src/src/rewrite.c

   1 /*************************************************
   2 *     Exim - an Internet mail transport agent    *
   3 *************************************************/
   4
   5 /* Copyright (c) University of Cambridge 1995 - 2018 */
   6 /* See the file NOTICE for conditions of use and distribution. */
   7
   8 /* Functions concerned with rewriting headers */
   9
  10
  11 #include "exim.h"
  12
  13 /* Names for testing rewriting */
  14
  15 static const char *rrname[] = {
  16   "  sender",
  17   "    from",
  18   "      to",
  19   "      cc",
  20   "     bcc",
  21   "reply-to",
  22   "env-from",
  23   "  env-to"
  24 };
  25
  26 /* Structure and table for finding source of address for debug printing */
  27
  28 typedef struct where_list_block {
  29   int bit;
  30   const uschar *string;
  31 } where_list_block;
  32
  33 static where_list_block where_list[] = {
  34   { rewrite_sender,  CUS"sender:" },
  35   { rewrite_from,    CUS"from:" },
  36   { rewrite_to,      CUS"to:" },
  37   { rewrite_cc,      CUS"cc:" },
  38   { rewrite_bcc,     CUS"bcc:" },
  39   { rewrite_replyto, CUS"reply-to:" },
  40   { rewrite_envfrom, CUS"env-from" },
  41   { rewrite_envto,   CUS"env-to" },
  42   { rewrite_smtp,    CUS"smtp recipient" },
  43   { rewrite_smtp|rewrite_smtp_sender, CUS"smtp sender" }
  44 };
  45
  46 static int where_list_size = sizeof(where_list)/sizeof(where_list_block);
  47
  48
  49
  50 /*************************************************
  51 *            Ensure an address is qualified      *
  52 *************************************************/
  53
  54 /*
  55 Arguments:
  56   s              address to check
  57   is_recipient   TRUE if a recipient address; FALSE if a sender address
  58
  59 Returns:         fully-qualified address
  60 */
  61
  62 uschar *
  63 rewrite_address_qualify(uschar *s, BOOL is_recipient)
  64 {
  65 return (parse_find_at(s) != NULL)? s :
  66   string_sprintf("%s@%s", s,
  67     is_recipient? qualify_domain_recipient : qualify_domain_sender);
  68 }
  69
  70
  71
  72 /*************************************************
  73 *               Rewrite a single address         *
  74 *************************************************/
  75
  76 /* The yield is the input address if there is no rewriting to be done. Assume
  77 the input is a valid address, except in the case of SMTP-time rewriting, which
  78 is handled specially. When this function is called while processing filter and
  79 forward files, the uid may be that of the user. Ensure it is reset while
  80 expanding a replacement, in case that involves file lookups.
  81
  82 Arguments:
  83   s              address to rewrite
  84   flag           indicates where this address comes from; it must match the
  85                    flags in the rewriting rule
  86   whole          if not NULL, set TRUE if any rewriting rule contained the
  87                    "whole" bit and it is a header that is being rewritten
  88   add_header     if TRUE and rewriting occurs, add an "X-rewrote-xxx" header
  89                    if headers are in existence; this should be TRUE only when
  90                    a message is being received, not during delivery
  91   name           name of header, for use when adding X-rewrote-xxxx
  92   rewrite_rules  chain of rewriting rules
  93
  94 Returns:         new address if rewritten; the input address if no change;
  95                  for a header rewrite, if the "whole" bit is set, the entire
  96                  rewritten address is returned, not just the active bit.
