projects / exim.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Certificate-related routines only present when TLS is supported
[exim.git] / src / src / expand.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2014 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8
9 /* Functions for handling string expansion. */
10
11
12 #include "exim.h"
13
14 /* Recursively called function */
15
16 static uschar *expand_string_internal(uschar *, BOOL, uschar **, BOOL, BOOL, BOOL *);
17
18 #ifdef STAND_ALONE
19 #ifndef SUPPORT_CRYPTEQ
20 #define SUPPORT_CRYPTEQ
21 #endif
22 #endif
23
24 #ifdef LOOKUP_LDAP
25 #include "lookups/ldap.h"
26 #endif
27
28 #ifdef SUPPORT_CRYPTEQ
29 #ifdef CRYPT_H
30 #include <crypt.h>
31 #endif
32 #ifndef HAVE_CRYPT16
33 extern char* crypt16(char*, char*);
34 #endif
35 #endif
36
37 /* The handling of crypt16() is a mess. I will record below the analysis of the
38 mess that was sent to me. We decided, however, to make changing this very low
39 priority, because in practice people are moving away from the crypt()
40 algorithms nowadays, so it doesn't seem worth it.
41
42 <quote>
43 There is an algorithm named "crypt16" in Ultrix and Tru64. It crypts
44 the first 8 characters of the password using a 20-round version of crypt
45 (standard crypt does 25 rounds). It then crypts the next 8 characters,
46 or an empty block if the password is less than 9 characters, using a
47 20-round version of crypt and the same salt as was used for the first
48 block. Charaters after the first 16 are ignored. It always generates
49 a 16-byte hash, which is expressed together with the salt as a string
50 of 24 base 64 digits. Here are some links to peruse:
51
52 http://cvs.pld.org.pl/pam/pamcrypt/crypt16.c?rev=1.2
53 http://seclists.org/bugtraq/1999/Mar/0076.html
54
55 There's a different algorithm named "bigcrypt" in HP-UX, Digital Unix,
56 and OSF/1. This is the same as the standard crypt if given a password
57 of 8 characters or less. If given more, it first does the same as crypt
58 using the first 8 characters, then crypts the next 8 (the 9th to 16th)
59 using as salt the first two base 64 digits from the first hash block.
60 If the password is more than 16 characters then it crypts the 17th to 24th
61 characters using as salt the first two base 64 digits from the second hash
62 block. And so on: I've seen references to it cutting off the password at
63 40 characters (5 blocks), 80 (10 blocks), or 128 (16 blocks). Some links:
64
65 http://cvs.pld.org.pl/pam/pamcrypt/bigcrypt.c?rev=1.2
66 http://seclists.org/bugtraq/1999/Mar/0109.html
67 http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/HTML/AA-Q0R2D-
68 TET1_html/sec.c222.html#no_id_208
69
70 Exim has something it calls "crypt16". It will either use a native
71 crypt16 or its own implementation. A native crypt16 will presumably
72 be the one that I called "crypt16" above. The internal "crypt16"
73 function, however, is a two-block-maximum implementation of what I called
74 "bigcrypt". The documentation matches the internal code.
75
76 I suspect that whoever did the "crypt16" stuff for Exim didn't realise
77 that crypt16 and bigcrypt were different things.
78
79 Exim uses the LDAP-style scheme identifier "{crypt16}" to refer
80 to whatever it is using under that name. This unfortunately sets a
81 precedent for using "{crypt16}" to identify two incompatible algorithms
82 whose output can't be distinguished. With "{crypt16}" thus rendered
83 ambiguous, I suggest you deprecate it and invent two new identifiers
84 for the two algorithms.
85
86 Both crypt16 and bigcrypt are very poor algorithms, btw. Hashing parts
87 of the password separately means they can be cracked separately, so
88 the double-length hash only doubles the cracking effort instead of
89 squaring it. I recommend salted SHA-1 ({SSHA}), or the Blowfish-based
90 bcrypt ({CRYPT}$2a$).
91 </quote>
92 */
93
94
95
96 #ifndef nelements
97 # define nelements(arr) (sizeof(arr) / sizeof(*arr))
98 #endif
99
100 /*************************************************
101 * Local statics and tables *
102 *************************************************/
103
104 /* Table of item names, and corresponding switch numbers. The names must be in
105 alphabetical order. */
106
107 static uschar *item_table[] = {
108 US"acl",
109 US"certextract",
110 US"dlfunc",
111 US"extract",
112 US"filter",
113 US"hash",
114 US"hmac",
115 US"if",
116 US"length",
117 US"listextract",
118 US"lookup",
119 US"map",
120 US"nhash",
121 US"perl",
122 US"prvs",
123 US"prvscheck",
124 US"readfile",
125 US"readsocket",
126 US"reduce",
127 US"run",
128 US"sg",
129 US"substr",
130 US"tr" };
131
132 enum {
133 EITEM_ACL,
134 EITEM_CERTEXTRACT,
135 EITEM_DLFUNC,
136 EITEM_EXTRACT,
137 EITEM_FILTER,
138 EITEM_HASH,
139 EITEM_HMAC,
140 EITEM_IF,
141 EITEM_LENGTH,
142 EITEM_LISTEXTRACT,
143 EITEM_LOOKUP,
144 EITEM_MAP,
145 EITEM_NHASH,
146 EITEM_PERL,
147 EITEM_PRVS,
148 EITEM_PRVSCHECK,
149 EITEM_READFILE,
150 EITEM_READSOCK,
151 EITEM_REDUCE,
152 EITEM_RUN,
153 EITEM_SG,
154 EITEM_SUBSTR,
155 EITEM_TR };
156
157 /* Tables of operator names, and corresponding switch numbers. The names must be
158 in alphabetical order. There are two tables, because underscore is used in some
159 cases to introduce arguments, whereas for other it is part of the name. This is
160 an historical mis-design. */
161
162 static uschar *op_table_underscore[] = {
163 US"from_utf8",
164 US"local_part",
165 US"quote_local_part",
166 US"reverse_ip",
167 US"time_eval",
168 US"time_interval"};
169
170 enum {
171 EOP_FROM_UTF8,
172 EOP_LOCAL_PART,
173 EOP_QUOTE_LOCAL_PART,
174 EOP_REVERSE_IP,
175 EOP_TIME_EVAL,
176 EOP_TIME_INTERVAL };
177
178 static uschar *op_table_main[] = {
179 US"address",
180 US"addresses",
181 US"base62",
182 US"base62d",
183 US"domain",
184 US"escape",
185 US"eval",
186 US"eval10",
187 US"expand",
188 US"h",
189 US"hash",
190 US"hex2b64",
191 US"hexquote",
192 US"l",
193 US"lc",
194 US"length",
195 US"listcount",
196 US"listnamed",
197 US"mask",
198 US"md5",
199 US"nh",
200 US"nhash",
201 US"quote",
202 US"randint",
203 US"rfc2047",
204 US"rfc2047d",
205 US"rxquote",
206 US"s",
207 US"sha1",
208 US"stat",
209 US"str2b64",
210 US"strlen",
211 US"substr",
212 US"uc",
213 US"utf8clean" };
214
215 enum {
216 EOP_ADDRESS = sizeof(op_table_underscore)/sizeof(uschar *),
217 EOP_ADDRESSES,
218 EOP_BASE62,
219 EOP_BASE62D,
220 EOP_DOMAIN,
221 EOP_ESCAPE,
222 EOP_EVAL,
223 EOP_EVAL10,
224 EOP_EXPAND,
225 EOP_H,
226 EOP_HASH,
227 EOP_HEX2B64,
228 EOP_HEXQUOTE,
229 EOP_L,
230 EOP_LC,
231 EOP_LENGTH,
232 EOP_LISTCOUNT,
233 EOP_LISTNAMED,
234 EOP_MASK,
235 EOP_MD5,
236 EOP_NH,
237 EOP_NHASH,
238 EOP_QUOTE,
239 EOP_RANDINT,
240 EOP_RFC2047,
241 EOP_RFC2047D,
242 EOP_RXQUOTE,
243 EOP_S,
244 EOP_SHA1,
245 EOP_STAT,
246 EOP_STR2B64,
247 EOP_STRLEN,
248 EOP_SUBSTR,
249 EOP_UC,
250 EOP_UTF8CLEAN };
251
252
253 /* Table of condition names, and corresponding switch numbers. The names must
254 be in alphabetical order. */
255
256 static uschar *cond_table[] = {
257 US"<",
258 US"<=",
259 US"=",
260 US"==", /* Backward compatibility */
261 US">",
262 US">=",
263 US"acl",
264 US"and",
265 US"bool",
266 US"bool_lax",
267 US"crypteq",
268 US"def",
269 US"eq",
270 US"eqi",
271 US"exists",
272 US"first_delivery",
273 US"forall",
274 US"forany",
275 US"ge",
276 US"gei",
277 US"gt",
278 US"gti",
279 US"inlist",
280 US"inlisti",
281 US"isip",
282 US"isip4",
283 US"isip6",
284 US"ldapauth",
285 US"le",
286 US"lei",
287 US"lt",
288 US"lti",
289 US"match",
290 US"match_address",
291 US"match_domain",
292 US"match_ip",
293 US"match_local_part",
294 US"or",
295 US"pam",
296 US"pwcheck",
297 US"queue_running",
298 US"radius",
299 US"saslauthd"
300 };
301
302 enum {
303 ECOND_NUM_L,
304 ECOND_NUM_LE,
305 ECOND_NUM_E,
306 ECOND_NUM_EE,
307 ECOND_NUM_G,
308 ECOND_NUM_GE,
309 ECOND_ACL,
310 ECOND_AND,
311 ECOND_BOOL,
312 ECOND_BOOL_LAX,
313 ECOND_CRYPTEQ,
314 ECOND_DEF,
315 ECOND_STR_EQ,
316 ECOND_STR_EQI,
317 ECOND_EXISTS,
318 ECOND_FIRST_DELIVERY,
319 ECOND_FORALL,
320 ECOND_FORANY,
321 ECOND_STR_GE,
322 ECOND_STR_GEI,
323 ECOND_STR_GT,
324 ECOND_STR_GTI,
325 ECOND_INLIST,
326 ECOND_INLISTI,
327 ECOND_ISIP,
328 ECOND_ISIP4,
329 ECOND_ISIP6,
330 ECOND_LDAPAUTH,
331 ECOND_STR_LE,
332 ECOND_STR_LEI,
333 ECOND_STR_LT,
334 ECOND_STR_LTI,
335 ECOND_MATCH,
336 ECOND_MATCH_ADDRESS,
337 ECOND_MATCH_DOMAIN,
338 ECOND_MATCH_IP,
339 ECOND_MATCH_LOCAL_PART,
340 ECOND_OR,
341 ECOND_PAM,
342 ECOND_PWCHECK,
343 ECOND_QUEUE_RUNNING,
344 ECOND_RADIUS,
345 ECOND_SASLAUTHD
346 };
347
348
349 /* Type for main variable table */
350
351 typedef struct {
352 const char *name;
353 int type;
354 void *value;
355 } var_entry;
356
357 /* Type for entries pointing to address/length pairs. Not currently
358 in use. */
359
360 typedef struct {
361 uschar **address;
362 int *length;
363 } alblock;
364
365 /* Types of table entry */
366
367 enum {
368 vtype_int, /* value is address of int */
369 vtype_filter_int, /* ditto, but recognized only when filtering */
370 vtype_ino, /* value is address of ino_t (not always an int) */
371 vtype_uid, /* value is address of uid_t (not always an int) */
372 vtype_gid, /* value is address of gid_t (not always an int) */
373 vtype_bool, /* value is address of bool */
374 vtype_stringptr, /* value is address of pointer to string */
375 vtype_msgbody, /* as stringptr, but read when first required */
376 vtype_msgbody_end, /* ditto, the end of the message */
377 vtype_msgheaders, /* the message's headers, processed */
378 vtype_msgheaders_raw, /* the message's headers, unprocessed */
379 vtype_localpart, /* extract local part from string */
380 vtype_domain, /* extract domain from string */
381 vtype_string_func, /* value is string returned by given function */
382 vtype_todbsdin, /* value not used; generate BSD inbox tod */
383 vtype_tode, /* value not used; generate tod in epoch format */
384 vtype_todel, /* value not used; generate tod in epoch/usec format */
385 vtype_todf, /* value not used; generate full tod */
386 vtype_todl, /* value not used; generate log tod */
387 vtype_todlf, /* value not used; generate log file datestamp tod */
388 vtype_todzone, /* value not used; generate time zone only */
389 vtype_todzulu, /* value not used; generate zulu tod */
390 vtype_reply, /* value not used; get reply from headers */
391 vtype_pid, /* value not used; result is pid */
392 vtype_host_lookup, /* value not used; get host name */
393 vtype_load_avg, /* value not used; result is int from os_getloadavg */
394 vtype_pspace, /* partition space; value is T/F for spool/log */
395 vtype_pinodes, /* partition inodes; value is T/F for spool/log */
396 vtype_cert /* SSL certificate */
397 #ifndef DISABLE_DKIM
398 ,vtype_dkim /* Lookup of value in DKIM signature */
399 #endif
400 };
401
402 static uschar * fn_recipients(void);
403
404 /* This table must be kept in alphabetical order. */
405
406 static var_entry var_table[] = {
407 /* WARNING: Do not invent variables whose names start acl_c or acl_m because
408 they will be confused with user-creatable ACL variables. */
409 { "acl_arg1", vtype_stringptr, &acl_arg[0] },
410 { "acl_arg2", vtype_stringptr, &acl_arg[1] },
411 { "acl_arg3", vtype_stringptr, &acl_arg[2] },
412 { "acl_arg4", vtype_stringptr, &acl_arg[3] },
413 { "acl_arg5", vtype_stringptr, &acl_arg[4] },
414 { "acl_arg6", vtype_stringptr, &acl_arg[5] },
415 { "acl_arg7", vtype_stringptr, &acl_arg[6] },
416 { "acl_arg8", vtype_stringptr, &acl_arg[7] },
417 { "acl_arg9", vtype_stringptr, &acl_arg[8] },
418 { "acl_narg", vtype_int, &acl_narg },
419 { "acl_verify_message", vtype_stringptr, &acl_verify_message },
420 { "address_data", vtype_stringptr, &deliver_address_data },
421 { "address_file", vtype_stringptr, &address_file },
422 { "address_pipe", vtype_stringptr, &address_pipe },
423 { "authenticated_fail_id",vtype_stringptr, &authenticated_fail_id },
424 { "authenticated_id", vtype_stringptr, &authenticated_id },
425 { "authenticated_sender",vtype_stringptr, &authenticated_sender },
426 { "authentication_failed",vtype_int, &authentication_failed },
427 #ifdef WITH_CONTENT_SCAN
428 { "av_failed", vtype_int, &av_failed },
429 #endif
430 #ifdef EXPERIMENTAL_BRIGHTMAIL
431 { "bmi_alt_location", vtype_stringptr, &bmi_alt_location },
432 { "bmi_base64_tracker_verdict", vtype_stringptr, &bmi_base64_tracker_verdict },
433 { "bmi_base64_verdict", vtype_stringptr, &bmi_base64_verdict },
434 { "bmi_deliver", vtype_int, &bmi_deliver },
435 #endif
436 { "body_linecount", vtype_int, &body_linecount },
437 { "body_zerocount", vtype_int, &body_zerocount },
438 { "bounce_recipient", vtype_stringptr, &bounce_recipient },
439 { "bounce_return_size_limit", vtype_int, &bounce_return_size_limit },
440 { "caller_gid", vtype_gid, &real_gid },
441 { "caller_uid", vtype_uid, &real_uid },
442 { "compile_date", vtype_stringptr, &version_date },
443 { "compile_number", vtype_stringptr, &version_cnumber },
444 { "csa_status", vtype_stringptr, &csa_status },
445 #ifdef EXPERIMENTAL_DCC
446 { "dcc_header", vtype_stringptr, &dcc_header },
447 { "dcc_result", vtype_stringptr, &dcc_result },
448 #endif
449 #ifdef WITH_OLD_DEMIME
450 { "demime_errorlevel", vtype_int, &demime_errorlevel },
451 { "demime_reason", vtype_stringptr, &demime_reason },
452 #endif
453 #ifndef DISABLE_DKIM
454 { "dkim_algo", vtype_dkim, (void *)DKIM_ALGO },
455 { "dkim_bodylength", vtype_dkim, (void *)DKIM_BODYLENGTH },
456 { "dkim_canon_body", vtype_dkim, (void *)DKIM_CANON_BODY },
457 { "dkim_canon_headers", vtype_dkim, (void *)DKIM_CANON_HEADERS },
458 { "dkim_copiedheaders", vtype_dkim, (void *)DKIM_COPIEDHEADERS },
459 { "dkim_created", vtype_dkim, (void *)DKIM_CREATED },
460 { "dkim_cur_signer", vtype_stringptr, &dkim_cur_signer },
461 { "dkim_domain", vtype_stringptr, &dkim_signing_domain },
462 { "dkim_expires", vtype_dkim, (void *)DKIM_EXPIRES },
463 { "dkim_headernames", vtype_dkim, (void *)DKIM_HEADERNAMES },
464 { "dkim_identity", vtype_dkim, (void *)DKIM_IDENTITY },
465 { "dkim_key_granularity",vtype_dkim, (void *)DKIM_KEY_GRANULARITY },
466 { "dkim_key_nosubdomains",vtype_dkim, (void *)DKIM_NOSUBDOMAINS },
467 { "dkim_key_notes", vtype_dkim, (void *)DKIM_KEY_NOTES },
468 { "dkim_key_srvtype", vtype_dkim, (void *)DKIM_KEY_SRVTYPE },
469 { "dkim_key_testing", vtype_dkim, (void *)DKIM_KEY_TESTING },
470 { "dkim_selector", vtype_stringptr, &dkim_signing_selector },
471 { "dkim_signers", vtype_stringptr, &dkim_signers },
472 { "dkim_verify_reason", vtype_dkim, (void *)DKIM_VERIFY_REASON },
473 { "dkim_verify_status", vtype_dkim, (void *)DKIM_VERIFY_STATUS},
474 #endif
475 #ifdef EXPERIMENTAL_DMARC
476 { "dmarc_ar_header", vtype_stringptr, &dmarc_ar_header },
477 { "dmarc_domain_policy", vtype_stringptr, &dmarc_domain_policy },
478 { "dmarc_status", vtype_stringptr, &dmarc_status },
479 { "dmarc_status_text", vtype_stringptr, &dmarc_status_text },
480 { "dmarc_used_domain", vtype_stringptr, &dmarc_used_domain },
481 #endif
482 { "dnslist_domain", vtype_stringptr, &dnslist_domain },
483 { "dnslist_matched", vtype_stringptr, &dnslist_matched },
484 { "dnslist_text", vtype_stringptr, &dnslist_text },
485 { "dnslist_value", vtype_stringptr, &dnslist_value },
486 { "domain", vtype_stringptr, &deliver_domain },
487 { "domain_data", vtype_stringptr, &deliver_domain_data },
488 { "exim_gid", vtype_gid, &exim_gid },
489 { "exim_path", vtype_stringptr, &exim_path },
490 { "exim_uid", vtype_uid, &exim_uid },
491 #ifdef WITH_OLD_DEMIME
492 { "found_extension", vtype_stringptr, &found_extension },
493 #endif
494 { "headers_added", vtype_string_func, &fn_hdrs_added },
495 { "home", vtype_stringptr, &deliver_home },
496 { "host", vtype_stringptr, &deliver_host },
497 { "host_address", vtype_stringptr, &deliver_host_address },
498 { "host_data", vtype_stringptr, &host_data },
499 { "host_lookup_deferred",vtype_int, &host_lookup_deferred },
500 { "host_lookup_failed", vtype_int, &host_lookup_failed },
501 { "inode", vtype_ino, &deliver_inode },
502 { "interface_address", vtype_stringptr, &interface_address },
503 { "interface_port", vtype_int, &interface_port },
504 { "item", vtype_stringptr, &iterate_item },
505 #ifdef LOOKUP_LDAP
506 { "ldap_dn", vtype_stringptr, &eldap_dn },
507 #endif
508 { "load_average", vtype_load_avg, NULL },
509 { "local_part", vtype_stringptr, &deliver_localpart },
510 { "local_part_data", vtype_stringptr, &deliver_localpart_data },
511 { "local_part_prefix", vtype_stringptr, &deliver_localpart_prefix },
512 { "local_part_suffix", vtype_stringptr, &deliver_localpart_suffix },
513 { "local_scan_data", vtype_stringptr, &local_scan_data },
514 { "local_user_gid", vtype_gid, &local_user_gid },
515 { "local_user_uid", vtype_uid, &local_user_uid },
516 { "localhost_number", vtype_int, &host_number },
517 { "log_inodes", vtype_pinodes, (void *)FALSE },
518 { "log_space", vtype_pspace, (void *)FALSE },
519 { "lookup_dnssec_authenticated",vtype_stringptr,&lookup_dnssec_authenticated},
520 { "mailstore_basename", vtype_stringptr, &mailstore_basename },
521 #ifdef WITH_CONTENT_SCAN
522 { "malware_name", vtype_stringptr, &malware_name },
523 #endif
524 { "max_received_linelength", vtype_int, &max_received_linelength },
525 { "message_age", vtype_int, &message_age },
526 { "message_body", vtype_msgbody, &message_body },
527 { "message_body_end", vtype_msgbody_end, &message_body_end },
528 { "message_body_size", vtype_int, &message_body_size },
529 { "message_exim_id", vtype_stringptr, &message_id },
530 { "message_headers", vtype_msgheaders, NULL },
531 { "message_headers_raw", vtype_msgheaders_raw, NULL },
532 { "message_id", vtype_stringptr, &message_id },
533 { "message_linecount", vtype_int, &message_linecount },
534 { "message_size", vtype_int, &message_size },
535 #ifdef WITH_CONTENT_SCAN
536 { "mime_anomaly_level", vtype_int, &mime_anomaly_level },
537 { "mime_anomaly_text", vtype_stringptr, &mime_anomaly_text },
538 { "mime_boundary", vtype_stringptr, &mime_boundary },
539 { "mime_charset", vtype_stringptr, &mime_charset },
540 { "mime_content_description", vtype_stringptr, &mime_content_description },
541 { "mime_content_disposition", vtype_stringptr, &mime_content_disposition },
542 { "mime_content_id", vtype_stringptr, &mime_content_id },
543 { "mime_content_size", vtype_int, &mime_content_size },
544 { "mime_content_transfer_encoding",vtype_stringptr, &mime_content_transfer_encoding },
545 { "mime_content_type", vtype_stringptr, &mime_content_type },
546 { "mime_decoded_filename", vtype_stringptr, &mime_decoded_filename },
547 { "mime_filename", vtype_stringptr, &mime_filename },
548 { "mime_is_coverletter", vtype_int, &mime_is_coverletter },
549 { "mime_is_multipart", vtype_int, &mime_is_multipart },
550 { "mime_is_rfc822", vtype_int, &mime_is_rfc822 },
551 { "mime_part_count", vtype_int, &mime_part_count },
552 #endif
553 { "n0", vtype_filter_int, &filter_n[0] },
554 { "n1", vtype_filter_int, &filter_n[1] },
555 { "n2", vtype_filter_int, &filter_n[2] },
556 { "n3", vtype_filter_int, &filter_n[3] },
557 { "n4", vtype_filter_int, &filter_n[4] },
558 { "n5", vtype_filter_int, &filter_n[5] },
559 { "n6", vtype_filter_int, &filter_n[6] },
560 { "n7", vtype_filter_int, &filter_n[7] },
561 { "n8", vtype_filter_int, &filter_n[8] },
562 { "n9", vtype_filter_int, &filter_n[9] },
563 { "original_domain", vtype_stringptr, &deliver_domain_orig },
564 { "original_local_part", vtype_stringptr, &deliver_localpart_orig },
565 { "originator_gid", vtype_gid, &originator_gid },
566 { "originator_uid", vtype_uid, &originator_uid },
567 { "parent_domain", vtype_stringptr, &deliver_domain_parent },
568 { "parent_local_part", vtype_stringptr, &deliver_localpart_parent },
569 { "pid", vtype_pid, NULL },
570 { "primary_hostname", vtype_stringptr, &primary_hostname },
571 #ifdef EXPERIMENTAL_PROXY
572 { "proxy_host_address", vtype_stringptr, &proxy_host_address },
573 { "proxy_host_port", vtype_int, &proxy_host_port },
574 { "proxy_session", vtype_bool, &proxy_session },
575 { "proxy_target_address",vtype_stringptr, &proxy_target_address },
576 { "proxy_target_port", vtype_int, &proxy_target_port },
577 #endif
578 { "prvscheck_address", vtype_stringptr, &prvscheck_address },
579 { "prvscheck_keynum", vtype_stringptr, &prvscheck_keynum },
580 { "prvscheck_result", vtype_stringptr, &prvscheck_result },
581 { "qualify_domain", vtype_stringptr, &qualify_domain_sender },
582 { "qualify_recipient", vtype_stringptr, &qualify_domain_recipient },
583 { "rcpt_count", vtype_int, &rcpt_count },
584 { "rcpt_defer_count", vtype_int, &rcpt_defer_count },
585 { "rcpt_fail_count", vtype_int, &rcpt_fail_count },
586 { "received_count", vtype_int, &received_count },
587 { "received_for", vtype_stringptr, &received_for },
588 { "received_ip_address", vtype_stringptr, &interface_address },
589 { "received_port", vtype_int, &interface_port },
590 { "received_protocol", vtype_stringptr, &received_protocol },
591 { "received_time", vtype_int, &received_time },
592 { "recipient_data", vtype_stringptr, &recipient_data },
593 { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
594 { "recipients", vtype_string_func, &fn_recipients },
595 { "recipients_count", vtype_int, &recipients_count },
596 #ifdef WITH_CONTENT_SCAN
597 { "regex_match_string", vtype_stringptr, &regex_match_string },
598 #endif
599 { "reply_address", vtype_reply, NULL },
600 { "return_path", vtype_stringptr, &return_path },
601 { "return_size_limit", vtype_int, &bounce_return_size_limit },
602 { "router_name", vtype_stringptr, &router_name },
603 { "runrc", vtype_int, &runrc },
604 { "self_hostname", vtype_stringptr, &self_hostname },
605 { "sender_address", vtype_stringptr, &sender_address },
606 { "sender_address_data", vtype_stringptr, &sender_address_data },
607 { "sender_address_domain", vtype_domain, &sender_address },
608 { "sender_address_local_part", vtype_localpart, &sender_address },
609 { "sender_data", vtype_stringptr, &sender_data },
610 { "sender_fullhost", vtype_stringptr, &sender_fullhost },
611 { "sender_helo_name", vtype_stringptr, &sender_helo_name },
612 { "sender_host_address", vtype_stringptr, &sender_host_address },
613 { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated },
614 { "sender_host_dnssec", vtype_bool, &sender_host_dnssec },
615 { "sender_host_name", vtype_host_lookup, NULL },
616 { "sender_host_port", vtype_int, &sender_host_port },
617 { "sender_ident", vtype_stringptr, &sender_ident },
618 { "sender_rate", vtype_stringptr, &sender_rate },
619 { "sender_rate_limit", vtype_stringptr, &sender_rate_limit },
620 { "sender_rate_period", vtype_stringptr, &sender_rate_period },
621 { "sender_rcvhost", vtype_stringptr, &sender_rcvhost },
622 { "sender_verify_failure",vtype_stringptr, &sender_verify_failure },
623 { "sending_ip_address", vtype_stringptr, &sending_ip_address },
624 { "sending_port", vtype_int, &sending_port },
625 { "smtp_active_hostname", vtype_stringptr, &smtp_active_hostname },
626 { "smtp_command", vtype_stringptr, &smtp_cmd_buffer },
627 { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
628 { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
629 { "smtp_notquit_reason", vtype_stringptr, &smtp_notquit_reason },
630 { "sn0", vtype_filter_int, &filter_sn[0] },
631 { "sn1", vtype_filter_int, &filter_sn[1] },
632 { "sn2", vtype_filter_int, &filter_sn[2] },
633 { "sn3", vtype_filter_int, &filter_sn[3] },
634 { "sn4", vtype_filter_int, &filter_sn[4] },
635 { "sn5", vtype_filter_int, &filter_sn[5] },
636 { "sn6", vtype_filter_int, &filter_sn[6] },
637 { "sn7", vtype_filter_int, &filter_sn[7] },
638 { "sn8", vtype_filter_int, &filter_sn[8] },
639 { "sn9", vtype_filter_int, &filter_sn[9] },
640 #ifdef WITH_CONTENT_SCAN
641 { "spam_bar", vtype_stringptr, &spam_bar },
642 { "spam_report", vtype_stringptr, &spam_report },
643 { "spam_score", vtype_stringptr, &spam_score },
644 { "spam_score_int", vtype_stringptr, &spam_score_int },
645 #endif
646 #ifdef EXPERIMENTAL_SPF
647 { "spf_guess", vtype_stringptr, &spf_guess },
648 { "spf_header_comment", vtype_stringptr, &spf_header_comment },
649 { "spf_received", vtype_stringptr, &spf_received },
650 { "spf_result", vtype_stringptr, &spf_result },
651 { "spf_smtp_comment", vtype_stringptr, &spf_smtp_comment },
652 #endif
653 { "spool_directory", vtype_stringptr, &spool_directory },
654 { "spool_inodes", vtype_pinodes, (void *)TRUE },
655 { "spool_space", vtype_pspace, (void *)TRUE },
656 #ifdef EXPERIMENTAL_SRS
657 { "srs_db_address", vtype_stringptr, &srs_db_address },
658 { "srs_db_key", vtype_stringptr, &srs_db_key },
659 { "srs_orig_recipient", vtype_stringptr, &srs_orig_recipient },
660 { "srs_orig_sender", vtype_stringptr, &srs_orig_sender },
661 { "srs_recipient", vtype_stringptr, &srs_recipient },
662 { "srs_status", vtype_stringptr, &srs_status },
663 #endif
664 { "thisaddress", vtype_stringptr, &filter_thisaddress },
665
666 /* The non-(in,out) variables are now deprecated */
667 { "tls_bits", vtype_int, &tls_in.bits },
668 { "tls_certificate_verified", vtype_int, &tls_in.certificate_verified },
669 { "tls_cipher", vtype_stringptr, &tls_in.cipher },
670
671 { "tls_in_bits", vtype_int, &tls_in.bits },
672 { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
673 { "tls_in_cipher", vtype_stringptr, &tls_in.cipher },
674 { "tls_in_ocsp", vtype_int, &tls_in.ocsp },
675 { "tls_in_ourcert", vtype_cert, &tls_in.ourcert },
676 { "tls_in_peercert", vtype_cert, &tls_in.peercert },
677 { "tls_in_peerdn", vtype_stringptr, &tls_in.peerdn },
678 #if defined(SUPPORT_TLS) && !defined(USE_GNUTLS)
679 { "tls_in_sni", vtype_stringptr, &tls_in.sni },
680 #endif
681 { "tls_out_bits", vtype_int, &tls_out.bits },
682 { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
683 { "tls_out_cipher", vtype_stringptr, &tls_out.cipher },
684 { "tls_out_ocsp", vtype_int, &tls_out.ocsp },
685 { "tls_out_ourcert", vtype_cert, &tls_out.ourcert },
686 { "tls_out_peercert", vtype_cert, &tls_out.peercert },
687 { "tls_out_peerdn", vtype_stringptr, &tls_out.peerdn },
688 #if defined(SUPPORT_TLS) && !defined(USE_GNUTLS)
689 { "tls_out_sni", vtype_stringptr, &tls_out.sni },
690 #endif
691
692 { "tls_peerdn", vtype_stringptr, &tls_in.peerdn }, /* mind the alphabetical order! */
693 #if defined(SUPPORT_TLS) && !defined(USE_GNUTLS)
694 { "tls_sni", vtype_stringptr, &tls_in.sni }, /* mind the alphabetical order! */
695 #endif
696
697 { "tod_bsdinbox", vtype_todbsdin, NULL },
698 { "tod_epoch", vtype_tode, NULL },
699 { "tod_epoch_l", vtype_todel, NULL },
700 { "tod_full", vtype_todf, NULL },
701 { "tod_log", vtype_todl, NULL },
702 { "tod_logfile", vtype_todlf, NULL },
703 { "tod_zone", vtype_todzone, NULL },
704 { "tod_zulu", vtype_todzulu, NULL },
705 #ifdef EXPERIMENTAL_TPDA
706 { "tpda_defer_errno", vtype_int, &tpda_defer_errno },
707 { "tpda_defer_errstr", vtype_stringptr, &tpda_defer_errstr },
708 { "tpda_delivery_confirmation", vtype_stringptr, &tpda_delivery_confirmation },
709 { "tpda_delivery_domain", vtype_stringptr, &tpda_delivery_domain },
710 { "tpda_delivery_fqdn", vtype_stringptr, &tpda_delivery_fqdn },
711 { "tpda_delivery_ip", vtype_stringptr, &tpda_delivery_ip },
712 { "tpda_delivery_local_part",vtype_stringptr,&tpda_delivery_local_part },
713 { "tpda_delivery_port", vtype_int, &tpda_delivery_port },
714 #endif
715 { "transport_name", vtype_stringptr, &transport_name },
716 { "value", vtype_stringptr, &lookup_value },
717 { "version_number", vtype_stringptr, &version_string },
718 { "warn_message_delay", vtype_stringptr, &warnmsg_delay },
719 { "warn_message_recipient",vtype_stringptr, &warnmsg_recipients },
720 { "warn_message_recipients",vtype_stringptr,&warnmsg_recipients },
721 { "warnmsg_delay", vtype_stringptr, &warnmsg_delay },
722 { "warnmsg_recipient", vtype_stringptr, &warnmsg_recipients },
723 { "warnmsg_recipients", vtype_stringptr, &warnmsg_recipients }
724 };
725
726 static int var_table_size = sizeof(var_table)/sizeof(var_entry);
727 static uschar var_buffer[256];
728 static BOOL malformed_header;
729
730 /* For textual hashes */
731
732 static const char *hashcodes = "abcdefghijklmnopqrtsuvwxyz"
733 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
734 "0123456789";
735
736 enum { HMAC_MD5, HMAC_SHA1 };
737
738 /* For numeric hashes */
739
740 static unsigned int prime[] = {
741 2, 3, 5, 7, 11, 13, 17, 19, 23, 29,
742 31, 37, 41, 43, 47, 53, 59, 61, 67, 71,
743 73, 79, 83, 89, 97, 101, 103, 107, 109, 113};
744
745 /* For printing modes in symbolic form */
746
747 static uschar *mtable_normal[] =
748 { US"---", US"--x", US"-w-", US"-wx", US"r--", US"r-x", US"rw-", US"rwx" };
749
750 static uschar *mtable_setid[] =
751 { US"--S", US"--s", US"-wS", US"-ws", US"r-S", US"r-s", US"rwS", US"rws" };
752
753 static uschar *mtable_sticky[] =
754 { US"--T", US"--t", US"-wT", US"-wt", US"r-T", US"r-t", US"rwT", US"rwt" };
755
756
757
758 /*************************************************
759 * Tables for UTF-8 support *
760 *************************************************/
761
762 /* Table of the number of extra characters, indexed by the first character
763 masked with 0x3f. The highest number for a valid UTF-8 character is in fact
764 0x3d. */
765
766 static uschar utf8_table1[] = {
767 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
768 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
769 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
770 3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
771
772 /* These are the masks for the data bits in the first byte of a character,
773 indexed by the number of additional bytes. */
774
775 static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
776
777 /* Get the next UTF-8 character, advancing the pointer. */
778
779 #define GETUTF8INC(c, ptr) \
780 c = *ptr++; \
781 if ((c & 0xc0) == 0xc0) \
782 { \
783 int a = utf8_table1[c & 0x3f]; /* Number of additional bytes */ \
784 int s = 6*a; \
785 c = (c & utf8_table2[a]) << s; \
786 while (a-- > 0) \
787 { \
788 s -= 6; \
789 c |= (*ptr++ & 0x3f) << s; \
790 } \
791 }
792
793
794 /*************************************************
795 * Binary chop search on a table *
796 *************************************************/
797
798 /* This is used for matching expansion items and operators.
