Taint: check on supplied buffer vs. list when extracting elements
[exim.git] / src / src / lookups / mysql.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Thanks to Paul Kelly for contributing the original code for these
9functions. */
10
11
12#include "../exim.h"
13#include "lf_functions.h"
0756eb3c
PH
14
15#include <mysql.h> /* The system header */
31beb797
HSHR
16
17/* We define symbols for *_VERSION_ID (numeric), *_VERSION_STR (char*)
18and *_BASE_STR (char*). It's a bit of guesswork. Especially for mariadb
19with versions before 10.2, as they do not define there there specific symbols.
20*/
21
8b6c5715 22/* Newer (>= 10.2) MariaDB */
31beb797
HSHR
23#if defined MARIADB_VERSION_ID
24#define EXIM_MxSQL_VERSION_ID MARIADB_VERSION_ID
25
8b6c5715
JH
26/* MySQL defines MYSQL_VERSION_ID, and MariaDB does so */
27/* https://dev.mysql.com/doc/refman/5.7/en/c-api-server-client-versions.html */
31beb797
HSHR
28#elif defined LIBMYSQL_VERSION_ID
29#define EXIM_MxSQL_VERSION_ID LIBMYSQL_VERSION_ID
30#elif defined MYSQL_VERSION_ID
31#define EXIM_MxSQL_VERSION_ID MYSQL_VERSION_ID
32
33#else
34#define EXIM_MYSQL_VERSION_ID 0
35#endif
36
8b6c5715 37/* Newer (>= 10.2) MariaDB */
31beb797
HSHR
38#ifdef MARIADB_CLIENT_VERSION_STR
39#define EXIM_MxSQL_VERSION_STR MARIADB_CLIENT_VERSION_STR
40
8b6c5715 41/* Mysql uses MYSQL_SERVER_VERSION */
31beb797
HSHR
42#elif defined LIBMYSQL_VERSION
43#define EXIM_MxSQL_VERSION_STR LIBMYSQL_VERSION
44#elif defined MYSQL_SERVER_VERSION
45#define EXIM_MxSQL_VERSION_STR MYSQL_SERVER_VERSION
46
47#else
eb002283 48#define EXIM_MxSQL_VERSION_STR "unknown"
31beb797
HSHR
49#endif
50
51#if defined MARIADB_BASE_VERSION
52#define EXIM_MxSQL_BASE_STR MARIADB_BASE_VERSION
53
54#elif defined MARIADB_PACKAGE_VERSION
55#define EXIM_MxSQL_BASE_STR "mariadb"
56
57#elif defined MYSQL_BASE_VERSION
58#define EXIM_MxSQL_BASE_STR MYSQL_BASE_VERSION
59
60#else
61#define EXIM_MxSQL_BASE_STR "n.A."
62#endif
0756eb3c
PH
63
64
65/* Structure and anchor for caching connections. */
66
67typedef struct mysql_connection {
68 struct mysql_connection *next;
69 uschar *server;
70 MYSQL *handle;
71} mysql_connection;
72
73static mysql_connection *mysql_connections = NULL;
74
75
76
77/*************************************************
78* Open entry point *
79*************************************************/
80
81/* See local README for interface description. */
82
e6d225ae 83static void *
d447dbd1 84mysql_open(const uschar * filename, uschar ** errmsg)
0756eb3c
PH
85{
86return (void *)(1); /* Just return something non-null */
87}
88
89
90
91/*************************************************
92* Tidy entry point *
93*************************************************/
94
95/* See local README for interface description. */
96
e6d225ae 97static void
0756eb3c
PH
98mysql_tidy(void)
99{
100mysql_connection *cn;
101while ((cn = mysql_connections) != NULL)
102 {
103 mysql_connections = cn->next;
42c7f0b4 104 DEBUG(D_lookup) debug_printf_indent("close MYSQL connection: %s\n", cn->server);
0756eb3c
PH
105 mysql_close(cn->handle);
106 }
107}
108
109
110
111/*************************************************
112* Internal search function *
113*************************************************/
114
115/* This function is called from the find entry point to do the search for a
116single server.
117
118Arguments:
119 query the query string
120 server the server string
121 resultptr where to store the result
122 errmsg where to point an error message
123 defer_break TRUE if no more servers are to be tried after DEFER
14b3c5bc 124 do_cache set zero if data is changed
0756eb3c
PH
125
126The server string is of the form "host/dbname/user/password". The host can be
127host:port. This string is in a nextinlist temporary buffer, so can be
128overwritten.
