src/src/expand.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2014 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8
   9 /* Functions for handling string expansion. */
  10
  11
  12 #include "exim.h"
  13
  14 /* Recursively called function */
  15
  16 static uschar *expand_string_internal(uschar *, BOOL, uschar **, BOOL, BOOL, BOOL *);
  17 static int_eximarith_t expanded_string_integer(uschar *, BOOL);
  18
  19 #ifdef STAND_ALONE
  20 #ifndef SUPPORT_CRYPTEQ
  21 #define SUPPORT_CRYPTEQ
  22 #endif
  23 #endif
  24
  25 #ifdef LOOKUP_LDAP
  26 #include "lookups/ldap.h"
  27 #endif
  28
  29 #ifdef SUPPORT_CRYPTEQ
  30 #ifdef CRYPT_H
  31 #include <crypt.h>
  32 #endif
  33 #ifndef HAVE_CRYPT16
  34 extern char* crypt16(char*, char*);
  35 #endif
  36 #endif
  37
  38 /* The handling of crypt16() is a mess. I will record below the analysis of the
  39 mess that was sent to me. We decided, however, to make changing this very low
  40 priority, because in practice people are moving away from the crypt()
  41 algorithms nowadays, so it doesn't seem worth it.
  42
  43 <quote>
  44 There is an algorithm named "crypt16" in Ultrix and Tru64.  It crypts
  45 the first 8 characters of the password using a 20-round version of crypt
  46 (standard crypt does 25 rounds).  It then crypts the next 8 characters,
  47 or an empty block if the password is less than 9 characters, using a
  48 20-round version of crypt and the same salt as was used for the first
  49 block.  Charaters after the first 16 are ignored.  It always generates
  50 a 16-byte hash, which is expressed together with the salt as a string
  51 of 24 base 64 digits.  Here are some links to peruse:
  52
  53         http://cvs.pld.org.pl/pam/pamcrypt/crypt16.c?rev=1.2
  54         http://seclists.org/bugtraq/1999/Mar/0076.html
  55
  56 There's a different algorithm named "bigcrypt" in HP-UX, Digital Unix,
  57 and OSF/1.  This is the same as the standard crypt if given a password
  58 of 8 characters or less.  If given more, it first does the same as crypt
  59 using the first 8 characters, then crypts the next 8 (the 9th to 16th)
  60 using as salt the first two base 64 digits from the first hash block.
  61 If the password is more than 16 characters then it crypts the 17th to 24th
  62 characters using as salt the first two base 64 digits from the second hash
  63 block.  And so on: I've seen references to it cutting off the password at
  64 40 characters (5 blocks), 80 (10 blocks), or 128 (16 blocks).  Some links:
  65
  66         http://cvs.pld.org.pl/pam/pamcrypt/bigcrypt.c?rev=1.2
  67         http://seclists.org/bugtraq/1999/Mar/0109.html
  68         http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/HTML/AA-Q0R2D-
  69              TET1_html/sec.c222.html#no_id_208
  70
  71 Exim has something it calls "crypt16".  It will either use a native
  72 crypt16 or its own implementation.  A native crypt16 will presumably
  73 be the one that I called "crypt16" above.  The internal "crypt16"
  74 function, however, is a two-block-maximum implementation of what I called
  75 "bigcrypt".  The documentation matches the internal code.
  76
  77 I suspect that whoever did the "crypt16" stuff for Exim didn't realise
  78 that crypt16 and bigcrypt were different things.
  79
  80 Exim uses the LDAP-style scheme identifier "{crypt16}" to refer
  81 to whatever it is using under that name.  This unfortunately sets a
  82 precedent for using "{crypt16}" to identify two incompatible algorithms
  83 whose output can't be distinguished.  With "{crypt16}" thus rendered
  84 ambiguous, I suggest you deprecate it and invent two new identifiers
  85 for the two algorithms.
  86
  87 Both crypt16 and bigcrypt are very poor algorithms, btw.  Hashing parts
  88 of the password separately means they can be cracked separately, so
  89 the double-length hash only doubles the cracking effort instead of
  90 squaring it.  I recommend salted SHA-1 ({SSHA}), or the Blowfish-based
  91 bcrypt ({CRYPT}$2a$).
  92 </quote>
  93 */
  94
  95
  96
  97 #ifndef nelements
  98 # define nelements(arr) (sizeof(arr) / sizeof(*arr))
  99 #endif
 100
 101 /*************************************************
 102 *            Local statics and tables            *
 103 *************************************************/
 104
 105 /* Table of item names, and corresponding switch numbers. The names must be in
 106 alphabetical order. */
 107
 108 static uschar *item_table[] = {
 109   US"acl",
 110   US"certextract",
 111   US"dlfunc",
 112   US"extract",
 113   US"filter",
 114   US"hash",
 115   US"hmac",
 116   US"if",
 117   US"length",
 118   US"listextract",
 119   US"lookup",
 120   US"map",
 121   US"nhash",
 122   US"perl",
 123   US"prvs",
 124   US"prvscheck",
 125   US"readfile",
 126   US"readsocket",
 127   US"reduce",
 128   US"run",
 129   US"sg",
 130   US"sort",
 131   US"substr",
 132   US"tr" };
 133
 134 enum {
 135   EITEM_ACL,
 136   EITEM_CERTEXTRACT,
 137   EITEM_DLFUNC,
 138   EITEM_EXTRACT,
 139   EITEM_FILTER,
 140   EITEM_HASH,
 141   EITEM_HMAC,
 142   EITEM_IF,
 143   EITEM_LENGTH,
 144   EITEM_LISTEXTRACT,
 145   EITEM_LOOKUP,
 146   EITEM_MAP,
 147   EITEM_NHASH,
 148   EITEM_PERL,
 149   EITEM_PRVS,
 150   EITEM_PRVSCHECK,
 151   EITEM_READFILE,
 152   EITEM_READSOCK,
 153   EITEM_REDUCE,
 154   EITEM_RUN,
 155   EITEM_SG,
 156   EITEM_SORT,
 157   EITEM_SUBSTR,
 158   EITEM_TR };
 159
 160 /* Tables of operator names, and corresponding switch numbers. The names must be
 161 in alphabetical order. There are two tables, because underscore is used in some
 162 cases to introduce arguments, whereas for other it is part of the name. This is
 163 an historical mis-design. */
 164
 165 static uschar *op_table_underscore[] = {
 166   US"from_utf8",
 167   US"local_part",
 168   US"quote_local_part",
 169   US"reverse_ip",
 170   US"time_eval",
 171   US"time_interval"};
 172
 173 enum {
 174   EOP_FROM_UTF8,
 175   EOP_LOCAL_PART,
 176   EOP_QUOTE_LOCAL_PART,
 177   EOP_REVERSE_IP,
 178   EOP_TIME_EVAL,
 179   EOP_TIME_INTERVAL };
 180
 181 static uschar *op_table_main[] = {
 182   US"address",
 183   US"addresses",
 184   US"base62",
 185   US"base62d",
 186   US"domain",
 187   US"escape",
 188   US"eval",
 189   US"eval10",
 190   US"expand",
 191   US"h",
 192   US"hash",
 193   US"hex2b64",
 194   US"hexquote",
 195   US"l",
 196   US"lc",
 197   US"length",
 198   US"listcount",
 199   US"listnamed",
 200   US"mask",
 201   US"md5",
 202   US"nh",
 203   US"nhash",
 204   US"quote",
 205   US"randint",
 206   US"rfc2047",
 207   US"rfc2047d",
 208   US"rxquote",
 209   US"s",
 210   US"sha1",
 211   US"sha256",
 212   US"stat",
 213   US"str2b64",
 214   US"strlen",
 215   US"substr",
 216   US"uc",
 217   US"utf8clean" };
 218
 219 enum {
 220   EOP_ADDRESS =  sizeof(op_table_underscore)/sizeof(uschar *),
 221   EOP_ADDRESSES,
 222   EOP_BASE62,
 223   EOP_BASE62D,
 224   EOP_DOMAIN,
 225   EOP_ESCAPE,
 226   EOP_EVAL,
 227   EOP_EVAL10,
 228   EOP_EXPAND,
 229   EOP_H,
 230   EOP_HASH,
 231   EOP_HEX2B64,
 232   EOP_HEXQUOTE,
 233   EOP_L,
 234   EOP_LC,
 235   EOP_LENGTH,
 236   EOP_LISTCOUNT,
 237   EOP_LISTNAMED,
 238   EOP_MASK,
 239   EOP_MD5,
 240   EOP_NH,
 241   EOP_NHASH,
 242   EOP_QUOTE,
 243   EOP_RANDINT,
 244   EOP_RFC2047,
 245   EOP_RFC2047D,
 246   EOP_RXQUOTE,
 247   EOP_S,
 248   EOP_SHA1,
 249   EOP_SHA256,
 250   EOP_STAT,
 251   EOP_STR2B64,
 252   EOP_STRLEN,
 253   EOP_SUBSTR,
 254   EOP_UC,
 255   EOP_UTF8CLEAN };
 256
 257
 258 /* Table of condition names, and corresponding switch numbers. The names must
 259 be in alphabetical order. */
 260
 261 static uschar *cond_table[] = {
 262   US"<",
 263   US"<=",
 264   US"=",
 265   US"==",     /* Backward compatibility */
 266   US">",
 267   US">=",
 268   US"acl",
 269   US"and",
 270   US"bool",
 271   US"bool_lax",
 272   US"crypteq",
 273   US"def",
 274   US"eq",
 275   US"eqi",
 276   US"exists",
 277   US"first_delivery",
 278   US"forall",
 279   US"forany",
 280   US"ge",
 281   US"gei",
 282   US"gt",
 283   US"gti",
 284   US"inlist",
 285   US"inlisti",
 286   US"isip",
 287   US"isip4",
 288   US"isip6",
 289   US"ldapauth",
 290   US"le",
 291   US"lei",
 292   US"lt",
 293   US"lti",
 294   US"match",
 295   US"match_address",
 296   US"match_domain",
 297   US"match_ip",
 298   US"match_local_part",
 299   US"or",
 300   US"pam",
 301   US"pwcheck",
 302   US"queue_running",
 303   US"radius",
 304   US"saslauthd"
 305 };
 306
 307 enum {
 308   ECOND_NUM_L,
 309   ECOND_NUM_LE,
 310   ECOND_NUM_E,
 311   ECOND_NUM_EE,
 312   ECOND_NUM_G,
 313   ECOND_NUM_GE,
 314   ECOND_ACL,
 315   ECOND_AND,
 316   ECOND_BOOL,
 317   ECOND_BOOL_LAX,
 318   ECOND_CRYPTEQ,
 319   ECOND_DEF,
 320   ECOND_STR_EQ,
 321   ECOND_STR_EQI,
 322   ECOND_EXISTS,
 323   ECOND_FIRST_DELIVERY,
 324   ECOND_FORALL,
 325   ECOND_FORANY,
 326   ECOND_STR_GE,
 327   ECOND_STR_GEI,
 328   ECOND_STR_GT,
 329   ECOND_STR_GTI,
 330   ECOND_INLIST,
 331   ECOND_INLISTI,
 332   ECOND_ISIP,
 333   ECOND_ISIP4,
 334   ECOND_ISIP6,
 335   ECOND_LDAPAUTH,
 336   ECOND_STR_LE,
 337   ECOND_STR_LEI,
 338   ECOND_STR_LT,
 339   ECOND_STR_LTI,
 340   ECOND_MATCH,
 341   ECOND_MATCH_ADDRESS,
 342   ECOND_MATCH_DOMAIN,
 343   ECOND_MATCH_IP,
 344   ECOND_MATCH_LOCAL_PART,
 345   ECOND_OR,
 346   ECOND_PAM,
 347   ECOND_PWCHECK,
 348   ECOND_QUEUE_RUNNING,
 349   ECOND_RADIUS,
 350   ECOND_SASLAUTHD
 351 };
 352
 353
 354 /* Types of table entry */
 355
 356 enum vtypes {
 357   vtype_int,            /* value is address of int */
 358   vtype_filter_int,     /* ditto, but recognized only when filtering */
 359   vtype_ino,            /* value is address of ino_t (not always an int) */
 360   vtype_uid,            /* value is address of uid_t (not always an int) */
 361   vtype_gid,            /* value is address of gid_t (not always an int) */
 362   vtype_bool,           /* value is address of bool */
 363   vtype_stringptr,      /* value is address of pointer to string */
 364   vtype_msgbody,        /* as stringptr, but read when first required */
 365   vtype_msgbody_end,    /* ditto, the end of the message */
 366   vtype_msgheaders,     /* the message's headers, processed */
 367   vtype_msgheaders_raw, /* the message's headers, unprocessed */
 368   vtype_localpart,      /* extract local part from string */
 369   vtype_domain,         /* extract domain from string */
 370   vtype_string_func,    /* value is string returned by given function */
 371   vtype_todbsdin,       /* value not used; generate BSD inbox tod */
 372   vtype_tode,           /* value not used; generate tod in epoch format */
 373   vtype_todel,          /* value not used; generate tod in epoch/usec format */
 374   vtype_todf,           /* value not used; generate full tod */
 375   vtype_todl,           /* value not used; generate log tod */
 376   vtype_todlf,          /* value not used; generate log file datestamp tod */
 377   vtype_todzone,        /* value not used; generate time zone only */
 378   vtype_todzulu,        /* value not used; generate zulu tod */
 379   vtype_reply,          /* value not used; get reply from headers */
 380   vtype_pid,            /* value not used; result is pid */
 381   vtype_host_lookup,    /* value not used; get host name */
 382   vtype_load_avg,       /* value not used; result is int from os_getloadavg */
 383   vtype_pspace,         /* partition space; value is T/F for spool/log */
 384   vtype_pinodes,        /* partition inodes; value is T/F for spool/log */
 385   vtype_cert            /* SSL certificate */
 386   #ifndef DISABLE_DKIM
 387   ,vtype_dkim           /* Lookup of value in DKIM signature */
 388   #endif
 389 };
 390
 391 /* Type for main variable table */
 392
 393 typedef struct {
 394   const char *name;
 395   enum vtypes type;
 396   void       *value;
 397 } var_entry;
 398
 399 /* Type for entries pointing to address/length pairs. Not currently
 400 in use. */
 401
 402 typedef struct {
 403   uschar **address;
 404   int  *length;
 405 } alblock;
 406
 407 static uschar * fn_recipients(void);
 408
 409 /* This table must be kept in alphabetical order. */
 410
 411 static var_entry var_table[] = {
 412   /* WARNING: Do not invent variables whose names start acl_c or acl_m because
 413      they will be confused with user-creatable ACL variables. */
 414   { "acl_arg1",            vtype_stringptr,   &acl_arg[0] },
 415   { "acl_arg2",            vtype_stringptr,   &acl_arg[1] },
 416   { "acl_arg3",            vtype_stringptr,   &acl_arg[2] },
 417   { "acl_arg4",            vtype_stringptr,   &acl_arg[3] },
 418   { "acl_arg5",            vtype_stringptr,   &acl_arg[4] },
 419   { "acl_arg6",            vtype_stringptr,   &acl_arg[5] },
 420   { "acl_arg7",            vtype_stringptr,   &acl_arg[6] },
 421   { "acl_arg8",            vtype_stringptr,   &acl_arg[7] },
 422   { "acl_arg9",            vtype_stringptr,   &acl_arg[8] },
 423   { "acl_narg",            vtype_int,         &acl_narg },
 424   { "acl_verify_message",  vtype_stringptr,   &acl_verify_message },
 425   { "address_data",        vtype_stringptr,   &deliver_address_data },
 426   { "address_file",        vtype_stringptr,   &address_file },
 427   { "address_pipe",        vtype_stringptr,   &address_pipe },
 428   { "authenticated_fail_id",vtype_stringptr,  &authenticated_fail_id },
 429   { "authenticated_id",    vtype_stringptr,   &authenticated_id },
 430   { "authenticated_sender",vtype_stringptr,   &authenticated_sender },
 431   { "authentication_failed",vtype_int,        &authentication_failed },
 432 #ifdef WITH_CONTENT_SCAN
 433   { "av_failed",           vtype_int,         &av_failed },
 434 #endif
 435 #ifdef EXPERIMENTAL_BRIGHTMAIL
 436   { "bmi_alt_location",    vtype_stringptr,   &bmi_alt_location },
 437   { "bmi_base64_tracker_verdict", vtype_stringptr, &bmi_base64_tracker_verdict },
 438   { "bmi_base64_verdict",  vtype_stringptr,   &bmi_base64_verdict },
 439   { "bmi_deliver",         vtype_int,         &bmi_deliver },
 440 #endif
 441   { "body_linecount",      vtype_int,         &body_linecount },
 442   { "body_zerocount",      vtype_int,         &body_zerocount },
 443   { "bounce_recipient",    vtype_stringptr,   &bounce_recipient },
 444   { "bounce_return_size_limit", vtype_int,    &bounce_return_size_limit },
 445   { "caller_gid",          vtype_gid,         &real_gid },
 446   { "caller_uid",          vtype_uid,         &real_uid },
 447   { "compile_date",        vtype_stringptr,   &version_date },
 448   { "compile_number",      vtype_stringptr,   &version_cnumber },
 449   { "config_dir",          vtype_stringptr,   &config_main_directory },
 450   { "config_file",         vtype_stringptr,   &config_main_filename },
 451   { "csa_status",          vtype_stringptr,   &csa_status },
 452 #ifdef EXPERIMENTAL_DCC
 453   { "dcc_header",          vtype_stringptr,   &dcc_header },
 454   { "dcc_result",          vtype_stringptr,   &dcc_result },
 455 #endif
 456 #ifdef WITH_OLD_DEMIME
 457   { "demime_errorlevel",   vtype_int,         &demime_errorlevel },
 458   { "demime_reason",       vtype_stringptr,   &demime_reason },
 459 #endif
 460 #ifndef DISABLE_DKIM
 461   { "dkim_algo",           vtype_dkim,        (void *)DKIM_ALGO },
 462   { "dkim_bodylength",     vtype_dkim,        (void *)DKIM_BODYLENGTH },
 463   { "dkim_canon_body",     vtype_dkim,        (void *)DKIM_CANON_BODY },
 464   { "dkim_canon_headers",  vtype_dkim,        (void *)DKIM_CANON_HEADERS },
 465   { "dkim_copiedheaders",  vtype_dkim,        (void *)DKIM_COPIEDHEADERS },
 466   { "dkim_created",        vtype_dkim,        (void *)DKIM_CREATED },
 467   { "dkim_cur_signer",     vtype_stringptr,   &dkim_cur_signer },
 468   { "dkim_domain",         vtype_stringptr,   &dkim_signing_domain },
 469   { "dkim_expires",        vtype_dkim,        (void *)DKIM_EXPIRES },
 470   { "dkim_headernames",    vtype_dkim,        (void *)DKIM_HEADERNAMES },
 471   { "dkim_identity",       vtype_dkim,        (void *)DKIM_IDENTITY },
 472   { "dkim_key_granularity",vtype_dkim,        (void *)DKIM_KEY_GRANULARITY },
 473   { "dkim_key_nosubdomains",vtype_dkim,       (void *)DKIM_NOSUBDOMAINS },
 474   { "dkim_key_notes",      vtype_dkim,        (void *)DKIM_KEY_NOTES },
 475   { "dkim_key_srvtype",    vtype_dkim,        (void *)DKIM_KEY_SRVTYPE },
 476   { "dkim_key_testing",    vtype_dkim,        (void *)DKIM_KEY_TESTING },
 477   { "dkim_selector",       vtype_stringptr,   &dkim_signing_selector },
 478   { "dkim_signers",        vtype_stringptr,   &dkim_signers },
 479   { "dkim_verify_reason",  vtype_dkim,        (void *)DKIM_VERIFY_REASON },
 480   { "dkim_verify_status",  vtype_dkim,        (void *)DKIM_VERIFY_STATUS},
 481 #endif
 482 #ifdef EXPERIMENTAL_DMARC
 483   { "dmarc_ar_header",     vtype_stringptr,   &dmarc_ar_header },
 484   { "dmarc_domain_policy", vtype_stringptr,   &dmarc_domain_policy },
 485   { "dmarc_status",        vtype_stringptr,   &dmarc_status },
 486   { "dmarc_status_text",   vtype_stringptr,   &dmarc_status_text },
 487   { "dmarc_used_domain",   vtype_stringptr,   &dmarc_used_domain },
 488 #endif
 489   { "dnslist_domain",      vtype_stringptr,   &dnslist_domain },
 490   { "dnslist_matched",     vtype_stringptr,   &dnslist_matched },
 491   { "dnslist_text",        vtype_stringptr,   &dnslist_text },
 492   { "dnslist_value",       vtype_stringptr,   &dnslist_value },
 493   { "domain",              vtype_stringptr,   &deliver_domain },
 494   { "domain_data",         vtype_stringptr,   &deliver_domain_data },
 495 #ifdef EXPERIMENTAL_EVENT
 496   { "event_data",          vtype_stringptr,   &event_data },
 497
 498   /*XXX want to use generic vars for as many of these as possible*/
 499   { "event_defer_errno",   vtype_int,         &event_defer_errno },
 500
 501   { "event_name",          vtype_stringptr,   &event_name },
 502 #endif
 503   { "exim_gid",            vtype_gid,         &exim_gid },
 504   { "exim_path",           vtype_stringptr,   &exim_path },
 505   { "exim_uid",            vtype_uid,         &exim_uid },
 506   { "exim_version",        vtype_stringptr,   &version_string },
 507 #ifdef WITH_OLD_DEMIME
 508   { "found_extension",     vtype_stringptr,   &found_extension },
 509 #endif
 510   { "headers_added",       vtype_string_func, &fn_hdrs_added },
 511   { "home",                vtype_stringptr,   &deliver_home },
 512   { "host",                vtype_stringptr,   &deliver_host },
 513   { "host_address",        vtype_stringptr,   &deliver_host_address },
 514   { "host_data",           vtype_stringptr,   &host_data },
 515   { "host_lookup_deferred",vtype_int,         &host_lookup_deferred },
 516   { "host_lookup_failed",  vtype_int,         &host_lookup_failed },
 517   { "host_port",           vtype_int,         &deliver_host_port },
 518   { "inode",               vtype_ino,         &deliver_inode },
 519   { "interface_address",   vtype_stringptr,   &interface_address },
 520   { "interface_port",      vtype_int,         &interface_port },
 521   { "item",                vtype_stringptr,   &iterate_item },
 522   #ifdef LOOKUP_LDAP
 523   { "ldap_dn",             vtype_stringptr,   &eldap_dn },
 524   #endif
 525   { "load_average",        vtype_load_avg,    NULL },
 526   { "local_part",          vtype_stringptr,   &deliver_localpart },
 527   { "local_part_data",     vtype_stringptr,   &deliver_localpart_data },
 528   { "local_part_prefix",   vtype_stringptr,   &deliver_localpart_prefix },
 529   { "local_part_suffix",   vtype_stringptr,   &deliver_localpart_suffix },
 530   { "local_scan_data",     vtype_stringptr,   &local_scan_data },
 531   { "local_user_gid",      vtype_gid,         &local_user_gid },
 532   { "local_user_uid",      vtype_uid,         &local_user_uid },
 533   { "localhost_number",    vtype_int,         &host_number },
 534   { "log_inodes",          vtype_pinodes,     (void *)FALSE },
 535   { "log_space",           vtype_pspace,      (void *)FALSE },
 536   { "lookup_dnssec_authenticated",vtype_stringptr,&lookup_dnssec_authenticated},
 537   { "mailstore_basename",  vtype_stringptr,   &mailstore_basename },
 538 #ifdef WITH_CONTENT_SCAN
 539   { "malware_name",        vtype_stringptr,   &malware_name },
 540 #endif
 541   { "max_received_linelength", vtype_int,     &max_received_linelength },
 542   { "message_age",         vtype_int,         &message_age },
 543   { "message_body",        vtype_msgbody,     &message_body },
 544   { "message_body_end",    vtype_msgbody_end, &message_body_end },
 545   { "message_body_size",   vtype_int,         &message_body_size },
 546   { "message_exim_id",     vtype_stringptr,   &message_id },
 547   { "message_headers",     vtype_msgheaders,  NULL },
 548   { "message_headers_raw", vtype_msgheaders_raw, NULL },
 549   { "message_id",          vtype_stringptr,   &message_id },
 550   { "message_linecount",   vtype_int,         &message_linecount },
 551   { "message_size",        vtype_int,         &message_size },
 552 #ifdef WITH_CONTENT_SCAN
 553   { "mime_anomaly_level",  vtype_int,         &mime_anomaly_level },
 554   { "mime_anomaly_text",   vtype_stringptr,   &mime_anomaly_text },
 555   { "mime_boundary",       vtype_stringptr,   &mime_boundary },
 556   { "mime_charset",        vtype_stringptr,   &mime_charset },
 557   { "mime_content_description", vtype_stringptr, &mime_content_description },
 558   { "mime_content_disposition", vtype_stringptr, &mime_content_disposition },
 559   { "mime_content_id",     vtype_stringptr,   &mime_content_id },
 560   { "mime_content_size",   vtype_int,         &mime_content_size },
 561   { "mime_content_transfer_encoding",vtype_stringptr, &mime_content_transfer_encoding },
 562   { "mime_content_type",   vtype_stringptr,   &mime_content_type },
 563   { "mime_decoded_filename", vtype_stringptr, &mime_decoded_filename },
 564   { "mime_filename",       vtype_stringptr,   &mime_filename },
 565   { "mime_is_coverletter", vtype_int,         &mime_is_coverletter },
 566   { "mime_is_multipart",   vtype_int,         &mime_is_multipart },
 567   { "mime_is_rfc822",      vtype_int,         &mime_is_rfc822 },
 568   { "mime_part_count",     vtype_int,         &mime_part_count },
 569 #endif
 570   { "n0",                  vtype_filter_int,  &filter_n[0] },
 571   { "n1",                  vtype_filter_int,  &filter_n[1] },
 572   { "n2",                  vtype_filter_int,  &filter_n[2] },
 573   { "n3",                  vtype_filter_int,  &filter_n[3] },
 574   { "n4",                  vtype_filter_int,  &filter_n[4] },
 575   { "n5",                  vtype_filter_int,  &filter_n[5] },
 576   { "n6",                  vtype_filter_int,  &filter_n[6] },
 577   { "n7",                  vtype_filter_int,  &filter_n[7] },
 578   { "n8",                  vtype_filter_int,  &filter_n[8] },
 579   { "n9",                  vtype_filter_int,  &filter_n[9] },
 580   { "original_domain",     vtype_stringptr,   &deliver_domain_orig },
 581   { "original_local_part", vtype_stringptr,   &deliver_localpart_orig },
 582   { "originator_gid",      vtype_gid,         &originator_gid },
 583   { "originator_uid",      vtype_uid,         &originator_uid },
 584   { "parent_domain",       vtype_stringptr,   &deliver_domain_parent },
 585   { "parent_local_part",   vtype_stringptr,   &deliver_localpart_parent },
 586   { "pid",                 vtype_pid,         NULL },
 587   { "primary_hostname",    vtype_stringptr,   &primary_hostname },
 588 #ifdef EXPERIMENTAL_PROXY
 589   { "proxy_host_address",  vtype_stringptr,   &proxy_host_address },
 590   { "proxy_host_port",     vtype_int,         &proxy_host_port },
 591   { "proxy_session",       vtype_bool,        &proxy_session },
 592   { "proxy_target_address",vtype_stringptr,   &proxy_target_address },
 593   { "proxy_target_port",   vtype_int,         &proxy_target_port },
 594 #endif
 595   { "prvscheck_address",   vtype_stringptr,   &prvscheck_address },
 596   { "prvscheck_keynum",    vtype_stringptr,   &prvscheck_keynum },
 597   { "prvscheck_result",    vtype_stringptr,   &prvscheck_result },
 598   { "qualify_domain",      vtype_stringptr,   &qualify_domain_sender },
 599   { "qualify_recipient",   vtype_stringptr,   &qualify_domain_recipient },
 600   { "rcpt_count",          vtype_int,         &rcpt_count },
 601   { "rcpt_defer_count",    vtype_int,         &rcpt_defer_count },
 602   { "rcpt_fail_count",     vtype_int,         &rcpt_fail_count },
 603   { "received_count",      vtype_int,         &received_count },
 604   { "received_for",        vtype_stringptr,   &received_for },
 605   { "received_ip_address", vtype_stringptr,   &interface_address },
 606   { "received_port",       vtype_int,         &interface_port },
 607   { "received_protocol",   vtype_stringptr,   &received_protocol },
 608   { "received_time",       vtype_int,         &received_time },
 609   { "recipient_data",      vtype_stringptr,   &recipient_data },
 610   { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
 611   { "recipients",          vtype_string_func, &fn_recipients },
 612   { "recipients_count",    vtype_int,         &recipients_count },
 613 #ifdef WITH_CONTENT_SCAN
 614   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 615 #endif
 616   { "reply_address",       vtype_reply,       NULL },
 617   { "return_path",         vtype_stringptr,   &return_path },
 618   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
 619   { "router_name",         vtype_stringptr,   &router_name },
 620   { "runrc",               vtype_int,         &runrc },
 621   { "self_hostname",       vtype_stringptr,   &self_hostname },
 622   { "sender_address",      vtype_stringptr,   &sender_address },
 623   { "sender_address_data", vtype_stringptr,   &sender_address_data },
 624   { "sender_address_domain", vtype_domain,    &sender_address },
 625   { "sender_address_local_part", vtype_localpart, &sender_address },
 626   { "sender_data",         vtype_stringptr,   &sender_data },
 627   { "sender_fullhost",     vtype_stringptr,   &sender_fullhost },
 628   { "sender_helo_name",    vtype_stringptr,   &sender_helo_name },
 629   { "sender_host_address", vtype_stringptr,   &sender_host_address },
 630   { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated },
 631   { "sender_host_dnssec",  vtype_bool,        &sender_host_dnssec },
 632   { "sender_host_name",    vtype_host_lookup, NULL },
 633   { "sender_host_port",    vtype_int,         &sender_host_port },
 634   { "sender_ident",        vtype_stringptr,   &sender_ident },
 635   { "sender_rate",         vtype_stringptr,   &sender_rate },
 636   { "sender_rate_limit",   vtype_stringptr,   &sender_rate_limit },
 637   { "sender_rate_period",  vtype_stringptr,   &sender_rate_period },
 638   { "sender_rcvhost",      vtype_stringptr,   &sender_rcvhost },
 639   { "sender_verify_failure",vtype_stringptr,  &sender_verify_failure },
 640   { "sending_ip_address",  vtype_stringptr,   &sending_ip_address },
 641   { "sending_port",        vtype_int,         &sending_port },
 642   { "smtp_active_hostname", vtype_stringptr,  &smtp_active_hostname },
 643   { "smtp_command",        vtype_stringptr,   &smtp_cmd_buffer },
 644   { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
 645   { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
 646   { "smtp_notquit_reason", vtype_stringptr,   &smtp_notquit_reason },
 647   { "sn0",                 vtype_filter_int,  &filter_sn[0] },
 648   { "sn1",                 vtype_filter_int,  &filter_sn[1] },
 649   { "sn2",                 vtype_filter_int,  &filter_sn[2] },
 650   { "sn3",                 vtype_filter_int,  &filter_sn[3] },
 651   { "sn4",                 vtype_filter_int,  &filter_sn[4] },
 652   { "sn5",                 vtype_filter_int,  &filter_sn[5] },
 653   { "sn6",                 vtype_filter_int,  &filter_sn[6] },
 654   { "sn7",                 vtype_filter_int,  &filter_sn[7] },
 655   { "sn8",                 vtype_filter_int,  &filter_sn[8] },
 656   { "sn9",                 vtype_filter_int,  &filter_sn[9] },
 657 #ifdef WITH_CONTENT_SCAN
 658   { "spam_bar",            vtype_stringptr,   &spam_bar },
 659   { "spam_report",         vtype_stringptr,   &spam_report },
 660   { "spam_score",          vtype_stringptr,   &spam_score },
 661   { "spam_score_int",      vtype_stringptr,   &spam_score_int },
 662 #endif
 663 #ifdef EXPERIMENTAL_SPF
 664   { "spf_guess",           vtype_stringptr,   &spf_guess },
 665   { "spf_header_comment",  vtype_stringptr,   &spf_header_comment },
 666   { "spf_received",        vtype_stringptr,   &spf_received },
 667   { "spf_result",          vtype_stringptr,   &spf_result },
 668   { "spf_smtp_comment",    vtype_stringptr,   &spf_smtp_comment },
 669 #endif
 670   { "spool_directory",     vtype_stringptr,   &spool_directory },
 671   { "spool_inodes",        vtype_pinodes,     (void *)TRUE },
 672   { "spool_space",         vtype_pspace,      (void *)TRUE },
 673 #ifdef EXPERIMENTAL_SRS
 674   { "srs_db_address",      vtype_stringptr,   &srs_db_address },
 675   { "srs_db_key",          vtype_stringptr,   &srs_db_key },
 676   { "srs_orig_recipient",  vtype_stringptr,   &srs_orig_recipient },
 677   { "srs_orig_sender",     vtype_stringptr,   &srs_orig_sender },
 678   { "srs_recipient",       vtype_stringptr,   &srs_recipient },
 679   { "srs_status",          vtype_stringptr,   &srs_status },
 680 #endif
 681   { "thisaddress",         vtype_stringptr,   &filter_thisaddress },
 682
 683   /* The non-(in,out) variables are now deprecated */
 684   { "tls_bits",            vtype_int,         &tls_in.bits },
 685   { "tls_certificate_verified", vtype_int,    &tls_in.certificate_verified },
 686   { "tls_cipher",          vtype_stringptr,   &tls_in.cipher },
 687
 688   { "tls_in_bits",         vtype_int,         &tls_in.bits },
 689   { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
 690   { "tls_in_cipher",       vtype_stringptr,   &tls_in.cipher },
 691   { "tls_in_ocsp",         vtype_int,         &tls_in.ocsp },
 692   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
 693   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
 694   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },
 695 #if defined(SUPPORT_TLS)
 696   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 697 #endif
 698   { "tls_out_bits",        vtype_int,         &tls_out.bits },
 699   { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
 700   { "tls_out_cipher",      vtype_stringptr,   &tls_out.cipher },
 701 #ifdef EXPERIMENTAL_DANE
 702   { "tls_out_dane",        vtype_bool,        &tls_out.dane_verified },
 703 #endif
 704   { "tls_out_ocsp",        vtype_int,         &tls_out.ocsp },
 705   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
 706   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
 707   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },
 708 #if defined(SUPPORT_TLS)
 709   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 710 #endif
 711 #ifdef EXPERIMENTAL_DANE
 712   { "tls_out_tlsa_usage",  vtype_int,         &tls_out.tlsa_usage },
 713 #endif
 714
 715   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn }, /* mind the alphabetical order! */
 716 #if defined(SUPPORT_TLS)
 717   { "tls_sni",             vtype_stringptr,   &tls_in.sni },    /* mind the alphabetical order! */
 718 #endif
 719
 720   { "tod_bsdinbox",        vtype_todbsdin,    NULL },
 721   { "tod_epoch",           vtype_tode,        NULL },
 722   { "tod_epoch_l",         vtype_todel,       NULL },
 723   { "tod_full",            vtype_todf,        NULL },
 724   { "tod_log",             vtype_todl,        NULL },
 725   { "tod_logfile",         vtype_todlf,       NULL },
 726   { "tod_zone",            vtype_todzone,     NULL },
 727   { "tod_zulu",            vtype_todzulu,     NULL },
 728   { "transport_name",      vtype_stringptr,   &transport_name },
 729   { "value",               vtype_stringptr,   &lookup_value },
 730   { "verify_mode",         vtype_stringptr,   &verify_mode },
 731   { "version_number",      vtype_stringptr,   &version_string },
 732   { "warn_message_delay",  vtype_stringptr,   &warnmsg_delay },
 733   { "warn_message_recipient",vtype_stringptr, &warnmsg_recipients },
 734   { "warn_message_recipients",vtype_stringptr,&warnmsg_recipients },
 735   { "warnmsg_delay",       vtype_stringptr,   &warnmsg_delay },
 736   { "warnmsg_recipient",   vtype_stringptr,   &warnmsg_recipients },
 737   { "warnmsg_recipients",  vtype_stringptr,   &warnmsg_recipients }
 738 };
 739
 740 static int var_table_size = sizeof(var_table)/sizeof(var_entry);
 741 static uschar var_buffer[256];
 742 static BOOL malformed_header;
 743
 744 /* For textual hashes */
 745
 746 static const char *hashcodes = "abcdefghijklmnopqrtsuvwxyz"
 747                                "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 748                                "0123456789";
 749
 750 enum { HMAC_MD5, HMAC_SHA1 };
 751
 752 /* For numeric hashes */
 753
 754 static unsigned int prime[] = {
 755   2,   3,   5,   7,  11,  13,  17,  19,  23,  29,
 756  31,  37,  41,  43,  47,  53,  59,  61,  67,  71,
 757  73,  79,  83,  89,  97, 101, 103, 107, 109, 113};
 758
 759 /* For printing modes in symbolic form */
 760
 761 static uschar *mtable_normal[] =
 762   { US"---", US"--x", US"-w-", US"-wx", US"r--", US"r-x", US"rw-", US"rwx" };
 763
 764 static uschar *mtable_setid[] =
 765   { US"--S", US"--s", US"-wS", US"-ws", US"r-S", US"r-s", US"rwS", US"rws" };
 766
 767 static uschar *mtable_sticky[] =
 768   { US"--T", US"--t", US"-wT", US"-wt", US"r-T", US"r-t", US"rwT", US"rwt" };
 769
 770
 771
 772 /*************************************************
 773 *           Tables for UTF-8 support             *
 774 *************************************************/
 775
 776 /* Table of the number of extra characters, indexed by the first character
 777 masked with 0x3f. The highest number for a valid UTF-8 character is in fact
 778 0x3d. */
 779
 780 static uschar utf8_table1[] = {
 781   1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
 782   1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
 783   2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
 784   3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
 785
 786 /* These are the masks for the data bits in the first byte of a character,
 787 indexed by the number of additional bytes. */
 788
 789 static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
 790
 791 /* Get the next UTF-8 character, advancing the pointer. */
 792
 793 #define GETUTF8INC(c, ptr) \
 794   c = *ptr++; \
 795   if ((c & 0xc0) == 0xc0) \
 796     { \
 797     int a = utf8_table1[c & 0x3f];  /* Number of additional bytes */ \
 798     int s = 6*a; \
 799     c = (c & utf8_table2[a]) << s; \
 800     while (a-- > 0) \
 801       { \
 802       s -= 6; \
 803       c |= (*ptr++ & 0x3f) << s; \
 804       } \
 805     }
 806
 807
 808 /*************************************************
 809 *           Binary chop search on a table        *
 810 *************************************************/
 811
 812 /* This is used for matching expansion items and operators.