799
800 Arguments:
801 name the name that is being sought
802 table the table to search
803 table_size the number of items in the table
804
805 Returns: the offset in the table, or -1
806 */
807
808 static int
809 chop_match(uschar *name, uschar **table, int table_size)
810 {
811 uschar **bot = table;
812 uschar **top = table + table_size;
813
814 while (top > bot)
815 {
816 uschar **mid = bot + (top - bot)/2;
817 int c = Ustrcmp(name, *mid);
818 if (c == 0) return mid - table;
819 if (c > 0) bot = mid + 1; else top = mid;
820 }
821
822 return -1;
823 }
824
825
826
827 /*************************************************
828 * Check a condition string *
829 *************************************************/
830
831 /* This function is called to expand a string, and test the result for a "true"
832 or "false" value. Failure of the expansion yields FALSE; logged unless it was a
833 forced fail or lookup defer.
834
835 We used to release all store used, but this is not not safe due
836 to ${dlfunc } and ${acl }. In any case expand_string_internal()
837 is reasonably careful to release what it can.
838
839 The actual false-value tests should be replicated for ECOND_BOOL_LAX.
840
841 Arguments:
842 condition the condition string
843 m1 text to be incorporated in panic error
844 m2 ditto
845
846 Returns: TRUE if condition is met, FALSE if not
847 */
848
849 BOOL
850 expand_check_condition(uschar *condition, uschar *m1, uschar *m2)
851 {
852 int rc;
853 uschar *ss = expand_string(condition);
854 if (ss == NULL)
855 {
856 if (!expand_string_forcedfail && !search_find_defer)
857 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand condition \"%s\" "
858 "for %s %s: %s", condition, m1, m2, expand_string_message);
859 return FALSE;
860 }
861 rc = ss[0] != 0 && Ustrcmp(ss, "0") != 0 && strcmpic(ss, US"no") != 0 &&
862 strcmpic(ss, US"false") != 0;
863 return rc;
864 }
865
866
867
868
869 /*************************************************
870 * Pseudo-random number generation *
871 *************************************************/
872
873 /* Pseudo-random number generation. The result is not "expected" to be
874 cryptographically strong but not so weak that someone will shoot themselves
875 in the foot using it as a nonce in some email header scheme or whatever
876 weirdness they'll twist this into. The result should ideally handle fork().
877
878 However, if we're stuck unable to provide this, then we'll fall back to
879 appallingly bad randomness.
880
881 If SUPPORT_TLS is defined then this will not be used except as an emergency
882 fallback.
883
884 Arguments:
885 max range maximum
886 Returns a random number in range [0, max-1]
887 */
888
889 #ifdef SUPPORT_TLS
890 # define vaguely_random_number vaguely_random_number_fallback
891 #endif
892 int
893 vaguely_random_number(int max)
894 {
895 #ifdef SUPPORT_TLS
896 # undef vaguely_random_number
897 #endif
898 static pid_t pid = 0;
899 pid_t p2;
900 #if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
901 struct timeval tv;
902 #endif
903
904 p2 = getpid();
905 if (p2 != pid)
906 {
907 if (pid != 0)
908 {
909
910 #ifdef HAVE_ARC4RANDOM
911 /* cryptographically strong randomness, common on *BSD platforms, not
912 so much elsewhere. Alas. */
913 arc4random_stir();
914 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
915 #ifdef HAVE_SRANDOMDEV
916 /* uses random(4) for seeding */
917 srandomdev();
918 #else
919 gettimeofday(&tv, NULL);
920 srandom(tv.tv_sec | tv.tv_usec | getpid());
921 #endif
922 #else
923 /* Poor randomness and no seeding here */
924 #endif
925
926 }
927 pid = p2;
928 }
929
930 #ifdef HAVE_ARC4RANDOM
931 return arc4random() % max;
932 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
933 return random() % max;
934 #else
935 /* This one returns a 16-bit number, definitely not crypto-strong */
936 return random_number(max);
937 #endif
938 }
939
940
941
942
943 /*************************************************
944 * Pick out a name from a string *
945 *************************************************/
946
947 /* If the name is too long, it is silently truncated.
948
949 Arguments:
950 name points to a buffer into which to put the name
951 max is the length of the buffer
952 s points to the first alphabetic character of the name
953 extras chars other than alphanumerics to permit
954
955 Returns: pointer to the first character after the name
956
957 Note: The test for *s != 0 in the while loop is necessary because
958 Ustrchr() yields non-NULL if the character is zero (which is not something
959 I expected). */
960
961 static uschar *
962 read_name(uschar *name, int max, uschar *s, uschar *extras)
963 {
964 int ptr = 0;
965 while (*s != 0 && (isalnum(*s) || Ustrchr(extras, *s) != NULL))
966 {
967 if (ptr < max-1) name[ptr++] = *s;
968 s++;
969 }
970 name[ptr] = 0;
971 return s;
972 }
973
974
975
976 /*************************************************
977 * Pick out the rest of a header name *
978 *************************************************/
979
980 /* A variable name starting $header_ (or just $h_ for those who like
981 abbreviations) might not be the complete header name because headers can
982 contain any printing characters in their names, except ':'. This function is
983 called to read the rest of the name, chop h[eader]_ off the front, and put ':'
984 on the end, if the name was terminated by white space.
985
986 Arguments:
987 name points to a buffer in which the name read so far exists
988 max is the length of the buffer
989 s points to the first character after the name so far, i.e. the
990 first non-alphameric character after $header_xxxxx
991
992 Returns: a pointer to the first character after the header name
993 */
994
995 static uschar *
996 read_header_name(uschar *name, int max, uschar *s)
997 {
998 int prelen = Ustrchr(name, '_') - name + 1;
999 int ptr = Ustrlen(name) - prelen;
1000 if (ptr > 0) memmove(name, name+prelen, ptr);
1001 while (mac_isgraph(*s) && *s != ':')
1002 {
1003 if (ptr < max-1) name[ptr++] = *s;
1004 s++;
1005 }
1006 if (*s == ':') s++;
1007 name[ptr++] = ':';
1008 name[ptr] = 0;
1009 return s;
1010 }
1011
1012
1013
1014 /*************************************************
1015 * Pick out a number from a string *
1016 *************************************************/
1017
1018 /* Arguments:
1019 n points to an integer into which to put the number
1020 s points to the first digit of the number
1021
1022 Returns: a pointer to the character after the last digit
1023 */
1024
1025 static uschar *
1026 read_number(int *n, uschar *s)
1027 {
1028 *n = 0;
1029 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1030 return s;
1031 }
1032
1033
1034
1035 /*************************************************
1036 * Extract keyed subfield from a string *
1037 *************************************************/
1038
1039 /* The yield is in dynamic store; NULL means that the key was not found.
1040
1041 Arguments:
1042 key points to the name of the key
1043 s points to the string from which to extract the subfield
1044
1045 Returns: NULL if the subfield was not found, or
1046 a pointer to the subfield's data
1047 */
1048
1049 static uschar *
1050 expand_getkeyed(uschar *key, uschar *s)
1051 {
1052 int length = Ustrlen(key);
1053 while (isspace(*s)) s++;
1054
1055 /* Loop to search for the key */
1056
1057 while (*s != 0)
1058 {
1059 int dkeylength;
1060 uschar *data;
1061 uschar *dkey = s;
1062
1063 while (*s != 0 && *s != '=' && !isspace(*s)) s++;
1064 dkeylength = s - dkey;
1065 while (isspace(*s)) s++;
1066 if (*s == '=') while (isspace((*(++s))));
1067
1068 data = string_dequote(&s);
1069 if (length == dkeylength && strncmpic(key, dkey, length) == 0)
1070 return data;
1071
1072 while (isspace(*s)) s++;
1073 }
1074
1075 return NULL;
1076 }
1077
1078
1079
1080 static var_entry *
1081 find_var_ent(uschar * name)
1082 {
1083 int first = 0;
1084 int last = var_table_size;
1085
1086 while (last > first)
1087 {
1088 int middle = (first + last)/2;
1089 int c = Ustrcmp(name, var_table[middle].name);
1090
1091 if (c > 0) { first = middle + 1; continue; }
1092 if (c < 0) { last = middle; continue; }
1093 return &var_table[middle];
1094 }
1095 return NULL;
1096 }
1097
1098 /*************************************************
1099 * Extract numbered subfield from string *
1100 *************************************************/
1101
1102 /* Extracts a numbered field from a string that is divided by tokens - for
1103 example a line from /etc/passwd is divided by colon characters. First field is
1104 numbered one. Negative arguments count from the right. Zero returns the whole
1105 string. Returns NULL if there are insufficient tokens in the string
1106
1107 ***WARNING***
1108 Modifies final argument - this is a dynamically generated string, so that's OK.
1109
1110 Arguments:
1111 field number of field to be extracted,
1112 first field = 1, whole string = 0, last field = -1
1113 separators characters that are used to break string into tokens
1114 s points to the string from which to extract the subfield
1115
1116 Returns: NULL if the field was not found,
1117 a pointer to the field's data inside s (modified to add 0)
1118 */
1119
1120 static uschar *
1121 expand_gettokened (int field, uschar *separators, uschar *s)
1122 {
1123 int sep = 1;
1124 int count;
1125 uschar *ss = s;
1126 uschar *fieldtext = NULL;
1127
1128 if (field == 0) return s;
1129
1130 /* Break the line up into fields in place; for field > 0 we stop when we have
1131 done the number of fields we want. For field < 0 we continue till the end of
1132 the string, counting the number of fields. */
1133
1134 count = (field > 0)? field : INT_MAX;
1135
1136 while (count-- > 0)
1137 {
1138 size_t len;
1139
1140 /* Previous field was the last one in the string. For a positive field
1141 number, this means there are not enough fields. For a negative field number,
1142 check that there are enough, and scan back to find the one that is wanted. */
1143
1144 if (sep == 0)
1145 {
1146 if (field > 0 || (-field) > (INT_MAX - count - 1)) return NULL;
1147 if ((-field) == (INT_MAX - count - 1)) return s;
1148 while (field++ < 0)
1149 {
1150 ss--;
1151 while (ss[-1] != 0) ss--;
1152 }
1153 fieldtext = ss;
1154 break;
1155 }
1156
1157 /* Previous field was not last in the string; save its start and put a
1158 zero at its end. */
1159
1160 fieldtext = ss;
1161 len = Ustrcspn(ss, separators);
1162 sep = ss[len];
1163 ss[len] = 0;
1164 ss += len + 1;
1165 }
1166
1167 return fieldtext;
1168 }
1169
1170
1171 static uschar *
1172 expand_getlistele(int field, uschar * list)
1173 {
1174 uschar * tlist= list;
1175 int sep= 0;
1176 uschar dummy;
1177
1178 if(field<0)
1179 {
1180 for(field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
1181 sep= 0;
1182 }
1183 if(field==0) return NULL;
1184 while(--field>0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
1185 return string_nextinlist(&list, &sep, NULL, 0);
1186 }
1187
1188
1189 /* Certificate fields, by name. Worry about by-OID later */
1190 /* Names are chosen to not have common prefixes */
1191
1192 #ifdef SUPPORT_TLS
1193 typedef struct
1194 {
1195 uschar * name;
1196 int namelen;
1197 uschar * (*getfn)(void * cert, uschar * mod);
1198 } certfield;
1199 static certfield certfields[] =
1200 { /* linear search; no special order */
1201 { US"version", 7, &tls_cert_version },
1202 { US"serial_number", 13, &tls_cert_serial_number },
1203 { US"subject", 7, &tls_cert_subject },
1204 { US"notbefore", 9, &tls_cert_not_before },
1205 { US"notafter", 8, &tls_cert_not_after },
1206 { US"issuer", 6, &tls_cert_issuer },
1207 { US"signature", 9, &tls_cert_signature },
1208 { US"sig_algorithm", 13, &tls_cert_signature_algorithm },
1209 { US"subj_altname", 12, &tls_cert_subject_altname },
1210 { US"ocsp_uri", 8, &tls_cert_ocsp_uri },
1211 { US"crl_uri", 7, &tls_cert_crl_uri },
1212 };
1213
1214 static uschar *
1215 expand_getcertele(uschar * field, uschar * certvar)
1216 {
1217 var_entry * vp;
1218 certfield * cp;
1219
1220 if (!(vp = find_var_ent(certvar)))
1221 {
1222 expand_string_message =
1223 string_sprintf("no variable named \"%s\"", certvar);
1224 return NULL; /* Unknown variable name */
1225 }
1226 /* NB this stops us passing certs around in variable. Might
1227 want to do that in future */
1228 if (vp->type != vtype_cert)
1229 {
1230 expand_string_message =
1231 string_sprintf("\"%s\" is not a certificate", certvar);
1232 return NULL; /* Unknown variable name */
1233 }
1234 if (!*(void **)vp->value)
1235 return NULL;
1236
1237 if (*field >= '0' && *field <= '9')
1238 return tls_cert_ext_by_oid(*(void **)vp->value, field, 0);
1239
1240 for(cp = certfields;
1241 cp < certfields + nelements(certfields);
1242 cp++)
1243 if (Ustrncmp(cp->name, field, cp->namelen) == 0)
1244 {
1245 uschar * modifier = *(field += cp->namelen) == ','
1246 ? ++field : NULL;
1247 return (*cp->getfn)( *(void **)vp->value, modifier );
1248 }
1249
1250 expand_string_message =
1251 string_sprintf("bad field selector \"%s\" for certextract", field);
1252 return NULL;
1253 }
1254 #endif /*SUPPORT_TLS*/
1255
1256 /*************************************************
1257 * Extract a substring from a string *
1258 *************************************************/
1259
1260 /* Perform the ${substr or ${length expansion operations.
1261
1262 Arguments:
1263 subject the input string
1264 value1 the offset from the start of the input string to the start of
1265 the output string; if negative, count from the right.
1266 value2 the length of the output string, or negative (-1) for unset
1267 if value1 is positive, unset means "all after"
1268 if value1 is negative, unset means "all before"
1269 len set to the length of the returned string
1270
1271 Returns: pointer to the output string, or NULL if there is an error
1272 */
1273
1274 static uschar *
1275 extract_substr(uschar *subject, int value1, int value2, int *len)
1276 {
1277 int sublen = Ustrlen(subject);
1278
1279 if (value1 < 0) /* count from right */
1280 {
1281 value1 += sublen;
1282
1283 /* If the position is before the start, skip to the start, and adjust the
1284 length. If the length ends up negative, the substring is null because nothing
1285 can precede. This falls out naturally when the length is unset, meaning "all
1286 to the left". */
1287
1288 if (value1 < 0)
1289 {
1290 value2 += value1;
1291 if (value2 < 0) value2 = 0;
1292 value1 = 0;
1293 }
1294
1295 /* Otherwise an unset length => characters before value1 */
1296
1297 else if (value2 < 0)
1298 {
1299 value2 = value1;
1300 value1 = 0;
1301 }
1302 }
1303
1304 /* For a non-negative offset, if the starting position is past the end of the
1305 string, the result will be the null string. Otherwise, an unset length means
1306 "rest"; just set it to the maximum - it will be cut down below if necessary. */
1307
1308 else
1309 {
1310 if (value1 > sublen)
1311 {
1312 value1 = sublen;
1313 value2 = 0;
1314 }
1315 else if (value2 < 0) value2 = sublen;
1316 }
1317
1318 /* Cut the length down to the maximum possible for the offset value, and get
1319 the required characters. */
1320
1321 if (value1 + value2 > sublen) value2 = sublen - value1;
1322 *len = value2;
1323 return subject + value1;
1324 }
1325
1326
1327
1328
1329 /*************************************************
1330 * Old-style hash of a string *
1331 *************************************************/
1332
1333 /* Perform the ${hash expansion operation.
1334
1335 Arguments:
1336 subject the input string (an expanded substring)
1337 value1 the length of the output string; if greater or equal to the
1338 length of the input string, the input string is returned
1339 value2 the number of hash characters to use, or 26 if negative
1340 len set to the length of the returned string
1341
1342 Returns: pointer to the output string, or NULL if there is an error
1343 */
1344
1345 static uschar *
1346 compute_hash(uschar *subject, int value1, int value2, int *len)
1347 {
1348 int sublen = Ustrlen(subject);
1349
1350 if (value2 < 0) value2 = 26;
1351 else if (value2 > Ustrlen(hashcodes))
1352 {
1353 expand_string_message =
1354 string_sprintf("hash count \"%d\" too big", value2);
1355 return NULL;
1356 }
1357
1358 /* Calculate the hash text. We know it is shorter than the original string, so
1359 can safely place it in subject[] (we know that subject is always itself an
1360 expanded substring). */
1361
1362 if (value1 < sublen)
1363 {
1364 int c;
1365 int i = 0;
1366 int j = value1;
1367 while ((c = (subject[j])) != 0)
1368 {
1369 int shift = (c + j++) & 7;
1370 subject[i] ^= (c << shift) | (c >> (8-shift));
1371 if (++i >= value1) i = 0;
1372 }
1373 for (i = 0; i < value1; i++)
1374 subject[i] = hashcodes[(subject[i]) % value2];
1375 }
1376 else value1 = sublen;
1377
1378 *len = value1;
1379 return subject;
1380 }
1381
1382
1383
1384
1385 /*************************************************
1386 * Numeric hash of a string *
1387 *************************************************/
1388
1389 /* Perform the ${nhash expansion operation. The first characters of the
1390 string are treated as most important, and get the highest prime numbers.
1391
1392 Arguments:
1393 subject the input string
1394 value1 the maximum value of the first part of the result
1395 value2 the maximum value of the second part of the result,
1396 or negative to produce only a one-part result
1397 len set to the length of the returned string
1398
1399 Returns: pointer to the output string, or NULL if there is an error.
1400 */
1401
1402 static uschar *
1403 compute_nhash (uschar *subject, int value1, int value2, int *len)
1404 {
1405 uschar *s = subject;
1406 int i = 0;
1407 unsigned long int total = 0; /* no overflow */
1408
1409 while (*s != 0)
1410 {
1411 if (i == 0) i = sizeof(prime)/sizeof(int) - 1;
1412 total += prime[i--] * (unsigned int)(*s++);
1413 }
1414
1415 /* If value2 is unset, just compute one number */
1416
1417 if (value2 < 0)
1418 {
1419 s = string_sprintf("%d", total % value1);
1420 }
1421
1422 /* Otherwise do a div/mod hash */
1423
1424 else
1425 {
1426 total = total % (value1 * value2);
1427 s = string_sprintf("%d/%d", total/value2, total % value2);
1428 }
1429
1430 *len = Ustrlen(s);
1431 return s;
1432 }
1433
1434
1435
1436
1437
1438 /*************************************************
1439 * Find the value of a header or headers *
1440 *************************************************/
1441
1442 /* Multiple instances of the same header get concatenated, and this function
1443 can also return a concatenation of all the header lines. When concatenating
1444 specific headers that contain lists of addresses, a comma is inserted between
1445 them. Otherwise we use a straight concatenation. Because some messages can have
1446 pathologically large number of lines, there is a limit on the length that is
1447 returned. Also, to avoid massive store use which would result from using
1448 string_cat() as it copies and extends strings, we do a preliminary pass to find
1449 out exactly how much store will be needed. On "normal" messages this will be
1450 pretty trivial.
1451
1452 Arguments:
1453 name the name of the header, without the leading $header_ or $h_,
1454 or NULL if a concatenation of all headers is required
1455 exists_only TRUE if called from a def: test; don't need to build a string;
1456 just return a string that is not "" and not "0" if the header
1457 exists
1458 newsize return the size of memory block that was obtained; may be NULL
1459 if exists_only is TRUE
1460 want_raw TRUE if called for $rh_ or $rheader_ variables; no processing,
1461 other than concatenating, will be done on the header. Also used
1462 for $message_headers_raw.
1463 charset name of charset to translate MIME words to; used only if
1464 want_raw is false; if NULL, no translation is done (this is
1465 used for $bh_ and $bheader_)
1466
1467 Returns: NULL if the header does not exist, else a pointer to a new
1468 store block
1469 */
1470
1471 static uschar *
1472 find_header(uschar *name, BOOL exists_only, int *newsize, BOOL want_raw,
1473 uschar *charset)
1474 {
1475 BOOL found = name == NULL;
1476 int comma = 0;
1477 int len = found? 0 : Ustrlen(name);
1478 int i;
1479 uschar *yield = NULL;
1480 uschar *ptr = NULL;
1481
1482 /* Loop for two passes - saves code repetition */
1483
1484 for (i = 0; i < 2; i++)
1485 {
1486 int size = 0;
1487 header_line *h;
1488
1489 for (h = header_list; size < header_insert_maxlen && h != NULL; h = h->next)
1490 {
1491 if (h->type != htype_old && h->text != NULL) /* NULL => Received: placeholder */
1492 {
1493 if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))
1494 {
1495 int ilen;
1496 uschar *t;
1497
1498 if (exists_only) return US"1"; /* don't need actual string */
1499 found = TRUE;
1500 t = h->text + len; /* text to insert */
1501 if (!want_raw) /* unless wanted raw, */
1502 while (isspace(*t)) t++; /* remove leading white space */
1503 ilen = h->slen - (t - h->text); /* length to insert */
1504
1505 /* Unless wanted raw, remove trailing whitespace, including the
1506 newline. */
1507
1508 if (!want_raw)
1509 while (ilen > 0 && isspace(t[ilen-1])) ilen--;
1510
1511 /* Set comma = 1 if handling a single header and it's one of those
1512 that contains an address list, except when asked for raw headers. Only
1513 need to do this once. */
1514
1515 if (!want_raw && name != NULL && comma == 0 &&
1516 Ustrchr("BCFRST", h->type) != NULL)
1517 comma = 1;
1518
1519 /* First pass - compute total store needed; second pass - compute
1520 total store used, including this header. */
1521
1522 size += ilen + comma + 1; /* +1 for the newline */
1523
1524 /* Second pass - concatentate the data, up to a maximum. Note that
1525 the loop stops when size hits the limit. */
1526
1527 if (i != 0)
1528 {
1529 if (size > header_insert_maxlen)
1530 {
1531 ilen -= size - header_insert_maxlen - 1;
1532 comma = 0;
1533 }
1534 Ustrncpy(ptr, t, ilen);
1535 ptr += ilen;
1536
1537 /* For a non-raw header, put in the comma if needed, then add
1538 back the newline we removed above, provided there was some text in
1539 the header. */
1540
1541 if (!want_raw && ilen > 0)
1542 {
1543 if (comma != 0) *ptr++ = ',';
1544 *ptr++ = '\n';
1545 }
1546 }
1547 }
1548 }
1549 }
1550
1551 /* At end of first pass, return NULL if no header found. Then truncate size
1552 if necessary, and get the buffer to hold the data, returning the buffer size.
1553 */
1554
1555 if (i == 0)
1556 {
1557 if (!found) return NULL;
1558 if (size > header_insert_maxlen) size = header_insert_maxlen;
1559 *newsize = size + 1;
1560 ptr = yield = store_get(*newsize);
1561 }
1562 }
1563
1564 /* That's all we do for raw header expansion. */
1565
1566 if (want_raw)
1567 {
1568 *ptr = 0;
1569 }
1570
1571 /* Otherwise, remove a final newline and a redundant added comma. Then we do
1572 RFC 2047 decoding, translating the charset if requested. The rfc2047_decode2()
1573 function can return an error with decoded data if the charset translation
1574 fails. If decoding fails, it returns NULL. */
1575
1576 else
1577 {
1578 uschar *decoded, *error;
1579 if (ptr > yield && ptr[-1] == '\n') ptr--;
1580 if (ptr > yield && comma != 0 && ptr[-1] == ',') ptr--;
1581 *ptr = 0;
1582 decoded = rfc2047_decode2(yield, check_rfc2047_length, charset, '?', NULL,
1583 newsize, &error);
1584 if (error != NULL)
1585 {
1586 DEBUG(D_any) debug_printf("*** error in RFC 2047 decoding: %s\n"
1587 " input was: %s\n", error, yield);
1588 }
1589 if (decoded != NULL) yield = decoded;
1590 }
1591
1592 return yield;
1593 }
1594
1595
1596
1597
1598 /*************************************************
1599 * Return list of recipients *
1600 *************************************************/
1601 /* A recipients list is available only during system message filtering,
1602 during ACL processing after DATA, and while expanding pipe commands
1603 generated from a system filter, but not elsewhere. */
1604
1605 static uschar *
1606 fn_recipients(void)
1607 {
1608 if (!enable_dollar_recipients) return NULL; else
1609 {
1610 int size = 128;
1611 int ptr = 0;
1612 int i;
1613 uschar * s = store_get(size);
1614 for (i = 0; i < recipients_count; i++)
1615 {
1616 if (i != 0) s = string_cat(s, &size, &ptr, US", ", 2);
1617 s = string_cat(s, &size, &ptr, recipients_list[i].address,
1618 Ustrlen(recipients_list[i].address));
1619 }
1620 s[ptr] = 0; /* string_cat() leaves room */
1621 return s;
1622 }
1623 }
1624
1625
1626 /*************************************************
1627 * Find value of a variable *
1628 *************************************************/
1629
1630 /* The table of variables is kept in alphabetic order, so we can search it
1631 using a binary chop. The "choplen" variable is nothing to do with the binary
1632 chop.