  97 */
  98
  99 uschar *
 100 rewrite_one(uschar *s, int flag, BOOL *whole, BOOL add_header, uschar *name,
 101   rewrite_rule *rewrite_rules)
 102 {
 103 uschar *yield = s;
 104 uschar *subject = s;
 105 uschar *domain = NULL;
 106 BOOL done = FALSE;
 107 int rule_number = 1;
 108 int yield_start = 0, yield_end = 0;
 109
 110 if (whole) *whole = FALSE;
 111
 112 /* Scan the rewriting rules */
 113
 114 for (rewrite_rule * rule = rewrite_rules;
 115      rule && !done;
 116      rule_number++, rule = rule->next)
 117   {
 118   int start, end, pdomain;
 119   int count = 0;
 120   uschar *save_localpart;
 121   const uschar *save_domain;
 122   uschar *error, *new, *newparsed;
 123
 124   /* Ensure that the flag matches the flags in the rule. */
 125
 126   if (!(rule->flags & flag)) continue;
 127
 128   /* Come back here for a repeat after a successful rewrite. We do this
 129   only so many times. */
 130
 131   REPEAT_RULE:
 132
 133   /* If this is an SMTP-time rewrite, the pattern must be a regex and
 134   the subject may have any structure. No local part or domain variables
 135   can be set for the expansion. We expand the pattern in order to be consistent
 136   with the other kinds of rewrite, where expansion happens inside
 137   match_address_list(). */
 138
 139   if (flag & rewrite_smtp)
 140     {
 141     uschar *key = expand_string(rule->key);
 142     if (!key)
 143       {
 144       if (!f.expand_string_forcedfail)
 145         log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand \"%s\" while "
 146           "checking for SMTP rewriting: %s", rule->key, expand_string_message);
 147       continue;
 148       }
 149     if (match_check_string(subject, key, 0, TRUE, FALSE, FALSE, NULL) != OK)
 150       continue;
 151     new = expand_string(rule->replacement);
 152     }
 153
 154   /* All other rewrites expect the input to be a valid address, so local part
 155   and domain variables can be set for expansion. For the first rule, to be
 156   applied to this address, domain will be NULL and needs to be set. */
 157
 158   else
 159     {
 160     if (!domain) domain = Ustrrchr(subject, '@') + 1;
 161
 162     /* Use the general function for matching an address against a list (here
 163     just one item, so use the "impossible value" separator UCHAR_MAX+1). */
 164
 165     if (match_address_list(subject, FALSE, TRUE, CUSS &(rule->key), NULL, 0,
 166         UCHAR_MAX + 1, NULL) != OK)
 167       continue;
 168
 169     /* The source address matches, and numerical variables have been
 170     set up. If the replacement string consists of precisely "*" then no
 171     rewriting is required for this address - the behaviour is as for "fail"
 172     in the replacement expansion, but assuming the quit flag. */
 173
 174     if (Ustrcmp(rule->replacement, "*") == 0) break;
 175
 176     /* Otherwise, expand the replacement string. Set $local_part and $domain to
 177     the appropriate values, restoring whatever value they previously had
 178     afterwards. */
 179
 180     save_localpart = deliver_localpart;
 181     save_domain = deliver_domain;
 182
 183     /* We have subject pointing to "localpart@domain" and domain pointing to
 184     the domain. Temporarily terminate the local part so that it can be
 185     set up as an expansion variable */
 186
 187     domain[-1] = 0;
 188     deliver_localpart = subject;
 189     deliver_domain = domain;