 813
 814 Arguments:
 815   name        the name that is being sought
 816   table       the table to search
 817   table_size  the number of items in the table
 818
 819 Returns:      the offset in the table, or -1
 820 */
 821
 822 static int
 823 chop_match(uschar *name, uschar **table, int table_size)
 824 {
 825 uschar **bot = table;
 826 uschar **top = table + table_size;
 827
 828 while (top > bot)
 829   {
 830   uschar **mid = bot + (top - bot)/2;
 831   int c = Ustrcmp(name, *mid);
 832   if (c == 0) return mid - table;
 833   if (c > 0) bot = mid + 1; else top = mid;
 834   }
 835
 836 return -1;
 837 }
 838
 839
 840
 841 /*************************************************
 842 *          Check a condition string              *
 843 *************************************************/
 844
 845 /* This function is called to expand a string, and test the result for a "true"
 846 or "false" value. Failure of the expansion yields FALSE; logged unless it was a
 847 forced fail or lookup defer.
 848
 849 We used to release all store used, but this is not not safe due
 850 to ${dlfunc } and ${acl }.  In any case expand_string_internal()
 851 is reasonably careful to release what it can.
 852
 853 The actual false-value tests should be replicated for ECOND_BOOL_LAX.
 854
 855 Arguments:
 856   condition     the condition string
 857   m1            text to be incorporated in panic error
 858   m2            ditto
 859
 860 Returns:        TRUE if condition is met, FALSE if not
 861 */
 862
 863 BOOL
 864 expand_check_condition(uschar *condition, uschar *m1, uschar *m2)
 865 {
 866 int rc;
 867 uschar *ss = expand_string(condition);
 868 if (ss == NULL)
 869   {
 870   if (!expand_string_forcedfail && !search_find_defer)
 871     log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand condition \"%s\" "
 872       "for %s %s: %s", condition, m1, m2, expand_string_message);
 873   return FALSE;
 874   }
 875 rc = ss[0] != 0 && Ustrcmp(ss, "0") != 0 && strcmpic(ss, US"no") != 0 &&
 876   strcmpic(ss, US"false") != 0;
 877 return rc;
 878 }
 879
 880
 881
 882
 883 /*************************************************
 884 *        Pseudo-random number generation         *
 885 *************************************************/
 886
 887 /* Pseudo-random number generation.  The result is not "expected" to be
 888 cryptographically strong but not so weak that someone will shoot themselves
 889 in the foot using it as a nonce in some email header scheme or whatever
 890 weirdness they'll twist this into.  The result should ideally handle fork().
 891
 892 However, if we're stuck unable to provide this, then we'll fall back to
 893 appallingly bad randomness.
 894
 895 If SUPPORT_TLS is defined then this will not be used except as an emergency
 896 fallback.
 897
 898 Arguments:
 899   max       range maximum
 900 Returns     a random number in range [0, max-1]
 901 */
 902
 903 #ifdef SUPPORT_TLS
 904 # define vaguely_random_number vaguely_random_number_fallback
 905 #endif
 906 int
 907 vaguely_random_number(int max)
 908 {
 909 #ifdef SUPPORT_TLS
 910 # undef vaguely_random_number
 911 #endif
 912   static pid_t pid = 0;
 913   pid_t p2;
 914 #if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
 915   struct timeval tv;
 916 #endif
 917
 918   p2 = getpid();
 919   if (p2 != pid)
 920     {
 921     if (pid != 0)
 922       {
 923
 924 #ifdef HAVE_ARC4RANDOM
 925       /* cryptographically strong randomness, common on *BSD platforms, not
 926       so much elsewhere.  Alas. */
 927 #ifndef NOT_HAVE_ARC4RANDOM_STIR
 928       arc4random_stir();
 929 #endif
 930 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 931 #ifdef HAVE_SRANDOMDEV
 932       /* uses random(4) for seeding */
 933       srandomdev();
 934 #else
 935       gettimeofday(&tv, NULL);
 936       srandom(tv.tv_sec | tv.tv_usec | getpid());
 937 #endif
 938 #else
 939       /* Poor randomness and no seeding here */
 940 #endif
 941
 942       }
 943     pid = p2;
 944     }
 945
 946 #ifdef HAVE_ARC4RANDOM
 947   return arc4random() % max;
 948 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 949   return random() % max;
 950 #else
 951   /* This one returns a 16-bit number, definitely not crypto-strong */
 952   return random_number(max);
 953 #endif
 954 }
 955
 956
 957
 958
 959 /*************************************************
 960 *             Pick out a name from a string      *
 961 *************************************************/
 962
 963 /* If the name is too long, it is silently truncated.
 964
 965 Arguments:
 966   name      points to a buffer into which to put the name
 967   max       is the length of the buffer
 968   s         points to the first alphabetic character of the name
 969   extras    chars other than alphanumerics to permit
 970
 971 Returns:    pointer to the first character after the name
 972
 973 Note: The test for *s != 0 in the while loop is necessary because
 974 Ustrchr() yields non-NULL if the character is zero (which is not something
 975 I expected). */
 976
 977 static uschar *
 978 read_name(uschar *name, int max, uschar *s, uschar *extras)
 979 {
 980 int ptr = 0;
 981 while (*s != 0 && (isalnum(*s) || Ustrchr(extras, *s) != NULL))
 982   {
 983   if (ptr < max-1) name[ptr++] = *s;
 984   s++;
 985   }
 986 name[ptr] = 0;
 987 return s;
 988 }
 989
 990
 991
 992 /*************************************************
 993 *     Pick out the rest of a header name         *
 994 *************************************************/
 995
 996 /* A variable name starting $header_ (or just $h_ for those who like
 997 abbreviations) might not be the complete header name because headers can
 998 contain any printing characters in their names, except ':'. This function is
 999 called to read the rest of the name, chop h[eader]_ off the front, and put ':'
1000 on the end, if the name was terminated by white space.
1001
1002 Arguments:
1003   name      points to a buffer in which the name read so far exists
1004   max       is the length of the buffer
1005   s         points to the first character after the name so far, i.e. the
1006             first non-alphameric character after $header_xxxxx
1007
1008 Returns:    a pointer to the first character after the header name
1009 */
1010
1011 static uschar *
1012 read_header_name(uschar *name, int max, uschar *s)
1013 {
1014 int prelen = Ustrchr(name, '_') - name + 1;
1015 int ptr = Ustrlen(name) - prelen;
1016 if (ptr > 0) memmove(name, name+prelen, ptr);
1017 while (mac_isgraph(*s) && *s != ':')
1018   {
1019   if (ptr < max-1) name[ptr++] = *s;
1020   s++;
1021   }
1022 if (*s == ':') s++;
1023 name[ptr++] = ':';
1024 name[ptr] = 0;
1025 return s;
1026 }
1027
1028
1029
1030 /*************************************************
1031 *           Pick out a number from a string      *
1032 *************************************************/
1033
1034 /* Arguments:
1035   n     points to an integer into which to put the number
1036   s     points to the first digit of the number
1037
1038 Returns:  a pointer to the character after the last digit
1039 */
1040
1041 static uschar *
1042 read_number(int *n, uschar *s)
1043 {
1044 *n = 0;
1045 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1046 return s;
1047 }
1048
1049
1050
1051 /*************************************************
1052 *        Extract keyed subfield from a string    *
1053 *************************************************/
1054
1055 /* The yield is in dynamic store; NULL means that the key was not found.
1056
1057 Arguments:
1058   key       points to the name of the key
1059   s         points to the string from which to extract the subfield
1060
1061 Returns:    NULL if the subfield was not found, or
1062             a pointer to the subfield's data
1063 */
1064
1065 static uschar *
1066 expand_getkeyed(uschar *key, uschar *s)
1067 {
1068 int length = Ustrlen(key);
1069 while (isspace(*s)) s++;
1070
1071 /* Loop to search for the key */
1072
1073 while (*s != 0)
1074   {
1075   int dkeylength;
1076   uschar *data;
1077   uschar *dkey = s;
1078
1079   while (*s != 0 && *s != '=' && !isspace(*s)) s++;
1080   dkeylength = s - dkey;
1081   while (isspace(*s)) s++;
1082   if (*s == '=') while (isspace((*(++s))));
1083
1084   data = string_dequote(&s);
1085   if (length == dkeylength && strncmpic(key, dkey, length) == 0)
1086     return data;
1087
1088   while (isspace(*s)) s++;
1089   }
1090
1091 return NULL;
1092 }
1093
1094
1095
1096 static var_entry *
1097 find_var_ent(uschar * name)
1098 {
1099 int first = 0;
1100 int last = var_table_size;
1101
1102 while (last > first)
1103   {
1104   int middle = (first + last)/2;
1105   int c = Ustrcmp(name, var_table[middle].name);
1106
1107   if (c > 0) { first = middle + 1; continue; }
1108   if (c < 0) { last = middle; continue; }
1109   return &var_table[middle];
1110   }
1111 return NULL;
1112 }
1113
1114 /*************************************************
1115 *   Extract numbered subfield from string        *
1116 *************************************************/
1117
1118 /* Extracts a numbered field from a string that is divided by tokens - for
1119 example a line from /etc/passwd is divided by colon characters.  First field is
1120 numbered one.  Negative arguments count from the right. Zero returns the whole
1121 string. Returns NULL if there are insufficient tokens in the string
1122
1123 ***WARNING***
1124 Modifies final argument - this is a dynamically generated string, so that's OK.
1125
1126 Arguments:
1127   field       number of field to be extracted,
1128                 first field = 1, whole string = 0, last field = -1
1129   separators  characters that are used to break string into tokens
1130   s           points to the string from which to extract the subfield
1131
1132 Returns:      NULL if the field was not found,
1133               a pointer to the field's data inside s (modified to add 0)
1134 */
1135
1136 static uschar *
1137 expand_gettokened (int field, uschar *separators, uschar *s)
1138 {
1139 int sep = 1;
1140 int count;
1141 uschar *ss = s;
1142 uschar *fieldtext = NULL;
1143
1144 if (field == 0) return s;
1145
1146 /* Break the line up into fields in place; for field > 0 we stop when we have
1147 done the number of fields we want. For field < 0 we continue till the end of
1148 the string, counting the number of fields. */
1149
1150 count = (field > 0)? field : INT_MAX;
1151
1152 while (count-- > 0)
1153   {
1154   size_t len;
1155
1156   /* Previous field was the last one in the string. For a positive field
1157   number, this means there are not enough fields. For a negative field number,
1158   check that there are enough, and scan back to find the one that is wanted. */
1159
1160   if (sep == 0)
1161     {
1162     if (field > 0 || (-field) > (INT_MAX - count - 1)) return NULL;
1163     if ((-field) == (INT_MAX - count - 1)) return s;
1164     while (field++ < 0)
1165       {
1166       ss--;
1167       while (ss[-1] != 0) ss--;
1168       }
1169     fieldtext = ss;
1170     break;
1171     }
1172
1173   /* Previous field was not last in the string; save its start and put a
1174   zero at its end. */
1175
1176   fieldtext = ss;
1177   len = Ustrcspn(ss, separators);
1178   sep = ss[len];
1179   ss[len] = 0;
1180   ss += len + 1;
1181   }
1182
1183 return fieldtext;
1184 }
1185
1186
1187 static uschar *
1188 expand_getlistele(int field, uschar * list)
1189 {
1190 uschar * tlist= list;
1191 int sep= 0;
1192 uschar dummy;
1193
1194 if(field<0)
1195   {
1196   for(field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
1197   sep= 0;
1198   }
1199 if(field==0) return NULL;
1200 while(--field>0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
1201 return string_nextinlist(&list, &sep, NULL, 0);
1202 }
1203
1204
1205 /* Certificate fields, by name.  Worry about by-OID later */
1206 /* Names are chosen to not have common prefixes */
1207
1208 #ifdef SUPPORT_TLS
1209 typedef struct
1210 {
1211 uschar * name;
1212 int      namelen;
1213 uschar * (*getfn)(void * cert, uschar * mod);
1214 } certfield;
1215 static certfield certfields[] =
1216 {                       /* linear search; no special order */
1217   { US"version",         7,  &tls_cert_version },
1218   { US"serial_number",   13, &tls_cert_serial_number },
1219   { US"subject",         7,  &tls_cert_subject },
1220   { US"notbefore",       9,  &tls_cert_not_before },
1221   { US"notafter",        8,  &tls_cert_not_after },
1222   { US"issuer",          6,  &tls_cert_issuer },
1223   { US"signature",       9,  &tls_cert_signature },
1224   { US"sig_algorithm",   13, &tls_cert_signature_algorithm },
1225   { US"subj_altname",    12, &tls_cert_subject_altname },
1226   { US"ocsp_uri",        8,  &tls_cert_ocsp_uri },
1227   { US"crl_uri",         7,  &tls_cert_crl_uri },
1228 };
1229
1230 static uschar *
1231 expand_getcertele(uschar * field, uschar * certvar)
1232 {
1233 var_entry * vp;
1234 certfield * cp;
1235
1236 if (!(vp = find_var_ent(certvar)))
1237   {
1238   expand_string_message =
1239     string_sprintf("no variable named \"%s\"", certvar);
1240   return NULL;          /* Unknown variable name */
1241   }
1242 /* NB this stops us passing certs around in variable.  Might
1243 want to do that in future */
1244 if (vp->type != vtype_cert)
1245   {
1246   expand_string_message =
1247     string_sprintf("\"%s\" is not a certificate", certvar);
1248   return NULL;          /* Unknown variable name */
1249   }
1250 if (!*(void **)vp->value)
1251   return NULL;
1252
1253 if (*field >= '0' && *field <= '9')
1254   return tls_cert_ext_by_oid(*(void **)vp->value, field, 0);
1255
1256 for(cp = certfields;
1257     cp < certfields + nelements(certfields);
1258     cp++)
1259   if (Ustrncmp(cp->name, field, cp->namelen) == 0)
1260     {
1261     uschar * modifier = *(field += cp->namelen) == ','
1262       ? ++field : NULL;
1263     return (*cp->getfn)( *(void **)vp->value, modifier );
1264     }
1265
1266 expand_string_message =
1267   string_sprintf("bad field selector \"%s\" for certextract", field);
1268 return NULL;
1269 }
1270 #endif  /*SUPPORT_TLS*/
1271
1272 /*************************************************
1273 *        Extract a substring from a string       *
1274 *************************************************/
1275
1276 /* Perform the ${substr or ${length expansion operations.
1277
1278 Arguments:
1279   subject     the input string
1280   value1      the offset from the start of the input string to the start of
1281                 the output string; if negative, count from the right.
1282   value2      the length of the output string, or negative (-1) for unset
1283                 if value1 is positive, unset means "all after"
1284                 if value1 is negative, unset means "all before"
1285   len         set to the length of the returned string
1286
1287 Returns:      pointer to the output string, or NULL if there is an error
1288 */
1289
1290 static uschar *
1291 extract_substr(uschar *subject, int value1, int value2, int *len)
1292 {
1293 int sublen = Ustrlen(subject);
1294
1295 if (value1 < 0)    /* count from right */
1296   {
1297   value1 += sublen;
1298
1299   /* If the position is before the start, skip to the start, and adjust the
1300   length. If the length ends up negative, the substring is null because nothing
1301   can precede. This falls out naturally when the length is unset, meaning "all
1302   to the left". */
1303
1304   if (value1 < 0)
1305     {
1306     value2 += value1;
1307     if (value2 < 0) value2 = 0;
1308     value1 = 0;
1309     }
1310
1311   /* Otherwise an unset length => characters before value1 */
1312
1313   else if (value2 < 0)
1314     {
1315     value2 = value1;
1316     value1 = 0;
1317     }
1318   }
1319
1320 /* For a non-negative offset, if the starting position is past the end of the
1321 string, the result will be the null string. Otherwise, an unset length means
1322 "rest"; just set it to the maximum - it will be cut down below if necessary. */
1323
1324 else
1325   {
1326   if (value1 > sublen)
1327     {
1328     value1 = sublen;
1329     value2 = 0;
1330     }
1331   else if (value2 < 0) value2 = sublen;
1332   }
1333
1334 /* Cut the length down to the maximum possible for the offset value, and get
1335 the required characters. */
1336
1337 if (value1 + value2 > sublen) value2 = sublen - value1;
1338 *len = value2;
1339 return subject + value1;
1340 }
1341
1342
1343
1344
1345 /*************************************************
1346 *            Old-style hash of a string          *
1347 *************************************************/
1348
1349 /* Perform the ${hash expansion operation.
1350
1351 Arguments:
1352   subject     the input string (an expanded substring)
1353   value1      the length of the output string; if greater or equal to the
1354                 length of the input string, the input string is returned
1355   value2      the number of hash characters to use, or 26 if negative
1356   len         set to the length of the returned string
1357
1358 Returns:      pointer to the output string, or NULL if there is an error
1359 */
1360
1361 static uschar *
1362 compute_hash(uschar *subject, int value1, int value2, int *len)
1363 {
1364 int sublen = Ustrlen(subject);
1365
1366 if (value2 < 0) value2 = 26;
1367 else if (value2 > Ustrlen(hashcodes))
1368   {
1369   expand_string_message =
1370     string_sprintf("hash count \"%d\" too big", value2);
1371   return NULL;
1372   }
1373
1374 /* Calculate the hash text. We know it is shorter than the original string, so
1375 can safely place it in subject[] (we know that subject is always itself an
1376 expanded substring). */
1377
1378 if (value1 < sublen)
1379   {
1380   int c;
1381   int i = 0;
1382   int j = value1;
1383   while ((c = (subject[j])) != 0)
1384     {
1385     int shift = (c + j++) & 7;
1386     subject[i] ^= (c << shift) | (c >> (8-shift));
1387     if (++i >= value1) i = 0;
1388     }
1389   for (i = 0; i < value1; i++)
1390     subject[i] = hashcodes[(subject[i]) % value2];
1391   }
1392 else value1 = sublen;
1393
1394 *len = value1;
1395 return subject;
1396 }
1397
1398
1399
1400
1401 /*************************************************
1402 *             Numeric hash of a string           *
1403 *************************************************/
1404
1405 /* Perform the ${nhash expansion operation. The first characters of the
1406 string are treated as most important, and get the highest prime numbers.
1407
1408 Arguments:
1409   subject     the input string
1410   value1      the maximum value of the first part of the result
1411   value2      the maximum value of the second part of the result,
1412                 or negative to produce only a one-part result
1413   len         set to the length of the returned string
1414
1415 Returns:  pointer to the output string, or NULL if there is an error.
1416 */
1417
1418 static uschar *
1419 compute_nhash (uschar *subject, int value1, int value2, int *len)
1420 {
1421 uschar *s = subject;
1422 int i = 0;
1423 unsigned long int total = 0; /* no overflow */
1424
1425 while (*s != 0)
1426   {
1427   if (i == 0) i = sizeof(prime)/sizeof(int) - 1;
1428   total += prime[i--] * (unsigned int)(*s++);
1429   }
1430
1431 /* If value2 is unset, just compute one number */
1432
1433 if (value2 < 0)
1434   {
1435   s = string_sprintf("%d", total % value1);
1436   }
1437
1438 /* Otherwise do a div/mod hash */
1439
1440 else
1441   {
1442   total = total % (value1 * value2);
1443   s = string_sprintf("%d/%d", total/value2, total % value2);
1444   }
1445
1446 *len = Ustrlen(s);
1447 return s;
1448 }
1449
1450
1451
1452
1453
1454 /*************************************************
1455 *     Find the value of a header or headers      *
1456 *************************************************/
1457
1458 /* Multiple instances of the same header get concatenated, and this function
1459 can also return a concatenation of all the header lines. When concatenating
1460 specific headers that contain lists of addresses, a comma is inserted between
1461 them. Otherwise we use a straight concatenation. Because some messages can have
1462 pathologically large number of lines, there is a limit on the length that is
1463 returned. Also, to avoid massive store use which would result from using
1464 string_cat() as it copies and extends strings, we do a preliminary pass to find
1465 out exactly how much store will be needed. On "normal" messages this will be
1466 pretty trivial.
1467
1468 Arguments:
1469   name          the name of the header, without the leading $header_ or $h_,
1470                 or NULL if a concatenation of all headers is required
1471   exists_only   TRUE if called from a def: test; don't need to build a string;
1472                 just return a string that is not "" and not "0" if the header
1473                 exists
1474   newsize       return the size of memory block that was obtained; may be NULL
1475                 if exists_only is TRUE
1476   want_raw      TRUE if called for $rh_ or $rheader_ variables; no processing,
1477                 other than concatenating, will be done on the header. Also used
1478                 for $message_headers_raw.
1479   charset       name of charset to translate MIME words to; used only if
1480                 want_raw is false; if NULL, no translation is done (this is
1481                 used for $bh_ and $bheader_)
1482
1483 Returns:        NULL if the header does not exist, else a pointer to a new
1484                 store block
1485 */
1486
1487 static uschar *
1488 find_header(uschar *name, BOOL exists_only, int *newsize, BOOL want_raw,
1489   uschar *charset)
1490 {
1491 BOOL found = name == NULL;
1492 int comma = 0;
1493 int len = found? 0 : Ustrlen(name);
1494 int i;
1495 uschar *yield = NULL;
1496 uschar *ptr = NULL;
1497
1498 /* Loop for two passes - saves code repetition */
1499
1500 for (i = 0; i < 2; i++)
1501   {
1502   int size = 0;
1503   header_line *h;
1504
1505   for (h = header_list; size < header_insert_maxlen && h != NULL; h = h->next)
1506     {
1507     if (h->type != htype_old && h->text != NULL)  /* NULL => Received: placeholder */
1508       {
1509       if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))
1510         {
1511         int ilen;
1512         uschar *t;
1513
1514         if (exists_only) return US"1";      /* don't need actual string */
1515         found = TRUE;
1516         t = h->text + len;                  /* text to insert */
1517         if (!want_raw)                      /* unless wanted raw, */
1518           while (isspace(*t)) t++;          /* remove leading white space */
1519         ilen = h->slen - (t - h->text);     /* length to insert */
1520
1521         /* Unless wanted raw, remove trailing whitespace, including the
1522         newline. */
1523
1524         if (!want_raw)
1525           while (ilen > 0 && isspace(t[ilen-1])) ilen--;
1526
1527         /* Set comma = 1 if handling a single header and it's one of those
1528         that contains an address list, except when asked for raw headers. Only
1529         need to do this once. */
1530
1531         if (!want_raw && name != NULL && comma == 0 &&
1532             Ustrchr("BCFRST", h->type) != NULL)
1533           comma = 1;
1534
1535         /* First pass - compute total store needed; second pass - compute
1536         total store used, including this header. */
1537
1538         size += ilen + comma + 1;  /* +1 for the newline */
1539
1540         /* Second pass - concatentate the data, up to a maximum. Note that
1541         the loop stops when size hits the limit. */
1542
1543         if (i != 0)
1544           {
1545           if (size > header_insert_maxlen)
1546             {
1547             ilen -= size - header_insert_maxlen - 1;
1548             comma = 0;
1549             }
1550           Ustrncpy(ptr, t, ilen);
1551           ptr += ilen;
1552
1553           /* For a non-raw header, put in the comma if needed, then add
1554           back the newline we removed above, provided there was some text in
1555           the header. */
1556
1557           if (!want_raw && ilen > 0)
1558             {
1559             if (comma != 0) *ptr++ = ',';
1560             *ptr++ = '\n';
1561             }
1562           }
1563         }
1564       }
1565     }
1566
1567   /* At end of first pass, return NULL if no header found. Then truncate size
1568   if necessary, and get the buffer to hold the data, returning the buffer size.
1569   */
1570
1571   if (i == 0)
1572     {
1573     if (!found) return NULL;
1574     if (size > header_insert_maxlen) size = header_insert_maxlen;
1575     *newsize = size + 1;
1576     ptr = yield = store_get(*newsize);
1577     }
1578   }
1579
1580 /* That's all we do for raw header expansion. */
1581
1582 if (want_raw)
1583   {
1584   *ptr = 0;
1585   }
1586
1587 /* Otherwise, remove a final newline and a redundant added comma. Then we do
1588 RFC 2047 decoding, translating the charset if requested. The rfc2047_decode2()
1589 function can return an error with decoded data if the charset translation
1590 fails. If decoding fails, it returns NULL. */
1591
1592 else
1593   {
1594   uschar *decoded, *error;
1595   if (ptr > yield && ptr[-1] == '\n') ptr--;
1596   if (ptr > yield && comma != 0 && ptr[-1] == ',') ptr--;
1597   *ptr = 0;
1598   decoded = rfc2047_decode2(yield, check_rfc2047_length, charset, '?', NULL,
1599     newsize, &error);
1600   if (error != NULL)
1601     {
1602     DEBUG(D_any) debug_printf("*** error in RFC 2047 decoding: %s\n"
1603       "    input was: %s\n", error, yield);
1604     }
1605   if (decoded != NULL) yield = decoded;
1606   }
1607
1608 return yield;
1609 }
1610
1611
1612
1613
1614 /*************************************************
1615 *               Return list of recipients        *
1616 *************************************************/
1617 /* A recipients list is available only during system message filtering,
1618 during ACL processing after DATA, and while expanding pipe commands
1619 generated from a system filter, but not elsewhere. */
1620
1621 static uschar *
1622 fn_recipients(void)
1623 {
1624 if (!enable_dollar_recipients) return NULL; else
1625   {
1626   int size = 128;
1627   int ptr = 0;
1628   int i;
1629   uschar * s = store_get(size);
1630   for (i = 0; i < recipients_count; i++)
1631     {
1632     if (i != 0) s = string_cat(s, &size, &ptr, US", ", 2);
1633     s = string_cat(s, &size, &ptr, recipients_list[i].address,
1634       Ustrlen(recipients_list[i].address));
1635     }
1636   s[ptr] = 0;     /* string_cat() leaves room */
1637   return s;
1638   }
1639 }
1640
1641
1642 /*************************************************
1643 *               Find value of a variable         *
1644 *************************************************/
1645
1646 /* The table of variables is kept in alphabetic order, so we can search it
1647 using a binary chop. The "choplen" variable is nothing to do with the binary
1648 chop.