1633
1634 Arguments:
1635 name the name of the variable being sought
1636 exists_only TRUE if this is a def: test; passed on to find_header()
1637 skipping TRUE => skip any processing evaluation; this is not the same as
1638 exists_only because def: may test for values that are first
1639 evaluated here
1640 newsize pointer to an int which is initially zero; if the answer is in
1641 a new memory buffer, *newsize is set to its size
1642
1643 Returns: NULL if the variable does not exist, or
1644 a pointer to the variable's contents, or
1645 something non-NULL if exists_only is TRUE
1646 */
1647
1648 static uschar *
1649 find_variable(uschar *name, BOOL exists_only, BOOL skipping, int *newsize)
1650 {
1651 var_entry * vp;
1652 uschar *s, *domain;
1653 uschar **ss;
1654 void * val;
1655
1656 /* Handle ACL variables, whose names are of the form acl_cxxx or acl_mxxx.
1657 Originally, xxx had to be a number in the range 0-9 (later 0-19), but from
1658 release 4.64 onwards arbitrary names are permitted, as long as the first 5
1659 characters are acl_c or acl_m and the sixth is either a digit or an underscore
1660 (this gave backwards compatibility at the changeover). There may be built-in
1661 variables whose names start acl_ but they should never start in this way. This
1662 slightly messy specification is a consequence of the history, needless to say.
1663
1664 If an ACL variable does not exist, treat it as empty, unless strict_acl_vars is
1665 set, in which case give an error. */
1666
1667 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
1668 !isalpha(name[5]))
1669 {
1670 tree_node *node =
1671 tree_search((name[4] == 'c')? acl_var_c : acl_var_m, name + 4);
1672 return (node == NULL)? (strict_acl_vars? NULL : US"") : node->data.ptr;
1673 }
1674
1675 /* Handle $auth<n> variables. */
1676
1677 if (Ustrncmp(name, "auth", 4) == 0)
1678 {
1679 uschar *endptr;
1680 int n = Ustrtoul(name + 4, &endptr, 10);
1681 if (*endptr == 0 && n != 0 && n <= AUTH_VARS)
1682 return (auth_vars[n-1] == NULL)? US"" : auth_vars[n-1];
1683 }
1684
1685 /* For all other variables, search the table */
1686
1687 if (!(vp = find_var_ent(name)))
1688 return NULL; /* Unknown variable name */
1689
1690 /* Found an existing variable. If in skipping state, the value isn't needed,
1691 and we want to avoid processing (such as looking up the host name). */
1692
1693 if (skipping)
1694 return US"";
1695
1696 val = vp->value;
1697 switch (vp->type)
1698 {
1699 case vtype_filter_int:
1700 if (!filter_running) return NULL;
1701 /* Fall through */
1702 /* VVVVVVVVVVVV */
1703 case vtype_int:
1704 sprintf(CS var_buffer, "%d", *(int *)(val)); /* Integer */
1705 return var_buffer;
1706
1707 case vtype_ino:
1708 sprintf(CS var_buffer, "%ld", (long int)(*(ino_t *)(val))); /* Inode */
1709 return var_buffer;
1710
1711 case vtype_gid:
1712 sprintf(CS var_buffer, "%ld", (long int)(*(gid_t *)(val))); /* gid */
1713 return var_buffer;
1714
1715 case vtype_uid:
1716 sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(val))); /* uid */
1717 return var_buffer;
1718
1719 case vtype_bool:
1720 sprintf(CS var_buffer, "%s", *(BOOL *)(val) ? "yes" : "no"); /* bool */
1721 return var_buffer;
1722
1723 case vtype_stringptr: /* Pointer to string */
1724 s = *((uschar **)(val));
1725 return (s == NULL)? US"" : s;
1726
1727 case vtype_pid:
1728 sprintf(CS var_buffer, "%d", (int)getpid()); /* pid */
1729 return var_buffer;
1730
1731 case vtype_load_avg:
1732 sprintf(CS var_buffer, "%d", OS_GETLOADAVG()); /* load_average */
1733 return var_buffer;
1734
1735 case vtype_host_lookup: /* Lookup if not done so */
1736 if (sender_host_name == NULL && sender_host_address != NULL &&
1737 !host_lookup_failed && host_name_lookup() == OK)
1738 host_build_sender_fullhost();
1739 return (sender_host_name == NULL)? US"" : sender_host_name;
1740
1741 case vtype_localpart: /* Get local part from address */
1742 s = *((uschar **)(val));
1743 if (s == NULL) return US"";
1744 domain = Ustrrchr(s, '@');
1745 if (domain == NULL) return s;
1746 if (domain - s > sizeof(var_buffer) - 1)
1747 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
1748 " in string expansion", sizeof(var_buffer));
1749 Ustrncpy(var_buffer, s, domain - s);
1750 var_buffer[domain - s] = 0;
1751 return var_buffer;
1752
1753 case vtype_domain: /* Get domain from address */
1754 s = *((uschar **)(val));
1755 if (s == NULL) return US"";
1756 domain = Ustrrchr(s, '@');
1757 return (domain == NULL)? US"" : domain + 1;
1758
1759 case vtype_msgheaders:
1760 return find_header(NULL, exists_only, newsize, FALSE, NULL);
1761
1762 case vtype_msgheaders_raw:
1763 return find_header(NULL, exists_only, newsize, TRUE, NULL);
1764
1765 case vtype_msgbody: /* Pointer to msgbody string */
1766 case vtype_msgbody_end: /* Ditto, the end of the msg */
1767 ss = (uschar **)(val);
1768 if (*ss == NULL && deliver_datafile >= 0) /* Read body when needed */
1769 {
1770 uschar *body;
1771 off_t start_offset = SPOOL_DATA_START_OFFSET;
1772 int len = message_body_visible;
1773 if (len > message_size) len = message_size;
1774 *ss = body = store_malloc(len+1);
1775 body[0] = 0;
1776 if (vp->type == vtype_msgbody_end)
1777 {
1778 struct stat statbuf;
1779 if (fstat(deliver_datafile, &statbuf) == 0)
1780 {
1781 start_offset = statbuf.st_size - len;
1782 if (start_offset < SPOOL_DATA_START_OFFSET)
1783 start_offset = SPOOL_DATA_START_OFFSET;
1784 }
1785 }
1786 lseek(deliver_datafile, start_offset, SEEK_SET);
1787 len = read(deliver_datafile, body, len);
1788 if (len > 0)
1789 {
1790 body[len] = 0;
1791 if (message_body_newlines) /* Separate loops for efficiency */
1792 {
1793 while (len > 0)
1794 { if (body[--len] == 0) body[len] = ' '; }
1795 }
1796 else
1797 {
1798 while (len > 0)
1799 { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; }
1800 }
1801 }
1802 }
1803 return (*ss == NULL)? US"" : *ss;
1804
1805 case vtype_todbsdin: /* BSD inbox time of day */
1806 return tod_stamp(tod_bsdin);
1807
1808 case vtype_tode: /* Unix epoch time of day */
1809 return tod_stamp(tod_epoch);
1810
1811 case vtype_todel: /* Unix epoch/usec time of day */
1812 return tod_stamp(tod_epoch_l);
1813
1814 case vtype_todf: /* Full time of day */
1815 return tod_stamp(tod_full);
1816
1817 case vtype_todl: /* Log format time of day */
1818 return tod_stamp(tod_log_bare); /* (without timezone) */
1819
1820 case vtype_todzone: /* Time zone offset only */
1821 return tod_stamp(tod_zone);
1822
1823 case vtype_todzulu: /* Zulu time */
1824 return tod_stamp(tod_zulu);
1825
1826 case vtype_todlf: /* Log file datestamp tod */
1827 return tod_stamp(tod_log_datestamp_daily);
1828
1829 case vtype_reply: /* Get reply address */
1830 s = find_header(US"reply-to:", exists_only, newsize, TRUE,
1831 headers_charset);
1832 if (s != NULL) while (isspace(*s)) s++;
1833 if (s == NULL || *s == 0)
1834 {
1835 *newsize = 0; /* For the *s==0 case */
1836 s = find_header(US"from:", exists_only, newsize, TRUE, headers_charset);
1837 }
1838 if (s != NULL)
1839 {
1840 uschar *t;
1841 while (isspace(*s)) s++;
1842 for (t = s; *t != 0; t++) if (*t == '\n') *t = ' ';
1843 while (t > s && isspace(t[-1])) t--;
1844 *t = 0;
1845 }
1846 return (s == NULL)? US"" : s;
1847
1848 case vtype_string_func:
1849 {
1850 uschar * (*fn)() = val;
1851 return fn();
1852 }
1853
1854 case vtype_pspace:
1855 {
1856 int inodes;
1857 sprintf(CS var_buffer, "%d",
1858 receive_statvfs(val == (void *)TRUE, &inodes));
1859 }
1860 return var_buffer;
1861
1862 case vtype_pinodes:
1863 {
1864 int inodes;
1865 (void) receive_statvfs(val == (void *)TRUE, &inodes);
1866 sprintf(CS var_buffer, "%d", inodes);
1867 }
1868 return var_buffer;
1869
1870 case vtype_cert:
1871 return *(void **)val ? US"<cert>" : US"";
1872
1873 #ifndef DISABLE_DKIM
1874 case vtype_dkim:
1875 return dkim_exim_expand_query((int)(long)val);
1876 #endif
1877
1878 }
1879 }
1880
1881
1882
1883
1884 void
1885 modify_variable(uschar *name, void * value)
1886 {
1887 var_entry * vp;
1888 if ((vp = find_var_ent(name))) vp->value = value;
1889 return; /* Unknown variable name, fail silently */
1890 }
1891
1892
1893
1894
1895
1896 /*************************************************
1897 * Read and expand substrings *
1898 *************************************************/
1899
1900 /* This function is called to read and expand argument substrings for various
1901 expansion items. Some have a minimum requirement that is less than the maximum;
1902 in these cases, the first non-present one is set to NULL.
1903
1904 Arguments:
1905 sub points to vector of pointers to set
1906 n maximum number of substrings
1907 m minimum required
1908 sptr points to current string pointer
1909 skipping the skipping flag
1910 check_end if TRUE, check for final '}'
1911 name name of item, for error message
1912 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
1913 the store.
1914
1915 Returns: 0 OK; string pointer updated
1916 1 curly bracketing error (too few arguments)
1917 2 too many arguments (only if check_end is set); message set
1918 3 other error (expansion failure)
1919 */
1920
1921 static int
1922 read_subs(uschar **sub, int n, int m, uschar **sptr, BOOL skipping,
1923 BOOL check_end, uschar *name, BOOL *resetok)
1924 {
1925 int i;
1926 uschar *s = *sptr;
1927
1928 while (isspace(*s)) s++;
1929 for (i = 0; i < n; i++)
1930 {
1931 if (*s != '{')
1932 {
1933 if (i < m) return 1;
1934 sub[i] = NULL;
1935 break;
1936 }
1937 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok);
1938 if (sub[i] == NULL) return 3;
1939 if (*s++ != '}') return 1;
1940 while (isspace(*s)) s++;
1941 }
1942 if (check_end && *s++ != '}')
1943 {
1944 if (s[-1] == '{')
1945 {
1946 expand_string_message = string_sprintf("Too many arguments for \"%s\" "
1947 "(max is %d)", name, n);
1948 return 2;
1949 }
1950 return 1;
1951 }
1952
1953 *sptr = s;
1954 return 0;
1955 }
1956
1957
1958
1959
1960 /*************************************************
1961 * Elaborate message for bad variable *
1962 *************************************************/
1963
1964 /* For the "unknown variable" message, take a look at the variable's name, and
1965 give additional information about possible ACL variables. The extra information
1966 is added on to expand_string_message.
1967
1968 Argument: the name of the variable
1969 Returns: nothing
1970 */
1971
1972 static void
1973 check_variable_error_message(uschar *name)
1974 {
1975 if (Ustrncmp(name, "acl_", 4) == 0)
1976 expand_string_message = string_sprintf("%s (%s)", expand_string_message,
1977 (name[4] == 'c' || name[4] == 'm')?
1978 (isalpha(name[5])?
1979 US"6th character of a user-defined ACL variable must be a digit or underscore" :
1980 US"strict_acl_vars is set" /* Syntax is OK, it has to be this */
1981 ) :
1982 US"user-defined ACL variables must start acl_c or acl_m");
1983 }
1984
1985
1986
1987 /*
1988 Load args from sub array to globals, and call acl_check().
1989 Sub array will be corrupted on return.
1990
1991 Returns: OK access is granted by an ACCEPT verb
1992 DISCARD access is granted by a DISCARD verb
1993 FAIL access is denied
1994 FAIL_DROP access is denied; drop the connection
1995 DEFER can't tell at the moment
1996 ERROR disaster
1997 */
1998 static int
1999 eval_acl(uschar ** sub, int nsub, uschar ** user_msgp)
2000 {
2001 int i;
2002 uschar *tmp;
2003 int sav_narg = acl_narg;
2004 int ret;
2005 extern int acl_where;
2006
2007 if(--nsub > sizeof(acl_arg)/sizeof(*acl_arg)) nsub = sizeof(acl_arg)/sizeof(*acl_arg);
2008 for (i = 0; i < nsub && sub[i+1]; i++)
2009 {
2010 tmp = acl_arg[i];
2011 acl_arg[i] = sub[i+1]; /* place callers args in the globals */
2012 sub[i+1] = tmp; /* stash the old args using our caller's storage */
2013 }
2014 acl_narg = i;
2015 while (i < nsub)
2016 {
2017 sub[i+1] = acl_arg[i];
2018 acl_arg[i++] = NULL;
2019 }
2020
2021 DEBUG(D_expand)
2022 debug_printf("expanding: acl: %s arg: %s%s\n",
2023 sub[0],
2024 acl_narg>0 ? acl_arg[0] : US"<none>",
2025 acl_narg>1 ? " +more" : "");
2026
2027 ret = acl_eval(acl_where, sub[0], user_msgp, &tmp);
2028
2029 for (i = 0; i < nsub; i++)
2030 acl_arg[i] = sub[i+1]; /* restore old args */
2031 acl_narg = sav_narg;
2032
2033 return ret;
2034 }
2035
2036
2037
2038
2039 /*************************************************
2040 * Read and evaluate a condition *
2041 *************************************************/
2042
2043 /*
2044 Arguments:
2045 s points to the start of the condition text
2046 resetok points to a BOOL which is written false if it is unsafe to
2047 free memory. Certain condition types (acl) may have side-effect
2048 allocation which must be preserved.
2049 yield points to a BOOL to hold the result of the condition test;
2050 if NULL, we are just reading through a condition that is
2051 part of an "or" combination to check syntax, or in a state
2052 where the answer isn't required
2053
2054 Returns: a pointer to the first character after the condition, or
2055 NULL after an error
2056 */
2057
2058 static uschar *
2059 eval_condition(uschar *s, BOOL *resetok, BOOL *yield)
2060 {
2061 BOOL testfor = TRUE;
2062 BOOL tempcond, combined_cond;
2063 BOOL *subcondptr;
2064 BOOL sub2_honour_dollar = TRUE;
2065 int i, rc, cond_type, roffset;
2066 int_eximarith_t num[2];
2067 struct stat statbuf;
2068 uschar name[256];
2069 uschar *sub[10];
2070
2071 const pcre *re;
2072 const uschar *rerror;
2073
2074 for (;;)
2075 {
2076 while (isspace(*s)) s++;
2077 if (*s == '!') { testfor = !testfor; s++; } else break;
2078 }
2079
2080 /* Numeric comparisons are symbolic */
2081
2082 if (*s == '=' || *s == '>' || *s == '<')
2083 {
2084 int p = 0;
2085 name[p++] = *s++;
2086 if (*s == '=')
2087 {
2088 name[p++] = '=';
2089 s++;
2090 }
2091 name[p] = 0;
2092 }
2093
2094 /* All other conditions are named */
2095
2096 else s = read_name(name, 256, s, US"_");
2097
2098 /* If we haven't read a name, it means some non-alpha character is first. */
2099
2100 if (name[0] == 0)
2101 {
2102 expand_string_message = string_sprintf("condition name expected, "
2103 "but found \"%.16s\"", s);
2104 return NULL;
2105 }
2106
2107 /* Find which condition we are dealing with, and switch on it */
2108
2109 cond_type = chop_match(name, cond_table, sizeof(cond_table)/sizeof(uschar *));
2110 switch(cond_type)
2111 {
2112 /* def: tests for a non-empty variable, or for the existence of a header. If
2113 yield == NULL we are in a skipping state, and don't care about the answer. */
2114
2115 case ECOND_DEF:
2116 if (*s != ':')
2117 {
2118 expand_string_message = US"\":\" expected after \"def\"";
2119 return NULL;
2120 }
2121
2122 s = read_name(name, 256, s+1, US"_");
2123
2124 /* Test for a header's existence. If the name contains a closing brace
2125 character, this may be a user error where the terminating colon has been
2126 omitted. Set a flag to adjust a subsequent error message in this case. */
2127
2128 if (Ustrncmp(name, "h_", 2) == 0 ||
2129 Ustrncmp(name, "rh_", 3) == 0 ||
2130 Ustrncmp(name, "bh_", 3) == 0 ||
2131 Ustrncmp(name, "header_", 7) == 0 ||
2132 Ustrncmp(name, "rheader_", 8) == 0 ||
2133 Ustrncmp(name, "bheader_", 8) == 0)
2134 {
2135 s = read_header_name(name, 256, s);
2136 /* {-for-text-editors */
2137 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
2138 if (yield != NULL) *yield =
2139 (find_header(name, TRUE, NULL, FALSE, NULL) != NULL) == testfor;
2140 }
2141
2142 /* Test for a variable's having a non-empty value. A non-existent variable
2143 causes an expansion failure. */
2144
2145 else
2146 {
2147 uschar *value = find_variable(name, TRUE, yield == NULL, NULL);
2148 if (value == NULL)
2149 {
2150 expand_string_message = (name[0] == 0)?
2151 string_sprintf("variable name omitted after \"def:\"") :
2152 string_sprintf("unknown variable \"%s\" after \"def:\"", name);
2153 check_variable_error_message(name);
2154 return NULL;
2155 }
2156 if (yield != NULL) *yield = (value[0] != 0) == testfor;
2157 }
2158
2159 return s;
2160
2161
2162 /* first_delivery tests for first delivery attempt */
2163
2164 case ECOND_FIRST_DELIVERY:
2165 if (yield != NULL) *yield = deliver_firsttime == testfor;
2166 return s;
2167
2168
2169 /* queue_running tests for any process started by a queue runner */
2170
2171 case ECOND_QUEUE_RUNNING:
2172 if (yield != NULL) *yield = (queue_run_pid != (pid_t)0) == testfor;
2173 return s;
2174
2175
2176 /* exists: tests for file existence
2177 isip: tests for any IP address
2178 isip4: tests for an IPv4 address
2179 isip6: tests for an IPv6 address
2180 pam: does PAM authentication
2181 radius: does RADIUS authentication
2182 ldapauth: does LDAP authentication
2183 pwcheck: does Cyrus SASL pwcheck authentication
2184 */
2185
2186 case ECOND_EXISTS:
2187 case ECOND_ISIP:
2188 case ECOND_ISIP4:
2189 case ECOND_ISIP6:
2190 case ECOND_PAM:
2191 case ECOND_RADIUS:
2192 case ECOND_LDAPAUTH:
2193 case ECOND_PWCHECK:
2194
2195 while (isspace(*s)) s++;
2196 if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2197
2198 sub[0] = expand_string_internal(s+1, TRUE, &s, yield == NULL, TRUE, resetok);
2199 if (sub[0] == NULL) return NULL;
2200 /* {-for-text-editors */
2201 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2202
2203 if (yield == NULL) return s; /* No need to run the test if skipping */
2204
2205 switch(cond_type)
2206 {
2207 case ECOND_EXISTS:
2208 if ((expand_forbid & RDO_EXISTS) != 0)
2209 {
2210 expand_string_message = US"File existence tests are not permitted";
2211 return NULL;
2212 }
2213 *yield = (Ustat(sub[0], &statbuf) == 0) == testfor;
2214 break;
2215
2216 case ECOND_ISIP:
2217 case ECOND_ISIP4:
2218 case ECOND_ISIP6:
2219 rc = string_is_ip_address(sub[0], NULL);
2220 *yield = ((cond_type == ECOND_ISIP)? (rc != 0) :
2221 (cond_type == ECOND_ISIP4)? (rc == 4) : (rc == 6)) == testfor;
2222 break;
2223
2224 /* Various authentication tests - all optionally compiled */
2225
2226 case ECOND_PAM:
2227 #ifdef SUPPORT_PAM
2228 rc = auth_call_pam(sub[0], &expand_string_message);
2229 goto END_AUTH;
2230 #else
2231 goto COND_FAILED_NOT_COMPILED;
2232 #endif /* SUPPORT_PAM */
2233
2234 case ECOND_RADIUS:
2235 #ifdef RADIUS_CONFIG_FILE
2236 rc = auth_call_radius(sub[0], &expand_string_message);
2237 goto END_AUTH;
2238 #else
2239 goto COND_FAILED_NOT_COMPILED;
2240 #endif /* RADIUS_CONFIG_FILE */
2241
2242 case ECOND_LDAPAUTH:
2243 #ifdef LOOKUP_LDAP
2244 {
2245 /* Just to keep the interface the same */
2246 BOOL do_cache;
2247 int old_pool = store_pool;
2248 store_pool = POOL_SEARCH;
2249 rc = eldapauth_find((void *)(-1), NULL, sub[0], Ustrlen(sub[0]), NULL,
2250 &expand_string_message, &do_cache);
2251 store_pool = old_pool;
2252 }
2253 goto END_AUTH;
2254 #else
2255 goto COND_FAILED_NOT_COMPILED;
2256 #endif /* LOOKUP_LDAP */
2257
2258 case ECOND_PWCHECK:
2259 #ifdef CYRUS_PWCHECK_SOCKET
2260 rc = auth_call_pwcheck(sub[0], &expand_string_message);
2261 goto END_AUTH;
2262 #else
2263 goto COND_FAILED_NOT_COMPILED;
2264 #endif /* CYRUS_PWCHECK_SOCKET */
2265
2266 #if defined(SUPPORT_PAM) || defined(RADIUS_CONFIG_FILE) || \
2267 defined(LOOKUP_LDAP) || defined(CYRUS_PWCHECK_SOCKET)
2268 END_AUTH:
2269 if (rc == ERROR || rc == DEFER) return NULL;
2270 *yield = (rc == OK) == testfor;
2271 #endif
2272 }
2273 return s;
2274
2275
2276 /* call ACL (in a conditional context). Accept true, deny false.
2277 Defer is a forced-fail. Anything set by message= goes to $value.
2278 Up to ten parameters are used; we use the braces round the name+args
2279 like the saslauthd condition does, to permit a variable number of args.
2280 See also the expansion-item version EITEM_ACL and the traditional
2281 acl modifier ACLC_ACL.
2282 Since the ACL may allocate new global variables, tell our caller to not
2283 reclaim memory.
2284 */
2285
2286 case ECOND_ACL:
2287 /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */
2288 {
2289 uschar *user_msg;
2290 BOOL cond = FALSE;
2291 int size = 0;
2292 int ptr = 0;
2293
2294 while (isspace(*s)) s++;
2295 if (*s++ != '{') goto COND_FAILED_CURLY_START; /*}*/
2296
2297 switch(read_subs(sub, sizeof(sub)/sizeof(*sub), 1,
2298 &s, yield == NULL, TRUE, US"acl", resetok))
2299 {
2300 case 1: expand_string_message = US"too few arguments or bracketing "
2301 "error for acl";
2302 case 2:
2303 case 3: return NULL;
2304 }
2305
2306 *resetok = FALSE;
2307 if (yield != NULL) switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
2308 {
2309 case OK:
2310 cond = TRUE;
2311 case FAIL:
2312 lookup_value = NULL;
2313 if (user_msg)
2314 {
2315 lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg));
2316 lookup_value[ptr] = '\0';
2317 }
2318 *yield = cond == testfor;
2319 break;
2320
2321 case DEFER:
2322 expand_string_forcedfail = TRUE;
2323 default:
2324 expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
2325 return NULL;
2326 }
2327 return s;
2328 }
2329
2330
2331 /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used:
2332
2333 ${if saslauthd {{username}{password}{service}{realm}} {yes}{no}}
2334
2335 However, the last two are optional. That is why the whole set is enclosed
2336 in their own set of braces. */
2337
2338 case ECOND_SASLAUTHD:
2339 #ifndef CYRUS_SASLAUTHD_SOCKET
2340 goto COND_FAILED_NOT_COMPILED;
2341 #else
2342 while (isspace(*s)) s++;
2343 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2344 switch(read_subs(sub, 4, 2, &s, yield == NULL, TRUE, US"saslauthd", resetok))
2345 {
2346 case 1: expand_string_message = US"too few arguments or bracketing "
2347 "error for saslauthd";
2348 case 2:
2349 case 3: return NULL;
2350 }
2351 if (sub[2] == NULL) sub[3] = NULL; /* realm if no service */
2352 if (yield != NULL)
2353 {
2354 int rc;
2355 rc = auth_call_saslauthd(sub[0], sub[1], sub[2], sub[3],
2356 &expand_string_message);
2357 if (rc == ERROR || rc == DEFER) return NULL;
2358 *yield = (rc == OK) == testfor;
2359 }
2360 return s;
2361 #endif /* CYRUS_SASLAUTHD_SOCKET */
2362
2363
2364 /* symbolic operators for numeric and string comparison, and a number of
2365 other operators, all requiring two arguments.
2366
2367 crypteq: encrypts plaintext and compares against an encrypted text,
2368 using crypt(), crypt16(), MD5 or SHA-1
2369 inlist/inlisti: checks if first argument is in the list of the second
2370 match: does a regular expression match and sets up the numerical
2371 variables if it succeeds
2372 match_address: matches in an address list
2373 match_domain: matches in a domain list
2374 match_ip: matches a host list that is restricted to IP addresses
2375 match_local_part: matches in a local part list
2376 */
2377
2378 case ECOND_MATCH_ADDRESS:
2379 case ECOND_MATCH_DOMAIN:
2380 case ECOND_MATCH_IP:
2381 case ECOND_MATCH_LOCAL_PART:
2382 #ifndef EXPAND_LISTMATCH_RHS
2383 sub2_honour_dollar = FALSE;
2384 #endif
2385 /* FALLTHROUGH */
2386
2387 case ECOND_CRYPTEQ:
2388 case ECOND_INLIST:
2389 case ECOND_INLISTI:
2390 case ECOND_MATCH:
2391
2392 case ECOND_NUM_L: /* Numerical comparisons */
2393 case ECOND_NUM_LE:
2394 case ECOND_NUM_E:
2395 case ECOND_NUM_EE:
2396 case ECOND_NUM_G:
2397 case ECOND_NUM_GE:
2398
2399 case ECOND_STR_LT: /* String comparisons */
2400 case ECOND_STR_LTI:
2401 case ECOND_STR_LE:
2402 case ECOND_STR_LEI:
2403 case ECOND_STR_EQ:
2404 case ECOND_STR_EQI:
2405 case ECOND_STR_GT:
2406 case ECOND_STR_GTI:
2407 case ECOND_STR_GE:
2408 case ECOND_STR_GEI:
2409
2410 for (i = 0; i < 2; i++)
2411 {
2412 /* Sometimes, we don't expand substrings; too many insecure configurations
2413 created using match_address{}{} and friends, where the second param
2414 includes information from untrustworthy sources. */
2415 BOOL honour_dollar = TRUE;
2416 if ((i > 0) && !sub2_honour_dollar)
2417 honour_dollar = FALSE;
2418
2419 while (isspace(*s)) s++;
2420 if (*s != '{')
2421 {
2422 if (i == 0) goto COND_FAILED_CURLY_START;
2423 expand_string_message = string_sprintf("missing 2nd string in {} "
2424 "after \"%s\"", name);
2425 return NULL;
2426 }
2427 sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
2428 honour_dollar, resetok);
2429 if (sub[i] == NULL) return NULL;
2430 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2431
2432 /* Convert to numerical if required; we know that the names of all the
2433 conditions that compare numbers do not start with a letter. This just saves
2434 checking for them individually. */
2435
2436 if (!isalpha(name[0]) && yield != NULL)
2437 {
2438 if (sub[i][0] == 0)
2439 {
2440 num[i] = 0;
2441 DEBUG(D_expand)
2442 debug_printf("empty string cast to zero for numerical comparison\n");
2443 }
2444 else
2445 {
2446 num[i] = expand_string_integer(sub[i], FALSE);
2447 if (expand_string_message != NULL) return NULL;
2448 }
2449 }
2450 }
2451
2452 /* Result not required */
2453
2454 if (yield == NULL) return s;
2455
2456 /* Do an appropriate comparison */
2457
2458 switch(cond_type)
2459 {
2460 case ECOND_NUM_E:
2461 case ECOND_NUM_EE:
2462 tempcond = (num[0] == num[1]);
2463 break;
2464
2465 case ECOND_NUM_G:
2466 tempcond = (num[0] > num[1]);
2467 break;
2468
2469 case ECOND_NUM_GE:
2470 tempcond = (num[0] >= num[1]);
2471 break;
2472
2473 case ECOND_NUM_L:
2474 tempcond = (num[0] < num[1]);
2475 break;
2476
2477 case ECOND_NUM_LE:
2478 tempcond = (num[0] <= num[1]);
2479 break;
2480
2481 case ECOND_STR_LT:
2482 tempcond = (Ustrcmp(sub[0], sub[1]) < 0);
2483 break;
2484
2485 case ECOND_STR_LTI:
2486 tempcond = (strcmpic(sub[0], sub[1]) < 0);
2487 break;
2488
2489 case ECOND_STR_LE:
2490 tempcond = (Ustrcmp(sub[0], sub[1]) <= 0);
2491 break;
2492
2493 case ECOND_STR_LEI:
2494 tempcond = (strcmpic(sub[0], sub[1]) <= 0);
2495 break;
2496
2497 case ECOND_STR_EQ:
2498 tempcond = (Ustrcmp(sub[0], sub[1]) == 0);
2499 break;
2500
2501 case ECOND_STR_EQI:
2502 tempcond = (strcmpic(sub[0], sub[1]) == 0);
2503 break;
2504
2505 case ECOND_STR_GT:
2506 tempcond = (Ustrcmp(sub[0], sub[1]) > 0);
2507 break;
2508
2509 case ECOND_STR_GTI:
2510 tempcond = (strcmpic(sub[0], sub[1]) > 0);
2511 break;
2512
2513 case ECOND_STR_GE:
2514 tempcond = (Ustrcmp(sub[0], sub[1]) >= 0);
2515 break;
2516
2517 case ECOND_STR_GEI:
2518 tempcond = (strcmpic(sub[0], sub[1]) >= 0);
2519 break;
2520
2521 case ECOND_MATCH: /* Regular expression match */
2522 re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
2523 NULL);
2524 if (re == NULL)
2525 {
2526 expand_string_message = string_sprintf("regular expression error in "
2527 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
2528 return NULL;
2529 }
2530 tempcond = regex_match_and_setup(re, sub[0], 0, -1);
2531 break;
2532
2533 case ECOND_MATCH_ADDRESS: /* Match in an address list */
2534 rc = match_address_list(sub[0], TRUE, FALSE, &(sub[1]), NULL, -1, 0, NULL);
2535 goto MATCHED_SOMETHING;
2536
2537 case ECOND_MATCH_DOMAIN: /* Match in a domain list */
2538 rc = match_isinlist(sub[0], &(sub[1]), 0, &domainlist_anchor, NULL,
2539 MCL_DOMAIN + MCL_NOEXPAND, TRUE, NULL);
2540 goto MATCHED_SOMETHING;
2541
2542 case ECOND_MATCH_IP: /* Match IP address in a host list */
2543 if (sub[0][0] != 0 && string_is_ip_address(sub[0], NULL) == 0)
2544 {
2545 expand_string_message = string_sprintf("\"%s\" is not an IP address",
2546 sub[0]);
2547 return NULL;
2548 }
2549 else
2550 {
2551 unsigned int *nullcache = NULL;
2552 check_host_block cb;
2553
2554 cb.host_name = US"";
2555 cb.host_address = sub[0];
2556
2557 /* If the host address starts off ::ffff: it is an IPv6 address in
2558 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2559 addresses. */
2560
2561 cb.host_ipv4 = (Ustrncmp(cb.host_address, "::ffff:", 7) == 0)?
