summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--doc/doc-docbook/spec.xfpt29
-rw-r--r--doc/doc-txt/ChangeLog4
-rw-r--r--doc/doc-txt/NewStuff13
-rw-r--r--src/src/acl.c11
-rw-r--r--src/src/expand.c15
-rw-r--r--test/confs/00027
-rw-r--r--test/scripts/0000-Basic/000210
-rw-r--r--test/stdout/000214
8 files changed, 81 insertions, 22 deletions
diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 29aacf61c..eb5bd4cba 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8764,14 +8764,15 @@ expansion item below.
.cindex "&%acl%&" "call from expansion"
The name and zero to nine argument strings are first expanded separately. The expanded
arguments are assigned to the variables &$acl_arg1$& to &$acl_arg9$& in order.
-Any used are made empty. The variable &$acl_narg$& is set to the number of
+Any unused are made empty. The variable &$acl_narg$& is set to the number of
arguments. The named ACL (see chapter &<<CHAPACL>>&) is called
and may use the variables; if another acl expansion is used the values
are overwritten. If the ACL sets
-a value using a "message =" modifier and returns accept, the value becomes
+a value using a "message =" modifier and returns accept or deny, the value becomes
the result of the expansion.
-If no message was set but the ACL returned accept, or if the ACL returned defer,
-the value is an empty string. Otherwise the expansion fails.
+If no message was set and the ACL returned accept or deny
+the value is an empty string.
+If the ACL returned defer the result is a forced-fail. Otherwise the expansion fails.
.vitem "&*${dlfunc{*&<&'file'&>&*}{*&<&'function'&>&*}{*&<&'arg'&>&*}&&&
@@ -10059,6 +10060,21 @@ In all cases, a relative comparator OP is testing if <&'string1'&> OP
10M, not if 10M is larger than &$message_size$&.
+.vitem &*acl&~{{*&<&'name'&>&*}{*&<&'arg1'&>&*}&&&
+ {*&<&'arg2'&>&*}...}*&
+.cindex "expansion" "calling an acl"
+.cindex "&%acl%&" "expansion condition"
+The name and zero to nine argument strings are first expanded separately. The expanded
+arguments are assigned to the variables &$acl_arg1$& to &$acl_arg9$& in order.
+Any unused are made empty. The variable &$acl_narg$& is set to the number of
+arguments. The named ACL (see chapter &<<CHAPACL>>&) is called
+and may use the variables; if another acl expansion is used the values
+are overwritten. If the ACL sets
+a value using a "message =" modifier the variable $value becomes
+the result of the expansion, otherwise it is empty.
+If the ACL returns accept the condition is true; if deny, false.
+If the ACL returns defer the result is a forced-fail.
+
.vitem &*bool&~{*&<&'string'&>&*}*&
.cindex "expansion" "boolean parsing"
.cindex "&%bool%& expansion condition"
@@ -27301,6 +27317,7 @@ The conditions are as follows:
.vitem &*acl&~=&~*&<&'name&~of&~acl&~or&~ACL&~string&~or&~file&~name&~'&>
.cindex "&ACL;" "nested"
.cindex "&ACL;" "indirect"
+.cindex "&ACL;" "arguments"
.cindex "&%acl%& ACL condition"
The possible values of the argument are the same as for the
&%acl_smtp_%&&'xxx'& options. The named or inline ACL is run. If it returns
@@ -27310,6 +27327,10 @@ condition is on a &%warn%& verb. In that case, a &"defer"& return makes the
condition false. This means that further processing of the &%warn%& verb
ceases, but processing of the ACL continues.
+If the argument is a named ACL, up to nine space-separated optional values
+can be appended; they appear in $acl_arg1 to $acl_arg9, and $acl_narg is set
+to the count of values. The name and values are expanded separately.
