(standard crypt does 25 rounds). It then crypts the next 8 characters,
or an empty block if the password is less than 9 characters, using a
20-round version of crypt and the same salt as was used for the first
-block. Charaters after the first 16 are ignored. It always generates
+block. Characters after the first 16 are ignored. It always generates
a 16-byte hash, which is expressed together with the salt as a string
of 24 base 64 digits. Here are some links to peruse:
static uschar *op_table_main[] = {
US"address",
US"addresses",
+ US"base32",
+ US"base32d",
US"base62",
US"base62d",
US"base64",
US"base64d",
US"domain",
US"escape",
+ US"escape8bit",
US"eval",
US"eval10",
US"expand",
US"s",
US"sha1",
US"sha256",
+ US"sha3",
US"stat",
US"str2b64",
US"strlen",
enum {
EOP_ADDRESS = nelem(op_table_underscore),
EOP_ADDRESSES,
+ EOP_BASE32,
+ EOP_BASE32D,
EOP_BASE62,
EOP_BASE62D,
EOP_BASE64,
EOP_BASE64D,
EOP_DOMAIN,
EOP_ESCAPE,
+ EOP_ESCAPE8BIT,
EOP_EVAL,
EOP_EVAL10,
EOP_EXPAND,
EOP_S,
EOP_SHA1,
EOP_SHA256,
+ EOP_SHA3,
EOP_STAT,
EOP_STR2B64,
EOP_STRLEN,
{ "prvscheck_result", vtype_stringptr, &prvscheck_result },
{ "qualify_domain", vtype_stringptr, &qualify_domain_sender },
{ "qualify_recipient", vtype_stringptr, &qualify_domain_recipient },
+ { "queue_name", vtype_stringptr, &queue_name },
{ "rcpt_count", vtype_int, &rcpt_count },
{ "rcpt_defer_count", vtype_int, &rcpt_defer_count },
{ "rcpt_fail_count", vtype_int, &rcpt_fail_count },
}
+
+static uschar * base32_chars = US"abcdefghijklmnopqrstuvwxyz234567";
+
/*************************************************
* Binary chop search on a table *
*************************************************/
int size = 0;
header_line *h;
- for (h = header_list; size < header_insert_maxlen && h != NULL; h = h->next)
- {
- if (h->type != htype_old && h->text != NULL) /* NULL => Received: placeholder */
- {
- if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0))
+ for (h = header_list; size < header_insert_maxlen && h; h = h->next)
+ if (h->type != htype_old && h->text) /* NULL => Received: placeholder */
+ if (!name || (len <= h->slen && strncmpic(name, h->text, len) == 0))
{
int ilen;
uschar *t;
that contains an address list, except when asked for raw headers. Only
need to do this once. */
- if (!want_raw && name != NULL && comma == 0 &&
+ if (!want_raw && name && comma == 0 &&
Ustrchr("BCFRST", h->type) != NULL)
comma = 1;
size += ilen + comma + 1; /* +1 for the newline */
- /* Second pass - concatentate the data, up to a maximum. Note that
+ /* Second pass - concatenate the data, up to a maximum. Note that
the loop stops when size hits the limit. */
if (i != 0)
}
}
}
- }
- }
/* At end of first pass, return NULL if no header found. Then truncate size
if necessary, and get the buffer to hold the data, returning the buffer size.