2562 cb.host_address + 7 : cb.host_address;
2563
2564 rc = match_check_list(
2565 &sub[1], /* the list */
2566 0, /* separator character */
2567 &hostlist_anchor, /* anchor pointer */
2568 &nullcache, /* cache pointer */
2569 check_host, /* function for testing */
2570 &cb, /* argument for function */
2571 MCL_HOST, /* type of check */
2572 sub[0], /* text for debugging */
2573 NULL); /* where to pass back data */
2574 }
2575 goto MATCHED_SOMETHING;
2576
2577 case ECOND_MATCH_LOCAL_PART:
2578 rc = match_isinlist(sub[0], &(sub[1]), 0, &localpartlist_anchor, NULL,
2579 MCL_LOCALPART + MCL_NOEXPAND, TRUE, NULL);
2580 /* Fall through */
2581 /* VVVVVVVVVVVV */
2582 MATCHED_SOMETHING:
2583 switch(rc)
2584 {
2585 case OK:
2586 tempcond = TRUE;
2587 break;
2588
2589 case FAIL:
2590 tempcond = FALSE;
2591 break;
2592
2593 case DEFER:
2594 expand_string_message = string_sprintf("unable to complete match "
2595 "against \"%s\": %s", sub[1], search_error_message);
2596 return NULL;
2597 }
2598
2599 break;
2600
2601 /* Various "encrypted" comparisons. If the second string starts with
2602 "{" then an encryption type is given. Default to crypt() or crypt16()
2603 (build-time choice). */
2604 /* }-for-text-editors */
2605
2606 case ECOND_CRYPTEQ:
2607 #ifndef SUPPORT_CRYPTEQ
2608 goto COND_FAILED_NOT_COMPILED;
2609 #else
2610 if (strncmpic(sub[1], US"{md5}", 5) == 0)
2611 {
2612 int sublen = Ustrlen(sub[1]+5);
2613 md5 base;
2614 uschar digest[16];
2615
2616 md5_start(&base);
2617 md5_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
2618
2619 /* If the length that we are comparing against is 24, the MD5 digest
2620 is expressed as a base64 string. This is the way LDAP does it. However,
2621 some other software uses a straightforward hex representation. We assume
2622 this if the length is 32. Other lengths fail. */
2623
2624 if (sublen == 24)
2625 {
2626 uschar *coded = auth_b64encode((uschar *)digest, 16);
2627 DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
2628 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
2629 tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
2630 }
2631 else if (sublen == 32)
2632 {
2633 int i;
2634 uschar coded[36];
2635 for (i = 0; i < 16; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2636 coded[32] = 0;
2637 DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n"
2638 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
2639 tempcond = (strcmpic(coded, sub[1]+5) == 0);
2640 }
2641 else
2642 {
2643 DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: "
2644 "fail\n crypted=%s\n", sub[1]+5);
2645 tempcond = FALSE;
2646 }
2647 }
2648
2649 else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
2650 {
2651 int sublen = Ustrlen(sub[1]+6);
2652 sha1 base;
2653 uschar digest[20];
2654
2655 sha1_start(&base);
2656 sha1_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
2657
2658 /* If the length that we are comparing against is 28, assume the SHA1
2659 digest is expressed as a base64 string. If the length is 40, assume a
2660 straightforward hex representation. Other lengths fail. */
2661
2662 if (sublen == 28)
2663 {
2664 uschar *coded = auth_b64encode((uschar *)digest, 20);
2665 DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
2666 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
2667 tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
2668 }
2669 else if (sublen == 40)
2670 {
2671 int i;
2672 uschar coded[44];
2673 for (i = 0; i < 20; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2674 coded[40] = 0;
2675 DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n"
2676 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
2677 tempcond = (strcmpic(coded, sub[1]+6) == 0);
2678 }
2679 else
2680 {
2681 DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: "
2682 "fail\n crypted=%s\n", sub[1]+6);
2683 tempcond = FALSE;
2684 }
2685 }
2686
2687 else /* {crypt} or {crypt16} and non-{ at start */
2688 /* }-for-text-editors */
2689 {
2690 int which = 0;
2691 uschar *coded;
2692
2693 if (strncmpic(sub[1], US"{crypt}", 7) == 0)
2694 {
2695 sub[1] += 7;
2696 which = 1;
2697 }
2698 else if (strncmpic(sub[1], US"{crypt16}", 9) == 0)
2699 {
2700 sub[1] += 9;
2701 which = 2;
2702 }
2703 else if (sub[1][0] == '{') /* }-for-text-editors */
2704 {
2705 expand_string_message = string_sprintf("unknown encryption mechanism "
2706 "in \"%s\"", sub[1]);
2707 return NULL;
2708 }
2709
2710 switch(which)
2711 {
2712 case 0: coded = US DEFAULT_CRYPT(CS sub[0], CS sub[1]); break;
2713 case 1: coded = US crypt(CS sub[0], CS sub[1]); break;
2714 default: coded = US crypt16(CS sub[0], CS sub[1]); break;
2715 }
2716
2717 #define STR(s) # s
2718 #define XSTR(s) STR(s)
2719 DEBUG(D_auth) debug_printf("crypteq: using %s()\n"
2720 " subject=%s\n crypted=%s\n",
2721 (which == 0)? XSTR(DEFAULT_CRYPT) : (which == 1)? "crypt" : "crypt16",
2722 coded, sub[1]);
2723 #undef STR
2724 #undef XSTR
2725
2726 /* If the encrypted string contains fewer than two characters (for the
2727 salt), force failure. Otherwise we get false positives: with an empty
2728 string the yield of crypt() is an empty string! */
2729
2730 tempcond = (Ustrlen(sub[1]) < 2)? FALSE :
2731 (Ustrcmp(coded, sub[1]) == 0);
2732 }
2733 break;
2734 #endif /* SUPPORT_CRYPTEQ */
2735
2736 case ECOND_INLIST:
2737 case ECOND_INLISTI:
2738 {
2739 int sep = 0;
2740 uschar *save_iterate_item = iterate_item;
2741 int (*compare)(const uschar *, const uschar *);
2742
2743 tempcond = FALSE;
2744 if (cond_type == ECOND_INLISTI)
2745 compare = strcmpic;
2746 else
2747 compare = (int (*)(const uschar *, const uschar *)) strcmp;
2748
2749 while ((iterate_item = string_nextinlist(&sub[1], &sep, NULL, 0)) != NULL)
2750 if (compare(sub[0], iterate_item) == 0)
2751 {
2752 tempcond = TRUE;
2753 break;
2754 }
2755 iterate_item = save_iterate_item;
2756 }
2757
2758 } /* Switch for comparison conditions */
2759
2760 *yield = tempcond == testfor;
2761 return s; /* End of comparison conditions */
2762
2763
2764 /* and/or: computes logical and/or of several conditions */
2765
2766 case ECOND_AND:
2767 case ECOND_OR:
2768 subcondptr = (yield == NULL)? NULL : &tempcond;
2769 combined_cond = (cond_type == ECOND_AND);
2770
2771 while (isspace(*s)) s++;
2772 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2773
2774 for (;;)
2775 {
2776 while (isspace(*s)) s++;
2777 /* {-for-text-editors */
2778 if (*s == '}') break;
2779 if (*s != '{') /* }-for-text-editors */
2780 {
2781 expand_string_message = string_sprintf("each subcondition "
2782 "inside an \"%s{...}\" condition must be in its own {}", name);
2783 return NULL;
2784 }
2785
2786 if (!(s = eval_condition(s+1, resetok, subcondptr)))
2787 {
2788 expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
2789 expand_string_message, name);
2790 return NULL;
2791 }
2792 while (isspace(*s)) s++;
2793
2794 /* {-for-text-editors */
2795 if (*s++ != '}')
2796 {
2797 /* {-for-text-editors */
2798 expand_string_message = string_sprintf("missing } at end of condition "
2799 "inside \"%s\" group", name);
2800 return NULL;
2801 }
2802
2803 if (yield != NULL)
2804 {
2805 if (cond_type == ECOND_AND)
2806 {
2807 combined_cond &= tempcond;
2808 if (!combined_cond) subcondptr = NULL; /* once false, don't */
2809 } /* evaluate any more */
2810 else
2811 {
2812 combined_cond |= tempcond;
2813 if (combined_cond) subcondptr = NULL; /* once true, don't */
2814 } /* evaluate any more */
2815 }
2816 }
2817
2818 if (yield != NULL) *yield = (combined_cond == testfor);
2819 return ++s;
2820
2821
2822 /* forall/forany: iterates a condition with different values */
2823
2824 case ECOND_FORALL:
2825 case ECOND_FORANY:
2826 {
2827 int sep = 0;
2828 uschar *save_iterate_item = iterate_item;
2829
2830 while (isspace(*s)) s++;
2831 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2832 sub[0] = expand_string_internal(s, TRUE, &s, (yield == NULL), TRUE, resetok);
2833 if (sub[0] == NULL) return NULL;
2834 /* {-for-text-editors */
2835 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2836
2837 while (isspace(*s)) s++;
2838 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2839
2840 sub[1] = s;
2841
2842 /* Call eval_condition once, with result discarded (as if scanning a
2843 "false" part). This allows us to find the end of the condition, because if
2844 the list it empty, we won't actually evaluate the condition for real. */
2845
2846 if (!(s = eval_condition(sub[1], resetok, NULL)))
2847 {
2848 expand_string_message = string_sprintf("%s inside \"%s\" condition",
2849 expand_string_message, name);
2850 return NULL;
2851 }
2852 while (isspace(*s)) s++;
2853
2854 /* {-for-text-editors */
2855 if (*s++ != '}')
2856 {
2857 /* {-for-text-editors */
2858 expand_string_message = string_sprintf("missing } at end of condition "
2859 "inside \"%s\"", name);
2860 return NULL;
2861 }
2862
2863 if (yield != NULL) *yield = !testfor;
2864 while ((iterate_item = string_nextinlist(&sub[0], &sep, NULL, 0)) != NULL)
2865 {
2866 DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
2867 if (!eval_condition(sub[1], resetok, &tempcond))
2868 {
2869 expand_string_message = string_sprintf("%s inside \"%s\" condition",
2870 expand_string_message, name);
2871 iterate_item = save_iterate_item;
2872 return NULL;
2873 }
2874 DEBUG(D_expand) debug_printf("%s: condition evaluated to %s\n", name,
2875 tempcond? "true":"false");
2876
2877 if (yield != NULL) *yield = (tempcond == testfor);
2878 if (tempcond == (cond_type == ECOND_FORANY)) break;
2879 }
2880
2881 iterate_item = save_iterate_item;
2882 return s;
2883 }
2884
2885
2886 /* The bool{} expansion condition maps a string to boolean.
2887 The values supported should match those supported by the ACL condition
2888 (acl.c, ACLC_CONDITION) so that we keep to a minimum the different ideas
2889 of true/false. Note that Router "condition" rules have a different
2890 interpretation, where general data can be used and only a few values
2891 map to FALSE.
2892 Note that readconf.c boolean matching, for boolean configuration options,
2893 only matches true/yes/false/no.
2894 The bool_lax{} condition matches the Router logic, which is much more
2895 liberal. */
2896 case ECOND_BOOL:
2897 case ECOND_BOOL_LAX:
2898 {
2899 uschar *sub_arg[1];
2900 uschar *t, *t2;
2901 uschar *ourname;
2902 size_t len;
2903 BOOL boolvalue = FALSE;
2904 while (isspace(*s)) s++;
2905 if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2906 ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool";
2907 switch(read_subs(sub_arg, 1, 1, &s, yield == NULL, FALSE, ourname, resetok))
2908 {
2909 case 1: expand_string_message = string_sprintf(
2910 "too few arguments or bracketing error for %s",
2911 ourname);
2912 /*FALLTHROUGH*/
2913 case 2:
2914 case 3: return NULL;
2915 }
2916 t = sub_arg[0];
2917 while (isspace(*t)) t++;
2918 len = Ustrlen(t);
2919 if (len)
2920 {
2921 /* trailing whitespace: seems like a good idea to ignore it too */
2922 t2 = t + len - 1;
2923 while (isspace(*t2)) t2--;
2924 if (t2 != (t + len))
2925 {
2926 *++t2 = '\0';
2927 len = t2 - t;
2928 }
2929 }
2930 DEBUG(D_expand)
2931 debug_printf("considering %s: %s\n", ourname, len ? t : US"<empty>");
2932 /* logic for the lax case from expand_check_condition(), which also does
2933 expands, and the logic is both short and stable enough that there should
2934 be no maintenance burden from replicating it. */
2935 if (len == 0)
2936 boolvalue = FALSE;
2937 else if (*t == '-'
2938 ? Ustrspn(t+1, "0123456789") == len-1
2939 : Ustrspn(t, "0123456789") == len)
2940 {
2941 boolvalue = (Uatoi(t) == 0) ? FALSE : TRUE;
2942 /* expand_check_condition only does a literal string "0" check */
2943 if ((cond_type == ECOND_BOOL_LAX) && (len > 1))
2944 boolvalue = TRUE;
2945 }
2946 else if (strcmpic(t, US"true") == 0 || strcmpic(t, US"yes") == 0)
2947 boolvalue = TRUE;
2948 else if (strcmpic(t, US"false") == 0 || strcmpic(t, US"no") == 0)
2949 boolvalue = FALSE;
2950 else if (cond_type == ECOND_BOOL_LAX)
2951 boolvalue = TRUE;
2952 else
2953 {
2954 expand_string_message = string_sprintf("unrecognised boolean "
2955 "value \"%s\"", t);
2956 return NULL;
2957 }
2958 if (yield != NULL) *yield = (boolvalue == testfor);
2959 return s;
2960 }
2961
2962 /* Unknown condition */
2963
2964 default:
2965 expand_string_message = string_sprintf("unknown condition \"%s\"", name);
2966 return NULL;
2967 } /* End switch on condition type */
2968
2969 /* Missing braces at start and end of data */
2970
2971 COND_FAILED_CURLY_START:
2972 expand_string_message = string_sprintf("missing { after \"%s\"", name);
2973 return NULL;
2974
2975 COND_FAILED_CURLY_END:
2976 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
2977 name);
2978 return NULL;
2979
2980 /* A condition requires code that is not compiled */
2981
2982 #if !defined(SUPPORT_PAM) || !defined(RADIUS_CONFIG_FILE) || \
2983 !defined(LOOKUP_LDAP) || !defined(CYRUS_PWCHECK_SOCKET) || \
2984 !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
2985 COND_FAILED_NOT_COMPILED:
2986 expand_string_message = string_sprintf("support for \"%s\" not compiled",
2987 name);
2988 return NULL;
2989 #endif
2990 }
2991
2992
2993
2994
2995 /*************************************************
2996 * Save numerical variables *
2997 *************************************************/
2998
2999 /* This function is called from items such as "if" that want to preserve and
3000 restore the numbered variables.
3001
3002 Arguments:
3003 save_expand_string points to an array of pointers to set
3004 save_expand_nlength points to an array of ints for the lengths
3005
3006 Returns: the value of expand max to save
3007 */
3008
3009 static int
3010 save_expand_strings(uschar **save_expand_nstring, int *save_expand_nlength)
3011 {
3012 int i;
3013 for (i = 0; i <= expand_nmax; i++)
3014 {
3015 save_expand_nstring[i] = expand_nstring[i];
3016 save_expand_nlength[i] = expand_nlength[i];
3017 }
3018 return expand_nmax;
3019 }
3020
3021
3022
3023 /*************************************************
3024 * Restore numerical variables *
3025 *************************************************/
3026
3027 /* This function restored saved values of numerical strings.
3028
3029 Arguments:
3030 save_expand_nmax the number of strings to restore
3031 save_expand_string points to an array of pointers
3032 save_expand_nlength points to an array of ints
3033
3034 Returns: nothing
3035 */
3036
3037 static void
3038 restore_expand_strings(int save_expand_nmax, uschar **save_expand_nstring,
3039 int *save_expand_nlength)
3040 {
3041 int i;
3042 expand_nmax = save_expand_nmax;
3043 for (i = 0; i <= expand_nmax; i++)
3044 {
3045 expand_nstring[i] = save_expand_nstring[i];
3046 expand_nlength[i] = save_expand_nlength[i];
3047 }
3048 }
3049
3050
3051
3052
3053
3054 /*************************************************
3055 * Handle yes/no substrings *
3056 *************************************************/
3057
3058 /* This function is used by ${if}, ${lookup} and ${extract} to handle the
3059 alternative substrings that depend on whether or not the condition was true,
3060 or the lookup or extraction succeeded. The substrings always have to be
3061 expanded, to check their syntax, but "skipping" is set when the result is not
3062 needed - this avoids unnecessary nested lookups.
3063
3064 Arguments:
3065 skipping TRUE if we were skipping when this item was reached
3066 yes TRUE if the first string is to be used, else use the second
3067 save_lookup a value to put back into lookup_value before the 2nd expansion
3068 sptr points to the input string pointer
3069 yieldptr points to the output string pointer
3070 sizeptr points to the output string size
3071 ptrptr points to the output string pointer
3072 type "lookup" or "if" or "extract" or "run", for error message
3073 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
3074 the store.
3075
3076 Returns: 0 OK; lookup_value has been reset to save_lookup
3077 1 expansion failed
3078 2 expansion failed because of bracketing error
3079 */
3080
3081 static int
3082 process_yesno(BOOL skipping, BOOL yes, uschar *save_lookup, uschar **sptr,
3083 uschar **yieldptr, int *sizeptr, int *ptrptr, uschar *type, BOOL *resetok)
3084 {
3085 int rc = 0;
3086 uschar *s = *sptr; /* Local value */
3087 uschar *sub1, *sub2;
3088
3089 /* If there are no following strings, we substitute the contents of $value for
3090 lookups and for extractions in the success case. For the ${if item, the string
3091 "true" is substituted. In the fail case, nothing is substituted for all three
3092 items. */
3093
3094 while (isspace(*s)) s++;
3095 if (*s == '}')
3096 {
3097 if (type[0] == 'i')
3098 {
3099 if (yes) *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, US"true", 4);
3100 }
3101 else
3102 {
3103 if (yes && lookup_value != NULL)
3104 *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value,
3105 Ustrlen(lookup_value));
3106 lookup_value = save_lookup;
3107 }
3108 s++;
3109 goto RETURN;
3110 }
3111
3112 /* The first following string must be braced. */
3113
3114 if (*s++ != '{') goto FAILED_CURLY;
3115
3116 /* Expand the first substring. Forced failures are noticed only if we actually
3117 want this string. Set skipping in the call in the fail case (this will always
3118 be the case if we were already skipping). */
3119
3120 sub1 = expand_string_internal(s, TRUE, &s, !yes, TRUE, resetok);
3121 if (sub1 == NULL && (yes || !expand_string_forcedfail)) goto FAILED;
3122 expand_string_forcedfail = FALSE;
3123 if (*s++ != '}') goto FAILED_CURLY;
3124
3125 /* If we want the first string, add it to the output */
3126
3127 if (yes)
3128 *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub1, Ustrlen(sub1));
3129
3130 /* If this is called from a lookup or an extract, we want to restore $value to
3131 what it was at the start of the item, so that it has this value during the
3132 second string expansion. For the call from "if" or "run" to this function,
3133 save_lookup is set to lookup_value, so that this statement does nothing. */
3134
3135 lookup_value = save_lookup;
3136
3137 /* There now follows either another substring, or "fail", or nothing. This
3138 time, forced failures are noticed only if we want the second string. We must
3139 set skipping in the nested call if we don't want this string, or if we were
3140 already skipping. */
3141
3142 while (isspace(*s)) s++;
3143 if (*s == '{')
3144 {
3145 sub2 = expand_string_internal(s+1, TRUE, &s, yes || skipping, TRUE, resetok);
3146 if (sub2 == NULL && (!yes || !expand_string_forcedfail)) goto FAILED;
3147 expand_string_forcedfail = FALSE;
3148 if (*s++ != '}') goto FAILED_CURLY;
3149
3150 /* If we want the second string, add it to the output */
3151
3152 if (!yes)
3153 *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, sub2, Ustrlen(sub2));
3154 }
3155
3156 /* If there is no second string, but the word "fail" is present when the use of
3157 the second string is wanted, set a flag indicating it was a forced failure
3158 rather than a syntactic error. Swallow the terminating } in case this is nested
3159 inside another lookup or if or extract. */
3160
3161 else if (*s != '}')
3162 {
3163 uschar name[256];
3164 s = read_name(name, sizeof(name), s, US"_");
3165 if (Ustrcmp(name, "fail") == 0)
3166 {
3167 if (!yes && !skipping)
3168 {
3169 while (isspace(*s)) s++;
3170 if (*s++ != '}') goto FAILED_CURLY;
3171 expand_string_message =
3172 string_sprintf("\"%s\" failed and \"fail\" requested", type);
3173 expand_string_forcedfail = TRUE;
3174 goto FAILED;
3175 }
3176 }
3177 else
3178 {
3179 expand_string_message =
3180 string_sprintf("syntax error in \"%s\" item - \"fail\" expected", type);
3181 goto FAILED;
3182 }
3183 }
3184
3185 /* All we have to do now is to check on the final closing brace. */
3186
3187 while (isspace(*s)) s++;
3188 if (*s++ == '}') goto RETURN;
3189
3190 /* Get here if there is a bracketing failure */
3191
3192 FAILED_CURLY:
3193 rc++;
3194
3195 /* Get here for other failures */
3196
3197 FAILED:
3198 rc++;
3199
3200 /* Update the input pointer value before returning */
3201
3202 RETURN:
3203 *sptr = s;
3204 return rc;
3205 }
3206
3207
3208
3209
3210 /*************************************************
3211 * Handle MD5 or SHA-1 computation for HMAC *
3212 *************************************************/
3213
3214 /* These are some wrapping functions that enable the HMAC code to be a bit
3215 cleaner. A good compiler will spot the tail recursion.
3216
3217 Arguments:
3218 type HMAC_MD5 or HMAC_SHA1
3219 remaining are as for the cryptographic hash functions
3220
3221 Returns: nothing
3222 */
3223
3224 static void
3225 chash_start(int type, void *base)
3226 {
3227 if (type == HMAC_MD5)
3228 md5_start((md5 *)base);
3229 else
3230 sha1_start((sha1 *)base);
3231 }
3232
3233 static void
3234 chash_mid(int type, void *base, uschar *string)
3235 {
3236 if (type == HMAC_MD5)
3237 md5_mid((md5 *)base, string);
3238 else
3239 sha1_mid((sha1 *)base, string);
3240 }
3241
3242 static void
3243 chash_end(int type, void *base, uschar *string, int length, uschar *digest)
3244 {
3245 if (type == HMAC_MD5)
3246 md5_end((md5 *)base, string, length, digest);
3247 else
3248 sha1_end((sha1 *)base, string, length, digest);
3249 }
3250
3251
3252
3253
3254
3255 /********************************************************
3256 * prvs: Get last three digits of days since Jan 1, 1970 *
3257 ********************************************************/
3258
3259 /* This is needed to implement the "prvs" BATV reverse
3260 path signing scheme
3261
3262 Argument: integer "days" offset to add or substract to
3263 or from the current number of days.
3264
3265 Returns: pointer to string containing the last three
3266 digits of the number of days since Jan 1, 1970,
3267 modified by the offset argument, NULL if there
3268 was an error in the conversion.
3269
3270 */
3271
3272 static uschar *
3273 prvs_daystamp(int day_offset)
3274 {
3275 uschar *days = store_get(32); /* Need at least 24 for cases */
3276 (void)string_format(days, 32, TIME_T_FMT, /* where TIME_T_FMT is %lld */
3277 (time(NULL) + day_offset*86400)/86400);
3278 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
3279 }
3280
3281
3282
3283 /********************************************************
3284 * prvs: perform HMAC-SHA1 computation of prvs bits *
3285 ********************************************************/
3286
3287 /* This is needed to implement the "prvs" BATV reverse
3288 path signing scheme
3289
3290 Arguments:
3291 address RFC2821 Address to use
3292 key The key to use (must be less than 64 characters
3293 in size)
3294 key_num Single-digit key number to use. Defaults to
3295 '0' when NULL.
3296
3297 Returns: pointer to string containing the first three
3298 bytes of the final hash in hex format, NULL if
3299 there was an error in the process.
3300 */
3301
3302 static uschar *
3303 prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
3304 {
3305 uschar *hash_source, *p;
3306 int size = 0,offset = 0,i;
3307 sha1 sha1_base;
3308 void *use_base = &sha1_base;
3309 uschar innerhash[20];
3310 uschar finalhash[20];
3311 uschar innerkey[64];
3312 uschar outerkey[64];
3313 uschar *finalhash_hex = store_get(40);
3314
3315 if (key_num == NULL)
3316 key_num = US"0";
3317
3318 if (Ustrlen(key) > 64)
3319 return NULL;
3320
3321 hash_source = string_cat(NULL,&size,&offset,key_num,1);
3322 string_cat(hash_source,&size,&offset,daystamp,3);
3323 string_cat(hash_source,&size,&offset,address,Ustrlen(address));
3324 hash_source[offset] = '\0';
3325
3326 DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source);
3327
3328 memset(innerkey, 0x36, 64);
3329 memset(outerkey, 0x5c, 64);
3330
3331 for (i = 0; i < Ustrlen(key); i++)
3332 {
3333 innerkey[i] ^= key[i];
3334 outerkey[i] ^= key[i];
3335 }
3336
3337 chash_start(HMAC_SHA1, use_base);
3338 chash_mid(HMAC_SHA1, use_base, innerkey);
3339 chash_end(HMAC_SHA1, use_base, hash_source, offset, innerhash);
3340
3341 chash_start(HMAC_SHA1, use_base);
3342 chash_mid(HMAC_SHA1, use_base, outerkey);
3343 chash_end(HMAC_SHA1, use_base, innerhash, 20, finalhash);
3344
3345 p = finalhash_hex;
3346 for (i = 0; i < 3; i++)
3347 {
3348 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
3349 *p++ = hex_digits[finalhash[i] & 0x0f];
3350 }
3351 *p = '\0';
3352
3353 return finalhash_hex;
3354 }
3355
3356
3357
3358
3359 /*************************************************
3360 * Join a file onto the output string *
3361 *************************************************/
3362
3363 /* This is used for readfile and after a run expansion. It joins the contents
3364 of a file onto the output string, globally replacing newlines with a given
3365 string (optionally). The file is closed at the end.
