if (Ustrchr(sender_host_address, ':') != NULL)
1508 type = T_AAAA;
1509 else
1510 #endif /* HAVE_IPV6 */
1511 type = T_A;
1512
1513
1514 lookup_dnssec_authenticated = NULL;
1515 switch (dns_lookup(dnsa, target, type, NULL))
1516 {
1517 /* If something bad happened (most commonly DNS_AGAIN), defer. */
1518
1519 default:
1520 yield = CSA_DEFER_ADDR;
1521 break;
1522
1523 /* If the query succeeded, scan the addresses and return the result. */
1524
1525 case DNS_SUCCEED:
1526 rc = acl_verify_csa_address(dnsa, &dnss, RESET_ANSWERS, target);
1527 if (rc != CSA_FAIL_NOADDR)
1528 {
1529 yield = rc;
1530 break;
1531 }
1532 /* else fall through */
1533
1534 /* If the target has no IP addresses, the client cannot have an authorized
1535 IP address. However, if the target site uses A6 records (not AAAA records)
1536 we have to do yet another lookup in order to check them. */
1537
1538 case DNS_NOMATCH:
1539 case DNS_NODATA:
1540 yield = CSA_FAIL_NOADDR;
1541 break;
1542 }
1543
1544 out:
1545
1546 store_free_dns_answer(dnsa);
1547 return t->data.val = yield;
1548 }
1549
1550
1551
1552 /*************************************************
1553 * Handle verification (address & other) *
1554 *************************************************/
1555
1556 enum { VERIFY_REV_HOST_LKUP, VERIFY_CERT, VERIFY_HELO, VERIFY_CSA, VERIFY_HDR_SYNTAX,
1557 VERIFY_NOT_BLIND, VERIFY_HDR_SNDR, VERIFY_SNDR, VERIFY_RCPT,
1558 VERIFY_HDR_NAMES_ASCII, VERIFY_ARC
1559 };
1560 typedef struct {
1561 uschar * name;
1562 int value;
1563 unsigned where_allowed; /* bitmap */
1564 BOOL no_options; /* Never has /option(s) following */
1565 unsigned alt_opt_sep; /* >0 Non-/ option separator (custom parser) */
1566 } verify_type_t;
1567 static verify_type_t verify_type_list[] = {
1568 /* name value where no-opt opt-sep */
1569 { US"reverse_host_lookup", VERIFY_REV_HOST_LKUP, (unsigned)~0, FALSE, 0 },
1570 { US"certificate", VERIFY_CERT, (unsigned)~0, TRUE, 0 },
1571 { US"helo", VERIFY_HELO, (unsigned)~0, TRUE, 0 },
1572 { US"csa", VERIFY_CSA, (unsigned)~0, FALSE, 0 },
1573 { US"header_syntax", VERIFY_HDR_SYNTAX, ACL_BITS_HAVEDATA, TRUE, 0 },
1574 { US"not_blind", VERIFY_NOT_BLIND, ACL_BITS_HAVEDATA, FALSE, 0 },
1575 { US"header_sender", VERIFY_HDR_SNDR, ACL_BITS_HAVEDATA, FALSE, 0 },
1576 { US"sender", VERIFY_SNDR, ACL_BIT_MAIL | ACL_BIT_RCPT
1577 | ACL_BIT_PREDATA | ACL_BIT_DATA | ACL_BIT_NOTSMTP,
1578 FALSE, 6 },
1579 { US"recipient", VERIFY_RCPT, ACL_BIT_RCPT, FALSE, 0 },
1580 { US"header_names_ascii", VERIFY_HDR_NAMES_ASCII, ACL_BITS_HAVEDATA, TRUE, 0 },
1581 #ifdef EXPERIMENTAL_ARC
1582 { US"arc", VERIFY_ARC, ACL_BIT_DATA, FALSE , 0 },
1583 #endif
1584 };
1585
1586
1587 enum { CALLOUT_DEFER_OK, CALLOUT_NOCACHE, CALLOUT_RANDOM, CALLOUT_USE_SENDER,
1588 CALLOUT_USE_POSTMASTER, CALLOUT_POSTMASTER, CALLOUT_FULLPOSTMASTER,
1589 CALLOUT_MAILFROM, CALLOUT_POSTMASTER_MAILFROM, CALLOUT_MAXWAIT, CALLOUT_CONNECT,
1590 CALLOUT_HOLD, CALLOUT_TIME /* TIME must be last */
1591 };
1592 typedef struct {
1593 uschar * name;
1594 int value;
1595 int flag;
1596 BOOL has_option; /* Has =option(s) following */
1597 BOOL timeval; /* Has a time value */
1598 } callout_opt_t;
1599 static callout_opt_t callout_opt_list[] = {
1600 /* name value flag has-opt has-time */
1601 { US"defer_ok", CALLOUT_DEFER_OK, 0, FALSE, FALSE },
1602 { US"no_cache", CALLOUT_NOCACHE, vopt_callout_no_cache, FALSE, FALSE },
1603 { US"random", CALLOUT_RANDOM, vopt_callout_random, FALSE, FALSE },
1604 { US"use_sender", CALLOUT_USE_SENDER, vopt_callout_recipsender, FALSE, FALSE },
1605 { US"use_postmaster", CALLOUT_USE_POSTMASTER,vopt_callout_recippmaster, FALSE, FALSE },
1606 { US"postmaster_mailfrom",CALLOUT_POSTMASTER_MAILFROM,0, TRUE, FALSE },
1607 { US"postmaster", CALLOUT_POSTMASTER, 0, FALSE, FALSE },
1608 { US"fullpostmaster", CALLOUT_FULLPOSTMASTER,vopt_callout_fullpm, FALSE, FALSE },
1609 { US"mailfrom", CALLOUT_MAILFROM, 0, TRUE, FALSE },
1610 { US"maxwait", CALLOUT_MAXWAIT, 0, TRUE, TRUE },
1611 { US"connect", CALLOUT_CONNECT, 0, TRUE, TRUE },
1612 { US"hold", CALLOUT_HOLD, vopt_callout_hold, FALSE, FALSE },
1613 { NULL, CALLOUT_TIME, 0, FALSE, TRUE }
1614 };
1615
1616
1617
1618 static int
v_period(const uschar * s,const uschar * arg,uschar ** log_msgptr)1619 v_period(const uschar * s, const uschar * arg, uschar ** log_msgptr)
1620 {
1621 int period;
1622 if ((period = readconf_readtime(s, 0, FALSE)) < 0)
1623 {
1624 *log_msgptr = string_sprintf("bad time value in ACL condition "
1625 "\"verify %s\"", arg);
1626 }
1627 return period;
1628 }
1629
1630
1631
1632 /* This function implements the "verify" condition. It is called when
1633 encountered in any ACL, because some tests are almost always permitted. Some
1634 just don't make sense, and always fail (for example, an attempt to test a host
1635 lookup for a non-TCP/IP message). Others are restricted to certain ACLs.
1636
1637 Arguments:
1638 where where called from
1639 addr the recipient address that the ACL is handling, or NULL
1640 arg the argument of "verify"
1641 user_msgptr pointer for user message
1642 log_msgptr pointer for log message
1643 basic_errno where to put verify errno
1644
1645 Returns: OK verification condition succeeded
1646 FAIL verification failed
1647 DEFER there was a problem verifying
1648 ERROR syntax error
1649 */
1650
1651 static int
acl_verify(int where,address_item * addr,const uschar * arg,uschar ** user_msgptr,uschar ** log_msgptr,int * basic_errno)1652 acl_verify(int where, address_item *addr, const uschar *arg,
1653 uschar **user_msgptr, uschar **log_msgptr, int *basic_errno)
1654 {
1655 int sep = '/';
1656 int callout = -1;
1657 int callout_overall = -1;
1658 int callout_connect = -1;
1659 int verify_options = 0;
1660 int rc;
1661 BOOL verify_header_sender = FALSE;
1662 BOOL defer_ok = FALSE;
1663 BOOL callout_defer_ok = FALSE;
1664 BOOL no_details = FALSE;
1665 BOOL success_on_redirect = FALSE;
1666 BOOL quota = FALSE;
1667 int quota_pos_cache = QUOTA_POS_DEFAULT, quota_neg_cache = QUOTA_NEG_DEFAULT;
1668 address_item *sender_vaddr = NULL;
1669 uschar *verify_sender_address = NULL;
1670 uschar *pm_mailfrom = NULL;
1671 uschar *se_mailfrom = NULL;
1672
1673 /* Some of the verify items have slash-separated options; some do not. Diagnose
1674 an error if options are given for items that don't expect them.
1675 */
1676
1677 uschar *slash = Ustrchr(arg, '/');
1678 const uschar *list = arg;
1679 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
1680 verify_type_t * vp;
1681
1682 if (!ss) goto BAD_VERIFY;
1683
1684 /* Handle name/address consistency verification in a separate function. */
1685
1686 for (vp = verify_type_list;
1687 CS vp < CS verify_type_list + sizeof(verify_type_list);
1688 vp++
1689 )
1690 if (vp->alt_opt_sep ? strncmpic(ss, vp->name, vp->alt_opt_sep) == 0
1691 : strcmpic (ss, vp->name) == 0)
1692 break;
1693 if (CS vp >= CS verify_type_list + sizeof(verify_type_list))
1694 goto BAD_VERIFY;
1695
1696 if (vp->no_options && slash)
1697 {
1698 *log_msgptr = string_sprintf("unexpected '/' found in \"%s\" "
1699 "(this verify item has no options)", arg);
1700 return ERROR;
1701 }
1702 if (!(vp->where_allowed & BIT(where)))
1703 {
1704 *log_msgptr = string_sprintf("cannot verify %s in ACL for %s",
1705 vp->name, acl_wherenames[where]);
1706 return ERROR;
1707 }
1708 switch(vp->value)
1709 {
1710 case VERIFY_REV_HOST_LKUP:
1711 if (!sender_host_address) return OK;
1712 if ((rc = acl_verify_reverse(user_msgptr, log_msgptr)) == DEFER)
1713 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1714 if (strcmpic(ss, US"defer_ok") == 0)
1715 return OK;
1716 return rc;
1717
1718 case VERIFY_CERT:
1719 /* TLS certificate verification is done at STARTTLS time; here we just
1720 test whether it was successful or not. (This is for optional verification; for
1721 mandatory verification, the connection doesn't last this long.) */
1722
1723 if (tls_in.certificate_verified) return OK;
1724 *user_msgptr = US"no verified certificate";
1725 return FAIL;
1726
1727 case VERIFY_HELO:
1728 /* We can test the result of optional HELO verification that might have
1729 occurred earlier. If not, we can attempt the verification now. */
1730
1731 if (!f.helo_verified && !f.helo_verify_failed) smtp_verify_helo();
1732 return f.helo_verified ? OK : FAIL;
1733
1734 case VERIFY_CSA:
1735 /* Do Client SMTP Authorization checks in a separate function, and turn the
1736 result code into user-friendly strings. */
1737
1738 rc = acl_verify_csa(list);
1739 *log_msgptr = *user_msgptr = string_sprintf("client SMTP authorization %s",
1740 csa_reason_string[rc]);
1741 csa_status = csa_status_string[rc];
1742 DEBUG(D_acl) debug_printf_indent("CSA result %s\n", csa_status);
1743 return csa_return_code[rc];
1744
1745 #ifdef EXPERIMENTAL_ARC
1746 case VERIFY_ARC:
1747 { /* Do Authenticated Received Chain checks in a separate function. */
1748 const uschar * condlist = CUS string_nextinlist(&list, &sep, NULL, 0);
1749 int csep = 0;
1750 uschar * cond;
1751
1752 if (!(arc_state = acl_verify_arc())) return DEFER;
1753 DEBUG(D_acl) debug_printf_indent("ARC verify result %s %s%s%s\n", arc_state,
1754 arc_state_reason ? "(":"", arc_state_reason, arc_state_reason ? ")":"");
1755
1756 if (!condlist) condlist = US"none:pass";
1757 while ((cond = string_nextinlist(&condlist, &csep, NULL, 0)))
1758 if (Ustrcmp(arc_state, cond) == 0) return OK;
1759 return FAIL;
1760 }
1761 #endif
1762
1763 case VERIFY_HDR_SYNTAX:
1764 /* Check that all relevant header lines have the correct 5322-syntax. If there is
1765 a syntax error, we return details of the error to the sender if configured to
1766 send out full details. (But a "message" setting on the ACL can override, as
1767 always). */
1768
1769 rc = verify_check_headers(log_msgptr);
1770 if (rc != OK && *log_msgptr)
1771 if (smtp_return_error_details)
1772 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1773 else
1774 acl_verify_message = *log_msgptr;
1775 return rc;
1776
1777 case VERIFY_HDR_NAMES_ASCII:
1778 /* Check that all header names are true 7 bit strings
1779 See RFC 5322, 2.2. and RFC 6532, 3. */
1780
1781 rc = verify_check_header_names_ascii(log_msgptr);
1782 if (rc != OK && smtp_return_error_details && *log_msgptr)
1783 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1784 return rc;
1785
1786 case VERIFY_NOT_BLIND:
1787 /* Check that no recipient of this message is "blind", that is, every envelope
1788 recipient must be mentioned in either To: or Cc:. */
1789 {
1790 BOOL case_sensitive = TRUE;
1791
1792 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1793 if (strcmpic(ss, US"case_insensitive") == 0)
1794 case_sensitive = FALSE;
1795 else
1796 {
1797 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1798 "condition \"verify %s\"", ss, arg);
1799 return ERROR;
1800 }
1801
1802 if ((rc = verify_check_notblind(case_sensitive)) != OK)
1803 {
1804 *log_msgptr = US"bcc recipient detected";
1805 if (smtp_return_error_details)
1806 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
1807 }
1808 return rc;
1809 }
1810
1811 /* The remaining verification tests check recipient and sender addresses,
1812 either from the envelope or from the header. There are a number of
1813 slash-separated options that are common to all of them. */
1814
1815 case VERIFY_HDR_SNDR:
1816 verify_header_sender = TRUE;
1817 break;
1818
1819 case VERIFY_SNDR:
1820 /* In the case of a sender, this can optionally be followed by an address to use
1821 in place of the actual sender (rare special-case requirement). */
1822 {
1823 uschar *s = ss + 6;
1824 if (!*s)
1825 verify_sender_address = sender_address;
1826 else
1827 {
1828 while (isspace(*s)) s++;
1829 if (*s++ != '=') goto BAD_VERIFY;
1830 while (isspace(*s)) s++;
1831 verify_sender_address = string_copy(s);
1832 }
1833 }
1834 break;
1835
1836 case VERIFY_RCPT:
1837 break;
1838 }
1839
1840
1841
1842 /* Remaining items are optional; they apply to sender and recipient
1843 verification, including "header sender" verification. */
1844
1845 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
1846 {
1847 if (strcmpic(ss, US"defer_ok") == 0) defer_ok = TRUE;
1848 else if (strcmpic(ss, US"no_details") == 0) no_details = TRUE;
1849 else if (strcmpic(ss, US"success_on_redirect") == 0) success_on_redirect = TRUE;
1850
1851 /* These two old options are left for backwards compatibility */
1852
1853 else if (strcmpic(ss, US"callout_defer_ok") == 0)
1854 {
1855 callout_defer_ok = TRUE;
1856 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1857 }
1858
1859 else if (strcmpic(ss, US"check_postmaster") == 0)
1860 {
1861 pm_mailfrom = US"";
1862 if (callout == -1) callout = CALLOUT_TIMEOUT_DEFAULT;
1863 }
1864
1865 /* The callout option has a number of sub-options, comma separated */
1866
1867 else if (strncmpic(ss, US"callout", 7) == 0)
1868 {
1869 callout = CALLOUT_TIMEOUT_DEFAULT;
1870 if (*(ss += 7))
1871 {
1872 while (isspace(*ss)) ss++;
1873 if (*ss++ == '=')
1874 {
1875 const uschar * sublist = ss;
1876 int optsep = ',';
1877
1878 while (isspace(*sublist)) sublist++;
1879 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1880 {
1881 callout_opt_t * op;
1882 double period = 1.0F;
1883
1884 for (op= callout_opt_list; op->name; op++)
1885 if (strncmpic(opt, op->name, Ustrlen(op->name)) == 0)
1886 break;
1887
1888 verify_options |= op->flag;