/* That's all we do for raw header expansion. */
if (want_raw)
- {
*ptr = 0;
- }
/* Otherwise, remove a final newline and a redundant added comma. Then we do
RFC 2047 decoding, translating the charset if requested. The rfc2047_decode2()
+
/*************************************************
* Read and expand substrings *
*************************************************/
}
DEBUG(D_expand)
- debug_printf("expanding: acl: %s arg: %s%s\n",
+ debug_printf_indent("expanding: acl: %s arg: %s%s\n",
sub[0],
acl_narg>0 ? acl_arg[0] : US"<none>",
acl_narg>1 ? " +more" : "");
checking for them individually. */
if (!isalpha(name[0]) && yield != NULL)
- {
if (sub[i][0] == 0)
{
num[i] = 0;
DEBUG(D_expand)
- debug_printf("empty string cast to zero for numerical comparison\n");
+ debug_printf_indent("empty string cast to zero for numerical comparison\n");
}
else
{
num[i] = expanded_string_integer(sub[i], FALSE);
if (expand_string_message != NULL) return NULL;
}
- }
}
/* Result not required */
uschar digest[16];
md5_start(&base);
- md5_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
+ md5_end(&base, sub[0], Ustrlen(sub[0]), digest);
/* If the length that we are comparing against is 24, the MD5 digest
is expressed as a base64 string. This is the way LDAP does it. However,
if (sublen == 24)
{
- uschar *coded = b64encode((uschar *)digest, 16);
+ uschar *coded = b64encode(digest, 16);
DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
" subject=%s\n crypted=%s\n", coded, sub[1]+5);
tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
{
int sublen = Ustrlen(sub[1]+6);
- sha1 base;
+ hctx h;
uschar digest[20];
- sha1_start(&base);
- sha1_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest);
+ sha1_start(&h);
+ sha1_end(&h, sub[0], Ustrlen(sub[0]), digest);
/* If the length that we are comparing against is 28, assume the SHA1
digest is expressed as a base64 string. If the length is 40, assume a
if (sublen == 28)
{
- uschar *coded = b64encode((uschar *)digest, 20);
+ uschar *coded = b64encode(digest, 20);
DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
" subject=%s\n crypted=%s\n", coded, sub[1]+6);
tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
uschar *save_iterate_item = iterate_item;
int (*compare)(const uschar *, const uschar *);
- DEBUG(D_expand) debug_printf("condition: %s\n", name);
+ DEBUG(D_expand) debug_printf_indent("condition: %s\n", name);
tempcond = FALSE;
compare = cond_type == ECOND_INLISTI
int sep = 0;
uschar *save_iterate_item = iterate_item;
- DEBUG(D_expand) debug_printf("condition: %s\n", name);
+ DEBUG(D_expand) debug_printf_indent("condition: %s\n", name);
while (isspace(*s)) s++;
if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
list = sub[0];
while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL)
{
- DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
+ DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, iterate_item);
if (!eval_condition(sub[1], resetok, &tempcond))
{
expand_string_message = string_sprintf("%s inside \"%s\" condition",
iterate_item = save_iterate_item;
return NULL;
}
- DEBUG(D_expand) debug_printf("%s: condition evaluated to %s\n", name,
+ DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", name,
tempcond? "true":"false");
if (yield != NULL) *yield = (tempcond == testfor);
}
}
DEBUG(D_expand)
- debug_printf("considering %s: %s\n", ourname, len ? t : US"<empty>");
+ debug_printf_indent("considering %s: %s\n", ourname, len ? t : US"<empty>");
/* logic for the lax case from expand_check_condition(), which also does
expands, and the logic is both short and stable enough that there should
be no maintenance burden from replicating it. */
"value \"%s\"", t);
return NULL;
}
+ DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", ourname,
+ boolvalue? "true":"false");
if (yield != NULL) *yield = (boolvalue == testfor);
return s;
}
{
if (type[0] == 'i')
{
- if (yes) *yieldptr = string_catn(*yieldptr, sizeptr, ptrptr, US"true", 4);
+ if (yes && !skipping)
+ *yieldptr = string_catn(*yieldptr, sizeptr, ptrptr, US"true", 4);
}
else
{
- if (yes && lookup_value)
+ if (yes && lookup_value && !skipping)
*yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value);
lookup_value = save_lookup;
}
if (type == HMAC_MD5)
md5_start((md5 *)base);
else
- sha1_start((sha1 *)base);
+ sha1_start((hctx *)base);
}
static void
if (type == HMAC_MD5)
md5_mid((md5 *)base, string);
else
- sha1_mid((sha1 *)base, string);
+ sha1_mid((hctx *)base, string);
}
static void
if (type == HMAC_MD5)
md5_end((md5 *)base, string, length, digest);
else
- sha1_end((sha1 *)base, string, length, digest);
+ sha1_end((hctx *)base, string, length, digest);
}
{
uschar *hash_source, *p;
int size = 0,offset = 0,i;
-sha1 sha1_base;
-void *use_base = &sha1_base;