3366
3367 Arguments:
3368 f the FILE
3369 yield pointer to the expandable string
3370 sizep pointer to the current size
3371 ptrp pointer to the current position
3372 eol newline replacement string, or NULL
3373
3374 Returns: new value of string pointer
3375 */
3376
3377 static uschar *
3378 cat_file(FILE *f, uschar *yield, int *sizep, int *ptrp, uschar *eol)
3379 {
3380 int eollen;
3381 uschar buffer[1024];
3382
3383 eollen = (eol == NULL)? 0 : Ustrlen(eol);
3384
3385 while (Ufgets(buffer, sizeof(buffer), f) != NULL)
3386 {
3387 int len = Ustrlen(buffer);
3388 if (eol != NULL && buffer[len-1] == '\n') len--;
3389 yield = string_cat(yield, sizep, ptrp, buffer, len);
3390 if (buffer[len] != 0)
3391 yield = string_cat(yield, sizep, ptrp, eol, eollen);
3392 }
3393
3394 if (yield != NULL) yield[*ptrp] = 0;
3395
3396 return yield;
3397 }
3398
3399
3400
3401
3402 /*************************************************
3403 * Evaluate numeric expression *
3404 *************************************************/
3405
3406 /* This is a set of mutually recursive functions that evaluate an arithmetic
3407 expression involving + - * / % & | ^ ~ << >> and parentheses. The only one of
3408 these functions that is called from elsewhere is eval_expr, whose interface is:
3409
3410 Arguments:
3411 sptr pointer to the pointer to the string - gets updated
3412 decimal TRUE if numbers are to be assumed decimal
3413 error pointer to where to put an error message - must be NULL on input
3414 endket TRUE if ')' must terminate - FALSE for external call
3415
3416 Returns: on success: the value of the expression, with *error still NULL
3417 on failure: an undefined value, with *error = a message
3418 */
3419
3420 static int_eximarith_t eval_op_or(uschar **, BOOL, uschar **);
3421
3422
3423 static int_eximarith_t
3424 eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
3425 {
3426 uschar *s = *sptr;
3427 int_eximarith_t x = eval_op_or(&s, decimal, error);
3428 if (*error == NULL)
3429 {
3430 if (endket)
3431 {
3432 if (*s != ')')
3433 *error = US"expecting closing parenthesis";
3434 else
3435 while (isspace(*(++s)));
3436 }
3437 else if (*s != 0) *error = US"expecting operator";
3438 }
3439 *sptr = s;
3440 return x;
3441 }
3442
3443
3444 static int_eximarith_t
3445 eval_number(uschar **sptr, BOOL decimal, uschar **error)
3446 {
3447 register int c;
3448 int_eximarith_t n;
3449 uschar *s = *sptr;
3450 while (isspace(*s)) s++;
3451 c = *s;
3452 if (isdigit(c))
3453 {
3454 int count;
3455 (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
3456 s += count;
3457 switch (tolower(*s))
3458 {
3459 default: break;
3460 case 'k': n *= 1024; s++; break;
3461 case 'm': n *= 1024*1024; s++; break;
3462 case 'g': n *= 1024*1024*1024; s++; break;
3463 }
3464 while (isspace (*s)) s++;
3465 }
3466 else if (c == '(')
3467 {
3468 s++;
3469 n = eval_expr(&s, decimal, error, 1);
3470 }
3471 else
3472 {
3473 *error = US"expecting number or opening parenthesis";
3474 n = 0;
3475 }
3476 *sptr = s;
3477 return n;
3478 }
3479
3480
3481 static int_eximarith_t
3482 eval_op_unary(uschar **sptr, BOOL decimal, uschar **error)
3483 {
3484 uschar *s = *sptr;
3485 int_eximarith_t x;
3486 while (isspace(*s)) s++;
3487 if (*s == '+' || *s == '-' || *s == '~')
3488 {
3489 int op = *s++;
3490 x = eval_op_unary(&s, decimal, error);
3491 if (op == '-') x = -x;
3492 else if (op == '~') x = ~x;
3493 }
3494 else
3495 {
3496 x = eval_number(&s, decimal, error);
3497 }
3498 *sptr = s;
3499 return x;
3500 }
3501
3502
3503 static int_eximarith_t
3504 eval_op_mult(uschar **sptr, BOOL decimal, uschar **error)
3505 {
3506 uschar *s = *sptr;
3507 int_eximarith_t x = eval_op_unary(&s, decimal, error);
3508 if (*error == NULL)
3509 {
3510 while (*s == '*' || *s == '/' || *s == '%')
3511 {
3512 int op = *s++;
3513 int_eximarith_t y = eval_op_unary(&s, decimal, error);
3514 if (*error != NULL) break;
3515 /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
3516 * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
3517 * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where
3518 * -N*M is INT_MIN will yielf INT_MIN.
3519 * Since we don't support floating point, this is somewhat simpler.
3520 * Ideally, we'd return an error, but since we overflow for all other
3521 * arithmetic, consistency suggests otherwise, but what's the correct value
3522 * to use? There is none.
3523 * The C standard guarantees overflow for unsigned arithmetic but signed
3524 * overflow invokes undefined behaviour; in practice, this is overflow
3525 * except for converting INT_MIN to INT_MAX+1. We also can't guarantee
3526 * that long/longlong larger than int are available, or we could just work
3527 * with larger types. We should consider whether to guarantee 32bit eval
3528 * and 64-bit working variables, with errors returned. For now ...
3529 * So, the only SIGFPEs occur with a non-shrinking div/mod, thus -1; we
3530 * can just let the other invalid results occur otherwise, as they have
3531 * until now. For this one case, we can coerce.
3532 */
3533 if (y == -1 && x == EXIM_ARITH_MIN && op != '*')
3534 {
3535 DEBUG(D_expand)
3536 debug_printf("Integer exception dodging: " PR_EXIM_ARITH "%c-1 coerced to " PR_EXIM_ARITH "\n",
3537 EXIM_ARITH_MIN, op, EXIM_ARITH_MAX);
3538 x = EXIM_ARITH_MAX;
3539 continue;
3540 }
3541 if (op == '*')
3542 x *= y;
3543 else
3544 {
3545 if (y == 0)
3546 {
3547 *error = (op == '/') ? US"divide by zero" : US"modulo by zero";
3548 x = 0;
3549 break;
3550 }
3551 if (op == '/')
3552 x /= y;
3553 else
3554 x %= y;
3555 }
3556 }
3557 }
3558 *sptr = s;
3559 return x;
3560 }
3561
3562
3563 static int_eximarith_t
3564 eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
3565 {
3566 uschar *s = *sptr;
3567 int_eximarith_t x = eval_op_mult(&s, decimal, error);
3568 if (*error == NULL)
3569 {
3570 while (*s == '+' || *s == '-')
3571 {
3572 int op = *s++;
3573 int_eximarith_t y = eval_op_mult(&s, decimal, error);
3574 if (*error != NULL) break;
3575 if (op == '+') x += y; else x -= y;
3576 }
3577 }
3578 *sptr = s;
3579 return x;
3580 }
3581
3582
3583 static int_eximarith_t
3584 eval_op_shift(uschar **sptr, BOOL decimal, uschar **error)
3585 {
3586 uschar *s = *sptr;
3587 int_eximarith_t x = eval_op_sum(&s, decimal, error);
3588 if (*error == NULL)
3589 {
3590 while ((*s == '<' || *s == '>') && s[1] == s[0])
3591 {
3592 int_eximarith_t y;
3593 int op = *s++;
3594 s++;
3595 y = eval_op_sum(&s, decimal, error);
3596 if (*error != NULL) break;
3597 if (op == '<') x <<= y; else x >>= y;
3598 }
3599 }
3600 *sptr = s;
3601 return x;
3602 }
3603
3604
3605 static int_eximarith_t
3606 eval_op_and(uschar **sptr, BOOL decimal, uschar **error)
3607 {
3608 uschar *s = *sptr;
3609 int_eximarith_t x = eval_op_shift(&s, decimal, error);
3610 if (*error == NULL)
3611 {
3612 while (*s == '&')
3613 {
3614 int_eximarith_t y;
3615 s++;
3616 y = eval_op_shift(&s, decimal, error);
3617 if (*error != NULL) break;
3618 x &= y;
3619 }
3620 }
3621 *sptr = s;
3622 return x;
3623 }
3624
3625
3626 static int_eximarith_t
3627 eval_op_xor(uschar **sptr, BOOL decimal, uschar **error)
3628 {
3629 uschar *s = *sptr;
3630 int_eximarith_t x = eval_op_and(&s, decimal, error);
3631 if (*error == NULL)
3632 {
3633 while (*s == '^')
3634 {
3635 int_eximarith_t y;
3636 s++;
3637 y = eval_op_and(&s, decimal, error);
3638 if (*error != NULL) break;
3639 x ^= y;
3640 }
3641 }
3642 *sptr = s;
3643 return x;
3644 }
3645
3646
3647 static int_eximarith_t
3648 eval_op_or(uschar **sptr, BOOL decimal, uschar **error)
3649 {
3650 uschar *s = *sptr;
3651 int_eximarith_t x = eval_op_xor(&s, decimal, error);
3652 if (*error == NULL)
3653 {
3654 while (*s == '|')
3655 {
3656 int_eximarith_t y;
3657 s++;
3658 y = eval_op_xor(&s, decimal, error);
3659 if (*error != NULL) break;
3660 x |= y;
3661 }
3662 }
3663 *sptr = s;
3664 return x;
3665 }
3666
3667
3668
3669 /*************************************************
3670 * Expand string *
3671 *************************************************/
3672
3673 /* Returns either an unchanged string, or the expanded string in stacking pool
3674 store. Interpreted sequences are:
3675
3676 \... normal escaping rules
3677 $name substitutes the variable
3678 ${name} ditto
3679 ${op:string} operates on the expanded string value
3680 ${item{arg1}{arg2}...} expands the args and then does the business
3681 some literal args are not enclosed in {}
3682
3683 There are now far too many operators and item types to make it worth listing
3684 them here in detail any more.
3685
3686 We use an internal routine recursively to handle embedded substrings. The
3687 external function follows. The yield is NULL if the expansion failed, and there
3688 are two cases: if something collapsed syntactically, or if "fail" was given
3689 as the action on a lookup failure. These can be distinguised by looking at the
3690 variable expand_string_forcedfail, which is TRUE in the latter case.
3691
3692 The skipping flag is set true when expanding a substring that isn't actually
3693 going to be used (after "if" or "lookup") and it prevents lookups from
3694 happening lower down.
3695
3696 Store usage: At start, a store block of the length of the input plus 64
3697 is obtained. This is expanded as necessary by string_cat(), which might have to
3698 get a new block, or might be able to expand the original. At the end of the
3699 function we can release any store above that portion of the yield block that
3700 was actually used. In many cases this will be optimal.
3701
3702 However: if the first item in the expansion is a variable name or header name,
3703 we reset the store before processing it; if the result is in fresh store, we
3704 use that without copying. This is helpful for expanding strings like
3705 $message_headers which can get very long.
3706
3707 There's a problem if a ${dlfunc item has side-effects that cause allocation,
3708 since resetting the store at the end of the expansion will free store that was
3709 allocated by the plugin code as well as the slop after the expanded string. So
3710 we skip any resets if ${dlfunc } has been used. The same applies for ${acl }
3711 and, given the acl condition, ${if }. This is an unfortunate consequence of
3712 string expansion becoming too powerful.
3713
3714 Arguments:
3715 string the string to be expanded
3716 ket_ends true if expansion is to stop at }
3717 left if not NULL, a pointer to the first character after the
3718 expansion is placed here (typically used with ket_ends)
3719 skipping TRUE for recursive calls when the value isn't actually going
3720 to be used (to allow for optimisation)
3721 honour_dollar TRUE if $ is to be expanded,
3722 FALSE if it's just another character
3723 resetok_p if not NULL, pointer to flag - write FALSE if unsafe to reset
3724 the store.
3725
3726 Returns: NULL if expansion fails:
3727 expand_string_forcedfail is set TRUE if failure was forced
3728 expand_string_message contains a textual error message
3729 a pointer to the expanded string on success
3730 */
3731
3732 static uschar *
3733 expand_string_internal(uschar *string, BOOL ket_ends, uschar **left,
3734 BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
3735 {
3736 int ptr = 0;
3737 int size = Ustrlen(string)+ 64;
3738 int item_type;
3739 uschar *yield = store_get(size);
3740 uschar *s = string;
3741 uschar *save_expand_nstring[EXPAND_MAXN+1];
3742 int save_expand_nlength[EXPAND_MAXN+1];
3743 BOOL resetok = TRUE;
3744
3745 expand_string_forcedfail = FALSE;
3746 expand_string_message = US"";
3747
3748 while (*s != 0)
3749 {
3750 uschar *value;
3751 uschar name[256];
3752
3753 /* \ escapes the next character, which must exist, or else
3754 the expansion fails. There's a special escape, \N, which causes
3755 copying of the subject verbatim up to the next \N. Otherwise,
3756 the escapes are the standard set. */
3757
3758 if (*s == '\\')
3759 {
3760 if (s[1] == 0)
3761 {
3762 expand_string_message = US"\\ at end of string";
3763 goto EXPAND_FAILED;
3764 }
3765
3766 if (s[1] == 'N')
3767 {
3768 uschar *t = s + 2;
3769 for (s = t; *s != 0; s++) if (*s == '\\' && s[1] == 'N') break;
3770 yield = string_cat(yield, &size, &ptr, t, s - t);
3771 if (*s != 0) s += 2;
3772 }
3773
3774 else
3775 {
3776 uschar ch[1];
3777 ch[0] = string_interpret_escape(&s);
3778 s++;
3779 yield = string_cat(yield, &size, &ptr, ch, 1);
3780 }
3781
3782 continue;
3783 }
3784
3785 /*{*/
3786 /* Anything other than $ is just copied verbatim, unless we are
3787 looking for a terminating } character. */
3788
3789 /*{*/
3790 if (ket_ends && *s == '}') break;
3791
3792 if (*s != '$' || !honour_dollar)
3793 {
3794 yield = string_cat(yield, &size, &ptr, s++, 1);
3795 continue;
3796 }
3797
3798 /* No { after the $ - must be a plain name or a number for string
3799 match variable. There has to be a fudge for variables that are the
3800 names of header fields preceded by "$header_" because header field
3801 names can contain any printing characters except space and colon.
3802 For those that don't like typing this much, "$h_" is a synonym for
3803 "$header_". A non-existent header yields a NULL value; nothing is
3804 inserted. */ /*}*/
3805
3806 if (isalpha((*(++s))))
3807 {
3808 int len;
3809 int newsize = 0;
3810
3811 s = read_name(name, sizeof(name), s, US"_");
3812
3813 /* If this is the first thing to be expanded, release the pre-allocated
3814 buffer. */
3815
3816 if (ptr == 0 && yield != NULL)
3817 {
3818 if (resetok) store_reset(yield);
3819 yield = NULL;
3820 size = 0;
3821 }
3822
3823 /* Header */
3824
3825 if (Ustrncmp(name, "h_", 2) == 0 ||
3826 Ustrncmp(name, "rh_", 3) == 0 ||
3827 Ustrncmp(name, "bh_", 3) == 0 ||
3828 Ustrncmp(name, "header_", 7) == 0 ||
3829 Ustrncmp(name, "rheader_", 8) == 0 ||
3830 Ustrncmp(name, "bheader_", 8) == 0)
3831 {
3832 BOOL want_raw = (name[0] == 'r')? TRUE : FALSE;
3833 uschar *charset = (name[0] == 'b')? NULL : headers_charset;
3834 s = read_header_name(name, sizeof(name), s);
3835 value = find_header(name, FALSE, &newsize, want_raw, charset);
3836
3837 /* If we didn't find the header, and the header contains a closing brace
3838 character, this may be a user error where the terminating colon
3839 has been omitted. Set a flag to adjust the error message in this case.
3840 But there is no error here - nothing gets inserted. */
3841
3842 if (value == NULL)
3843 {
3844 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
3845 continue;
3846 }
3847 }
3848
3849 /* Variable */
3850
3851 else
3852 {
3853 value = find_variable(name, FALSE, skipping, &newsize);
3854 if (value == NULL)
3855 {
3856 expand_string_message =
3857 string_sprintf("unknown variable name \"%s\"", name);
3858 check_variable_error_message(name);
3859 goto EXPAND_FAILED;
3860 }
3861 }
3862
3863 /* If the data is known to be in a new buffer, newsize will be set to the
3864 size of that buffer. If this is the first thing in an expansion string,
3865 yield will be NULL; just point it at the new store instead of copying. Many
3866 expansion strings contain just one reference, so this is a useful
3867 optimization, especially for humungous headers. */
3868
3869 len = Ustrlen(value);
3870 if (yield == NULL && newsize != 0)
3871 {
3872 yield = value;
3873 size = newsize;
3874 ptr = len;
3875 }
3876 else yield = string_cat(yield, &size, &ptr, value, len);
3877
3878 continue;
3879 }
3880
3881 if (isdigit(*s))
3882 {
3883 int n;
3884 s = read_number(&n, s);
3885 if (n >= 0 && n <= expand_nmax)
3886 yield = string_cat(yield, &size, &ptr, expand_nstring[n],
3887 expand_nlength[n]);
3888 continue;
3889 }
3890
3891 /* Otherwise, if there's no '{' after $ it's an error. */ /*}*/
3892
3893 if (*s != '{') /*}*/
3894 {
3895 expand_string_message = US"$ not followed by letter, digit, or {"; /*}*/
3896 goto EXPAND_FAILED;
3897 }
3898
3899 /* After { there can be various things, but they all start with
3900 an initial word, except for a number for a string match variable. */
3901
3902 if (isdigit((*(++s))))
3903 {
3904 int n;
3905 s = read_number(&n, s); /*{*/
3906 if (*s++ != '}')
3907 { /*{*/
3908 expand_string_message = US"} expected after number";
3909 goto EXPAND_FAILED;
3910 }
3911 if (n >= 0 && n <= expand_nmax)
3912 yield = string_cat(yield, &size, &ptr, expand_nstring[n],
3913 expand_nlength[n]);
3914 continue;
3915 }
3916
3917 if (!isalpha(*s))
3918 {
3919 expand_string_message = US"letter or digit expected after ${"; /*}*/
3920 goto EXPAND_FAILED;
3921 }
3922
3923 /* Allow "-" in names to cater for substrings with negative
3924 arguments. Since we are checking for known names after { this is
3925 OK. */
3926
3927 s = read_name(name, sizeof(name), s, US"_-");
3928 item_type = chop_match(name, item_table, sizeof(item_table)/sizeof(uschar *));
3929
3930 switch(item_type)
3931 {
3932 /* Call an ACL from an expansion. We feed data in via $acl_arg1 - $acl_arg9.
3933 If the ACL returns accept or reject we return content set by "message ="
3934 There is currently no limit on recursion; this would have us call
3935 acl_check_internal() directly and get a current level from somewhere.
3936 See also the acl expansion condition ECOND_ACL and the traditional
3937 acl modifier ACLC_ACL.
3938 Assume that the function has side-effects on the store that must be preserved.
3939 */
3940
3941 case EITEM_ACL:
3942 /* ${acl {name} {arg1}{arg2}...} */
3943 {
3944 uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
3945 uschar *user_msg;
3946
3947 switch(read_subs(sub, 10, 1, &s, skipping, TRUE, US"acl", &resetok))
3948 {
3949 case 1: goto EXPAND_FAILED_CURLY;
3950 case 2:
3951 case 3: goto EXPAND_FAILED;
3952 }
3953 if (skipping) continue;
3954
3955 resetok = FALSE;
3956 switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
3957 {
3958 case OK:
3959 case FAIL:
3960 DEBUG(D_expand)
3961 debug_printf("acl expansion yield: %s\n", user_msg);
3962 if (user_msg)
3963 yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg));
3964 continue;
3965
3966 case DEFER:
3967 expand_string_forcedfail = TRUE;
3968 default:
3969 expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
3970 goto EXPAND_FAILED;
3971 }
3972 }
3973
3974 /* Handle conditionals - preserve the values of the numerical expansion
3975 variables in case they get changed by a regular expression match in the
3976 condition. If not, they retain their external settings. At the end
3977 of this "if" section, they get restored to their previous values. */
3978
3979 case EITEM_IF:
3980 {
3981 BOOL cond = FALSE;
3982 uschar *next_s;
3983 int save_expand_nmax =
3984 save_expand_strings(save_expand_nstring, save_expand_nlength);
3985
3986 while (isspace(*s)) s++;
3987 next_s = eval_condition(s, &resetok, skipping? NULL : &cond);
3988 if (next_s == NULL) goto EXPAND_FAILED; /* message already set */
3989
3990 DEBUG(D_expand)
3991 debug_printf("condition: %.*s\n result: %s\n", (int)(next_s - s), s,
3992 cond? "true" : "false");
3993
3994 s = next_s;
3995
3996 /* The handling of "yes" and "no" result strings is now in a separate
3997 function that is also used by ${lookup} and ${extract} and ${run}. */
3998
3999 switch(process_yesno(
4000 skipping, /* were previously skipping */
4001 cond, /* success/failure indicator */
4002 lookup_value, /* value to reset for string2 */
4003 &s, /* input pointer */
4004 &yield, /* output pointer */
4005 &size, /* output size */
4006 &ptr, /* output current point */
4007 US"if", /* condition type */
4008 &resetok))
4009 {
4010 case 1: goto EXPAND_FAILED; /* when all is well, the */
4011 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4012 }
4013
4014 /* Restore external setting of expansion variables for continuation
4015 at this level. */
4016
4017 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4018 save_expand_nlength);
4019 continue;
4020 }
4021
4022 /* Handle database lookups unless locked out. If "skipping" is TRUE, we are
4023 expanding an internal string that isn't actually going to be used. All we
4024 need to do is check the syntax, so don't do a lookup at all. Preserve the
4025 values of the numerical expansion variables in case they get changed by a
4026 partial lookup. If not, they retain their external settings. At the end
4027 of this "lookup" section, they get restored to their previous values. */
4028
4029 case EITEM_LOOKUP:
4030 {
4031 int stype, partial, affixlen, starflags;
4032 int expand_setup = 0;
4033 int nameptr = 0;
4034 uschar *key, *filename, *affix;
4035 uschar *save_lookup_value = lookup_value;
4036 int save_expand_nmax =
4037 save_expand_strings(save_expand_nstring, save_expand_nlength);
4038
4039 if ((expand_forbid & RDO_LOOKUP) != 0)
4040 {
4041 expand_string_message = US"lookup expansions are not permitted";
4042 goto EXPAND_FAILED;
4043 }
4044
4045 /* Get the key we are to look up for single-key+file style lookups.
4046 Otherwise set the key NULL pro-tem. */
4047
4048 while (isspace(*s)) s++;
4049 if (*s == '{') /*}*/
4050 {
4051 key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4052 if (key == NULL) goto EXPAND_FAILED; /*{*/
4053 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4054 while (isspace(*s)) s++;
4055 }
4056 else key = NULL;
4057
4058 /* Find out the type of database */
4059
4060 if (!isalpha(*s))
4061 {
4062 expand_string_message = US"missing lookup type";
4063 goto EXPAND_FAILED;
4064 }
4065
4066 /* The type is a string that may contain special characters of various
4067 kinds. Allow everything except space or { to appear; the actual content
4068 is checked by search_findtype_partial. */ /*}*/
4069
4070 while (*s != 0 && *s != '{' && !isspace(*s)) /*}*/
4071 {
4072 if (nameptr < sizeof(name) - 1) name[nameptr++] = *s;
4073 s++;
4074 }
4075 name[nameptr] = 0;
4076 while (isspace(*s)) s++;
4077
4078 /* Now check for the individual search type and any partial or default
4079 options. Only those types that are actually in the binary are valid. */
4080
4081 stype = search_findtype_partial(name, &partial, &affix, &affixlen,
4082 &starflags);
4083 if (stype < 0)
4084 {
4085 expand_string_message = search_error_message;
4086 goto EXPAND_FAILED;
4087 }
4088
4089 /* Check that a key was provided for those lookup types that need it,
4090 and was not supplied for those that use the query style. */
4091
4092 if (!mac_islookup(stype, lookup_querystyle|lookup_absfilequery))
4093 {
4094 if (key == NULL)
4095 {
4096 expand_string_message = string_sprintf("missing {key} for single-"
4097 "key \"%s\" lookup", name);
4098 goto EXPAND_FAILED;
4099 }
4100 }
4101 else
4102 {
4103 if (key != NULL)
4104 {
4105 expand_string_message = string_sprintf("a single key was given for "
4106 "lookup type \"%s\", which is not a single-key lookup type", name);
4107 goto EXPAND_FAILED;
4108 }
4109 }
4110
4111 /* Get the next string in brackets and expand it. It is the file name for
4112 single-key+file lookups, and the whole query otherwise. In the case of
4113 queries that also require a file name (e.g. sqlite), the file name comes
4114 first. */
4115
4116 if (*s != '{') goto EXPAND_FAILED_CURLY;
4117 filename = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4118 if (filename == NULL) goto EXPAND_FAILED;
4119 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4120 while (isspace(*s)) s++;
4121
4122 /* If this isn't a single-key+file lookup, re-arrange the variables
4123 to be appropriate for the search_ functions. For query-style lookups,
4124 there is just a "key", and no file name. For the special query-style +
4125 file types, the query (i.e. "key") starts with a file name. */
4126
4127 if (key == NULL)
4128 {
4129 while (isspace(*filename)) filename++;
4130 key = filename;
4131
4132 if (mac_islookup(stype, lookup_querystyle))
4133 {
4134 filename = NULL;
4135 }
4136 else
4137 {
4138 if (*filename != '/')
4139 {
4140 expand_string_message = string_sprintf(
4141 "absolute file name expected for \"%s\" lookup", name);
4142 goto EXPAND_FAILED;
4143 }
4144 while (*key != 0 && !isspace(*key)) key++;
4145 if (*key != 0) *key++ = 0;
4146 }
4147 }
4148
4149 /* If skipping, don't do the next bit - just lookup_value == NULL, as if
4150 the entry was not found. Note that there is no search_close() function.
4151 Files are left open in case of re-use. At suitable places in higher logic,
4152 search_tidyup() is called to tidy all open files. This can save opening
4153 the same file several times. However, files may also get closed when
4154 others are opened, if too many are open at once. The rule is that a
4155 handle should not be used after a second search_open().
4156
4157 Request that a partial search sets up $1 and maybe $2 by passing
4158 expand_setup containing zero. If its value changes, reset expand_nmax,
4159 since new variables will have been set. Note that at the end of this
4160 "lookup" section, the old numeric variables are restored. */
4161
4162 if (skipping)
4163 lookup_value = NULL;
4164 else
4165 {
4166 void *handle = search_open(filename, stype, 0, NULL, NULL);
4167 if (handle == NULL)
4168 {
4169 expand_string_message = search_error_message;
4170 goto EXPAND_FAILED;
4171 }
4172 lookup_value = search_find(handle, filename, key, partial, affix,
4173 affixlen, starflags, &expand_setup);
4174 if (search_find_defer)
4175 {
4176 expand_string_message =
4177 string_sprintf("lookup of \"%s\" gave DEFER: %s",
4178 string_printing2(key, FALSE), search_error_message);
4179 goto EXPAND_FAILED;
4180 }
4181 if (expand_setup > 0) expand_nmax = expand_setup;
4182 }
4183
4184 /* The handling of "yes" and "no" result strings is now in a separate
4185 function that is also used by ${if} and ${extract}. */
4186
4187 switch(process_yesno(
4188 skipping, /* were previously skipping */
4189 lookup_value != NULL, /* success/failure indicator */
4190 save_lookup_value, /* value to reset for string2 */
4191 &s, /* input pointer */
4192 &yield, /* output pointer */
4193 &size, /* output size */
4194 &ptr, /* output current point */
4195 US"lookup", /* condition type */
4196 &resetok))
4197 {
4198 case 1: goto EXPAND_FAILED; /* when all is well, the */
4199 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4200 }
4201
4202 /* Restore external setting of expansion variables for carrying on
4203 at this level, and continue. */
4204
4205 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4206 save_expand_nlength);
4207 continue;
4208 }
4209
4210 /* If Perl support is configured, handle calling embedded perl subroutines,
4211 unless locked out at this time. Syntax is ${perl{sub}} or ${perl{sub}{arg}}
4212 or ${perl{sub}{arg1}{arg2}} or up to a maximum of EXIM_PERL_MAX_ARGS
4213 arguments (defined below). */
4214
4215 #define EXIM_PERL_MAX_ARGS 8
4216
4217 case EITEM_PERL:
4218 #ifndef EXIM_PERL
4219 expand_string_message = US"\"${perl\" encountered, but this facility " /*}*/
4220 "is not included in this binary";
4221 goto EXPAND_FAILED;
4222
4223 #else /* EXIM_PERL */
4224 {
4225 uschar *sub_arg[EXIM_PERL_MAX_ARGS + 2];
4226 uschar *new_yield;
4227
4228 if ((expand_forbid & RDO_PERL) != 0)
4229 {
4230 expand_string_message = US"Perl calls are not permitted";
4231 goto EXPAND_FAILED;
4232 }
4233
4234 switch(read_subs(sub_arg, EXIM_PERL_MAX_ARGS + 1, 1, &s, skipping, TRUE,
4235 US"perl", &resetok))
4236 {
4237 case 1: goto EXPAND_FAILED_CURLY;
4238 case 2:
4239 case 3: goto EXPAND_FAILED;
4240 }
4241
4242 /* If skipping, we don't actually do anything */
4243
4244 if (skipping) continue;
4245
4246 /* Start the interpreter if necessary */
4247
4248 if (!opt_perl_started)
4249 {
4250 uschar *initerror;
4251 if (opt_perl_startup == NULL)
4252 {
4253 expand_string_message = US"A setting of perl_startup is needed when "
4254 "using the Perl interpreter";
4255 goto EXPAND_FAILED;
4256 }
4257 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4258 initerror = init_perl(opt_perl_startup);
4259 if (initerror != NULL)
4260 {
4261 expand_string_message =
4262 string_sprintf("error in perl_startup code: %s\n", initerror);
4263 goto EXPAND_FAILED;
4264 }
4265 opt_perl_started = TRUE;
4266 }
4267
4268 /* Call the function */
4269
4270 sub_arg[EXIM_PERL_MAX_ARGS + 1] = NULL;
4271 new_yield = call_perl_cat(yield, &size, &ptr, &expand_string_message,
4272 sub_arg[0], sub_arg + 1);
4273
4274 /* NULL yield indicates failure; if the message pointer has been set to
4275 NULL, the yield was undef, indicating a forced failure. Otherwise the
4276 message will indicate some kind of Perl error. */
4277
4278 if (new_yield == NULL)
4279 {
4280 if (expand_string_message == NULL)
4281 {
4282 expand_string_message =
4283 string_sprintf("Perl subroutine \"%s\" returned undef to force "
4284 "failure", sub_arg[0]);
4285 expand_string_forcedfail = TRUE;
4286 }
4287 goto EXPAND_FAILED;
4288 }
4289
4290 /* Yield succeeded. Ensure forcedfail is unset, just in case it got
4291 set during a callback from Perl. */
4292
4293 expand_string_forcedfail = FALSE;
4294 yield = new_yield;
4295 continue;
4296 }
4297 #endif /* EXIM_PERL */
4298
4299 /* Transform email address to "prvs" scheme to use
4300 as BATV-signed return path */
4301
4302 case EITEM_PRVS:
4303 {
4304 uschar *sub_arg[3];
4305 uschar *p,*domain;
4306
4307 switch(read_subs(sub_arg, 3, 2, &s, skipping, TRUE, US"prvs", &resetok))
4308 {
4309 case 1: goto EXPAND_FAILED_CURLY;
4310 case 2:
4311 case 3: goto EXPAND_FAILED;
4312 }
4313
4314 /* If skipping, we don't actually do anything */
4315 if (skipping) continue;
4316
4317 /* sub_arg[0] is the address */
4318 domain = Ustrrchr(sub_arg[0],'@');
4319 if ( (domain == NULL) || (domain == sub_arg[0]) || (Ustrlen(domain) == 1) )
4320 {
4321 expand_string_message = US"prvs first argument must be a qualified email address";
4322 goto EXPAND_FAILED;
4323 }
4324
4325 /* Calculate the hash. The second argument must be a single-digit
4326 key number, or unset. */
4327
4328 if (sub_arg[2] != NULL &&
4329 (!isdigit(sub_arg[2][0]) || sub_arg[2][1] != 0))
4330 {
4331 expand_string_message = US"prvs second argument must be a single digit";
4332 goto EXPAND_FAILED;
4333 }
4334
4335 p = prvs_hmac_sha1(sub_arg[0],sub_arg[1],sub_arg[2],prvs_daystamp(7));
4336 if (p == NULL)
4337 {
4338 expand_string_message = US"prvs hmac-sha1 conversion failed";
4339 goto EXPAND_FAILED;
4340 }
4341
4342 /* Now separate the domain from the local part */
4343 *domain++ = '\0';
4344
4345 yield = string_cat(yield,&size,&ptr,US"prvs=",5);
4346 string_cat(yield,&size,&ptr,(sub_arg[2] != NULL) ? sub_arg[2] : US"0", 1);
4347 string_cat(yield,&size,&ptr,prvs_daystamp(7),3);
4348 string_cat(yield,&size,&ptr,p,6);
4349 string_cat(yield,&size,&ptr,US"=",1);
4350 string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
4351 string_cat(yield,&size,&ptr,US"@",1);
4352 string_cat(yield,&size,&ptr,domain,Ustrlen(domain));
4353
4354 continue;
4355 }
4356
4357 /* Check a prvs-encoded address for validity */
4358
4359 case EITEM_PRVSCHECK:
4360 {
4361 uschar *sub_arg[3];
4362 int mysize = 0, myptr = 0;
4363 const pcre *re;
4364 uschar *p;
4365
4366 /* TF: Ugliness: We want to expand parameter 1 first, then set
4367 up expansion variables that are used in the expansion of
4368 parameter 2. So we clone the string for the first
4369 expansion, where we only expand parameter 1.