1889 if (op->has_option)
1890 {
1891 opt += Ustrlen(op->name);
1892 while (isspace(*opt)) opt++;
1893 if (*opt++ != '=')
1894 {
1895 *log_msgptr = string_sprintf("'=' expected after "
1896 "\"%s\" in ACL verify condition \"%s\"", op->name, arg);
1897 return ERROR;
1898 }
1899 while (isspace(*opt)) opt++;
1900 }
1901 if (op->timeval && (period = v_period(opt, arg, log_msgptr)) < 0)
1902 return ERROR;
1903
1904 switch(op->value)
1905 {
1906 case CALLOUT_DEFER_OK: callout_defer_ok = TRUE; break;
1907 case CALLOUT_POSTMASTER: pm_mailfrom = US""; break;
1908 case CALLOUT_FULLPOSTMASTER: pm_mailfrom = US""; break;
1909 case CALLOUT_MAILFROM:
1910 if (!verify_header_sender)
1911 {
1912 *log_msgptr = string_sprintf("\"mailfrom\" is allowed as a "
1913 "callout option only for verify=header_sender (detected in ACL "
1914 "condition \"%s\")", arg);
1915 return ERROR;
1916 }
1917 se_mailfrom = string_copy(opt);
1918 break;
1919 case CALLOUT_POSTMASTER_MAILFROM: pm_mailfrom = string_copy(opt); break;
1920 case CALLOUT_MAXWAIT: callout_overall = period; break;
1921 case CALLOUT_CONNECT: callout_connect = period; break;
1922 case CALLOUT_TIME: callout = period; break;
1923 }
1924 }
1925 }
1926 else
1927 {
1928 *log_msgptr = string_sprintf("'=' expected after \"callout\" in "
1929 "ACL condition \"%s\"", arg);
1930 return ERROR;
1931 }
1932 }
1933 }
1934
1935 /* The quota option has sub-options, comma-separated */
1936
1937 else if (strncmpic(ss, US"quota", 5) == 0)
1938 {
1939 quota = TRUE;
1940 if (*(ss += 5))
1941 {
1942 while (isspace(*ss)) ss++;
1943 if (*ss++ == '=')
1944 {
1945 const uschar * sublist = ss;
1946 int optsep = ',';
1947 int period;
1948
1949 while (isspace(*sublist)) sublist++;
1950 for (uschar * opt; opt = string_nextinlist(&sublist, &optsep, NULL, 0); )
1951 if (Ustrncmp(opt, "cachepos=", 9) == 0)
1952 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1953 return ERROR;
1954 else
1955 quota_pos_cache = period;
1956 else if (Ustrncmp(opt, "cacheneg=", 9) == 0)
1957 if ((period = v_period(opt += 9, arg, log_msgptr)) < 0)
1958 return ERROR;
1959 else
1960 quota_neg_cache = period;
1961 else if (Ustrcmp(opt, "no_cache") == 0)
1962 quota_pos_cache = quota_neg_cache = 0;
1963 }
1964 }
1965 }
1966
1967 /* Option not recognized */
1968
1969 else
1970 {
1971 *log_msgptr = string_sprintf("unknown option \"%s\" in ACL "
1972 "condition \"verify %s\"", ss, arg);
1973 return ERROR;
1974 }
1975 }
1976
1977 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)) ==
1978 (vopt_callout_recipsender|vopt_callout_recippmaster))
1979 {
1980 *log_msgptr = US"only one of use_sender and use_postmaster can be set "
1981 "for a recipient callout";
1982 return ERROR;
1983 }
1984
1985 /* Handle quota verification */
1986 if (quota)
1987 {
1988 if (vp->value != VERIFY_RCPT)
1989 {
1990 *log_msgptr = US"can only verify quota of recipient";
1991 return ERROR;
1992 }
1993
1994 if ((rc = verify_quota_call(addr->address,
1995 quota_pos_cache, quota_neg_cache, log_msgptr)) != OK)
1996 {
1997 *basic_errno = errno;
1998 if (smtp_return_error_details)
1999 {
2000 if (!*user_msgptr && *log_msgptr)
2001 *user_msgptr = string_sprintf("Rejected after %s: %s",
2002 smtp_names[smtp_connection_had[SMTP_HBUFF_PREV(smtp_ch_index)]],
2003 *log_msgptr);
2004 if (rc == DEFER) f.acl_temp_details = TRUE;
2005 }
2006 }
2007
2008 return rc;
2009 }
2010
2011 /* Handle sender-in-header verification. Default the user message to the log
2012 message if giving out verification details. */
2013
2014 if (verify_header_sender)
2015 {
2016 int verrno;
2017
2018 if ((rc = verify_check_header_address(user_msgptr, log_msgptr, callout,
2019 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, verify_options,
2020 &verrno)) != OK)
2021 {
2022 *basic_errno = verrno;
2023 if (smtp_return_error_details)
2024 {
2025 if (!*user_msgptr && *log_msgptr)
2026 *user_msgptr = string_sprintf("Rejected after DATA: %s", *log_msgptr);
2027 if (rc == DEFER) f.acl_temp_details = TRUE;
2028 }
2029 }
2030 }
2031
2032 /* Handle a sender address. The default is to verify *the* sender address, but
2033 optionally a different address can be given, for special requirements. If the
2034 address is empty, we are dealing with a bounce message that has no sender, so
2035 we cannot do any checking. If the real sender address gets rewritten during
2036 verification (e.g. DNS widening), set the flag to stop it being rewritten again
2037 during message reception.
2038
2039 A list of verified "sender" addresses is kept to try to avoid doing to much
2040 work repetitively when there are multiple recipients in a message and they all
2041 require sender verification. However, when callouts are involved, it gets too
2042 complicated because different recipients may require different callout options.
2043 Therefore, we always do a full sender verify when any kind of callout is
2044 specified. Caching elsewhere, for instance in the DNS resolver and in the
2045 callout handling, should ensure that this is not terribly inefficient. */
2046
2047 else if (verify_sender_address)
2048 {
2049 if ((verify_options & (vopt_callout_recipsender|vopt_callout_recippmaster)))
2050 {
2051 *log_msgptr = US"use_sender or use_postmaster cannot be used for a "
2052 "sender verify callout";
2053 return ERROR;
2054 }
2055
2056 sender_vaddr = verify_checked_sender(verify_sender_address);
2057 if ( sender_vaddr /* Previously checked */
2058 && callout <= 0) /* No callout needed this time */
2059 {
2060 /* If the "routed" flag is set, it means that routing worked before, so
2061 this check can give OK (the saved return code value, if set, belongs to a
2062 callout that was done previously). If the "routed" flag is not set, routing
2063 must have failed, so we use the saved return code. */
2064
2065 if (testflag(sender_vaddr, af_verify_routed))
2066 rc = OK;
2067 else
2068 {
2069 rc = sender_vaddr->special_action;
2070 *basic_errno = sender_vaddr->basic_errno;
2071 }
2072 HDEBUG(D_acl) debug_printf_indent("using cached sender verify result\n");
2073 }
2074
2075 /* Do a new verification, and cache the result. The cache is used to avoid
2076 verifying the sender multiple times for multiple RCPTs when callouts are not
2077 specified (see comments above).
2078
2079 The cache is also used on failure to give details in response to the first
2080 RCPT that gets bounced for this reason. However, this can be suppressed by
2081 the no_details option, which sets the flag that says "this detail has already
2082 been sent". The cache normally contains just one address, but there may be
2083 more in esoteric circumstances. */
2084
2085 else
2086 {
2087 BOOL routed = TRUE;
2088 uschar *save_address_data = deliver_address_data;
2089
2090 sender_vaddr = deliver_make_addr(verify_sender_address, TRUE);
2091 #ifdef SUPPORT_I18N
2092 if ((sender_vaddr->prop.utf8_msg = message_smtputf8))
2093 {
2094 sender_vaddr->prop.utf8_downcvt = message_utf8_downconvert == 1;
2095 sender_vaddr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
2096 }
2097 #endif
2098 if (no_details) setflag(sender_vaddr, af_sverify_told);
2099 if (verify_sender_address[0] != 0)
2100 {
2101 /* If this is the real sender address, save the unrewritten version
2102 for use later in receive. Otherwise, set a flag so that rewriting the
2103 sender in verify_address() does not update sender_address. */
2104
2105 if (verify_sender_address == sender_address)
2106 sender_address_unrewritten = sender_address;
2107 else
2108 verify_options |= vopt_fake_sender;
2109
2110 if (success_on_redirect)
2111 verify_options |= vopt_success_on_redirect;
2112
2113 /* The recipient, qualify, and expn options are never set in
2114 verify_options. */
2115
2116 rc = verify_address(sender_vaddr, NULL, verify_options, callout,
2117 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, &routed);
2118
2119 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2120
2121 if (rc != OK)
2122 *basic_errno = sender_vaddr->basic_errno;
2123 else
2124 DEBUG(D_acl)
2125 if (Ustrcmp(sender_vaddr->address, verify_sender_address) != 0)
2126 debug_printf_indent("sender %s verified ok as %s\n",
2127 verify_sender_address, sender_vaddr->address);
2128 else
2129 debug_printf_indent("sender %s verified ok\n",
2130 verify_sender_address);
2131 }
2132 else
2133 rc = OK; /* Null sender */
2134
2135 /* Cache the result code */
2136
2137 if (routed) setflag(sender_vaddr, af_verify_routed);
2138 if (callout > 0) setflag(sender_vaddr, af_verify_callout);
2139 sender_vaddr->special_action = rc;
2140 sender_vaddr->next = sender_verified_list;
2141 sender_verified_list = sender_vaddr;
2142
2143 /* Restore the recipient address data, which might have been clobbered by
2144 the sender verification. */
2145
2146 deliver_address_data = save_address_data;
2147 }
2148
2149 /* Put the sender address_data value into $sender_address_data */
2150
2151 sender_address_data = sender_vaddr->prop.address_data;
2152 }
2153
2154 /* A recipient address just gets a straightforward verify; again we must handle
2155 the DEFER overrides. */
2156
2157 else
2158 {
2159 address_item addr2;
2160
2161 if (success_on_redirect)
2162 verify_options |= vopt_success_on_redirect;
2163
2164 /* We must use a copy of the address for verification, because it might
2165 get rewritten. */
2166
2167 addr2 = *addr;
2168 rc = verify_address(&addr2, NULL, verify_options|vopt_is_recipient, callout,
2169 callout_overall, callout_connect, se_mailfrom, pm_mailfrom, NULL);
2170 HDEBUG(D_acl) debug_printf_indent("----------- end verify ------------\n");
2171
2172 *basic_errno = addr2.basic_errno;
2173 *log_msgptr = addr2.message;
2174 *user_msgptr = addr2.user_message ? addr2.user_message : addr2.message;
2175
2176 /* Allow details for temporary error if the address is so flagged. */
2177 if (testflag((&addr2), af_pass_message)) f.acl_temp_details = TRUE;
2178
2179 /* Make $address_data visible */
2180 deliver_address_data = addr2.prop.address_data;
2181 }
2182
2183 /* We have a result from the relevant test. Handle defer overrides first. */
2184
2185 if ( rc == DEFER
2186 && ( defer_ok
2187 || callout_defer_ok && *basic_errno == ERRNO_CALLOUTDEFER
2188 ) )
2189 {
2190 HDEBUG(D_acl) debug_printf_indent("verify defer overridden by %s\n",
2191 defer_ok? "defer_ok" : "callout_defer_ok");
2192 rc = OK;
2193 }
2194
2195 /* If we've failed a sender, set up a recipient message, and point
2196 sender_verified_failed to the address item that actually failed. */
2197
2198 if (rc != OK && verify_sender_address)
2199 {
2200 if (rc != DEFER)
2201 *log_msgptr = *user_msgptr = US"Sender verify failed";
2202 else if (*basic_errno != ERRNO_CALLOUTDEFER)
2203 *log_msgptr = *user_msgptr = US"Could not complete sender verify";
2204 else
2205 {
2206 *log_msgptr = US"Could not complete sender verify callout";
2207 *user_msgptr = smtp_return_error_details? sender_vaddr->user_message :
2208 *log_msgptr;
2209 }
2210
2211 sender_verified_failed = sender_vaddr;
2212 }
2213
2214 /* Verifying an address messes up the values of $domain and $local_part,
2215 so reset them before returning if this is a RCPT ACL. */
2216
2217 if (addr)
2218 {
2219 deliver_domain = addr->domain;
2220 deliver_localpart = addr->local_part;
2221 }
2222 return rc;
2223
2224 /* Syntax errors in the verify argument come here. */
2225
2226 BAD_VERIFY:
2227 *log_msgptr = string_sprintf("expected \"sender[=address]\", \"recipient\", "
2228 "\"helo\", \"header_syntax\", \"header_sender\", \"header_names_ascii\" "
2229 "or \"reverse_host_lookup\" at start of ACL condition "
2230 "\"verify %s\"", arg);
2231 return ERROR;
2232 }
2233
2234
2235
2236
2237 /*************************************************
2238 * Check argument for control= modifier *
2239 *************************************************/
2240
2241 /* Called from acl_check_condition() below.
2242 To handle the case "queue_only" we accept an _ in the
2243 initial / option-switch position.
2244
2245 Arguments:
2246 arg the argument string for control=
2247 pptr set to point to the terminating character
2248 where which ACL we are in
2249 log_msgptr for error messages
2250
2251 Returns: CONTROL_xxx value
2252 */
2253
2254 static int
decode_control(const uschar * arg,const uschar ** pptr,int where,uschar ** log_msgptr)2255 decode_control(const uschar *arg, const uschar **pptr, int where, uschar **log_msgptr)
2256 {
2257 int idx, len;
2258 control_def * d;
2259 uschar c;
2260
2261 if ( (idx = find_control(arg, controls_list, nelem(controls_list))) < 0
2262 || ( (c = arg[len = Ustrlen((d = controls_list+idx)->name)]) != 0
2263 && (!d->has_option || c != '/' && c != '_')
2264 ) )
2265 {
2266 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
2267 return CONTROL_ERROR;
2268 }
2269
2270 *pptr = arg + len;
2271 return idx;
2272 }
2273
2274
2275
2276
2277 /*************************************************
2278 * Return a ratelimit error *
2279 *************************************************/
2280
2281 /* Called from acl_ratelimit() below
2282
2283 Arguments:
2284 log_msgptr for error messages
2285 format format string
2286 ... supplementary arguments
2287
2288 Returns: ERROR
2289 */
2290
2291 static int
ratelimit_error(uschar ** log_msgptr,const char * format,...)2292 ratelimit_error(uschar **log_msgptr, const char *format, ...)