+hctx h;
uschar innerhash[20];
uschar finalhash[20];
uschar innerkey[64];
hash_source = string_cat(hash_source, &size, &offset, address);
hash_source[offset] = '\0';
-DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source);
+DEBUG(D_expand) debug_printf_indent("prvs: hash source is '%s'\n", hash_source);
memset(innerkey, 0x36, 64);
memset(outerkey, 0x5c, 64);
outerkey[i] ^= key[i];
}
-chash_start(HMAC_SHA1, use_base);
-chash_mid(HMAC_SHA1, use_base, innerkey);
-chash_end(HMAC_SHA1, use_base, hash_source, offset, innerhash);
+chash_start(HMAC_SHA1, &h);
+chash_mid(HMAC_SHA1, &h, innerkey);
+chash_end(HMAC_SHA1, &h, hash_source, offset, innerhash);
-chash_start(HMAC_SHA1, use_base);
-chash_mid(HMAC_SHA1, use_base, outerkey);
-chash_end(HMAC_SHA1, use_base, innerhash, 20, finalhash);
+chash_start(HMAC_SHA1, &h);
+chash_mid(HMAC_SHA1, &h, outerkey);
+chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
p = finalhash_hex;
for (i = 0; i < 3; i++)
static uschar *
cat_file(FILE *f, uschar *yield, int *sizep, int *ptrp, uschar *eol)
{
-int eollen = eol ? Ustrlen(eol) : 0;
uschar buffer[1024];
while (Ufgets(buffer, sizeof(buffer), f))
int len = Ustrlen(buffer);
if (eol && buffer[len-1] == '\n') len--;
yield = string_catn(yield, sizep, ptrp, buffer, len);
- if (buffer[len] != 0)
- yield = string_catn(yield, sizep, ptrp, eol, eollen);
+ if (eol && buffer[len])
+ yield = string_cat(yield, sizep, ptrp, eol);
}
if (yield) yield[*ptrp] = 0;
/* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
* a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
* is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where
- * -N*M is INT_MIN will yielf INT_MIN.
+ * -N*M is INT_MIN will yield INT_MIN.
* Since we don't support floating point, this is somewhat simpler.
* Ideally, we'd return an error, but since we overflow for all other
* arithmetic, consistency suggests otherwise, but what's the correct value
We use an internal routine recursively to handle embedded substrings. The
external function follows. The yield is NULL if the expansion failed, and there
are two cases: if something collapsed syntactically, or if "fail" was given
-as the action on a lookup failure. These can be distinguised by looking at the
+as the action on a lookup failure. These can be distinguished by looking at the
variable expand_string_forcedfail, which is TRUE in the latter case.
The skipping flag is set true when expanding a substring that isn't actually
int save_expand_nlength[EXPAND_MAXN+1];
BOOL resetok = TRUE;
+expand_level++;
DEBUG(D_expand)
- debug_printf("%s: %s\n", skipping ? " scanning" : "considering", string);
+ debug_printf_indent(UTF8_DOWN_RIGHT "%s: %s\n",
+ skipping
+ ? UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ "scanning"
+ : "considering",
+ string);
expand_string_forcedfail = FALSE;
expand_string_message = US"";
case OK:
case FAIL:
DEBUG(D_expand)
- debug_printf("acl expansion yield: %s\n", user_msg);
+ debug_printf_indent("acl expansion yield: %s\n", user_msg);
if (user_msg)
yield = string_cat(yield, &size, &ptr, user_msg);
continue;
save_expand_strings(save_expand_nstring, save_expand_nlength);
while (isspace(*s)) s++;
- next_s = eval_condition(s, &resetok, skipping? NULL : &cond);
+ next_s = eval_condition(s, &resetok, skipping ? NULL : &cond);
if (next_s == NULL) goto EXPAND_FAILED; /* message already set */
DEBUG(D_expand)
- debug_printf("condition: %.*s\n result: %s\n", (int)(next_s - s), s,
- cond? "true" : "false");
+ {
+ debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
+ "condition: %.*s\n",
+ (int)(next_s - s), s);
+ debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
+ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
+ "result: %s\n",
+ cond ? "true" : "false");
+ }
s = next_s;
goto EXPAND_FAILED;
}
- if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
- sub_arg[1][0], sub_arg[2], &expand_string_message)))
- goto EXPAND_FAILED;
if (!skipping)
+ {
+ if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
+ sub_arg[1][0], sub_arg[2], &expand_string_message)))
+ goto EXPAND_FAILED;
yield = string_cat(yield, &size, &ptr, encoded);
+ }
continue;
}
#endif
uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]);
uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]);
- DEBUG(D_expand) debug_printf("prvscheck localpart: %s\n", local_part);
- DEBUG(D_expand) debug_printf("prvscheck key number: %s\n", key_num);
- DEBUG(D_expand) debug_printf("prvscheck daystamp: %s\n", daystamp);
- DEBUG(D_expand) debug_printf("prvscheck hash: %s\n", hash);
- DEBUG(D_expand) debug_printf("prvscheck domain: %s\n", domain);
+ DEBUG(D_expand) debug_printf_indent("prvscheck localpart: %s\n", local_part);
+ DEBUG(D_expand) debug_printf_indent("prvscheck key number: %s\n", key_num);