4370
4371 PH: Actually, that isn't necessary. The read_subs() function is
4372 designed to work this way for the ${if and ${lookup expansions. I've
4373 tidied the code.
4374 */
4375
4376 /* Reset expansion variables */
4377 prvscheck_result = NULL;
4378 prvscheck_address = NULL;
4379 prvscheck_keynum = NULL;
4380
4381 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4382 {
4383 case 1: goto EXPAND_FAILED_CURLY;
4384 case 2:
4385 case 3: goto EXPAND_FAILED;
4386 }
4387
4388 re = regex_must_compile(US"^prvs\\=([0-9])([0-9]{3})([A-F0-9]{6})\\=(.+)\\@(.+)$",
4389 TRUE,FALSE);
4390
4391 if (regex_match_and_setup(re,sub_arg[0],0,-1))
4392 {
4393 uschar *local_part = string_copyn(expand_nstring[4],expand_nlength[4]);
4394 uschar *key_num = string_copyn(expand_nstring[1],expand_nlength[1]);
4395 uschar *daystamp = string_copyn(expand_nstring[2],expand_nlength[2]);
4396 uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]);
4397 uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]);
4398
4399 DEBUG(D_expand) debug_printf("prvscheck localpart: %s\n", local_part);
4400 DEBUG(D_expand) debug_printf("prvscheck key number: %s\n", key_num);
4401 DEBUG(D_expand) debug_printf("prvscheck daystamp: %s\n", daystamp);
4402 DEBUG(D_expand) debug_printf("prvscheck hash: %s\n", hash);
4403 DEBUG(D_expand) debug_printf("prvscheck domain: %s\n", domain);
4404
4405 /* Set up expansion variables */
4406 prvscheck_address = string_cat(NULL, &mysize, &myptr, local_part, Ustrlen(local_part));
4407 string_cat(prvscheck_address,&mysize,&myptr,US"@",1);
4408 string_cat(prvscheck_address,&mysize,&myptr,domain,Ustrlen(domain));
4409 prvscheck_address[myptr] = '\0';
4410 prvscheck_keynum = string_copy(key_num);
4411
4412 /* Now expand the second argument */
4413 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4414 {
4415 case 1: goto EXPAND_FAILED_CURLY;
4416 case 2:
4417 case 3: goto EXPAND_FAILED;
4418 }
4419
4420 /* Now we have the key and can check the address. */
4421
4422 p = prvs_hmac_sha1(prvscheck_address, sub_arg[0], prvscheck_keynum,
4423 daystamp);
4424
4425 if (p == NULL)
4426 {
4427 expand_string_message = US"hmac-sha1 conversion failed";
4428 goto EXPAND_FAILED;
4429 }
4430
4431 DEBUG(D_expand) debug_printf("prvscheck: received hash is %s\n", hash);
4432 DEBUG(D_expand) debug_printf("prvscheck: own hash is %s\n", p);
4433
4434 if (Ustrcmp(p,hash) == 0)
4435 {
4436 /* Success, valid BATV address. Now check the expiry date. */
4437 uschar *now = prvs_daystamp(0);
4438 unsigned int inow = 0,iexpire = 1;
4439
4440 (void)sscanf(CS now,"%u",&inow);
4441 (void)sscanf(CS daystamp,"%u",&iexpire);
4442
4443 /* When "iexpire" is < 7, a "flip" has occured.
4444 Adjust "inow" accordingly. */
4445 if ( (iexpire < 7) && (inow >= 993) ) inow = 0;
4446
4447 if (iexpire >= inow)
4448 {
4449 prvscheck_result = US"1";
4450 DEBUG(D_expand) debug_printf("prvscheck: success, $pvrs_result set to 1\n");
4451 }
4452 else
4453 {
4454 prvscheck_result = NULL;
4455 DEBUG(D_expand) debug_printf("prvscheck: signature expired, $pvrs_result unset\n");
4456 }
4457 }
4458 else
4459 {
4460 prvscheck_result = NULL;
4461 DEBUG(D_expand) debug_printf("prvscheck: hash failure, $pvrs_result unset\n");
4462 }
4463
4464 /* Now expand the final argument. We leave this till now so that
4465 it can include $prvscheck_result. */
4466
4467 switch(read_subs(sub_arg, 1, 0, &s, skipping, TRUE, US"prvs", &resetok))
4468 {
4469 case 1: goto EXPAND_FAILED_CURLY;
4470 case 2:
4471 case 3: goto EXPAND_FAILED;
4472 }
4473
4474 if (sub_arg[0] == NULL || *sub_arg[0] == '\0')
4475 yield = string_cat(yield,&size,&ptr,prvscheck_address,Ustrlen(prvscheck_address));
4476 else
4477 yield = string_cat(yield,&size,&ptr,sub_arg[0],Ustrlen(sub_arg[0]));
4478
4479 /* Reset the "internal" variables afterwards, because they are in
4480 dynamic store that will be reclaimed if the expansion succeeded. */
4481
4482 prvscheck_address = NULL;
4483 prvscheck_keynum = NULL;
4484 }
4485 else
4486 {
4487 /* Does not look like a prvs encoded address, return the empty string.
4488 We need to make sure all subs are expanded first, so as to skip over
4489 the entire item. */
4490
4491 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"prvs", &resetok))
4492 {
4493 case 1: goto EXPAND_FAILED_CURLY;
4494 case 2:
4495 case 3: goto EXPAND_FAILED;
4496 }
4497 }
4498
4499 continue;
4500 }
4501
4502 /* Handle "readfile" to insert an entire file */
4503
4504 case EITEM_READFILE:
4505 {
4506 FILE *f;
4507 uschar *sub_arg[2];
4508
4509 if ((expand_forbid & RDO_READFILE) != 0)
4510 {
4511 expand_string_message = US"file insertions are not permitted";
4512 goto EXPAND_FAILED;
4513 }
4514
4515 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"readfile", &resetok))
4516 {
4517 case 1: goto EXPAND_FAILED_CURLY;
4518 case 2:
4519 case 3: goto EXPAND_FAILED;
4520 }
4521
4522 /* If skipping, we don't actually do anything */
4523
4524 if (skipping) continue;
4525
4526 /* Open the file and read it */
4527
4528 f = Ufopen(sub_arg[0], "rb");
4529 if (f == NULL)
4530 {
4531 expand_string_message = string_open_failed(errno, "%s", sub_arg[0]);
4532 goto EXPAND_FAILED;
4533 }
4534
4535 yield = cat_file(f, yield, &size, &ptr, sub_arg[1]);
4536 (void)fclose(f);
4537 continue;
4538 }
4539
4540 /* Handle "readsocket" to insert data from a Unix domain socket */
4541
4542 case EITEM_READSOCK:
4543 {
4544 int fd;
4545 int timeout = 5;
4546 int save_ptr = ptr;
4547 FILE *f;
4548 struct sockaddr_un sockun; /* don't call this "sun" ! */
4549 uschar *arg;
4550 uschar *sub_arg[4];
4551
4552 if ((expand_forbid & RDO_READSOCK) != 0)
4553 {
4554 expand_string_message = US"socket insertions are not permitted";
4555 goto EXPAND_FAILED;
4556 }
4557
4558 /* Read up to 4 arguments, but don't do the end of item check afterwards,
4559 because there may be a string for expansion on failure. */
4560
4561 switch(read_subs(sub_arg, 4, 2, &s, skipping, FALSE, US"readsocket", &resetok))
4562 {
4563 case 1: goto EXPAND_FAILED_CURLY;
4564 case 2: /* Won't occur: no end check */
4565 case 3: goto EXPAND_FAILED;
4566 }
4567
4568 /* Sort out timeout, if given */
4569
4570 if (sub_arg[2] != NULL)
4571 {
4572 timeout = readconf_readtime(sub_arg[2], 0, FALSE);
4573 if (timeout < 0)
4574 {
4575 expand_string_message = string_sprintf("bad time value %s",
4576 sub_arg[2]);
4577 goto EXPAND_FAILED;
4578 }
4579 }
4580 else sub_arg[3] = NULL; /* No eol if no timeout */
4581
4582 /* If skipping, we don't actually do anything. Otherwise, arrange to
4583 connect to either an IP or a Unix socket. */
4584
4585 if (!skipping)
4586 {
4587 /* Handle an IP (internet) domain */
4588
4589 if (Ustrncmp(sub_arg[0], "inet:", 5) == 0)
4590 {
4591 int port;
4592 uschar *server_name = sub_arg[0] + 5;
4593 uschar *port_name = Ustrrchr(server_name, ':');
4594
4595 /* Sort out the port */
4596
4597 if (port_name == NULL)
4598 {
4599 expand_string_message =
4600 string_sprintf("missing port for readsocket %s", sub_arg[0]);
4601 goto EXPAND_FAILED;
4602 }
4603 *port_name++ = 0; /* Terminate server name */
4604
4605 if (isdigit(*port_name))
4606 {
4607 uschar *end;
4608 port = Ustrtol(port_name, &end, 0);
4609 if (end != port_name + Ustrlen(port_name))
4610 {
4611 expand_string_message =
4612 string_sprintf("invalid port number %s", port_name);
4613 goto EXPAND_FAILED;
4614 }
4615 }
4616 else
4617 {
4618 struct servent *service_info = getservbyname(CS port_name, "tcp");
4619 if (service_info == NULL)
4620 {
4621 expand_string_message = string_sprintf("unknown port \"%s\"",
4622 port_name);
4623 goto EXPAND_FAILED;
4624 }
4625 port = ntohs(service_info->s_port);
4626 }
4627
4628 if ((fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
4629 timeout, NULL, &expand_string_message)) < 0)
4630 goto SOCK_FAIL;
4631 }
4632
4633 /* Handle a Unix domain socket */
4634
4635 else
4636 {
4637 int rc;
4638 if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
4639 {
4640 expand_string_message = string_sprintf("failed to create socket: %s",
4641 strerror(errno));
4642 goto SOCK_FAIL;
4643 }
4644
4645 sockun.sun_family = AF_UNIX;
4646 sprintf(sockun.sun_path, "%.*s", (int)(sizeof(sockun.sun_path)-1),
4647 sub_arg[0]);
4648
4649 sigalrm_seen = FALSE;
4650 alarm(timeout);
4651 rc = connect(fd, (struct sockaddr *)(&sockun), sizeof(sockun));
4652 alarm(0);
4653 if (sigalrm_seen)
4654 {
4655 expand_string_message = US "socket connect timed out";
4656 goto SOCK_FAIL;
4657 }
4658 if (rc < 0)
4659 {
4660 expand_string_message = string_sprintf("failed to connect to socket "
4661 "%s: %s", sub_arg[0], strerror(errno));
4662 goto SOCK_FAIL;
4663 }
4664 }
4665
4666 DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]);
4667
4668 /* Write the request string, if not empty */
4669
4670 if (sub_arg[1][0] != 0)
4671 {
4672 int len = Ustrlen(sub_arg[1]);
4673 DEBUG(D_expand) debug_printf("writing \"%s\" to socket\n",
4674 sub_arg[1]);
4675 if (write(fd, sub_arg[1], len) != len)
4676 {
4677 expand_string_message = string_sprintf("request write to socket "
4678 "failed: %s", strerror(errno));
4679 goto SOCK_FAIL;
4680 }
4681 }
4682
4683 /* Shut down the sending side of the socket. This helps some servers to
4684 recognise that it is their turn to do some work. Just in case some
4685 system doesn't have this function, make it conditional. */
4686
4687 #ifdef SHUT_WR
4688 shutdown(fd, SHUT_WR);
4689 #endif
4690
4691 /* Now we need to read from the socket, under a timeout. The function
4692 that reads a file can be used. */
4693
4694 f = fdopen(fd, "rb");
4695 sigalrm_seen = FALSE;
4696 alarm(timeout);
4697 yield = cat_file(f, yield, &size, &ptr, sub_arg[3]);
4698 alarm(0);
4699 (void)fclose(f);
4700
4701 /* After a timeout, we restore the pointer in the result, that is,
4702 make sure we add nothing from the socket. */
4703
4704 if (sigalrm_seen)
4705 {
4706 ptr = save_ptr;
4707 expand_string_message = US "socket read timed out";
4708 goto SOCK_FAIL;
4709 }
4710 }
4711
4712 /* The whole thing has worked (or we were skipping). If there is a
4713 failure string following, we need to skip it. */
4714
4715 if (*s == '{')
4716 {
4717 if (expand_string_internal(s+1, TRUE, &s, TRUE, TRUE, &resetok) == NULL)
4718 goto EXPAND_FAILED;
4719 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4720 while (isspace(*s)) s++;
4721 }
4722 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4723 continue;
4724
4725 /* Come here on failure to create socket, connect socket, write to the
4726 socket, or timeout on reading. If another substring follows, expand and
4727 use it. Otherwise, those conditions give expand errors. */
4728
4729 SOCK_FAIL:
4730 if (*s != '{') goto EXPAND_FAILED;
4731 DEBUG(D_any) debug_printf("%s\n", expand_string_message);
4732 arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok);
4733 if (arg == NULL) goto EXPAND_FAILED;
4734 yield = string_cat(yield, &size, &ptr, arg, Ustrlen(arg));
4735 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4736 while (isspace(*s)) s++;
4737 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4738 continue;
4739 }
4740
4741 /* Handle "run" to execute a program. */
4742
4743 case EITEM_RUN:
4744 {
4745 FILE *f;
4746 uschar *arg;
4747 uschar **argv;
4748 pid_t pid;
4749 int fd_in, fd_out;
4750 int lsize = 0;
4751 int lptr = 0;
4752
4753 if ((expand_forbid & RDO_RUN) != 0)
4754 {
4755 expand_string_message = US"running a command is not permitted";
4756 goto EXPAND_FAILED;
4757 }
4758
4759 while (isspace(*s)) s++;
4760 if (*s != '{') goto EXPAND_FAILED_CURLY;
4761 arg = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4762 if (arg == NULL) goto EXPAND_FAILED;
4763 while (isspace(*s)) s++;
4764 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
4765
4766 if (skipping) /* Just pretend it worked when we're skipping */
4767 {
4768 runrc = 0;
4769 }
4770 else
4771 {
4772 if (!transport_set_up_command(&argv, /* anchor for arg list */
4773 arg, /* raw command */
4774 FALSE, /* don't expand the arguments */
4775 0, /* not relevant when... */
4776 NULL, /* no transporting address */
4777 US"${run} expansion", /* for error messages */
4778 &expand_string_message)) /* where to put error message */
4779 {
4780 goto EXPAND_FAILED;
4781 }
4782
4783 /* Create the child process, making it a group leader. */
4784
4785 pid = child_open(argv, NULL, 0077, &fd_in, &fd_out, TRUE);
4786
4787 if (pid < 0)
4788 {
4789 expand_string_message =
4790 string_sprintf("couldn't create child process: %s", strerror(errno));
4791 goto EXPAND_FAILED;
4792 }
4793
4794 /* Nothing is written to the standard input. */
4795
4796 (void)close(fd_in);
4797
4798 /* Read the pipe to get the command's output into $value (which is kept
4799 in lookup_value). Read during execution, so that if the output exceeds
4800 the OS pipe buffer limit, we don't block forever. */
4801
4802 f = fdopen(fd_out, "rb");
4803 sigalrm_seen = FALSE;
4804 alarm(60);
4805 lookup_value = cat_file(f, lookup_value, &lsize, &lptr, NULL);
4806 alarm(0);
4807 (void)fclose(f);
4808
4809 /* Wait for the process to finish, applying the timeout, and inspect its
4810 return code for serious disasters. Simple non-zero returns are passed on.
4811 */
4812
4813 if (sigalrm_seen == TRUE || (runrc = child_close(pid, 30)) < 0)
4814 {
4815 if (sigalrm_seen == TRUE || runrc == -256)
4816 {
4817 expand_string_message = string_sprintf("command timed out");
4818 killpg(pid, SIGKILL); /* Kill the whole process group */
4819 }
4820
4821 else if (runrc == -257)
4822 expand_string_message = string_sprintf("wait() failed: %s",
4823 strerror(errno));
4824
4825 else
4826 expand_string_message = string_sprintf("command killed by signal %d",
4827 -runrc);
4828
4829 goto EXPAND_FAILED;
4830 }
4831 }
4832
4833 /* Process the yes/no strings; $value may be useful in both cases */
4834
4835 switch(process_yesno(
4836 skipping, /* were previously skipping */
4837 runrc == 0, /* success/failure indicator */
4838 lookup_value, /* value to reset for string2 */
4839 &s, /* input pointer */
4840 &yield, /* output pointer */
4841 &size, /* output size */
4842 &ptr, /* output current point */
4843 US"run", /* condition type */
4844 &resetok))
4845 {
4846 case 1: goto EXPAND_FAILED; /* when all is well, the */
4847 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4848 }
4849
4850 continue;
4851 }
4852
4853 /* Handle character translation for "tr" */
4854
4855 case EITEM_TR:
4856 {
4857 int oldptr = ptr;
4858 int o2m;
4859 uschar *sub[3];
4860
4861 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"tr", &resetok))
4862 {
4863 case 1: goto EXPAND_FAILED_CURLY;
4864 case 2:
4865 case 3: goto EXPAND_FAILED;
4866 }
4867
4868 yield = string_cat(yield, &size, &ptr, sub[0], Ustrlen(sub[0]));
4869 o2m = Ustrlen(sub[2]) - 1;
4870
4871 if (o2m >= 0) for (; oldptr < ptr; oldptr++)
4872 {
4873 uschar *m = Ustrrchr(sub[1], yield[oldptr]);
4874 if (m != NULL)
4875 {
4876 int o = m - sub[1];
4877 yield[oldptr] = sub[2][(o < o2m)? o : o2m];
4878 }
4879 }
4880
4881 continue;
4882 }
4883
4884 /* Handle "hash", "length", "nhash", and "substr" when they are given with
4885 expanded arguments. */
4886
4887 case EITEM_HASH:
4888 case EITEM_LENGTH:
4889 case EITEM_NHASH:
4890 case EITEM_SUBSTR:
4891 {
4892 int i;
4893 int len;
4894 uschar *ret;
4895 int val[2] = { 0, -1 };
4896 uschar *sub[3];
4897
4898 /* "length" takes only 2 arguments whereas the others take 2 or 3.
4899 Ensure that sub[2] is set in the ${length } case. */
4900
4901 sub[2] = NULL;
4902 switch(read_subs(sub, (item_type == EITEM_LENGTH)? 2:3, 2, &s, skipping,
4903 TRUE, name, &resetok))
4904 {
4905 case 1: goto EXPAND_FAILED_CURLY;
4906 case 2:
4907 case 3: goto EXPAND_FAILED;
4908 }
4909
4910 /* Juggle the arguments if there are only two of them: always move the
4911 string to the last position and make ${length{n}{str}} equivalent to
4912 ${substr{0}{n}{str}}. See the defaults for val[] above. */
4913
4914 if (sub[2] == NULL)
4915 {
4916 sub[2] = sub[1];
4917 sub[1] = NULL;
4918 if (item_type == EITEM_LENGTH)
4919 {
4920 sub[1] = sub[0];
4921 sub[0] = NULL;
4922 }
4923 }
4924
4925 for (i = 0; i < 2; i++)
4926 {
4927 if (sub[i] == NULL) continue;
4928 val[i] = (int)Ustrtol(sub[i], &ret, 10);
4929 if (*ret != 0 || (i != 0 && val[i] < 0))
4930 {
4931 expand_string_message = string_sprintf("\"%s\" is not a%s number "
4932 "(in \"%s\" expansion)", sub[i], (i != 0)? " positive" : "", name);
4933 goto EXPAND_FAILED;
4934 }
4935 }
4936
4937 ret =
4938 (item_type == EITEM_HASH)?
4939 compute_hash(sub[2], val[0], val[1], &len) :
4940 (item_type == EITEM_NHASH)?
4941 compute_nhash(sub[2], val[0], val[1], &len) :
4942 extract_substr(sub[2], val[0], val[1], &len);
4943
4944 if (ret == NULL) goto EXPAND_FAILED;
4945 yield = string_cat(yield, &size, &ptr, ret, len);
4946 continue;
4947 }
4948
4949 /* Handle HMAC computation: ${hmac{<algorithm>}{<secret>}{<text>}}
4950 This code originally contributed by Steve Haslam. It currently supports
4951 the use of MD5 and SHA-1 hashes.
4952
4953 We need some workspace that is large enough to handle all the supported
4954 hash types. Use macros to set the sizes rather than be too elaborate. */
4955
4956 #define MAX_HASHLEN 20
4957 #define MAX_HASHBLOCKLEN 64
4958
4959 case EITEM_HMAC:
4960 {
4961 uschar *sub[3];
4962 md5 md5_base;
4963 sha1 sha1_base;
4964 void *use_base;
4965 int type, i;
4966 int hashlen; /* Number of octets for the hash algorithm's output */
4967 int hashblocklen; /* Number of octets the hash algorithm processes */
4968 uschar *keyptr, *p;
4969 unsigned int keylen;
4970
4971 uschar keyhash[MAX_HASHLEN];
4972 uschar innerhash[MAX_HASHLEN];
4973 uschar finalhash[MAX_HASHLEN];
4974 uschar finalhash_hex[2*MAX_HASHLEN];
4975 uschar innerkey[MAX_HASHBLOCKLEN];
4976 uschar outerkey[MAX_HASHBLOCKLEN];
4977
4978 switch (read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
4979 {
4980 case 1: goto EXPAND_FAILED_CURLY;
4981 case 2:
4982 case 3: goto EXPAND_FAILED;
4983 }
4984
4985 if (Ustrcmp(sub[0], "md5") == 0)
4986 {
4987 type = HMAC_MD5;
4988 use_base = &md5_base;
4989 hashlen = 16;
4990 hashblocklen = 64;
4991 }
4992 else if (Ustrcmp(sub[0], "sha1") == 0)
4993 {
4994 type = HMAC_SHA1;
4995 use_base = &sha1_base;
4996 hashlen = 20;
4997 hashblocklen = 64;
4998 }
4999 else
5000 {
5001 expand_string_message =
5002 string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
5003 goto EXPAND_FAILED;
5004 }
5005
5006 keyptr = sub[1];
5007 keylen = Ustrlen(keyptr);
5008
5009 /* If the key is longer than the hash block length, then hash the key
5010 first */
5011
5012 if (keylen > hashblocklen)
5013 {
5014 chash_start(type, use_base);
5015 chash_end(type, use_base, keyptr, keylen, keyhash);
5016 keyptr = keyhash;
5017 keylen = hashlen;
5018 }
5019
5020 /* Now make the inner and outer key values */
5021
5022 memset(innerkey, 0x36, hashblocklen);
5023 memset(outerkey, 0x5c, hashblocklen);
5024
5025 for (i = 0; i < keylen; i++)
5026 {
5027 innerkey[i] ^= keyptr[i];
5028 outerkey[i] ^= keyptr[i];
5029 }
5030
5031 /* Now do the hashes */
5032
5033 chash_start(type, use_base);
5034 chash_mid(type, use_base, innerkey);
5035 chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
5036
5037 chash_start(type, use_base);
5038 chash_mid(type, use_base, outerkey);
5039 chash_end(type, use_base, innerhash, hashlen, finalhash);
5040
5041 /* Encode the final hash as a hex string */
5042
5043 p = finalhash_hex;
5044 for (i = 0; i < hashlen; i++)
5045 {
5046 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
5047 *p++ = hex_digits[finalhash[i] & 0x0f];
5048 }
5049
5050 DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%.*s)=%.*s\n", sub[0],
5051 (int)keylen, keyptr, Ustrlen(sub[2]), sub[2], hashlen*2, finalhash_hex);
5052
5053 yield = string_cat(yield, &size, &ptr, finalhash_hex, hashlen*2);
5054 }
5055
5056 continue;
5057
5058 /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
5059 We have to save the numerical variables and restore them afterwards. */
5060
5061 case EITEM_SG:
5062 {
5063 const pcre *re;
5064 int moffset, moffsetextra, slen;
5065 int roffset;
5066 int emptyopt;
5067 const uschar *rerror;
5068 uschar *subject;
5069 uschar *sub[3];
5070 int save_expand_nmax =
5071 save_expand_strings(save_expand_nstring, save_expand_nlength);
5072
5073 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"sg", &resetok))
5074 {
5075 case 1: goto EXPAND_FAILED_CURLY;
5076 case 2:
5077 case 3: goto EXPAND_FAILED;
5078 }
5079
5080 /* Compile the regular expression */
5081
5082 re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
5083 NULL);
5084
5085 if (re == NULL)
5086 {
5087 expand_string_message = string_sprintf("regular expression error in "
5088 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
5089 goto EXPAND_FAILED;
5090 }
5091
5092 /* Now run a loop to do the substitutions as often as necessary. It ends
5093 when there are no more matches. Take care over matches of the null string;
5094 do the same thing as Perl does. */
5095
5096 subject = sub[0];
5097 slen = Ustrlen(sub[0]);
5098 moffset = moffsetextra = 0;
5099 emptyopt = 0;
5100
5101 for (;;)
5102 {
5103 int ovector[3*(EXPAND_MAXN+1)];
5104 int n = pcre_exec(re, NULL, CS subject, slen, moffset + moffsetextra,
5105 PCRE_EOPT | emptyopt, ovector, sizeof(ovector)/sizeof(int));
5106 int nn;
5107 uschar *insert;
5108
5109 /* No match - if we previously set PCRE_NOTEMPTY after a null match, this
5110 is not necessarily the end. We want to repeat the match from one
5111 character further along, but leaving the basic offset the same (for
5112 copying below). We can't be at the end of the string - that was checked
5113 before setting PCRE_NOTEMPTY. If PCRE_NOTEMPTY is not set, we are
5114 finished; copy the remaining string and end the loop. */
5115
5116 if (n < 0)
5117 {
5118 if (emptyopt != 0)
5119 {
5120 moffsetextra = 1;
5121 emptyopt = 0;
5122 continue;
5123 }
5124 yield = string_cat(yield, &size, &ptr, subject+moffset, slen-moffset);
5125 break;
5126 }
5127
5128 /* Match - set up for expanding the replacement. */
5129
5130 if (n == 0) n = EXPAND_MAXN + 1;
5131 expand_nmax = 0;
5132 for (nn = 0; nn < n*2; nn += 2)
5133 {
5134 expand_nstring[expand_nmax] = subject + ovector[nn];
5135 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
5136 }
5137 expand_nmax--;
5138
5139 /* Copy the characters before the match, plus the expanded insertion. */
5140
5141 yield = string_cat(yield, &size, &ptr, subject + moffset,
5142 ovector[0] - moffset);
5143 insert = expand_string(sub[2]);
5144 if (insert == NULL) goto EXPAND_FAILED;
5145 yield = string_cat(yield, &size, &ptr, insert, Ustrlen(insert));
5146
5147 moffset = ovector[1];
5148 moffsetextra = 0;
5149 emptyopt = 0;
5150
5151 /* If we have matched an empty string, first check to see if we are at
5152 the end of the subject. If so, the loop is over. Otherwise, mimic
5153 what Perl's /g options does. This turns out to be rather cunning. First
5154 we set PCRE_NOTEMPTY and PCRE_ANCHORED and try the match a non-empty
5155 string at the same point. If this fails (picked up above) we advance to
5156 the next character. */
5157
5158 if (ovector[0] == ovector[1])
5159 {
5160 if (ovector[0] == slen) break;
5161 emptyopt = PCRE_NOTEMPTY | PCRE_ANCHORED;
5162 }
5163 }
5164
5165 /* All done - restore numerical variables. */
5166
5167 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5168 save_expand_nlength);
5169 continue;
5170 }
5171
5172 /* Handle keyed and numbered substring extraction. If the first argument
5173 consists entirely of digits, then a numerical extraction is assumed. */
5174
5175 case EITEM_EXTRACT:
5176 {
5177 int i;
5178 int j = 2;
5179 int field_number = 1;
5180 BOOL field_number_set = FALSE;
5181 uschar *save_lookup_value = lookup_value;
5182 uschar *sub[3];
5183 int save_expand_nmax =
5184 save_expand_strings(save_expand_nstring, save_expand_nlength);
5185
5186 /* Read the arguments */
5187
5188 for (i = 0; i < j; i++)
5189 {
5190 while (isspace(*s)) s++;
5191 if (*s == '{') /*}*/
5192 {
5193 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5194 if (sub[i] == NULL) goto EXPAND_FAILED; /*{*/
5195 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5196
5197 /* After removal of leading and trailing white space, the first
5198 argument must not be empty; if it consists entirely of digits
5199 (optionally preceded by a minus sign), this is a numerical
5200 extraction, and we expect 3 arguments. */
5201
5202 if (i == 0)
5203 {
5204 int len;
5205 int x = 0;
5206 uschar *p = sub[0];
5207
5208 while (isspace(*p)) p++;
5209 sub[0] = p;
5210
5211 len = Ustrlen(p);
5212 while (len > 0 && isspace(p[len-1])) len--;
5213 p[len] = 0;
5214
5215 if (*p == 0 && !skipping)
5216 {
5217 expand_string_message = US"first argument of \"extract\" must "
5218 "not be empty";
5219 goto EXPAND_FAILED;
5220 }
5221
5222 if (*p == '-')
5223 {
5224 field_number = -1;
5225 p++;
5226 }
5227 while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
5228 if (*p == 0)
5229 {
5230 field_number *= x;
5231 j = 3; /* Need 3 args */
5232 field_number_set = TRUE;
5233 }
5234 }
5235 }
5236 else goto EXPAND_FAILED_CURLY;
5237 }
5238
5239 /* Extract either the numbered or the keyed substring into $value. If
5240 skipping, just pretend the extraction failed. */
5241
5242 lookup_value = skipping? NULL : field_number_set?