2293 {
2294 va_list ap;
2295 gstring * g =
2296 string_cat(NULL, US"error in arguments to \"ratelimit\" condition: ");
2297
2298 va_start(ap, format);
2299 g = string_vformat(g, SVFMT_EXTEND|SVFMT_REBUFFER, format, ap);
2300 va_end(ap);
2301
2302 gstring_release_unused(g);
2303 *log_msgptr = string_from_gstring(g);
2304 return ERROR;
2305 }
2306
2307
2308
2309
2310 /*************************************************
2311 * Handle rate limiting *
2312 *************************************************/
2313
2314 /* Called by acl_check_condition() below to calculate the result
2315 of the ACL ratelimit condition.
2316
2317 Note that the return value might be slightly unexpected: if the
2318 sender's rate is above the limit then the result is OK. This is
2319 similar to the dnslists condition, and is so that you can write
2320 ACL clauses like: defer ratelimit = 15 / 1h
2321
2322 Arguments:
2323 arg the option string for ratelimit=
2324 where ACL_WHERE_xxxx indicating which ACL this is
2325 log_msgptr for error messages
2326
2327 Returns: OK - Sender's rate is above limit
2328 FAIL - Sender's rate is below limit
2329 DEFER - Problem opening ratelimit database
2330 ERROR - Syntax error in options.
2331 */
2332
2333 static int
acl_ratelimit(const uschar * arg,int where,uschar ** log_msgptr)2334 acl_ratelimit(const uschar *arg, int where, uschar **log_msgptr)
2335 {
2336 double limit, period, count;
2337 uschar *ss;
2338 uschar *key = NULL;
2339 uschar *unique = NULL;
2340 int sep = '/';
2341 BOOL leaky = FALSE, strict = FALSE, readonly = FALSE;
2342 BOOL noupdate = FALSE, badacl = FALSE;
2343 int mode = RATE_PER_WHAT;
2344 int old_pool, rc;
2345 tree_node **anchor, *t;
2346 open_db dbblock, *dbm;
2347 int dbdb_size;
2348 dbdata_ratelimit *dbd;
2349 dbdata_ratelimit_unique *dbdb;
2350 struct timeval tv;
2351
2352 /* Parse the first two options and record their values in expansion
2353 variables. These variables allow the configuration to have informative
2354 error messages based on rate limits obtained from a table lookup. */
2355
2356 /* First is the maximum number of messages per period / maximum burst
2357 size, which must be greater than or equal to zero. Zero is useful for
2358 rate measurement as opposed to rate limiting. */
2359
2360 if (!(sender_rate_limit = string_nextinlist(&arg, &sep, NULL, 0)))
2361 return ratelimit_error(log_msgptr, "sender rate limit not set");
2362
2363 limit = Ustrtod(sender_rate_limit, &ss);
2364 if (tolower(*ss) == 'k') { limit *= 1024.0; ss++; }
2365 else if (tolower(*ss) == 'm') { limit *= 1024.0*1024.0; ss++; }
2366 else if (tolower(*ss) == 'g') { limit *= 1024.0*1024.0*1024.0; ss++; }
2367
2368 if (limit < 0.0 || *ss != '\0')
2369 return ratelimit_error(log_msgptr,
2370 "\"%s\" is not a positive number", sender_rate_limit);
2371
2372 /* Second is the rate measurement period / exponential smoothing time
2373 constant. This must be strictly greater than zero, because zero leads to
2374 run-time division errors. */
2375
2376 period = !(sender_rate_period = string_nextinlist(&arg, &sep, NULL, 0))
2377 ? -1.0 : readconf_readtime(sender_rate_period, 0, FALSE);
2378 if (period <= 0.0)
2379 return ratelimit_error(log_msgptr,
2380 "\"%s\" is not a time value", sender_rate_period);
2381
2382 /* By default we are counting one of something, but the per_rcpt,
2383 per_byte, and count options can change this. */
2384
2385 count = 1.0;
2386
2387 /* Parse the other options. */
2388
2389 while ((ss = string_nextinlist(&arg, &sep, NULL, 0)))
2390 {
2391 if (strcmpic(ss, US"leaky") == 0) leaky = TRUE;
2392 else if (strcmpic(ss, US"strict") == 0) strict = TRUE;
2393 else if (strcmpic(ss, US"noupdate") == 0) noupdate = TRUE;
2394 else if (strcmpic(ss, US"readonly") == 0) readonly = TRUE;
2395 else if (strcmpic(ss, US"per_cmd") == 0) RATE_SET(mode, PER_CMD);
2396 else if (strcmpic(ss, US"per_conn") == 0)
2397 {
2398 RATE_SET(mode, PER_CONN);
2399 if (where == ACL_WHERE_NOTSMTP || where == ACL_WHERE_NOTSMTP_START)
2400 badacl = TRUE;
2401 }
2402 else if (strcmpic(ss, US"per_mail") == 0)
2403 {
2404 RATE_SET(mode, PER_MAIL);
2405 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2406 }
2407 else if (strcmpic(ss, US"per_rcpt") == 0)
2408 {
2409 /* If we are running in the RCPT ACL, then we'll count the recipients
2410 one by one, but if we are running when we have accumulated the whole
2411 list then we'll add them all in one batch. */
2412 if (where == ACL_WHERE_RCPT)
2413 RATE_SET(mode, PER_RCPT);
2414 else if (where >= ACL_WHERE_PREDATA && where <= ACL_WHERE_NOTSMTP)
2415 RATE_SET(mode, PER_ALLRCPTS), count = (double)recipients_count;
2416 else if (where == ACL_WHERE_MAIL || where > ACL_WHERE_NOTSMTP)
2417 RATE_SET(mode, PER_RCPT), badacl = TRUE;
2418 }
2419 else if (strcmpic(ss, US"per_byte") == 0)
2420 {
2421 /* If we have not yet received the message data and there was no SIZE
2422 declaration on the MAIL command, then it's safe to just use a value of
2423 zero and let the recorded rate decay as if nothing happened. */
2424 RATE_SET(mode, PER_MAIL);
2425 if (where > ACL_WHERE_NOTSMTP) badacl = TRUE;
2426 else count = message_size < 0 ? 0.0 : (double)message_size;
2427 }
2428 else if (strcmpic(ss, US"per_addr") == 0)
2429 {
2430 RATE_SET(mode, PER_RCPT);
2431 if (where != ACL_WHERE_RCPT) badacl = TRUE, unique = US"*";
2432 else unique = string_sprintf("%s@%s", deliver_localpart, deliver_domain);
2433 }
2434 else if (strncmpic(ss, US"count=", 6) == 0)
2435 {
2436 uschar *e;
2437 count = Ustrtod(ss+6, &e);
2438 if (count < 0.0 || *e != '\0')
2439 return ratelimit_error(log_msgptr, "\"%s\" is not a positive number", ss);
2440 }
2441 else if (strncmpic(ss, US"unique=", 7) == 0)
2442 unique = string_copy(ss + 7);
2443 else if (!key)
2444 key = string_copy(ss);
2445 else
2446 key = string_sprintf("%s/%s", key, ss);
2447 }
2448
2449 /* Sanity check. When the badacl flag is set the update mode must either
2450 be readonly (which is the default if it is omitted) or, for backwards
2451 compatibility, a combination of noupdate and strict or leaky. */
2452
2453 if (mode == RATE_PER_CLASH)
2454 return ratelimit_error(log_msgptr, "conflicting per_* options");
2455 if (leaky + strict + readonly > 1)
2456 return ratelimit_error(log_msgptr, "conflicting update modes");
2457 if (badacl && (leaky || strict) && !noupdate)
2458 return ratelimit_error(log_msgptr,
2459 "\"%s\" must not have /leaky or /strict option, or cannot be used in %s ACL",
2460 ratelimit_option_string[mode], acl_wherenames[where]);
2461
2462 /* Set the default values of any unset options. In readonly mode we
2463 perform the rate computation without any increment so that its value
2464 decays to eventually allow over-limit senders through. */
2465
2466 if (noupdate) readonly = TRUE, leaky = strict = FALSE;
2467 if (badacl) readonly = TRUE;
2468 if (readonly) count = 0.0;
2469 if (!strict && !readonly) leaky = TRUE;
2470 if (mode == RATE_PER_WHAT) mode = RATE_PER_MAIL;
2471
2472 /* Create the lookup key. If there is no explicit key, use sender_host_address.
2473 If there is no sender_host_address (e.g. -bs or acl_not_smtp) then we simply
2474 omit it. The smoothing constant (sender_rate_period) and the per_xxx options
2475 are added to the key because they alter the meaning of the stored data. */
2476
2477 if (!key)
2478 key = !sender_host_address ? US"" : sender_host_address;
2479
2480 key = string_sprintf("%s/%s/%s%s",
2481 sender_rate_period,
2482 ratelimit_option_string[mode],
2483 unique == NULL ? "" : "unique/",
2484 key);
2485
2486 HDEBUG(D_acl)
2487 debug_printf_indent("ratelimit condition count=%.0f %.1f/%s\n", count, limit, key);
2488
2489 /* See if we have already computed the rate by looking in the relevant tree.
2490 For per-connection rate limiting, store tree nodes and dbdata in the permanent
2491 pool so that they survive across resets. In readonly mode we only remember the
2492 result for the rest of this command in case a later command changes it. After
2493 this bit of logic the code is independent of the per_* mode. */
2494
2495 old_pool = store_pool;
2496
2497 if (readonly)
2498 anchor = &ratelimiters_cmd;
2499 else switch(mode)
2500 {
2501 case RATE_PER_CONN:
2502 anchor = &ratelimiters_conn;
2503 store_pool = POOL_PERM;
2504 break;
2505 case RATE_PER_BYTE:
2506 case RATE_PER_MAIL:
2507 case RATE_PER_ALLRCPTS:
2508 anchor = &ratelimiters_mail;
2509 break;
2510 case RATE_PER_ADDR:
2511 case RATE_PER_CMD:
2512 case RATE_PER_RCPT:
2513 anchor = &ratelimiters_cmd;
2514 break;
2515 default:
2516 anchor = NULL; /* silence an "unused" complaint */
2517 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
2518 "internal ACL error: unknown ratelimit mode %d", mode);
2519 break;
2520 }
2521
2522 if ((t = tree_search(*anchor, key)))
2523 {
2524 dbd = t->data.ptr;
2525 /* The following few lines duplicate some of the code below. */
2526 rc = (dbd->rate < limit)? FAIL : OK;
2527 store_pool = old_pool;
2528 sender_rate = string_sprintf("%.1f", dbd->rate);
2529 HDEBUG(D_acl)
2530 debug_printf_indent("ratelimit found pre-computed rate %s\n", sender_rate);
2531 return rc;
2532 }
2533
2534 /* We aren't using a pre-computed rate, so get a previously recorded rate
2535 from the database, which will be updated and written back if required. */
2536
2537 if (!(dbm = dbfn_open(US"ratelimit", O_RDWR, &dbblock, TRUE, TRUE)))
2538 {
2539 store_pool = old_pool;
2540 sender_rate = NULL;
2541 HDEBUG(D_acl) debug_printf_indent("ratelimit database not available\n");
2542 *log_msgptr = US"ratelimit database not available";
2543 return DEFER;
2544 }
2545 dbdb = dbfn_read_with_length(dbm, key, &dbdb_size);
2546 dbd = NULL;
2547
2548 gettimeofday(&tv, NULL);
2549
2550 if (dbdb)
2551 {
2552 /* Locate the basic ratelimit block inside the DB data. */
2553 HDEBUG(D_acl) debug_printf_indent("ratelimit found key in database\n");
2554 dbd = &dbdb->dbd;
2555
2556 /* Forget the old Bloom filter if it is too old, so that we count each
2557 repeating event once per period. We don't simply clear and re-use the old
2558 filter because we want its size to change if the limit changes. Note that
2559 we keep the dbd pointer for copying the rate into the new data block. */
2560
2561 if(unique && tv.tv_sec > dbdb->bloom_epoch + period)
2562 {
2563 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding old Bloom filter\n");
2564 dbdb = NULL;
2565 }
2566
2567 /* Sanity check. */
2568
2569 if(unique && dbdb_size < sizeof(*dbdb))
2570 {
2571 HDEBUG(D_acl) debug_printf_indent("ratelimit discarding undersize Bloom filter\n");
2572 dbdb = NULL;
2573 }
2574 }
2575
2576 /* Allocate a new data block if the database lookup failed
2577 or the Bloom filter passed its age limit. */
2578
2579 if (!dbdb)
2580 {
2581 if (!unique)
2582 {
2583 /* No Bloom filter. This basic ratelimit block is initialized below. */
2584 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new rate data block\n");
2585 dbdb_size = sizeof(*dbd);
2586 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2587 }
2588 else
2589 {
2590 int extra;
2591 HDEBUG(D_acl) debug_printf_indent("ratelimit creating new Bloom filter\n");
2592
2593 /* See the long comment below for an explanation of the magic number 2.
2594 The filter has a minimum size in case the rate limit is very small;
2595 this is determined by the definition of dbdata_ratelimit_unique. */
2596
2597 extra = (int)limit * 2 - sizeof(dbdb->bloom);
2598 if (extra < 0) extra = 0;
2599 dbdb_size = sizeof(*dbdb) + extra;
2600 dbdb = store_get(dbdb_size, FALSE); /* not tainted */
2601 dbdb->bloom_epoch = tv.tv_sec;
2602 dbdb->bloom_size = sizeof(dbdb->bloom) + extra;
2603 memset(dbdb->bloom, 0, dbdb->bloom_size);
2604
2605 /* Preserve any basic ratelimit data (which is our longer-term memory)
2606 by copying it from the discarded block. */
2607
2608 if (dbd)
2609 {
2610 dbdb->dbd = *dbd;
2611 dbd = &dbdb->dbd;
2612 }
2613 }
2614 }
2615
2616 /* If we are counting unique events, find out if this event is new or not.
2617 If the client repeats the event during the current period then it should be
2618 counted. We skip this code in readonly mode for efficiency, because any
2619 changes to the filter will be discarded and because count is already set to
2620 zero. */
2621
2622 if (unique && !readonly)
2623 {
2624 /* We identify unique events using a Bloom filter. (You can find my
2625 notes on Bloom filters at http://fanf.livejournal.com/81696.html)
2626 With the per_addr option, an "event" is a recipient address, though the
2627 user can use the unique option to define their own events. We only count
2628 an event if we have not seen it before.
2629
2630 We size the filter according to the rate limit, which (in leaky mode)
2631 is the limit on the population of the filter. We allow 16 bits of space
2632 per entry (see the construction code above) and we set (up to) 8 of them
2633 when inserting an element (see the loop below). The probability of a false
2634 positive (an event we have not seen before but which we fail to count) is
2635
2636 size = limit * 16
2637 numhash = 8
2638 allzero = exp(-numhash * pop / size)
2639 = exp(-0.5 * pop / limit)
2640 fpr = pow(1 - allzero, numhash)
2641
2642 For senders at the limit the fpr is 0.06% or 1 in 1700
2643 and for senders at half the limit it is 0.0006% or 1 in 170000
2644
2645 In strict mode the Bloom filter can fill up beyond the normal limit, in
2646 which case the false positive rate will rise. This means that the
2647 measured rate for very fast senders can bogusly drop off after a while.