+ DEBUG(D_expand) debug_printf_indent("prvscheck daystamp: %s\n", daystamp);
+ DEBUG(D_expand) debug_printf_indent("prvscheck hash: %s\n", hash);
+ DEBUG(D_expand) debug_printf_indent("prvscheck domain: %s\n", domain);
/* Set up expansion variables */
prvscheck_address = string_cat (NULL, &mysize, &myptr, local_part);
goto EXPAND_FAILED;
}
- DEBUG(D_expand) debug_printf("prvscheck: received hash is %s\n", hash);
- DEBUG(D_expand) debug_printf("prvscheck: own hash is %s\n", p);
+ DEBUG(D_expand) debug_printf_indent("prvscheck: received hash is %s\n", hash);
+ DEBUG(D_expand) debug_printf_indent("prvscheck: own hash is %s\n", p);
if (Ustrcmp(p,hash) == 0)
{
if (iexpire >= inow)
{
prvscheck_result = US"1";
- DEBUG(D_expand) debug_printf("prvscheck: success, $pvrs_result set to 1\n");
+ DEBUG(D_expand) debug_printf_indent("prvscheck: success, $pvrs_result set to 1\n");
}
else
{
prvscheck_result = NULL;
- DEBUG(D_expand) debug_printf("prvscheck: signature expired, $pvrs_result unset\n");
+ DEBUG(D_expand) debug_printf_indent("prvscheck: signature expired, $pvrs_result unset\n");
}
}
else
{
prvscheck_result = NULL;
- DEBUG(D_expand) debug_printf("prvscheck: hash failure, $pvrs_result unset\n");
+ DEBUG(D_expand) debug_printf_indent("prvscheck: hash failure, $pvrs_result unset\n");
}
/* Now expand the final argument. We leave this till now so that
prvscheck_keynum = NULL;
}
else
- {
/* Does not look like a prvs encoded address, return the empty string.
We need to make sure all subs are expanded first, so as to skip over
the entire item. */
case 2:
case 3: goto EXPAND_FAILED;
}
- }
continue;
}
struct sockaddr_un sockun; /* don't call this "sun" ! */
uschar *arg;
uschar *sub_arg[4];
+ BOOL do_shutdown = TRUE;
- if ((expand_forbid & RDO_READSOCK) != 0)
+ if (expand_forbid & RDO_READSOCK)
{
expand_string_message = US"socket insertions are not permitted";
goto EXPAND_FAILED;
case 3: goto EXPAND_FAILED;
}
- /* Sort out timeout, if given */
+ /* Sort out timeout, if given. The second arg is a list with the first element
+ being a time value. Any more are options of form "name=value". Currently the
+ only option recognised is "shutdown". */
- if (sub_arg[2] != NULL)
+ if (sub_arg[2])
{
- timeout = readconf_readtime(sub_arg[2], 0, FALSE);
- if (timeout < 0)
+ const uschar * list = sub_arg[2];
+ uschar * item;
+ int sep = 0;
+
+ item = string_nextinlist(&list, &sep, NULL, 0);
+ if ((timeout = readconf_readtime(item, 0, FALSE)) < 0)
{
- expand_string_message = string_sprintf("bad time value %s",
- sub_arg[2]);
+ expand_string_message = string_sprintf("bad time value %s", item);
goto EXPAND_FAILED;
}
+
+ while ((item = string_nextinlist(&list, &sep, NULL, 0)))
+ if (Ustrncmp(item, US"shutdown=", 9) == 0)
+ if (Ustrcmp(item + 9, US"no") == 0)
+ do_shutdown = FALSE;
}
else sub_arg[3] = NULL; /* No eol if no timeout */
port = ntohs(service_info->s_port);
}
- if ((fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
- timeout, NULL, &expand_string_message)) < 0)
+ fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
+ timeout, NULL, &expand_string_message);
+ callout_address = NULL;
+ if (fd < 0)
goto SOCK_FAIL;
}
}
}
- DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]);
+ DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
/* Allow sequencing of test actions */
if (running_in_test_harness) millisleep(100);
if (sub_arg[1][0] != 0)
{
int len = Ustrlen(sub_arg[1]);
- DEBUG(D_expand) debug_printf("writing \"%s\" to socket\n",
+ DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
sub_arg[1]);
if (write(fd, sub_arg[1], len) != len)
{
recognise that it is their turn to do some work. Just in case some
system doesn't have this function, make it conditional. */
- #ifdef SHUT_WR
- shutdown(fd, SHUT_WR);
- #endif
+#ifdef SHUT_WR
+ if (do_shutdown) shutdown(fd, SHUT_WR);
+#endif
if (running_in_test_harness) millisleep(100);
while (isspace(*s)) s++;
}
- readsock_done:
+ READSOCK_DONE:
if (*s++ != '}')
{
expand_string_message = US"missing '}' closing readsocket";
socket, or timeout on reading. If another substring follows, expand and
use it. Otherwise, those conditions give expand errors. */
- SOCK_FAIL:
+ SOCK_FAIL:
if (*s != '{') goto EXPAND_FAILED;
DEBUG(D_any) debug_printf("%s\n", expand_string_message);
if (!(arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok)))
goto EXPAND_FAILED_CURLY;
}
while (isspace(*s)) s++;
- goto readsock_done;
+ goto READSOCK_DONE;
}
/* Handle "run" to execute a program. */
}
if (skipping) /* Just pretend it worked when we're skipping */
+ {
runrc = 0;
+ lookup_value = NULL;
+ }
else
{
if (!transport_set_up_command(&argv, /* anchor for arg list */
return code for serious disasters. Simple non-zero returns are passed on.