5243 expand_gettokened(field_number, sub[1], sub[2]) :
5244 expand_getkeyed(sub[0], sub[1]);
5245
5246 /* If no string follows, $value gets substituted; otherwise there can
5247 be yes/no strings, as for lookup or if. */
5248
5249 switch(process_yesno(
5250 skipping, /* were previously skipping */
5251 lookup_value != NULL, /* success/failure indicator */
5252 save_lookup_value, /* value to reset for string2 */
5253 &s, /* input pointer */
5254 &yield, /* output pointer */
5255 &size, /* output size */
5256 &ptr, /* output current point */
5257 US"extract", /* condition type */
5258 &resetok))
5259 {
5260 case 1: goto EXPAND_FAILED; /* when all is well, the */
5261 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5262 }
5263
5264 /* All done - restore numerical variables. */
5265
5266 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5267 save_expand_nlength);
5268
5269 continue;
5270 }
5271
5272 /* return the Nth item from a list */
5273
5274 case EITEM_LISTEXTRACT:
5275 {
5276 int i;
5277 int field_number = 1;
5278 uschar *save_lookup_value = lookup_value;
5279 uschar *sub[2];
5280 int save_expand_nmax =
5281 save_expand_strings(save_expand_nstring, save_expand_nlength);
5282
5283 /* Read the field & list arguments */
5284
5285 for (i = 0; i < 2; i++)
5286 {
5287 while (isspace(*s)) s++;
5288 if (*s != '{') /*}*/
5289 goto EXPAND_FAILED_CURLY;
5290
5291 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5292 if (!sub[i]) goto EXPAND_FAILED; /*{*/
5293 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5294
5295 /* After removal of leading and trailing white space, the first
5296 argument must be numeric and nonempty. */
5297
5298 if (i == 0)
5299 {
5300 int len;
5301 int x = 0;
5302 uschar *p = sub[0];
5303
5304 while (isspace(*p)) p++;
5305 sub[0] = p;
5306
5307 len = Ustrlen(p);
5308 while (len > 0 && isspace(p[len-1])) len--;
5309 p[len] = 0;
5310
5311 if (!*p && !skipping)
5312 {
5313 expand_string_message = US"first argument of \"listextract\" must "
5314 "not be empty";
5315 goto EXPAND_FAILED;
5316 }
5317
5318 if (*p == '-')
5319 {
5320 field_number = -1;
5321 p++;
5322 }
5323 while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
5324 if (*p)
5325 {
5326 expand_string_message = US"first argument of \"listextract\" must "
5327 "be numeric";
5328 goto EXPAND_FAILED;
5329 }
5330 field_number *= x;
5331 }
5332 }
5333
5334 /* Extract the numbered element into $value. If
5335 skipping, just pretend the extraction failed. */
5336
5337 lookup_value = skipping? NULL : expand_getlistele(field_number, sub[1]);
5338
5339 /* If no string follows, $value gets substituted; otherwise there can
5340 be yes/no strings, as for lookup or if. */
5341
5342 switch(process_yesno(
5343 skipping, /* were previously skipping */
5344 lookup_value != NULL, /* success/failure indicator */
5345 save_lookup_value, /* value to reset for string2 */
5346 &s, /* input pointer */
5347 &yield, /* output pointer */
5348 &size, /* output size */
5349 &ptr, /* output current point */
5350 US"extract", /* condition type */
5351 &resetok))
5352 {
5353 case 1: goto EXPAND_FAILED; /* when all is well, the */
5354 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5355 }
5356
5357 /* All done - restore numerical variables. */
5358
5359 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5360 save_expand_nlength);
5361
5362 continue;
5363 }
5364
5365 #ifdef SUPPORT_TLS
5366 case EITEM_CERTEXTRACT:
5367 {
5368 int i;
5369 int field_number = 1;
5370 uschar *save_lookup_value = lookup_value;
5371 uschar *sub[2];
5372 int save_expand_nmax =
5373 save_expand_strings(save_expand_nstring, save_expand_nlength);
5374
5375 /* Read the field argument */
5376 while (isspace(*s)) s++;
5377 if (*s != '{') /*}*/
5378 goto EXPAND_FAILED_CURLY;
5379 sub[0] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5380 if (!sub[0]) goto EXPAND_FAILED; /*{*/
5381 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5382 /* strip spaces fore & aft */
5383 {
5384 int len;
5385 int x = 0;
5386 uschar *p = sub[0];
5387
5388 while (isspace(*p)) p++;
5389 sub[0] = p;
5390
5391 len = Ustrlen(p);
5392 while (len > 0 && isspace(p[len-1])) len--;
5393 p[len] = 0;
5394 }
5395
5396 /* inspect the cert argument */
5397 while (isspace(*s)) s++;
5398 if (*s != '{') /*}*/
5399 goto EXPAND_FAILED_CURLY;
5400 if (*++s != '$')
5401 {
5402 expand_string_message = US"second argument of \"certextract\" must "
5403 "be a certificate variable";
5404 goto EXPAND_FAILED;
5405 }
5406 sub[1] = expand_string_internal(s+1, TRUE, &s, skipping, FALSE, &resetok);
5407 if (!sub[1]) goto EXPAND_FAILED; /*{*/
5408 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5409
5410 if (skipping)
5411 lookup_value = NULL;
5412 else
5413 {
5414 lookup_value = expand_getcertele(sub[0], sub[1]);
5415 if (*expand_string_message) goto EXPAND_FAILED;
5416 }
5417 switch(process_yesno(
5418 skipping, /* were previously skipping */
5419 lookup_value != NULL, /* success/failure indicator */
5420 save_lookup_value, /* value to reset for string2 */
5421 &s, /* input pointer */
5422 &yield, /* output pointer */
5423 &size, /* output size */
5424 &ptr, /* output current point */
5425 US"extract", /* condition type */
5426 &resetok))
5427 {
5428 case 1: goto EXPAND_FAILED; /* when all is well, the */
5429 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5430 }
5431
5432 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5433 save_expand_nlength);
5434 continue;
5435 }
5436 #endif /*SUPPORT_TLS*/
5437
5438 /* Handle list operations */
5439
5440 case EITEM_FILTER:
5441 case EITEM_MAP:
5442 case EITEM_REDUCE:
5443 {
5444 int sep = 0;
5445 int save_ptr = ptr;
5446 uschar outsep[2] = { '\0', '\0' };
5447 uschar *list, *expr, *temp;
5448 uschar *save_iterate_item = iterate_item;
5449 uschar *save_lookup_value = lookup_value;
5450
5451 while (isspace(*s)) s++;
5452 if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5453
5454 list = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5455 if (list == NULL) goto EXPAND_FAILED;
5456 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5457
5458 if (item_type == EITEM_REDUCE)
5459 {
5460 while (isspace(*s)) s++;
5461 if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5462 temp = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5463 if (temp == NULL) goto EXPAND_FAILED;
5464 lookup_value = temp;
5465 if (*s++ != '}') goto EXPAND_FAILED_CURLY;
5466 }
5467
5468 while (isspace(*s)) s++;
5469 if (*s++ != '{') goto EXPAND_FAILED_CURLY;
5470
5471 expr = s;
5472
5473 /* For EITEM_FILTER, call eval_condition once, with result discarded (as
5474 if scanning a "false" part). This allows us to find the end of the
5475 condition, because if the list is empty, we won't actually evaluate the
5476 condition for real. For EITEM_MAP and EITEM_REDUCE, do the same, using
5477 the normal internal expansion function. */
5478
5479 if (item_type == EITEM_FILTER)
5480 {
5481 temp = eval_condition(expr, &resetok, NULL);
5482 if (temp != NULL) s = temp;
5483 }
5484 else
5485 {
5486 temp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
5487 }
5488
5489 if (temp == NULL)
5490 {
5491 expand_string_message = string_sprintf("%s inside \"%s\" item",
5492 expand_string_message, name);
5493 goto EXPAND_FAILED;
5494 }
5495
5496 while (isspace(*s)) s++;
5497 if (*s++ != '}')
5498 { /*{*/
5499 expand_string_message = string_sprintf("missing } at end of condition "
5500 "or expression inside \"%s\"", name);
5501 goto EXPAND_FAILED;
5502 }
5503
5504 while (isspace(*s)) s++; /*{*/
5505 if (*s++ != '}')
5506 { /*{*/
5507 expand_string_message = string_sprintf("missing } at end of \"%s\"",
5508 name);
5509 goto EXPAND_FAILED;
5510 }
5511
5512 /* If we are skipping, we can now just move on to the next item. When
5513 processing for real, we perform the iteration. */
5514
5515 if (skipping) continue;
5516 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL)
5517 {
5518 *outsep = (uschar)sep; /* Separator as a string */
5519
5520 DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
5521
5522 if (item_type == EITEM_FILTER)
5523 {
5524 BOOL condresult;
5525 if (eval_condition(expr, &resetok, &condresult) == NULL)
5526 {
5527 iterate_item = save_iterate_item;
5528 lookup_value = save_lookup_value;
5529 expand_string_message = string_sprintf("%s inside \"%s\" condition",
5530 expand_string_message, name);
5531 goto EXPAND_FAILED;
5532 }
5533 DEBUG(D_expand) debug_printf("%s: condition is %s\n", name,
5534 condresult? "true":"false");
5535 if (condresult)
5536 temp = iterate_item; /* TRUE => include this item */
5537 else
5538 continue; /* FALSE => skip this item */
5539 }
5540
5541 /* EITEM_MAP and EITEM_REDUCE */
5542
5543 else
5544 {
5545 temp = expand_string_internal(expr, TRUE, NULL, skipping, TRUE, &resetok);
5546 if (temp == NULL)
5547 {
5548 iterate_item = save_iterate_item;
5549 expand_string_message = string_sprintf("%s inside \"%s\" item",
5550 expand_string_message, name);
5551 goto EXPAND_FAILED;
5552 }
5553 if (item_type == EITEM_REDUCE)
5554 {
5555 lookup_value = temp; /* Update the value of $value */
5556 continue; /* and continue the iteration */
5557 }
5558 }
5559
5560 /* We reach here for FILTER if the condition is true, always for MAP,
5561 and never for REDUCE. The value in "temp" is to be added to the output
5562 list that is being created, ensuring that any occurrences of the
5563 separator character are doubled. Unless we are dealing with the first
5564 item of the output list, add in a space if the new item begins with the
5565 separator character, or is an empty string. */
5566
5567 if (ptr != save_ptr && (temp[0] == *outsep || temp[0] == 0))
5568 yield = string_cat(yield, &size, &ptr, US" ", 1);
5569
5570 /* Add the string in "temp" to the output list that we are building,
5571 This is done in chunks by searching for the separator character. */
5572
5573 for (;;)
5574 {
5575 size_t seglen = Ustrcspn(temp, outsep);
5576 yield = string_cat(yield, &size, &ptr, temp, seglen + 1);
5577
5578 /* If we got to the end of the string we output one character
5579 too many; backup and end the loop. Otherwise arrange to double the
5580 separator. */
5581
5582 if (temp[seglen] == '\0') { ptr--; break; }
5583 yield = string_cat(yield, &size, &ptr, outsep, 1);
5584 temp += seglen + 1;
5585 }
5586
5587 /* Output a separator after the string: we will remove the redundant
5588 final one at the end. */
5589
5590 yield = string_cat(yield, &size, &ptr, outsep, 1);
5591 } /* End of iteration over the list loop */
5592
5593 /* REDUCE has generated no output above: output the final value of
5594 $value. */
5595
5596 if (item_type == EITEM_REDUCE)
5597 {
5598 yield = string_cat(yield, &size, &ptr, lookup_value,
5599 Ustrlen(lookup_value));
5600 lookup_value = save_lookup_value; /* Restore $value */
5601 }
5602
5603 /* FILTER and MAP generate lists: if they have generated anything, remove
5604 the redundant final separator. Even though an empty item at the end of a
5605 list does not count, this is tidier. */
5606
5607 else if (ptr != save_ptr) ptr--;
5608
5609 /* Restore preserved $item */
5610
5611 iterate_item = save_iterate_item;
5612 continue;
5613 }
5614
5615
5616 /* If ${dlfunc } support is configured, handle calling dynamically-loaded
5617 functions, unless locked out at this time. Syntax is ${dlfunc{file}{func}}
5618 or ${dlfunc{file}{func}{arg}} or ${dlfunc{file}{func}{arg1}{arg2}} or up to
5619 a maximum of EXPAND_DLFUNC_MAX_ARGS arguments (defined below). */
5620
5621 #define EXPAND_DLFUNC_MAX_ARGS 8
5622
5623 case EITEM_DLFUNC:
5624 #ifndef EXPAND_DLFUNC
5625 expand_string_message = US"\"${dlfunc\" encountered, but this facility " /*}*/
5626 "is not included in this binary";
5627 goto EXPAND_FAILED;
5628
5629 #else /* EXPAND_DLFUNC */
5630 {
5631 tree_node *t;
5632 exim_dlfunc_t *func;
5633 uschar *result;
5634 int status, argc;
5635 uschar *argv[EXPAND_DLFUNC_MAX_ARGS + 3];
5636
5637 if ((expand_forbid & RDO_DLFUNC) != 0)
5638 {
5639 expand_string_message =
5640 US"dynamically-loaded functions are not permitted";
5641 goto EXPAND_FAILED;
5642 }
5643
5644 switch(read_subs(argv, EXPAND_DLFUNC_MAX_ARGS + 2, 2, &s, skipping,
5645 TRUE, US"dlfunc", &resetok))
5646 {
5647 case 1: goto EXPAND_FAILED_CURLY;
5648 case 2:
5649 case 3: goto EXPAND_FAILED;
5650 }
5651
5652 /* If skipping, we don't actually do anything */
5653
5654 if (skipping) continue;
5655
5656 /* Look up the dynamically loaded object handle in the tree. If it isn't
5657 found, dlopen() the file and put the handle in the tree for next time. */
5658
5659 t = tree_search(dlobj_anchor, argv[0]);
5660 if (t == NULL)
5661 {
5662 void *handle = dlopen(CS argv[0], RTLD_LAZY);
5663 if (handle == NULL)
5664 {
5665 expand_string_message = string_sprintf("dlopen \"%s\" failed: %s",
5666 argv[0], dlerror());
5667 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
5668 goto EXPAND_FAILED;
5669 }
5670 t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]));
5671 Ustrcpy(t->name, argv[0]);
5672 t->data.ptr = handle;
5673 (void)tree_insertnode(&dlobj_anchor, t);
5674 }
5675
5676 /* Having obtained the dynamically loaded object handle, look up the
5677 function pointer. */
5678
5679 func = (exim_dlfunc_t *)dlsym(t->data.ptr, CS argv[1]);
5680 if (func == NULL)
5681 {
5682 expand_string_message = string_sprintf("dlsym \"%s\" in \"%s\" failed: "
5683 "%s", argv[1], argv[0], dlerror());
5684 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
5685 goto EXPAND_FAILED;
5686 }
5687
5688 /* Call the function and work out what to do with the result. If it
5689 returns OK, we have a replacement string; if it returns DEFER then
5690 expansion has failed in a non-forced manner; if it returns FAIL then
5691 failure was forced; if it returns ERROR or any other value there's a
5692 problem, so panic slightly. In any case, assume that the function has
5693 side-effects on the store that must be preserved. */
5694
5695 resetok = FALSE;
5696 result = NULL;
5697 for (argc = 0; argv[argc] != NULL; argc++);
5698 status = func(&result, argc - 2, &argv[2]);
5699 if(status == OK)
5700 {
5701 if (result == NULL) result = US"";
5702 yield = string_cat(yield, &size, &ptr, result, Ustrlen(result));
5703 continue;
5704 }
5705 else
5706 {
5707 expand_string_message = result == NULL ? US"(no message)" : result;
5708 if(status == FAIL_FORCED) expand_string_forcedfail = TRUE;
5709 else if(status != FAIL)
5710 log_write(0, LOG_MAIN|LOG_PANIC, "dlfunc{%s}{%s} failed (%d): %s",
5711 argv[0], argv[1], status, expand_string_message);
5712 goto EXPAND_FAILED;
5713 }
5714 }
5715 #endif /* EXPAND_DLFUNC */
5716 } /* EITEM_* switch */
5717
5718 /* Control reaches here if the name is not recognized as one of the more
5719 complicated expansion items. Check for the "operator" syntax (name terminated
5720 by a colon). Some of the operators have arguments, separated by _ from the
5721 name. */
5722
5723 if (*s == ':')
5724 {
5725 int c;
5726 uschar *arg = NULL;
5727 uschar *sub;
5728 var_entry *vp;
5729
5730 /* Owing to an historical mis-design, an underscore may be part of the
5731 operator name, or it may introduce arguments. We therefore first scan the
5732 table of names that contain underscores. If there is no match, we cut off
5733 the arguments and then scan the main table. */
5734
5735 if ((c = chop_match(name, op_table_underscore,
5736 sizeof(op_table_underscore)/sizeof(uschar *))) < 0)
5737 {
5738 arg = Ustrchr(name, '_');
5739 if (arg != NULL) *arg = 0;
5740 c = chop_match(name, op_table_main,
5741 sizeof(op_table_main)/sizeof(uschar *));
5742 if (c >= 0) c += sizeof(op_table_underscore)/sizeof(uschar *);
5743 if (arg != NULL) *arg++ = '_'; /* Put back for error messages */
5744 }
5745
5746 /* Deal specially with operators that might take a certificate variable
5747 as we do not want to do the usual expansion. For most, expand the string.*/
5748 switch(c)
5749 {
5750 #ifdef SUPPORT_TLS
5751 case EOP_SHA1:
5752 case EOP_MD5:
5753 if (s[1] == '$')
5754 {
5755 uschar * s1 = s;
5756 sub = expand_string_internal(s+2, TRUE, &s1, skipping,
5757 FALSE, &resetok);
5758 if (!sub) goto EXPAND_FAILED; /*{*/
5759 if (*s1 != '}') goto EXPAND_FAILED_CURLY;
5760 if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
5761 {
5762 s = s1+1;
5763 break;
5764 }
5765 }
5766 vp = NULL;
5767 /*FALLTHROUGH*/
5768 #endif
5769 default:
5770 sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5771 if (!sub) goto EXPAND_FAILED;
5772 s++;
5773 break;
5774 }
5775
5776 /* If we are skipping, we don't need to perform the operation at all.
5777 This matters for operations like "mask", because the data may not be
5778 in the correct format when skipping. For example, the expression may test
5779 for the existence of $sender_host_address before trying to mask it. For
5780 other operations, doing them may not fail, but it is a waste of time. */
5781
5782 if (skipping && c >= 0) continue;
5783
5784 /* Otherwise, switch on the operator type */
5785
5786 switch(c)
5787 {
5788 case EOP_BASE62:
5789 {
5790 uschar *t;
5791 unsigned long int n = Ustrtoul(sub, &t, 10);
5792 if (*t != 0)
5793 {
5794 expand_string_message = string_sprintf("argument for base62 "
5795 "operator is \"%s\", which is not a decimal number", sub);
5796 goto EXPAND_FAILED;
5797 }
5798 t = string_base62(n);
5799 yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
5800 continue;
5801 }
5802
5803 /* Note that for Darwin and Cygwin, BASE_62 actually has the value 36 */
5804
5805 case EOP_BASE62D:
5806 {
5807 uschar buf[16];
5808 uschar *tt = sub;
5809 unsigned long int n = 0;
5810 while (*tt != 0)
5811 {
5812 uschar *t = Ustrchr(base62_chars, *tt++);
5813 if (t == NULL)
5814 {
5815 expand_string_message = string_sprintf("argument for base62d "
5816 "operator is \"%s\", which is not a base %d number", sub,
5817 BASE_62);
5818 goto EXPAND_FAILED;
5819 }
5820 n = n * BASE_62 + (t - base62_chars);
5821 }
5822 (void)sprintf(CS buf, "%ld", n);
5823 yield = string_cat(yield, &size, &ptr, buf, Ustrlen(buf));
5824 continue;
5825 }
5826
5827 case EOP_EXPAND:
5828 {
5829 uschar *expanded = expand_string_internal(sub, FALSE, NULL, skipping, TRUE, &resetok);
5830 if (expanded == NULL)
5831 {
5832 expand_string_message =
5833 string_sprintf("internal expansion of \"%s\" failed: %s", sub,
5834 expand_string_message);
5835 goto EXPAND_FAILED;
5836 }
5837 yield = string_cat(yield, &size, &ptr, expanded, Ustrlen(expanded));
5838 continue;
5839 }
5840
5841 case EOP_LC:
5842 {
5843 int count = 0;
5844 uschar *t = sub - 1;
5845 while (*(++t) != 0) { *t = tolower(*t); count++; }
5846 yield = string_cat(yield, &size, &ptr, sub, count);
5847 continue;
5848 }
5849
5850 case EOP_UC:
5851 {
5852 int count = 0;
5853 uschar *t = sub - 1;
5854 while (*(++t) != 0) { *t = toupper(*t); count++; }
5855 yield = string_cat(yield, &size, &ptr, sub, count);
5856 continue;
5857 }
5858
5859 case EOP_MD5:
5860 #ifdef SUPPORT_TLS
5861 if (vp && *(void **)vp->value)
5862 {
5863 uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
5864 yield = string_cat(yield, &size, &ptr, cp, (int)strlen(cp));
5865 }
5866 else
5867 #endif
5868 {
5869 md5 base;
5870 uschar digest[16];
5871 int j;
5872 char st[33];
5873 md5_start(&base);
5874 md5_end(&base, sub, Ustrlen(sub), digest);
5875 for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
5876 yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
5877 }
5878 continue;
5879
5880 case EOP_SHA1:
5881 #ifdef SUPPORT_TLS
5882 if (vp && *(void **)vp->value)
5883 {
5884 uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
5885 yield = string_cat(yield, &size, &ptr, cp, (int)strlen(cp));
5886 }
5887 else
5888 #endif
5889 {
5890 sha1 base;
5891 uschar digest[20];
5892 int j;
5893 char st[41];
5894 sha1_start(&base);
5895 sha1_end(&base, sub, Ustrlen(sub), digest);
5896 for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
5897 yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
5898 }
5899 continue;
5900
5901 /* Convert hex encoding to base64 encoding */
5902
5903 case EOP_HEX2B64:
5904 {
5905 int c = 0;
5906 int b = -1;
5907 uschar *in = sub;
5908 uschar *out = sub;
5909 uschar *enc;
5910
5911 for (enc = sub; *enc != 0; enc++)
5912 {
5913 if (!isxdigit(*enc))
5914 {
5915 expand_string_message = string_sprintf("\"%s\" is not a hex "
5916 "string", sub);
5917 goto EXPAND_FAILED;
5918 }
5919 c++;
5920 }
5921
5922 if ((c & 1) != 0)
5923 {
5924 expand_string_message = string_sprintf("\"%s\" contains an odd "
5925 "number of characters", sub);
5926 goto EXPAND_FAILED;
5927 }
5928
5929 while ((c = *in++) != 0)
5930 {
5931 if (isdigit(c)) c -= '0';
5932 else c = toupper(c) - 'A' + 10;
5933 if (b == -1)
5934 {
5935 b = c << 4;
5936 }
5937 else
5938 {
5939 *out++ = b | c;
5940 b = -1;
5941 }
5942 }
5943
5944 enc = auth_b64encode(sub, out - sub);
5945 yield = string_cat(yield, &size, &ptr, enc, Ustrlen(enc));
5946 continue;
5947 }
5948
5949 /* Convert octets outside 0x21..0x7E to \xXX form */
5950
5951 case EOP_HEXQUOTE:
5952 {
5953 uschar *t = sub - 1;
5954 while (*(++t) != 0)
5955 {
5956 if (*t < 0x21 || 0x7E < *t)
5957 yield = string_cat(yield, &size, &ptr,
5958 string_sprintf("\\x%02x", *t), 4);
5959 else
5960 yield = string_cat(yield, &size, &ptr, t, 1);
5961 }
5962 continue;
5963 }
5964
5965 /* count the number of list elements */
5966
5967 case EOP_LISTCOUNT:
5968 {
5969 int cnt = 0;
5970 int sep = 0;
5971 uschar * cp;
5972 uschar buffer[256];
5973
5974 while (string_nextinlist(&sub, &sep, buffer, sizeof(buffer)) != NULL) cnt++;
5975 cp = string_sprintf("%d", cnt);
5976 yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
5977 continue;
5978 }
5979
5980 /* expand a named list given the name */
5981 /* handles nested named lists; requotes as colon-sep list */
5982
5983 case EOP_LISTNAMED:
5984 {
5985 tree_node *t = NULL;
5986 uschar * list;
5987 int sep = 0;
5988 uschar * item;
5989 uschar * suffix = US"";
5990 BOOL needsep = FALSE;
5991 uschar buffer[256];
5992
5993 if (*sub == '+') sub++;
5994 if (arg == NULL) /* no-argument version */
5995 {
5996 if (!(t = tree_search(addresslist_anchor, sub)) &&
5997 !(t = tree_search(domainlist_anchor, sub)) &&
5998 !(t = tree_search(hostlist_anchor, sub)))
5999 t = tree_search(localpartlist_anchor, sub);
6000 }
6001 else switch(*arg) /* specific list-type version */
6002 {
6003 case 'a': t = tree_search(addresslist_anchor, sub); suffix = US"_a"; break;
6004 case 'd': t = tree_search(domainlist_anchor, sub); suffix = US"_d"; break;
6005 case 'h': t = tree_search(hostlist_anchor, sub); suffix = US"_h"; break;
6006 case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
6007 default:
6008 expand_string_message = string_sprintf("bad suffix on \"list\" operator");
6009 goto EXPAND_FAILED;
6010 }
6011
6012 if(!t)
6013 {
6014 expand_string_message = string_sprintf("\"%s\" is not a %snamed list",
6015 sub, !arg?""
6016 : *arg=='a'?"address "
6017 : *arg=='d'?"domain "
6018 : *arg=='h'?"host "
6019 : *arg=='l'?"localpart "
6020 : 0);
6021 goto EXPAND_FAILED;
6022 }
6023
6024 list = ((namedlist_block *)(t->data.ptr))->string;
6025
6026 while ((item = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
6027 {
6028 uschar * buf = US" : ";
6029 if (needsep)
6030 yield = string_cat(yield, &size, &ptr, buf, 3);
6031 else
6032 needsep = TRUE;
6033
6034 if (*item == '+') /* list item is itself a named list */
6035 {
6036 uschar * sub = string_sprintf("${listnamed%s:%s}", suffix, item);
6037 item = expand_string_internal(sub, FALSE, NULL, FALSE, TRUE, &resetok);
6038 }
6039 else if (sep != ':') /* item from non-colon-sep list, re-quote for colon list-separator */
6040 {
6041 char * cp;
6042 char tok[3];
6043 tok[0] = sep; tok[1] = ':'; tok[2] = 0;
6044 while ((cp= strpbrk((const char *)item, tok)))
6045 {
6046 yield = string_cat(yield, &size, &ptr, item, cp-(char *)item);
6047 if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */
6048 {
6049 yield = string_cat(yield, &size, &ptr, US"::", 2);
6050 item = (uschar *)cp;
6051 }
6052 else /* sep in item; should already be doubled; emit once */
6053 {
6054 yield = string_cat(yield, &size, &ptr, (uschar *)tok, 1);
6055 if (*cp == sep) cp++;
6056 item = (uschar *)cp;
6057 }
6058 }
6059 }
6060 yield = string_cat(yield, &size, &ptr, item, Ustrlen(item));
6061 }
6062 continue;
6063 }
6064
6065 /* mask applies a mask to an IP address; for example the result of
6066 ${mask:131.111.10.206/28} is 131.111.10.192/28. */
6067
6068 case EOP_MASK:
6069 {
6070 int count;
6071 uschar *endptr;
6072 int binary[4];
6073 int mask, maskoffset;
6074 int type = string_is_ip_address(sub, &maskoffset);
6075 uschar buffer[64];
6076
6077 if (type == 0)
6078 {
6079 expand_string_message = string_sprintf("\"%s\" is not an IP address",
6080 sub);
6081 goto EXPAND_FAILED;
6082 }
6083
6084 if (maskoffset == 0)
6085 {
6086 expand_string_message = string_sprintf("missing mask value in \"%s\"",
6087 sub);
6088 goto EXPAND_FAILED;
6089 }
6090
6091 mask = Ustrtol(sub + maskoffset + 1, &endptr, 10);
6092
6093 if (*endptr != 0 || mask < 0 || mask > ((type == 4)? 32 : 128))
6094 {
6095 expand_string_message = string_sprintf("mask value too big in \"%s\"",
6096 sub);
6097 goto EXPAND_FAILED;
6098 }
6099
6100 /* Convert the address to binary integer(s) and apply the mask */
6101
6102 sub[maskoffset] = 0;
6103 count = host_aton(sub, binary);
6104 host_mask(count, binary, mask);
6105
6106 /* Convert to masked textual format and add to output. */
6107
6108 yield = string_cat(yield, &size, &ptr, buffer,
6109 host_nmtoa(count, binary, mask, buffer, '.'));
6110 continue;
6111 }
6112
6113 case EOP_ADDRESS:
6114 case EOP_LOCAL_PART:
6115 case EOP_DOMAIN:
6116 {
6117 uschar *error;
6118 int start, end, domain;
6119 uschar *t = parse_extract_address(sub, &error, &start, &end, &domain,
6120 FALSE);
6121 if (t != NULL)
6122 {
6123 if (c != EOP_DOMAIN)
6124 {
6125 if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1;
6126 yield = string_cat(yield, &size, &ptr, sub+start, end-start);
6127 }
6128 else if (domain != 0)
6129 {
6130 domain += start;
6131 yield = string_cat(yield, &size, &ptr, sub+domain, end-domain);
6132 }
6133 }
6134 continue;
6135 }
6136
6137 case EOP_ADDRESSES:
6138 {
6139 uschar outsep[2] = { ':', '\0' };
6140 uschar *address, *error;
6141 int save_ptr = ptr;
6142 int start, end, domain; /* Not really used */
6143
6144 while (isspace(*sub)) sub++;
6145 if (*sub == '>') { *outsep = *++sub; ++sub; }
6146 parse_allow_group = TRUE;
6147
6148 for (;;)
6149 {
6150 uschar *p = parse_find_address_end(sub, FALSE);
6151 uschar saveend = *p;
6152 *p = '\0';
6153 address = parse_extract_address(sub, &error, &start, &end, &domain,
6154 FALSE);
6155 *p = saveend;
6156
6157 /* Add the address to the output list that we are building. This is
6158 done in chunks by searching for the separator character. At the
6159 start, unless we are dealing with the first address of the output
6160 list, add in a space if the new address begins with the separator
6161 character, or is an empty string. */
6162
6163 if (address != NULL)
6164 {
6165 if (ptr != save_ptr && address[0] == *outsep)
6166 yield = string_cat(yield, &size, &ptr, US" ", 1);
6167
6168 for (;;)
6169 {
6170 size_t seglen = Ustrcspn(address, outsep);
6171 yield = string_cat(yield, &size, &ptr, address, seglen + 1);
6172
6173 /* If we got to the end of the string we output one character
6174 too many. */
6175
6176 if (address[seglen] == '\0') { ptr--; break; }
6177 yield = string_cat(yield, &size, &ptr, outsep, 1);
6178 address += seglen + 1;
6179 }
6180
6181 /* Output a separator after the string: we will remove the
6182 redundant final one at the end. */
6183
6184 yield = string_cat(yield, &size, &ptr, outsep, 1);
6185 }
6186
6187 if (saveend == '\0') break;
6188 sub = p + 1;
6189 }
6190
6191 /* If we have generated anything, remove the redundant final
6192 separator. */
6193
6194 if (ptr != save_ptr) ptr--;
6195 parse_allow_group = FALSE;
6196 continue;
6197 }
6198
6199
6200 /* quote puts a string in quotes if it is empty or contains anything
6201 other than alphamerics, underscore, dot, or hyphen.
