milter: make responses configurable

flowerysong · flowerysong · commit becddec3d401 · 2024-11-03T16:25:36.000Z
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file.
 - milter - `AuthResIP` configuration option.
 - milter - `RequireSafeKeys` configuration option.
 - milter - `MinimumKeySizeRSA` configuration option.
+- milter - `ResponseDisabled`, `ResponseUnable`, and `ResponseUnwilling`
+  configuration options.
 
 ### Changed
 - Custom OpenSSL locations must be configured using `OPENSSL_CFLAGS`
@@ -37,6 +39,8 @@ All notable changes to this project will be documented in this file.
   `header.oldest-pass` when appropriate.
 - milter - An `ar-test` program for seeing how `Authentication-Results`
   headers are parsed is built without making you jump through weird hoops.
+- milter - The default behaviour for messages that fail basic validity checks
+  (malformed headers, too many headers) is to reject them.
 
 ### Removed
 - libopenarc - `arc_mail_parse()`
diff --git a/openarc/openarc-config.h b/openarc/openarc-config.h
@@ -39,6 +39,9 @@ struct configdef arcf_config[] = {
     {"PermitAuthenticationOverrides", CONFIG_TYPE_BOOLEAN, false},
     {"PidFile",                       CONFIG_TYPE_STRING,  false},
     {"RequireSafeKeys",               CONFIG_TYPE_BOOLEAN, false},
+    {"ResponseDisabled",              CONFIG_TYPE_STRING,  false},
+    {"ResponseUnable",                CONFIG_TYPE_STRING,  false},
+    {"ResponseUnwilling",             CONFIG_TYPE_STRING,  false},
     {"SealHeaderChecks",              CONFIG_TYPE_STRING,  false},
     {"Selector",                      CONFIG_TYPE_STRING,  false},
     {"SignatureAlgorithm",            CONFIG_TYPE_STRING,  false},
diff --git a/openarc/openarc.c b/openarc/openarc.c
@@ -135,6 +135,9 @@ struct arcf_config
     size_t          conf_keylen;            /* key length */
     int             conf_maxhdrsz;          /* max. header size */
     int             conf_minkeysz;          /* min. key size */
+    int             conf_ret_disabled;      /* configured not to process */
+    int             conf_ret_unable;        /* internal error */
+    int             conf_ret_unwilling;     /* badly formed message */
     struct config  *conf_data;              /* configuration data */
     ARC_LIB        *conf_libopenarc;        /* shared library instance */
     struct conflist conf_peers;             /* peers hosts */
@@ -221,6 +224,14 @@ struct nametable arcf_chainstates[] = {
     {NULL,   -1            }
 };
 
+struct nametable arcf_responses[] = {
+    {"accept",   SMFIS_ACCEPT  },
+    {"discard",  SMFIS_DISCARD },
+    {"reject",   SMFIS_REJECT  },
+    {"tempfail", SMFIS_TEMPFAIL},
+    {NULL,       -1            }
+};
+
 /* PROTOTYPES */
 sfsistat      mlfi_abort(SMFICTX *);
 sfsistat      mlfi_close(SMFICTX *);
@@ -1156,6 +1167,10 @@ arcf_config_new(void)
     new->conf_safekeys = true;
     new->conf_authresip = true;
 
+    new->conf_ret_disabled = SMFIS_ACCEPT;
+    new->conf_ret_unable = SMFIS_TEMPFAIL;
+    new->conf_ret_unwilling = SMFIS_REJECT;
+
     LIST_INIT(&new->conf_peers);
     LIST_INIT(&new->conf_internal);
 
@@ -1543,6 +1558,52 @@ arcf_config_load(struct config      *data,
             conf->conf_fixedtime = strtoul(str, &end, 10);
         }
 