2648
2649 At twice the limit, the fpr is 2.5% or 1 in 40
2650 At four times the limit, it is 31% or 1 in 3.2
2651
2652 It takes ln(pop/limit) periods for an over-limit burst of pop events to
2653 decay below the limit, and if this is more than one then the Bloom filter
2654 will be discarded before the decay gets that far. The false positive rate
2655 at this threshold is 9.3% or 1 in 10.7. */
2656
2657 BOOL seen;
2658 unsigned n, hash, hinc;
2659 uschar md5sum[16];
2660 md5 md5info;
2661
2662 /* Instead of using eight independent hash values, we combine two values
2663 using the formula h1 + n * h2. This does not harm the Bloom filter's
2664 performance, and means the amount of hash we need is independent of the
2665 number of bits we set in the filter. */
2666
2667 md5_start(&md5info);
2668 md5_end(&md5info, unique, Ustrlen(unique), md5sum);
2669 hash = md5sum[0] | md5sum[1] << 8 | md5sum[2] << 16 | md5sum[3] << 24;
2670 hinc = md5sum[4] | md5sum[5] << 8 | md5sum[6] << 16 | md5sum[7] << 24;
2671
2672 /* Scan the bits corresponding to this event. A zero bit means we have
2673 not seen it before. Ensure all bits are set to record this event. */
2674
2675 HDEBUG(D_acl) debug_printf_indent("ratelimit checking uniqueness of %s\n", unique);
2676
2677 seen = TRUE;
2678 for (n = 0; n < 8; n++, hash += hinc)
2679 {
2680 int bit = 1 << (hash % 8);
2681 int byte = (hash / 8) % dbdb->bloom_size;
2682 if ((dbdb->bloom[byte] & bit) == 0)
2683 {
2684 dbdb->bloom[byte] |= bit;
2685 seen = FALSE;
2686 }
2687 }
2688
2689 /* If this event has occurred before, do not count it. */
2690
2691 if (seen)
2692 {
2693 HDEBUG(D_acl) debug_printf_indent("ratelimit event found in Bloom filter\n");
2694 count = 0.0;
2695 }
2696 else
2697 HDEBUG(D_acl) debug_printf_indent("ratelimit event added to Bloom filter\n");
2698 }
2699
2700 /* If there was no previous ratelimit data block for this key, initialize
2701 the new one, otherwise update the block from the database. The initial rate
2702 is what would be computed by the code below for an infinite interval. */
2703
2704 if (!dbd)
2705 {
2706 HDEBUG(D_acl) debug_printf_indent("ratelimit initializing new key's rate data\n");
2707 dbd = &dbdb->dbd;
2708 dbd->time_stamp = tv.tv_sec;
2709 dbd->time_usec = tv.tv_usec;
2710 dbd->rate = count;
2711 }
2712 else
2713 {
2714 /* The smoothed rate is computed using an exponentially weighted moving
2715 average adjusted for variable sampling intervals. The standard EWMA for
2716 a fixed sampling interval is: f'(t) = (1 - a) * f(t) + a * f'(t - 1)
2717 where f() is the measured value and f'() is the smoothed value.
2718
2719 Old data decays out of the smoothed value exponentially, such that data n
2720 samples old is multiplied by a^n. The exponential decay time constant p
2721 is defined such that data p samples old is multiplied by 1/e, which means
2722 that a = exp(-1/p). We can maintain the same time constant for a variable
2723 sampling interval i by using a = exp(-i/p).
2724
2725 The rate we are measuring is messages per period, suitable for directly
2726 comparing with the limit. The average rate between now and the previous
2727 message is period / interval, which we feed into the EWMA as the sample.
2728
2729 It turns out that the number of messages required for the smoothed rate
2730 to reach the limit when they are sent in a burst is equal to the limit.
2731 This can be seen by analysing the value of the smoothed rate after N
2732 messages sent at even intervals. Let k = (1 - a) * p/i
2733
2734 rate_1 = (1 - a) * p/i + a * rate_0
2735 = k + a * rate_0
2736 rate_2 = k + a * rate_1
2737 = k + a * k + a^2 * rate_0
2738 rate_3 = k + a * k + a^2 * k + a^3 * rate_0
2739 rate_N = rate_0 * a^N + k * SUM(x=0..N-1)(a^x)
2740 = rate_0 * a^N + k * (1 - a^N) / (1 - a)
2741 = rate_0 * a^N + p/i * (1 - a^N)
2742
2743 When N is large, a^N -> 0 so rate_N -> p/i as desired.
2744
2745 rate_N = p/i + (rate_0 - p/i) * a^N
2746 a^N = (rate_N - p/i) / (rate_0 - p/i)
2747 N * -i/p = log((rate_N - p/i) / (rate_0 - p/i))
2748 N = p/i * log((rate_0 - p/i) / (rate_N - p/i))
2749
2750 Numerical analysis of the above equation, setting the computed rate to
2751 increase from rate_0 = 0 to rate_N = limit, shows that for large sending
2752 rates, p/i, the number of messages N = limit. So limit serves as both the
2753 maximum rate measured in messages per period, and the maximum number of
2754 messages that can be sent in a fast burst. */
2755
2756 double this_time = (double)tv.tv_sec
2757 + (double)tv.tv_usec / 1000000.0;
2758 double prev_time = (double)dbd->time_stamp
2759 + (double)dbd->time_usec / 1000000.0;
2760
2761 /* We must avoid division by zero, and deal gracefully with the clock going
2762 backwards. If we blunder ahead when time is in reverse then the computed
2763 rate will be bogus. To be safe we clamp interval to a very small number. */
2764
2765 double interval = this_time - prev_time <= 0.0 ? 1e-9
2766 : this_time - prev_time;
2767
2768 double i_over_p = interval / period;
2769 double a = exp(-i_over_p);
2770
2771 /* Combine the instantaneous rate (period / interval) with the previous rate
2772 using the smoothing factor a. In order to measure sized events, multiply the
2773 instantaneous rate by the count of bytes or recipients etc. */
2774
2775 dbd->time_stamp = tv.tv_sec;
2776 dbd->time_usec = tv.tv_usec;
2777 dbd->rate = (1 - a) * count / i_over_p + a * dbd->rate;
2778
2779 /* When events are very widely spaced the computed rate tends towards zero.
2780 Although this is accurate it turns out not to be useful for our purposes,
2781 especially when the first event after a long silence is the start of a spam
2782 run. A more useful model is that the rate for an isolated event should be the
2783 size of the event per the period size, ignoring the lack of events outside
2784 the current period and regardless of where the event falls in the period. So,
2785 if the interval was so long that the calculated rate is unhelpfully small, we
2786 re-initialize the rate. In the absence of higher-rate bursts, the condition
2787 below is true if the interval is greater than the period. */
2788
2789 if (dbd->rate < count) dbd->rate = count;
2790 }
2791
2792 /* Clients sending at the limit are considered to be over the limit.
2793 This matters for edge cases such as a limit of zero, when the client
2794 should be completely blocked. */
2795
2796 rc = dbd->rate < limit ? FAIL : OK;
2797
2798 /* Update the state if the rate is low or if we are being strict. If we
2799 are in leaky mode and the sender's rate is too high, we do not update
2800 the recorded rate in order to avoid an over-aggressive sender's retry
2801 rate preventing them from getting any email through. If readonly is set,
2802 neither leaky nor strict are set, so we do not do any updates. */
2803
2804 if ((rc == FAIL && leaky) || strict)
2805 {
2806 dbfn_write(dbm, key, dbdb, dbdb_size);
2807 HDEBUG(D_acl) debug_printf_indent("ratelimit db updated\n");
2808 }
2809 else
2810 {
2811 HDEBUG(D_acl) debug_printf_indent("ratelimit db not updated: %s\n",
2812 readonly? "readonly mode" : "over the limit, but leaky");
2813 }
2814
2815 dbfn_close(dbm);
2816
2817 /* Store the result in the tree for future reference. Take the taint status
2818 from the key for consistency even though it's unlikely we'll ever expand this. */
2819
2820 t = store_get(sizeof(tree_node) + Ustrlen(key), is_tainted(key));
2821 t->data.ptr = dbd;
2822 Ustrcpy(t->name, key);
2823 (void)tree_insertnode(anchor, t);
2824
2825 /* We create the formatted version of the sender's rate very late in
2826 order to ensure that it is done using the correct storage pool. */
2827
2828 store_pool = old_pool;
2829 sender_rate = string_sprintf("%.1f", dbd->rate);
2830
2831 HDEBUG(D_acl)
2832 debug_printf_indent("ratelimit computed rate %s\n", sender_rate);
2833
2834 return rc;
2835 }
2836
2837
2838
2839 /*************************************************
2840 * The udpsend ACL modifier *
2841 *************************************************/
2842
2843 /* Called by acl_check_condition() below.
2844
2845 Arguments:
2846 arg the option string for udpsend=
2847 log_msgptr for error messages
2848
2849 Returns: OK - Completed.
2850 DEFER - Problem with DNS lookup.
2851 ERROR - Syntax error in options.
2852 */
2853
2854 static int
acl_udpsend(const uschar * arg,uschar ** log_msgptr)2855 acl_udpsend(const uschar *arg, uschar **log_msgptr)
2856 {
2857 int sep = 0;
2858 uschar *hostname;
2859 uschar *portstr;
2860 uschar *portend;
2861 host_item *h;
2862 int portnum;
2863 int len;
2864 int r, s;
2865 uschar * errstr;
2866
2867 hostname = string_nextinlist(&arg, &sep, NULL, 0);
2868 portstr = string_nextinlist(&arg, &sep, NULL, 0);
2869
2870 if (!hostname)
2871 {
2872 *log_msgptr = US"missing destination host in \"udpsend\" modifier";
2873 return ERROR;
2874 }
2875 if (!portstr)
2876 {
2877 *log_msgptr = US"missing destination port in \"udpsend\" modifier";
2878 return ERROR;
2879 }
2880 if (!arg)
2881 {
2882 *log_msgptr = US"missing datagram payload in \"udpsend\" modifier";
2883 return ERROR;
2884 }
2885 portnum = Ustrtol(portstr, &portend, 10);
2886 if (*portend != '\0')
2887 {
2888 *log_msgptr = US"bad destination port in \"udpsend\" modifier";
2889 return ERROR;
2890 }
2891
2892 /* Make a single-item host list. */
2893 h = store_get(sizeof(host_item), FALSE);
2894 memset(h, 0, sizeof(host_item));
2895 h->name = hostname;
2896 h->port = portnum;
2897 h->mx = MX_NONE;
2898
2899 if (string_is_ip_address(hostname, NULL))
2900 h->address = hostname, r = HOST_FOUND;
2901 else
2902 r = host_find_byname(h, NULL, 0, NULL, FALSE);
2903 if (r == HOST_FIND_FAILED || r == HOST_FIND_AGAIN)
2904 {
2905 *log_msgptr = US"DNS lookup failed in \"udpsend\" modifier";
2906 return DEFER;
2907 }
2908
2909 HDEBUG(D_acl)
2910 debug_printf_indent("udpsend [%s]:%d %s\n", h->address, portnum, arg);
2911
2912 /*XXX this could better use sendto */
2913 r = s = ip_connectedsocket(SOCK_DGRAM, h->address, portnum, portnum,
2914 1, NULL, &errstr, NULL);
2915 if (r < 0) goto defer;
2916 len = Ustrlen(arg);
2917 r = send(s, arg, len, 0);
2918 if (r < 0)
2919 {
2920 errstr = US strerror(errno);
2921 close(s);
2922 goto defer;
2923 }
2924 close(s);
2925 if (r < len)
2926 {
2927 *log_msgptr =
2928 string_sprintf("\"udpsend\" truncated from %d to %d octets", len, r);
2929 return DEFER;
2930 }
2931
2932 HDEBUG(D_acl)
2933 debug_printf_indent("udpsend %d bytes\n", r);
2934
2935 return OK;
2936
2937 defer:
2938 *log_msgptr = string_sprintf("\"udpsend\" failed: %s", errstr);
2939 return DEFER;
2940 }
2941
2942
2943
2944 /*************************************************
2945 * Handle conditions/modifiers on an ACL item *
2946 *************************************************/
2947
2948 /* Called from acl_check() below.