+
If the nested &%acl%& returns &"drop"& and the outer condition denies access,
the connection is dropped. If it returns &"discard"&, the verb must be
&%accept%& or &%discard%&, and the action is taken immediately &-- no further
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 504c3f551..9dbc65c09 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -44,7 +44,9 @@ NM/01 Bugzilla 1197 - Spec typo
JH/03 Add expansion operators ${listnamed:name} and ${listcount:string}
-JH/04 Add expansion item ${acl {name}{arg}...}
+JH/04 Add expansion item ${acl {name}{arg}...}, expansion condition
+ "acl {{name}{arg}...}", and optional args on acl condition
+ "acl = name arg..."
Exim version 4.80
-----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 3c5c4913b..df2ede807 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -87,10 +87,15 @@ Version 4.81
8. New expansion operators ${listnamed:name} to get the content of a named list
and ${listcount:string} to count the items in a list.
- 9. New expansion item ${acl {name}{arg}...} to call an ACL. The argument can
- be accessed by the ACL in $acl_arg1 to $acl_arg9. $acl_narg will be the
- number of arguments. The expansion result is set by a "message =" modifier
- and an "accept" return from the ACL.
+ 9. The "acl = name" condition on an ACL now supports optional arguments.
+ New expansion item "${acl {name}{arg}...}" and expansion condition
+ "acl {{name}{arg}...}" are added. In all cases up to nine arguments
+ can be used, appearing in $acl_arg1 to $acl_arg9 for the called ACL.
+ Variable $acl_narg contains the number of arguments. If the ACL sets
+ a "message =" value this becomes the result of the expansion item,
+ or the value of $value for the expansion condition. If the ACL returns
+ accept the expansion condition is true; if reject, false. A defer
+ return results in a forced fail.
Version 4.80
------------
diff --git a/src/src/acl.c b/src/src/acl.c
index d0db7171e..5cd0c3507 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3873,23 +3873,28 @@ acl_check_wargs(int where, address_item *addr, uschar *s, int level,
uschar **user_msgptr, uschar **log_msgptr)
{
uschar * tmp;
+uschar * tmp_arg[9]; /* must match acl_arg[] */
uschar * name;
+int i;
if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
goto bad;
-for (acl_narg = 0; acl_narg < sizeof(acl_arg)/sizeof(*acl_arg); acl_narg++)
+for (i = 0; i < 9; i++)
{
while (*s && isspace(*s)) s++;
if (!*s) break;
- if (!(tmp = string_dequote(&s)) || !(acl_arg[acl_narg] = expand_string(tmp)))
+ if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
{
tmp = name;
goto bad;
}
}
+acl_narg = i;
+for (i = 0; i < acl_narg; i++) acl_arg[i] = tmp_arg[i];
+while (i < 9) acl_arg[i++] = NULL;
-return acl_check_internal(where, addr, name, level+1, user_msgptr, log_msgptr);
+return acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);
bad:
if (expand_string_forcedfail) return ERROR;
diff --git a/src/src/expand.c b/src/src/expand.c
index 60552a85c..767e4771a 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1855,7 +1855,7 @@ uschar *dummy_log_msg;
for (i = 1; i < nsub && sub[i]; i++)
acl_arg[i-1] = sub[i];
acl_narg = i-1;
-while (i < sizeof(sub)/sizeof(*sub))
+while (i < nsub)
acl_arg[i++ - 1] = NULL;
DEBUG(D_expand)
@@ -2111,11 +2111,13 @@ switch(cond_type)
*/
case ECOND_ACL:
- /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}}
+ /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */
{
uschar *nameargs;
uschar *user_msg;
BOOL cond = FALSE;
+ int size = 0;
+ int ptr = 0;
while (isspace(*s)) s++;
if (*s++ != '{') goto COND_FAILED_CURLY_START;
@@ -2129,16 +2131,17 @@ switch(cond_type)
case 3: return NULL;
}
- if (yield != NULL)
- switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
+ if (yield != NULL) switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
{
case OK:
cond = TRUE;
case FAIL:
+ lookup_value = NULL;
if (user_msg)
+ {
lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg));
- else
- lookup_value = NULL;
+ lookup_value[ptr] = '\0';
+ }
*yield = cond;
break;
diff --git a/test/confs/0002 b/test/confs/0002
index df65e2c30..eb473e6b9 100644
--- a/test/confs/0002
+++ b/test/confs/0002
@@ -51,5 +51,12 @@ a_none:
accept
a_deny:
+ deny message = ($acl_narg) [$acl_arg1] [$acl_arg2]
+
+a_defer:
+ defer
+
+a_sub:
+ require acl = a_deny "new arg1" $acl_arg1
# End
diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 62a0a1f56..3e2421b1e 100644
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -88,7 +88,7 @@ reduce: ${reduce {<\x7f 1\x7f2\177 3}{0}{${eval:$value+$item}}}
acl: ${acl
acl: ${acl}
-acl: ${acl {a_bad}}
+acl: ${acl {a_nosuch}}
acl: ${acl {a_ret}}
acl: ${acl {a_ret}{person@dom.ain}}
acl: ${acl {a_ret}{firstarg}{secondarg}}
@@ -97,6 +97,8 @@ acl: ${acl {a_none}}
acl: ${acl {a_none}{person@dom.ain}}
acl: ${acl {a_deny}}
acl: ${acl {a_deny}{person@dom.ain}}
+acl: ${acl {a_defer}}
+acl: ${acl {a_sub}{top_arg_1}{top_arg_2}{top_arg_3}}
acl: ${reduce {1:2:3:4} {} {$value ${acl {a_ret}{$item}}}}
addrss: ${address:local-part@dom.ain}
@@ -421,6 +423,12 @@ first_delivery: ${if first_delivery{y}{n}}
queue_running after or: ${if or{{eq {0}{0}}{queue_running}}{y}{n}}
first_delivery after or: ${if or{{eq {0}{0}}{first_delivery}}{y}{n}}
+# acl expansion condition
+acl if: ${if acl {{a_ret}} {Y:$value}{N:$value}}
+acl if: ${if acl {{a_ret}{argY}} {Y:$value}{N:$value}}
+acl if: ${if acl {{a_deny}{argN}{arg2}} {Y:$value}{N:$value}}
+acl if: ${if acl {{a_defer}{argN}{arg2}} {Y:$value}{N:$value}}
+
# Default values for both if strings
\${if eq{1}{1}} >${if eq{1}{1}}<
diff --git a/test/stdout/0002 b/test/stdout/0002
index edf18d18c..b4b96dfb5 100644
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -80,15 +80,17 @@
>
> Failed: missing or misplaced { or }
> Failed: missing or misplaced { or }
-> Failed: acl "a_bad" did not accept
+> Failed: error from acl "a_nosuch"
> acl: (0) [] []
> acl: (1) [person@dom.ain] []
> acl: (2) [firstarg] [secondarg]
> acl: (1) [arg with spaces] []
> acl:
> acl:
-> Failed: acl "a_deny" did not accept
-> Failed: acl "a_deny" did not accept
+> acl: (0) [] []
+> acl: (1) [person@dom.ain] []
+> Failed: error from acl "a_defer"
+> acl: (2) [new arg1] [top_arg_1]
> acl: (1) [1] [] (1) [2] [] (1) [3] [] (1) [4] []
>
> addrss: local-part@dom.ain
@@ -390,6 +392,12 @@
> queue_running after or: y
> first_delivery after or: y
>
+> # acl expansion condition
+> acl if: Y:(0) [] []
+> acl if: Y:(1) [argY] []
+> acl if: N:(2) [argN] [arg2]
+> Failed: error from acl "a_defer"
+>
> # Default values for both if strings
>
> ${if eq{1}{1}} >true<
generated by cgit v1.2.3 (git 2.39.1) at 2024-10-21 05:08:53 +0000