129
130Returns: OK, FAIL, or DEFER
131*/
132
133static int
55414b25 134perform_mysql_search(const uschar *query, uschar *server, uschar **resultptr,
14b3c5bc 135 uschar **errmsg, BOOL *defer_break, uint *do_cache)
0756eb3c
PH
136{
137MYSQL *mysql_handle = NULL; /* Keep compilers happy */
138MYSQL_RES *mysql_result = NULL;
139MYSQL_ROW mysql_row_data;
140MYSQL_FIELD *fields;
141
142int i;
0756eb3c
PH
143int yield = DEFER;
144unsigned int num_fields;
acec9514 145gstring * result = NULL;
0756eb3c
PH
146mysql_connection *cn;
147uschar *server_copy = NULL;
148uschar *sdata[4];
149
150/* Disaggregate the parameters from the server argument. The order is host,
151database, user, password. We can write to the string, since it is in a
152nextinlist temporary buffer. The copy of the string that is used for caching
153has the password removed. This copy is also used for debugging output. */
154
d7978c0f 155for (int i = 3; i > 0; i--)
0756eb3c
PH
156 {
157 uschar *pp = Ustrrchr(server, '/');
158 if (pp == NULL)
159 {
160 *errmsg = string_sprintf("incomplete MySQL server data: %s",
161 (i == 3)? server : server_copy);
162 *defer_break = TRUE;
163 return DEFER;
164 }
165 *pp++ = 0;
166 sdata[i] = pp;
167 if (i == 3) server_copy = string_copy(server); /* sans password */
168 }
169sdata[0] = server; /* What's left at the start */
170
171/* See if we have a cached connection to the server */
172
a159f203 173for (cn = mysql_connections; cn; cn = cn->next)
0756eb3c
PH
174 if (Ustrcmp(cn->server, server_copy) == 0)
175 {
176 mysql_handle = cn->handle;
177 break;
178 }
0756eb3c
PH
179
180/* If no cached connection, we must set one up. Mysql allows for a host name
181and port to be specified. It also allows the name of a Unix socket to be used.
182Unfortunately, this contains slashes, but its use is expected to be rare, so
183the rather cumbersome syntax shouldn't inconvenience too many people. We use
a159f203
JH
184this: host:port(socket)[group] where all the parts are optional.
185The "group" parameter specifies an option group from a MySQL option file. */
0756eb3c 186
a159f203 187if (!cn)
0756eb3c
PH
188 {
189 uschar *p;
190 uschar *socket = NULL;
191 int port = 0;
a159f203
JH
192 uschar *group = US"exim";
193
194 if ((p = Ustrchr(sdata[0], '[')))
195 {
196 *p++ = 0;
197 group = p;
198 while (*p && *p != ']') p++;
199 *p = 0;
200 }
0756eb3c 201
a159f203 202 if ((p = Ustrchr(sdata[0], '(')))
0756eb3c
PH
203 {
204 *p++ = 0;
205 socket = p;
a159f203 206 while (*p && *p != ')') p++;
0756eb3c
PH
207 *p = 0;
208 }
209
a159f203 210 if ((p = Ustrchr(sdata[0], ':')))
0756eb3c
PH
211 {
212 *p++ = 0;
213 port = Uatoi(p);
214 }
215
a159f203 216 if (Ustrchr(sdata[0], '/'))
0756eb3c
PH
217 {
218 *errmsg = string_sprintf("unexpected slash in MySQL server hostname: %s",
219 sdata[0]);
220 *defer_break = TRUE;
221 return DEFER;
222 }
223
224 /* If the database is the empty string, set it NULL - the query must then
225 define it. */
226
227 if (sdata[1][0] == 0) sdata[1] = NULL;
228
229 DEBUG(D_lookup)
42c7f0b4 230 debug_printf_indent("MYSQL new connection: host=%s port=%d socket=%s "
0756eb3c
PH
231 "database=%s user=%s\n", sdata[0], port, socket, sdata[1], sdata[2]);
232
233 /* Get store for a new handle, initialize it, and connect to the server */
234
f3ebb786 235 mysql_handle = store_get(sizeof(MYSQL), FALSE);
0756eb3c 236 mysql_init(mysql_handle);
a159f203 237 mysql_options(mysql_handle, MYSQL_READ_DEFAULT_GROUP, CS group);
0756eb3c
PH
238 if (mysql_real_connect(mysql_handle,
239 /* host user passwd database */
240 CS sdata[0], CS sdata[2], CS sdata[3], CS sdata[1],
f6efe9ce 241 port, CS socket, CLIENT_MULTI_RESULTS) == NULL)