2949
2950 Arguments:
2951 verb ACL verb
2952 cb ACL condition block - if NULL, result is OK
2953 where where called from
2954 addr the address being checked for RCPT, or NULL
2955 level the nesting level
2956 epp pointer to pass back TRUE if "endpass" encountered
2957 (applies only to "accept" and "discard")
2958 user_msgptr user message pointer
2959 log_msgptr log message pointer
2960 basic_errno pointer to where to put verify error
2961
2962 Returns: OK - all conditions are met
2963 DISCARD - an "acl" condition returned DISCARD - only allowed
2964 for "accept" or "discard" verbs
2965 FAIL - at least one condition fails
2966 FAIL_DROP - an "acl" condition returned FAIL_DROP
2967 DEFER - can't tell at the moment (typically, lookup defer,
2968 but can be temporary callout problem)
2969 ERROR - ERROR from nested ACL or expansion failure or other
2970 error
2971 */
2972
2973 static int
acl_check_condition(int verb,acl_condition_block * cb,int where,address_item * addr,int level,BOOL * epp,uschar ** user_msgptr,uschar ** log_msgptr,int * basic_errno)2974 acl_check_condition(int verb, acl_condition_block *cb, int where,
2975 address_item *addr, int level, BOOL *epp, uschar **user_msgptr,
2976 uschar **log_msgptr, int *basic_errno)
2977 {
2978 uschar *user_message = NULL;
2979 uschar *log_message = NULL;
2980 int rc = OK;
2981 #ifdef WITH_CONTENT_SCAN
2982 int sep = -'/';
2983 #endif
2984
2985 for (; cb; cb = cb->next)
2986 {
2987 const uschar *arg;
2988 int control_type;
2989
2990 /* The message and log_message items set up messages to be used in
2991 case of rejection. They are expanded later. */
2992
2993 if (cb->type == ACLC_MESSAGE)
2994 {
2995 HDEBUG(D_acl) debug_printf_indent(" message: %s\n", cb->arg);
2996 user_message = cb->arg;
2997 continue;
2998 }
2999
3000 if (cb->type == ACLC_LOG_MESSAGE)
3001 {
3002 HDEBUG(D_acl) debug_printf_indent("l_message: %s\n", cb->arg);
3003 log_message = cb->arg;
3004 continue;
3005 }
3006
3007 /* The endpass "condition" just sets a flag to show it occurred. This is
3008 checked at compile time to be on an "accept" or "discard" item. */
3009
3010 if (cb->type == ACLC_ENDPASS)
3011 {
3012 *epp = TRUE;
3013 continue;
3014 }
3015
3016 /* For other conditions and modifiers, the argument is expanded now for some
3017 of them, but not for all, because expansion happens down in some lower level
3018 checking functions in some cases. */
3019
3020 if (!conditions[cb->type].expand_at_top)
3021 arg = cb->arg;
3022 else if (!(arg = expand_string(cb->arg)))
3023 {
3024 if (f.expand_string_forcedfail) continue;
3025 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
3026 cb->arg, expand_string_message);
3027 return f.search_find_defer ? DEFER : ERROR;
3028 }
3029
3030 /* Show condition, and expanded condition if it's different */
3031
3032 HDEBUG(D_acl)
3033 {
3034 int lhswidth = 0;
3035 debug_printf_indent("check %s%s %n",
3036 (!conditions[cb->type].is_modifier && cb->u.negated)? "!":"",
3037 conditions[cb->type].name, &lhswidth);
3038
3039 if (cb->type == ACLC_SET)
3040 {
3041 #ifndef DISABLE_DKIM
3042 if ( Ustrcmp(cb->u.varname, "dkim_verify_status") == 0
3043 || Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3044 {
3045 debug_printf("%s ", cb->u.varname);
3046 lhswidth += 19;
3047 }
3048 else
3049 #endif
3050 {
3051 debug_printf("acl_%s ", cb->u.varname);
3052 lhswidth += 5 + Ustrlen(cb->u.varname);
3053 }
3054 }
3055
3056 debug_printf("= %s\n", cb->arg);
3057
3058 if (arg != cb->arg)
3059 debug_printf("%.*s= %s\n", lhswidth,
3060 US" ", CS arg);
3061 }
3062
3063 /* Check that this condition makes sense at this time */
3064
3065 if ((conditions[cb->type].forbids & (1 << where)) != 0)
3066 {
3067 *log_msgptr = string_sprintf("cannot %s %s condition in %s ACL",
3068 conditions[cb->type].is_modifier ? "use" : "test",
3069 conditions[cb->type].name, acl_wherenames[where]);
3070 return ERROR;
3071 }
3072
3073 /* Run the appropriate test for each condition, or take the appropriate
3074 action for the remaining modifiers. */
3075
3076 switch(cb->type)
3077 {
3078 case ACLC_ADD_HEADER:
3079 setup_header(arg);
3080 break;
3081
3082 /* A nested ACL that returns "discard" makes sense only for an "accept" or
3083 "discard" verb. */
3084
3085 case ACLC_ACL:
3086 rc = acl_check_wargs(where, addr, arg, user_msgptr, log_msgptr);
3087 if (rc == DISCARD && verb != ACL_ACCEPT && verb != ACL_DISCARD)
3088 {
3089 *log_msgptr = string_sprintf("nested ACL returned \"discard\" for "
3090 "\"%s\" command (only allowed with \"accept\" or \"discard\")",
3091 verbs[verb]);
3092 return ERROR;
3093 }
3094 break;
3095
3096 case ACLC_AUTHENTICATED:
3097 rc = sender_host_authenticated ? match_isinlist(sender_host_authenticated,
3098 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL) : FAIL;
3099 break;
3100
3101 #ifdef EXPERIMENTAL_BRIGHTMAIL
3102 case ACLC_BMI_OPTIN:
3103 {
3104 int old_pool = store_pool;
3105 store_pool = POOL_PERM;
3106 bmi_current_optin = string_copy(arg);
3107 store_pool = old_pool;
3108 }
3109 break;
3110 #endif
3111
3112 case ACLC_CONDITION:
3113 /* The true/false parsing here should be kept in sync with that used in
3114 expand.c when dealing with ECOND_BOOL so that we don't have too many
3115 different definitions of what can be a boolean. */
3116 if (*arg == '-'
3117 ? Ustrspn(arg+1, "0123456789") == Ustrlen(arg+1) /* Negative number */
3118 : Ustrspn(arg, "0123456789") == Ustrlen(arg)) /* Digits, or empty */
3119 rc = (Uatoi(arg) == 0)? FAIL : OK;
3120 else
3121 rc = (strcmpic(arg, US"no") == 0 ||
3122 strcmpic(arg, US"false") == 0)? FAIL :
3123 (strcmpic(arg, US"yes") == 0 ||
3124 strcmpic(arg, US"true") == 0)? OK : DEFER;
3125 if (rc == DEFER)
3126 *log_msgptr = string_sprintf("invalid \"condition\" value \"%s\"", arg);
3127 break;
3128
3129 case ACLC_CONTINUE: /* Always succeeds */
3130 break;
3131
3132 case ACLC_CONTROL:
3133 {
3134 const uschar *p = NULL;
3135 control_type = decode_control(arg, &p, where, log_msgptr);
3136
3137 /* Check if this control makes sense at this time */
3138
3139 if (controls_list[control_type].forbids & (1 << where))
3140 {
3141 *log_msgptr = string_sprintf("cannot use \"control=%s\" in %s ACL",
3142 controls_list[control_type].name, acl_wherenames[where]);
3143 return ERROR;
3144 }
3145
3146 switch(control_type)
3147 {
3148 case CONTROL_AUTH_UNADVERTISED:
3149 f.allow_auth_unadvertised = TRUE;
3150 break;
3151
3152 #ifdef EXPERIMENTAL_BRIGHTMAIL
3153 case CONTROL_BMI_RUN:
3154 bmi_run = 1;
3155 break;
3156 #endif
3157
3158 #ifndef DISABLE_DKIM
3159 case CONTROL_DKIM_VERIFY:
3160 f.dkim_disable_verify = TRUE;
3161 # ifdef SUPPORT_DMARC
3162 /* Since DKIM was blocked, skip DMARC too */
3163 f.dmarc_disable_verify = TRUE;
3164 f.dmarc_enable_forensic = FALSE;
3165 # endif
3166 break;
3167 #endif
3168
3169 #ifdef SUPPORT_DMARC
3170 case CONTROL_DMARC_VERIFY:
3171 f.dmarc_disable_verify = TRUE;
3172 break;
3173
3174 case CONTROL_DMARC_FORENSIC:
3175 f.dmarc_enable_forensic = TRUE;
3176 break;
3177 #endif
3178
3179 case CONTROL_DSCP:
3180 if (*p == '/')
3181 {
3182 int fd, af, level, optname, value;
3183 /* If we are acting on stdin, the setsockopt may fail if stdin is not
3184 a socket; we can accept that, we'll just debug-log failures anyway. */
3185 fd = fileno(smtp_in);
3186 if ((af = ip_get_address_family(fd)) < 0)
3187 {
3188 HDEBUG(D_acl)
3189 debug_printf_indent("smtp input is probably not a socket [%s], not setting DSCP\n",
3190 strerror(errno));
3191 break;
3192 }
3193 if (dscp_lookup(p+1, af, &level, &optname, &value))
3194 if (setsockopt(fd, level, optname, &value, sizeof(value)) < 0)
3195 {
3196 HDEBUG(D_acl) debug_printf_indent("failed to set input DSCP[%s]: %s\n",
3197 p+1, strerror(errno));
3198 }
3199 else
3200 {
3201 HDEBUG(D_acl) debug_printf_indent("set input DSCP to \"%s\"\n", p+1);
3202 }
3203 else
3204 {
3205 *log_msgptr = string_sprintf("unrecognised DSCP value in \"control=%s\"", arg);
3206 return ERROR;
3207 }
3208 }
3209 else
3210 {
3211 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3212 return ERROR;
3213 }
3214 break;
3215
3216 case CONTROL_ERROR:
3217 return ERROR;
3218
3219 case CONTROL_CASEFUL_LOCAL_PART:
3220 deliver_localpart = addr->cc_local_part;
3221 break;
3222
3223 case CONTROL_CASELOWER_LOCAL_PART:
3224 deliver_localpart = addr->lc_local_part;
3225 break;
3226
3227 case CONTROL_ENFORCE_SYNC:
3228 smtp_enforce_sync = TRUE;
3229 break;
3230
3231 case CONTROL_NO_ENFORCE_SYNC:
3232 smtp_enforce_sync = FALSE;
3233 break;
3234
3235 #ifdef WITH_CONTENT_SCAN
3236 case CONTROL_NO_MBOX_UNSPOOL:
3237 f.no_mbox_unspool = TRUE;
3238 break;
3239 #endif
3240
3241 case CONTROL_NO_MULTILINE:
3242 f.no_multiline_responses = TRUE;
3243 break;
3244
3245 case CONTROL_NO_PIPELINING:
3246 f.pipelining_enable = FALSE;
3247 break;
3248
3249 case CONTROL_NO_DELAY_FLUSH:
3250 f.disable_delay_flush = TRUE;
3251 break;
3252
3253 case CONTROL_NO_CALLOUT_FLUSH:
3254 f.disable_callout_flush = TRUE;
3255 break;
3256
3257 case CONTROL_FAKEREJECT:
3258 cancel_cutthrough_connection(TRUE, US"fakereject");
3259 case CONTROL_FAKEDEFER:
3260 fake_response = (control_type == CONTROL_FAKEDEFER) ? DEFER : FAIL;
3261 if (*p == '/')
3262 {
3263 const uschar *pp = p + 1;
3264 while (*pp) pp++;
3265 /* The entire control= line was expanded at top so no need to expand
3266 the part after the / */
3267 fake_response_text = string_copyn(p+1, pp-p-1);
3268 p = pp;
3269 }
3270 else /* Explicitly reset to default string */
3271 fake_response_text = US"Your message has been rejected but is being kept for evaluation.\nIf it was a legitimate message, it may still be delivered to the target recipient(s).";
3272 break;
3273
3274 case CONTROL_FREEZE:
3275 f.deliver_freeze = TRUE;
3276 deliver_frozen_at = time(NULL);
3277 freeze_tell = freeze_tell_config; /* Reset to configured value */
3278 if (Ustrncmp(p, "/no_tell", 8) == 0)
3279 {
3280 p += 8;
3281 freeze_tell = NULL;
3282 }
3283 if (*p)
3284 {
3285 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3286 return ERROR;
3287 }
3288 cancel_cutthrough_connection(TRUE, US"item frozen");
3289 break;
3290
3291 case CONTROL_QUEUE:
3292 f.queue_only_policy = TRUE;
3293 if (Ustrcmp(p, "_only") == 0)
3294 p += 5;
3295 else while (*p == '/')
3296 if (Ustrncmp(p, "/only", 5) == 0)
3297 { p += 5; f.queue_smtp = FALSE; }
3298 else if (Ustrncmp(p, "/first_pass_route", 17) == 0)
3299 { p += 17; f.queue_smtp = TRUE; }
3300 else
3301 break;
3302 cancel_cutthrough_connection(TRUE, US"queueing forced");
3303 break;
3304
3305 case CONTROL_SUBMISSION:
3306 originator_name = US"";
3307 f.submission_mode = TRUE;
3308 while (*p == '/')
3309 {
3310 if (Ustrncmp(p, "/sender_retain", 14) == 0)
3311 {
3312 p += 14;
3313 f.active_local_sender_retain = TRUE;
3314 f.active_local_from_check = FALSE;
3315 }
3316 else if (Ustrncmp(p, "/domain=", 8) == 0)
3317 {
3318 const uschar *pp = p + 8;
3319 while (*pp && *pp != '/') pp++;
3320 submission_domain = string_copyn(p+8, pp-p-8);
3321 p = pp;
3322 }
3323 /* The name= option must be last, because it swallows the rest of
3324 the string. */
3325 else if (Ustrncmp(p, "/name=", 6) == 0)
3326 {
3327 const uschar *pp = p + 6;
3328 while (*pp) pp++;
3329 submission_name = parse_fix_phrase(p+6, pp-p-6);
3330 p = pp;
3331 }
3332 else break;
3333 }
3334 if (*p)
3335 {
3336 *log_msgptr = string_sprintf("syntax error in \"control=%s\"", arg);
3337 return ERROR;
3338 }
3339 break;
3340
3341 case CONTROL_DEBUG:
3342 {
3343 uschar * debug_tag = NULL;
3344 uschar * debug_opts = NULL;
3345 BOOL kill = FALSE;
3346
3347 while (*p == '/')
3348 {
3349 const uschar * pp = p+1;
3350 if (Ustrncmp(pp, "tag=", 4) == 0)
3351 {
3352 for (pp += 4; *pp && *pp != '/';) pp++;
3353 debug_tag = string_copyn(p+5, pp-p-5);
3354 }
3355 else if (Ustrncmp(pp, "opts=", 5) == 0)
3356 {
3357 for (pp += 5; *pp && *pp != '/';) pp++;
3358 debug_opts = string_copyn(p+6, pp-p-6);
3359 }
3360 else if (Ustrncmp(pp, "kill", 4) == 0)
3361 {
3362 for (pp += 4; *pp && *pp != '/';) pp++;
3363 kill = TRUE;
3364 }
3365 else
3366 while (*pp && *pp != '/') pp++;
3367 p = pp;
3368 }
3369
3370 if (kill)
3371 debug_logging_stop();
3372 else
3373 debug_logging_activate(debug_tag, debug_opts);
3374 break;
3375 }
3376
3377 case CONTROL_SUPPRESS_LOCAL_FIXUPS:
3378 f.suppress_local_fixups = TRUE;
3379 break;
3380
3381 case CONTROL_CUTTHROUGH_DELIVERY:
3382 {
3383 uschar * ignored = NULL;
3384 #ifndef DISABLE_PRDR
3385 if (prdr_requested)
3386 #else
3387 if (0)
3388 #endif
3389 /* Too hard to think about for now. We might in future cutthrough
3390 the case where both sides handle prdr and this-node prdr acl
3391 is "accept" */
3392 ignored = US"PRDR active";
3393 else if (f.deliver_freeze)
3394 ignored = US"frozen";
3395 else if (f.queue_only_policy)
3396 ignored = US"queue-only";
3397 else if (fake_response == FAIL)
3398 ignored = US"fakereject";
3399 else if (rcpt_count != 1)
3400 ignored = US"nonfirst rcpt";
3401 else if (cutthrough.delivery)
3402 ignored = US"repeated";
3403 else if (cutthrough.callout_hold_only)
3404 {
3405 DEBUG(D_acl)
3406 debug_printf_indent(" cutthrough request upgrades callout hold\n");
3407 cutthrough.callout_hold_only = FALSE;
3408 cutthrough.delivery = TRUE; /* control accepted */
3409 }
3410 else
3411 {
3412 cutthrough.delivery = TRUE; /* control accepted */
3413 while (*p == '/')
3414 {
3415 const uschar * pp = p+1;
3416 if (Ustrncmp(pp, "defer=", 6) == 0)
3417 {
3418 pp += 6;
3419 if (Ustrncmp(pp, "pass", 4) == 0) cutthrough.defer_pass = TRUE;
3420 /* else if (Ustrncmp(pp, "spool") == 0) ; default */
3421 }
3422 else
3423 while (*pp && *pp != '/') pp++;
3424 p = pp;
3425 }
3426 }
3427
3428 DEBUG(D_acl) if (ignored)
3429 debug_printf(" cutthrough request ignored on %s item\n", ignored);
3430 }
3431 break;
3432
3433 #ifdef SUPPORT_I18N
3434 case CONTROL_UTF8_DOWNCONVERT:
3435 if (*p == '/')
3436 {
3437 if (p[1] == '1')
3438 {
3439 message_utf8_downconvert = 1;
3440 addr->prop.utf8_downcvt = TRUE;
3441 addr->prop.utf8_downcvt_maybe = FALSE;
3442 p += 2;
3443 break;
3444 }
3445 if (p[1] == '0')
3446 {
3447 message_utf8_downconvert = 0;
3448 addr->prop.utf8_downcvt = FALSE;
3449 addr->prop.utf8_downcvt_maybe = FALSE;
3450 p += 2;
3451 break;
3452 }
3453 if (p[1] == '-' && p[2] == '1')
3454 {
3455 message_utf8_downconvert = -1;
3456 addr->prop.utf8_downcvt = FALSE;
3457 addr->prop.utf8_downcvt_maybe = TRUE;
3458 p += 3;
3459 break;
3460 }
3461 *log_msgptr = US"bad option value for control=utf8_downconvert";
3462 }
3463 else
3464 {
3465 message_utf8_downconvert = 1;
3466 addr->prop.utf8_downcvt = TRUE;
3467 addr->prop.utf8_downcvt_maybe = FALSE;
3468 break;
3469 }
3470 return ERROR;
3471 #endif
3472
3473 }
3474 break;
3475 }
3476
3477 #ifdef EXPERIMENTAL_DCC
3478 case ACLC_DCC:
3479 {
3480 /* Separate the regular expression and any optional parameters. */
3481 const uschar * list = arg;
3482 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3483 /* Run the dcc backend. */
3484 rc = dcc_process(&ss);
3485 /* Modify return code based upon the existence of options. */
3486 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3487 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3488 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3489 }
3490 break;
3491 #endif
3492
3493 #ifdef WITH_CONTENT_SCAN
3494 case ACLC_DECODE:
3495 rc = mime_decode(&arg);
3496 break;
3497 #endif
3498
3499 case ACLC_DELAY:
3500 {
3501 int delay = readconf_readtime(arg, 0, FALSE);
3502 if (delay < 0)
3503 {
3504 *log_msgptr = string_sprintf("syntax error in argument for \"delay\" "
3505 "modifier: \"%s\" is not a time value", arg);
3506 return ERROR;
3507 }
3508 else
3509 {
3510 HDEBUG(D_acl) debug_printf_indent("delay modifier requests %d-second delay\n",
3511 delay);
3512 if (host_checking)
3513 {
3514 HDEBUG(D_acl)
3515 debug_printf_indent("delay skipped in -bh checking mode\n");
3516 }
3517
3518 /* NOTE 1: Remember that we may be
3519 dealing with stdin/stdout here, in addition to TCP/IP connections.