+        str = NULL;
+        config_get(data, "ResponseDisabled", &str, sizeof str);
+        if (str)
+        {
+            int resp = arc_name_to_code(arcf_responses, str);
+            if (resp == -1)
+            {
+                snprintf(err, errlen, "%s: invalid response value", str);
+            }
+            else
+            {
+                conf->conf_ret_disabled = arc_name_to_code(arcf_responses, str);
+            }
+        }
+
+        str = NULL;
+        config_get(data, "ResponseUnable", &str, sizeof str);
+        if (str)
+        {
+            int resp = arc_name_to_code(arcf_responses, str);
+            if (resp == -1)
+            {
+                snprintf(err, errlen, "%s: invalid response value", str);
+            }
+            else
+            {
+                conf->conf_ret_unable = arc_name_to_code(arcf_responses, str);
+            }
+        }
+
+        str = NULL;
+        config_get(data, "ResponseUnwilling", &str, sizeof str);
+        if (str)
+        {
+            int resp = arc_name_to_code(arcf_responses, str);
+            if (resp == -1)
+            {
+                snprintf(err, errlen, "%s: invalid response value", str);
+            }
+            else
+            {
+                conf->conf_ret_unwilling = arc_name_to_code(arcf_responses,
+                                                            str);
+            }
+        }
+
         (void) config_get(data, "TestKeys", &conf->conf_testkeys,
                           sizeof conf->conf_testkeys);
 
@@ -2785,10 +2846,10 @@ mlfi_connect(SMFICTX *ctx, char *host, _SOCK_ADDR *ip)
                 syslog(LOG_ERR, "%s malloc(): %s", host, strerror(errno));
             }
 
+            int retval = curconf->conf_ret_unable;
             pthread_mutex_unlock(&conf_lock);
 
-            /* XXX -- result should be selectable */
-            return SMFIS_TEMPFAIL;
+            return retval;
         }
 
         pthread_mutex_lock(&conf_lock);
@@ -2836,9 +2897,11 @@ mlfi_connect(SMFICTX *ctx, char *host, _SOCK_ADDR *ip)
     {
         if (curconf->conf_dolog)
         {
-            syslog(LOG_INFO, "ignoring connection from %s", host);
+            syslog(
+                LOG_INFO, "peer connection from %s, returning %s", host,
+                arc_code_to_name(arcf_responses, curconf->conf_ret_disabled));
         }
-        return SMFIS_ACCEPT;
+        return curconf->conf_ret_disabled;
     }
 
     /* infer operating mode if not explicitly set */
@@ -2991,15 +3054,13 @@ mlfi_header(SMFICTX *ctx, char *headerf, char *headerv)
         afc->mctx_hdrbytes + strlen(headerf) + strlen(headerv) + 2 >
             conf->conf_maxhdrsz)
     {
-        /* FIXME: this should be configurable, and it might be better to
-         * default to rejecting the message.
-         */
         if (conf->conf_dolog)
         {
-            syslog(LOG_NOTICE, "too much header data; accepting");
+            syslog(LOG_NOTICE, "too much header data, returning %s",
+                   arc_code_to_name(arcf_responses, conf->conf_ret_unwilling));
         }
 
-        return SMFIS_ACCEPT;
+        return conf->conf_ret_unwilling;
     }
 
     /*
@@ -3026,7 +3087,7 @@ mlfi_header(SMFICTX *ctx, char *headerf, char *headerv)
         }
 
         arcf_cleanup(ctx);
-        return SMFIS_TEMPFAIL;
+        return conf->conf_ret_unable;
     }
 
     newhdr->hdr_hdr = ARC_STRDUP(headerf);
@@ -3046,7 +3107,7 @@ mlfi_header(SMFICTX *ctx, char *headerf, char *headerv)
 
             arcf_cleanup(ctx);
 
-            return SMFIS_TEMPFAIL;
+            return conf->conf_ret_unable;
         }
     }
     else
@@ -3111,7 +3172,7 @@ mlfi_header(SMFICTX *ctx, char *headerf, char *headerv)
         ARC_FREE(newhdr->hdr_val);
         ARC_FREE(newhdr);
         arcf_cleanup(ctx);
-        return SMFIS_TEMPFAIL;
+        return conf->conf_ret_unable;
     }
 
     afc->mctx_hdrbytes += strlen(newhdr->hdr_hdr) + 1;
@@ -3359,7 +3420,7 @@ mlfi_eoh(SMFICTX *ctx)
                        afc->mctx_jobid);
             }
 
-            return SMFIS_ACCEPT;
+            return conf->conf_ret_disabled;
         }
     }
 #endif /* USE_JANSSON */
@@ -3381,7 +3442,7 @@ mlfi_eoh(SMFICTX *ctx)
                    afc->mctx_jobid, err);
         }
 