0756eb3c
PH
242 {
243 *errmsg = string_sprintf("MYSQL connection failed: %s",
244 mysql_error(mysql_handle));
245 *defer_break = FALSE;
246 goto MYSQL_EXIT;
247 }
248
249 /* Add the connection to the cache */
250
f3ebb786 251 cn = store_get(sizeof(mysql_connection), FALSE);
0756eb3c
PH
252 cn->server = server_copy;
253 cn->handle = mysql_handle;
254 cn->next = mysql_connections;
255 mysql_connections = cn;
256 }
257
258/* Else use a previously cached connection */
259
260else
261 {
262 DEBUG(D_lookup)
42c7f0b4 263 debug_printf_indent("MYSQL using cached connection for %s\n", server_copy);
0756eb3c
PH
264 }
265
266/* Run the query */
267
268if (mysql_query(mysql_handle, CS query) != 0)
269 {
270 *errmsg = string_sprintf("MYSQL: query failed: %s\n",
271 mysql_error(mysql_handle));
272 *defer_break = FALSE;
273 goto MYSQL_EXIT;
274 }
275
276/* Pick up the result. If the query was not of the type that returns data,
277namely INSERT, UPDATE, or DELETE, an error occurs here. However, this situation
278can be detected by calling mysql_field_count(). If its result is zero, no data
279was expected (this is all explained clearly in the MySQL manual). In this case,
280we return the number of rows affected by the command. In this event, we do NOT
281want to cache the result; also the whole cache for the handle must be cleaned
14b3c5bc 282up. Setting do_cache zero requests this. */
0756eb3c 283
ba0e37b1 284if (!(mysql_result = mysql_use_result(mysql_handle)))
0756eb3c
PH
285 {
286 if ( mysql_field_count(mysql_handle) == 0 )
287 {
42c7f0b4 288 DEBUG(D_lookup) debug_printf_indent("MYSQL: query was not one that returns data\n");
acec9514
JH
289 result = string_cat(result,
290 string_sprintf("%d", mysql_affected_rows(mysql_handle)));
14b3c5bc 291 *do_cache = 0;
0756eb3c
PH
292 goto MYSQL_EXIT;
293 }
294 *errmsg = string_sprintf("MYSQL: lookup result failed: %s\n",
295 mysql_error(mysql_handle));
296 *defer_break = FALSE;
297 goto MYSQL_EXIT;
298 }
299
300/* Find the number of fields returned. If this is one, we don't add field
301names to the data. Otherwise we do. */
302
303num_fields = mysql_num_fields(mysql_result);
304
305/* Get the fields and construct the result string. If there is more than one
306row, we insert '\n' between them. */
307
308fields = mysql_fetch_fields(mysql_result);
309
acec9514 310while ((mysql_row_data = mysql_fetch_row(mysql_result)))
0756eb3c
PH
311 {
312 unsigned long *lengths = mysql_fetch_lengths(mysql_result);
313
acec9514
JH
314 if (result)
315 result = string_catn(result, US"\n", 1);
0756eb3c 316
ba0e37b1 317 if (num_fields != 1)
d7978c0f 318 for (int i = 0; i < num_fields; i++)
ba0e37b1
JH
319 result = lf_quote(US fields[i].name, US mysql_row_data[i], lengths[i],
320 result);
0756eb3c 321
ba0e37b1
JH
322 else if (mysql_row_data[0] != NULL) /* NULL value yields nothing */
323 result = string_catn(result, US mysql_row_data[0], lengths[0]);
0756eb3c
PH
324 }
325
f6efe9ce
NM
326/* more results? -1 = no, >0 = error, 0 = yes (keep looping)
327 This is needed because of the CLIENT_MULTI_RESULTS on mysql_real_connect(),
328 we don't expect any more results. */
329
ba0e37b1
JH
330while((i = mysql_next_result(mysql_handle)) >= 0)
331 {
332 if(i == 0) /* Just ignore more results */
333 {
42c7f0b4 334 DEBUG(D_lookup) debug_printf_indent("MYSQL: got unexpected more results\n");
ba0e37b1
JH
335 continue;
336 }
f6efe9ce 337
ba0e37b1
JH
338 *errmsg = string_sprintf(
339 "MYSQL: lookup result error when checking for more results: %s\n",
340 mysql_error(mysql_handle));
341 goto MYSQL_EXIT;
342 }
f6efe9ce 343
0756eb3c
PH
344/* If result is NULL then no data has been found and so we return FAIL.