 190
 191     new = expand_string(rule->replacement);
 192
 193     domain[-1] = '@';
 194     deliver_localpart = save_localpart;
 195     deliver_domain = save_domain;
 196     }
 197
 198   /* If the expansion failed with the "forcedfail" flag, don't generate
 199   an error - just give up on this rewriting rule. If the "q" flag is set,
 200   give up altogether. For other expansion failures we have a configuration
 201   error. */
 202
 203   if (!new)
 204     {
 205     if (f.expand_string_forcedfail)
 206       { if (rule->flags & rewrite_quit) break; else continue; }
 207
 208     expand_string_message = expand_hide_passwords(expand_string_message);
 209
 210     log_write(0, LOG_MAIN|LOG_PANIC, "Expansion of %s failed while rewriting: "
 211       "%s", rule->replacement, expand_string_message);
 212     break;
 213     }
 214
 215   /* Check the what has been generated is a valid RFC 2822 address. Only
 216   envelope from or SMTP sender is permitted to be rewritten as <>.*/
 217
 218   newparsed = parse_extract_address(new, &error, &start, &end, &pdomain,
 219     flag == rewrite_envfrom || flag == (rewrite_smtp|rewrite_smtp_sender));
 220
 221   if (!newparsed)
 222     {
 223     log_write(0, LOG_MAIN|LOG_PANIC, "Rewrite of %s yielded unparseable "
 224       "address: %s in address %s", subject, error, new);
 225     break;   /* Give up on this address */
 226     }
 227
 228   /* A non-null unqualified address can be qualified if requested. Otherwise,
 229   this is an error unless it's the empty address in circumstances where that is
 230   permitted. */
 231
 232   if (pdomain == 0 && (*newparsed != 0 ||
 233       (flag != rewrite_envfrom && flag != (rewrite_smtp|rewrite_smtp_sender))))
 234     {
 235     if (rule->flags & rewrite_qualify)
 236       {
 237       newparsed = rewrite_address_qualify(newparsed, TRUE);
 238       new = string_sprintf("%.*s%s%.*s", start, new, newparsed,
 239         Ustrlen(new) - end, new + end);
 240       end = start + Ustrlen(newparsed);
 241       }
 242     else
 243       {
 244       log_write(0, LOG_MAIN|LOG_PANIC, "Rewrite of %s yielded unqualified "
 245         "address \"%s\"", subject, new);
 246       break;   /* Give up on this address */
 247       }
 248     }
 249
 250   /* We have a validly rewritten address */
 251
 252   if (LOGGING(address_rewrite) || (debug_selector & D_rewrite) != 0)
 253     {
 254     const uschar *where = CUS"?";
 255
 256     for (int i = 0; i < where_list_size; i++)
 257       if (flag == where_list[i].bit)
 258         {
 259         where = where_list[i].string;
 260         break;
 261         }
 262     log_write(L_address_rewrite,
 263            LOG_MAIN, "\"%s\" from %s rewritten as \"%s\" by rule %d",
 264            yield, where, new, rule_number);
 265     }
 266
 267   /* A header will only actually be added if header_last is non-NULL,
 268   i.e. during message reception or delivery, but add_header should not
 269   be set TRUE during delivery, as otherwise multiple instances of the header
 270   can fill up the -H file and make it embarrassingly large. We don't need
 271   to set header_rewritten because the -H file always gets written at the end
 272   of message reception. */
 273
 274   if (add_header)
 275     header_add(htype_old, "X-rewrote-%s: %s\n", name, subject);
 276
 277   /* Handle the case when replacement of the whole address is possible.