1649
1650 Arguments:
1651   name          the name of the variable being sought
1652   exists_only   TRUE if this is a def: test; passed on to find_header()
1653   skipping      TRUE => skip any processing evaluation; this is not the same as
1654                   exists_only because def: may test for values that are first
1655                   evaluated here
1656   newsize       pointer to an int which is initially zero; if the answer is in
1657                 a new memory buffer, *newsize is set to its size
1658
1659 Returns:        NULL if the variable does not exist, or
1660                 a pointer to the variable's contents, or
1661                 something non-NULL if exists_only is TRUE
1662 */
1663
1664 static uschar *
1665 find_variable(uschar *name, BOOL exists_only, BOOL skipping, int *newsize)
1666 {
1667 var_entry * vp;
1668 uschar *s, *domain;
1669 uschar **ss;
1670 void * val;
1671
1672 /* Handle ACL variables, whose names are of the form acl_cxxx or acl_mxxx.
1673 Originally, xxx had to be a number in the range 0-9 (later 0-19), but from
1674 release 4.64 onwards arbitrary names are permitted, as long as the first 5
1675 characters are acl_c or acl_m and the sixth is either a digit or an underscore
1676 (this gave backwards compatibility at the changeover). There may be built-in
1677 variables whose names start acl_ but they should never start in this way. This
1678 slightly messy specification is a consequence of the history, needless to say.
1679
1680 If an ACL variable does not exist, treat it as empty, unless strict_acl_vars is
1681 set, in which case give an error. */
1682
1683 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
1684      !isalpha(name[5]))
1685   {
1686   tree_node *node =
1687     tree_search((name[4] == 'c')? acl_var_c : acl_var_m, name + 4);
1688   return (node == NULL)? (strict_acl_vars? NULL : US"") : node->data.ptr;
1689   }
1690
1691 /* Handle $auth<n> variables. */
1692
1693 if (Ustrncmp(name, "auth", 4) == 0)
1694   {
1695   uschar *endptr;
1696   int n = Ustrtoul(name + 4, &endptr, 10);
1697   if (*endptr == 0 && n != 0 && n <= AUTH_VARS)
1698     return (auth_vars[n-1] == NULL)? US"" : auth_vars[n-1];
1699   }
1700
1701 /* For all other variables, search the table */
1702
1703 if (!(vp = find_var_ent(name)))
1704   return NULL;          /* Unknown variable name */
1705
1706 /* Found an existing variable. If in skipping state, the value isn't needed,
1707 and we want to avoid processing (such as looking up the host name). */
1708
1709 if (skipping)
1710   return US"";
1711
1712 val = vp->value;
1713 switch (vp->type)
1714   {
1715   case vtype_filter_int:
1716   if (!filter_running) return NULL;
1717   /* Fall through */
1718   /* VVVVVVVVVVVV */
1719   case vtype_int:
1720   sprintf(CS var_buffer, "%d", *(int *)(val)); /* Integer */
1721   return var_buffer;
1722
1723   case vtype_ino:
1724   sprintf(CS var_buffer, "%ld", (long int)(*(ino_t *)(val))); /* Inode */
1725   return var_buffer;
1726
1727   case vtype_gid:
1728   sprintf(CS var_buffer, "%ld", (long int)(*(gid_t *)(val))); /* gid */
1729   return var_buffer;
1730
1731   case vtype_uid:
1732   sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(val))); /* uid */
1733   return var_buffer;
1734
1735   case vtype_bool:
1736   sprintf(CS var_buffer, "%s", *(BOOL *)(val) ? "yes" : "no"); /* bool */
1737   return var_buffer;
1738
1739   case vtype_stringptr:                      /* Pointer to string */
1740   s = *((uschar **)(val));
1741   return (s == NULL)? US"" : s;
1742
1743   case vtype_pid:
1744   sprintf(CS var_buffer, "%d", (int)getpid()); /* pid */
1745   return var_buffer;
1746
1747   case vtype_load_avg:
1748   sprintf(CS var_buffer, "%d", OS_GETLOADAVG()); /* load_average */
1749   return var_buffer;
1750
1751   case vtype_host_lookup:                    /* Lookup if not done so */
1752   if (sender_host_name == NULL && sender_host_address != NULL &&
1753       !host_lookup_failed && host_name_lookup() == OK)
1754     host_build_sender_fullhost();
1755   return (sender_host_name == NULL)? US"" : sender_host_name;
1756
1757   case vtype_localpart:                      /* Get local part from address */
1758   s = *((uschar **)(val));
1759   if (s == NULL) return US"";
1760   domain = Ustrrchr(s, '@');
1761   if (domain == NULL) return s;
1762   if (domain - s > sizeof(var_buffer) - 1)
1763     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
1764         " in string expansion", sizeof(var_buffer));
1765   Ustrncpy(var_buffer, s, domain - s);
1766   var_buffer[domain - s] = 0;
1767   return var_buffer;
1768
1769   case vtype_domain:                         /* Get domain from address */
1770   s = *((uschar **)(val));
1771   if (s == NULL) return US"";
1772   domain = Ustrrchr(s, '@');
1773   return (domain == NULL)? US"" : domain + 1;
1774
1775   case vtype_msgheaders:
1776   return find_header(NULL, exists_only, newsize, FALSE, NULL);
1777
1778   case vtype_msgheaders_raw:
1779   return find_header(NULL, exists_only, newsize, TRUE, NULL);
1780
1781   case vtype_msgbody:                        /* Pointer to msgbody string */
1782   case vtype_msgbody_end:                    /* Ditto, the end of the msg */
1783   ss = (uschar **)(val);
1784   if (*ss == NULL && deliver_datafile >= 0)  /* Read body when needed */
1785     {
1786     uschar *body;
1787     off_t start_offset = SPOOL_DATA_START_OFFSET;
1788     int len = message_body_visible;
1789     if (len > message_size) len = message_size;
1790     *ss = body = store_malloc(len+1);
1791     body[0] = 0;
1792     if (vp->type == vtype_msgbody_end)
1793       {
1794       struct stat statbuf;
1795       if (fstat(deliver_datafile, &statbuf) == 0)
1796         {
1797         start_offset = statbuf.st_size - len;
1798         if (start_offset < SPOOL_DATA_START_OFFSET)
1799           start_offset = SPOOL_DATA_START_OFFSET;
1800         }
1801       }
1802     lseek(deliver_datafile, start_offset, SEEK_SET);
1803     len = read(deliver_datafile, body, len);
1804     if (len > 0)
1805       {
1806       body[len] = 0;
1807       if (message_body_newlines)   /* Separate loops for efficiency */
1808         {
1809         while (len > 0)
1810           { if (body[--len] == 0) body[len] = ' '; }
1811         }
1812       else
1813         {
1814         while (len > 0)
1815           { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; }
1816         }
1817       }
1818     }
1819   return (*ss == NULL)? US"" : *ss;
1820
1821   case vtype_todbsdin:                       /* BSD inbox time of day */
1822   return tod_stamp(tod_bsdin);
1823
1824   case vtype_tode:                           /* Unix epoch time of day */
1825   return tod_stamp(tod_epoch);
1826
1827   case vtype_todel:                          /* Unix epoch/usec time of day */
1828   return tod_stamp(tod_epoch_l);
1829
1830   case vtype_todf:                           /* Full time of day */
1831   return tod_stamp(tod_full);
1832
1833   case vtype_todl:                           /* Log format time of day */
1834   return tod_stamp(tod_log_bare);            /* (without timezone) */
1835
1836   case vtype_todzone:                        /* Time zone offset only */
1837   return tod_stamp(tod_zone);
1838
1839   case vtype_todzulu:                        /* Zulu time */
1840   return tod_stamp(tod_zulu);
1841
1842   case vtype_todlf:                          /* Log file datestamp tod */
1843   return tod_stamp(tod_log_datestamp_daily);
1844
1845   case vtype_reply:                          /* Get reply address */
1846   s = find_header(US"reply-to:", exists_only, newsize, TRUE,
1847     headers_charset);
1848   if (s != NULL) while (isspace(*s)) s++;
1849   if (s == NULL || *s == 0)
1850     {
1851     *newsize = 0;                            /* For the *s==0 case */
1852     s = find_header(US"from:", exists_only, newsize, TRUE, headers_charset);
1853     }
1854   if (s != NULL)
1855     {
1856     uschar *t;
1857     while (isspace(*s)) s++;
1858     for (t = s; *t != 0; t++) if (*t == '\n') *t = ' ';
1859     while (t > s && isspace(t[-1])) t--;
1860     *t = 0;
1861     }
1862   return (s == NULL)? US"" : s;
1863
1864   case vtype_string_func:
1865     {
1866     uschar * (*fn)() = val;
1867     return fn();
1868     }
1869
1870   case vtype_pspace:
1871     {
1872     int inodes;
1873     sprintf(CS var_buffer, "%d",
1874       receive_statvfs(val == (void *)TRUE, &inodes));
1875     }
1876   return var_buffer;
1877
1878   case vtype_pinodes:
1879     {
1880     int inodes;
1881     (void) receive_statvfs(val == (void *)TRUE, &inodes);
1882     sprintf(CS var_buffer, "%d", inodes);
1883     }
1884   return var_buffer;
1885
1886   case vtype_cert:
1887   return *(void **)val ? US"<cert>" : US"";
1888
1889   #ifndef DISABLE_DKIM
1890   case vtype_dkim:
1891   return dkim_exim_expand_query((int)(long)val);
1892   #endif
1893
1894   }
1895
1896 return NULL;  /* Unknown variable. Silences static checkers. */
1897 }
1898
1899
1900
1901
1902 void
1903 modify_variable(uschar *name, void * value)
1904 {
1905 var_entry * vp;
1906 if ((vp = find_var_ent(name))) vp->value = value;
1907 return;          /* Unknown variable name, fail silently */
1908 }
1909
1910
1911
1912
1913
1914 /*************************************************
1915 *           Read and expand substrings           *
1916 *************************************************/
1917
1918 /* This function is called to read and expand argument substrings for various
1919 expansion items. Some have a minimum requirement that is less than the maximum;
1920 in these cases, the first non-present one is set to NULL.
1921
1922 Arguments:
1923   sub        points to vector of pointers to set
1924   n          maximum number of substrings
1925   m          minimum required
1926   sptr       points to current string pointer
1927   skipping   the skipping flag
1928   check_end  if TRUE, check for final '}'
1929   name       name of item, for error message
1930   resetok    if not NULL, pointer to flag - write FALSE if unsafe to reset
1931              the store.
1932
1933 Returns:     0 OK; string pointer updated
1934              1 curly bracketing error (too few arguments)
1935              2 too many arguments (only if check_end is set); message set
1936              3 other error (expansion failure)
1937 */
1938
1939 static int
1940 read_subs(uschar **sub, int n, int m, uschar **sptr, BOOL skipping,
1941   BOOL check_end, uschar *name, BOOL *resetok)
1942 {
1943 int i;
1944 uschar *s = *sptr;
1945
1946 while (isspace(*s)) s++;
1947 for (i = 0; i < n; i++)
1948   {
1949   if (*s != '{')
1950     {
1951     if (i < m) return 1;
1952     sub[i] = NULL;
1953     break;
1954     }
1955   sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok);
1956   if (sub[i] == NULL) return 3;
1957   if (*s++ != '}') return 1;
1958   while (isspace(*s)) s++;
1959   }
1960 if (check_end && *s++ != '}')
1961   {
1962   if (s[-1] == '{')
1963     {
1964     expand_string_message = string_sprintf("Too many arguments for \"%s\" "
1965       "(max is %d)", name, n);
1966     return 2;
1967     }
1968   return 1;
1969   }
1970
1971 *sptr = s;
1972 return 0;
1973 }
1974
1975
1976
1977
1978 /*************************************************
1979 *     Elaborate message for bad variable         *
1980 *************************************************/
1981
1982 /* For the "unknown variable" message, take a look at the variable's name, and
1983 give additional information about possible ACL variables. The extra information
1984 is added on to expand_string_message.
1985
1986 Argument:   the name of the variable
1987 Returns:    nothing
1988 */
1989
1990 static void
1991 check_variable_error_message(uschar *name)
1992 {
1993 if (Ustrncmp(name, "acl_", 4) == 0)
1994   expand_string_message = string_sprintf("%s (%s)", expand_string_message,
1995     (name[4] == 'c' || name[4] == 'm')?
1996       (isalpha(name[5])?
1997         US"6th character of a user-defined ACL variable must be a digit or underscore" :
1998         US"strict_acl_vars is set"    /* Syntax is OK, it has to be this */
1999       ) :
2000       US"user-defined ACL variables must start acl_c or acl_m");
2001 }
2002
2003
2004
2005 /*
2006 Load args from sub array to globals, and call acl_check().
2007 Sub array will be corrupted on return.
2008
2009 Returns:       OK         access is granted by an ACCEPT verb
2010                DISCARD    access is granted by a DISCARD verb
2011                FAIL       access is denied
2012                FAIL_DROP  access is denied; drop the connection
2013                DEFER      can't tell at the moment
2014                ERROR      disaster
2015 */
2016 static int
2017 eval_acl(uschar ** sub, int nsub, uschar ** user_msgp)
2018 {
2019 int i;
2020 uschar * tmp = NULL;
2021 int sav_narg = acl_narg;
2022 int ret;
2023 extern int acl_where;
2024
2025 if(--nsub > sizeof(acl_arg)/sizeof(*acl_arg)) nsub = sizeof(acl_arg)/sizeof(*acl_arg);
2026 for (i = 0; i < nsub && sub[i+1]; i++)
2027   {
2028   tmp = acl_arg[i];
2029   acl_arg[i] = sub[i+1];        /* place callers args in the globals */
2030   sub[i+1] = tmp;               /* stash the old args using our caller's storage */
2031   }
2032 acl_narg = i;
2033 while (i < nsub)
2034   {
2035   sub[i+1] = acl_arg[i];
2036   acl_arg[i++] = NULL;
2037   }
2038
2039 DEBUG(D_expand)
2040   debug_printf("expanding: acl: %s  arg: %s%s\n",
2041     sub[0],
2042     acl_narg>0 ? acl_arg[0] : US"<none>",
2043     acl_narg>1 ? " +more"   : "");
2044
2045 ret = acl_eval(acl_where, sub[0], user_msgp, &tmp);
2046
2047 for (i = 0; i < nsub; i++)
2048   acl_arg[i] = sub[i+1];        /* restore old args */
2049 acl_narg = sav_narg;
2050
2051 return ret;
2052 }
2053
2054
2055
2056
2057 /*************************************************
2058 *        Read and evaluate a condition           *
2059 *************************************************/
2060
2061 /*
2062 Arguments:
2063   s        points to the start of the condition text
2064   resetok  points to a BOOL which is written false if it is unsafe to
2065            free memory. Certain condition types (acl) may have side-effect
2066            allocation which must be preserved.
2067   yield    points to a BOOL to hold the result of the condition test;
2068            if NULL, we are just reading through a condition that is
2069            part of an "or" combination to check syntax, or in a state
2070            where the answer isn't required
2071
2072 Returns:   a pointer to the first character after the condition, or
2073            NULL after an error
2074 */
2075
2076 static uschar *
2077 eval_condition(uschar *s, BOOL *resetok, BOOL *yield)
2078 {
2079 BOOL testfor = TRUE;
2080 BOOL tempcond, combined_cond;
2081 BOOL *subcondptr;
2082 BOOL sub2_honour_dollar = TRUE;
2083 int i, rc, cond_type, roffset;
2084 int_eximarith_t num[2];
2085 struct stat statbuf;
2086 uschar name[256];
2087 uschar *sub[10];
2088
2089 const pcre *re;
2090 const uschar *rerror;
2091
2092 for (;;)
2093   {
2094   while (isspace(*s)) s++;
2095   if (*s == '!') { testfor = !testfor; s++; } else break;
2096   }
2097
2098 /* Numeric comparisons are symbolic */
2099
2100 if (*s == '=' || *s == '>' || *s == '<')
2101   {
2102   int p = 0;
2103   name[p++] = *s++;
2104   if (*s == '=')
2105     {
2106     name[p++] = '=';
2107     s++;
2108     }
2109   name[p] = 0;
2110   }
2111
2112 /* All other conditions are named */
2113
2114 else s = read_name(name, 256, s, US"_");
2115
2116 /* If we haven't read a name, it means some non-alpha character is first. */
2117
2118 if (name[0] == 0)
2119   {
2120   expand_string_message = string_sprintf("condition name expected, "
2121     "but found \"%.16s\"", s);
2122   return NULL;
2123   }
2124
2125 /* Find which condition we are dealing with, and switch on it */
2126
2127 cond_type = chop_match(name, cond_table, sizeof(cond_table)/sizeof(uschar *));
2128 switch(cond_type)
2129   {
2130   /* def: tests for a non-empty variable, or for the existence of a header. If
2131   yield == NULL we are in a skipping state, and don't care about the answer. */
2132
2133   case ECOND_DEF:
2134   if (*s != ':')
2135     {
2136     expand_string_message = US"\":\" expected after \"def\"";
2137     return NULL;
2138     }
2139
2140   s = read_name(name, 256, s+1, US"_");
2141
2142   /* Test for a header's existence. If the name contains a closing brace
2143   character, this may be a user error where the terminating colon has been
2144   omitted. Set a flag to adjust a subsequent error message in this case. */
2145
2146   if (Ustrncmp(name, "h_", 2) == 0 ||
2147       Ustrncmp(name, "rh_", 3) == 0 ||
2148       Ustrncmp(name, "bh_", 3) == 0 ||
2149       Ustrncmp(name, "header_", 7) == 0 ||
2150       Ustrncmp(name, "rheader_", 8) == 0 ||
2151       Ustrncmp(name, "bheader_", 8) == 0)
2152     {
2153     s = read_header_name(name, 256, s);
2154     /* {-for-text-editors */
2155     if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
2156     if (yield != NULL) *yield =
2157       (find_header(name, TRUE, NULL, FALSE, NULL) != NULL) == testfor;
2158     }
2159
2160   /* Test for a variable's having a non-empty value. A non-existent variable
2161   causes an expansion failure. */
2162
2163   else
2164     {
2165     uschar *value = find_variable(name, TRUE, yield == NULL, NULL);
2166     if (value == NULL)
2167       {
2168       expand_string_message = (name[0] == 0)?
2169         string_sprintf("variable name omitted after \"def:\"") :
2170         string_sprintf("unknown variable \"%s\" after \"def:\"", name);
2171       check_variable_error_message(name);
2172       return NULL;
2173       }
2174     if (yield != NULL) *yield = (value[0] != 0) == testfor;
2175     }
2176
2177   return s;
2178
2179
2180   /* first_delivery tests for first delivery attempt */
2181
2182   case ECOND_FIRST_DELIVERY:
2183   if (yield != NULL) *yield = deliver_firsttime == testfor;
2184   return s;
2185
2186
2187   /* queue_running tests for any process started by a queue runner */
2188
2189   case ECOND_QUEUE_RUNNING:
2190   if (yield != NULL) *yield = (queue_run_pid != (pid_t)0) == testfor;
2191   return s;
2192
2193
2194   /* exists:  tests for file existence
2195        isip:  tests for any IP address
2196       isip4:  tests for an IPv4 address
2197       isip6:  tests for an IPv6 address
2198         pam:  does PAM authentication
2199      radius:  does RADIUS authentication
2200    ldapauth:  does LDAP authentication
2201     pwcheck:  does Cyrus SASL pwcheck authentication
2202   */
2203
2204   case ECOND_EXISTS:
2205   case ECOND_ISIP:
2206   case ECOND_ISIP4:
2207   case ECOND_ISIP6:
2208   case ECOND_PAM:
2209   case ECOND_RADIUS:
2210   case ECOND_LDAPAUTH:
2211   case ECOND_PWCHECK:
2212
2213   while (isspace(*s)) s++;
2214   if (*s != '{') goto COND_FAILED_CURLY_START;          /* }-for-text-editors */
2215
2216   sub[0] = expand_string_internal(s+1, TRUE, &s, yield == NULL, TRUE, resetok);
2217   if (sub[0] == NULL) return NULL;
2218   /* {-for-text-editors */
2219   if (*s++ != '}') goto COND_FAILED_CURLY_END;
2220
2221   if (yield == NULL) return s;   /* No need to run the test if skipping */
2222
2223   switch(cond_type)
2224     {
2225     case ECOND_EXISTS:
2226     if ((expand_forbid & RDO_EXISTS) != 0)
2227       {
2228       expand_string_message = US"File existence tests are not permitted";
2229       return NULL;
2230       }
2231     *yield = (Ustat(sub[0], &statbuf) == 0) == testfor;
2232     break;
2233
2234     case ECOND_ISIP:
2235     case ECOND_ISIP4:
2236     case ECOND_ISIP6:
2237     rc = string_is_ip_address(sub[0], NULL);
2238     *yield = ((cond_type == ECOND_ISIP)? (rc != 0) :
2239              (cond_type == ECOND_ISIP4)? (rc == 4) : (rc == 6)) == testfor;
2240     break;
2241
2242     /* Various authentication tests - all optionally compiled */
2243
2244     case ECOND_PAM:
2245     #ifdef SUPPORT_PAM
2246     rc = auth_call_pam(sub[0], &expand_string_message);
2247     goto END_AUTH;
2248     #else
2249     goto COND_FAILED_NOT_COMPILED;
2250     #endif  /* SUPPORT_PAM */
2251
2252     case ECOND_RADIUS:
2253     #ifdef RADIUS_CONFIG_FILE
2254     rc = auth_call_radius(sub[0], &expand_string_message);
2255     goto END_AUTH;
2256     #else
2257     goto COND_FAILED_NOT_COMPILED;
2258     #endif  /* RADIUS_CONFIG_FILE */
2259
2260     case ECOND_LDAPAUTH:
2261     #ifdef LOOKUP_LDAP
2262       {
2263       /* Just to keep the interface the same */
2264       BOOL do_cache;
2265       int old_pool = store_pool;
2266       store_pool = POOL_SEARCH;
2267       rc = eldapauth_find((void *)(-1), NULL, sub[0], Ustrlen(sub[0]), NULL,
2268         &expand_string_message, &do_cache);
2269       store_pool = old_pool;
2270       }
2271     goto END_AUTH;
2272     #else
2273     goto COND_FAILED_NOT_COMPILED;
2274     #endif  /* LOOKUP_LDAP */
2275
2276     case ECOND_PWCHECK:
2277     #ifdef CYRUS_PWCHECK_SOCKET
2278     rc = auth_call_pwcheck(sub[0], &expand_string_message);
2279     goto END_AUTH;
2280     #else
2281     goto COND_FAILED_NOT_COMPILED;
2282     #endif  /* CYRUS_PWCHECK_SOCKET */
2283
2284     #if defined(SUPPORT_PAM) || defined(RADIUS_CONFIG_FILE) || \
2285         defined(LOOKUP_LDAP) || defined(CYRUS_PWCHECK_SOCKET)
2286     END_AUTH:
2287     if (rc == ERROR || rc == DEFER) return NULL;
2288     *yield = (rc == OK) == testfor;
2289     #endif
2290     }
2291   return s;
2292
2293
2294   /* call ACL (in a conditional context).  Accept true, deny false.
2295   Defer is a forced-fail.  Anything set by message= goes to $value.
2296   Up to ten parameters are used; we use the braces round the name+args
2297   like the saslauthd condition does, to permit a variable number of args.
2298   See also the expansion-item version EITEM_ACL and the traditional
2299   acl modifier ACLC_ACL.
2300   Since the ACL may allocate new global variables, tell our caller to not
2301   reclaim memory.
2302   */
2303
2304   case ECOND_ACL:
2305     /* ${if acl {{name}{arg1}{arg2}...}  {yes}{no}} */
2306     {
2307     uschar *user_msg;
2308     BOOL cond = FALSE;
2309     int size = 0;
2310     int ptr = 0;
2311
2312     while (isspace(*s)) s++;
2313     if (*s++ != '{') goto COND_FAILED_CURLY_START;      /*}*/
2314
2315     switch(read_subs(sub, sizeof(sub)/sizeof(*sub), 1,
2316       &s, yield == NULL, TRUE, US"acl", resetok))
2317       {
2318       case 1: expand_string_message = US"too few arguments or bracketing "
2319         "error for acl";
2320       case 2:
2321       case 3: return NULL;
2322       }
2323
2324     *resetok = FALSE;
2325     if (yield != NULL) switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
2326         {
2327         case OK:
2328           cond = TRUE;
2329         case FAIL:
2330           lookup_value = NULL;
2331           if (user_msg)
2332             {
2333             lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg));
2334             lookup_value[ptr] = '\0';
2335             }
2336           *yield = cond == testfor;
2337           break;
2338
2339         case DEFER:
2340           expand_string_forcedfail = TRUE;
2341         default:
2342           expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
2343           return NULL;
2344         }
2345     return s;
2346     }
2347
2348
2349   /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used:
2350
2351      ${if saslauthd {{username}{password}{service}{realm}}  {yes}{no}}
2352
2353   However, the last two are optional. That is why the whole set is enclosed
2354   in their own set of braces. */
2355
2356   case ECOND_SASLAUTHD:
2357   #ifndef CYRUS_SASLAUTHD_SOCKET
2358   goto COND_FAILED_NOT_COMPILED;
2359   #else
2360   while (isspace(*s)) s++;
2361   if (*s++ != '{') goto COND_FAILED_CURLY_START;        /* }-for-text-editors */
2362   switch(read_subs(sub, 4, 2, &s, yield == NULL, TRUE, US"saslauthd", resetok))
2363     {
2364     case 1: expand_string_message = US"too few arguments or bracketing "
2365       "error for saslauthd";
2366     case 2:
2367     case 3: return NULL;
2368     }
2369   if (sub[2] == NULL) sub[3] = NULL;  /* realm if no service */
2370   if (yield != NULL)
2371     {
2372     int rc;
2373     rc = auth_call_saslauthd(sub[0], sub[1], sub[2], sub[3],
2374       &expand_string_message);
2375     if (rc == ERROR || rc == DEFER) return NULL;
2376     *yield = (rc == OK) == testfor;
2377     }
2378   return s;
2379   #endif /* CYRUS_SASLAUTHD_SOCKET */
2380
2381
2382   /* symbolic operators for numeric and string comparison, and a number of
2383   other operators, all requiring two arguments.
2384
2385   crypteq:           encrypts plaintext and compares against an encrypted text,
2386                        using crypt(), crypt16(), MD5 or SHA-1
2387   inlist/inlisti:    checks if first argument is in the list of the second
2388   match:             does a regular expression match and sets up the numerical
2389                        variables if it succeeds
2390   match_address:     matches in an address list
2391   match_domain:      matches in a domain list
2392   match_ip:          matches a host list that is restricted to IP addresses
2393   match_local_part:  matches in a local part list
2394   */
2395
2396   case ECOND_MATCH_ADDRESS:
2397   case ECOND_MATCH_DOMAIN:
2398   case ECOND_MATCH_IP:
2399   case ECOND_MATCH_LOCAL_PART:
2400 #ifndef EXPAND_LISTMATCH_RHS
2401     sub2_honour_dollar = FALSE;
2402 #endif
2403     /* FALLTHROUGH */
2404
2405   case ECOND_CRYPTEQ:
2406   case ECOND_INLIST:
2407   case ECOND_INLISTI:
2408   case ECOND_MATCH:
2409
2410   case ECOND_NUM_L:     /* Numerical comparisons */
2411   case ECOND_NUM_LE:
2412   case ECOND_NUM_E:
2413   case ECOND_NUM_EE:
2414   case ECOND_NUM_G:
2415   case ECOND_NUM_GE:
2416
2417   case ECOND_STR_LT:    /* String comparisons */
2418   case ECOND_STR_LTI:
2419   case ECOND_STR_LE:
2420   case ECOND_STR_LEI:
2421   case ECOND_STR_EQ:
2422   case ECOND_STR_EQI:
2423   case ECOND_STR_GT:
2424   case ECOND_STR_GTI:
2425   case ECOND_STR_GE:
2426   case ECOND_STR_GEI:
2427
2428   for (i = 0; i < 2; i++)
2429     {
2430     /* Sometimes, we don't expand substrings; too many insecure configurations
2431     created using match_address{}{} and friends, where the second param
2432     includes information from untrustworthy sources. */
2433     BOOL honour_dollar = TRUE;
2434     if ((i > 0) && !sub2_honour_dollar)
2435       honour_dollar = FALSE;
2436
2437     while (isspace(*s)) s++;
2438     if (*s != '{')
2439       {
2440       if (i == 0) goto COND_FAILED_CURLY_START;
2441       expand_string_message = string_sprintf("missing 2nd string in {} "
2442         "after \"%s\"", name);
2443       return NULL;
2444       }
2445     sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
2446         honour_dollar, resetok);
2447     if (sub[i] == NULL) return NULL;
2448     if (*s++ != '}') goto COND_FAILED_CURLY_END;
2449
2450     /* Convert to numerical if required; we know that the names of all the
2451     conditions that compare numbers do not start with a letter. This just saves
2452     checking for them individually. */
2453
2454     if (!isalpha(name[0]) && yield != NULL)
2455       {
2456       if (sub[i][0] == 0)
2457         {
2458         num[i] = 0;
2459         DEBUG(D_expand)
2460           debug_printf("empty string cast to zero for numerical comparison\n");
2461         }
2462       else
2463         {
2464         num[i] = expanded_string_integer(sub[i], FALSE);
2465         if (expand_string_message != NULL) return NULL;
2466         }
2467       }
2468     }
2469
2470   /* Result not required */
2471
2472   if (yield == NULL) return s;
2473
2474   /* Do an appropriate comparison */
2475
2476   switch(cond_type)
2477     {
2478     case ECOND_NUM_E:
2479     case ECOND_NUM_EE:
2480     tempcond = (num[0] == num[1]);
2481     break;
2482
2483     case ECOND_NUM_G:
2484     tempcond = (num[0] > num[1]);
2485     break;
2486
2487     case ECOND_NUM_GE:
2488     tempcond = (num[0] >= num[1]);
2489     break;
2490
2491     case ECOND_NUM_L:
2492     tempcond = (num[0] < num[1]);
2493     break;
2494
2495     case ECOND_NUM_LE:
2496     tempcond = (num[0] <= num[1]);
2497     break;
2498
2499     case ECOND_STR_LT:
2500     tempcond = (Ustrcmp(sub[0], sub[1]) < 0);
2501     break;
2502
2503     case ECOND_STR_LTI:
2504     tempcond = (strcmpic(sub[0], sub[1]) < 0);
2505     break;
2506
2507     case ECOND_STR_LE:
2508     tempcond = (Ustrcmp(sub[0], sub[1]) <= 0);
2509     break;
2510
2511     case ECOND_STR_LEI:
2512     tempcond = (strcmpic(sub[0], sub[1]) <= 0);
2513     break;
2514
2515     case ECOND_STR_EQ:
2516     tempcond = (Ustrcmp(sub[0], sub[1]) == 0);
2517     break;
2518
2519     case ECOND_STR_EQI:
2520     tempcond = (strcmpic(sub[0], sub[1]) == 0);
2521     break;
2522
2523     case ECOND_STR_GT:
2524     tempcond = (Ustrcmp(sub[0], sub[1]) > 0);
2525     break;
2526
2527     case ECOND_STR_GTI:
2528     tempcond = (strcmpic(sub[0], sub[1]) > 0);
2529     break;
2530
2531     case ECOND_STR_GE:
2532     tempcond = (Ustrcmp(sub[0], sub[1]) >= 0);
2533     break;
2534
2535     case ECOND_STR_GEI:
2536     tempcond = (strcmpic(sub[0], sub[1]) >= 0);
2537     break;
2538
2539     case ECOND_MATCH:   /* Regular expression match */
2540     re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
2541       NULL);
2542     if (re == NULL)
2543       {
2544       expand_string_message = string_sprintf("regular expression error in "
2545         "\"%s\": %s at offset %d", sub[1], rerror, roffset);
2546       return NULL;
2547       }
2548     tempcond = regex_match_and_setup(re, sub[0], 0, -1);
2549     break;
2550
2551     case ECOND_MATCH_ADDRESS:  /* Match in an address list */
2552     rc = match_address_list(sub[0], TRUE, FALSE, &(sub[1]), NULL, -1, 0, NULL);
2553     goto MATCHED_SOMETHING;
2554
2555     case ECOND_MATCH_DOMAIN:   /* Match in a domain list */
2556     rc = match_isinlist(sub[0], &(sub[1]), 0, &domainlist_anchor, NULL,
2557       MCL_DOMAIN + MCL_NOEXPAND, TRUE, NULL);
2558     goto MATCHED_SOMETHING;
2559
2560     case ECOND_MATCH_IP:       /* Match IP address in a host list */
2561     if (sub[0][0] != 0 && string_is_ip_address(sub[0], NULL) == 0)
2562       {
2563       expand_string_message = string_sprintf("\"%s\" is not an IP address",
2564         sub[0]);
2565       return NULL;
2566       }
2567     else
2568       {
2569       unsigned int *nullcache = NULL;
2570       check_host_block cb;
2571
2572       cb.host_name = US"";
2573       cb.host_address = sub[0];
2574
2575       /* If the host address starts off ::ffff: it is an IPv6 address in
2576       IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2577       addresses. */
2578
2579       cb.host_ipv4 = (Ustrncmp(cb.host_address, "::ffff:", 7) == 0)?