-        return SMFIS_TEMPFAIL;
+        return conf->conf_ret_unable;
     }
 
     for (hdr = afc->mctx_hqhead; hdr != NULL; hdr = hdr->hdr_next)
@@ -3397,7 +3458,7 @@ mlfi_eoh(SMFICTX *ctx)
                            afc->mctx_jobid);
                 }
 
-                return SMFIS_TEMPFAIL;
+                return conf->conf_ret_unable;
             }
         }
         else
@@ -3438,7 +3499,11 @@ mlfi_eoh(SMFICTX *ctx)
                        afc->mctx_jobid, hdr->hdr_hdr);
             }
 
-            return SMFIS_TEMPFAIL;
+            if (status == ARC_STAT_SYNTAX)
+            {
+                return conf->conf_ret_unwilling;
+            }
+            return conf->conf_ret_unable;
         }
     }
 
@@ -3512,7 +3577,7 @@ mlfi_body(SMFICTX *ctx, unsigned char *bodyp, size_t bodylen)
                        afc->mctx_jobid);
             }
 
-            return SMFIS_TEMPFAIL;
+            return conf->conf_ret_unable;
         }
     }
 
@@ -3657,7 +3722,7 @@ mlfi_eom(SMFICTX *ctx)
                 syslog(LOG_ERR, "arc_dstring_new() failed");
             }
 
-            return SMFIS_TEMPFAIL;
+            return conf->conf_ret_unable;
         }
     }
 
@@ -3693,7 +3758,7 @@ mlfi_eom(SMFICTX *ctx)
                    afc->mctx_jobid);
         }
 
-        return SMFIS_TEMPFAIL;
+        return conf->conf_ret_unable;
     }
 
     if (BITSET(ARC_MODE_SIGN, cc->cctx_mode))
@@ -3806,7 +3871,7 @@ mlfi_eom(SMFICTX *ctx)
                        afc->mctx_jobid);
             }
 
-            return SMFIS_TEMPFAIL;
+            return conf->conf_ret_unable;
         }
 
         for (sealhdr = seal; sealhdr != NULL; sealhdr = arc_hdr_next(sealhdr))
@@ -3858,7 +3923,7 @@ mlfi_eom(SMFICTX *ctx)
                        afc->mctx_jobid, "");
             }
 
-            return SMFIS_TEMPFAIL;
+            return conf->conf_ret_unable;
         }
 
         arc_dstring_blank(afc->mctx_tmpstr);
diff --git a/openarc/openarc.conf.5.in b/openarc/openarc.conf.5.in
@@ -248,6 +248,34 @@ containing the process ID.
 Controls whether the filter requires that private keys have safe file
 permissions.
 
+.It Cm ResponseDisabled Pq string
+.Brq Cm accept | discard | reject | tempfail
+
+Response to send after determining that this message is one that
+the filter is configured not to process.
+See
+.Cm SealHeaderChecks
+and
+.Cm PeerList .
+The default is
+.Cm accept .
+
+.It Cm ResponseUnable Pq string
+.Brq Cm accept | discard | reject | tempfail
+
+Response to send after an internal error occurs that makes it
+impossible to finish processing the message.
+The default is
+.Cm tempfail .
+
+.It Cm ResponseUnwilling Pq string
+.Brq Cm accept | discard | reject | tempfail
+
+Response to send after a message fails basic validity checks, such as
+.Cm MaximumHeaders .
+The default is
+.Cm reject .
+
 .It Cm SealHeaderChecks Pq string
 Identifies a file containing header checks that should be done to determine
 whether to seal a message.
@@ -268,7 +296,7 @@ Use
 .Ql openarc \-V
 to see the list of supported algorithms.
 The default is
-.Cm rsa-sha256.
+.Cm rsa-sha256 .
 Other values are not useful if you are intending to interoperate with other
 implementers of the ARC protocol.
 
diff --git a/openarc/openarc.conf.sample b/openarc/openarc.conf.sample
@@ -216,6 +216,30 @@ KeyFile			/var/db/dkim/example.private
 