*/
- if (sigalrm_seen == TRUE || (runrc = child_close(pid, 30)) < 0)
+ if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0)
{
- if (sigalrm_seen == TRUE || runrc == -256)
+ if (sigalrm_seen || runrc == -256)
{
expand_string_message = string_sprintf("command timed out");
killpg(pid, SIGKILL); /* Kill the whole process group */
{
uschar *sub[3];
md5 md5_base;
- sha1 sha1_base;
+ hctx sha1_ctx;
void *use_base;
int type, i;
int hashlen; /* Number of octets for the hash algorithm's output */
case 3: goto EXPAND_FAILED;
}
- if (Ustrcmp(sub[0], "md5") == 0)
- {
- type = HMAC_MD5;
- use_base = &md5_base;
- hashlen = 16;
- hashblocklen = 64;
- }
- else if (Ustrcmp(sub[0], "sha1") == 0)
- {
- type = HMAC_SHA1;
- use_base = &sha1_base;
- hashlen = 20;
- hashblocklen = 64;
- }
- else
- {
- expand_string_message =
- string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
- goto EXPAND_FAILED;
- }
+ if (!skipping)
+ {
+ if (Ustrcmp(sub[0], "md5") == 0)
+ {
+ type = HMAC_MD5;
+ use_base = &md5_base;
+ hashlen = 16;
+ hashblocklen = 64;
+ }
+ else if (Ustrcmp(sub[0], "sha1") == 0)
+ {
+ type = HMAC_SHA1;
+ use_base = &sha1_ctx;
+ hashlen = 20;
+ hashblocklen = 64;
+ }
+ else
+ {
+ expand_string_message =
+ string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
+ goto EXPAND_FAILED;
+ }
- keyptr = sub[1];
- keylen = Ustrlen(keyptr);
+ keyptr = sub[1];
+ keylen = Ustrlen(keyptr);
- /* If the key is longer than the hash block length, then hash the key
- first */
+ /* If the key is longer than the hash block length, then hash the key
+ first */
- if (keylen > hashblocklen)
- {
- chash_start(type, use_base);
- chash_end(type, use_base, keyptr, keylen, keyhash);
- keyptr = keyhash;
- keylen = hashlen;
- }
+ if (keylen > hashblocklen)
+ {
+ chash_start(type, use_base);
+ chash_end(type, use_base, keyptr, keylen, keyhash);
+ keyptr = keyhash;
+ keylen = hashlen;
+ }
- /* Now make the inner and outer key values */
+ /* Now make the inner and outer key values */
- memset(innerkey, 0x36, hashblocklen);
- memset(outerkey, 0x5c, hashblocklen);
+ memset(innerkey, 0x36, hashblocklen);
+ memset(outerkey, 0x5c, hashblocklen);
- for (i = 0; i < keylen; i++)
- {
- innerkey[i] ^= keyptr[i];
- outerkey[i] ^= keyptr[i];
- }
+ for (i = 0; i < keylen; i++)
+ {
+ innerkey[i] ^= keyptr[i];
+ outerkey[i] ^= keyptr[i];
+ }
- /* Now do the hashes */
+ /* Now do the hashes */
- chash_start(type, use_base);
- chash_mid(type, use_base, innerkey);
- chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
+ chash_start(type, use_base);
+ chash_mid(type, use_base, innerkey);
+ chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
- chash_start(type, use_base);
- chash_mid(type, use_base, outerkey);
- chash_end(type, use_base, innerhash, hashlen, finalhash);
+ chash_start(type, use_base);
+ chash_mid(type, use_base, outerkey);
+ chash_end(type, use_base, innerhash, hashlen, finalhash);
- /* Encode the final hash as a hex string */
+ /* Encode the final hash as a hex string */
- p = finalhash_hex;
- for (i = 0; i < hashlen; i++)
- {
- *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
- *p++ = hex_digits[finalhash[i] & 0x0f];
- }
+ p = finalhash_hex;
+ for (i = 0; i < hashlen; i++)
+ {
+ *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
+ *p++ = hex_digits[finalhash[i] & 0x0f];
+ }
- DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%.*s)=%.*s\n", sub[0],
- (int)keylen, keyptr, Ustrlen(sub[2]), sub[2], hashlen*2, finalhash_hex);
+ DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n",
+ sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex);
- yield = string_catn(yield, &size, &ptr, finalhash_hex, hashlen*2);
+ yield = string_catn(yield, &size, &ptr, finalhash_hex, hashlen*2);
+ }
+ continue;
}
- continue;
-
/* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
We have to save the numerical variables and restore them afterwards. */
/* While skipping we cannot rely on the data for expansions being
available (eg. $item) hence cannot decide on numeric vs. keyed.
- Read a maximum of 5 arguments (inclding the yes/no) */
+ Read a maximum of 5 arguments (including the yes/no) */
if (skipping)
{
processing for real, we perform the iteration. */
if (skipping) continue;
- while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL)
+ while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
{
*outsep = (uschar)sep; /* Separator as a string */
- DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item);
+ DEBUG(D_expand) debug_printf_indent("%s: $item = '%s' $value = '%s'\n",
+ name, iterate_item, lookup_value);
if (item_type == EITEM_FILTER)
{
expand_string_message, name);
goto EXPAND_FAILED;
}
- DEBUG(D_expand) debug_printf("%s: condition is %s\n", name,
+ DEBUG(D_expand) debug_printf_indent("%s: condition is %s\n", name,
condresult? "true":"false");
if (condresult)
temp = iterate_item; /* TRUE => include this item */
uschar * newkeylist = NULL;
uschar * srcfield;
- DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, srcitem);
+ DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
/* extract field for comparisons */
iterate_item = srcitem;
/* build and run condition string */
expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield);
- DEBUG(D_expand) debug_printf("%s: cond = \"%s\"\n", name, expr);
+ DEBUG(D_expand) debug_printf_indent("%s: cond = \"%s\"\n", name, expr);
if (!eval_condition(expr, &resetok, &before))
{
expand_string_message = string_sprintf("comparison in sort: %s",
dstlist = newlist;
dstkeylist = newkeylist;
- DEBUG(D_expand) debug_printf("%s: dstlist = \"%s\"\n", name, dstlist);
- DEBUG(D_expand) debug_printf("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
+ DEBUG(D_expand) debug_printf_indent("%s: dstlist = \"%s\"\n", name, dstlist);
+ DEBUG(D_expand) debug_printf_indent("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
}
if (dstlist)
switch(c)
{
+ case EOP_BASE32:
+ {
+ uschar *t;
+ unsigned long int n = Ustrtoul(sub, &t, 10);
+ uschar * s = NULL;
+ int sz = 0, i = 0;
+
+ if (*t != 0)
+ {
+ expand_string_message = string_sprintf("argument for base32 "
+ "operator is \"%s\", which is not a decimal number", sub);
+ goto EXPAND_FAILED;
+ }
+ for ( ; n; n >>= 5)
+ s = string_catn(s, &sz, &i, &base32_chars[n & 0x1f], 1);
+
+ while (i > 0) yield = string_catn(yield, &size, &ptr, &s[--i], 1);
+ continue;
+ }
+
+ case EOP_BASE32D:
+ {
+ uschar *tt = sub;
+ unsigned long int n = 0;
+ uschar * s;
+ while (*tt)
+ {
+ uschar * t = Ustrchr(base32_chars, *tt++);
+ if (t == NULL)
+ {
+ expand_string_message = string_sprintf("argument for base32d "
+ "operator is \"%s\", which is not a base 32 number", sub);
+ goto EXPAND_FAILED;
+ }
+ n = n * 32 + (t - base32_chars);
+ }
+ s = string_sprintf("%ld", n);
+ yield = string_cat(yield, &size, &ptr, s);
+ continue;
+ }
+
case EOP_BASE62:
{
uschar *t;
else
#endif
{
- sha1 base;
+ hctx h;
uschar digest[20];
int j;
char st[41];
- sha1_start(&base);
- sha1_end(&base, sub, Ustrlen(sub), digest);
+ sha1_start(&h);
+ sha1_end(&h, sub, Ustrlen(sub), digest);
for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