3520 Also, delays may be specified for non-SMTP input, where smtp_out and
3521 smtp_in will be NULL. Whatever is done must work in all cases.
3522
3523 NOTE 2: The added feature of flushing the output before a delay must
3524 apply only to SMTP input. Hence the test for smtp_out being non-NULL.
3525 */
3526
3527 else
3528 {
3529 if (smtp_out && !f.disable_delay_flush)
3530 mac_smtp_fflush();
3531
3532 #if !defined(NO_POLL_H) && defined (POLLRDHUP)
3533 {
3534 struct pollfd p;
3535 nfds_t n = 0;
3536 if (smtp_out)
3537 {
3538 p.fd = fileno(smtp_out);
3539 p.events = POLLRDHUP;
3540 n = 1;
3541 }
3542 if (poll(&p, n, delay*1000) > 0)
3543 HDEBUG(D_acl) debug_printf_indent("delay cancelled by peer close\n");
3544 }
3545 #else
3546 /* Lacking POLLRDHUP it appears to be impossible to detect that a
3547 TCP/IP connection has gone away without reading from it. This means
3548 that we cannot shorten the delay below if the client goes away,
3549 because we cannot discover that the client has closed its end of the
3550 connection. (The connection is actually in a half-closed state,
3551 waiting for the server to close its end.) It would be nice to be able
3552 to detect this state, so that the Exim process is not held up
3553 unnecessarily. However, it seems that we can't. The poll() function
3554 does not do the right thing, and in any case it is not always
3555 available. */
3556
3557 while (delay > 0) delay = sleep(delay);
3558 #endif
3559 }
3560 }
3561 }
3562 break;
3563
3564 #ifndef DISABLE_DKIM
3565 case ACLC_DKIM_SIGNER:
3566 if (dkim_cur_signer)
3567 rc = match_isinlist(dkim_cur_signer,
3568 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3569 else
3570 rc = FAIL;
3571 break;
3572
3573 case ACLC_DKIM_STATUS:
3574 rc = match_isinlist(dkim_verify_status,
3575 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3576 break;
3577 #endif
3578
3579 #ifdef SUPPORT_DMARC
3580 case ACLC_DMARC_STATUS:
3581 if (!f.dmarc_has_been_checked)
3582 dmarc_process();
3583 f.dmarc_has_been_checked = TRUE;
3584 /* used long way of dmarc_exim_expand_query() in case we need more
3585 * view into the process in the future. */
3586 rc = match_isinlist(dmarc_exim_expand_query(DMARC_VERIFY_STATUS),
3587 &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3588 break;
3589 #endif
3590
3591 case ACLC_DNSLISTS:
3592 rc = verify_check_dnsbl(where, &arg, log_msgptr);
3593 break;
3594
3595 case ACLC_DOMAINS:
3596 rc = match_isinlist(addr->domain, &arg, 0, &domainlist_anchor,
3597 addr->domain_cache, MCL_DOMAIN, TRUE, CUSS &deliver_domain_data);
3598 break;
3599
3600 /* The value in tls_cipher is the full cipher name, for example,
3601 TLSv1:DES-CBC3-SHA:168, whereas the values to test for are just the
3602 cipher names such as DES-CBC3-SHA. But program defensively. We don't know
3603 what may in practice come out of the SSL library - which at the time of
3604 writing is poorly documented. */
3605
3606 case ACLC_ENCRYPTED:
3607 if (tls_in.cipher == NULL) rc = FAIL; else
3608 {
3609 uschar *endcipher = NULL;
3610 uschar *cipher = Ustrchr(tls_in.cipher, ':');
3611 if (!cipher) cipher = tls_in.cipher; else
3612 {
3613 endcipher = Ustrchr(++cipher, ':');
3614 if (endcipher) *endcipher = 0;
3615 }
3616 rc = match_isinlist(cipher, &arg, 0, NULL, NULL, MCL_STRING, TRUE, NULL);
3617 if (endcipher) *endcipher = ':';
3618 }
3619 break;
3620
3621 /* Use verify_check_this_host() instead of verify_check_host() so that
3622 we can pass over &host_data to catch any looked up data. Once it has been
3623 set, it retains its value so that it's still there if another ACL verb
3624 comes through here and uses the cache. However, we must put it into
3625 permanent store in case it is also expected to be used in a subsequent
3626 message in the same SMTP connection. */
3627
3628 case ACLC_HOSTS:
3629 rc = verify_check_this_host(&arg, sender_host_cache, NULL,
3630 sender_host_address ? sender_host_address : US"", CUSS &host_data);
3631 if (rc == DEFER) *log_msgptr = search_error_message;
3632 if (host_data) host_data = string_copy_perm(host_data, TRUE);
3633 break;
3634
3635 case ACLC_LOCAL_PARTS:
3636 rc = match_isinlist(addr->cc_local_part, &arg, 0,
3637 &localpartlist_anchor, addr->localpart_cache, MCL_LOCALPART, TRUE,
3638 CUSS &deliver_localpart_data);
3639 break;
3640
3641 case ACLC_LOG_REJECT_TARGET:
3642 {
3643 int logbits = 0;
3644 int sep = 0;
3645 const uschar *s = arg;
3646 uschar * ss;
3647 while ((ss = string_nextinlist(&s, &sep, NULL, 0)))
3648 {
3649 if (Ustrcmp(ss, "main") == 0) logbits |= LOG_MAIN;
3650 else if (Ustrcmp(ss, "panic") == 0) logbits |= LOG_PANIC;
3651 else if (Ustrcmp(ss, "reject") == 0) logbits |= LOG_REJECT;
3652 else
3653 {
3654 logbits |= LOG_MAIN|LOG_REJECT;
3655 log_write(0, LOG_MAIN|LOG_PANIC, "unknown log name \"%s\" in "
3656 "\"log_reject_target\" in %s ACL", ss, acl_wherenames[where]);
3657 }
3658 }
3659 log_reject_target = logbits;
3660 }
3661 break;
3662
3663 case ACLC_LOGWRITE:
3664 {
3665 int logbits = 0;
3666 const uschar *s = arg;
3667 if (*s == ':')
3668 {
3669 s++;
3670 while (*s != ':')
3671 {
3672 if (Ustrncmp(s, "main", 4) == 0)
3673 { logbits |= LOG_MAIN; s += 4; }
3674 else if (Ustrncmp(s, "panic", 5) == 0)
3675 { logbits |= LOG_PANIC; s += 5; }
3676 else if (Ustrncmp(s, "reject", 6) == 0)
3677 { logbits |= LOG_REJECT; s += 6; }
3678 else
3679 {
3680 logbits = LOG_MAIN|LOG_PANIC;
3681 s = string_sprintf(":unknown log name in \"%s\" in "
3682 "\"logwrite\" in %s ACL", arg, acl_wherenames[where]);
3683 }
3684 if (*s == ',') s++;
3685 }
3686 s++;
3687 }
3688 while (isspace(*s)) s++;
3689
3690 if (logbits == 0) logbits = LOG_MAIN;
3691 log_write(0, logbits, "%s", string_printing(s));
3692 }
3693 break;
3694
3695 #ifdef WITH_CONTENT_SCAN
3696 case ACLC_MALWARE: /* Run the malware backend. */
3697 {
3698 /* Separate the regular expression and any optional parameters. */
3699 const uschar * list = arg;
3700 uschar * ss = string_nextinlist(&list, &sep, NULL, 0);
3701 uschar * opt;
3702 BOOL defer_ok = FALSE;
3703 int timeout = 0;
3704
3705 while ((opt = string_nextinlist(&list, &sep, NULL, 0)))
3706 if (strcmpic(opt, US"defer_ok") == 0)
3707 defer_ok = TRUE;
3708 else if ( strncmpic(opt, US"tmo=", 4) == 0
3709 && (timeout = readconf_readtime(opt+4, '\0', FALSE)) < 0
3710 )
3711 {
3712 *log_msgptr = string_sprintf("bad timeout value in '%s'", opt);
3713 return ERROR;
3714 }
3715
3716 rc = malware(ss, timeout);
3717 if (rc == DEFER && defer_ok)
3718 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3719 }
3720 break;
3721
3722 case ACLC_MIME_REGEX:
3723 rc = mime_regex(&arg);
3724 break;
3725 #endif
3726
3727 case ACLC_QUEUE:
3728 {
3729 uschar *m;
3730 if ((m = is_tainted2(arg, 0, "Tainted name '%s' for queue not permitted", arg)))
3731 {
3732 *log_msgptr = m;
3733 return ERROR;
3734 }
3735 if (Ustrchr(arg, '/'))
3736 {
3737 *log_msgptr = string_sprintf(
3738 "Directory separator not permitted in queue name: '%s'", arg);
3739 return ERROR;
3740 }
3741 queue_name = string_copy_perm(arg, FALSE);
3742 break;
3743 }
3744
3745 case ACLC_RATELIMIT:
3746 rc = acl_ratelimit(arg, where, log_msgptr);
3747 break;
3748
3749 case ACLC_RECIPIENTS:
3750 rc = match_address_list(CUS addr->address, TRUE, TRUE, &arg, NULL, -1, 0,
3751 CUSS &recipient_data);
3752 break;
3753
3754 #ifdef WITH_CONTENT_SCAN
3755 case ACLC_REGEX:
3756 rc = regex(&arg);
3757 break;
3758 #endif
3759
3760 case ACLC_REMOVE_HEADER:
3761 setup_remove_header(arg);
3762 break;
3763
3764 case ACLC_SENDER_DOMAINS:
3765 {
3766 uschar *sdomain;
3767 sdomain = Ustrrchr(sender_address, '@');
3768 sdomain = sdomain ? sdomain + 1 : US"";
3769 rc = match_isinlist(sdomain, &arg, 0, &domainlist_anchor,
3770 sender_domain_cache, MCL_DOMAIN, TRUE, NULL);
3771 }
3772 break;
3773
3774 case ACLC_SENDERS:
3775 rc = match_address_list(CUS sender_address, TRUE, TRUE, &arg,
3776 sender_address_cache, -1, 0, CUSS &sender_data);
3777 break;
3778
3779 /* Connection variables must persist forever; message variables not */
3780
3781 case ACLC_SET:
3782 {
3783 int old_pool = store_pool;
3784 if ( cb->u.varname[0] != 'm'
3785 #ifndef DISABLE_EVENT
3786 || event_name /* An event is being delivered */
3787 #endif
3788 )
3789 store_pool = POOL_PERM;
3790 #ifndef DISABLE_DKIM /* Overwriteable dkim result variables */
3791 if (Ustrcmp(cb->u.varname, "dkim_verify_status") == 0)
3792 dkim_verify_status = string_copy(arg);
3793 else if (Ustrcmp(cb->u.varname, "dkim_verify_reason") == 0)
3794 dkim_verify_reason = string_copy(arg);
3795 else
3796 #endif
3797 acl_var_create(cb->u.varname)->data.ptr = string_copy(arg);
3798 store_pool = old_pool;
3799 }
3800 break;
3801
3802 #ifdef WITH_CONTENT_SCAN
3803 case ACLC_SPAM:
3804 {
3805 /* Separate the regular expression and any optional parameters. */
3806 const uschar * list = arg;
3807 uschar *ss = string_nextinlist(&list, &sep, NULL, 0);
3808
3809 rc = spam(CUSS &ss);
3810 /* Modify return code based upon the existence of options. */
3811 while ((ss = string_nextinlist(&list, &sep, NULL, 0)))
3812 if (strcmpic(ss, US"defer_ok") == 0 && rc == DEFER)
3813 rc = FAIL; /* FAIL so that the message is passed to the next ACL */
3814 }
3815 break;
3816 #endif
3817
3818 #ifdef SUPPORT_SPF
3819 case ACLC_SPF:
3820 rc = spf_process(&arg, sender_address, SPF_PROCESS_NORMAL);
3821 break;
3822 case ACLC_SPF_GUESS:
3823 rc = spf_process(&arg, sender_address, SPF_PROCESS_GUESS);
3824 break;
3825 #endif
3826
3827 case ACLC_UDPSEND:
3828 rc = acl_udpsend(arg, log_msgptr);
3829 break;
3830
3831 /* If the verb is WARN, discard any user message from verification, because
3832 such messages are SMTP responses, not header additions. The latter come
3833 only from explicit "message" modifiers. However, put the user message into
3834 $acl_verify_message so it can be used in subsequent conditions or modifiers
3835 (until something changes it). */
3836
3837 case ACLC_VERIFY:
3838 rc = acl_verify(where, addr, arg, user_msgptr, log_msgptr, basic_errno);
3839 if (*user_msgptr)
3840 acl_verify_message = *user_msgptr;
3841 if (verb == ACL_WARN) *user_msgptr = NULL;
3842 break;
3843
3844 default:
3845 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown "
3846 "condition %d", cb->type);
3847 break;
3848 }
3849
3850 /* If a condition was negated, invert OK/FAIL. */
3851
3852 if (!conditions[cb->type].is_modifier && cb->u.negated)
3853 if (rc == OK) rc = FAIL;
3854 else if (rc == FAIL || rc == FAIL_DROP) rc = OK;
3855
3856 if (rc != OK) break; /* Conditions loop */
3857 }
3858
3859
3860 /* If the result is the one for which "message" and/or "log_message" are used,
3861 handle the values of these modifiers. If there isn't a log message set, we make
3862 it the same as the user message.
3863
3864 "message" is a user message that will be included in an SMTP response. Unless
3865 it is empty, it overrides any previously set user message.
3866
3867 "log_message" is a non-user message, and it adds to any existing non-user
3868 message that is already set.
3869
3870 Most verbs have but a single return for which the messages are relevant, but
3871 for "discard", it's useful to have the log message both when it succeeds and
3872 when it fails. For "accept", the message is used in the OK case if there is no
3873 "endpass", but (for backwards compatibility) in the FAIL case if "endpass" is
3874 present. */
3875
3876 if (*epp && rc == OK) user_message = NULL;
3877
3878 if ((BIT(rc) & msgcond[verb]) != 0)
3879 {
3880 uschar *expmessage;
3881 uschar *old_user_msgptr = *user_msgptr;
3882 uschar *old_log_msgptr = (*log_msgptr != NULL)? *log_msgptr : old_user_msgptr;
3883
3884 /* If the verb is "warn", messages generated by conditions (verification or
3885 nested ACLs) are always discarded. This also happens for acceptance verbs
3886 when they actually do accept. Only messages specified at this level are used.