6202
6203 quote_local_part puts a string in quotes if RFC 2821/2822 requires it to
6204 be quoted in order to be a valid local part.
6205
6206 In both cases, newlines and carriage returns are converted into \n and \r
6207 respectively */
6208
6209 case EOP_QUOTE:
6210 case EOP_QUOTE_LOCAL_PART:
6211 if (arg == NULL)
6212 {
6213 BOOL needs_quote = (*sub == 0); /* TRUE for empty string */
6214 uschar *t = sub - 1;
6215
6216 if (c == EOP_QUOTE)
6217 {
6218 while (!needs_quote && *(++t) != 0)
6219 needs_quote = !isalnum(*t) && !strchr("_-.", *t);
6220 }
6221 else /* EOP_QUOTE_LOCAL_PART */
6222 {
6223 while (!needs_quote && *(++t) != 0)
6224 needs_quote = !isalnum(*t) &&
6225 strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
6226 (*t != '.' || t == sub || t[1] == 0);
6227 }
6228
6229 if (needs_quote)
6230 {
6231 yield = string_cat(yield, &size, &ptr, US"\"", 1);
6232 t = sub - 1;
6233 while (*(++t) != 0)
6234 {
6235 if (*t == '\n')
6236 yield = string_cat(yield, &size, &ptr, US"\\n", 2);
6237 else if (*t == '\r')
6238 yield = string_cat(yield, &size, &ptr, US"\\r", 2);
6239 else
6240 {
6241 if (*t == '\\' || *t == '"')
6242 yield = string_cat(yield, &size, &ptr, US"\\", 1);
6243 yield = string_cat(yield, &size, &ptr, t, 1);
6244 }
6245 }
6246 yield = string_cat(yield, &size, &ptr, US"\"", 1);
6247 }
6248 else yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
6249 continue;
6250 }
6251
6252 /* quote_lookuptype does lookup-specific quoting */
6253
6254 else
6255 {
6256 int n;
6257 uschar *opt = Ustrchr(arg, '_');
6258
6259 if (opt != NULL) *opt++ = 0;
6260
6261 n = search_findtype(arg, Ustrlen(arg));
6262 if (n < 0)
6263 {
6264 expand_string_message = search_error_message;
6265 goto EXPAND_FAILED;
6266 }
6267
6268 if (lookup_list[n]->quote != NULL)
6269 sub = (lookup_list[n]->quote)(sub, opt);
6270 else if (opt != NULL) sub = NULL;
6271
6272 if (sub == NULL)
6273 {
6274 expand_string_message = string_sprintf(
6275 "\"%s\" unrecognized after \"${quote_%s\"",
6276 opt, arg);
6277 goto EXPAND_FAILED;
6278 }
6279
6280 yield = string_cat(yield, &size, &ptr, sub, Ustrlen(sub));
6281 continue;
6282 }
6283
6284 /* rx quote sticks in \ before any non-alphameric character so that
6285 the insertion works in a regular expression. */
6286
6287 case EOP_RXQUOTE:
6288 {
6289 uschar *t = sub - 1;
6290 while (*(++t) != 0)
6291 {
6292 if (!isalnum(*t))
6293 yield = string_cat(yield, &size, &ptr, US"\\", 1);
6294 yield = string_cat(yield, &size, &ptr, t, 1);
6295 }
6296 continue;
6297 }
6298
6299 /* RFC 2047 encodes, assuming headers_charset (default ISO 8859-1) as
6300 prescribed by the RFC, if there are characters that need to be encoded */
6301
6302 case EOP_RFC2047:
6303 {
6304 uschar buffer[2048];
6305 uschar *string = parse_quote_2047(sub, Ustrlen(sub), headers_charset,
6306 buffer, sizeof(buffer), FALSE);
6307 yield = string_cat(yield, &size, &ptr, string, Ustrlen(string));
6308 continue;
6309 }
6310
6311 /* RFC 2047 decode */
6312
6313 case EOP_RFC2047D:
6314 {
6315 int len;
6316 uschar *error;
6317 uschar *decoded = rfc2047_decode(sub, check_rfc2047_length,
6318 headers_charset, '?', &len, &error);
6319 if (error != NULL)
6320 {
6321 expand_string_message = error;
6322 goto EXPAND_FAILED;
6323 }
6324 yield = string_cat(yield, &size, &ptr, decoded, len);
6325 continue;
6326 }
6327
6328 /* from_utf8 converts UTF-8 to 8859-1, turning non-existent chars into
6329 underscores */
6330
6331 case EOP_FROM_UTF8:
6332 {
6333 while (*sub != 0)
6334 {
6335 int c;
6336 uschar buff[4];
6337 GETUTF8INC(c, sub);
6338 if (c > 255) c = '_';
6339 buff[0] = c;
6340 yield = string_cat(yield, &size, &ptr, buff, 1);
6341 }
6342 continue;
6343 }
6344
6345 /* replace illegal UTF-8 sequences by replacement character */
6346
6347 #define UTF8_REPLACEMENT_CHAR US"?"
6348
6349 case EOP_UTF8CLEAN:
6350 {
6351 int seq_len, index = 0;
6352 int bytes_left = 0;
6353 uschar seq_buff[4]; /* accumulate utf-8 here */
6354
6355 while (*sub != 0)
6356 {
6357 int complete;
6358 long codepoint;
6359 uschar c;
6360
6361 complete = 0;
6362 c = *sub++;
6363 if(bytes_left)
6364 {
6365 if ((c & 0xc0) != 0x80)
6366 {
6367 /* wrong continuation byte; invalidate all bytes */
6368 complete = 1; /* error */
6369 }
6370 else
6371 {
6372 codepoint = (codepoint << 6) | (c & 0x3f);
6373 seq_buff[index++] = c;
6374 if (--bytes_left == 0) /* codepoint complete */
6375 {
6376 if(codepoint > 0x10FFFF) /* is it too large? */
6377 complete = -1; /* error */
6378 else
6379 { /* finished; output utf-8 sequence */
6380 yield = string_cat(yield, &size, &ptr, seq_buff, seq_len);
6381 index = 0;
6382 }
6383 }
6384 }
6385 }
6386 else /* no bytes left: new sequence */
6387 {
6388 if((c & 0x80) == 0) /* 1-byte sequence, US-ASCII, keep it */
6389 {
6390 yield = string_cat(yield, &size, &ptr, &c, 1);
6391 continue;
6392 }
6393 if((c & 0xe0) == 0xc0) /* 2-byte sequence */
6394 {
6395 if(c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */
6396 complete = -1;
6397 else
6398 {
6399 bytes_left = 1;
6400 codepoint = c & 0x1f;
6401 }
6402 }
6403 else if((c & 0xf0) == 0xe0) /* 3-byte sequence */
6404 {
6405 bytes_left = 2;
6406 codepoint = c & 0x0f;
6407 }
6408 else if((c & 0xf8) == 0xf0) /* 4-byte sequence */
6409 {
6410 bytes_left = 3;
6411 codepoint = c & 0x07;
6412 }
6413 else /* invalid or too long (RFC3629 allows only 4 bytes) */
6414 complete = -1;
6415
6416 seq_buff[index++] = c;
6417 seq_len = bytes_left + 1;
6418 } /* if(bytes_left) */
6419
6420 if (complete != 0)
6421 {
6422 bytes_left = index = 0;
6423 yield = string_cat(yield, &size, &ptr, UTF8_REPLACEMENT_CHAR, 1);
6424 }
6425 if ((complete == 1) && ((c & 0x80) == 0))
6426 { /* ASCII character follows incomplete sequence */
6427 yield = string_cat(yield, &size, &ptr, &c, 1);
6428 }
6429 }
6430 continue;
6431 }
6432
6433 /* escape turns all non-printing characters into escape sequences. */
6434
6435 case EOP_ESCAPE:
6436 {
6437 uschar *t = string_printing(sub);
6438 yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
6439 continue;
6440 }
6441
6442 /* Handle numeric expression evaluation */
6443
6444 case EOP_EVAL:
6445 case EOP_EVAL10:
6446 {
6447 uschar *save_sub = sub;
6448 uschar *error = NULL;
6449 int_eximarith_t n = eval_expr(&sub, (c == EOP_EVAL10), &error, FALSE);
6450 if (error != NULL)
6451 {
6452 expand_string_message = string_sprintf("error in expression "
6453 "evaluation: %s (after processing \"%.*s\")", error, sub-save_sub,
6454 save_sub);
6455 goto EXPAND_FAILED;
6456 }
6457 sprintf(CS var_buffer, PR_EXIM_ARITH, n);
6458 yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
6459 continue;
6460 }
6461
6462 /* Handle time period formating */
6463
6464 case EOP_TIME_EVAL:
6465 {
6466 int n = readconf_readtime(sub, 0, FALSE);
6467 if (n < 0)
6468 {
6469 expand_string_message = string_sprintf("string \"%s\" is not an "
6470 "Exim time interval in \"%s\" operator", sub, name);
6471 goto EXPAND_FAILED;
6472 }
6473 sprintf(CS var_buffer, "%d", n);
6474 yield = string_cat(yield, &size, &ptr, var_buffer, Ustrlen(var_buffer));
6475 continue;
6476 }
6477
6478 case EOP_TIME_INTERVAL:
6479 {
6480 int n;
6481 uschar *t = read_number(&n, sub);
6482 if (*t != 0) /* Not A Number*/
6483 {
6484 expand_string_message = string_sprintf("string \"%s\" is not a "
6485 "positive number in \"%s\" operator", sub, name);
6486 goto EXPAND_FAILED;
6487 }
6488 t = readconf_printtime(n);
6489 yield = string_cat(yield, &size, &ptr, t, Ustrlen(t));
6490 continue;
6491 }
6492
6493 /* Convert string to base64 encoding */
6494
6495 case EOP_STR2B64:
6496 {
6497 uschar *encstr = auth_b64encode(sub, Ustrlen(sub));
6498 yield = string_cat(yield, &size, &ptr, encstr, Ustrlen(encstr));
6499 continue;
6500 }
6501
6502 /* strlen returns the length of the string */
6503
6504 case EOP_STRLEN:
6505 {
6506 uschar buff[24];
6507 (void)sprintf(CS buff, "%d", Ustrlen(sub));
6508 yield = string_cat(yield, &size, &ptr, buff, Ustrlen(buff));
6509 continue;
6510 }
6511
6512 /* length_n or l_n takes just the first n characters or the whole string,
6513 whichever is the shorter;
6514
6515 substr_m_n, and s_m_n take n characters from offset m; negative m take
6516 from the end; l_n is synonymous with s_0_n. If n is omitted in substr it
6517 takes the rest, either to the right or to the left.
6518
6519 hash_n or h_n makes a hash of length n from the string, yielding n
6520 characters from the set a-z; hash_n_m makes a hash of length n, but
6521 uses m characters from the set a-zA-Z0-9.
6522
6523 nhash_n returns a single number between 0 and n-1 (in text form), while
6524 nhash_n_m returns a div/mod hash as two numbers "a/b". The first lies
6525 between 0 and n-1 and the second between 0 and m-1. */
6526
6527 case EOP_LENGTH:
6528 case EOP_L:
6529 case EOP_SUBSTR:
6530 case EOP_S:
6531 case EOP_HASH:
6532 case EOP_H:
6533 case EOP_NHASH:
6534 case EOP_NH:
6535 {
6536 int sign = 1;
6537 int value1 = 0;
6538 int value2 = -1;
6539 int *pn;
6540 int len;
6541 uschar *ret;
6542
6543 if (arg == NULL)
6544 {
6545 expand_string_message = string_sprintf("missing values after %s",
6546 name);
6547 goto EXPAND_FAILED;
6548 }
6549
6550 /* "length" has only one argument, effectively being synonymous with
6551 substr_0_n. */
6552
6553 if (c == EOP_LENGTH || c == EOP_L)
6554 {
6555 pn = &value2;
6556 value2 = 0;
6557 }
6558
6559 /* The others have one or two arguments; for "substr" the first may be
6560 negative. The second being negative means "not supplied". */
6561
6562 else
6563 {
6564 pn = &value1;
6565 if (name[0] == 's' && *arg == '-') { sign = -1; arg++; }
6566 }
6567
6568 /* Read up to two numbers, separated by underscores */
6569
6570 ret = arg;
6571 while (*arg != 0)
6572 {
6573 if (arg != ret && *arg == '_' && pn == &value1)
6574 {
6575 pn = &value2;
6576 value2 = 0;
6577 if (arg[1] != 0) arg++;
6578 }
6579 else if (!isdigit(*arg))
6580 {
6581 expand_string_message =
6582 string_sprintf("non-digit after underscore in \"%s\"", name);
6583 goto EXPAND_FAILED;
6584 }
6585 else *pn = (*pn)*10 + *arg++ - '0';
6586 }
6587 value1 *= sign;
6588
6589 /* Perform the required operation */
6590
6591 ret =
6592 (c == EOP_HASH || c == EOP_H)?
6593 compute_hash(sub, value1, value2, &len) :
6594 (c == EOP_NHASH || c == EOP_NH)?
6595 compute_nhash(sub, value1, value2, &len) :
6596 extract_substr(sub, value1, value2, &len);
6597
6598 if (ret == NULL) goto EXPAND_FAILED;
6599 yield = string_cat(yield, &size, &ptr, ret, len);
6600 continue;
6601 }
6602
6603 /* Stat a path */
6604
6605 case EOP_STAT:
6606 {
6607 uschar *s;
6608 uschar smode[12];
6609 uschar **modetable[3];
6610 int i;
6611 mode_t mode;
6612 struct stat st;
6613
6614 if ((expand_forbid & RDO_EXISTS) != 0)
6615 {
6616 expand_string_message = US"Use of the stat() expansion is not permitted";
6617 goto EXPAND_FAILED;
6618 }
6619
6620 if (stat(CS sub, &st) < 0)
6621 {
6622 expand_string_message = string_sprintf("stat(%s) failed: %s",
6623 sub, strerror(errno));
6624 goto EXPAND_FAILED;
6625 }
6626 mode = st.st_mode;
6627 switch (mode & S_IFMT)
6628 {
6629 case S_IFIFO: smode[0] = 'p'; break;
6630 case S_IFCHR: smode[0] = 'c'; break;
6631 case S_IFDIR: smode[0] = 'd'; break;
6632 case S_IFBLK: smode[0] = 'b'; break;
6633 case S_IFREG: smode[0] = '-'; break;
6634 default: smode[0] = '?'; break;
6635 }
6636
6637 modetable[0] = ((mode & 01000) == 0)? mtable_normal : mtable_sticky;
6638 modetable[1] = ((mode & 02000) == 0)? mtable_normal : mtable_setid;
6639 modetable[2] = ((mode & 04000) == 0)? mtable_normal : mtable_setid;
6640
6641 for (i = 0; i < 3; i++)
6642 {
6643 memcpy(CS(smode + 7 - i*3), CS(modetable[i][mode & 7]), 3);
6644 mode >>= 3;
6645 }
6646
6647 smode[10] = 0;
6648 s = string_sprintf("mode=%04lo smode=%s inode=%ld device=%ld links=%ld "
6649 "uid=%ld gid=%ld size=" OFF_T_FMT " atime=%ld mtime=%ld ctime=%ld",
6650 (long)(st.st_mode & 077777), smode, (long)st.st_ino,
6651 (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
6652 (long)st.st_gid, st.st_size, (long)st.st_atime,
6653 (long)st.st_mtime, (long)st.st_ctime);
6654 yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
6655 continue;
6656 }
6657
6658 /* vaguely random number less than N */
6659
6660 case EOP_RANDINT:
6661 {
6662 int_eximarith_t max;
6663 uschar *s;
6664
6665 max = expand_string_integer(sub, TRUE);
6666 if (expand_string_message != NULL)
6667 goto EXPAND_FAILED;
6668 s = string_sprintf("%d", vaguely_random_number((int)max));
6669 yield = string_cat(yield, &size, &ptr, s, Ustrlen(s));
6670 continue;
6671 }
6672
6673 /* Reverse IP, including IPv6 to dotted-nibble */
6674
6675 case EOP_REVERSE_IP:
6676 {
6677 int family, maskptr;
6678 uschar reversed[128];
6679
6680 family = string_is_ip_address(sub, &maskptr);
6681 if (family == 0)
6682 {
6683 expand_string_message = string_sprintf(
6684 "reverse_ip() not given an IP address [%s]", sub);
6685 goto EXPAND_FAILED;
6686 }
6687 invert_address(reversed, sub);
6688 yield = string_cat(yield, &size, &ptr, reversed, Ustrlen(reversed));
6689 continue;
6690 }
6691
6692 /* Unknown operator */
6693
6694 default:
6695 expand_string_message =
6696 string_sprintf("unknown expansion operator \"%s\"", name);
6697 goto EXPAND_FAILED;
6698 }
6699 }
6700
6701 /* Handle a plain name. If this is the first thing in the expansion, release
6702 the pre-allocated buffer. If the result data is known to be in a new buffer,
6703 newsize will be set to the size of that buffer, and we can just point at that
6704 store instead of copying. Many expansion strings contain just one reference,
6705 so this is a useful optimization, especially for humungous headers
6706 ($message_headers). */
6707 /*{*/
6708 if (*s++ == '}')
6709 {
6710 int len;
6711 int newsize = 0;
6712 if (ptr == 0)
6713 {
6714 if (resetok) store_reset(yield);
6715 yield = NULL;
6716 size = 0;
6717 }
6718 value = find_variable(name, FALSE, skipping, &newsize);
6719 if (value == NULL)
6720 {
6721 expand_string_message =
6722 string_sprintf("unknown variable in \"${%s}\"", name);
6723 check_variable_error_message(name);
6724 goto EXPAND_FAILED;
6725 }
6726 len = Ustrlen(value);
6727 if (yield == NULL && newsize != 0)
6728 {
6729 yield = value;
6730 size = newsize;
6731 ptr = len;
6732 }
6733 else yield = string_cat(yield, &size, &ptr, value, len);
6734 continue;
6735 }
6736
6737 /* Else there's something wrong */
6738
6739 expand_string_message =
6740 string_sprintf("\"${%s\" is not a known operator (or a } is missing "
6741 "in a variable reference)", name);
6742 goto EXPAND_FAILED;
6743 }
6744
6745 /* If we hit the end of the string when ket_ends is set, there is a missing
6746 terminating brace. */
6747
6748 if (ket_ends && *s == 0)
6749 {
6750 expand_string_message = malformed_header?
6751 US"missing } at end of string - could be header name not terminated by colon"
6752 :
6753 US"missing } at end of string";
6754 goto EXPAND_FAILED;
6755 }
6756
6757 /* Expansion succeeded; yield may still be NULL here if nothing was actually
6758 added to the string. If so, set up an empty string. Add a terminating zero. If
6759 left != NULL, return a pointer to the terminator. */
6760
6761 if (yield == NULL) yield = store_get(1);
6762 yield[ptr] = 0;
6763 if (left != NULL) *left = s;
6764
6765 /* Any stacking store that was used above the final string is no longer needed.
6766 In many cases the final string will be the first one that was got and so there
6767 will be optimal store usage. */
6768
6769 if (resetok) store_reset(yield + ptr + 1);
6770 else if (resetok_p) *resetok_p = FALSE;
6771
6772 DEBUG(D_expand)
6773 {
6774 debug_printf("expanding: %.*s\n result: %s\n", (int)(s - string), string,
6775 yield);
6776 if (skipping) debug_printf("skipping: result is not used\n");
6777 }
6778 return yield;
6779
6780 /* This is the failure exit: easiest to program with a goto. We still need
6781 to update the pointer to the terminator, for cases of nested calls with "fail".
6782 */
6783
6784 EXPAND_FAILED_CURLY:
6785 expand_string_message = malformed_header?
6786 US"missing or misplaced { or } - could be header name not terminated by colon"
6787 :
6788 US"missing or misplaced { or }";
6789
6790 /* At one point, Exim reset the store to yield (if yield was not NULL), but
6791 that is a bad idea, because expand_string_message is in dynamic store. */
6792
6793 EXPAND_FAILED:
6794 if (left != NULL) *left = s;
6795 DEBUG(D_expand)
6796 {
6797 debug_printf("failed to expand: %s\n", string);
6798 debug_printf(" error message: %s\n", expand_string_message);
6799 if (expand_string_forcedfail) debug_printf("failure was forced\n");
6800 }
6801 if (resetok_p) *resetok_p = resetok;
6802 return NULL;
6803 }
6804
6805
6806 /* This is the external function call. Do a quick check for any expansion
6807 metacharacters, and if there are none, just return the input string.
6808
6809 Argument: the string to be expanded
6810 Returns: the expanded string, or NULL if expansion failed; if failure was
6811 due to a lookup deferring, search_find_defer will be TRUE
6812 */
6813
6814 uschar *
6815 expand_string(uschar *string)
6816 {
6817 search_find_defer = FALSE;
6818 malformed_header = FALSE;
6819 return (Ustrpbrk(string, "$\\") == NULL)? string :
6820 expand_string_internal(string, FALSE, NULL, FALSE, TRUE, NULL);
6821 }
6822
6823
6824
6825 /*************************************************
6826 * Expand and copy *
6827 *************************************************/
6828
6829 /* Now and again we want to expand a string and be sure that the result is in a
6830 new bit of store. This function does that.
6831
6832 Argument: the string to be expanded
6833 Returns: the expanded string, always in a new bit of store, or NULL
6834 */
6835
6836 uschar *
6837 expand_string_copy(uschar *string)
6838 {
6839 uschar *yield = expand_string(string);
6840 if (yield == string) yield = string_copy(string);
6841 return yield;
6842 }
6843
6844
6845
6846 /*************************************************
6847 * Expand and interpret as an integer *
6848 *************************************************/
6849
6850 /* Expand a string, and convert the result into an integer.
6851
6852 Arguments:
6853 string the string to be expanded
6854 isplus TRUE if a non-negative number is expected
6855
6856 Returns: the integer value, or
6857 -1 for an expansion error ) in both cases, message in
6858 -2 for an integer interpretation error ) expand_string_message
6859 expand_string_message is set NULL for an OK integer
6860 */
6861
6862 int_eximarith_t
6863 expand_string_integer(uschar *string, BOOL isplus)
6864 {
6865 int_eximarith_t value;
6866 uschar *s = expand_string(string);
6867 uschar *msg = US"invalid integer \"%s\"";
6868 uschar *endptr;
6869
6870 /* If expansion failed, expand_string_message will be set. */
6871
6872 if (s == NULL) return -1;
6873
6874 /* On an overflow, strtol() returns LONG_MAX or LONG_MIN, and sets errno
6875 to ERANGE. When there isn't an overflow, errno is not changed, at least on some
6876 systems, so we set it zero ourselves. */
6877
6878 errno = 0;
6879 expand_string_message = NULL; /* Indicates no error */
6880
6881 /* Before Exim 4.64, strings consisting entirely of whitespace compared
6882 equal to 0. Unfortunately, people actually relied upon that, so preserve
6883 the behaviour explicitly. Stripping leading whitespace is a harmless
6884 noop change since strtol skips it anyway (provided that there is a number
6885 to find at all). */
6886 if (isspace(*s))
6887 {
6888 while (isspace(*s)) ++s;
6889 if (*s == '\0')
6890 {
6891 DEBUG(D_expand)
6892 debug_printf("treating blank string as number 0\n");
6893 return 0;
6894 }
6895 }
6896
6897 value = strtoll(CS s, CSS &endptr, 10);
6898
6899 if (endptr == s)
6900 {
6901 msg = US"integer expected but \"%s\" found";
6902 }
6903 else if (value < 0 && isplus)
6904 {
6905 msg = US"non-negative integer expected but \"%s\" found";
6906 }
6907 else
6908 {
6909 switch (tolower(*endptr))
6910 {
6911 default:
6912 break;
6913 case 'k':
6914 if (value > EXIM_ARITH_MAX/1024 || value < EXIM_ARITH_MIN/1024) errno = ERANGE;
6915 else value *= 1024;
6916 endptr++;
6917 break;
6918 case 'm':
6919 if (value > EXIM_ARITH_MAX/(1024*1024) || value < EXIM_ARITH_MIN/(1024*1024)) errno = ERANGE;
6920 else value *= 1024*1024;
6921 endptr++;
6922 break;
6923 case 'g':
6924 if (value > EXIM_ARITH_MAX/(1024*1024*1024) || value < EXIM_ARITH_MIN/(1024*1024*1024)) errno = ERANGE;
6925 else value *= 1024*1024*1024;
6926 endptr++;
6927 break;
6928 }
6929 if (errno == ERANGE)
6930 msg = US"absolute value of integer \"%s\" is too large (overflow)";
6931 else
6932 {
6933 while (isspace(*endptr)) endptr++;
6934 if (*endptr == 0) return value;
6935 }
6936 }
6937
6938 expand_string_message = string_sprintf(CS msg, s);
6939 return -2;
6940 }
6941
6942
6943 /*************************************************
6944 **************************************************
6945 * Stand-alone test program *
6946 **************************************************
6947 *************************************************/
6948
6949 #ifdef STAND_ALONE
6950
6951
6952 BOOL
6953 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
6954 {
6955 int ovector[3*(EXPAND_MAXN+1)];
6956 int n = pcre_exec(re, NULL, subject, Ustrlen(subject), 0, PCRE_EOPT|options,
6957 ovector, sizeof(ovector)/sizeof(int));
6958 BOOL yield = n >= 0;
6959 if (n == 0) n = EXPAND_MAXN + 1;
6960 if (yield)
6961 {
6962 int nn;
6963 expand_nmax = (setup < 0)? 0 : setup + 1;
6964 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
6965 {
6966 expand_nstring[expand_nmax] = subject + ovector[nn];
6967 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
6968 }
6969 expand_nmax--;
6970 }
6971 return yield;
6972 }
6973
6974
6975 int main(int argc, uschar **argv)
6976 {
6977 int i;
6978 uschar buffer[1024];
6979
6980 debug_selector = D_v;
6981 debug_file = stderr;
6982 debug_fd = fileno(debug_file);
6983 big_buffer = malloc(big_buffer_size);
6984
6985 for (i = 1; i < argc; i++)
6986 {
6987 if (argv[i][0] == '+')
6988 {
6989 debug_trace_memory = 2;
6990 argv[i]++;
6991 }
6992 if (isdigit(argv[i][0]))
6993 debug_selector = Ustrtol(argv[i], NULL, 0);
6994 else
6995 if (Ustrspn(argv[i], "abcdefghijklmnopqrtsuvwxyz0123456789-.:/") ==
6996 Ustrlen(argv[i]))
6997 {
6998 #ifdef LOOKUP_LDAP
6999 eldap_default_servers = argv[i];
7000 #endif
7001 #ifdef LOOKUP_MYSQL
7002 mysql_servers = argv[i];
7003 #endif
7004 #ifdef LOOKUP_PGSQL
7005 pgsql_servers = argv[i];
7006 #endif
7007 #ifdef EXPERIMENTAL_REDIS
7008 redis_servers = argv[i];
7009 #endif
7010 }
7011 #ifdef EXIM_PERL
7012 else opt_perl_startup = argv[i];
7013 #endif
7014 }
7015
7016 printf("Testing string expansion: debug_level = %d\n\n", debug_level);
7017
7018 expand_nstring[1] = US"string 1....";
7019 expand_nlength[1] = 8;
7020 expand_nmax = 1;
7021
7022 #ifdef EXIM_PERL
7023 if (opt_perl_startup != NULL)
7024 {
7025 uschar *errstr;
7026 printf("Starting Perl interpreter\n");
7027 errstr = init_perl(opt_perl_startup);
7028 if (errstr != NULL)
7029 {
7030 printf("** error in perl_startup code: %s\n", errstr);
7031 return EXIT_FAILURE;
7032 }
7033 }
7034 #endif /* EXIM_PERL */
7035
7036 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
7037 {
7038 void *reset_point = store_get(0);
7039 uschar *yield = expand_string(buffer);
7040 if (yield != NULL)
7041 {
7042 printf("%s\n", yield);
7043 store_reset(reset_point);
7044 }
7045 else
7046 {
7047 if (search_find_defer) printf("search_find deferred\n");
7048 printf("Failed: %s\n", expand_string_message);
7049 if (expand_string_forcedfail) printf("Forced failure\n");
7050 printf("\n");
7051 }
7052 }
7053
7054 search_tidyup();
7055
7056 return 0;
7057 }
7058
7059 #endif
7060
7061 /* vi: aw ai sw=2
7062 */
7063 /* End of expand.c */
Unnamed repository; edit this file 'description' to name the repository.