 # RequireSafeKeys yes
 
+##  ResponseDisabled { accept | discard | reject | tempfail }
+##      default "accept"
+##
+##  Response to send after determining that this message is one that
+##  the filter is configured not to process.
+
+# ResponseDisabled accept
+
+##  ResponseUnable { accept | discard | reject | tempfail }
+##      default "tempfail"
+##
+##  Response to send after an internal error occurs that makes it impossible
+##  to finish processing the message.
+
+# ResponseUnable tempfail
+
+##  ResponseUnwilling { accept | discard | reject | tempfail }
+##      default "reject"
+##
+##  Response to send after a message fails basic validity checks, such as
+##  MaximumHeaders.
+
+# ResponseUnwilling reject
+
 ##  SealHeaderChecks filename
 ##  	default (none)
 ##
diff --git a/test/files/test_milter_maximumheaders.conf b/test/files/test_milter_maximumheaders.conf
@@ -0,0 +1,3 @@
+{
+  "MaximumHeaders": "1"
+}
diff --git a/test/files/test_milter_responsedisabled.conf b/test/files/test_milter_responsedisabled.conf
@@ -0,0 +1,4 @@
+{
+  "PeerList": "peerlist",
+  "ResponseDisabled": "reject"
+}
diff --git a/test/files/test_milter_responseunwilling.conf b/test/files/test_milter_responseunwilling.conf
@@ -0,0 +1,4 @@
+{
+  "MaximumHeaders": "1",
+  "ResponseUnwilling": "accept"
+}
diff --git a/test/test_milter.py b/test/test_milter.py
@@ -564,6 +564,12 @@ def test_milter_finalreceiver(run_miltertest):
     assert res['headers'][0][1] == ' example.com; arc=pass header.oldest-pass=0 smtp.remote-ip=127.0.0.1 arc.chain="example.com:example.com"'
 
 
+def test_milter_maximumheaders(run_miltertest):
+    """Oversized headers result in message rejection"""
+    with pytest.raises(miltertest.MilterError, match="Unexpected reply to L: \\('r'"):
+        run_miltertest()
+
+
 def test_milter_minimum_key_bits(run_miltertest):
     """A 2048-bit key passes when that is the minimum"""
     res = run_miltertest()
@@ -584,6 +590,18 @@ def test_milter_peerlist(run_miltertest):
         run_miltertest()
 
 
+def test_milter_responsedisabled(run_miltertest):
+    """Configured to reject messages from peers"""
+    with pytest.raises(miltertest.MilterError, match='unexpected response: r'):
+        run_miltertest()
+
+
+def test_milter_responseunwilling(run_miltertest):
+    """Configured to accept messages with too many headers"""
+    with pytest.raises(miltertest.MilterError, match="Unexpected reply to L: \\('a'"):
+        run_miltertest()
+
+
 def test_milter_softwareheader(run_miltertest):
     """Advertise software name, version"""
     res = run_miltertest()