2580         cb.host_address + 7 : cb.host_address;
2581
2582       rc = match_check_list(
2583              &sub[1],                   /* the list */
2584              0,                         /* separator character */
2585              &hostlist_anchor,          /* anchor pointer */
2586              &nullcache,                /* cache pointer */
2587              check_host,                /* function for testing */
2588              &cb,                       /* argument for function */
2589              MCL_HOST,                  /* type of check */
2590              sub[0],                    /* text for debugging */
2591              NULL);                     /* where to pass back data */
2592       }
2593     goto MATCHED_SOMETHING;
2594
2595     case ECOND_MATCH_LOCAL_PART:
2596     rc = match_isinlist(sub[0], &(sub[1]), 0, &localpartlist_anchor, NULL,
2597       MCL_LOCALPART + MCL_NOEXPAND, TRUE, NULL);
2598     /* Fall through */
2599     /* VVVVVVVVVVVV */
2600     MATCHED_SOMETHING:
2601     switch(rc)
2602       {
2603       case OK:
2604       tempcond = TRUE;
2605       break;
2606
2607       case FAIL:
2608       tempcond = FALSE;
2609       break;
2610
2611       case DEFER:
2612       expand_string_message = string_sprintf("unable to complete match "
2613         "against \"%s\": %s", sub[1], search_error_message);
2614       return NULL;
2615       }
2616
2617     break;
2618
2619     /* Various "encrypted" comparisons. If the second string starts with
2620     "{" then an encryption type is given. Default to crypt() or crypt16()
2621     (build-time choice). */
2622     /* }-for-text-editors */
2623
2624     case ECOND_CRYPTEQ:
2625     #ifndef SUPPORT_CRYPTEQ
2626     goto COND_FAILED_NOT_COMPILED;
2627     #else
2628     if (strncmpic(sub[1], US"{md5}", 5) == 0)
2629       {
2630       int sublen = Ustrlen(sub[1]+5);
2631       md5 base;
2632       uschar digest[16];
2633
2634       md5_start(&base);
2635       md5_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
2636
2637       /* If the length that we are comparing against is 24, the MD5 digest
2638       is expressed as a base64 string. This is the way LDAP does it. However,
2639       some other software uses a straightforward hex representation. We assume
2640       this if the length is 32. Other lengths fail. */
2641
2642       if (sublen == 24)
2643         {
2644         uschar *coded = auth_b64encode((uschar *)digest, 16);
2645         DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
2646           "  subject=%s\n  crypted=%s\n", coded, sub[1]+5);
2647         tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
2648         }
2649       else if (sublen == 32)
2650         {
2651         int i;
2652         uschar coded[36];
2653         for (i = 0; i < 16; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2654         coded[32] = 0;
2655         DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n"
2656           "  subject=%s\n  crypted=%s\n", coded, sub[1]+5);
2657         tempcond = (strcmpic(coded, sub[1]+5) == 0);
2658         }
2659       else
2660         {
2661         DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: "
2662           "fail\n  crypted=%s\n", sub[1]+5);
2663         tempcond = FALSE;
2664         }
2665       }
2666
2667     else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
2668       {
2669       int sublen = Ustrlen(sub[1]+6);
2670       sha1 base;
2671       uschar digest[20];
2672
2673       sha1_start(&base);
2674       sha1_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
2675
2676       /* If the length that we are comparing against is 28, assume the SHA1
2677       digest is expressed as a base64 string. If the length is 40, assume a
2678       straightforward hex representation. Other lengths fail. */
2679
2680       if (sublen == 28)
2681         {
2682         uschar *coded = auth_b64encode((uschar *)digest, 20);
2683         DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
2684           "  subject=%s\n  crypted=%s\n", coded, sub[1]+6);
2685         tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
2686         }
2687       else if (sublen == 40)
2688         {
2689         int i;
2690         uschar coded[44];
2691         for (i = 0; i < 20; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2692         coded[40] = 0;
2693         DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n"
2694           "  subject=%s\n  crypted=%s\n", coded, sub[1]+6);
2695         tempcond = (strcmpic(coded, sub[1]+6) == 0);
2696         }
2697       else
2698         {
2699         DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: "
2700           "fail\n  crypted=%s\n", sub[1]+6);
2701         tempcond = FALSE;
2702         }
2703       }
2704
2705     else   /* {crypt} or {crypt16} and non-{ at start */
2706            /* }-for-text-editors */
2707       {
2708       int which = 0;
2709       uschar *coded;
2710
2711       if (strncmpic(sub[1], US"{crypt}", 7) == 0)
2712         {
2713         sub[1] += 7;
2714         which = 1;
2715         }
2716       else if (strncmpic(sub[1], US"{crypt16}", 9) == 0)
2717         {
2718         sub[1] += 9;
2719         which = 2;
2720         }
2721       else if (sub[1][0] == '{')                /* }-for-text-editors */
2722         {
2723         expand_string_message = string_sprintf("unknown encryption mechanism "
2724           "in \"%s\"", sub[1]);
2725         return NULL;
2726         }
2727
2728       switch(which)
2729         {
2730         case 0:  coded = US DEFAULT_CRYPT(CS sub[0], CS sub[1]); break;
2731         case 1:  coded = US crypt(CS sub[0], CS sub[1]); break;
2732         default: coded = US crypt16(CS sub[0], CS sub[1]); break;
2733         }
2734
2735       #define STR(s) # s
2736       #define XSTR(s) STR(s)
2737       DEBUG(D_auth) debug_printf("crypteq: using %s()\n"
2738         "  subject=%s\n  crypted=%s\n",
2739         (which == 0)? XSTR(DEFAULT_CRYPT) : (which == 1)? "crypt" : "crypt16",
2740         coded, sub[1]);
2741       #undef STR
2742       #undef XSTR
2743
2744       /* If the encrypted string contains fewer than two characters (for the
2745       salt), force failure. Otherwise we get false positives: with an empty
2746       string the yield of crypt() is an empty string! */
2747
2748       tempcond = (Ustrlen(sub[1]) < 2)? FALSE :
2749         (Ustrcmp(coded, sub[1]) == 0);
2750       }
2751     break;
2752     #endif  /* SUPPORT_CRYPTEQ */
2753
2754     case ECOND_INLIST:
2755     case ECOND_INLISTI:
2756       {
2757       int sep = 0;
2758       uschar *save_iterate_item = iterate_item;
2759       int (*compare)(const uschar *, const uschar *);
2760
2761       DEBUG(D_expand) debug_printf("condition: %s\n", name);
2762
2763       tempcond = FALSE;
2764       if (cond_type == ECOND_INLISTI)
2765         compare = strcmpic;
2766       else
2767         compare = (int (*)(const uschar *, const uschar *)) strcmp;
2768
2769       while ((iterate_item = string_nextinlist(&sub[1], &sep, NULL, 0)) != NULL)
2770         if (compare(sub[0], iterate_item) == 0)
2771           {
2772           tempcond = TRUE;
2773           break;
2774           }
2775       iterate_item = save_iterate_item;
2776       }
2777
2778     }   /* Switch for comparison conditions */
2779
2780   *yield = tempcond == testfor;
2781   return s;    /* End of comparison conditions */
2782
2783
2784   /* and/or: computes logical and/or of several conditions */
2785
2786   case ECOND_AND:
2787   case ECOND_OR:
2788   subcondptr = (yield == NULL)? NULL : &tempcond;
2789   combined_cond = (cond_type == ECOND_AND);
2790
2791   while (isspace(*s)) s++;
2792   if (*s++ != '{') goto COND_FAILED_CURLY_START;        /* }-for-text-editors */
2793
2794   for (;;)
2795     {
2796     while (isspace(*s)) s++;
2797     /* {-for-text-editors */
2798     if (*s == '}') break;
2799     if (*s != '{')                                      /* }-for-text-editors */
2800       {
2801       expand_string_message = string_sprintf("each subcondition "
2802         "inside an \"%s{...}\" condition must be in its own {}", name);
2803       return NULL;
2804       }
2805
2806     if (!(s = eval_condition(s+1, resetok, subcondptr)))
2807       {
2808       expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
2809         expand_string_message, name);
2810       return NULL;
2811       }
2812     while (isspace(*s)) s++;
2813
2814     /* {-for-text-editors */
2815     if (*s++ != '}')
2816       {
2817       /* {-for-text-editors */
2818       expand_string_message = string_sprintf("missing } at end of condition "
2819         "inside \"%s\" group", name);
2820       return NULL;
2821       }
2822
2823     if (yield != NULL)
2824       {
2825       if (cond_type == ECOND_AND)
2826         {
2827         combined_cond &= tempcond;
2828         if (!combined_cond) subcondptr = NULL;  /* once false, don't */
2829         }                                       /* evaluate any more */
2830       else
2831         {
2832         combined_cond |= tempcond;
2833         if (combined_cond) subcondptr = NULL;   /* once true, don't */
2834         }                                       /* evaluate any more */
2835       }
2836     }
2837
2838   if (yield != NULL) *yield = (combined_cond == testfor);
2839   return ++s;
2840
2841
2842   /* forall/forany: iterates a condition with different values */
2843
2844   case ECOND_FORALL:
2845   case ECOND_FORANY:
2846     {
2847     int sep = 0;
2848     uschar *save_iterate_item = iterate_item;
2849
2850     DEBUG(D_expand) debug_printf("condition: %s\n", name);
2851
2852     while (isspace(*s)) s++;
2853     if (*s++ != '{') goto COND_FAILED_CURLY_START;      /* }-for-text-editors */
2854     sub[0] = expand_string_internal(s, TRUE, &s, (yield == NULL), TRUE, resetok);
2855     if (sub[0] == NULL) return NULL;
2856     /* {-for-text-editors */
2857     if (*s++ != '}') goto COND_FAILED_CURLY_END;
2858
2859     while (isspace(*s)) s++;
2860     if (*s++ != '{') goto COND_FAILED_CURLY_START;      /* }-for-text-editors */
2861
2862     sub[1] = s;
2863
2864     /* Call eval_condition once, with result discarded (as if scanning a
2865     "false" part). This allows us to find the end of the condition, because if
2866     the list it empty, we won't actually evaluate the condition for real. */
2867
2868     if (!(s = eval_condition(sub[1], resetok, NULL)))
2869       {
2870       expand_string_message = string_sprintf("%s inside \"%s\" condition",
2871         expand_string_message, name);
2872       return NULL;
2873       }
2874     while (isspace(*s)) s++;
2875
2876     /* {-for-text-editors */
2877     if (*s++ != '}')
2878       {
2879       /* {-for-text-editors */
2880       expand_string_message = string_sprintf("missing } at end of condition "
2881         "inside \"%s\"", name);
2882       return NULL;
2883       }
2884
2885     if (yield != NULL) *yield = !testfor;
2886     while ((iterate_item = string_nextinlist(&sub[0], &sep, NULL, 0)) != NULL)
2887       {
2888       DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
2889       if (!eval_condition(sub[1], resetok, &tempcond))
2890         {
2891         expand_string_message = string_sprintf("%s inside \"%s\" condition",
2892           expand_string_message, name);
2893         iterate_item = save_iterate_item;
2894         return NULL;
2895         }
2896       DEBUG(D_expand) debug_printf("%s: condition evaluated to %s\n", name,
2897         tempcond? "true":"false");
2898
2899       if (yield != NULL) *yield = (tempcond == testfor);
2900       if (tempcond == (cond_type == ECOND_FORANY)) break;
2901       }
2902
2903     iterate_item = save_iterate_item;
2904     return s;
2905     }
2906
2907
2908   /* The bool{} expansion condition maps a string to boolean.
2909   The values supported should match those supported by the ACL condition
2910   (acl.c, ACLC_CONDITION) so that we keep to a minimum the different ideas
2911   of true/false.  Note that Router "condition" rules have a different
2912   interpretation, where general data can be used and only a few values
2913   map to FALSE.
2914   Note that readconf.c boolean matching, for boolean configuration options,
2915   only matches true/yes/false/no.
2916   The bool_lax{} condition matches the Router logic, which is much more
2917   liberal. */
2918   case ECOND_BOOL:
2919   case ECOND_BOOL_LAX:
2920     {
2921     uschar *sub_arg[1];
2922     uschar *t, *t2;
2923     uschar *ourname;
2924     size_t len;
2925     BOOL boolvalue = FALSE;
2926     while (isspace(*s)) s++;
2927     if (*s != '{') goto COND_FAILED_CURLY_START;        /* }-for-text-editors */
2928     ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool";
2929     switch(read_subs(sub_arg, 1, 1, &s, yield == NULL, FALSE, ourname, resetok))
2930       {
2931       case 1: expand_string_message = string_sprintf(
2932                   "too few arguments or bracketing error for %s",
2933                   ourname);
2934       /*FALLTHROUGH*/
2935       case 2:
2936       case 3: return NULL;
2937       }
2938     t = sub_arg[0];
2939     while (isspace(*t)) t++;
2940     len = Ustrlen(t);
2941     if (len)
2942       {
2943       /* trailing whitespace: seems like a good idea to ignore it too */
2944       t2 = t + len - 1;
2945       while (isspace(*t2)) t2--;
2946       if (t2 != (t + len))
2947         {
2948         *++t2 = '\0';
2949         len = t2 - t;
2950         }
2951       }
2952     DEBUG(D_expand)
2953       debug_printf("considering %s: %s\n", ourname, len ? t : US"<empty>");
2954     /* logic for the lax case from expand_check_condition(), which also does
2955     expands, and the logic is both short and stable enough that there should
2956     be no maintenance burden from replicating it. */
2957     if (len == 0)
2958       boolvalue = FALSE;
2959     else if (*t == '-'
2960              ? Ustrspn(t+1, "0123456789") == len-1
2961              : Ustrspn(t,   "0123456789") == len)
2962       {
2963       boolvalue = (Uatoi(t) == 0) ? FALSE : TRUE;
2964       /* expand_check_condition only does a literal string "0" check */
2965       if ((cond_type == ECOND_BOOL_LAX) && (len > 1))
2966         boolvalue = TRUE;
2967       }
2968     else if (strcmpic(t, US"true") == 0 || strcmpic(t, US"yes") == 0)
2969       boolvalue = TRUE;
2970     else if (strcmpic(t, US"false") == 0 || strcmpic(t, US"no") == 0)
2971       boolvalue = FALSE;
2972     else if (cond_type == ECOND_BOOL_LAX)
2973       boolvalue = TRUE;
2974     else
2975       {
2976       expand_string_message = string_sprintf("unrecognised boolean "
2977        "value \"%s\"", t);
2978       return NULL;
2979       }
2980     if (yield != NULL) *yield = (boolvalue == testfor);
2981     return s;
2982     }
2983
2984   /* Unknown condition */
2985
2986   default:
2987   expand_string_message = string_sprintf("unknown condition \"%s\"", name);
2988   return NULL;
2989   }   /* End switch on condition type */
2990
2991 /* Missing braces at start and end of data */
2992
2993 COND_FAILED_CURLY_START:
2994 expand_string_message = string_sprintf("missing { after \"%s\"", name);
2995 return NULL;
2996
2997 COND_FAILED_CURLY_END:
2998 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
2999   name);
3000 return NULL;
3001
3002 /* A condition requires code that is not compiled */
3003
3004 #if !defined(SUPPORT_PAM) || !defined(RADIUS_CONFIG_FILE) || \
3005     !defined(LOOKUP_LDAP) || !defined(CYRUS_PWCHECK_SOCKET) || \
3006     !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
3007 COND_FAILED_NOT_COMPILED:
3008 expand_string_message = string_sprintf("support for \"%s\" not compiled",
3009   name);
3010 return NULL;
3011 #endif
3012 }
3013
3014
3015
3016
3017 /*************************************************
3018 *          Save numerical variables              *
3019 *************************************************/
3020
3021 /* This function is called from items such as "if" that want to preserve and
3022 restore the numbered variables.
3023
3024 Arguments:
3025   save_expand_string    points to an array of pointers to set
3026   save_expand_nlength   points to an array of ints for the lengths
3027
3028 Returns:                the value of expand max to save
3029 */
3030
3031 static int
3032 save_expand_strings(uschar **save_expand_nstring, int *save_expand_nlength)
3033 {
3034 int i;
3035 for (i = 0; i <= expand_nmax; i++)
3036   {
3037   save_expand_nstring[i] = expand_nstring[i];
3038   save_expand_nlength[i] = expand_nlength[i];
3039   }
3040 return expand_nmax;
3041 }
3042
3043
3044
3045 /*************************************************
3046 *           Restore numerical variables          *
3047 *************************************************/
3048
3049 /* This function restored saved values of numerical strings.
3050
3051 Arguments:
3052   save_expand_nmax      the number of strings to restore
3053   save_expand_string    points to an array of pointers
3054   save_expand_nlength   points to an array of ints
3055
3056 Returns:                nothing
3057 */
3058
3059 static void
3060 restore_expand_strings(int save_expand_nmax, uschar **save_expand_nstring,
3061   int *save_expand_nlength)
3062 {
3063 int i;
3064 expand_nmax = save_expand_nmax;
3065 for (i = 0; i <= expand_nmax; i++)
3066   {
3067   expand_nstring[i] = save_expand_nstring[i];
3068   expand_nlength[i] = save_expand_nlength[i];
3069   }
3070 }
3071
3072
3073
3074
3075
3076 /*************************************************
3077 *            Handle yes/no substrings            *
3078 *************************************************/
3079
3080 /* This function is used by ${if}, ${lookup} and ${extract} to handle the
3081 alternative substrings that depend on whether or not the condition was true,
3082 or the lookup or extraction succeeded. The substrings always have to be
3083 expanded, to check their syntax, but "skipping" is set when the result is not
3084 needed - this avoids unnecessary nested lookups.
3085
3086 Arguments:
3087   skipping       TRUE if we were skipping when this item was reached
3088   yes            TRUE if the first string is to be used, else use the second
3089   save_lookup    a value to put back into lookup_value before the 2nd expansion
3090   sptr           points to the input string pointer
3091   yieldptr       points to the output string pointer
3092   sizeptr        points to the output string size
3093   ptrptr         points to the output string pointer
3094   type           "lookup" or "if" or "extract" or "run", for error message
3095   resetok        if not NULL, pointer to flag - write FALSE if unsafe to reset
3096                 the store.
3097
3098 Returns:         0 OK; lookup_value has been reset to save_lookup
3099                  1 expansion failed
3100                  2 expansion failed because of bracketing error
3101 */
3102
3103 static int
3104 process_yesno(BOOL skipping, BOOL yes, uschar *save_lookup, uschar **sptr,
3105   uschar **yieldptr, int *sizeptr, int *ptrptr, uschar *type, BOOL *resetok)
3106 {
3107 int rc = 0;
3108 uschar *s = *sptr;    /* Local value */
3109 uschar *sub1, *sub2;
3110
3111 /* If there are no following strings, we substitute the contents of $value for
3112 lookups and for extractions in the success case. For the ${if item, the string
3113 "true" is substituted. In the fail case, nothing is substituted for all three
3114 items. */
3115
3116 while (isspace(*s)) s++;
3117 if (*s == '}')
3118   {
3119   if (type[0] == 'i')
3120     {
3121     if (yes) *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, US"true", 4);
3122     }
3123   else
3124     {
3125     if (yes && lookup_value != NULL)
3126       *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value,
3127         Ustrlen(lookup_value));
3128     lookup_value = save_lookup;
3129     }
3130   s++;
3131   goto RETURN;
3132   }
3133
3134 /* The first following string must be braced. */
3135
3136 if (*s++ != '{') goto FAILED_CURLY;
3137
3138 /* Expand the first substring. Forced failures are noticed only if we actually
3139 want this string. Set skipping in the call in the fail case (this will always
3140 be the case if we were already skipping). */
3141
3142 sub1 = expand_string_internal(s, TRUE, &s, !yes, TRUE, resetok);
3143 if (sub1 == NULL && (yes || !expand_string_forcedfail)) goto FAILED;
3144 expand_string_forcedfail = FALSE;
3145 if (*s++ != '}') goto FAILED_CURLY;
3146
3147 /* If we want the first string, add it to the output */
3148
3149 if (yes)
3150   *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub1, Ustrlen(sub1));
3151
3152 /* If this is called from a lookup or an extract, we want to restore $value to
3153 what it was at the start of the item, so that it has this value during the
3154 second string expansion. For the call from "if" or "run" to this function,
3155 save_lookup is set to lookup_value, so that this statement does nothing. */
3156
3157 lookup_value = save_lookup;
3158
3159 /* There now follows either another substring, or "fail", or nothing. This
3160 time, forced failures are noticed only if we want the second string. We must
3161 set skipping in the nested call if we don't want this string, or if we were
3162 already skipping. */
3163
3164 while (isspace(*s)) s++;
3165 if (*s == '{')
3166   {
3167   sub2 = expand_string_internal(s+1, TRUE, &s, yes || skipping, TRUE, resetok);
3168   if (sub2 == NULL && (!yes || !expand_string_forcedfail)) goto FAILED;
3169   expand_string_forcedfail = FALSE;
3170   if (*s++ != '}') goto FAILED_CURLY;
3171
3172   /* If we want the second string, add it to the output */
3173
3174   if (!yes)
3175     *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub2, Ustrlen(sub2));
3176   }
3177
3178 /* If there is no second string, but the word "fail" is present when the use of
3179 the second string is wanted, set a flag indicating it was a forced failure
3180 rather than a syntactic error. Swallow the terminating } in case this is nested
3181 inside another lookup or if or extract. */
3182
3183 else if (*s != '}')
3184   {
3185   uschar name[256];
3186   s = read_name(name, sizeof(name), s, US"_");
3187   if (Ustrcmp(name, "fail") == 0)
3188     {
3189     if (!yes && !skipping)
3190       {
3191       while (isspace(*s)) s++;
3192       if (*s++ != '}') goto FAILED_CURLY;
3193       expand_string_message =
3194         string_sprintf("\"%s\" failed and \"fail\" requested", type);
3195       expand_string_forcedfail = TRUE;
3196       goto FAILED;
3197       }
3198     }
3199   else
3200     {
3201     expand_string_message =
3202       string_sprintf("syntax error in \"%s\" item - \"fail\" expected", type);
3203     goto FAILED;
3204     }
3205   }
3206
3207 /* All we have to do now is to check on the final closing brace. */
3208
3209 while (isspace(*s)) s++;
3210 if (*s++ == '}') goto RETURN;
3211
3212 /* Get here if there is a bracketing failure */
3213
3214 FAILED_CURLY:
3215 rc++;
3216
3217 /* Get here for other failures */
3218
3219 FAILED:
3220 rc++;
3221
3222 /* Update the input pointer value before returning */
3223
3224 RETURN:
3225 *sptr = s;
3226 return rc;
3227 }
3228
3229
3230
3231
3232 /*************************************************
3233 *    Handle MD5 or SHA-1 computation for HMAC    *
3234 *************************************************/
3235
3236 /* These are some wrapping functions that enable the HMAC code to be a bit
3237 cleaner. A good compiler will spot the tail recursion.
3238
3239 Arguments:
3240   type         HMAC_MD5 or HMAC_SHA1
3241   remaining    are as for the cryptographic hash functions
3242
3243 Returns:       nothing
3244 */
3245
3246 static void
3247 chash_start(int type, void *base)
3248 {
3249 if (type == HMAC_MD5)
3250   md5_start((md5 *)base);
3251 else
3252   sha1_start((sha1 *)base);
3253 }
3254
3255 static void
3256 chash_mid(int type, void *base, uschar *string)
3257 {
3258 if (type == HMAC_MD5)
3259   md5_mid((md5 *)base, string);
3260 else
3261   sha1_mid((sha1 *)base, string);
3262 }
3263
3264 static void
3265 chash_end(int type, void *base, uschar *string, int length, uschar *digest)
3266 {
3267 if (type == HMAC_MD5)
3268   md5_end((md5 *)base, string, length, digest);
3269 else
3270   sha1_end((sha1 *)base, string, length, digest);
3271 }
3272
3273
3274
3275
3276
3277 /********************************************************
3278 * prvs: Get last three digits of days since Jan 1, 1970 *
3279 ********************************************************/
3280
3281 /* This is needed to implement the "prvs" BATV reverse
3282    path signing scheme
3283
3284 Argument: integer "days" offset to add or substract to
3285           or from the current number of days.
3286
3287 Returns:  pointer to string containing the last three
3288           digits of the number of days since Jan 1, 1970,
3289           modified by the offset argument, NULL if there
3290           was an error in the conversion.
3291
3292 */
3293
3294 static uschar *
3295 prvs_daystamp(int day_offset)
3296 {
3297 uschar *days = store_get(32);                /* Need at least 24 for cases */
3298 (void)string_format(days, 32, TIME_T_FMT,    /* where TIME_T_FMT is %lld */
3299   (time(NULL) + day_offset*86400)/86400);
3300 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
3301 }
3302
3303
3304
3305 /********************************************************
3306 *   prvs: perform HMAC-SHA1 computation of prvs bits    *
3307 ********************************************************/
3308
3309 /* This is needed to implement the "prvs" BATV reverse
3310    path signing scheme
3311
3312 Arguments:
3313   address RFC2821 Address to use
3314       key The key to use (must be less than 64 characters
3315           in size)
3316   key_num Single-digit key number to use. Defaults to
3317           '0' when NULL.
3318
3319 Returns:  pointer to string containing the first three
3320           bytes of the final hash in hex format, NULL if
3321           there was an error in the process.
3322 */
3323
3324 static uschar *
3325 prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
3326 {
3327 uschar *hash_source, *p;
3328 int size = 0,offset = 0,i;
3329 sha1 sha1_base;
3330 void *use_base = &sha1_base;
3331 uschar innerhash[20];
3332 uschar finalhash[20];
3333 uschar innerkey[64];
3334 uschar outerkey[64];
3335 uschar *finalhash_hex = store_get(40);
3336
3337 if (key_num == NULL)
3338   key_num = US"0";
3339
3340 if (Ustrlen(key) > 64)
3341   return NULL;
3342
3343 hash_source = string_cat(NULL,&size,&offset,key_num,1);
3344 string_cat(hash_source,&size,&offset,daystamp,3);
3345 string_cat(hash_source,&size,&offset,address,Ustrlen(address));
3346 hash_source[offset] = '\0';
3347
3348 DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source);
3349
3350 memset(innerkey, 0x36, 64);
3351 memset(outerkey, 0x5c, 64);
3352
3353 for (i = 0; i < Ustrlen(key); i++)
3354   {
3355   innerkey[i] ^= key[i];
3356   outerkey[i] ^= key[i];
3357   }
3358
3359 chash_start(HMAC_SHA1, use_base);
3360 chash_mid(HMAC_SHA1, use_base, innerkey);
3361 chash_end(HMAC_SHA1, use_base, hash_source, offset, innerhash);
3362
3363 chash_start(HMAC_SHA1, use_base);
3364 chash_mid(HMAC_SHA1, use_base, outerkey);
3365 chash_end(HMAC_SHA1, use_base, innerhash, 20, finalhash);
3366
3367 p = finalhash_hex;
3368 for (i = 0; i < 3; i++)
3369   {
3370   *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
3371   *p++ = hex_digits[finalhash[i] & 0x0f];
3372   }
3373 *p = '\0';
3374
3375 return finalhash_hex;
3376 }
3377
3378
3379
3380
3381 /*************************************************
3382 *        Join a file onto the output string      *
3383 *************************************************/
3384
3385 /* This is used for readfile and after a run expansion. It joins the contents
3386 of a file onto the output string, globally replacing newlines with a given
3387 string (optionally). The file is closed at the end.
3388
3389 Arguments:
3390   f            the FILE
3391   yield        pointer to the expandable string
3392   sizep        pointer to the current size
3393   ptrp         pointer to the current position
3394   eol          newline replacement string, or NULL
3395
3396 Returns:       new value of string pointer
3397 */
3398
3399 static uschar *
3400 cat_file(FILE *f, uschar *yield, int *sizep, int *ptrp, uschar *eol)
3401 {
3402 int eollen;
3403 uschar buffer[1024];
3404
3405 eollen = (eol == NULL)? 0 : Ustrlen(eol);
3406
3407 while (Ufgets(buffer, sizeof(buffer), f) != NULL)
3408   {
3409   int len = Ustrlen(buffer);
3410   if (eol != NULL && buffer[len-1] == '\n') len--;
3411   yield = string_cat(yield, sizep, ptrp, buffer, len);
3412   if (buffer[len] != 0)
3413     yield = string_cat(yield, sizep, ptrp, eol, eollen);
3414   }
3415
3416 if (yield != NULL) yield[*ptrp] = 0;
3417
3418 return yield;
3419 }
3420
3421
3422
3423
3424 /*************************************************
3425 *          Evaluate numeric expression           *
3426 *************************************************/
3427
3428 /* This is a set of mutually recursive functions that evaluate an arithmetic
3429 expression involving + - * / % & | ^ ~ << >> and parentheses. The only one of
3430 these functions that is called from elsewhere is eval_expr, whose interface is:
3431
3432 Arguments:
3433   sptr        pointer to the pointer to the string - gets updated
3434   decimal     TRUE if numbers are to be assumed decimal
3435   error       pointer to where to put an error message - must be NULL on input
3436   endket      TRUE if ')' must terminate - FALSE for external call
3437
3438 Returns:      on success: the value of the expression, with *error still NULL
3439               on failure: an undefined value, with *error = a message
3440 */
3441
3442 static int_eximarith_t eval_op_or(uschar **, BOOL, uschar **);
3443
3444
3445 static int_eximarith_t
3446 eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
3447 {
3448 uschar *s = *sptr;
3449 int_eximarith_t x = eval_op_or(&s, decimal, error);
3450 if (*error == NULL)
3451   {
3452   if (endket)
3453     {
3454     if (*s != ')')
3455       *error = US"expecting closing parenthesis";
3456     else
3457       while (isspace(*(++s)));
3458     }
3459   else if (*s != 0) *error = US"expecting operator";
3460   }
3461 *sptr = s;
3462 return x;
3463 }
3464
3465
3466 static int_eximarith_t
3467 eval_number(uschar **sptr, BOOL decimal, uschar **error)
3468 {
3469 register int c;
3470 int_eximarith_t n;
3471 uschar *s = *sptr;
3472 while (isspace(*s)) s++;
3473 c = *s;
3474 if (isdigit(c))
3475   {
3476   int count;
3477   (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
3478   s += count;
3479   switch (tolower(*s))
3480     {
3481     default: break;
3482     case 'k': n *= 1024; s++; break;
3483     case 'm': n *= 1024*1024; s++; break;
3484     case 'g': n *= 1024*1024*1024; s++; break;
3485     }
3486   while (isspace (*s)) s++;
3487   }
3488 else if (c == '(')
3489   {
3490   s++;
3491   n = eval_expr(&s, decimal, error, 1);
3492   }
3493 else
3494   {
3495   *error = US"expecting number or opening parenthesis";
3496   n = 0;
3497   }
3498 *sptr = s;
3499 return n;
3500 }
3501
3502
3503 static int_eximarith_t
3504 eval_op_unary(uschar **sptr, BOOL decimal, uschar **error)
3505 {
3506 uschar *s = *sptr;
3507 int_eximarith_t x;
3508 while (isspace(*s)) s++;
3509 if (*s == '+' || *s == '-' || *s == '~')
3510   {
3511   int op = *s++;
3512   x = eval_op_unary(&s, decimal, error);
3513   if (op == '-') x = -x;
3514     else if (op == '~') x = ~x;
3515   }
3516 else
3517   {
3518   x = eval_number(&s, decimal, error);
3519   }
3520 *sptr = s;
3521 return x;
3522 }
3523
3524
3525 static int_eximarith_t
3526 eval_op_mult(uschar **sptr, BOOL decimal, uschar **error)
3527 {
3528 uschar *s = *sptr;
3529 int_eximarith_t x = eval_op_unary(&s, decimal, error);
3530 if (*error == NULL)
3531   {
3532   while (*s == '*' || *s == '/' || *s == '%')
3533     {
3534     int op = *s++;
3535     int_eximarith_t y = eval_op_unary(&s, decimal, error);
3536     if (*error != NULL) break;
3537     /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
3538      * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
3539      * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64].  In fact, -N*-M where
3540      * -N*M is INT_MIN will yielf INT_MIN.