3887 However, the value of an existing message is available in $acl_verify_message
3888 during expansions. */
3889
3890 if (verb == ACL_WARN ||
3891 (rc == OK && (verb == ACL_ACCEPT || verb == ACL_DISCARD)))
3892 *log_msgptr = *user_msgptr = NULL;
3893
3894 if (user_message)
3895 {
3896 acl_verify_message = old_user_msgptr;
3897 expmessage = expand_string(user_message);
3898 if (!expmessage)
3899 {
3900 if (!f.expand_string_forcedfail)
3901 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3902 user_message, expand_string_message);
3903 }
3904 else if (expmessage[0] != 0) *user_msgptr = expmessage;
3905 }
3906
3907 if (log_message)
3908 {
3909 acl_verify_message = old_log_msgptr;
3910 expmessage = expand_string(log_message);
3911 if (!expmessage)
3912 {
3913 if (!f.expand_string_forcedfail)
3914 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand ACL message \"%s\": %s",
3915 log_message, expand_string_message);
3916 }
3917 else if (expmessage[0] != 0)
3918 {
3919 *log_msgptr = (*log_msgptr == NULL)? expmessage :
3920 string_sprintf("%s: %s", expmessage, *log_msgptr);
3921 }
3922 }
3923
3924 /* If no log message, default it to the user message */
3925
3926 if (!*log_msgptr) *log_msgptr = *user_msgptr;
3927 }
3928
3929 acl_verify_message = NULL;
3930 return rc;
3931 }
3932
3933
3934
3935
3936
3937 /*************************************************
3938 * Get line from a literal ACL *
3939 *************************************************/
3940
3941 /* This function is passed to acl_read() in order to extract individual lines
3942 of a literal ACL, which we access via static pointers. We can destroy the
3943 contents because this is called only once (the compiled ACL is remembered).
3944
3945 This code is intended to treat the data in the same way as lines in the main
3946 Exim configuration file. That is:
3947
3948 . Leading spaces are ignored.
3949
3950 . A \ at the end of a line is a continuation - trailing spaces after the \
3951 are permitted (this is because I don't believe in making invisible things
3952 significant). Leading spaces on the continued part of a line are ignored.
3953
3954 . Physical lines starting (significantly) with # are totally ignored, and
3955 may appear within a sequence of backslash-continued lines.
3956
3957 . Blank lines are ignored, but will end a sequence of continuations.
3958
3959 Arguments: none
3960 Returns: a pointer to the next line
3961 */
3962
3963
3964 static uschar *acl_text; /* Current pointer in the text */
3965 static uschar *acl_text_end; /* Points one past the terminating '0' */
3966
3967
3968 static uschar *
acl_getline(void)3969 acl_getline(void)
3970 {
3971 uschar *yield;
3972
3973 /* This loop handles leading blank lines and comments. */
3974
3975 for(;;)
3976 {
3977 Uskip_whitespace(&acl_text); /* Leading spaces/empty lines */
3978 if (!*acl_text) return NULL; /* No more data */
3979 yield = acl_text; /* Potential data line */
3980
3981 while (*acl_text && *acl_text != '\n') acl_text++;
3982
3983 /* If we hit the end before a newline, we have the whole logical line. If
3984 it's a comment, there's no more data to be given. Otherwise, yield it. */
3985
3986 if (!*acl_text) return *yield == '#' ? NULL : yield;
3987
3988 /* After reaching a newline, end this loop if the physical line does not
3989 start with '#'. If it does, it's a comment, and the loop continues. */
3990
3991 if (*yield != '#') break;
3992 }
3993
3994 /* This loop handles continuations. We know we have some real data, ending in
3995 newline. See if there is a continuation marker at the end (ignoring trailing
3996 white space). We know that *yield is not white space, so no need to test for
3997 cont > yield in the backwards scanning loop. */
3998
3999 for(;;)
4000 {
4001 uschar *cont;
4002 for (cont = acl_text - 1; isspace(*cont); cont--);
4003
4004 /* If no continuation follows, we are done. Mark the end of the line and
4005 return it. */
4006
4007 if (*cont != '\\')
4008 {
4009 *acl_text++ = 0;
4010 return yield;
4011 }
4012
4013 /* We have encountered a continuation. Skip over whitespace at the start of
4014 the next line, and indeed the whole of the next line or lines if they are
4015 comment lines. */
4016
4017 for (;;)
4018 {
4019 while (*(++acl_text) == ' ' || *acl_text == '\t');
4020 if (*acl_text != '#') break;
4021 while (*(++acl_text) != 0 && *acl_text != '\n');
4022 }
4023
4024 /* We have the start of a continuation line. Move all the rest of the data
4025 to join onto the previous line, and then find its end. If the end is not a
4026 newline, we are done. Otherwise loop to look for another continuation. */
4027
4028 memmove(cont, acl_text, acl_text_end - acl_text);
4029 acl_text_end -= acl_text - cont;
4030 acl_text = cont;
4031 while (*acl_text != 0 && *acl_text != '\n') acl_text++;
4032 if (*acl_text == 0) return yield;
4033 }
4034
4035 /* Control does not reach here */
4036 }
4037
4038
4039
4040
4041
4042 /*************************************************
4043 * Check access using an ACL *
4044 *************************************************/
4045
4046 /* This function is called from address_check. It may recurse via
4047 acl_check_condition() - hence the use of a level to stop looping. The ACL is
4048 passed as a string which is expanded. A forced failure implies no access check
4049 is required. If the result is a single word, it is taken as the name of an ACL
4050 which is sought in the global ACL tree. Otherwise, it is taken as literal ACL
4051 text, complete with newlines, and parsed as such. In both cases, the ACL check
4052 is then run. This function uses an auxiliary function for acl_read() to call
4053 for reading individual lines of a literal ACL. This is acl_getline(), which
4054 appears immediately above.
4055
4056 Arguments:
4057 where where called from
4058 addr address item when called from RCPT; otherwise NULL
4059 s the input string; NULL is the same as an empty ACL => DENY
4060 user_msgptr where to put a user error (for SMTP response)
4061 log_msgptr where to put a logging message (not for SMTP response)
4062
4063 Returns: OK access is granted
4064 DISCARD access is apparently granted...
4065 FAIL access is denied
4066 FAIL_DROP access is denied; drop the connection
4067 DEFER can't tell at the moment
4068 ERROR disaster
4069 */
4070
4071 static int
acl_check_internal(int where,address_item * addr,uschar * s,uschar ** user_msgptr,uschar ** log_msgptr)4072 acl_check_internal(int where, address_item *addr, uschar *s,
4073 uschar **user_msgptr, uschar **log_msgptr)
4074 {
4075 int fd = -1;
4076 acl_block *acl = NULL;
4077 uschar *acl_name = US"inline ACL";
4078 uschar *ss;
4079
4080 /* Catch configuration loops */
4081
4082 if (acl_level > 20)
4083 {
4084 *log_msgptr = US"ACL nested too deep: possible loop";
4085 return ERROR;
4086 }
4087
4088 if (!s)
4089 {
4090 HDEBUG(D_acl) debug_printf_indent("ACL is NULL: implicit DENY\n");
4091 return FAIL;
4092 }
4093
4094 /* At top level, we expand the incoming string. At lower levels, it has already
4095 been expanded as part of condition processing. */
4096
4097 if (acl_level == 0)
4098 {
4099 if (!(ss = expand_string(s)))
4100 {
4101 if (f.expand_string_forcedfail) return OK;
4102 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s", s,
4103 expand_string_message);
4104 return ERROR;
4105 }
4106 }
4107 else ss = s;
4108
4109 while (isspace(*ss)) ss++;
4110
4111 /* If we can't find a named ACL, the default is to parse it as an inline one.
4112 (Unless it begins with a slash; non-existent files give rise to an error.) */
4113
4114 acl_text = ss;
4115
4116 if ( !f.running_in_test_harness
4117 && is_tainted2(acl_text, LOG_MAIN|LOG_PANIC,
4118 "Tainted ACL text \"%s\"", acl_text))
4119 {
4120 /* Avoid leaking info to an attacker */
4121 *log_msgptr = US"internal configuration error";
4122 return ERROR;
4123 }
4124
4125 /* Handle the case of a string that does not contain any spaces. Look for a
4126 named ACL among those read from the configuration, or a previously read file.
4127 It is possible that the pointer to the ACL is NULL if the configuration
4128 contains a name with no data. If not found, and the text begins with '/',
4129 read an ACL from a file, and save it so it can be re-used. */
4130
4131 if (Ustrchr(ss, ' ') == NULL)
4132 {
4133 tree_node * t = tree_search(acl_anchor, ss);
4134 if (t)
4135 {
4136 if (!(acl = (acl_block *)(t->data.ptr)))
4137 {
4138 HDEBUG(D_acl) debug_printf_indent("ACL \"%s\" is empty: implicit DENY\n", ss);
4139 return FAIL;
4140 }
4141 acl_name = string_sprintf("ACL \"%s\"", ss);
4142 HDEBUG(D_acl) debug_printf_indent("using ACL \"%s\"\n", ss);
4143 }
4144
4145 else if (*ss == '/')
4146 {
4147 struct stat statbuf;
4148 if (is_tainted2(ss, LOG_MAIN|LOG_PANIC, "Tainted ACL file name '%s'", ss))
4149 {
4150 /* Avoid leaking info to an attacker */
4151 *log_msgptr = US"internal configuration error";
4152 return ERROR;
4153 }
4154 if ((fd = Uopen(ss, O_RDONLY, 0)) < 0)
4155 {
4156 *log_msgptr = string_sprintf("failed to open ACL file \"%s\": %s", ss,
4157 strerror(errno));
4158 return ERROR;
4159 }
4160 if (fstat(fd, &statbuf) != 0)
4161 {
4162 *log_msgptr = string_sprintf("failed to fstat ACL file \"%s\": %s", ss,
4163 strerror(errno));
4164 return ERROR;
4165 }
4166
4167 /* If the string being used as a filename is tainted, so is the file content */
4168 acl_text = store_get(statbuf.st_size + 1, is_tainted(ss));
4169 acl_text_end = acl_text + statbuf.st_size + 1;
4170
4171 if (read(fd, acl_text, statbuf.st_size) != statbuf.st_size)
4172 {
4173 *log_msgptr = string_sprintf("failed to read ACL file \"%s\": %s",
4174 ss, strerror(errno));
4175 return ERROR;
4176 }
4177 acl_text[statbuf.st_size] = 0;
4178 (void)close(fd);
4179
4180 acl_name = string_sprintf("ACL \"%s\"", ss);
4181 HDEBUG(D_acl) debug_printf_indent("read ACL from file %s\n", ss);
4182 }
4183 }
4184
4185 /* Parse an ACL that is still in text form. If it came from a file, remember it
4186 in the ACL tree, having read it into the POOL_PERM store pool so that it
4187 persists between multiple messages. */
4188
4189 if (!acl)
4190 {
4191 int old_pool = store_pool;
4192 if (fd >= 0) store_pool = POOL_PERM;
4193 acl = acl_read(acl_getline, log_msgptr);
4194 store_pool = old_pool;
4195 if (!acl && *log_msgptr) return ERROR;
4196 if (fd >= 0)
4197 {
4198 tree_node *t = store_get_perm(sizeof(tree_node) + Ustrlen(ss), is_tainted(ss));
4199 Ustrcpy(t->name, ss);
4200 t->data.ptr = acl;
4201 (void)tree_insertnode(&acl_anchor, t);
4202 }
4203 }
4204
4205 /* Now we have an ACL to use. It's possible it may be NULL. */
4206
4207 while (acl)
4208 {
4209 int cond;
4210 int basic_errno = 0;
4211 BOOL endpass_seen = FALSE;
4212 BOOL acl_quit_check = acl_level == 0
4213 && (where == ACL_WHERE_QUIT || where == ACL_WHERE_NOTQUIT);
4214
4215 *log_msgptr = *user_msgptr = NULL;
4216 f.acl_temp_details = FALSE;
4217
4218 HDEBUG(D_acl) debug_printf_indent("processing \"%s\" (%s %d)\n",
4219 verbs[acl->verb], acl->srcfile, acl->srcline);
4220
4221 /* Clear out any search error message from a previous check before testing
4222 this condition. */
4223
4224 search_error_message = NULL;
4225 cond = acl_check_condition(acl->verb, acl->condition, where, addr, acl_level,
4226 &endpass_seen, user_msgptr, log_msgptr, &basic_errno);
4227
4228 /* Handle special returns: DEFER causes a return except on a WARN verb;
4229 ERROR always causes a return. */
4230
4231 switch (cond)
4232 {
4233 case DEFER:
4234 HDEBUG(D_acl) debug_printf_indent("%s: condition test deferred in %s\n",
4235 verbs[acl->verb], acl_name);
4236 if (basic_errno != ERRNO_CALLOUTDEFER)
4237 {
4238 if (search_error_message != NULL && *search_error_message != 0)
4239 *log_msgptr = search_error_message;
4240 if (smtp_return_error_details) f.acl_temp_details = TRUE;
4241 }
4242 else
4243 f.acl_temp_details = TRUE;
4244 if (acl->verb != ACL_WARN) return DEFER;
4245 break;
4246
4247 default: /* Paranoia */
4248 case ERROR:
4249 HDEBUG(D_acl) debug_printf_indent("%s: condition test error in %s\n",
4250 verbs[acl->verb], acl_name);
4251 return ERROR;
4252
4253 case OK:
4254 HDEBUG(D_acl) debug_printf_indent("%s: condition test succeeded in %s\n",
4255 verbs[acl->verb], acl_name);
4256 break;
4257
4258 case FAIL:
4259 HDEBUG(D_acl) debug_printf_indent("%s: condition test failed in %s\n",
4260 verbs[acl->verb], acl_name);
4261 break;
4262
4263 /* DISCARD and DROP can happen only from a nested ACL condition, and
4264 DISCARD can happen only for an "accept" or "discard" verb. */
4265
4266 case DISCARD:
4267 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"discard\" in %s\n",
4268 verbs[acl->verb], acl_name);
4269 break;
4270
4271 case FAIL_DROP:
4272 HDEBUG(D_acl) debug_printf_indent("%s: condition test yielded \"drop\" in %s\n",
4273 verbs[acl->verb], acl_name);
4274 break;
4275 }
4276
4277 /* At this point, cond for most verbs is either OK or FAIL or (as a result of
4278 a nested ACL condition) FAIL_DROP. However, for WARN, cond may be DEFER, and
4279 for ACCEPT and DISCARD, it may be DISCARD after a nested ACL call. */
4280
4281 switch(acl->verb)
4282 {
4283 case ACL_ACCEPT:
4284 if (cond == OK || cond == DISCARD)
4285 {
4286 HDEBUG(D_acl) debug_printf_indent("end of %s: ACCEPT\n", acl_name);
4287 return cond;
4288 }
4289 if (endpass_seen)
4290 {
4291 HDEBUG(D_acl) debug_printf_indent("accept: endpass encountered - denying access\n");
4292 return cond;
4293 }
4294 break;
4295
4296 case ACL_DEFER:
4297 if (cond == OK)
4298 {
4299 HDEBUG(D_acl) debug_printf_indent("end of %s: DEFER\n", acl_name);
4300 if (acl_quit_check) goto badquit;
4301 f.acl_temp_details = TRUE;
4302 return DEFER;
4303 }
4304 break;
4305
4306 case ACL_DENY:
4307 if (cond == OK)
4308 {
4309 HDEBUG(D_acl) debug_printf_indent("end of %s: DENY\n", acl_name);
4310 if (acl_quit_check) goto badquit;
4311 return FAIL;
4312 }
4313 break;
4314
4315 case ACL_DISCARD:
4316 if (cond == OK || cond == DISCARD)
4317 {
4318 HDEBUG(D_acl) debug_printf_indent("end of %s: DISCARD\n", acl_name);
4319 if (acl_quit_check) goto badquit;
4320 return DISCARD;
4321 }
4322 if (endpass_seen)
4323 {
4324 HDEBUG(D_acl)
4325 debug_printf_indent("discard: endpass encountered - denying access\n");
4326 return cond;
4327 }
4328 break;
4329
4330 case ACL_DROP:
4331 if (cond == OK)
4332 {
4333 HDEBUG(D_acl) debug_printf_indent("end of %s: DROP\n", acl_name);
4334 if (acl_quit_check) goto badquit;
4335 return FAIL_DROP;
4336 }
4337 break;
4338
4339 case ACL_REQUIRE:
4340 if (cond != OK)
4341 {
4342 HDEBUG(D_acl) debug_printf_indent("end of %s: not OK\n", acl_name);
4343 if (acl_quit_check) goto badquit;
4344 return cond;
4345 }
4346 break;
4347
4348 case ACL_WARN:
4349 if (cond == OK)
4350 acl_warn(where, *user_msgptr, *log_msgptr);
4351 else if (cond == DEFER && LOGGING(acl_warn_skipped))
4352 log_write(0, LOG_MAIN, "%s Warning: ACL \"warn\" statement skipped: "
4353 "condition test deferred%s%s", host_and_ident(TRUE),
4354 (*log_msgptr == NULL)? US"" : US": ",
4355 (*log_msgptr == NULL)? US"" : *log_msgptr);
4356 *log_msgptr = *user_msgptr = NULL; /* In case implicit DENY follows */
4357 break;
4358
4359 default:
4360 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "internal ACL error: unknown verb %d",
4361 acl->verb);
4362 break;
4363 }
4364
4365 /* Pass to the next ACL item */
4366
4367 acl = acl->next;
4368 }
4369
4370 /* We have reached the end of the ACL. This is an implicit DENY. */
4371
4372 HDEBUG(D_acl) debug_printf_indent("end of %s: implicit DENY\n", acl_name);
4373 return FAIL;
4374
4375 badquit:
4376 *log_msgptr = string_sprintf("QUIT or not-QUIT toplevel ACL may not fail "
4377 "('%s' verb used incorrectly)", verbs[acl->verb]);
4378 return ERROR;
4379 }
4380
4381
4382
4383
4384 /* Same args as acl_check_internal() above, but the string s is
4385 the name of an ACL followed optionally by up to 9 space-separated arguments.