Original file line number	Diff line number	Diff line change
`@@ -135,6 +135,9 @@ struct arcf_config`
`135`	`135`	`size_t conf_keylen; /* key length */`
`136`	`136`	`int conf_maxhdrsz; /* max. header size */`
`137`	`137`	`int conf_minkeysz; /* min. key size */`
	`138`	`+ int conf_ret_disabled; /* configured not to process */`
	`139`	`+ int conf_ret_unable; /* internal error */`
	`140`	`+ int conf_ret_unwilling; /* badly formed message */`
`138`	`141`	`struct config conf_data; / configuration data */`
`139`	`142`	`ARC_LIB conf_libopenarc; / shared library instance */`
`140`	`143`	`struct conflist conf_peers; /* peers hosts */`
`@@ -221,6 +224,14 @@ struct nametable arcf_chainstates[] = {`
`221`	`224`	`{NULL, -1 }`
`222`	`225`	`};`
`223`	`226`
	`227`	`+struct nametable arcf_responses[] = {`
	`228`	`+ {"accept", SMFIS_ACCEPT },`
	`229`	`+ {"discard", SMFIS_DISCARD },`
	`230`	`+ {"reject", SMFIS_REJECT },`
	`231`	`+ {"tempfail", SMFIS_TEMPFAIL},`
	`232`	`+ {NULL, -1 }`
	`233`	`+};`
	`234`	`+`
`224`	`235`	`/* PROTOTYPES */`
`225`	`236`	`sfsistat mlfi_abort(SMFICTX *);`
`226`	`237`	`sfsistat mlfi_close(SMFICTX *);`
`@@ -1156,6 +1167,10 @@ arcf_config_new(void)`
`1156`	`1167`	`new->conf_safekeys = true;`
`1157`	`1168`	`new->conf_authresip = true;`
`1158`	`1169`
	`1170`	`+ new->conf_ret_disabled = SMFIS_ACCEPT;`
	`1171`	`+ new->conf_ret_unable = SMFIS_TEMPFAIL;`
	`1172`	`+ new->conf_ret_unwilling = SMFIS_REJECT;`
	`1173`	`+`
`1159`	`1174`	`LIST_INIT(&new->conf_peers);`
`1160`	`1175`	`LIST_INIT(&new->conf_internal);`
`1161`	`1176`
`@@ -1543,6 +1558,52 @@ arcf_config_load(struct config *data,`
`1543`	`1558`	`conf->conf_fixedtime = strtoul(str, &end, 10);`
`1544`	`1559`	`}`
`1545`	`1560`
	`1561`	`+ str = NULL;`
	`1562`	`+ config_get(data, "ResponseDisabled", &str, sizeof str);`
	`1563`	`+ if (str)`
	`1564`	`+ {`
	`1565`	`+ int resp = arc_name_to_code(arcf_responses, str);`
	`1566`	`+ if (resp == -1)`
	`1567`	`+ {`
	`1568`	`+ snprintf(err, errlen, "%s: invalid response value", str);`
	`1569`	`+ }`
	`1570`	`+ else`
	`1571`	`+ {`
	`1572`	`+ conf->conf_ret_disabled = arc_name_to_code(arcf_responses, str);`
	`1573`	`+ }`
	`1574`	`+ }`
	`1575`	`+`
	`1576`	`+ str = NULL;`
	`1577`	`+ config_get(data, "ResponseUnable", &str, sizeof str);`
	`1578`	`+ if (str)`
	`1579`	`+ {`
	`1580`	`+ int resp = arc_name_to_code(arcf_responses, str);`
	`1581`	`+ if (resp == -1)`
	`1582`	`+ {`
	`1583`	`+ snprintf(err, errlen, "%s: invalid response value", str);`
	`1584`	`+ }`
	`1585`	`+ else`
	`1586`	`+ {`
	`1587`	`+ conf->conf_ret_unable = arc_name_to_code(arcf_responses, str);`
	`1588`	`+ }`
	`1589`	`+ }`
	`1590`	`+`
	`1591`	`+ str = NULL;`
	`1592`	`+ config_get(data, "ResponseUnwilling", &str, sizeof str);`
	`1593`	`+ if (str)`
	`1594`	`+ {`
	`1595`	`+ int resp = arc_name_to_code(arcf_responses, str);`
	`1596`	`+ if (resp == -1)`
	`1597`	`+ {`