 278   This happens only when whole is not NULL and we are rewriting a header.
 279   If *whole is already TRUE it means that a previous rule had the w
 280   flag set and so we must preserve the non-active portion of the current
 281   subject unless the current rule also has the w flag set. */
 282
 283   if (whole && (flag & rewrite_all_headers))
 284     {
 285     /* Current rule has the w flag set. We must ensure the phrase parts
 286     are syntactically valid if they are present. */
 287
 288     if (rule->flags & rewrite_whole)
 289       {
 290       if (start > 0 && new[start-1] == '<')
 291         {
 292         uschar *p1 = new + start - 1;
 293         uschar *p2 = new + end + 1;
 294         const uschar *pf1, *pf2;
 295         uschar buff1[256], buff2[256];
 296
 297         while (p1 > new && p1[-1] == ' ') p1--;
 298         pf1 = parse_fix_phrase(new, p1 - new, buff1, sizeof(buff1));
 299         while (*p2 == ' ') p2++;
 300         pf2 = parse_fix_phrase(p2, Ustrlen(p2), buff2, sizeof(buff2));
 301
 302         /* Note that pf1 and pf2 are NOT necessarily buff1 and buff2. For
 303         a non-RFC 2047 phrase that does not need to be RFC 2822 quoted, they
 304         will be buff1+1 and buff2+1. */
 305
 306         start = Ustrlen(pf1) + start + new - p1;
 307         end = start + Ustrlen(newparsed);
 308         new = string_sprintf("%s%.*s%s", pf1, (int)(p2 - p1), p1, pf2);
 309         }
 310
 311       /* Now accept the whole thing */
 312
 313       yield = new;
 314       yield_start = start;
 315       yield_end = end;
 316       subject = newparsed;
 317       *whole = TRUE;
 318       }
 319
 320     /* Current rule does not have the w flag set; if not previously
 321     done any whole rewriting, behave in non-whole manner. */
 322
 323     else if (!*whole) goto NEVER_WHOLE;
 324
 325     /* Current rule does not have the w flag set, but a previous
 326     rule did rewrite the whole address. Thus yield and subject will be
 327     different. Preserve the previous non-active part of the address. */
 328
 329     else
 330       {
 331       subject = newparsed;
 332       new = string_sprintf("%.*s%s%n%s",
 333          yield_start, yield, subject, &end, yield + yield_end);
 334       yield_end = end;
 335       yield = new;
 336       }
 337     }
 338
 339   /* Rule just rewrites active part, or handling an envelope. This
 340   code is obeyed only when all rules so far have not done "whole"
 341   replacement. */
 342
 343   else
 344     {
 345     NEVER_WHOLE:
 346     subject = yield = newparsed;
 347     }
 348
 349   domain = NULL;    /* Reset for next rule */
 350
 351   /* If no further rewrites are to be done, set the done flag. This allows
 352   repeats of the current rule if configured before breaking the loop. */
 353
 354   if (rule->flags & rewrite_quit) done = TRUE;
 355
 356   /* Allow the current rule to be applied up to 10 times if
 357   requested. */
 358
 359   if (rule->flags & rewrite_repeat)
 360     {
 361     if (count++ < 10) goto REPEAT_RULE;
 362     log_write(0, LOG_MAIN|LOG_PANIC, "rewrite rule repeat ignored after 10 "
 363       "times");
 364     }
 365   }
 366
 367 /* Unset expansion numeric variables, and that's it. */
 368
 369 expand_nmax = -1;
 370 return yield;
 371 }
 372
 373
 374
 375 /*************************************************
 376 *         Ensure qualification and rewrite       *
 377 *************************************************/
 378
 379 /* This function is called for envelope addresses, the boolean specifying
 380 whether a recipient or a sender. It must first of all ensure the address is
 381 fully qualified, and then apply any relevant re-writing rules. The add-header
 382 flag causes a header to be added, recording the old address. This is marked
 383 "old", so that it is never transported anywhere; it exists for local checking
 384 and debugging purposes.
 385
 386 Arguments:
 387   s              the address to be considered
 388   is_recipient   TRUE for recipient addresses; FALSE otherwise
 389   add_header     add "X-rewrote-xxx" header when rewriting; this is
 390                    set TRUE only for calls from the reception functions
 391   rewrite_rules  points to chain of rewrite rules
 392   existflags     bits indicating which headers there are rewrites for
 393                  (just an optimisation)
 394
 395 Returns:         possibly rewritten address
 396 */
 397
 398 uschar *
 399 rewrite_address(uschar *s, BOOL is_recipient, BOOL add_header,
 400   rewrite_rule *rewrite_rules, int existflags)
 401 {
 402 int flag = is_recipient? rewrite_envto : rewrite_envfrom;
 403 s = rewrite_address_qualify(s, is_recipient);
 404 if ((existflags & flag) != 0)
 405   {
 406   uschar *new = rewrite_one(s, flag, NULL, add_header, is_recipient?