- yield = string_cat(yield, &size, &ptr, US st);
+ yield = string_catn(yield, &size, &ptr, US st, 40);
}
continue;
case EOP_SHA256:
-#ifdef SUPPORT_TLS
+#ifdef EXIM_HAVE_SHA2
if (vp && *(void **)vp->value)
{
uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
yield = string_cat(yield, &size, &ptr, cp);
}
else
+ {
+ hctx h;
+ blob b;
+ char st[3];
+
+ if (!exim_sha_init(&h, HASH_SHA256))
+ {
+ expand_string_message = US"unrecognised sha256 variant";
+ goto EXPAND_FAILED;
+ }
+ exim_sha_update(&h, sub, Ustrlen(sub));
+ exim_sha_finish(&h, &b);
+ while (b.len-- > 0)
+ {
+ sprintf(st, "%02X", *b.data++);
+ yield = string_catn(yield, &size, &ptr, US st, 2);
+ }
+ }
+#else
+ expand_string_message = US"sha256 only supported with TLS";
#endif
- expand_string_message = US"sha256 only supported for certificates";
continue;
+ case EOP_SHA3:
+#ifdef EXIM_HAVE_SHA3
+ {
+ hctx h;
+ blob b;
+ char st[3];
+ hashmethod m = !arg ? HASH_SHA3_256
+ : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224
+ : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256
+ : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384
+ : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512
+ : HASH_BADTYPE;
+
+ if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
+ {
+ expand_string_message = US"unrecognised sha3 variant";
+ goto EXPAND_FAILED;
+ }
+
+ exim_sha_update(&h, sub, Ustrlen(sub));
+ exim_sha_finish(&h, &b);
+ while (b.len-- > 0)
+ {
+ sprintf(st, "%02X", *b.data++);
+ yield = string_catn(yield, &size, &ptr, US st, 2);
+ }
+ }
+ continue;
+#else
+ expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 +";
+ goto EXPAND_FAILED;
+#endif
+
/* Convert hex encoding to base64 encoding */
case EOP_HEX2B64:
case EOP_LOCAL_PART:
case EOP_DOMAIN:
{
- uschar *error;
+ uschar * error;
int start, end, domain;
- uschar *t = parse_extract_address(sub, &error, &start, &end, &domain,
+ uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
FALSE);
- if (t != NULL)
- {
+ if (t)
if (c != EOP_DOMAIN)
{
if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1;
domain += start;
yield = string_catn(yield, &size, &ptr, sub+domain, end-domain);
}
- }
continue;
}
goto EXPAND_FAILED;
}
yield = string_cat(yield, &size, &ptr, s);
- DEBUG(D_expand) debug_printf("yield: '%s'\n", yield);
+ DEBUG(D_expand) debug_printf_indent("yield: '%s'\n", yield);
continue;
}
case EOP_ESCAPE:
{
- const uschar *t = string_printing(sub);
+ const uschar * t = string_printing(sub);
yield = string_cat(yield, &size, &ptr, t);
continue;
}
+ case EOP_ESCAPE8BIT:
+ {
+ const uschar * s = sub;
+ uschar c;
+
+ for (s = sub; (c = *s); s++)
+ yield = c < 127 && c != '\\'
+ ? string_catn(yield, &size, &ptr, s, 1)
+ : string_catn(yield, &size, &ptr, string_sprintf("\\%03o", c), 4);
+ continue;
+ }
+
/* Handle numeric expression evaluation */
case EOP_EVAL:
yield = NULL;
size = 0;
}
- value = find_variable(name, FALSE, skipping, &newsize);
- if (value == NULL)
+ if (!(value = find_variable(name, FALSE, skipping, &newsize)))
{
expand_string_message =
string_sprintf("unknown variable in \"${%s}\"", name);
goto EXPAND_FAILED;
}
len = Ustrlen(value);
- if (yield == NULL && newsize != 0)
+ if (!yield && newsize)
{
yield = value;
size = newsize;
ptr = len;
}
- else yield = string_catn(yield, &size, &ptr, value, len);
+ else
+ yield = string_catn(yield, &size, &ptr, value, len);
continue;
}
DEBUG(D_expand)
{
- debug_printf(" expanding: %.*s\n result: %s\n", (int)(s - string), string,
+ debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
+ "expanding: %.*s\n",