3541      * Since we don't support floating point, this is somewhat simpler.
3542      * Ideally, we'd return an error, but since we overflow for all other
3543      * arithmetic, consistency suggests otherwise, but what's the correct value
3544      * to use?  There is none.
3545      * The C standard guarantees overflow for unsigned arithmetic but signed
3546      * overflow invokes undefined behaviour; in practice, this is overflow
3547      * except for converting INT_MIN to INT_MAX+1.  We also can't guarantee
3548      * that long/longlong larger than int are available, or we could just work
3549      * with larger types.  We should consider whether to guarantee 32bit eval
3550      * and 64-bit working variables, with errors returned.  For now ...
3551      * So, the only SIGFPEs occur with a non-shrinking div/mod, thus -1; we
3552      * can just let the other invalid results occur otherwise, as they have
3553      * until now.  For this one case, we can coerce.
3554      */
3555     if (y == -1 && x == EXIM_ARITH_MIN && op != '*')
3556       {
3557       DEBUG(D_expand)
3558         debug_printf("Integer exception dodging: " PR_EXIM_ARITH "%c-1 coerced to " PR_EXIM_ARITH "\n",
3559             EXIM_ARITH_MIN, op, EXIM_ARITH_MAX);
3560       x = EXIM_ARITH_MAX;
3561       continue;
3562       }
3563     if (op == '*')
3564       x *= y;
3565     else
3566       {
3567       if (y == 0)
3568         {
3569         *error = (op == '/') ? US"divide by zero" : US"modulo by zero";
3570         x = 0;
3571         break;
3572         }
3573       if (op == '/')
3574         x /= y;
3575       else
3576         x %= y;
3577       }
3578     }
3579   }
3580 *sptr = s;
3581 return x;
3582 }
3583
3584
3585 static int_eximarith_t
3586 eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
3587 {
3588 uschar *s = *sptr;
3589 int_eximarith_t x = eval_op_mult(&s, decimal, error);
3590 if (*error == NULL)
3591   {
3592   while (*s == '+' || *s == '-')
3593     {
3594     int op = *s++;
3595     int_eximarith_t y = eval_op_mult(&s, decimal, error);
3596     if (*error != NULL) break;
3597     if (op == '+') x += y; else x -= y;
3598     }
3599   }
3600 *sptr = s;
3601 return x;
3602 }
3603
3604
3605 static int_eximarith_t
3606 eval_op_shift(uschar **sptr, BOOL decimal, uschar **error)
3607 {
3608 uschar *s = *sptr;
3609 int_eximarith_t x = eval_op_sum(&s, decimal, error);
3610 if (*error == NULL)
3611   {
3612   while ((*s == '<' || *s == '>') && s[1] == s[0])
3613     {
3614     int_eximarith_t y;
3615     int op = *s++;
3616     s++;
3617     y = eval_op_sum(&s, decimal, error);
3618     if (*error != NULL) break;
3619     if (op == '<') x <<= y; else x >>= y;
3620     }
3621   }
3622 *sptr = s;
3623 return x;
3624 }
3625
3626
3627 static int_eximarith_t
3628 eval_op_and(uschar **sptr, BOOL decimal, uschar **error)
3629 {
3630 uschar *s = *sptr;
3631 int_eximarith_t x = eval_op_shift(&s, decimal, error);
3632 if (*error == NULL)
3633   {
3634   while (*s == '&')
3635     {
3636     int_eximarith_t y;
3637     s++;
3638     y = eval_op_shift(&s, decimal, error);
3639     if (*error != NULL) break;
3640     x &= y;
3641     }
3642   }
3643 *sptr = s;
3644 return x;
3645 }
3646
3647
3648 static int_eximarith_t
3649 eval_op_xor(uschar **sptr, BOOL decimal, uschar **error)
3650 {
3651 uschar *s = *sptr;
3652 int_eximarith_t x = eval_op_and(&s, decimal, error);
3653 if (*error == NULL)
3654   {
3655   while (*s == '^')
3656     {
3657     int_eximarith_t y;
3658     s++;
3659     y = eval_op_and(&s, decimal, error);
3660     if (*error != NULL) break;
3661     x ^= y;
3662     }
3663   }
3664 *sptr = s;
3665 return x;
3666 }
3667
3668
3669 static int_eximarith_t
3670 eval_op_or(uschar **sptr, BOOL decimal, uschar **error)
3671 {
3672 uschar *s = *sptr;
3673 int_eximarith_t x = eval_op_xor(&s, decimal, error);
3674 if (*error == NULL)
3675   {
3676   while (*s == '|')
3677     {
3678     int_eximarith_t y;
3679     s++;
3680     y = eval_op_xor(&s, decimal, error);
3681     if (*error != NULL) break;
3682     x |= y;
3683     }
3684   }
3685 *sptr = s;
3686 return x;
3687 }
3688
3689
3690
3691 /*************************************************
3692 *                 Expand string                  *
3693 *************************************************/
3694
3695 /* Returns either an unchanged string, or the expanded string in stacking pool
3696 store. Interpreted sequences are:
3697
3698    \...                    normal escaping rules
3699    $name                   substitutes the variable
3700    ${name}                 ditto
3701    ${op:string}            operates on the expanded string value
3702    ${item{arg1}{arg2}...}  expands the args and then does the business
3703                              some literal args are not enclosed in {}
3704
3705 There are now far too many operators and item types to make it worth listing
3706 them here in detail any more.
3707
3708 We use an internal routine recursively to handle embedded substrings. The
3709 external function follows. The yield is NULL if the expansion failed, and there
3710 are two cases: if something collapsed syntactically, or if "fail" was given
3711 as the action on a lookup failure. These can be distinguised by looking at the
3712 variable expand_string_forcedfail, which is TRUE in the latter case.
3713
3714 The skipping flag is set true when expanding a substring that isn't actually
3715 going to be used (after "if" or "lookup") and it prevents lookups from
3716 happening lower down.
3717
3718 Store usage: At start, a store block of the length of the input plus 64
3719 is obtained. This is expanded as necessary by string_cat(), which might have to
3720 get a new block, or might be able to expand the original. At the end of the
3721 function we can release any store above that portion of the yield block that
3722 was actually used. In many cases this will be optimal.
3723
3724 However: if the first item in the expansion is a variable name or header name,
3725 we reset the store before processing it; if the result is in fresh store, we
3726 use that without copying. This is helpful for expanding strings like
3727 $message_headers which can get very long.
3728
3729 There's a problem if a ${dlfunc item has side-effects that cause allocation,
3730 since resetting the store at the end of the expansion will free store that was
3731 allocated by the plugin code as well as the slop after the expanded string. So
3732 we skip any resets if ${dlfunc } has been used. The same applies for ${acl }
3733 and, given the acl condition, ${if }. This is an unfortunate consequence of
3734 string expansion becoming too powerful.
3735
3736 Arguments:
3737   string         the string to be expanded
3738   ket_ends       true if expansion is to stop at }
3739   left           if not NULL, a pointer to the first character after the
3740                  expansion is placed here (typically used with ket_ends)
3741   skipping       TRUE for recursive calls when the value isn't actually going
3742                  to be used (to allow for optimisation)
3743   honour_dollar  TRUE if $ is to be expanded,
3744                  FALSE if it's just another character
3745   resetok_p      if not NULL, pointer to flag - write FALSE if unsafe to reset
3746                  the store.
3747
3748 Returns:         NULL if expansion fails:
3749                    expand_string_forcedfail is set TRUE if failure was forced
3750                    expand_string_message contains a textual error message
3751                  a pointer to the expanded string on success
3752 */
3753
3754 static uschar *
3755 expand_string_internal(uschar *string, BOOL ket_ends, uschar **left,
3756   BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
3757 {
3758 int ptr = 0;
3759 int size = Ustrlen(string)+ 64;
3760 int item_type;
3761 uschar *yield = store_get(size);
3762 uschar *s = string;
3763 uschar *save_expand_nstring[EXPAND_MAXN+1];
3764 int save_expand_nlength[EXPAND_MAXN+1];
3765 BOOL resetok = TRUE;
3766
3767 expand_string_forcedfail = FALSE;
3768 expand_string_message = US"";
3769
3770 while (*s != 0)
3771   {
3772   uschar *value;
3773   uschar name[256];
3774
3775   /* \ escapes the next character, which must exist, or else
3776   the expansion fails. There's a special escape, \N, which causes
3777   copying of the subject verbatim up to the next \N. Otherwise,
3778   the escapes are the standard set. */
3779
3780   if (*s == '\\')
3781     {
3782     if (s[1] == 0)
3783       {
3784       expand_string_message = US"\\ at end of string";
3785       goto EXPAND_FAILED;
3786       }
3787
3788     if (s[1] == 'N')
3789       {
3790       uschar *t = s + 2;
3791       for (s = t; *s != 0; s++) if (*s == '\\' && s[1] == 'N') break;
3792       yield = string_cat(yield, &size, &ptr, t, s - t);
3793       if (*s != 0) s += 2;
3794       }
3795
3796     else
3797       {
3798       uschar ch[1];
3799       ch[0] = string_interpret_escape(&s);
3800       s++;
3801       yield = string_cat(yield, &size, &ptr, ch, 1);
3802       }
3803
3804     continue;
3805     }
3806
3807   /*{*/
3808   /* Anything other than $ is just copied verbatim, unless we are
3809   looking for a terminating } character. */
3810
3811   /*{*/
3812   if (ket_ends && *s == '}') break;
3813
3814   if (*s != '$' || !honour_dollar)
3815     {
3816     yield = string_cat(yield, &size, &ptr, s++, 1);
3817     continue;
3818     }
3819
3820   /* No { after the $ - must be a plain name or a number for string
3821   match variable. There has to be a fudge for variables that are the
3822   names of header fields preceded by "$header_" because header field
3823   names can contain any printing characters except space and colon.
3824   For those that don't like typing this much, "$h_" is a synonym for
3825   "$header_". A non-existent header yields a NULL value; nothing is
3826   inserted. */  /*}*/
3827
3828   if (isalpha((*(++s))))
3829     {
3830     int len;
3831     int newsize = 0;
3832
3833     s = read_name(name, sizeof(name), s, US"_");
3834
3835     /* If this is the first thing to be expanded, release the pre-allocated
3836     buffer. */
3837
3838     if (ptr == 0 && yield != NULL)
3839       {
3840       if (resetok) store_reset(yield);
3841       yield = NULL;
3842       size = 0;
3843       }
3844
3845     /* Header */
3846
3847     if (Ustrncmp(name, "h_", 2) == 0 ||
3848         Ustrncmp(name, "rh_", 3) == 0 ||
3849         Ustrncmp(name, "bh_", 3) == 0 ||
3850         Ustrncmp(name, "header_", 7) == 0 ||
3851         Ustrncmp(name, "rheader_", 8) == 0 ||
3852         Ustrncmp(name, "bheader_", 8) == 0)
3853       {
3854       BOOL want_raw = (name[0] == 'r')? TRUE : FALSE;
3855       uschar *charset = (name[0] == 'b')? NULL : headers_charset;
3856       s = read_header_name(name, sizeof(name), s);
3857       value = find_header(name, FALSE, &newsize, want_raw, charset);
3858
3859       /* If we didn't find the header, and the header contains a closing brace
3860       character, this may be a user error where the terminating colon
3861       has been omitted. Set a flag to adjust the error message in this case.
3862       But there is no error here - nothing gets inserted. */
3863
3864       if (value == NULL)
3865         {
3866         if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
3867         continue;
3868         }
3869       }
3870
3871     /* Variable */
3872
3873     else
3874       {
3875       value = find_variable(name, FALSE, skipping, &newsize);
3876       if (value == NULL)
3877         {
3878         expand_string_message =
3879           string_sprintf("unknown variable name \"%s\"", name);
3880           check_variable_error_message(name);
3881         goto EXPAND_FAILED;
3882         }
3883       }
3884
3885     /* If the data is known to be in a new buffer, newsize will be set to the
3886     size of that buffer. If this is the first thing in an expansion string,
3887     yield will be NULL; just point it at the new store instead of copying. Many
3888     expansion strings contain just one reference, so this is a useful
3889     optimization, especially for humungous headers. */
3890
3891     len = Ustrlen(value);
3892     if (yield == NULL && newsize != 0)
3893       {
3894       yield = value;
3895       size = newsize;
3896       ptr = len;
3897       }
3898     else yield = string_cat(yield, &size, &ptr, value, len);
3899
3900     continue;
3901     }
3902
3903   if (isdigit(*s))
3904     {
3905     int n;
3906     s = read_number(&n, s);
3907     if (n >= 0 && n <= expand_nmax)
3908       yield = string_cat(yield, &size, &ptr, expand_nstring[n],
3909         expand_nlength[n]);
3910     continue;
3911     }
3912
3913   /* Otherwise, if there's no '{' after $ it's an error. */             /*}*/
3914
3915   if (*s != '{')                                                        /*}*/
3916     {
3917     expand_string_message = US"$ not followed by letter, digit, or {";  /*}*/
3918     goto EXPAND_FAILED;
3919     }
3920
3921   /* After { there can be various things, but they all start with
3922   an initial word, except for a number for a string match variable. */
3923
3924   if (isdigit((*(++s))))
3925     {
3926     int n;
3927     s = read_number(&n, s);             /*{*/
3928     if (*s++ != '}')
3929       {                                 /*{*/
3930       expand_string_message = US"} expected after number";
3931       goto EXPAND_FAILED;
3932       }
3933     if (n >= 0 && n <= expand_nmax)
3934       yield = string_cat(yield, &size, &ptr, expand_nstring[n],
3935         expand_nlength[n]);
3936     continue;
3937     }
3938
3939   if (!isalpha(*s))
3940     {
3941     expand_string_message = US"letter or digit expected after ${";      /*}*/
3942     goto EXPAND_FAILED;
3943     }
3944
3945   /* Allow "-" in names to cater for substrings with negative
3946   arguments. Since we are checking for known names after { this is
3947   OK. */
3948
3949   s = read_name(name, sizeof(name), s, US"_-");
3950   item_type = chop_match(name, item_table, sizeof(item_table)/sizeof(uschar *));
3951
3952   switch(item_type)
3953     {
3954     /* Call an ACL from an expansion.  We feed data in via $acl_arg1 - $acl_arg9.
3955     If the ACL returns accept or reject we return content set by "message ="
3956     There is currently no limit on recursion; this would have us call
3957     acl_check_internal() directly and get a current level from somewhere.
3958     See also the acl expansion condition ECOND_ACL and the traditional
3959     acl modifier ACLC_ACL.
3960     Assume that the function has side-effects on the store that must be preserved.
3961     */
3962
3963     case EITEM_ACL:
3964       /* ${acl {name} {arg1}{arg2}...} */
3965       {
3966       uschar *sub[10];  /* name + arg1-arg9 (which must match number of acl_arg[]) */
3967       uschar *user_msg;
3968
3969       switch(read_subs(sub, 10, 1, &s, skipping, TRUE, US"acl", &resetok))
3970         {
3971         case 1: goto EXPAND_FAILED_CURLY;
3972         case 2:
3973         case 3: goto EXPAND_FAILED;
3974         }
3975       if (skipping) continue;
3976
3977       resetok = FALSE;
3978       switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
3979         {
3980         case OK:
3981         case FAIL:
3982           DEBUG(D_expand)
3983             debug_printf("acl expansion yield: %s\n", user_msg);
3984           if (user_msg)
3985             yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg));
3986           continue;
3987
3988         case DEFER:
3989           expand_string_forcedfail = TRUE;
3990         default:
3991           expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
3992           goto EXPAND_FAILED;
3993         }
3994       }
3995
3996     /* Handle conditionals - preserve the values of the numerical expansion
3997     variables in case they get changed by a regular expression match in the
3998     condition. If not, they retain their external settings. At the end
3999     of this "if" section, they get restored to their previous values. */
4000
4001     case EITEM_IF:
4002       {
4003       BOOL cond = FALSE;
4004       uschar *next_s;
4005       int save_expand_nmax =
4006         save_expand_strings(save_expand_nstring, save_expand_nlength);
4007
4008       while (isspace(*s)) s++;
4009       next_s = eval_condition(s, &resetok, skipping? NULL : &cond);
4010       if (next_s == NULL) goto EXPAND_FAILED;  /* message already set */
4011
4012       DEBUG(D_expand)
4013         debug_printf("condition: %.*s\n   result: %s\n", (int)(next_s - s), s,
4014           cond? "true" : "false");
4015
4016       s = next_s;
4017
4018       /* The handling of "yes" and "no" result strings is now in a separate
4019       function that is also used by ${lookup} and ${extract} and ${run}. */
4020
4021       switch(process_yesno(
4022                skipping,                     /* were previously skipping */
4023                cond,                         /* success/failure indicator */
4024                lookup_value,                 /* value to reset for string2 */
4025                &s,                           /* input pointer */
4026                &yield,                       /* output pointer */
4027                &size,                        /* output size */
4028                &ptr,                         /* output current point */
4029                US"if",                       /* condition type */
4030                &resetok))
4031         {
4032         case 1: goto EXPAND_FAILED;          /* when all is well, the */
4033         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
4034         }
4035
4036       /* Restore external setting of expansion variables for continuation
4037       at this level. */
4038
4039       restore_expand_strings(save_expand_nmax, save_expand_nstring,
4040         save_expand_nlength);
4041       continue;
4042       }
4043
4044     /* Handle database lookups unless locked out. If "skipping" is TRUE, we are
4045     expanding an internal string that isn't actually going to be used. All we
4046     need to do is check the syntax, so don't do a lookup at all. Preserve the
4047     values of the numerical expansion variables in case they get changed by a
4048     partial lookup. If not, they retain their external settings. At the end
4049     of this "lookup" section, they get restored to their previous values. */
4050
4051     case EITEM_LOOKUP:
4052       {
4053       int stype, partial, affixlen, starflags;
4054       int expand_setup = 0;
4055       int nameptr = 0;
4056       uschar *key, *filename, *affix;
4057       uschar *save_lookup_value = lookup_value;
4058       int save_expand_nmax =
4059         save_expand_strings(save_expand_nstring, save_expand_nlength);
4060
4061       if ((expand_forbid & RDO_LOOKUP) != 0)
4062         {
4063         expand_string_message = US"lookup expansions are not permitted";
4064         goto EXPAND_FAILED;
4065         }
4066
4067       /* Get the key we are to look up for single-key+file style lookups.
4068       Otherwise set the key NULL pro-tem. */
4069
4070       while (isspace(*s)) s++;
4071       if (*s == '{')                                    /*}*/
4072         {
4073         key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4074         if (key == NULL) goto EXPAND_FAILED;            /*{*/
4075         if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4076         while (isspace(*s)) s++;
4077         }
4078       else key = NULL;
4079
4080       /* Find out the type of database */
4081
4082       if (!isalpha(*s))
4083         {
4084         expand_string_message = US"missing lookup type";
4085         goto EXPAND_FAILED;
4086         }
4087
4088       /* The type is a string that may contain special characters of various
4089       kinds. Allow everything except space or { to appear; the actual content
4090       is checked by search_findtype_partial. */         /*}*/
4091
4092       while (*s != 0 && *s != '{' && !isspace(*s))      /*}*/
4093         {
4094         if (nameptr < sizeof(name) - 1) name[nameptr++] = *s;
4095         s++;
4096         }
4097       name[nameptr] = 0;
4098       while (isspace(*s)) s++;
4099
4100       /* Now check for the individual search type and any partial or default
4101       options. Only those types that are actually in the binary are valid. */
4102
4103       stype = search_findtype_partial(name, &partial, &affix, &affixlen,
4104         &starflags);
4105       if (stype < 0)
4106         {
4107         expand_string_message = search_error_message;
4108         goto EXPAND_FAILED;
4109         }
4110
4111       /* Check that a key was provided for those lookup types that need it,
4112       and was not supplied for those that use the query style. */
4113
4114       if (!mac_islookup(stype, lookup_querystyle|lookup_absfilequery))
4115         {
4116         if (key == NULL)
4117           {
4118           expand_string_message = string_sprintf("missing {key} for single-"
4119             "key \"%s\" lookup", name);
4120           goto EXPAND_FAILED;
4121           }
4122         }
4123       else
4124         {
4125         if (key != NULL)
4126           {
4127           expand_string_message = string_sprintf("a single key was given for "
4128             "lookup type \"%s\", which is not a single-key lookup type", name);
4129           goto EXPAND_FAILED;
4130           }
4131         }
4132
4133       /* Get the next string in brackets and expand it. It is the file name for
4134       single-key+file lookups, and the whole query otherwise. In the case of
4135       queries that also require a file name (e.g. sqlite), the file name comes
4136       first. */
4137
4138       if (*s != '{') goto EXPAND_FAILED_CURLY;
4139       filename = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4140       if (filename == NULL) goto EXPAND_FAILED;
4141       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4142       while (isspace(*s)) s++;
4143
4144       /* If this isn't a single-key+file lookup, re-arrange the variables
4145       to be appropriate for the search_ functions. For query-style lookups,
4146       there is just a "key", and no file name. For the special query-style +
4147       file types, the query (i.e. "key") starts with a file name. */
4148
4149       if (key == NULL)
4150         {
4151         while (isspace(*filename)) filename++;
4152         key = filename;
4153
4154         if (mac_islookup(stype, lookup_querystyle))
4155           {
4156           filename = NULL;
4157           }
4158         else
4159           {
4160           if (*filename != '/')
4161             {
4162             expand_string_message = string_sprintf(
4163               "absolute file name expected for \"%s\" lookup", name);
4164             goto EXPAND_FAILED;
4165             }
4166           while (*key != 0 && !isspace(*key)) key++;
4167           if (*key != 0) *key++ = 0;
4168           }
4169         }
4170
4171       /* If skipping, don't do the next bit - just lookup_value == NULL, as if
4172       the entry was not found. Note that there is no search_close() function.
4173       Files are left open in case of re-use. At suitable places in higher logic,
4174       search_tidyup() is called to tidy all open files. This can save opening
4175       the same file several times. However, files may also get closed when
4176       others are opened, if too many are open at once. The rule is that a
4177       handle should not be used after a second search_open().
4178
4179       Request that a partial search sets up $1 and maybe $2 by passing
4180       expand_setup containing zero. If its value changes, reset expand_nmax,
4181       since new variables will have been set. Note that at the end of this
4182       "lookup" section, the old numeric variables are restored. */
4183
4184       if (skipping)
4185         lookup_value = NULL;
4186       else
4187         {
4188         void *handle = search_open(filename, stype, 0, NULL, NULL);
4189         if (handle == NULL)
4190           {
4191           expand_string_message = search_error_message;
4192           goto EXPAND_FAILED;
4193           }
4194         lookup_value = search_find(handle, filename, key, partial, affix,
4195           affixlen, starflags, &expand_setup);
4196         if (search_find_defer)
4197           {
4198           expand_string_message =
4199             string_sprintf("lookup of \"%s\" gave DEFER: %s",
4200               string_printing2(key, FALSE), search_error_message);
4201           goto EXPAND_FAILED;
4202           }
4203         if (expand_setup > 0) expand_nmax = expand_setup;
4204         }
4205
4206       /* The handling of "yes" and "no" result strings is now in a separate
4207       function that is also used by ${if} and ${extract}. */
4208
4209       switch(process_yesno(
4210                skipping,                     /* were previously skipping */
4211                lookup_value != NULL,         /* success/failure indicator */
4212                save_lookup_value,            /* value to reset for string2 */
4213                &s,                           /* input pointer */
4214                &yield,                       /* output pointer */
4215                &size,                        /* output size */
4216                &ptr,                         /* output current point */
4217                US"lookup",                   /* condition type */
4218                &resetok))
4219         {
4220         case 1: goto EXPAND_FAILED;          /* when all is well, the */
4221         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
4222         }
4223
4224       /* Restore external setting of expansion variables for carrying on
4225       at this level, and continue. */
4226
4227       restore_expand_strings(save_expand_nmax, save_expand_nstring,
4228         save_expand_nlength);
4229       continue;
4230       }
4231
4232     /* If Perl support is configured, handle calling embedded perl subroutines,
4233     unless locked out at this time. Syntax is ${perl{sub}} or ${perl{sub}{arg}}
4234     or ${perl{sub}{arg1}{arg2}} or up to a maximum of EXIM_PERL_MAX_ARGS
4235     arguments (defined below). */
4236
4237     #define EXIM_PERL_MAX_ARGS 8
4238
4239     case EITEM_PERL:
4240     #ifndef EXIM_PERL
4241     expand_string_message = US"\"${perl\" encountered, but this facility "      /*}*/
4242       "is not included in this binary";
4243     goto EXPAND_FAILED;
4244
4245     #else   /* EXIM_PERL */
4246       {
4247       uschar *sub_arg[EXIM_PERL_MAX_ARGS + 2];
4248       uschar *new_yield;
4249
4250       if ((expand_forbid & RDO_PERL) != 0)
4251         {
4252         expand_string_message = US"Perl calls are not permitted";
4253         goto EXPAND_FAILED;
4254         }
4255
4256       switch(read_subs(sub_arg, EXIM_PERL_MAX_ARGS + 1, 1, &s, skipping, TRUE,
4257            US"perl", &resetok))
4258         {
4259         case 1: goto EXPAND_FAILED_CURLY;
4260         case 2:
4261         case 3: goto EXPAND_FAILED;
4262         }
4263
4264       /* If skipping, we don't actually do anything */
4265
4266       if (skipping) continue;
4267
4268       /* Start the interpreter if necessary */
4269
4270       if (!opt_perl_started)
4271         {
4272         uschar *initerror;
4273         if (opt_perl_startup == NULL)
4274           {
4275           expand_string_message = US"A setting of perl_startup is needed when "
4276             "using the Perl interpreter";
4277           goto EXPAND_FAILED;
4278           }
4279         DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4280         initerror = init_perl(opt_perl_startup);
4281         if (initerror != NULL)
4282           {
4283           expand_string_message =
4284             string_sprintf("error in perl_startup code: %s\n", initerror);
4285           goto EXPAND_FAILED;
4286           }
4287         opt_perl_started = TRUE;
4288         }
4289
4290       /* Call the function */
4291
4292       sub_arg[EXIM_PERL_MAX_ARGS + 1] = NULL;
4293       new_yield = call_perl_cat(yield, &size, &ptr, &expand_string_message,
4294         sub_arg[0], sub_arg + 1);
4295
4296       /* NULL yield indicates failure; if the message pointer has been set to
4297       NULL, the yield was undef, indicating a forced failure. Otherwise the
4298       message will indicate some kind of Perl error. */
4299
4300       if (new_yield == NULL)
4301         {
4302         if (expand_string_message == NULL)
4303           {
4304           expand_string_message =
4305             string_sprintf("Perl subroutine \"%s\" returned undef to force "
4306               "failure", sub_arg[0]);
4307           expand_string_forcedfail = TRUE;
4308           }
4309         goto EXPAND_FAILED;
4310         }
4311
4312       /* Yield succeeded. Ensure forcedfail is unset, just in case it got
4313       set during a callback from Perl. */
4314
4315       expand_string_forcedfail = FALSE;
4316       yield = new_yield;
4317       continue;
4318       }
4319     #endif /* EXIM_PERL */
4320
4321     /* Transform email address to "prvs" scheme to use
4322        as BATV-signed return path */
4323
4324     case EITEM_PRVS:
4325       {
4326       uschar *sub_arg[3];
4327       uschar *p,*domain;
4328
4329       switch(read_subs(sub_arg, 3, 2, &s, skipping, TRUE, US"prvs", &resetok))
4330         {
4331         case 1: goto EXPAND_FAILED_CURLY;
4332         case 2:
4333         case 3: goto EXPAND_FAILED;
4334         }
4335
4336       /* If skipping, we don't actually do anything */
4337       if (skipping) continue;
4338
4339       /* sub_arg[0] is the address */
4340       domain = Ustrrchr(sub_arg[0],'@');
4341       if ( (domain == NULL) || (domain == sub_arg[0]) || (Ustrlen(domain) == 1) )
4342         {
4343         expand_string_message = US"prvs first argument must be a qualified email address";
4344         goto EXPAND_FAILED;
4345         }
4346
4347       /* Calculate the hash. The second argument must be a single-digit
4348       key number, or unset. */
4349
4350       if (sub_arg[2] != NULL &&
4351           (!isdigit(sub_arg[2][0]) || sub_arg[2][1] != 0))
4352         {
4353         expand_string_message = US"prvs second argument must be a single digit";
4354         goto EXPAND_FAILED;
4355         }
4356
4357       p = prvs_hmac_sha1(sub_arg[0],sub_arg[1],sub_arg[2],prvs_daystamp(7));
4358       if (p == NULL)
4359         {
4360         expand_string_message = US"prvs hmac-sha1 conversion failed";
4361         goto EXPAND_FAILED;
4362         }
4363
4364       /* Now separate the domain from the local part */
4365       *domain++ = '\0';
4366
4367       yield = string_cat(yield,&size,&ptr,US"prvs=",5);
4368       string_cat(yield,&size,&ptr,(sub_arg[2] != NULL) ? sub_arg[2] : US"0", 1);
4369       string_cat(yield,&size,&ptr,prvs_daystamp(7),3);
4370       string_cat(yield,&size,&ptr,p,6);
4371       string_cat(yield,&size,&ptr,US"=",1);
4372       string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
4373       string_cat(yield,&size,&ptr,US"@",1);
4374       string_cat(yield,&size,&ptr,domain,Ustrlen(domain));
4375
4376       continue;
4377       }
4378
4379     /* Check a prvs-encoded address for validity */
4380
4381     case EITEM_PRVSCHECK:
4382       {
4383       uschar *sub_arg[3];
4384       int mysize = 0, myptr = 0;
4385       const pcre *re;
4386       uschar *p;
4387
4388       /* TF: Ugliness: We want to expand parameter 1 first, then set
4389          up expansion variables that are used in the expansion of
4390          parameter 2. So we clone the string for the first
4391          expansion, where we only expand parameter 1.
4392
4393          PH: Actually, that isn't necessary. The read_subs() function is
4394          designed to work this way for the ${if and ${lookup expansions. I've
4395          tidied the code.