 407     US"original-recipient" : US"sender", rewrite_rules);
 408   if (new != s) s = new;
 409   }
 410 return s;
 411 }
 412
 413
 414
 415 /*************************************************
 416 *    Qualify and possibly rewrite one header     *
 417 *************************************************/
 418
 419 /* This is called only from rewrite_header() below, either when reading a
 420 message. or when routing, in order to rewrite addresses that get changed by a
 421 router. This is normally the addition of full qualification to a partial
 422 domain. The first rewriting rule in this case is "change routed_old into
 423 routed_new", and it applies to all header lines that contain addresses. Then
 424 header-specific rewriting rules are applied.
 425
 426 Before rewriting can be done, addresses without domains have to be qualified.
 427 This should only be done for messages from "local" senders. This is a difficult
 428 concept to pin down, what with the use of SMTP both as a submission and as a
 429 transmission protocol. Exim normally requires incoming SMTP to contain fully-
 430 qualified addresses, but there are options to permit unqualified ones from
 431 certain hosts. For those hosts only, addresses in headers can also be
 432 qualified. For other hosts, unqualified addresses in headers do not get touched
 433 in any way. For locally sourced messages, unqualified addresses always get
 434 qualified, except when -bnq is used to explicitly suppress this.
 435
 436 Arguments:
 437   h              pointer to header line block
 438   flag           indicates which header this is
 439   routed_old     if not NULL, this is a rewrite caused by a router, changing
 440                    this domain into routed_new
 441   routed_new     new routed domain if routed_old is not NULL
 442   rewrite_rules  points to chain of rewriting rules
 443   existflags     bits indicating which rewrites exist
 444   replace        if TRUE, insert the new header in the chain after the old
 445                    one, and mark the old one "replaced"
 446
 447 Returns:         NULL if header unchanged; otherwise the rewritten header
 448 */
 449
 450 static header_line *
 451 rewrite_one_header(header_line *h, int flag,
 452   const uschar *routed_old, const uschar *routed_new,
 453   rewrite_rule *rewrite_rules, int existflags, BOOL replace)
 454 {
 455 int lastnewline = 0;
 456 header_line *newh = NULL;
 457 rmark function_reset_point = store_mark();
 458 uschar *s = Ustrchr(h->text, ':') + 1;
 459 while (isspace(*s)) s++;
 460
 461 DEBUG(D_rewrite)
 462   debug_printf("rewrite_one_header: type=%c:\n  %s", h->type, h->text);
 463
 464 f.parse_allow_group = TRUE;     /* Allow group syntax */
 465
 466 /* Loop for multiple addresses in the header. We have to go through them all
 467 in case any need qualifying, even if there's no rewriting. Pathological headers
 468 may have thousands of addresses in them, so cause the store to be reset for
 469 any that don't actually get rewritten. We also play silly games for those that
 470 _are_ rewritten so as to avoid runaway store usage for these kinds of header.
 471 We want to avoid keeping store for any intermediate versions. */
 472
 473 while (*s)
 474   {
 475   uschar *sprev;
 476   uschar *ss = parse_find_address_end(s, FALSE);
 477   uschar *recipient, *new, *errmess;
 478   rmark loop_reset_point = store_mark();
 479   BOOL changed = FALSE;
 480   int terminator = *ss;
 481   int start, end, domain;
 482
 483   /* Temporarily terminate the string at this point, and extract the
 484   operative address within. Then put back the terminator and prepare for
 485   the next address, saving the start of the old one. */
 486
 487   *ss = 0;
 488   recipient = parse_extract_address(s,&errmess,&start,&end,&domain,FALSE);
 489   *ss = terminator;
 490   sprev = s;
 491   s = ss + (terminator? 1:0);
 492   while (isspace(*s)) s++;
 493
 494   /* There isn't much we can do for syntactic disasters at this stage.
