Advanced
Mailing List Archive

Mailing List Archive

  1. Home >
  2. exim>
  3. dev
[Bug 608] ACL condition with deny called from acl_smtp_quit/ acl_smtp_notquit causes error
graeme at graemef
Oct 5, 2007, 1:36 AM
Post #1 of 4 (1158 views)
Permalink
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=608

Graeme Fowler <graeme@graemef.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |graeme@graemef.net
Status|NEW |RESOLVED
Resolution| |INVALID




--- Comment #1 from Graeme Fowler <graeme@graemef.net> 2007-10-05 09:36:22 ---
A "deny" in the quit or not_quit acl is superfluous - at this point, the remote
server has either closed the connection gracefully (ie. sent a QUIT) or has
terminated unexpectedly, perhaps due to a network problem or (in the case of
Exim) by dropping the connection on purpose.

This is why the log message says:

ACL for not-QUIT returned ERROR: "deny" is not allowed in a QUIT or not-QUIT
ACL

This is documented here:

http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTQUITACL

The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
does not affect the response code to QUIT, which is always 221. Thus, the ACL
does not in fact control any access. For this reason, the only verbs that are
permitted are accept and warn.

and here:

http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTNOTQUITACL

Like the QUIT ACL, this ACL is provided to make it possible to do customized
logging or to gather statistics, and its outcome is ignored. The delay modifier
is forbidden in this ACL, and the only permitted verbs are accept and warn.

The fact that you're calling a nested ACL is not relevant - the outcome is a
"deny", which is an invalid verb for the "parent" ACL.

Closing, not a bug.


--
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: [Bug 608] ACL condition with deny called from acl_smtp_quit/ acl_smtp_notquit causes error [ In reply to ]
simon at arlott
Oct 5, 2007, 4:25 AM
Post #2 of 4 (1120 views)
Permalink
On Fri, October 5, 2007 09:36, Graeme Fowler wrote:
> A "deny" in the quit or not_quit acl is superfluous - at this point, the remote
> server has either closed the connection gracefully (ie. sent a QUIT) or has
> terminated unexpectedly, perhaps due to a network problem or (in the case of
> Exim) by dropping the connection on purpose.
>
> This is why the log message says:
>
> ACL for not-QUIT returned ERROR: "deny" is not allowed in a QUIT or not-QUIT
> ACL
>
> This is documented here:
>
> http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTQUITACL
>
> The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
> does not affect the response code to QUIT, which is always 221. Thus, the ACL
> does not in fact control any access. For this reason, the only verbs that are
> permitted are accept and warn.
>
> and here:
>
> http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTNOTQUITACL
>
> Like the QUIT ACL, this ACL is provided to make it possible to do customized
> logging or to gather statistics, and its outcome is ignored. The delay modifier
> is forbidden in this ACL, and the only permitted verbs are accept and warn.
>
> The fact that you're calling a nested ACL is not relevant - the outcome is a
> "deny", which is an invalid verb for the "parent" ACL.

The outcome of the nested ACL isn't used as the verb in the parent ACL, it's the
result of a condition, so this is still a bug.

> Closing, not a bug.

--
Simon Arlott

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
Re: [Bug 608] ACL condition with deny called from acl_smtp_quit/ acl_smtp_notquit causes error [ In reply to ]
simon at arlott
Oct 5, 2007, 4:25 AM
Post #3 of 4 (1126 views)
Permalink
On Fri, October 5, 2007 09:36, Graeme Fowler wrote:
> A "deny" in the quit or not_quit acl is superfluous - at this point, the remote
> server has either closed the connection gracefully (ie. sent a QUIT) or has
> terminated unexpectedly, perhaps due to a network problem or (in the case of
> Exim) by dropping the connection on purpose.
>
> This is why the log message says:
>
> ACL for not-QUIT returned ERROR: "deny" is not allowed in a QUIT or not-QUIT
> ACL
>
> This is documented here:
>
> http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTQUITACL
>
> The ACL for the SMTP QUIT command is anomalous, in that the outcome of the ACL
> does not affect the response code to QUIT, which is always 221. Thus, the ACL
> does not in fact control any access. For this reason, the only verbs that are
> permitted are accept and warn.
>
> and here:
>
> http://www.exim.org/exim-html-current/doc/html/spec_html/ch40.html#SECTNOTQUITACL
>
> Like the QUIT ACL, this ACL is provided to make it possible to do customized
> logging or to gather statistics, and its outcome is ignored. The delay modifier
> is forbidden in this ACL, and the only permitted verbs are accept and warn.
>
> The fact that you're calling a nested ACL is not relevant - the outcome is a
> "deny", which is an invalid verb for the "parent" ACL.

The outcome of the nested ACL isn't used as the verb in the parent ACL, it's the
result of a condition, so this is still a bug.

> Closing, not a bug.

--
Simon Arlott

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
[Bug 608] ACL condition with deny called from acl_smtp_quit/ acl_smtp_notquit causes error [ In reply to ]
holmgren at lysator
Oct 5, 2007, 10:04 AM
Post #4 of 4 (1123 views)
Permalink
------- You are receiving this mail because: -------
You are on the CC list for the bug.

http://bugs.exim.org/show_bug.cgi?id=608

Magnus Holmgren <holmgren@lysator.liu.se> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |




--- Comment #2 from Magnus Holmgren <holmgren@lysator.liu.se> 2007-10-05 18:04:52 ---
As noted in the discussions, the "deny" in a nested ACL is not really a "deny",
but rather a "return false". Hence, it doesn't make sense to forbid it there,
and the long explanation comment #1 is irrelevant. This is at least in
principle a bug, although perhaps one of low severity.


--
Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email

--
## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##

©2024 GT.net. A Gossamer Threads company.
5th Floor, 455 Granville St., Vancouver, BC V6C 1T1, Canada | Legal