4386 The name and args are separately expanded. Args go into $acl_arg globals. */
4387 static int
acl_check_wargs(int where,address_item * addr,const uschar * s,uschar ** user_msgptr,uschar ** log_msgptr)4388 acl_check_wargs(int where, address_item *addr, const uschar *s,
4389 uschar **user_msgptr, uschar **log_msgptr)
4390 {
4391 uschar * tmp;
4392 uschar * tmp_arg[9]; /* must match acl_arg[] */
4393 uschar * sav_arg[9]; /* must match acl_arg[] */
4394 int sav_narg;
4395 uschar * name;
4396 int i;
4397 int ret;
4398
4399 if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
4400 goto bad;
4401
4402 for (i = 0; i < 9; i++)
4403 {
4404 while (*s && isspace(*s)) s++;
4405 if (!*s) break;
4406 if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
4407 {
4408 tmp = name;
4409 goto bad;
4410 }
4411 }
4412
4413 sav_narg = acl_narg;
4414 acl_narg = i;
4415 for (i = 0; i < acl_narg; i++)
4416 {
4417 sav_arg[i] = acl_arg[i];
4418 acl_arg[i] = tmp_arg[i];
4419 }
4420 while (i < 9)
4421 {
4422 sav_arg[i] = acl_arg[i];
4423 acl_arg[i++] = NULL;
4424 }
4425
4426 acl_level++;
4427 ret = acl_check_internal(where, addr, name, user_msgptr, log_msgptr);
4428 acl_level--;
4429
4430 acl_narg = sav_narg;
4431 for (i = 0; i < 9; i++) acl_arg[i] = sav_arg[i];
4432 return ret;
4433
4434 bad:
4435 if (f.expand_string_forcedfail) return ERROR;
4436 *log_msgptr = string_sprintf("failed to expand ACL string \"%s\": %s",
4437 tmp, expand_string_message);
4438 return f.search_find_defer ? DEFER : ERROR;
4439 }
4440
4441
4442
4443 /*************************************************
4444 * Check access using an ACL *
4445 *************************************************/
4446
4447 /* Alternate interface for ACL, used by expansions */
4448 int
acl_eval(int where,uschar * s,uschar ** user_msgptr,uschar ** log_msgptr)4449 acl_eval(int where, uschar *s, uschar **user_msgptr, uschar **log_msgptr)
4450 {
4451 address_item adb;
4452 address_item *addr = NULL;
4453 int rc;
4454
4455 *user_msgptr = *log_msgptr = NULL;
4456 sender_verified_failed = NULL;
4457 ratelimiters_cmd = NULL;
4458 log_reject_target = LOG_MAIN|LOG_REJECT;
4459
4460 if (where == ACL_WHERE_RCPT)
4461 {
4462 adb = address_defaults;
4463 addr = &adb;
4464 addr->address = expand_string(US"$local_part@$domain");
4465 addr->domain = deliver_domain;
4466 addr->local_part = deliver_localpart;
4467 addr->cc_local_part = deliver_localpart;
4468 addr->lc_local_part = deliver_localpart;
4469 }
4470
4471 acl_level++;
4472 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4473 acl_level--;
4474 return rc;
4475 }
4476
4477
4478
4479 /* This is the external interface for ACL checks. It sets up an address and the
4480 expansions for $domain and $local_part when called after RCPT, then calls
4481 acl_check_internal() to do the actual work.
4482
4483 Arguments:
4484 where ACL_WHERE_xxxx indicating where called from
4485 recipient RCPT address for RCPT check, else NULL
4486 s the input string; NULL is the same as an empty ACL => DENY
4487 user_msgptr where to put a user error (for SMTP response)
4488 log_msgptr where to put a logging message (not for SMTP response)
4489
4490 Returns: OK access is granted by an ACCEPT verb
4491 DISCARD access is granted by a DISCARD verb
4492 FAIL access is denied
4493 FAIL_DROP access is denied; drop the connection
4494 DEFER can't tell at the moment
4495 ERROR disaster
4496 */
4497 int acl_where = ACL_WHERE_UNKNOWN;
4498
4499 int
acl_check(int where,uschar * recipient,uschar * s,uschar ** user_msgptr,uschar ** log_msgptr)4500 acl_check(int where, uschar *recipient, uschar *s, uschar **user_msgptr,
4501 uschar **log_msgptr)
4502 {
4503 int rc;
4504 address_item adb;
4505 address_item *addr = NULL;
4506
4507 *user_msgptr = *log_msgptr = NULL;
4508 sender_verified_failed = NULL;
4509 ratelimiters_cmd = NULL;
4510 log_reject_target = LOG_MAIN|LOG_REJECT;
4511
4512 #ifndef DISABLE_PRDR
4513 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY || where==ACL_WHERE_PRDR)
4514 #else
4515 if (where==ACL_WHERE_RCPT || where==ACL_WHERE_VRFY)
4516 #endif
4517 {
4518 adb = address_defaults;
4519 addr = &adb;
4520 addr->address = recipient;
4521 if (deliver_split_address(addr) == DEFER)
4522 {
4523 *log_msgptr = US"defer in percent_hack_domains check";
4524 return DEFER;
4525 }
4526 #ifdef SUPPORT_I18N
4527 if ((addr->prop.utf8_msg = message_smtputf8))
4528 {
4529 addr->prop.utf8_downcvt = message_utf8_downconvert == 1;
4530 addr->prop.utf8_downcvt_maybe = message_utf8_downconvert == -1;
4531 }
4532 #endif
4533 deliver_domain = addr->domain;
4534 deliver_localpart = addr->local_part;
4535 }
4536
4537 acl_where = where;
4538 acl_level = 0;
4539 rc = acl_check_internal(where, addr, s, user_msgptr, log_msgptr);
4540 acl_level = 0;
4541 acl_where = ACL_WHERE_UNKNOWN;
4542
4543 /* Cutthrough - if requested,
4544 and WHERE_RCPT and not yet opened conn as result of recipient-verify,
4545 and rcpt acl returned accept,
4546 and first recipient (cancel on any subsequents)
4547 open one now and run it up to RCPT acceptance.
4548 A failed verify should cancel cutthrough request,
4549 and will pass the fail to the originator.
4550 Initial implementation: dual-write to spool.
4551 Assume the rxd datastream is now being copied byte-for-byte to an open cutthrough connection.
4552
4553 Cease cutthrough copy on rxd final dot; do not send one.
4554
4555 On a data acl, if not accept and a cutthrough conn is open, hard-close it (no SMTP niceness).
4556
4557 On data acl accept, terminate the dataphase on an open cutthrough conn. If accepted or
4558 perm-rejected, reflect that to the original sender - and dump the spooled copy.
4559 If temp-reject, close the conn (and keep the spooled copy).
4560 If conn-failure, no action (and keep the spooled copy).
4561 */
4562 switch (where)
4563 {
4564 case ACL_WHERE_RCPT:
4565 #ifndef DISABLE_PRDR
4566 case ACL_WHERE_PRDR:
4567 #endif
4568
4569 if (f.host_checking_callout) /* -bhc mode */
4570 cancel_cutthrough_connection(TRUE, US"host-checking mode");
4571
4572 else if ( rc == OK
4573 && cutthrough.delivery
4574 && rcpt_count > cutthrough.nrcpt
4575 )
4576 {
4577 if ((rc = open_cutthrough_connection(addr)) == DEFER)
4578 if (cutthrough.defer_pass)
4579 {
4580 uschar * s = addr->message;
4581 /* Horrid kludge to recover target's SMTP message */
4582 while (*s) s++;
4583 do --s; while (!isdigit(*s));
4584 if (*--s && isdigit(*s) && *--s && isdigit(*s)) *user_msgptr = s;
4585 f.acl_temp_details = TRUE;
4586 }
4587 else
4588 {
4589 HDEBUG(D_acl) debug_printf_indent("cutthrough defer; will spool\n");
4590 rc = OK;
4591 }
4592 }
4593 else HDEBUG(D_acl) if (cutthrough.delivery)
4594 if (rcpt_count <= cutthrough.nrcpt)
4595 debug_printf_indent("ignore cutthrough request; nonfirst message\n");
4596 else if (rc != OK)
4597 debug_printf_indent("ignore cutthrough request; ACL did not accept\n");
4598 break;
4599
4600 case ACL_WHERE_PREDATA:
4601 if (rc == OK)
4602 cutthrough_predata();
4603 else
4604 cancel_cutthrough_connection(TRUE, US"predata acl not ok");
4605 break;
4606
4607 case ACL_WHERE_QUIT:
4608 case ACL_WHERE_NOTQUIT:
4609 /* Drop cutthrough conns, and drop heldopen verify conns if
4610 the previous was not DATA */
4611 {
4612 uschar prev =
4613 smtp_connection_had[SMTP_HBUFF_PREV(SMTP_HBUFF_PREV(smtp_ch_index))];
4614 BOOL dropverify = !(prev == SCH_DATA || prev == SCH_BDAT);
4615
4616 cancel_cutthrough_connection(dropverify, US"quit or conndrop");
4617 break;
4618 }
4619
4620 default:
4621 break;
4622 }
4623
4624 deliver_domain = deliver_localpart = deliver_address_data =
4625 deliver_domain_data = sender_address_data = NULL;
4626
4627 /* A DISCARD response is permitted only for message ACLs, excluding the PREDATA
4628 ACL, which is really in the middle of an SMTP command. */
4629
4630 if (rc == DISCARD)
4631 {
4632 if (where > ACL_WHERE_NOTSMTP || where == ACL_WHERE_PREDATA)
4633 {
4634 log_write(0, LOG_MAIN|LOG_PANIC, "\"discard\" verb not allowed in %s "
4635 "ACL", acl_wherenames[where]);
4636 return ERROR;
4637 }
4638 return DISCARD;
4639 }
4640
4641 /* A DROP response is not permitted from MAILAUTH */
4642
4643 if (rc == FAIL_DROP && where == ACL_WHERE_MAILAUTH)
4644 {
4645 log_write(0, LOG_MAIN|LOG_PANIC, "\"drop\" verb not allowed in %s "
4646 "ACL", acl_wherenames[where]);
4647 return ERROR;
4648 }
4649
4650 /* Before giving a response, take a look at the length of any user message, and
4651 split it up into multiple lines if possible. */
4652
4653 *user_msgptr = string_split_message(*user_msgptr);
4654 if (fake_response != OK)
4655 fake_response_text = string_split_message(fake_response_text);
4656
4657 return rc;
4658 }
4659
4660
4661 /*************************************************
4662 * Create ACL variable *
4663 *************************************************/
4664
4665 /* Create an ACL variable or reuse an existing one. ACL variables are in a
4666 binary tree (see tree.c) with acl_var_c and acl_var_m as root nodes.
4667
4668 Argument:
4669 name pointer to the variable's name, starting with c or m
4670
4671 Returns the pointer to variable's tree node
4672 */
4673
4674 tree_node *
acl_var_create(uschar * name)4675 acl_var_create(uschar * name)
4676 {
4677 tree_node * node, ** root = name[0] == 'c' ? &acl_var_c : &acl_var_m;
4678 if (!(node = tree_search(*root, name)))
4679 {
4680 node = store_get(sizeof(tree_node) + Ustrlen(name), is_tainted(name));
4681 Ustrcpy(node->name, name);
4682 (void)tree_insertnode(root, node);
4683 }
4684 node->data.ptr = NULL;
4685 return node;
4686 }
4687
4688
4689
4690 /*************************************************
4691 * Write an ACL variable in spool format *
4692 *************************************************/
4693
4694 /* This function is used as a callback for tree_walk when writing variables to
4695 the spool file. To retain spool file compatibility, what is written is -aclc or
4696 -aclm followed by the rest of the name and the data length, space separated,
4697 then the value itself, starting on a new line, and terminated by an additional
4698 newline. When we had only numbered ACL variables, the first line might look
4699 like this: "-aclc 5 20". Now it might be "-aclc foo 20" for the variable called
4700 acl_cfoo.
4701
4702 Arguments:
4703 name of the variable
4704 value of the variable
4705 ctx FILE pointer (as a void pointer)
4706
4707 Returns: nothing
4708 */
4709
4710 void
acl_var_write(uschar * name,uschar * value,void * ctx)4711 acl_var_write(uschar *name, uschar *value, void *ctx)
4712 {
4713 FILE *f = (FILE *)ctx;
4714 if (is_tainted(value)) putc('-', f);
4715 fprintf(f, "-acl%c %s %d\n%s\n", name[0], name+1, Ustrlen(value), value);
4716 }
4717
4718 #endif /* !MACRO_PREDEF */
4719 /* vi: aw ai sw=2
4720 */
4721 /* End of acl.c */
4722