 495   Pro tem (possibly for ever) ignore them. */
 496
 497   if (!recipient)
 498     {
 499     loop_reset_point = store_reset(loop_reset_point);
 500     continue;
 501     }
 502
 503   /* If routed_old is not NULL, this is a rewrite caused by a router,
 504   consisting of changing routed_old into routed_new, and applying to all
 505   headers. If the header address has no domain, it is excluded, since a router
 506   rewrite affects domains only. The new value should always be fully qualified,
 507   but it may be something that has an explicit re-write rule set, so we need to
 508   check the configured rules subsequently as well. (Example: there's an
 509   explicit rewrite turning *.foo.com into foo.com, and an address is supplied
 510   as abc@xyz, which the DNS lookup turns into abc@xyz.foo.com). However, if no
 511   change is made here, don't bother carrying on. */
 512
 513   if (routed_old != NULL)
 514     {
 515     if (domain <= 0 || strcmpic(recipient+domain, routed_old) != 0) continue;
 516     recipient[domain-1] = 0;
 517     new = string_sprintf("%s@%s", recipient, routed_new);
 518     DEBUG(D_rewrite)
 519       {
 520       recipient[domain-1] = '@';
 521       debug_printf("%s rewritten by router as %s\n", recipient, new);
 522       }
 523     recipient = new;
 524     changed = TRUE;
 525     }
 526
 527   /* This is not a router-inspired rewrite. Ensure the address is fully
 528   qualified if that is permitted. If an unqualified address was received
 529   from a host that isn't listed, do not continue rewriting this address.
 530   Sender, From or Reply-To headers are treated as senders, the rest as
 531   recipients. This matters only when there are different qualify strings. */
 532
 533   else
 534     {
 535     BOOL is_recipient =
 536       (flag & (rewrite_sender | rewrite_from | rewrite_replyto)) == 0;
 537     new = rewrite_address_qualify(recipient, is_recipient);
 538     changed = (new != recipient);
 539     recipient = new;
 540
 541     /* Can only qualify if permitted; if not, no rewrite. */
 542
 543     if (changed && ((is_recipient && !f.allow_unqualified_recipient) ||
 544                     (!is_recipient && !f.allow_unqualified_sender)))
 545       {
 546       loop_reset_point = store_reset(loop_reset_point);
 547       continue;
 548       }
 549     }
 550
 551   /* If there are rewrite rules for this type of header, apply
 552   them. This test is just for efficiency, to save scanning the rules
 553   in cases when nothing is going to change. If any rewrite rule had the
 554   "whole" flag set, adjust the pointers so that the whole address gets
 555   replaced, except possibly a final \n. */
 556
 557   if ((existflags & flag) != 0)
 558     {
 559     BOOL whole;
 560     new = rewrite_one(recipient, flag, &whole, FALSE, NULL, rewrite_rules);
 561     if (new != recipient)
 562       {
 563       changed = TRUE;
 564       if (whole)
 565         {
 566         start = 0;
 567         end = ss - sprev;
 568         if (sprev[end-1] == '\n') end--;
 569         }
 570       }
 571     }
 572
 573   /* If nothing has changed, lose all dynamic store obtained in this loop, and
 574   move on to the next address. We can't reset to the function start store
 575   point, because we may have a rewritten line from a previous time round the
 576   loop. */
 577
 578   if (!changed) loop_reset_point = store_reset(loop_reset_point);
 579
 580   /* If the address has changed, create a new header containing the
 581   rewritten address. We do not need to set the chain pointers at this
 582   stage. We want to avoid using more and more memory if the header is very long
 583   and contains lots and lots of rewritten addresses. Therefore, we build the
 584   new text string in malloc store, then at the end we reset dynamic store
 585   before copying the new header to a new block (and then freeing the malloc
 586   block). The header must end up in dynamic store so that it's freed at the end
 587   of receiving a message. */
 588
 589   else
 590     {
 591     int remlen;
 592     int newlen = Ustrlen(new);
 593     int oldlen = end - start;
 594
 595     header_line * prev = newh ? newh : h;