	`1598`	`+ snprintf(err, errlen, "%s: invalid response value", str);`
	`1599`	`+ }`
	`1600`	`+ else`
	`1601`	`+ {`
	`1602`	`+ conf->conf_ret_unwilling = arc_name_to_code(arcf_responses,`
	`1603`	`+ str);`
	`1604`	`+ }`
	`1605`	`+ }`
	`1606`	`+`
`1546`	`1607`	`(void) config_get(data, "TestKeys", &conf->conf_testkeys,`
`1547`	`1608`	`sizeof conf->conf_testkeys);`
`1548`	`1609`
`@@ -2785,10 +2846,10 @@ mlfi_connect(SMFICTX ctx, char host, _SOCK_ADDR *ip)`
`2785`	`2846`	`syslog(LOG_ERR, "%s malloc(): %s", host, strerror(errno));`
`2786`	`2847`	`}`
`2787`	`2848`
	`2849`	`+ int retval = curconf->conf_ret_unable;`
`2788`	`2850`	`pthread_mutex_unlock(&conf_lock);`
`2789`	`2851`
`2790`		`- /* XXX -- result should be selectable */`
`2791`		`- return SMFIS_TEMPFAIL;`
	`2852`	`+ return retval;`
`2792`	`2853`	`}`
`2793`	`2854`
`2794`	`2855`	`pthread_mutex_lock(&conf_lock);`
`@@ -2836,9 +2897,11 @@ mlfi_connect(SMFICTX ctx, char host, _SOCK_ADDR *ip)`
`2836`	`2897`	`{`
`2837`	`2898`	`if (curconf->conf_dolog)`
`2838`	`2899`	`{`
`2839`		`- syslog(LOG_INFO, "ignoring connection from %s", host);`
	`2900`	`+ syslog(`
	`2901`	`+ LOG_INFO, "peer connection from %s, returning %s", host,`
	`2902`	`+ arc_code_to_name(arcf_responses, curconf->conf_ret_disabled));`
`2840`	`2903`	`}`
`2841`		`- return SMFIS_ACCEPT;`
	`2904`	`+ return curconf->conf_ret_disabled;`
`2842`	`2905`	`}`
`2843`	`2906`
`2844`	`2907`	`/* infer operating mode if not explicitly set */`
`@@ -2991,15 +3054,13 @@ mlfi_header(SMFICTX ctx, char headerf, char *headerv)`
`2991`	`3054`	`afc->mctx_hdrbytes + strlen(headerf) + strlen(headerv) + 2 >`
`2992`	`3055`	`conf->conf_maxhdrsz)`
`2993`	`3056`	`{`
`2994`		`- /* FIXME: this should be configurable, and it might be better to`
`2995`		`- * default to rejecting the message.`
`2996`		`- */`
`2997`	`3057`	`if (conf->conf_dolog)`
`2998`	`3058`	`{`
`2999`		`- syslog(LOG_NOTICE, "too much header data; accepting");`
	`3059`	`+ syslog(LOG_NOTICE, "too much header data, returning %s",`
	`3060`	`+ arc_code_to_name(arcf_responses, conf->conf_ret_unwilling));`
`3000`	`3061`	`}`
`3001`	`3062`
`3002`		`- return SMFIS_ACCEPT;`
	`3063`	`+ return conf->conf_ret_unwilling;`
`3003`	`3064`	`}`
`3004`	`3065`
`3005`	`3066`	`/*`
`@@ -3026,7 +3087,7 @@ mlfi_header(SMFICTX ctx, char headerf, char *headerv)`
`3026`	`3087`	`}`
`3027`	`3088`
`3028`	`3089`	`arcf_cleanup(ctx);`
`3029`		`- return SMFIS_TEMPFAIL;`
	`3090`	`+ return conf->conf_ret_unable;`
`3030`	`3091`	`}`
`3031`	`3092`
`3032`	`3093`	`newhdr->hdr_hdr = ARC_STRDUP(headerf);`
`@@ -3046,7 +3107,7 @@ mlfi_header(SMFICTX ctx, char headerf, char *headerv)`
`3046`	`3107`
`3047`	`3108`	`arcf_cleanup(ctx);`
`3048`	`3109`
`3049`		`- return SMFIS_TEMPFAIL;`
	`3110`	`+ return conf->conf_ret_unable;`
`3050`	`3111`	`}`
`3051`	`3112`	`}`
`3052`	`3113`	`else`
`@@ -3111,7 +3172,7 @@ mlfi_header(SMFICTX ctx, char headerf, char *headerv)`