4396       */
4397
4398       /* Reset expansion variables */
4399       prvscheck_result = NULL;
4400       prvscheck_address = NULL;
4401       prvscheck_keynum = NULL;
4402
4403       switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4404         {
4405         case 1: goto EXPAND_FAILED_CURLY;
4406         case 2:
4407         case 3: goto EXPAND_FAILED;
4408         }
4409
4410       re = regex_must_compile(US"^prvs\\=([0-9])([0-9]{3})([A-F0-9]{6})\\=(.+)\\@(.+)$",
4411                               TRUE,FALSE);
4412
4413       if (regex_match_and_setup(re,sub_arg[0],0,-1))
4414         {
4415         uschar *local_part = string_copyn(expand_nstring[4],expand_nlength[4]);
4416         uschar *key_num = string_copyn(expand_nstring[1],expand_nlength[1]);
4417         uschar *daystamp = string_copyn(expand_nstring[2],expand_nlength[2]);
4418         uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]);
4419         uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]);
4420
4421         DEBUG(D_expand) debug_printf("prvscheck localpart: %s\n", local_part);
4422         DEBUG(D_expand) debug_printf("prvscheck key number: %s\n", key_num);
4423         DEBUG(D_expand) debug_printf("prvscheck daystamp: %s\n", daystamp);
4424         DEBUG(D_expand) debug_printf("prvscheck hash: %s\n", hash);
4425         DEBUG(D_expand) debug_printf("prvscheck domain: %s\n", domain);
4426
4427         /* Set up expansion variables */
4428         prvscheck_address = string_cat(NULL, &mysize, &myptr, local_part, Ustrlen(local_part));
4429         string_cat(prvscheck_address,&mysize,&myptr,US"@",1);
4430         string_cat(prvscheck_address,&mysize,&myptr,domain,Ustrlen(domain));
4431         prvscheck_address[myptr] = '\0';
4432         prvscheck_keynum = string_copy(key_num);
4433
4434         /* Now expand the second argument */
4435         switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4436           {
4437           case 1: goto EXPAND_FAILED_CURLY;
4438           case 2:
4439           case 3: goto EXPAND_FAILED;
4440           }
4441
4442         /* Now we have the key and can check the address. */
4443
4444         p = prvs_hmac_sha1(prvscheck_address, sub_arg[0], prvscheck_keynum,
4445           daystamp);
4446
4447         if (p == NULL)
4448           {
4449           expand_string_message = US"hmac-sha1 conversion failed";
4450           goto EXPAND_FAILED;
4451           }
4452
4453         DEBUG(D_expand) debug_printf("prvscheck: received hash is %s\n", hash);
4454         DEBUG(D_expand) debug_printf("prvscheck:      own hash is %s\n", p);
4455
4456         if (Ustrcmp(p,hash) == 0)
4457           {
4458           /* Success, valid BATV address. Now check the expiry date. */
4459           uschar *now = prvs_daystamp(0);
4460           unsigned int inow = 0,iexpire = 1;
4461
4462           (void)sscanf(CS now,"%u",&inow);
4463           (void)sscanf(CS daystamp,"%u",&iexpire);
4464
4465           /* When "iexpire" is < 7, a "flip" has occured.
4466              Adjust "inow" accordingly. */
4467           if ( (iexpire < 7) && (inow >= 993) ) inow = 0;
4468
4469           if (iexpire >= inow)
4470             {
4471             prvscheck_result = US"1";
4472             DEBUG(D_expand) debug_printf("prvscheck: success, $pvrs_result set to 1\n");
4473             }
4474             else
4475             {
4476             prvscheck_result = NULL;
4477             DEBUG(D_expand) debug_printf("prvscheck: signature expired, $pvrs_result unset\n");
4478             }
4479           }
4480         else
4481           {
4482           prvscheck_result = NULL;
4483           DEBUG(D_expand) debug_printf("prvscheck: hash failure, $pvrs_result unset\n");
4484           }
4485
4486         /* Now expand the final argument. We leave this till now so that
4487         it can include $prvscheck_result. */
4488
4489         switch(read_subs(sub_arg, 1, 0, &s, skipping, TRUE, US"prvs", &resetok))
4490           {
4491           case 1: goto EXPAND_FAILED_CURLY;
4492           case 2:
4493           case 3: goto EXPAND_FAILED;
4494           }
4495
4496         if (sub_arg[0] == NULL || *sub_arg[0] == '\0')
4497           yield = string_cat(yield,&size,&ptr,prvscheck_address,Ustrlen(prvscheck_address));
4498         else
4499           yield = string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
4500
4501         /* Reset the "internal" variables afterwards, because they are in
4502         dynamic store that will be reclaimed if the expansion succeeded. */
4503
4504         prvscheck_address = NULL;
4505         prvscheck_keynum = NULL;
4506         }
4507       else
4508         {
4509         /* Does not look like a prvs encoded address, return the empty string.
4510            We need to make sure all subs are expanded first, so as to skip over
4511            the entire item. */
4512
4513         switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"prvs", &resetok))
4514           {
4515           case 1: goto EXPAND_FAILED_CURLY;
4516           case 2:
4517           case 3: goto EXPAND_FAILED;
4518           }
4519         }
4520
4521       continue;
4522       }
4523
4524     /* Handle "readfile" to insert an entire file */
4525
4526     case EITEM_READFILE:
4527       {
4528       FILE *f;
4529       uschar *sub_arg[2];
4530
4531       if ((expand_forbid & RDO_READFILE) != 0)
4532         {
4533         expand_string_message = US"file insertions are not permitted";
4534         goto EXPAND_FAILED;
4535         }
4536
4537       switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"readfile", &resetok))
4538         {
4539         case 1: goto EXPAND_FAILED_CURLY;
4540         case 2:
4541         case 3: goto EXPAND_FAILED;
4542         }
4543
4544       /* If skipping, we don't actually do anything */
4545
4546       if (skipping) continue;
4547
4548       /* Open the file and read it */
4549
4550       f = Ufopen(sub_arg[0], "rb");
4551       if (f == NULL)
4552         {
4553         expand_string_message = string_open_failed(errno, "%s", sub_arg[0]);
4554         goto EXPAND_FAILED;
4555         }
4556
4557       yield = cat_file(f, yield, &size, &ptr, sub_arg[1]);
4558       (void)fclose(f);
4559       continue;
4560       }
4561
4562     /* Handle "readsocket" to insert data from a Unix domain socket */
4563
4564     case EITEM_READSOCK:
4565       {
4566       int fd;
4567       int timeout = 5;
4568       int save_ptr = ptr;
4569       FILE *f;
4570       struct sockaddr_un sockun;         /* don't call this "sun" ! */
4571       uschar *arg;
4572       uschar *sub_arg[4];
4573
4574       if ((expand_forbid & RDO_READSOCK) != 0)
4575         {
4576         expand_string_message = US"socket insertions are not permitted";
4577         goto EXPAND_FAILED;
4578         }
4579
4580       /* Read up to 4 arguments, but don't do the end of item check afterwards,
4581       because there may be a string for expansion on failure. */
4582
4583       switch(read_subs(sub_arg, 4, 2, &s, skipping, FALSE, US"readsocket", &resetok))
4584         {
4585         case 1: goto EXPAND_FAILED_CURLY;
4586         case 2:                             /* Won't occur: no end check */
4587         case 3: goto EXPAND_FAILED;
4588         }
4589
4590       /* Sort out timeout, if given */
4591
4592       if (sub_arg[2] != NULL)
4593         {
4594         timeout = readconf_readtime(sub_arg[2], 0, FALSE);
4595         if (timeout < 0)
4596           {
4597           expand_string_message = string_sprintf("bad time value %s",
4598             sub_arg[2]);
4599           goto EXPAND_FAILED;
4600           }
4601         }
4602       else sub_arg[3] = NULL;                     /* No eol if no timeout */
4603
4604       /* If skipping, we don't actually do anything. Otherwise, arrange to
4605       connect to either an IP or a Unix socket. */
4606
4607       if (!skipping)
4608         {
4609         /* Handle an IP (internet) domain */
4610
4611         if (Ustrncmp(sub_arg[0], "inet:", 5) == 0)
4612           {
4613           int port;
4614           uschar *server_name = sub_arg[0] + 5;
4615           uschar *port_name = Ustrrchr(server_name, ':');
4616
4617           /* Sort out the port */
4618
4619           if (port_name == NULL)
4620             {
4621             expand_string_message =
4622               string_sprintf("missing port for readsocket %s", sub_arg[0]);
4623             goto EXPAND_FAILED;
4624             }
4625           *port_name++ = 0;           /* Terminate server name */
4626
4627           if (isdigit(*port_name))
4628             {
4629             uschar *end;
4630             port = Ustrtol(port_name, &end, 0);
4631             if (end != port_name + Ustrlen(port_name))
4632               {
4633               expand_string_message =
4634                 string_sprintf("invalid port number %s", port_name);
4635               goto EXPAND_FAILED;
4636               }
4637             }
4638           else
4639             {
4640             struct servent *service_info = getservbyname(CS port_name, "tcp");
4641             if (service_info == NULL)
4642               {
4643               expand_string_message = string_sprintf("unknown port \"%s\"",
4644                 port_name);
4645               goto EXPAND_FAILED;
4646               }
4647             port = ntohs(service_info->s_port);
4648             }
4649
4650           if ((fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
4651                   timeout, NULL, &expand_string_message)) < 0)
4652               goto SOCK_FAIL;
4653           }
4654
4655         /* Handle a Unix domain socket */
4656
4657         else
4658           {
4659           int rc;
4660           if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
4661             {
4662             expand_string_message = string_sprintf("failed to create socket: %s",
4663               strerror(errno));
4664             goto SOCK_FAIL;
4665             }
4666
4667           sockun.sun_family = AF_UNIX;
4668           sprintf(sockun.sun_path, "%.*s", (int)(sizeof(sockun.sun_path)-1),
4669             sub_arg[0]);
4670
4671           sigalrm_seen = FALSE;
4672           alarm(timeout);
4673           rc = connect(fd, (struct sockaddr *)(&sockun), sizeof(sockun));
4674           alarm(0);
4675           if (sigalrm_seen)
4676             {
4677             expand_string_message = US "socket connect timed out";
4678             goto SOCK_FAIL;
4679             }
4680           if (rc < 0)
4681             {
4682             expand_string_message = string_sprintf("failed to connect to socket "
4683               "%s: %s", sub_arg[0], strerror(errno));
4684             goto SOCK_FAIL;
4685             }
4686           }
4687
4688         DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]);
4689
4690         /* Allow sequencing of test actions */
4691         if (running_in_test_harness) millisleep(100);
4692
4693         /* Write the request string, if not empty */
4694
4695         if (sub_arg[1][0] != 0)
4696           {
4697           int len = Ustrlen(sub_arg[1]);
4698           DEBUG(D_expand) debug_printf("writing \"%s\" to socket\n",
4699             sub_arg[1]);
4700           if (write(fd, sub_arg[1], len) != len)
4701             {
4702             expand_string_message = string_sprintf("request write to socket "
4703               "failed: %s", strerror(errno));
4704             goto SOCK_FAIL;
4705             }
4706           }
4707
4708         /* Shut down the sending side of the socket. This helps some servers to
4709         recognise that it is their turn to do some work. Just in case some
4710         system doesn't have this function, make it conditional. */
4711
4712         #ifdef SHUT_WR
4713         shutdown(fd, SHUT_WR);
4714         #endif
4715
4716         if (running_in_test_harness) millisleep(100);
4717
4718         /* Now we need to read from the socket, under a timeout. The function
4719         that reads a file can be used. */
4720
4721         f = fdopen(fd, "rb");
4722         sigalrm_seen = FALSE;
4723         alarm(timeout);
4724         yield = cat_file(f, yield, &size, &ptr, sub_arg[3]);
4725         alarm(0);
4726         (void)fclose(f);
4727
4728         /* After a timeout, we restore the pointer in the result, that is,
4729         make sure we add nothing from the socket. */
4730
4731         if (sigalrm_seen)
4732           {
4733           ptr = save_ptr;
4734           expand_string_message = US "socket read timed out";
4735           goto SOCK_FAIL;
4736           }
4737         }
4738
4739       /* The whole thing has worked (or we were skipping). If there is a
4740       failure string following, we need to skip it. */
4741
4742       if (*s == '{')
4743         {
4744         if (expand_string_internal(s+1, TRUE, &s, TRUE, TRUE, &resetok) == NULL)
4745           goto EXPAND_FAILED;
4746         if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4747         while (isspace(*s)) s++;
4748         }
4749       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4750       continue;
4751
4752       /* Come here on failure to create socket, connect socket, write to the
4753       socket, or timeout on reading. If another substring follows, expand and
4754       use it. Otherwise, those conditions give expand errors. */
4755
4756       SOCK_FAIL:
4757       if (*s != '{') goto EXPAND_FAILED;
4758       DEBUG(D_any) debug_printf("%s\n", expand_string_message);
4759       arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok);
4760       if (arg == NULL) goto EXPAND_FAILED;
4761       yield = string_cat(yield, &size, &ptr, arg, Ustrlen(arg));
4762       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4763       while (isspace(*s)) s++;
4764       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4765       continue;
4766       }
4767
4768     /* Handle "run" to execute a program. */
4769
4770     case EITEM_RUN:
4771       {
4772       FILE *f;
4773       uschar *arg;
4774       uschar **argv;
4775       pid_t pid;
4776       int fd_in, fd_out;
4777       int lsize = 0;
4778       int lptr = 0;
4779
4780       if ((expand_forbid & RDO_RUN) != 0)
4781         {
4782         expand_string_message = US"running a command is not permitted";
4783         goto EXPAND_FAILED;
4784         }
4785
4786       while (isspace(*s)) s++;
4787       if (*s != '{') goto EXPAND_FAILED_CURLY;
4788       arg = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4789       if (arg == NULL) goto EXPAND_FAILED;
4790       while (isspace(*s)) s++;
4791       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4792
4793       if (skipping)   /* Just pretend it worked when we're skipping */
4794         {
4795         runrc = 0;
4796         }
4797       else
4798         {
4799         if (!transport_set_up_command(&argv,    /* anchor for arg list */
4800             arg,                                /* raw command */
4801             FALSE,                              /* don't expand the arguments */
4802             0,                                  /* not relevant when... */
4803             NULL,                               /* no transporting address */
4804             US"${run} expansion",               /* for error messages */
4805             &expand_string_message))            /* where to put error message */
4806           {
4807           goto EXPAND_FAILED;
4808           }
4809
4810         /* Create the child process, making it a group leader. */
4811
4812         pid = child_open(argv, NULL, 0077, &fd_in, &fd_out, TRUE);
4813
4814         if (pid < 0)
4815           {
4816           expand_string_message =
4817             string_sprintf("couldn't create child process: %s", strerror(errno));
4818           goto EXPAND_FAILED;
4819           }
4820
4821         /* Nothing is written to the standard input. */
4822
4823         (void)close(fd_in);
4824
4825         /* Read the pipe to get the command's output into $value (which is kept
4826         in lookup_value). Read during execution, so that if the output exceeds
4827         the OS pipe buffer limit, we don't block forever. */
4828
4829         f = fdopen(fd_out, "rb");
4830         sigalrm_seen = FALSE;
4831         alarm(60);
4832         lookup_value = cat_file(f, lookup_value, &lsize, &lptr, NULL);
4833         alarm(0);
4834         (void)fclose(f);
4835
4836         /* Wait for the process to finish, applying the timeout, and inspect its
4837         return code for serious disasters. Simple non-zero returns are passed on.
4838         */
4839
4840         if (sigalrm_seen == TRUE || (runrc = child_close(pid, 30)) < 0)
4841           {
4842           if (sigalrm_seen == TRUE || runrc == -256)
4843             {
4844             expand_string_message = string_sprintf("command timed out");
4845             killpg(pid, SIGKILL);       /* Kill the whole process group */
4846             }
4847
4848           else if (runrc == -257)
4849             expand_string_message = string_sprintf("wait() failed: %s",
4850               strerror(errno));
4851
4852           else
4853             expand_string_message = string_sprintf("command killed by signal %d",
4854               -runrc);
4855
4856           goto EXPAND_FAILED;
4857           }
4858         }
4859
4860       /* Process the yes/no strings; $value may be useful in both cases */
4861
4862       switch(process_yesno(
4863                skipping,                     /* were previously skipping */
4864                runrc == 0,                   /* success/failure indicator */
4865                lookup_value,                 /* value to reset for string2 */
4866                &s,                           /* input pointer */
4867                &yield,                       /* output pointer */
4868                &size,                        /* output size */
4869                &ptr,                         /* output current point */
4870                US"run",                      /* condition type */
4871                &resetok))
4872         {
4873         case 1: goto EXPAND_FAILED;          /* when all is well, the */
4874         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
4875         }
4876
4877       continue;
4878       }
4879
4880     /* Handle character translation for "tr" */
4881
4882     case EITEM_TR:
4883       {
4884       int oldptr = ptr;
4885       int o2m;
4886       uschar *sub[3];
4887
4888       switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"tr", &resetok))
4889         {
4890         case 1: goto EXPAND_FAILED_CURLY;
4891         case 2:
4892         case 3: goto EXPAND_FAILED;
4893         }
4894
4895       yield = string_cat(yield, &size, &ptr, sub[0], Ustrlen(sub[0]));
4896       o2m = Ustrlen(sub[2]) - 1;
4897
4898       if (o2m >= 0) for (; oldptr < ptr; oldptr++)
4899         {
4900         uschar *m = Ustrrchr(sub[1], yield[oldptr]);
4901         if (m != NULL)
4902           {
4903           int o = m - sub[1];
4904           yield[oldptr] = sub[2][(o < o2m)? o : o2m];
4905           }
4906         }
4907
4908       continue;
4909       }
4910
4911     /* Handle "hash", "length", "nhash", and "substr" when they are given with
4912     expanded arguments. */
4913
4914     case EITEM_HASH:
4915     case EITEM_LENGTH:
4916     case EITEM_NHASH:
4917     case EITEM_SUBSTR:
4918       {
4919       int i;
4920       int len;
4921       uschar *ret;
4922       int val[2] = { 0, -1 };
4923       uschar *sub[3];
4924
4925       /* "length" takes only 2 arguments whereas the others take 2 or 3.
4926       Ensure that sub[2] is set in the ${length } case. */
4927
4928       sub[2] = NULL;
4929       switch(read_subs(sub, (item_type == EITEM_LENGTH)? 2:3, 2, &s, skipping,
4930              TRUE, name, &resetok))
4931         {
4932         case 1: goto EXPAND_FAILED_CURLY;
4933         case 2:
4934         case 3: goto EXPAND_FAILED;
4935         }
4936
4937       /* Juggle the arguments if there are only two of them: always move the
4938       string to the last position and make ${length{n}{str}} equivalent to
4939       ${substr{0}{n}{str}}. See the defaults for val[] above. */
4940
4941       if (sub[2] == NULL)
4942         {
4943         sub[2] = sub[1];
4944         sub[1] = NULL;
4945         if (item_type == EITEM_LENGTH)
4946           {
4947           sub[1] = sub[0];
4948           sub[0] = NULL;
4949           }
4950         }
4951
4952       for (i = 0; i < 2; i++)
4953         {
4954         if (sub[i] == NULL) continue;
4955         val[i] = (int)Ustrtol(sub[i], &ret, 10);
4956         if (*ret != 0 || (i != 0 && val[i] < 0))
4957           {
4958           expand_string_message = string_sprintf("\"%s\" is not a%s number "
4959             "(in \"%s\" expansion)", sub[i], (i != 0)? " positive" : "", name);
4960           goto EXPAND_FAILED;
4961           }
4962         }
4963
4964       ret =
4965         (item_type == EITEM_HASH)?
4966           compute_hash(sub[2], val[0], val[1], &len) :
4967         (item_type == EITEM_NHASH)?
4968           compute_nhash(sub[2], val[0], val[1], &len) :
4969           extract_substr(sub[2], val[0], val[1], &len);
4970
4971       if (ret == NULL) goto EXPAND_FAILED;
4972       yield = string_cat(yield, &size, &ptr, ret, len);
4973       continue;
4974       }
4975
4976     /* Handle HMAC computation: ${hmac{<algorithm>}{<secret>}{<text>}}
4977     This code originally contributed by Steve Haslam. It currently supports
4978     the use of MD5 and SHA-1 hashes.
4979
4980     We need some workspace that is large enough to handle all the supported
4981     hash types. Use macros to set the sizes rather than be too elaborate. */
4982
4983     #define MAX_HASHLEN      20
4984     #define MAX_HASHBLOCKLEN 64
4985
4986     case EITEM_HMAC:
4987       {
4988       uschar *sub[3];
4989       md5 md5_base;
4990       sha1 sha1_base;
4991       void *use_base;
4992       int type, i;
4993       int hashlen;      /* Number of octets for the hash algorithm's output */
4994       int hashblocklen; /* Number of octets the hash algorithm processes */
4995       uschar *keyptr, *p;
4996       unsigned int keylen;
4997
4998       uschar keyhash[MAX_HASHLEN];
4999       uschar innerhash[MAX_HASHLEN];
5000       uschar finalhash[MAX_HASHLEN];
5001       uschar finalhash_hex[2*MAX_HASHLEN];
5002       uschar innerkey[MAX_HASHBLOCKLEN];
5003       uschar outerkey[MAX_HASHBLOCKLEN];
5004
5005       switch (read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
5006         {
5007         case 1: goto EXPAND_FAILED_CURLY;
5008         case 2:
5009         case 3: goto EXPAND_FAILED;
5010         }
5011
5012       if (Ustrcmp(sub[0], "md5") == 0)
5013         {
5014         type = HMAC_MD5;
5015         use_base = &md5_base;
5016         hashlen = 16;
5017         hashblocklen = 64;
5018         }
5019       else if (Ustrcmp(sub[0], "sha1") == 0)
5020         {
5021         type = HMAC_SHA1;
5022         use_base = &sha1_base;
5023         hashlen = 20;
5024         hashblocklen = 64;
5025         }
5026       else
5027         {
5028         expand_string_message =
5029           string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
5030         goto EXPAND_FAILED;
5031         }
5032
5033       keyptr = sub[1];
5034       keylen = Ustrlen(keyptr);
5035
5036       /* If the key is longer than the hash block length, then hash the key
5037       first */
5038
5039       if (keylen > hashblocklen)
5040         {
5041         chash_start(type, use_base);
5042         chash_end(type, use_base, keyptr, keylen, keyhash);
5043         keyptr = keyhash;
5044         keylen = hashlen;
5045         }
5046
5047       /* Now make the inner and outer key values */
5048
5049       memset(innerkey, 0x36, hashblocklen);
5050       memset(outerkey, 0x5c, hashblocklen);
5051
5052       for (i = 0; i < keylen; i++)
5053         {
5054         innerkey[i] ^= keyptr[i];
5055         outerkey[i] ^= keyptr[i];
5056         }
5057
5058       /* Now do the hashes */
5059
5060       chash_start(type, use_base);
5061       chash_mid(type, use_base, innerkey);
5062       chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
5063
5064       chash_start(type, use_base);
5065       chash_mid(type, use_base, outerkey);
5066       chash_end(type, use_base, innerhash, hashlen, finalhash);
5067
5068       /* Encode the final hash as a hex string */
5069
5070       p = finalhash_hex;
5071       for (i = 0; i < hashlen; i++)
5072         {
5073         *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
5074         *p++ = hex_digits[finalhash[i] & 0x0f];
5075         }
5076
5077       DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%.*s)=%.*s\n", sub[0],
5078         (int)keylen, keyptr, Ustrlen(sub[2]), sub[2], hashlen*2, finalhash_hex);
5079
5080       yield = string_cat(yield, &size, &ptr, finalhash_hex, hashlen*2);
5081       }
5082
5083     continue;
5084
5085     /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
5086     We have to save the numerical variables and restore them afterwards. */
5087
5088     case EITEM_SG:
5089       {
5090       const pcre *re;
5091       int moffset, moffsetextra, slen;
5092       int roffset;
5093       int emptyopt;
5094       const uschar *rerror;
5095       uschar *subject;
5096       uschar *sub[3];
5097       int save_expand_nmax =
5098         save_expand_strings(save_expand_nstring, save_expand_nlength);
5099
5100       switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"sg", &resetok))
5101         {
5102         case 1: goto EXPAND_FAILED_CURLY;
5103         case 2:
5104         case 3: goto EXPAND_FAILED;
5105         }
5106
5107       /* Compile the regular expression */
5108
5109       re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
5110         NULL);
5111
5112       if (re == NULL)
5113         {
5114         expand_string_message = string_sprintf("regular expression error in "
5115           "\"%s\": %s at offset %d", sub[1], rerror, roffset);
5116         goto EXPAND_FAILED;
5117         }
5118
5119       /* Now run a loop to do the substitutions as often as necessary. It ends
5120       when there are no more matches. Take care over matches of the null string;
5121       do the same thing as Perl does. */
5122
5123       subject = sub[0];
5124       slen = Ustrlen(sub[0]);
5125       moffset = moffsetextra = 0;
5126       emptyopt = 0;
5127
5128       for (;;)
5129         {
5130         int ovector[3*(EXPAND_MAXN+1)];
5131         int n = pcre_exec(re, NULL, CS subject, slen, moffset + moffsetextra,
5132           PCRE_EOPT | emptyopt, ovector, sizeof(ovector)/sizeof(int));
5133         int nn;
5134         uschar *insert;
5135
5136         /* No match - if we previously set PCRE_NOTEMPTY after a null match, this
5137         is not necessarily the end. We want to repeat the match from one
5138         character further along, but leaving the basic offset the same (for
5139         copying below). We can't be at the end of the string - that was checked
5140         before setting PCRE_NOTEMPTY. If PCRE_NOTEMPTY is not set, we are
5141         finished; copy the remaining string and end the loop. */
5142
5143         if (n < 0)
5144           {
5145           if (emptyopt != 0)
5146             {
5147             moffsetextra = 1;
5148             emptyopt = 0;
5149             continue;
5150             }
5151           yield = string_cat(yield, &size, &ptr, subject+moffset, slen-moffset);
5152           break;
5153           }
5154
5155         /* Match - set up for expanding the replacement. */
5156
5157         if (n == 0) n = EXPAND_MAXN + 1;
5158         expand_nmax = 0;
5159         for (nn = 0; nn < n*2; nn += 2)
5160           {
5161           expand_nstring[expand_nmax] = subject + ovector[nn];
5162           expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
5163           }
5164         expand_nmax--;
5165
5166         /* Copy the characters before the match, plus the expanded insertion. */
5167
5168         yield = string_cat(yield, &size, &ptr, subject + moffset,
5169           ovector[0] - moffset);
5170         insert = expand_string(sub[2]);
5171         if (insert == NULL) goto EXPAND_FAILED;
5172         yield = string_cat(yield, &size, &ptr, insert, Ustrlen(insert));
5173
5174         moffset = ovector[1];
5175         moffsetextra = 0;
5176         emptyopt = 0;
5177
5178         /* If we have matched an empty string, first check to see if we are at
5179         the end of the subject. If so, the loop is over. Otherwise, mimic
5180         what Perl's /g options does. This turns out to be rather cunning. First
5181         we set PCRE_NOTEMPTY and PCRE_ANCHORED and try the match a non-empty
5182         string at the same point. If this fails (picked up above) we advance to
5183         the next character. */
5184
5185         if (ovector[0] == ovector[1])
5186           {
5187           if (ovector[0] == slen) break;
5188           emptyopt = PCRE_NOTEMPTY | PCRE_ANCHORED;
5189           }
5190         }
5191
5192       /* All done - restore numerical variables. */
5193
5194       restore_expand_strings(save_expand_nmax, save_expand_nstring,
5195         save_expand_nlength);
5196       continue;
5197       }
5198
5199     /* Handle keyed and numbered substring extraction. If the first argument
5200     consists entirely of digits, then a numerical extraction is assumed. */
5201
5202     case EITEM_EXTRACT:
5203       {
5204       int i;
5205       int j = 2;
5206       int field_number = 1;
5207       BOOL field_number_set = FALSE;
5208       uschar *save_lookup_value = lookup_value;
5209       uschar *sub[3];
5210       int save_expand_nmax =
5211         save_expand_strings(save_expand_nstring, save_expand_nlength);
5212
5213       /* Read the arguments */
5214
5215       for (i = 0; i < j; i++)
5216         {
5217         while (isspace(*s)) s++;
5218         if (*s == '{')                                          /*}*/
5219           {
5220           sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5221           if (sub[i] == NULL) goto EXPAND_FAILED;               /*{*/
5222           if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5223
5224           /* After removal of leading and trailing white space, the first
5225           argument must not be empty; if it consists entirely of digits
5226           (optionally preceded by a minus sign), this is a numerical
5227           extraction, and we expect 3 arguments. */
5228
5229           if (i == 0)
5230             {
5231             int len;
5232             int x = 0;
5233             uschar *p = sub[0];
5234
5235             while (isspace(*p)) p++;
5236             sub[0] = p;
5237
5238             len = Ustrlen(p);
5239             while (len > 0 && isspace(p[len-1])) len--;
5240             p[len] = 0;
5241
5242             if (!skipping)
5243               {
5244               if (*p == 0)
5245                 {
5246                 expand_string_message = US"first argument of \"extract\" must "
5247                   "not be empty";
5248                 goto EXPAND_FAILED;
5249                 }
5250
5251               if (*p == '-')
5252                 {
5253                 field_number = -1;
5254                 p++;
5255                 }
5256               while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
5257               if (*p == 0)
5258                 {
5259                 field_number *= x;
5260                 j = 3;               /* Need 3 args */
5261                 field_number_set = TRUE;
5262                 }
5263               }
5264             }
5265           }
5266         else goto EXPAND_FAILED_CURLY;
5267         }
5268
5269       /* Extract either the numbered or the keyed substring into $value. If
5270       skipping, just pretend the extraction failed. */
5271
5272       lookup_value = skipping? NULL : field_number_set?