 596     uschar * newt = store_get_perm(prev->slen - oldlen + newlen + 4, TRUE);
 597     uschar * newtstart = newt;
 598
 599     int type = prev->type;
 600     int slen = prev->slen - oldlen + newlen;
 601
 602     /* Build the new header text by copying the old and putting in the
 603     replacement. This process may make the header substantially longer
 604     than it was before - qualification of a list of bare addresses can
 605     often do this - so we stick in a newline after the re-written address
 606     if it has increased in length and ends more than 40 characters in. In
 607     fact, the code is not perfect, since it does not scan for existing
 608     newlines in the header, but it doesn't seem worth going to that
 609     amount of trouble. */
 610
 611     Ustrncpy(newt, prev->text, sprev - prev->text + start);
 612     newt += sprev - prev->text + start;
 613     *newt = 0;
 614     Ustrcat(newt, new);
 615     newt += newlen;
 616     remlen = s - (sprev + end);
 617     if (remlen > 0)
 618       {
 619       Ustrncpy(newt, sprev + end, remlen);
 620       newt += remlen;
 621       *newt = 0;
 622       }
 623
 624     /* Must check that there isn't a newline here anyway; in particular, there
 625     will be one at the very end of the header, where we DON'T want to insert
 626     another one! The pointer s has been skipped over white space, so just
 627     look back to see if the last non-space-or-tab was a newline. */
 628
 629     if (newlen > oldlen && newt - newtstart - lastnewline > 40)
 630       {
 631       uschar *p = s - 1;
 632       while (p >= prev->text && (*p == ' ' || *p == '\t')) p--;
 633       if (*p != '\n')
 634         {
 635         lastnewline = newt - newtstart;
 636         Ustrcat(newt, US"\n\t");
 637         slen += 2;
 638         }
 639       }
 640
 641     /* Finally, the remaining unprocessed addresses, if any. */
 642
 643     Ustrcat(newt, s);
 644
 645     DEBUG(D_rewrite) debug_printf("newlen=%d newtype=%c newtext:\n%s",
 646       slen, type, newtstart);
 647
 648     /* Compute the length of the rest of the header line before we possibly
 649     flatten a previously rewritten copy. */
 650
 651     remlen = (s - prev->text) - oldlen + newlen;
 652
 653     /* We have the new text in a malloc block. That enables us to release all
 654     the memory that has been used, back to the point at which the function was
 655     entered. Then set up a new header in dynamic store. This will override a
 656     rewritten copy from a previous time round this loop. */
 657
 658     store_reset(function_reset_point);
 659     function_reset_point = store_mark();
 660     newh = store_get(sizeof(header_line), FALSE);
 661     newh->type = type;
 662     newh->slen = slen;
 663     newh->text = string_copyn(newtstart, slen);
 664
 665     /* Set up for scanning the rest of the header */
 666
 667     s = newh->text + remlen;
 668     DEBUG(D_rewrite) debug_printf("remainder: %s", (*s == 0)? US"\n" : s);
 669     }
 670   }
 671
 672 f.parse_allow_group = FALSE;  /* Reset group flags */
 673 f.parse_found_group = FALSE;
 674
 675 /* If a rewrite happened and "replace" is true, put the new header into the
 676 chain following the old one, and mark the old one as replaced. */
 677
 678 if (newh != NULL && replace)
 679   {
 680   newh->next = h->next;
 681   if (newh->next == NULL) header_last = newh;
 682   h->type = htype_old;
 683   h->next = newh;
 684   }
 685
 686 return newh;
 687 }
 688
 689
 690
 691
 692 /*************************************************
 693 *              Rewrite a header line             *
 694 *************************************************/
 695
 696 /* This function may be passed any old header line. It must detect those which
 697 contain addresses, then then apply any rewriting rules that apply. If
 698 routed_old is NULL, only the configured rewriting rules are consulted.
 699 Otherwise, the rewriting rule is "change routed_old into routed_new", and it
 700 applies to all header lines that contain addresses. Then header-specific
 701 rewriting rules are applied.
 702
 703 The old header line is flagged as "old". Old headers are saved on the spool for
 704 debugging but are never sent to any recipients.