`3111`	`3172`	`ARC_FREE(newhdr->hdr_val);`
`3112`	`3173`	`ARC_FREE(newhdr);`
`3113`	`3174`	`arcf_cleanup(ctx);`
`3114`		`- return SMFIS_TEMPFAIL;`
	`3175`	`+ return conf->conf_ret_unable;`
`3115`	`3176`	`}`
`3116`	`3177`
`3117`	`3178`	`afc->mctx_hdrbytes += strlen(newhdr->hdr_hdr) + 1;`
`@@ -3359,7 +3420,7 @@ mlfi_eoh(SMFICTX *ctx)`
`3359`	`3420`	`afc->mctx_jobid);`
`3360`	`3421`	`}`
`3361`	`3422`
`3362`		`- return SMFIS_ACCEPT;`
	`3423`	`+ return conf->conf_ret_disabled;`
`3363`	`3424`	`}`
`3364`	`3425`	`}`
`3365`	`3426`	`#endif /* USE_JANSSON */`
`@@ -3381,7 +3442,7 @@ mlfi_eoh(SMFICTX *ctx)`
`3381`	`3442`	`afc->mctx_jobid, err);`
`3382`	`3443`	`}`
`3383`	`3444`
`3384`		`- return SMFIS_TEMPFAIL;`
	`3445`	`+ return conf->conf_ret_unable;`
`3385`	`3446`	`}`
`3386`	`3447`
`3387`	`3448`	`for (hdr = afc->mctx_hqhead; hdr != NULL; hdr = hdr->hdr_next)`
`@@ -3397,7 +3458,7 @@ mlfi_eoh(SMFICTX *ctx)`
`3397`	`3458`	`afc->mctx_jobid);`
`3398`	`3459`	`}`
`3399`	`3460`
`3400`		`- return SMFIS_TEMPFAIL;`
	`3461`	`+ return conf->conf_ret_unable;`
`3401`	`3462`	`}`
`3402`	`3463`	`}`
`3403`	`3464`	`else`
`@@ -3438,7 +3499,11 @@ mlfi_eoh(SMFICTX *ctx)`
`3438`	`3499`	`afc->mctx_jobid, hdr->hdr_hdr);`
`3439`	`3500`	`}`
`3440`	`3501`
`3441`		`- return SMFIS_TEMPFAIL;`
	`3502`	`+ if (status == ARC_STAT_SYNTAX)`
	`3503`	`+ {`
	`3504`	`+ return conf->conf_ret_unwilling;`
	`3505`	`+ }`
	`3506`	`+ return conf->conf_ret_unable;`
`3442`	`3507`	`}`
`3443`	`3508`	`}`
`3444`	`3509`
`@@ -3512,7 +3577,7 @@ mlfi_body(SMFICTX ctx, unsigned char bodyp, size_t bodylen)`
`3512`	`3577`	`afc->mctx_jobid);`
`3513`	`3578`	`}`
`3514`	`3579`
`3515`		`- return SMFIS_TEMPFAIL;`
	`3580`	`+ return conf->conf_ret_unable;`
`3516`	`3581`	`}`
`3517`	`3582`	`}`
`3518`	`3583`
`@@ -3657,7 +3722,7 @@ mlfi_eom(SMFICTX *ctx)`
`3657`	`3722`	`syslog(LOG_ERR, "arc_dstring_new() failed");`
`3658`	`3723`	`}`
`3659`	`3724`
`3660`		`- return SMFIS_TEMPFAIL;`
	`3725`	`+ return conf->conf_ret_unable;`
`3661`	`3726`	`}`
`3662`	`3727`	`}`
`3663`	`3728`
`@@ -3693,7 +3758,7 @@ mlfi_eom(SMFICTX *ctx)`
`3693`	`3758`	`afc->mctx_jobid);`
`3694`	`3759`	`}`
`3695`	`3760`
`3696`		`- return SMFIS_TEMPFAIL;`
	`3761`	`+ return conf->conf_ret_unable;`
`3697`	`3762`	`}`
`3698`	`3763`
`3699`	`3764`	`if (BITSET(ARC_MODE_SIGN, cc->cctx_mode))`
`@@ -3806,7 +3871,7 @@ mlfi_eom(SMFICTX *ctx)`
`3806`	`3871`	`afc->mctx_jobid);`
`3807`	`3872`	`}`
`3808`	`3873`
`3809`		`- return SMFIS_TEMPFAIL;`
	`3874`	`+ return conf->conf_ret_unable;`
`3810`	`3875`	`}`
`3811`	`3876`
`3812`	`3877`	`for (sealhdr = seal; sealhdr != NULL; sealhdr = arc_hdr_next(sealhdr))`
`@@ -3858,7 +3923,7 @@ mlfi_eom(SMFICTX *ctx)`
`3858`	`3923`	`afc->mctx_jobid, "");`
`3859`	`3924`	`}`
`3860`	`3925`
`3861`		`- return SMFIS_TEMPFAIL;`
	`3926`	`+ return conf->conf_ret_unable;`
`3862`	`3927`	`}`
`3863`	`3928`
`3864`	`3929`	`arc_dstring_blank(afc->mctx_tmpstr);`