345Otherwise, we must terminate the string which has been built; string_cat()
346always leaves enough room for a terminating zero. */
347
acec9514 348if (!result)
0756eb3c
PH
349 {
350 yield = FAIL;
351 *errmsg = US"MYSQL: no data found";
352 }
0756eb3c
PH
353
354/* Get here by goto from various error checks and from the case where no data
355was read (e.g. an update query). */
356
357MYSQL_EXIT:
358
359/* Free mysal store for any result that was got; don't close the connection, as
360it is cached. */
361
acec9514 362if (mysql_result) mysql_free_result(mysql_result);
0756eb3c 363
4c04137d 364/* Non-NULL result indicates a successful result */
0756eb3c 365
acec9514 366if (result)
0756eb3c 367 {
ba0e37b1 368 *resultptr = string_from_gstring(result);
f3ebb786 369 gstring_release_unused(result);
0756eb3c
PH
370 return OK;
371 }
372else
373 {
42c7f0b4 374 DEBUG(D_lookup) debug_printf_indent("%s\n", *errmsg);
0756eb3c
PH
375 return yield; /* FAIL or DEFER */
376 }
377}
378
379
380
381
382/*************************************************
383* Find entry point *
384*************************************************/
385
386/* See local README for interface description. The handle and filename
b7670459
PH
387arguments are not used. The code to loop through a list of servers while the
388query is deferred with a retryable error is now in a separate function that is
389shared with other SQL lookups. */
0756eb3c 390
e6d225ae 391static int
d447dbd1 392mysql_find(void * handle, const uschar * filename, const uschar * query,
67a57a5a
JH
393 int length, uschar ** result, uschar ** errmsg, uint * do_cache,
394 const uschar * opts)
0756eb3c 395{
b7670459
PH
396return lf_sqlperform(US"MySQL", US"mysql_servers", mysql_servers, query,
397 result, errmsg, do_cache, perform_mysql_search);
0756eb3c
PH
398}
399
400
401
402/*************************************************
403* Quote entry point *
404*************************************************/
405
406/* The only characters that need to be quoted (with backslash) are newline,
407tab, carriage return, backspace, backslash itself, and the quote characters.
408Percent, and underscore and not escaped. They are only special in contexts
409where they can be wild cards, and this isn't usually the case for data inserted
410from messages, since that isn't likely to be treated as a pattern of any kind.
411Sadly, MySQL doesn't seem to behave like other programs. If you use something
412like "where id="ab\%cd" it does not treat the string as "ab%cd". So you really
413can't quote "on spec".
414
415Arguments:
416 s the string to be quoted
417 opt additional option text or NULL if none
418
419Returns: the processed string or NULL for a bad option
420*/
421
e6d225ae 422static uschar *
0756eb3c
PH
423mysql_quote(uschar *s, uschar *opt)
424{
425register int c;
426int count = 0;
427uschar *t = s;
428uschar *quoted;
429
430if (opt != NULL) return NULL; /* No options recognized */
431
432while ((c = *t++) != 0)
433 if (Ustrchr("\n\t\r\b\'\"\\", c) != NULL) count++;
434
435if (count == 0) return s;
f3ebb786 436t = quoted = store_get(Ustrlen(s) + count + 1, is_tainted(s));
0756eb3c
PH
437
438while ((c = *s++) != 0)
439 {
440 if (Ustrchr("\n\t\r\b\'\"\\", c) != NULL)
441 {
442 *t++ = '\\';
443 switch(c)
444 {
445 case '\n': *t++ = 'n';
446 break;
447 case '\t': *t++ = 't';
448 break;
449 case '\r': *t++ = 'r';
450 break;
451 case '\b': *t++ = 'b';
452 break;
453 default: *t++ = c;
454 break;
455 }
456 }
457 else *t++ = c;
458 }
459
460*t = 0;
461return quoted;
462}
463
6545de78
PP
464
465/*************************************************
466* Version reporting entry point *
467*************************************************/
468
469/* See local README for interface description. */
470
471#include "../version.h"
472
473void
474mysql_version_report(FILE *f)
475{
31beb797
HSHR
476fprintf(f, "Library version: MySQL: Compile: %lu %s [%s]\n"
477 " Runtime: %lu %s\n",
478 (long)EXIM_MxSQL_VERSION_ID, EXIM_MxSQL_VERSION_STR, EXIM_MxSQL_BASE_STR,
479 mysql_get_client_version(), mysql_get_client_info());
6545de78
PP
480#ifdef DYNLOOKUP
481fprintf(f, " Exim version %s\n", EXIM_VERSION_STR);
482#endif
483}
484
e6d225ae
DW
485/* These are the lookup_info blocks for this driver */
486
487static lookup_info mysql_lookup_info = {
488 US"mysql", /* lookup name */
489 lookup_querystyle, /* query-style lookup */
490 mysql_open, /* open function */
491 NULL, /* no check function */
492 mysql_find, /* find function */
493 NULL, /* no close function */
494 mysql_tidy, /* tidy function */
6545de78
PP
495 mysql_quote, /* quoting function */
496 mysql_version_report /* version reporting */
e6d225ae
DW
497};
498
499#ifdef DYNLOOKUP
500#define mysql_lookup_module_info _lookup_module_info
501#endif
502
503static lookup_info *_lookup_list[] = { &mysql_lookup_info };
504lookup_module_info mysql_lookup_module_info = { LOOKUP_MODULE_INFO_MAGIC, _lookup_list, 1 };
0756eb3c
PH
505
506/* End of lookups/mysql.c */