5273         expand_gettokened(field_number, sub[1], sub[2]) :
5274         expand_getkeyed(sub[0], sub[1]);
5275
5276       /* If no string follows, $value gets substituted; otherwise there can
5277       be yes/no strings, as for lookup or if. */
5278
5279       switch(process_yesno(
5280                skipping,                     /* were previously skipping */
5281                lookup_value != NULL,         /* success/failure indicator */
5282                save_lookup_value,            /* value to reset for string2 */
5283                &s,                           /* input pointer */
5284                &yield,                       /* output pointer */
5285                &size,                        /* output size */
5286                &ptr,                         /* output current point */
5287                US"extract",                  /* condition type */
5288                &resetok))
5289         {
5290         case 1: goto EXPAND_FAILED;          /* when all is well, the */
5291         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
5292         }
5293
5294       /* All done - restore numerical variables. */
5295
5296       restore_expand_strings(save_expand_nmax, save_expand_nstring,
5297         save_expand_nlength);
5298
5299       continue;
5300       }
5301
5302     /* return the Nth item from a list */
5303
5304     case EITEM_LISTEXTRACT:
5305       {
5306       int i;
5307       int field_number = 1;
5308       uschar *save_lookup_value = lookup_value;
5309       uschar *sub[2];
5310       int save_expand_nmax =
5311         save_expand_strings(save_expand_nstring, save_expand_nlength);
5312
5313       /* Read the field & list arguments */
5314
5315       for (i = 0; i < 2; i++)
5316         {
5317         while (isspace(*s)) s++;
5318         if (*s != '{')                                  /*}*/
5319           goto EXPAND_FAILED_CURLY;
5320
5321         sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5322         if (!sub[i])     goto EXPAND_FAILED;            /*{*/
5323         if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5324
5325         /* After removal of leading and trailing white space, the first
5326         argument must be numeric and nonempty. */
5327
5328         if (i == 0)
5329           {
5330           int len;
5331           int x = 0;
5332           uschar *p = sub[0];
5333
5334           while (isspace(*p)) p++;
5335           sub[0] = p;
5336
5337           len = Ustrlen(p);
5338           while (len > 0 && isspace(p[len-1])) len--;
5339           p[len] = 0;
5340
5341           if (!*p && !skipping)
5342             {
5343             expand_string_message = US"first argument of \"listextract\" must "
5344               "not be empty";
5345             goto EXPAND_FAILED;
5346             }
5347
5348           if (*p == '-')
5349             {
5350             field_number = -1;
5351             p++;
5352             }
5353           while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
5354           if (*p)
5355             {
5356             expand_string_message = US"first argument of \"listextract\" must "
5357               "be numeric";
5358             goto EXPAND_FAILED;
5359             }
5360           field_number *= x;
5361           }
5362         }
5363
5364       /* Extract the numbered element into $value. If
5365       skipping, just pretend the extraction failed. */
5366
5367       lookup_value = skipping? NULL : expand_getlistele(field_number, sub[1]);
5368
5369       /* If no string follows, $value gets substituted; otherwise there can
5370       be yes/no strings, as for lookup or if. */
5371
5372       switch(process_yesno(
5373                skipping,                     /* were previously skipping */
5374                lookup_value != NULL,         /* success/failure indicator */
5375                save_lookup_value,            /* value to reset for string2 */
5376                &s,                           /* input pointer */
5377                &yield,                       /* output pointer */
5378                &size,                        /* output size */
5379                &ptr,                         /* output current point */
5380                US"extract",                  /* condition type */
5381                &resetok))
5382         {
5383         case 1: goto EXPAND_FAILED;          /* when all is well, the */
5384         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
5385         }
5386
5387       /* All done - restore numerical variables. */
5388
5389       restore_expand_strings(save_expand_nmax, save_expand_nstring,
5390         save_expand_nlength);
5391
5392       continue;
5393       }
5394
5395 #ifdef SUPPORT_TLS
5396     case EITEM_CERTEXTRACT:
5397       {
5398       uschar *save_lookup_value = lookup_value;
5399       uschar *sub[2];
5400       int save_expand_nmax =
5401         save_expand_strings(save_expand_nstring, save_expand_nlength);
5402
5403       /* Read the field argument */
5404       while (isspace(*s)) s++;
5405       if (*s != '{')                                    /*}*/
5406         goto EXPAND_FAILED_CURLY;
5407       sub[0] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5408       if (!sub[0])     goto EXPAND_FAILED;              /*{*/
5409       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5410       /* strip spaces fore & aft */
5411       {
5412       int len;
5413       uschar *p = sub[0];
5414
5415       while (isspace(*p)) p++;
5416       sub[0] = p;
5417
5418       len = Ustrlen(p);
5419       while (len > 0 && isspace(p[len-1])) len--;
5420       p[len] = 0;
5421       }
5422
5423       /* inspect the cert argument */
5424       while (isspace(*s)) s++;
5425       if (*s != '{')                                    /*}*/
5426         goto EXPAND_FAILED_CURLY;
5427       if (*++s != '$')
5428         {
5429         expand_string_message = US"second argument of \"certextract\" must "
5430           "be a certificate variable";
5431         goto EXPAND_FAILED;
5432         }
5433       sub[1] = expand_string_internal(s+1, TRUE, &s, skipping, FALSE, &resetok);
5434       if (!sub[1])     goto EXPAND_FAILED;              /*{*/
5435       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5436
5437       if (skipping)
5438         lookup_value = NULL;
5439       else
5440         {
5441         lookup_value = expand_getcertele(sub[0], sub[1]);
5442         if (*expand_string_message) goto EXPAND_FAILED;
5443         }
5444       switch(process_yesno(
5445                skipping,                     /* were previously skipping */
5446                lookup_value != NULL,         /* success/failure indicator */
5447                save_lookup_value,            /* value to reset for string2 */
5448                &s,                           /* input pointer */
5449                &yield,                       /* output pointer */
5450                &size,                        /* output size */
5451                &ptr,                         /* output current point */
5452                US"extract",                  /* condition type */
5453                &resetok))
5454         {
5455         case 1: goto EXPAND_FAILED;          /* when all is well, the */
5456         case 2: goto EXPAND_FAILED_CURLY;    /* returned value is 0 */
5457         }
5458
5459       restore_expand_strings(save_expand_nmax, save_expand_nstring,
5460         save_expand_nlength);
5461       continue;
5462       }
5463 #endif  /*SUPPORT_TLS*/
5464
5465     /* Handle list operations */
5466
5467     case EITEM_FILTER:
5468     case EITEM_MAP:
5469     case EITEM_REDUCE:
5470       {
5471       int sep = 0;
5472       int save_ptr = ptr;
5473       uschar outsep[2] = { '\0', '\0' };
5474       uschar *list, *expr, *temp;
5475       uschar *save_iterate_item = iterate_item;
5476       uschar *save_lookup_value = lookup_value;
5477
5478       while (isspace(*s)) s++;
5479       if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5480
5481       list = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5482       if (list == NULL) goto EXPAND_FAILED;
5483       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5484
5485       if (item_type == EITEM_REDUCE)
5486         {
5487         while (isspace(*s)) s++;
5488         if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5489         temp = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5490         if (temp == NULL) goto EXPAND_FAILED;
5491         lookup_value = temp;
5492         if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5493         }
5494
5495       while (isspace(*s)) s++;
5496       if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5497
5498       expr = s;
5499
5500       /* For EITEM_FILTER, call eval_condition once, with result discarded (as
5501       if scanning a "false" part). This allows us to find the end of the
5502       condition, because if the list is empty, we won't actually evaluate the
5503       condition for real. For EITEM_MAP and EITEM_REDUCE, do the same, using
5504       the normal internal expansion function. */
5505
5506       if (item_type == EITEM_FILTER)
5507         {
5508         temp = eval_condition(expr, &resetok, NULL);
5509         if (temp != NULL) s = temp;
5510         }
5511       else
5512         {
5513         temp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
5514         }
5515
5516       if (temp == NULL)
5517         {
5518         expand_string_message = string_sprintf("%s inside \"%s\" item",
5519           expand_string_message, name);
5520         goto EXPAND_FAILED;
5521         }
5522
5523       while (isspace(*s)) s++;
5524       if (*s++ != '}')
5525         {                                               /*{*/
5526         expand_string_message = string_sprintf("missing } at end of condition "
5527           "or expression inside \"%s\"", name);
5528         goto EXPAND_FAILED;
5529         }
5530
5531       while (isspace(*s)) s++;                          /*{*/
5532       if (*s++ != '}')
5533         {                                               /*{*/
5534         expand_string_message = string_sprintf("missing } at end of \"%s\"",
5535           name);
5536         goto EXPAND_FAILED;
5537         }
5538
5539       /* If we are skipping, we can now just move on to the next item. When
5540       processing for real, we perform the iteration. */
5541
5542       if (skipping) continue;
5543       while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL)
5544         {
5545         *outsep = (uschar)sep;      /* Separator as a string */
5546
5547         DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
5548
5549         if (item_type == EITEM_FILTER)
5550           {
5551           BOOL condresult;
5552           if (eval_condition(expr, &resetok, &condresult) == NULL)
5553             {
5554             iterate_item = save_iterate_item;
5555             lookup_value = save_lookup_value;
5556             expand_string_message = string_sprintf("%s inside \"%s\" condition",
5557               expand_string_message, name);
5558             goto EXPAND_FAILED;
5559             }
5560           DEBUG(D_expand) debug_printf("%s: condition is %s\n", name,
5561             condresult? "true":"false");
5562           if (condresult)
5563             temp = iterate_item;    /* TRUE => include this item */
5564           else
5565             continue;               /* FALSE => skip this item */
5566           }
5567
5568         /* EITEM_MAP and EITEM_REDUCE */
5569
5570         else
5571           {
5572           temp = expand_string_internal(expr, TRUE, NULL, skipping, TRUE, &resetok);
5573           if (temp == NULL)
5574             {
5575             iterate_item = save_iterate_item;
5576             expand_string_message = string_sprintf("%s inside \"%s\" item",
5577               expand_string_message, name);
5578             goto EXPAND_FAILED;
5579             }
5580           if (item_type == EITEM_REDUCE)
5581             {
5582             lookup_value = temp;      /* Update the value of $value */
5583             continue;                 /* and continue the iteration */
5584             }
5585           }
5586
5587         /* We reach here for FILTER if the condition is true, always for MAP,
5588         and never for REDUCE. The value in "temp" is to be added to the output
5589         list that is being created, ensuring that any occurrences of the
5590         separator character are doubled. Unless we are dealing with the first
5591         item of the output list, add in a space if the new item begins with the
5592         separator character, or is an empty string. */
5593
5594         if (ptr != save_ptr && (temp[0] == *outsep || temp[0] == 0))
5595           yield = string_cat(yield, &size, &ptr, US" ", 1);
5596
5597         /* Add the string in "temp" to the output list that we are building,
5598         This is done in chunks by searching for the separator character. */
5599
5600         for (;;)
5601           {
5602           size_t seglen = Ustrcspn(temp, outsep);
5603             yield = string_cat(yield, &size, &ptr, temp, seglen + 1);
5604
5605           /* If we got to the end of the string we output one character
5606           too many; backup and end the loop. Otherwise arrange to double the
5607           separator. */
5608
5609           if (temp[seglen] == '\0') { ptr--; break; }
5610           yield = string_cat(yield, &size, &ptr, outsep, 1);
5611           temp += seglen + 1;
5612           }
5613
5614         /* Output a separator after the string: we will remove the redundant
5615         final one at the end. */
5616
5617         yield = string_cat(yield, &size, &ptr, outsep, 1);
5618         }   /* End of iteration over the list loop */
5619
5620       /* REDUCE has generated no output above: output the final value of
5621       $value. */
5622
5623       if (item_type == EITEM_REDUCE)
5624         {
5625         yield = string_cat(yield, &size, &ptr, lookup_value,
5626           Ustrlen(lookup_value));
5627         lookup_value = save_lookup_value;  /* Restore $value */
5628         }
5629
5630       /* FILTER and MAP generate lists: if they have generated anything, remove
5631       the redundant final separator. Even though an empty item at the end of a
5632       list does not count, this is tidier. */
5633
5634       else if (ptr != save_ptr) ptr--;
5635
5636       /* Restore preserved $item */
5637
5638       iterate_item = save_iterate_item;
5639       continue;
5640       }
5641
5642     case EITEM_SORT:
5643       {
5644       int sep = 0;
5645       uschar *srclist, *cmp, *xtract;
5646       uschar *srcitem;
5647       uschar *dstlist = NULL;
5648       uschar *dstkeylist = NULL;
5649       uschar * tmp;
5650       uschar *save_iterate_item = iterate_item;
5651
5652       while (isspace(*s)) s++;
5653       if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5654
5655       srclist = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5656       if (!srclist) goto EXPAND_FAILED;
5657       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5658
5659       while (isspace(*s)) s++;
5660       if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5661
5662       cmp = expand_string_internal(s, TRUE, &s, skipping, FALSE, &resetok);
5663       if (!cmp) goto EXPAND_FAILED;
5664       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5665
5666       while (isspace(*s)) s++;
5667       if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5668
5669       xtract = s;
5670       tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
5671       if (!tmp) goto EXPAND_FAILED;
5672       xtract = string_copyn(xtract, s - xtract);
5673
5674       if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5675                                                         /*{*/
5676       if (*s++ != '}')
5677         {                                               /*{*/
5678         expand_string_message = US"missing } at end of \"sort\"";
5679         goto EXPAND_FAILED;
5680         }
5681
5682       if (skipping) continue;
5683
5684       while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
5685         {
5686         uschar * dstitem;
5687         uschar * newlist = NULL;
5688         uschar * newkeylist = NULL;
5689         uschar * srcfield;
5690
5691         DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, srcitem);
5692
5693         /* extract field for comparisons */
5694         iterate_item = srcitem;
5695         if (  !(srcfield = expand_string_internal(xtract, FALSE, NULL, FALSE,
5696                                           TRUE, &resetok))
5697            || !*srcfield)
5698           {
5699           expand_string_message = string_sprintf(
5700               "field-extract in sort: \"%s\"", xtract);
5701           goto EXPAND_FAILED;
5702           }
5703
5704         /* Insertion sort */
5705
5706         /* copy output list until new-item < list-item */
5707         while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
5708           {
5709           uschar * dstfield;
5710           uschar * expr;
5711           BOOL before;
5712
5713           /* field for comparison */
5714           if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
5715             goto sort_mismatch;
5716
5717           /* build and run condition string */
5718           expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield);
5719
5720           DEBUG(D_expand) debug_printf("%s: cond = \"%s\"\n", name, expr);
5721           if (!eval_condition(expr, &resetok, &before))
5722             {
5723             expand_string_message = string_sprintf("comparison in sort: %s",
5724                 expr);
5725             goto EXPAND_FAILED;
5726             }
5727
5728           if (before)
5729             {
5730             /* New-item sorts before this dst-item.  Append new-item,
5731             then dst-item, then remainder of dst list. */
5732
5733             newlist = string_append_listele(newlist, sep, srcitem);
5734             newkeylist = string_append_listele(newkeylist, sep, srcfield);
5735             srcitem = NULL;
5736
5737             newlist = string_append_listele(newlist, sep, dstitem);
5738             newkeylist = string_append_listele(newkeylist, sep, dstfield);
5739
5740             while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
5741               {
5742               if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
5743                 goto sort_mismatch;
5744               newlist = string_append_listele(newlist, sep, dstitem);
5745               newkeylist = string_append_listele(newkeylist, sep, dstfield);
5746               }
5747
5748             break;
5749             }
5750
5751           newlist = string_append_listele(newlist, sep, dstitem);
5752           newkeylist = string_append_listele(newkeylist, sep, dstfield);
5753           }
5754
5755         /* If we ran out of dstlist without consuming srcitem, append it */
5756         if (srcitem)
5757           {
5758           newlist = string_append_listele(newlist, sep, srcitem);
5759           newkeylist = string_append_listele(newkeylist, sep, srcfield);
5760           }
5761
5762         dstlist = newlist;
5763         dstkeylist = newkeylist;
5764
5765         DEBUG(D_expand) debug_printf("%s: dstlist = \"%s\"\n", name, dstlist);
5766         DEBUG(D_expand) debug_printf("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
5767         }
5768
5769       if (dstlist)
5770         yield = string_cat(yield, &size, &ptr, dstlist, Ustrlen(dstlist));
5771
5772       /* Restore preserved $item */
5773       iterate_item = save_iterate_item;
5774       continue;
5775
5776       sort_mismatch:
5777         expand_string_message = US"Internal error in sort (list mismatch)";
5778         goto EXPAND_FAILED;
5779       }
5780
5781
5782     /* If ${dlfunc } support is configured, handle calling dynamically-loaded
5783     functions, unless locked out at this time. Syntax is ${dlfunc{file}{func}}
5784     or ${dlfunc{file}{func}{arg}} or ${dlfunc{file}{func}{arg1}{arg2}} or up to
5785     a maximum of EXPAND_DLFUNC_MAX_ARGS arguments (defined below). */
5786
5787     #define EXPAND_DLFUNC_MAX_ARGS 8
5788
5789     case EITEM_DLFUNC:
5790     #ifndef EXPAND_DLFUNC
5791     expand_string_message = US"\"${dlfunc\" encountered, but this facility "    /*}*/
5792       "is not included in this binary";
5793     goto EXPAND_FAILED;
5794
5795     #else   /* EXPAND_DLFUNC */
5796       {
5797       tree_node *t;
5798       exim_dlfunc_t *func;
5799       uschar *result;
5800       int status, argc;
5801       uschar *argv[EXPAND_DLFUNC_MAX_ARGS + 3];
5802
5803       if ((expand_forbid & RDO_DLFUNC) != 0)
5804         {
5805         expand_string_message =
5806           US"dynamically-loaded functions are not permitted";
5807         goto EXPAND_FAILED;
5808         }
5809
5810       switch(read_subs(argv, EXPAND_DLFUNC_MAX_ARGS + 2, 2, &s, skipping,
5811            TRUE, US"dlfunc", &resetok))
5812         {
5813         case 1: goto EXPAND_FAILED_CURLY;
5814         case 2:
5815         case 3: goto EXPAND_FAILED;
5816         }
5817
5818       /* If skipping, we don't actually do anything */
5819
5820       if (skipping) continue;
5821
5822       /* Look up the dynamically loaded object handle in the tree. If it isn't
5823       found, dlopen() the file and put the handle in the tree for next time. */
5824
5825       t = tree_search(dlobj_anchor, argv[0]);
5826       if (t == NULL)
5827         {
5828         void *handle = dlopen(CS argv[0], RTLD_LAZY);
5829         if (handle == NULL)
5830           {
5831           expand_string_message = string_sprintf("dlopen \"%s\" failed: %s",
5832             argv[0], dlerror());
5833           log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
5834           goto EXPAND_FAILED;
5835           }
5836         t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]));
5837         Ustrcpy(t->name, argv[0]);
5838         t->data.ptr = handle;
5839         (void)tree_insertnode(&dlobj_anchor, t);
5840         }
5841
5842       /* Having obtained the dynamically loaded object handle, look up the
5843       function pointer. */
5844
5845       func = (exim_dlfunc_t *)dlsym(t->data.ptr, CS argv[1]);
5846       if (func == NULL)
5847         {
5848         expand_string_message = string_sprintf("dlsym \"%s\" in \"%s\" failed: "
5849           "%s", argv[1], argv[0], dlerror());
5850         log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
5851         goto EXPAND_FAILED;
5852         }
5853
5854       /* Call the function and work out what to do with the result. If it
5855       returns OK, we have a replacement string; if it returns DEFER then
5856       expansion has failed in a non-forced manner; if it returns FAIL then
5857       failure was forced; if it returns ERROR or any other value there's a
5858       problem, so panic slightly. In any case, assume that the function has
5859       side-effects on the store that must be preserved. */
5860
5861       resetok = FALSE;
5862       result = NULL;
5863       for (argc = 0; argv[argc] != NULL; argc++);
5864       status = func(&result, argc - 2, &argv[2]);
5865       if(status == OK)
5866         {
5867         if (result == NULL) result = US"";
5868         yield = string_cat(yield, &size, &ptr, result, Ustrlen(result));
5869         continue;
5870         }
5871       else
5872         {
5873         expand_string_message = result == NULL ? US"(no message)" : result;
5874         if(status == FAIL_FORCED) expand_string_forcedfail = TRUE;
5875           else if(status != FAIL)
5876             log_write(0, LOG_MAIN|LOG_PANIC, "dlfunc{%s}{%s} failed (%d): %s",
5877               argv[0], argv[1], status, expand_string_message);
5878         goto EXPAND_FAILED;
5879         }
5880       }
5881     #endif /* EXPAND_DLFUNC */
5882     }   /* EITEM_* switch */
5883
5884   /* Control reaches here if the name is not recognized as one of the more
5885   complicated expansion items. Check for the "operator" syntax (name terminated
5886   by a colon). Some of the operators have arguments, separated by _ from the
5887   name. */
5888
5889   if (*s == ':')
5890     {
5891     int c;
5892     uschar *arg = NULL;
5893     uschar *sub;
5894     var_entry *vp = NULL;
5895
5896     /* Owing to an historical mis-design, an underscore may be part of the
5897     operator name, or it may introduce arguments.  We therefore first scan the
5898     table of names that contain underscores. If there is no match, we cut off
5899     the arguments and then scan the main table. */
5900
5901     if ((c = chop_match(name, op_table_underscore,
5902         sizeof(op_table_underscore)/sizeof(uschar *))) < 0)
5903       {
5904       arg = Ustrchr(name, '_');
5905       if (arg != NULL) *arg = 0;
5906       c = chop_match(name, op_table_main,
5907         sizeof(op_table_main)/sizeof(uschar *));
5908       if (c >= 0) c += sizeof(op_table_underscore)/sizeof(uschar *);
5909       if (arg != NULL) *arg++ = '_';   /* Put back for error messages */
5910       }
5911
5912     /* Deal specially with operators that might take a certificate variable
5913     as we do not want to do the usual expansion. For most, expand the string.*/
5914     switch(c)
5915       {
5916 #ifdef SUPPORT_TLS
5917       case EOP_MD5:
5918       case EOP_SHA1:
5919       case EOP_SHA256:
5920         if (s[1] == '$')
5921           {
5922           uschar * s1 = s;
5923           sub = expand_string_internal(s+2, TRUE, &s1, skipping,
5924                   FALSE, &resetok);
5925           if (!sub)       goto EXPAND_FAILED;           /*{*/
5926           if (*s1 != '}') goto EXPAND_FAILED_CURLY;
5927           if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
5928             {
5929             s = s1+1;
5930             break;
5931             }
5932           vp = NULL;
5933           }
5934         /*FALLTHROUGH*/
5935 #endif
5936       default:
5937         sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5938         if (!sub) goto EXPAND_FAILED;
5939         s++;
5940         break;
5941       }
5942
5943     /* If we are skipping, we don't need to perform the operation at all.
5944     This matters for operations like "mask", because the data may not be
5945     in the correct format when skipping. For example, the expression may test
5946     for the existence of $sender_host_address before trying to mask it. For
5947     other operations, doing them may not fail, but it is a waste of time. */
5948
5949     if (skipping && c >= 0) continue;
5950
5951     /* Otherwise, switch on the operator type */
5952
5953     switch(c)
5954       {
5955       case EOP_BASE62:
5956         {
5957         uschar *t;
5958         unsigned long int n = Ustrtoul(sub, &t, 10);
5959         if (*t != 0)
5960           {
5961           expand_string_message = string_sprintf("argument for base62 "
5962             "operator is \"%s\", which is not a decimal number", sub);
5963           goto EXPAND_FAILED;
5964           }
5965         t = string_base62(n);
5966         yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
5967         continue;
5968         }
5969
5970       /* Note that for Darwin and Cygwin, BASE_62 actually has the value 36 */
5971
5972       case EOP_BASE62D:
5973         {
5974         uschar buf[16];
5975         uschar *tt = sub;
5976         unsigned long int n = 0;
5977         while (*tt != 0)
5978           {
5979           uschar *t = Ustrchr(base62_chars, *tt++);
5980           if (t == NULL)
5981             {
5982             expand_string_message = string_sprintf("argument for base62d "
5983               "operator is \"%s\", which is not a base %d number", sub,
5984               BASE_62);
5985             goto EXPAND_FAILED;
5986             }
5987           n = n * BASE_62 + (t - base62_chars);
5988           }
5989         (void)sprintf(CS buf, "%ld", n);
5990         yield = string_cat(yield, &size, &ptr, buf, Ustrlen(buf));
5991         continue;
5992         }
5993
5994       case EOP_EXPAND:
5995         {
5996         uschar *expanded = expand_string_internal(sub, FALSE, NULL, skipping, TRUE, &resetok);
5997         if (expanded == NULL)
5998           {
5999           expand_string_message =
6000             string_sprintf("internal expansion of \"%s\" failed: %s", sub,
6001               expand_string_message);
6002           goto EXPAND_FAILED;
6003           }
6004         yield = string_cat(yield, &size, &ptr, expanded, Ustrlen(expanded));
6005         continue;
6006         }
6007
6008       case EOP_LC:
6009         {
6010         int count = 0;
6011         uschar *t = sub - 1;
6012         while (*(++t) != 0) { *t = tolower(*t); count++; }
6013         yield = string_cat(yield, &size, &ptr, sub, count);
6014         continue;
6015         }
6016
6017       case EOP_UC:
6018         {
6019         int count = 0;
6020         uschar *t = sub - 1;
6021         while (*(++t) != 0) { *t = toupper(*t); count++; }
6022         yield = string_cat(yield, &size, &ptr, sub, count);
6023         continue;
6024         }
6025
6026       case EOP_MD5:
6027 #ifdef SUPPORT_TLS
6028         if (vp && *(void **)vp->value)
6029           {
6030           uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
6031           yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
6032           }
6033         else
6034 #endif
6035           {
6036           md5 base;
6037           uschar digest[16];
6038           int j;
6039           char st[33];
6040           md5_start(&base);
6041           md5_end(&base, sub, Ustrlen(sub), digest);
6042           for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
6043           yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
6044           }
6045         continue;
6046
6047       case EOP_SHA1:
6048 #ifdef SUPPORT_TLS
6049         if (vp && *(void **)vp->value)
6050           {
6051           uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
6052           yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
6053           }
6054         else
6055 #endif
6056           {
6057           sha1 base;
6058           uschar digest[20];
6059           int j;
6060           char st[41];
6061           sha1_start(&base);
6062           sha1_end(&base, sub, Ustrlen(sub), digest);
6063           for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
6064           yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
6065           }
6066         continue;
6067
6068       case EOP_SHA256:
6069 #ifdef SUPPORT_TLS
6070         if (vp && *(void **)vp->value)
6071           {
6072           uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
6073           yield = string_cat(yield, &size, &ptr, cp, (int)Ustrlen(cp));
6074           }
6075         else
6076 #endif
6077           expand_string_message = US"sha256 only supported for certificates";
6078         continue;
6079
6080       /* Convert hex encoding to base64 encoding */
6081
6082       case EOP_HEX2B64:
6083         {
6084         int c = 0;
6085         int b = -1;
6086         uschar *in = sub;
6087         uschar *out = sub;
6088         uschar *enc;
6089
6090         for (enc = sub; *enc != 0; enc++)
6091           {
6092           if (!isxdigit(*enc))
6093             {
6094             expand_string_message = string_sprintf("\"%s\" is not a hex "
6095               "string", sub);
6096             goto EXPAND_FAILED;
6097             }
6098           c++;
6099           }
6100
6101         if ((c & 1) != 0)
6102           {
6103           expand_string_message = string_sprintf("\"%s\" contains an odd "
6104             "number of characters", sub);
6105           goto EXPAND_FAILED;
6106           }
6107
6108         while ((c = *in++) != 0)
6109           {
6110           if (isdigit(c)) c -= '0';
6111           else c = toupper(c) - 'A' + 10;
6112           if (b == -1)
6113             {
6114             b = c << 4;
6115             }
6116           else
6117             {
6118             *out++ = b | c;
6119             b = -1;
6120             }
6121           }
6122
6123         enc = auth_b64encode(sub, out - sub);
6124         yield = string_cat(yield, &size, &ptr, enc, Ustrlen(enc));
6125         continue;
6126         }
6127
6128       /* Convert octets outside 0x21..0x7E to \xXX form */
6129
6130       case EOP_HEXQUOTE:
6131         {
6132         uschar *t = sub - 1;
6133         while (*(++t) != 0)
6134           {
6135           if (*t < 0x21 || 0x7E < *t)
6136             yield = string_cat(yield, &size, &ptr,
6137               string_sprintf("\\x%02x", *t), 4);
6138           else
6139             yield = string_cat(yield, &size, &ptr, t, 1);
6140           }
6141         continue;
6142         }
6143
6144       /* count the number of list elements */
6145
6146       case EOP_LISTCOUNT:
6147         {
6148         int cnt = 0;
6149         int sep = 0;
6150         uschar * cp;
6151         uschar buffer[256];
6152
6153         while (string_nextinlist(&sub, &sep, buffer, sizeof(buffer)) != NULL) cnt++;
6154         cp = string_sprintf("%d", cnt);
6155         yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
6156         continue;
6157         }
6158
6159       /* expand a named list given the name */
6160       /* handles nested named lists; requotes as colon-sep list */
6161
6162       case EOP_LISTNAMED:
6163         {
6164         tree_node *t = NULL;
6165         uschar * list;
6166         int sep = 0;
6167         uschar * item;
6168         uschar * suffix = US"";
6169         BOOL needsep = FALSE;
6170         uschar buffer[256];
6171
6172         if (*sub == '+') sub++;
6173         if (arg == NULL)        /* no-argument version */
6174           {
6175           if (!(t = tree_search(addresslist_anchor, sub)) &&
6176               !(t = tree_search(domainlist_anchor,  sub)) &&
6177               !(t = tree_search(hostlist_anchor,    sub)))
6178             t = tree_search(localpartlist_anchor, sub);
6179           }
6180         else switch(*arg)       /* specific list-type version */
6181           {
6182           case 'a': t = tree_search(addresslist_anchor,   sub); suffix = US"_a"; break;
6183           case 'd': t = tree_search(domainlist_anchor,    sub); suffix = US"_d"; break;
6184           case 'h': t = tree_search(hostlist_anchor,      sub); suffix = US"_h"; break;
6185           case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
6186           default:
6187             expand_string_message = string_sprintf("bad suffix on \"list\" operator");
6188             goto EXPAND_FAILED;
6189           }
6190
6191         if(!t)
6192           {
6193           expand_string_message = string_sprintf("\"%s\" is not a %snamed list",
6194             sub, !arg?""
6195               : *arg=='a'?"address "
6196               : *arg=='d'?"domain "
6197               : *arg=='h'?"host "
6198               : *arg=='l'?"localpart "
6199               : 0);
6200           goto EXPAND_FAILED;
6201           }
6202
6203         list = ((namedlist_block *)(t->data.ptr))->string;
6204
6205         while ((item = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
6206           {
6207           uschar * buf = US" : ";
6208           if (needsep)
6209             yield = string_cat(yield, &size, &ptr, buf, 3);
6210           else
6211             needsep = TRUE;
6212
6213           if (*item == '+')     /* list item is itself a named list */
6214             {
6215             uschar * sub = string_sprintf("${listnamed%s:%s}", suffix, item);
6216             item = expand_string_internal(sub, FALSE, NULL, FALSE, TRUE, &resetok);
6217             }
6218           else if (sep != ':')  /* item from non-colon-sep list, re-quote for colon list-separator */
6219             {
6220             char * cp;
6221             char tok[3];
6222             tok[0] = sep; tok[1] = ':'; tok[2] = 0;
6223             while ((cp= strpbrk((const char *)item, tok)))
6224               {
6225               yield = string_cat(yield, &size, &ptr, item, cp-(char *)item);
6226               if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */
6227                 {
6228                 yield = string_cat(yield, &size, &ptr, US"::", 2);
6229                 item = (uschar *)cp;
6230                 }
6231               else              /* sep in item; should already be doubled; emit once */
6232                 {
6233                 yield = string_cat(yield, &size, &ptr, (uschar *)tok, 1);
6234                 if (*cp == sep) cp++;
6235                 item = (uschar *)cp;
6236                 }
6237               }
6238             }
6239           yield = string_cat(yield, &size, &ptr, item, Ustrlen(item));
6240           }
6241         continue;
6242         }
6243
6244       /* mask applies a mask to an IP address; for example the result of
6245       ${mask:131.111.10.206/28} is 131.111.10.192/28. */
6246
6247       case EOP_MASK:
6248         {
6249         int count;
6250         uschar *endptr;
6251         int binary[4];
6252         int mask, maskoffset;
6253         int type = string_is_ip_address(sub, &maskoffset);
6254         uschar buffer[64];
6255
6256         if (type == 0)
6257           {
6258           expand_string_message = string_sprintf("\"%s\" is not an IP address",
6259            sub);
6260           goto EXPAND_FAILED;
6261           }
6262
6263         if (maskoffset == 0)
6264           {
6265           expand_string_message = string_sprintf("missing mask value in \"%s\"",
6266             sub);
6267           goto EXPAND_FAILED;
6268           }
6269
6270         mask = Ustrtol(sub + maskoffset + 1, &endptr, 10);
6271
6272         if (*endptr != 0 || mask < 0 || mask > ((type == 4)? 32 : 128))
6273           {
6274           expand_string_message = string_sprintf("mask value too big in \"%s\"",
6275             sub);
6276           goto EXPAND_FAILED;
6277           }
6278
6279         /* Convert the address to binary integer(s) and apply the mask */
6280
6281         sub[maskoffset] = 0;
6282         count = host_aton(sub, binary);
6283         host_mask(count, binary, mask);
6284
6285         /* Convert to masked textual format and add to output. */
6286
6287         yield = string_cat(yield, &size, &ptr, buffer,
6288           host_nmtoa(count, binary, mask, buffer, '.'));
6289         continue;
6290         }
6291
6292       case EOP_ADDRESS:
6293       case EOP_LOCAL_PART:
6294       case EOP_DOMAIN:
6295         {
6296         uschar *error;
6297         int start, end, domain;
6298         uschar *t = parse_extract_address(sub, &error, &start, &end, &domain,
6299           FALSE);
6300         if (t != NULL)
6301           {
6302           if (c != EOP_DOMAIN)
6303             {
6304             if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1;
6305             yield = string_cat(yield, &size, &ptr, sub+start, end-start);
6306             }
6307           else if (domain != 0)
6308             {
6309             domain += start;
6310             yield = string_cat(yield, &size, &ptr, sub+domain, end-domain);
6311             }
6312           }
6313         continue;
6314         }
6315
6316       case EOP_ADDRESSES:
6317         {
6318         uschar outsep[2] = { ':', '\0' };
6319         uschar *address, *error;
6320         int save_ptr = ptr;
6321         int start, end, domain;  /* Not really used */
6322
6323         while (isspace(*sub)) sub++;
6324         if (*sub == '>') { *outsep = *++sub; ++sub; }
6325         parse_allow_group = TRUE;
6326
6327         for (;;)
6328           {
6329           uschar *p = parse_find_address_end(sub, FALSE);
6330           uschar saveend = *p;
6331           *p = '\0';
6332           address = parse_extract_address(sub, &error, &start, &end, &domain,
6333             FALSE);
6334           *p = saveend;
6335
6336           /* Add the address to the output list that we are building. This is
6337           done in chunks by searching for the separator character. At the
6338           start, unless we are dealing with the first address of the output
6339           list, add in a space if the new address begins with the separator
6340           character, or is an empty string. */
6341
6342           if (address != NULL)
6343             {
6344             if (ptr != save_ptr && address[0] == *outsep)
6345               yield = string_cat(yield, &size, &ptr, US" ", 1);
6346
6347             for (;;)
6348               {
6349               size_t seglen = Ustrcspn(address, outsep);
6350               yield = string_cat(yield, &size, &ptr, address, seglen + 1);
6351
6352               /* If we got to the end of the string we output one character
6353               too many. */
6354
6355               if (address[seglen] == '\0') { ptr--; break; }
6356               yield = string_cat(yield, &size, &ptr, outsep, 1);
6357               address += seglen + 1;
6358               }
6359
6360             /* Output a separator after the string: we will remove the
6361             redundant final one at the end. */
6362
6363             yield = string_cat(yield, &size, &ptr, outsep, 1);
6364             }
6365
6366           if (saveend == '\0') break;
6367           sub = p + 1;
6368           }
6369
6370         /* If we have generated anything, remove the redundant final
6371         separator. */
6372
6373         if (ptr != save_ptr) ptr--;
6374         parse_allow_group = FALSE;
6375         continue;
6376         }
6377
6378
6379       /* quote puts a string in quotes if it is empty or contains anything
6380       other than alphamerics, underscore, dot, or hyphen.