 705
 706 Arguments:
 707   h              header line to rewrite
 708   routed_old     if not NULL, this is a rewrite caused by a router, changing
 709                    this domain into routed_new
 710   routed_new     new routed domain if routed_old is not NULL
 711   rewrite_rules  points to chain of rewrite rules
 712   existflags     bits indicating which rewrites exist
 713   replace        if TRUE, the new header is inserted into the header chain
 714                     after the old one, and the old one is marked replaced
 715
 716 Returns:         NULL if header unchanged; otherwise the rewritten header
 717 */
 718
 719 header_line *
 720 rewrite_header(header_line *h,
 721   const uschar *routed_old, const uschar *routed_new,
 722   rewrite_rule *rewrite_rules, int existflags, BOOL replace)
 723 {
 724 int flag;
 725 switch (h->type)
 726   {
 727   case htype_sender:    flag = rewrite_sender;  break;
 728   case htype_from:      flag = rewrite_from;    break;
 729   case htype_to:        flag = rewrite_to;      break;
 730   case htype_cc:        flag = rewrite_cc;      break;
 731   case htype_bcc:       flag = rewrite_bcc;     break;
 732   case htype_reply_to:  flag = rewrite_replyto; break;
 733   default:              return NULL;
 734   }
 735 return rewrite_one_header(h, flag, routed_old, routed_new,
 736   rewrite_rules, existflags, replace);
 737 }
 738
 739
 740
 741 /************************************************
 742 *            Test rewriting rules               *
 743 ************************************************/
 744
 745 /* Called from the mainline as a result of the -brw option. Test the
 746 address for all possible cases.
 747
 748 Argument: the address to test
 749 Returns:  nothing
 750 */
 751
 752 void rewrite_test(uschar *s)
 753 {
 754 uschar *recipient, *error;
 755 int start, end, domain;
 756 BOOL done_smtp = FALSE;
 757
 758 if (rewrite_existflags == 0)
 759   {
 760   printf("No rewrite rules are defined\n");
 761   return;
 762   }
 763
 764 /* Do SMTP rewrite only if a rule with the S flag exists. Allow <> by
 765 pretending it is a sender. */
 766
 767 if ((rewrite_existflags & rewrite_smtp) != 0)
 768   {
 769   uschar *new = rewrite_one(s, rewrite_smtp|rewrite_smtp_sender, NULL, FALSE,
 770     US"", global_rewrite_rules);
 771   if (new != s)
 772     {
 773     if (*new == 0)
 774       printf("    SMTP: <>\n");
 775     else
 776       printf("    SMTP: %s\n", new);
 777     done_smtp = TRUE;
 778     }
 779   }
 780
 781 /* Do the other rewrites only if a rule without the S flag exists */
 782
 783 if ((rewrite_existflags & ~rewrite_smtp) == 0) return;
 784
 785 /* Qualify if necessary before extracting the address */
 786
 787 if (parse_find_at(s) == NULL)
 788   s = string_sprintf("%s@%s", s, qualify_domain_recipient);
 789
 790 recipient = parse_extract_address(s, &error, &start, &end, &domain, FALSE);
 791
 792 if (!recipient)
 793   {
 794   if (!done_smtp)
 795     printf("Syntax error in %s\n%c%s\n", s, toupper(error[0]), error+1);
 796   return;
 797   }
 798
 799 for (int i = 0; i < 8; i++)
 800   {
 801   BOOL whole = FALSE;
 802   int flag = 1 << i;
 803   uschar *new = rewrite_one(recipient, flag, &whole, FALSE, US"",
 804     global_rewrite_rules);
 805   printf("%s: ", rrname[i]);
 806   if (*new == 0)
 807     printf("<>\n");
 808   else if (whole || (flag & rewrite_all_headers) == 0)
 809     printf("%s\n", CS new);
 810   else printf("%.*s%s%s\n", start, s, new, s+end);
 811   }
 812 }
 813
 814 /* End of rewrite.c */