+ (int)(s - string), string);
+ debug_printf_indent("%s"
+ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
+ "result: %s\n",
+ skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
yield);
- if (skipping) debug_printf(" skipping: result is not used\n");
+ if (skipping)
+ debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
+ "skipping: result is not used\n");
}
+expand_level--;
return yield;
/* This is the failure exit: easiest to program with a goto. We still need
if (left != NULL) *left = s;
DEBUG(D_expand)
{
- debug_printf("failed to expand: %s\n", string);
- debug_printf(" error message: %s\n", expand_string_message);
- if (expand_string_forcedfail) debug_printf("failure was forced\n");
+ debug_printf_indent(UTF8_VERT_RIGHT "failed to expand: %s\n",
+ string);
+ debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
+ "error message: %s\n",
+ expand_string_forcedfail ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
+ expand_string_message);
+ if (expand_string_forcedfail)
+ debug_printf_indent(UTF8_UP_RIGHT "failure was forced\n");
}
if (resetok_p) *resetok_p = resetok;
+expand_level--;
return NULL;
}
if (*s == '\0')
{
DEBUG(D_expand)
- debug_printf("treating blank string as number 0\n");
+ debug_printf_indent("treating blank string as number 0\n");
return 0;
}
}
+/* Avoid potentially exposing a password in a string about to be logged */
+
+uschar *
+expand_hide_passwords(uschar * s)
+{
+return ( ( Ustrstr(s, "failed to expand") != NULL
+ || Ustrstr(s, "expansion of ") != NULL
+ )
+ && ( Ustrstr(s, "mysql") != NULL
+ || Ustrstr(s, "pgsql") != NULL
+ || Ustrstr(s, "redis") != NULL
+ || Ustrstr(s, "sqlite") != NULL
+ || Ustrstr(s, "ldap:") != NULL
+ || Ustrstr(s, "ldaps:") != NULL
+ || Ustrstr(s, "ldapi:") != NULL
+ || Ustrstr(s, "ldapdn:") != NULL
+ || Ustrstr(s, "ldapm:") != NULL
+ ) )
+ ? US"Temporary internal error" : s;
+}
+
+
+
+/*************************************************
+* Error-checking for testsuite *
+*************************************************/
+typedef struct {
+ const char * filename;
+ int linenumber;
+ uschar * region_start;
+ uschar * region_end;
+ const uschar *var_name;
+ const uschar *var_data;
+} err_ctx;
+
+static void
+assert_variable_notin(uschar * var_name, uschar * var_data, void * ctx)
+{
+err_ctx * e = ctx;
+if (var_data >= e->region_start && var_data < e->region_end)
+ {
+ e->var_name = CUS var_name;
+ e->var_data = CUS var_data;
+ }
+}
+
+void
+assert_no_variables(void * ptr, int len, const char * filename, int linenumber)
+{
+err_ctx e = {filename, linenumber, ptr, US ptr + len, NULL };
+int i;
+var_entry * v;
+
+/* check acl_ variables */
+tree_walk(acl_var_c, assert_variable_notin, &e);
+tree_walk(acl_var_m, assert_variable_notin, &e);
+
+/* check auth<n> variables */
+for (i = 0; i < AUTH_VARS; i++) if (auth_vars[i])
+ assert_variable_notin(US"auth<n>", auth_vars[i], &e);
+
+/* check regex<n> variables */
+for (i = 0; i < REGEX_VARS; i++) if (regex_vars[i])
+ assert_variable_notin(US"regex<n>", regex_vars[i], &e);
+
+/* check known-name variables */
+for (v = var_table; v < var_table + var_table_size; v++)
+ if (v->type == vtype_stringptr)
+ assert_variable_notin(US v->name, *(USS v->value), &e);
+
+if (e.var_name)
+ log_write(0, LOG_MAIN|LOG_PANIC_DIE,
+ "live variable '%s' destroyed by reset_store at %s:%d\n- value '%.64s'",
+ e.var_name, e.filename, e.linenumber, e.var_data);
+}
+
+
/*************************************************
**************************************************
projects / exim.git / blobdiff