6381
6382       quote_local_part puts a string in quotes if RFC 2821/2822 requires it to
6383       be quoted in order to be a valid local part.
6384
6385       In both cases, newlines and carriage returns are converted into \n and \r
6386       respectively */
6387
6388       case EOP_QUOTE:
6389       case EOP_QUOTE_LOCAL_PART:
6390       if (arg == NULL)
6391         {
6392         BOOL needs_quote = (*sub == 0);      /* TRUE for empty string */
6393         uschar *t = sub - 1;
6394
6395         if (c == EOP_QUOTE)
6396           {
6397           while (!needs_quote && *(++t) != 0)
6398             needs_quote = !isalnum(*t) && !strchr("_-.", *t);
6399           }
6400         else  /* EOP_QUOTE_LOCAL_PART */
6401           {
6402           while (!needs_quote && *(++t) != 0)
6403             needs_quote = !isalnum(*t) &&
6404               strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
6405               (*t != '.' || t == sub || t[1] == 0);
6406           }
6407
6408         if (needs_quote)
6409           {
6410           yield = string_cat(yield, &size, &ptr, US"\"", 1);
6411           t = sub - 1;
6412           while (*(++t) != 0)
6413             {
6414             if (*t == '\n')
6415               yield = string_cat(yield, &size, &ptr, US"\\n", 2);
6416             else if (*t == '\r')
6417               yield = string_cat(yield, &size, &ptr, US"\\r", 2);
6418             else
6419               {
6420               if (*t == '\\' || *t == '"')
6421                 yield = string_cat(yield, &size, &ptr, US"\\", 1);
6422               yield = string_cat(yield, &size, &ptr, t, 1);
6423               }
6424             }
6425           yield = string_cat(yield, &size, &ptr, US"\"", 1);
6426           }
6427         else yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
6428         continue;
6429         }
6430
6431       /* quote_lookuptype does lookup-specific quoting */
6432
6433       else
6434         {
6435         int n;
6436         uschar *opt = Ustrchr(arg, '_');
6437
6438         if (opt != NULL) *opt++ = 0;
6439
6440         n = search_findtype(arg, Ustrlen(arg));
6441         if (n < 0)
6442           {
6443           expand_string_message = search_error_message;
6444           goto EXPAND_FAILED;
6445           }
6446
6447         if (lookup_list[n]->quote != NULL)
6448           sub = (lookup_list[n]->quote)(sub, opt);
6449         else if (opt != NULL) sub = NULL;
6450
6451         if (sub == NULL)
6452           {
6453           expand_string_message = string_sprintf(
6454             "\"%s\" unrecognized after \"${quote_%s\"",
6455             opt, arg);
6456           goto EXPAND_FAILED;
6457           }
6458
6459         yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
6460         continue;
6461         }
6462
6463       /* rx quote sticks in \ before any non-alphameric character so that
6464       the insertion works in a regular expression. */
6465
6466       case EOP_RXQUOTE:
6467         {
6468         uschar *t = sub - 1;
6469         while (*(++t) != 0)
6470           {
6471           if (!isalnum(*t))
6472             yield = string_cat(yield, &size, &ptr, US"\\", 1);
6473           yield = string_cat(yield, &size, &ptr, t, 1);
6474           }
6475         continue;
6476         }
6477
6478       /* RFC 2047 encodes, assuming headers_charset (default ISO 8859-1) as
6479       prescribed by the RFC, if there are characters that need to be encoded */
6480
6481       case EOP_RFC2047:
6482         {
6483         uschar buffer[2048];
6484         uschar *string = parse_quote_2047(sub, Ustrlen(sub), headers_charset,
6485           buffer, sizeof(buffer), FALSE);
6486         yield = string_cat(yield, &size, &ptr, string, Ustrlen(string));
6487         continue;
6488         }
6489
6490       /* RFC 2047 decode */
6491
6492       case EOP_RFC2047D:
6493         {
6494         int len;
6495         uschar *error;
6496         uschar *decoded = rfc2047_decode(sub, check_rfc2047_length,
6497           headers_charset, '?', &len, &error);
6498         if (error != NULL)
6499           {
6500           expand_string_message = error;
6501           goto EXPAND_FAILED;
6502           }
6503         yield = string_cat(yield, &size, &ptr, decoded, len);
6504         continue;
6505         }
6506
6507       /* from_utf8 converts UTF-8 to 8859-1, turning non-existent chars into
6508       underscores */
6509
6510       case EOP_FROM_UTF8:
6511         {
6512         while (*sub != 0)
6513           {
6514           int c;
6515           uschar buff[4];
6516           GETUTF8INC(c, sub);
6517           if (c > 255) c = '_';
6518           buff[0] = c;
6519           yield = string_cat(yield, &size, &ptr, buff, 1);
6520           }
6521         continue;
6522         }
6523
6524           /* replace illegal UTF-8 sequences by replacement character  */
6525
6526       #define UTF8_REPLACEMENT_CHAR US"?"
6527
6528       case EOP_UTF8CLEAN:
6529         {
6530         int seq_len = 0, index = 0;
6531         int bytes_left = 0;
6532         long codepoint = -1;
6533         uschar seq_buff[4];                     /* accumulate utf-8 here */
6534
6535         while (*sub != 0)
6536           {
6537           int complete = 0;
6538           uschar c = *sub++;
6539
6540           if (bytes_left)
6541             {
6542             if ((c & 0xc0) != 0x80)
6543               {
6544                     /* wrong continuation byte; invalidate all bytes */
6545               complete = 1; /* error */
6546               }
6547             else
6548               {
6549               codepoint = (codepoint << 6) | (c & 0x3f);
6550               seq_buff[index++] = c;
6551               if (--bytes_left == 0)            /* codepoint complete */
6552                 {
6553                 if(codepoint > 0x10FFFF)        /* is it too large? */
6554                   complete = -1;        /* error (RFC3629 limit) */
6555                 else
6556                   {             /* finished; output utf-8 sequence */
6557                   yield = string_cat(yield, &size, &ptr, seq_buff, seq_len);
6558                   index = 0;
6559                   }
6560                 }
6561               }
6562             }
6563           else  /* no bytes left: new sequence */
6564             {
6565             if((c & 0x80) == 0) /* 1-byte sequence, US-ASCII, keep it */
6566               {
6567               yield = string_cat(yield, &size, &ptr, &c, 1);
6568               continue;
6569               }
6570             if((c & 0xe0) == 0xc0)              /* 2-byte sequence */
6571               {
6572               if(c == 0xc0 || c == 0xc1)        /* 0xc0 and 0xc1 are illegal */
6573                 complete = -1;
6574               else
6575                 {
6576                   bytes_left = 1;
6577                   codepoint = c & 0x1f;
6578                 }
6579               }
6580             else if((c & 0xf0) == 0xe0)         /* 3-byte sequence */
6581               {
6582               bytes_left = 2;
6583               codepoint = c & 0x0f;
6584               }
6585             else if((c & 0xf8) == 0xf0)         /* 4-byte sequence */
6586               {
6587               bytes_left = 3;
6588               codepoint = c & 0x07;
6589               }
6590             else        /* invalid or too long (RFC3629 allows only 4 bytes) */
6591               complete = -1;
6592
6593             seq_buff[index++] = c;
6594             seq_len = bytes_left + 1;
6595             }           /* if(bytes_left) */
6596
6597           if (complete != 0)
6598             {
6599             bytes_left = index = 0;
6600             yield = string_cat(yield, &size, &ptr, UTF8_REPLACEMENT_CHAR, 1);
6601             }
6602           if ((complete == 1) && ((c & 0x80) == 0))
6603             { /* ASCII character follows incomplete sequence */
6604               yield = string_cat(yield, &size, &ptr, &c, 1);
6605             }
6606           }
6607         continue;
6608         }
6609
6610       /* escape turns all non-printing characters into escape sequences. */
6611
6612       case EOP_ESCAPE:
6613         {
6614         uschar *t = string_printing(sub);
6615         yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
6616         continue;
6617         }
6618
6619       /* Handle numeric expression evaluation */
6620
6621       case EOP_EVAL:
6622       case EOP_EVAL10:
6623         {
6624         uschar *save_sub = sub;
6625         uschar *error = NULL;
6626         int_eximarith_t n = eval_expr(&sub, (c == EOP_EVAL10), &error, FALSE);
6627         if (error != NULL)
6628           {
6629           expand_string_message = string_sprintf("error in expression "
6630             "evaluation: %s (after processing \"%.*s\")", error, sub-save_sub,
6631               save_sub);
6632           goto EXPAND_FAILED;
6633           }
6634         sprintf(CS var_buffer, PR_EXIM_ARITH, n);
6635         yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
6636         continue;
6637         }
6638
6639       /* Handle time period formating */
6640
6641       case EOP_TIME_EVAL:
6642         {
6643         int n = readconf_readtime(sub, 0, FALSE);
6644         if (n < 0)
6645           {
6646           expand_string_message = string_sprintf("string \"%s\" is not an "
6647             "Exim time interval in \"%s\" operator", sub, name);
6648           goto EXPAND_FAILED;
6649           }
6650         sprintf(CS var_buffer, "%d", n);
6651         yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
6652         continue;
6653         }
6654
6655       case EOP_TIME_INTERVAL:
6656         {
6657         int n;
6658         uschar *t = read_number(&n, sub);
6659         if (*t != 0) /* Not A Number*/
6660           {
6661           expand_string_message = string_sprintf("string \"%s\" is not a "
6662             "positive number in \"%s\" operator", sub, name);
6663           goto EXPAND_FAILED;
6664           }
6665         t = readconf_printtime(n);
6666         yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
6667         continue;
6668         }
6669
6670       /* Convert string to base64 encoding */
6671
6672       case EOP_STR2B64:
6673         {
6674         uschar *encstr = auth_b64encode(sub, Ustrlen(sub));
6675         yield = string_cat(yield, &size, &ptr, encstr, Ustrlen(encstr));
6676         continue;
6677         }
6678
6679       /* strlen returns the length of the string */
6680
6681       case EOP_STRLEN:
6682         {
6683         uschar buff[24];
6684         (void)sprintf(CS buff, "%d", Ustrlen(sub));
6685         yield = string_cat(yield, &size, &ptr, buff, Ustrlen(buff));
6686         continue;
6687         }
6688
6689       /* length_n or l_n takes just the first n characters or the whole string,
6690       whichever is the shorter;
6691
6692       substr_m_n, and s_m_n take n characters from offset m; negative m take
6693       from the end; l_n is synonymous with s_0_n. If n is omitted in substr it
6694       takes the rest, either to the right or to the left.
6695
6696       hash_n or h_n makes a hash of length n from the string, yielding n
6697       characters from the set a-z; hash_n_m makes a hash of length n, but
6698       uses m characters from the set a-zA-Z0-9.
6699
6700       nhash_n returns a single number between 0 and n-1 (in text form), while
6701       nhash_n_m returns a div/mod hash as two numbers "a/b". The first lies
6702       between 0 and n-1 and the second between 0 and m-1. */
6703
6704       case EOP_LENGTH:
6705       case EOP_L:
6706       case EOP_SUBSTR:
6707       case EOP_S:
6708       case EOP_HASH:
6709       case EOP_H:
6710       case EOP_NHASH:
6711       case EOP_NH:
6712         {
6713         int sign = 1;
6714         int value1 = 0;
6715         int value2 = -1;
6716         int *pn;
6717         int len;
6718         uschar *ret;
6719
6720         if (arg == NULL)
6721           {
6722           expand_string_message = string_sprintf("missing values after %s",
6723             name);
6724           goto EXPAND_FAILED;
6725           }
6726
6727         /* "length" has only one argument, effectively being synonymous with
6728         substr_0_n. */
6729
6730         if (c == EOP_LENGTH || c == EOP_L)
6731           {
6732           pn = &value2;
6733           value2 = 0;
6734           }
6735
6736         /* The others have one or two arguments; for "substr" the first may be
6737         negative. The second being negative means "not supplied". */
6738
6739         else
6740           {
6741           pn = &value1;
6742           if (name[0] == 's' && *arg == '-') { sign = -1; arg++; }
6743           }
6744
6745         /* Read up to two numbers, separated by underscores */
6746
6747         ret = arg;
6748         while (*arg != 0)
6749           {
6750           if (arg != ret && *arg == '_' && pn == &value1)
6751             {
6752             pn = &value2;
6753             value2 = 0;
6754             if (arg[1] != 0) arg++;
6755             }
6756           else if (!isdigit(*arg))
6757             {
6758             expand_string_message =
6759               string_sprintf("non-digit after underscore in \"%s\"", name);
6760             goto EXPAND_FAILED;
6761             }
6762           else *pn = (*pn)*10 + *arg++ - '0';
6763           }
6764         value1 *= sign;
6765
6766         /* Perform the required operation */
6767
6768         ret =
6769           (c == EOP_HASH || c == EOP_H)?
6770              compute_hash(sub, value1, value2, &len) :
6771           (c == EOP_NHASH || c == EOP_NH)?
6772              compute_nhash(sub, value1, value2, &len) :
6773              extract_substr(sub, value1, value2, &len);
6774
6775         if (ret == NULL) goto EXPAND_FAILED;
6776         yield = string_cat(yield, &size, &ptr, ret, len);
6777         continue;
6778         }
6779
6780       /* Stat a path */
6781
6782       case EOP_STAT:
6783         {
6784         uschar *s;
6785         uschar smode[12];
6786         uschar **modetable[3];
6787         int i;
6788         mode_t mode;
6789         struct stat st;
6790
6791         if ((expand_forbid & RDO_EXISTS) != 0)
6792           {
6793           expand_string_message = US"Use of the stat() expansion is not permitted";
6794           goto EXPAND_FAILED;
6795           }
6796
6797         if (stat(CS sub, &st) < 0)
6798           {
6799           expand_string_message = string_sprintf("stat(%s) failed: %s",
6800             sub, strerror(errno));
6801           goto EXPAND_FAILED;
6802           }
6803         mode = st.st_mode;
6804         switch (mode & S_IFMT)
6805           {
6806           case S_IFIFO: smode[0] = 'p'; break;
6807           case S_IFCHR: smode[0] = 'c'; break;
6808           case S_IFDIR: smode[0] = 'd'; break;
6809           case S_IFBLK: smode[0] = 'b'; break;
6810           case S_IFREG: smode[0] = '-'; break;
6811           default: smode[0] = '?'; break;
6812           }
6813
6814         modetable[0] = ((mode & 01000) == 0)? mtable_normal : mtable_sticky;
6815         modetable[1] = ((mode & 02000) == 0)? mtable_normal : mtable_setid;
6816         modetable[2] = ((mode & 04000) == 0)? mtable_normal : mtable_setid;
6817
6818         for (i = 0; i < 3; i++)
6819           {
6820           memcpy(CS(smode + 7 - i*3), CS(modetable[i][mode & 7]), 3);
6821           mode >>= 3;
6822           }
6823
6824         smode[10] = 0;
6825         s = string_sprintf("mode=%04lo smode=%s inode=%ld device=%ld links=%ld "
6826           "uid=%ld gid=%ld size=" OFF_T_FMT " atime=%ld mtime=%ld ctime=%ld",
6827           (long)(st.st_mode & 077777), smode, (long)st.st_ino,
6828           (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
6829           (long)st.st_gid, st.st_size, (long)st.st_atime,
6830           (long)st.st_mtime, (long)st.st_ctime);
6831         yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
6832         continue;
6833         }
6834
6835       /* vaguely random number less than N */
6836
6837       case EOP_RANDINT:
6838         {
6839         int_eximarith_t max;
6840         uschar *s;
6841
6842         max = expanded_string_integer(sub, TRUE);
6843         if (expand_string_message != NULL)
6844           goto EXPAND_FAILED;
6845         s = string_sprintf("%d", vaguely_random_number((int)max));
6846         yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
6847         continue;
6848         }
6849
6850       /* Reverse IP, including IPv6 to dotted-nibble */
6851
6852       case EOP_REVERSE_IP:
6853         {
6854         int family, maskptr;
6855         uschar reversed[128];
6856
6857         family = string_is_ip_address(sub, &maskptr);
6858         if (family == 0)
6859           {
6860           expand_string_message = string_sprintf(
6861               "reverse_ip() not given an IP address [%s]", sub);
6862           goto EXPAND_FAILED;
6863           }
6864         invert_address(reversed, sub);
6865         yield = string_cat(yield, &size, &ptr, reversed, Ustrlen(reversed));
6866         continue;
6867         }
6868
6869       /* Unknown operator */
6870
6871       default:
6872       expand_string_message =
6873         string_sprintf("unknown expansion operator \"%s\"", name);
6874       goto EXPAND_FAILED;
6875       }
6876     }
6877
6878   /* Handle a plain name. If this is the first thing in the expansion, release
6879   the pre-allocated buffer. If the result data is known to be in a new buffer,
6880   newsize will be set to the size of that buffer, and we can just point at that
6881   store instead of copying. Many expansion strings contain just one reference,
6882   so this is a useful optimization, especially for humungous headers
6883   ($message_headers). */
6884                                                 /*{*/
6885   if (*s++ == '}')
6886     {
6887     int len;
6888     int newsize = 0;
6889     if (ptr == 0)
6890       {
6891       if (resetok) store_reset(yield);
6892       yield = NULL;
6893       size = 0;
6894       }
6895     value = find_variable(name, FALSE, skipping, &newsize);
6896     if (value == NULL)
6897       {
6898       expand_string_message =
6899         string_sprintf("unknown variable in \"${%s}\"", name);
6900       check_variable_error_message(name);
6901       goto EXPAND_FAILED;
6902       }
6903     len = Ustrlen(value);
6904     if (yield == NULL && newsize != 0)
6905       {
6906       yield = value;
6907       size = newsize;
6908       ptr = len;
6909       }
6910     else yield = string_cat(yield, &size, &ptr, value, len);
6911     continue;
6912     }
6913
6914   /* Else there's something wrong */
6915
6916   expand_string_message =
6917     string_sprintf("\"${%s\" is not a known operator (or a } is missing "
6918     "in a variable reference)", name);
6919   goto EXPAND_FAILED;
6920   }
6921
6922 /* If we hit the end of the string when ket_ends is set, there is a missing
6923 terminating brace. */
6924
6925 if (ket_ends && *s == 0)
6926   {
6927   expand_string_message = malformed_header?
6928     US"missing } at end of string - could be header name not terminated by colon"
6929     :
6930     US"missing } at end of string";
6931   goto EXPAND_FAILED;
6932   }
6933
6934 /* Expansion succeeded; yield may still be NULL here if nothing was actually
6935 added to the string. If so, set up an empty string. Add a terminating zero. If
6936 left != NULL, return a pointer to the terminator. */
6937
6938 if (yield == NULL) yield = store_get(1);
6939 yield[ptr] = 0;
6940 if (left != NULL) *left = s;
6941
6942 /* Any stacking store that was used above the final string is no longer needed.
6943 In many cases the final string will be the first one that was got and so there
6944 will be optimal store usage. */
6945
6946 if (resetok) store_reset(yield + ptr + 1);
6947 else if (resetok_p) *resetok_p = FALSE;
6948
6949 DEBUG(D_expand)
6950   {
6951   debug_printf("expanding: %.*s\n   result: %s\n", (int)(s - string), string,
6952     yield);
6953   if (skipping) debug_printf("skipping: result is not used\n");
6954   }
6955 return yield;
6956
6957 /* This is the failure exit: easiest to program with a goto. We still need
6958 to update the pointer to the terminator, for cases of nested calls with "fail".
6959 */
6960
6961 EXPAND_FAILED_CURLY:
6962 expand_string_message = malformed_header?
6963   US"missing or misplaced { or } - could be header name not terminated by colon"
6964   :
6965   US"missing or misplaced { or }";
6966
6967 /* At one point, Exim reset the store to yield (if yield was not NULL), but
6968 that is a bad idea, because expand_string_message is in dynamic store. */
6969
6970 EXPAND_FAILED:
6971 if (left != NULL) *left = s;
6972 DEBUG(D_expand)
6973   {
6974   debug_printf("failed to expand: %s\n", string);
6975   debug_printf("   error message: %s\n", expand_string_message);
6976   if (expand_string_forcedfail) debug_printf("failure was forced\n");
6977   }
6978 if (resetok_p) *resetok_p = resetok;
6979 return NULL;
6980 }
6981
6982
6983 /* This is the external function call. Do a quick check for any expansion
6984 metacharacters, and if there are none, just return the input string.
6985
6986 Argument: the string to be expanded
6987 Returns:  the expanded string, or NULL if expansion failed; if failure was
6988           due to a lookup deferring, search_find_defer will be TRUE
6989 */
6990
6991 uschar *
6992 expand_string(uschar *string)
6993 {
6994 search_find_defer = FALSE;
6995 malformed_header = FALSE;
6996 return (Ustrpbrk(string, "$\\") == NULL)? string :
6997   expand_string_internal(string, FALSE, NULL, FALSE, TRUE, NULL);
6998 }
6999
7000
7001
7002 /*************************************************
7003 *              Expand and copy                   *
7004 *************************************************/
7005
7006 /* Now and again we want to expand a string and be sure that the result is in a
7007 new bit of store. This function does that.
7008
7009 Argument: the string to be expanded
7010 Returns:  the expanded string, always in a new bit of store, or NULL
7011 */
7012
7013 uschar *
7014 expand_string_copy(uschar *string)
7015 {
7016 uschar *yield = expand_string(string);
7017 if (yield == string) yield = string_copy(string);
7018 return yield;
7019 }
7020
7021
7022
7023 /*************************************************
7024 *        Expand and interpret as an integer      *
7025 *************************************************/
7026
7027 /* Expand a string, and convert the result into an integer.
7028
7029 Arguments:
7030   string  the string to be expanded
7031   isplus  TRUE if a non-negative number is expected
7032
7033 Returns:  the integer value, or
7034           -1 for an expansion error               ) in both cases, message in
7035           -2 for an integer interpretation error  ) expand_string_message
7036           expand_string_message is set NULL for an OK integer
7037 */
7038
7039 int_eximarith_t
7040 expand_string_integer(uschar *string, BOOL isplus)
7041 {
7042 return expanded_string_integer(expand_string(string), isplus);
7043 }
7044
7045
7046 /*************************************************
7047  *         Interpret string as an integer        *
7048  *************************************************/
7049
7050 /* Convert a string (that has already been expanded) into an integer.
7051
7052 This function is used inside the expansion code.
7053
7054 Arguments:
7055   s       the string to be expanded
7056   isplus  TRUE if a non-negative number is expected
7057
7058 Returns:  the integer value, or
7059           -1 if string is NULL (which implies an expansion error)
7060           -2 for an integer interpretation error
7061           expand_string_message is set NULL for an OK integer
7062 */
7063
7064 static int_eximarith_t
7065 expanded_string_integer(uschar *s, BOOL isplus)
7066 {
7067 int_eximarith_t value;
7068 uschar *msg = US"invalid integer \"%s\"";
7069 uschar *endptr;
7070
7071 /* If expansion failed, expand_string_message will be set. */
7072
7073 if (s == NULL) return -1;
7074
7075 /* On an overflow, strtol() returns LONG_MAX or LONG_MIN, and sets errno
7076 to ERANGE. When there isn't an overflow, errno is not changed, at least on some
7077 systems, so we set it zero ourselves. */
7078
7079 errno = 0;
7080 expand_string_message = NULL;               /* Indicates no error */
7081
7082 /* Before Exim 4.64, strings consisting entirely of whitespace compared
7083 equal to 0.  Unfortunately, people actually relied upon that, so preserve
7084 the behaviour explicitly.  Stripping leading whitespace is a harmless
7085 noop change since strtol skips it anyway (provided that there is a number
7086 to find at all). */
7087 if (isspace(*s))
7088   {
7089   while (isspace(*s)) ++s;
7090   if (*s == '\0')
7091     {
7092       DEBUG(D_expand)
7093        debug_printf("treating blank string as number 0\n");
7094       return 0;
7095     }
7096   }
7097
7098 value = strtoll(CS s, CSS &endptr, 10);
7099
7100 if (endptr == s)
7101   {
7102   msg = US"integer expected but \"%s\" found";
7103   }
7104 else if (value < 0 && isplus)
7105   {
7106   msg = US"non-negative integer expected but \"%s\" found";
7107   }
7108 else
7109   {
7110   switch (tolower(*endptr))
7111     {
7112     default:
7113       break;
7114     case 'k':
7115       if (value > EXIM_ARITH_MAX/1024 || value < EXIM_ARITH_MIN/1024) errno = ERANGE;
7116       else value *= 1024;
7117       endptr++;
7118       break;
7119     case 'm':
7120       if (value > EXIM_ARITH_MAX/(1024*1024) || value < EXIM_ARITH_MIN/(1024*1024)) errno = ERANGE;
7121       else value *= 1024*1024;
7122       endptr++;
7123       break;
7124     case 'g':
7125       if (value > EXIM_ARITH_MAX/(1024*1024*1024) || value < EXIM_ARITH_MIN/(1024*1024*1024)) errno = ERANGE;
7126       else value *= 1024*1024*1024;
7127       endptr++;
7128       break;
7129     }
7130   if (errno == ERANGE)
7131     msg = US"absolute value of integer \"%s\" is too large (overflow)";
7132   else
7133     {
7134     while (isspace(*endptr)) endptr++;
7135     if (*endptr == 0) return value;
7136     }
7137   }
7138
7139 expand_string_message = string_sprintf(CS msg, s);
7140 return -2;
7141 }
7142
7143
7144 /* These values are usually fixed boolean values, but they are permitted to be
7145 expanded strings.
7146
7147 Arguments:
7148   addr       address being routed
7149   mtype      the module type
7150   mname      the module name
7151   dbg_opt    debug selectors
7152   oname      the option name
7153   bvalue     the router's boolean value
7154   svalue     the router's string value
7155   rvalue     where to put the returned value
7156
7157 Returns:     OK     value placed in rvalue
7158              DEFER  expansion failed
7159 */
7160
7161 int
7162 exp_bool(address_item *addr,
7163   uschar *mtype, uschar *mname, unsigned dbg_opt,
7164   uschar *oname, BOOL bvalue,
7165   uschar *svalue, BOOL *rvalue)
7166 {
7167 uschar *expanded;
7168 if (svalue == NULL) { *rvalue = bvalue; return OK; }
7169
7170 expanded = expand_string(svalue);
7171 if (expanded == NULL)
7172   {
7173   if (expand_string_forcedfail)
7174     {
7175     DEBUG(dbg_opt) debug_printf("expansion of \"%s\" forced failure\n", oname);
7176     *rvalue = bvalue;
7177     return OK;
7178     }
7179   addr->message = string_sprintf("failed to expand \"%s\" in %s %s: %s",
7180       oname, mname, mtype, expand_string_message);
7181   DEBUG(dbg_opt) debug_printf("%s\n", addr->message);
7182   return DEFER;
7183   }
7184
7185 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" yields \"%s\"\n", oname,
7186   expanded);
7187
7188 if (strcmpic(expanded, US"true") == 0 || strcmpic(expanded, US"yes") == 0)
7189   *rvalue = TRUE;
7190 else if (strcmpic(expanded, US"false") == 0 || strcmpic(expanded, US"no") == 0)
7191   *rvalue = FALSE;
7192 else
7193   {
7194   addr->message = string_sprintf("\"%s\" is not a valid value for the "
7195     "\"%s\" option in the %s %s", expanded, oname, mname, mtype);
7196   return DEFER;
7197   }
7198
7199 return OK;
7200 }
7201
7202
7203
7204
7205 /*************************************************
7206 **************************************************
7207 *             Stand-alone test program           *
7208 **************************************************
7209 *************************************************/
7210
7211 #ifdef STAND_ALONE
7212
7213
7214 BOOL
7215 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
7216 {
7217 int ovector[3*(EXPAND_MAXN+1)];
7218 int n = pcre_exec(re, NULL, subject, Ustrlen(subject), 0, PCRE_EOPT|options,
7219   ovector, sizeof(ovector)/sizeof(int));
7220 BOOL yield = n >= 0;
7221 if (n == 0) n = EXPAND_MAXN + 1;
7222 if (yield)
7223   {
7224   int nn;
7225   expand_nmax = (setup < 0)? 0 : setup + 1;
7226   for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
7227     {
7228     expand_nstring[expand_nmax] = subject + ovector[nn];
7229     expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
7230     }
7231   expand_nmax--;
7232   }
7233 return yield;
7234 }
7235
7236
7237 int main(int argc, uschar **argv)
7238 {
7239 int i;
7240 uschar buffer[1024];
7241
7242 debug_selector = D_v;
7243 debug_file = stderr;
7244 debug_fd = fileno(debug_file);
7245 big_buffer = malloc(big_buffer_size);
7246
7247 for (i = 1; i < argc; i++)
7248   {
7249   if (argv[i][0] == '+')
7250     {
7251     debug_trace_memory = 2;
7252     argv[i]++;
7253     }
7254   if (isdigit(argv[i][0]))
7255     debug_selector = Ustrtol(argv[i], NULL, 0);
7256   else
7257     if (Ustrspn(argv[i], "abcdefghijklmnopqrtsuvwxyz0123456789-.:/") ==
7258         Ustrlen(argv[i]))
7259       {
7260       #ifdef LOOKUP_LDAP
7261       eldap_default_servers = argv[i];
7262       #endif
7263       #ifdef LOOKUP_MYSQL
7264       mysql_servers = argv[i];
7265       #endif
7266       #ifdef LOOKUP_PGSQL
7267       pgsql_servers = argv[i];
7268       #endif
7269       #ifdef EXPERIMENTAL_REDIS
7270       redis_servers = argv[i];
7271       #endif
7272       }
7273   #ifdef EXIM_PERL
7274   else opt_perl_startup = argv[i];
7275   #endif
7276   }
7277
7278 printf("Testing string expansion: debug_level = %d\n\n", debug_level);
7279
7280 expand_nstring[1] = US"string 1....";
7281 expand_nlength[1] = 8;
7282 expand_nmax = 1;
7283
7284 #ifdef EXIM_PERL
7285 if (opt_perl_startup != NULL)
7286   {
7287   uschar *errstr;
7288   printf("Starting Perl interpreter\n");
7289   errstr = init_perl(opt_perl_startup);
7290   if (errstr != NULL)
7291     {
7292     printf("** error in perl_startup code: %s\n", errstr);
7293     return EXIT_FAILURE;
7294     }
7295   }
7296 #endif /* EXIM_PERL */
7297
7298 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
7299   {
7300   void *reset_point = store_get(0);
7301   uschar *yield = expand_string(buffer);
7302   if (yield != NULL)
7303     {
7304     printf("%s\n", yield);
7305     store_reset(reset_point);
7306     }
7307   else
7308     {
7309     if (search_find_defer) printf("search_find deferred\n");
7310     printf("Failed: %s\n", expand_string_message);
7311     if (expand_string_forcedfail) printf("Forced failure\n");
7312     printf("\n");
7313     }
7314   }
7315
7316 search_tidyup();
7317
7318 return 0;
7319 }
7320
7321 #endif
7322
7323 /* vi: aw ai sw=2
7324 */
7325 /* End of expand.c */