1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2015 */
6 /* See the file NOTICE for conditions of use and distribution. */
8 /* Functions for matching strings */
14 /* Argument block for the check_string() function. This is used for general
15 strings, domains, and local parts. */
17 typedef struct check_string_block {
18 const uschar *origsubject; /* caseful; keep these two first, in */
19 const uschar *subject; /* step with the block below */
27 /* Argument block for the check_address() function. This is used for whole
30 typedef struct check_address_block {
31 const uschar *origaddress; /* caseful; keep these two first, in */
32 uschar *address; /* step with the block above */
35 } check_address_block;
39 /*************************************************
40 * Generalized string match *
41 *************************************************/
43 /* This function does a single match of a subject against a pattern, and
44 optionally sets up the numeric variables according to what it matched. It is
45 called from match_isinlist() via match_check_list() when scanning a list, and
46 from match_check_string() when testing just a single item. The subject and
47 options arguments are passed in a check_string_block so as to make it easier to
48 pass them through match_check_list.
50 The possible types of pattern are:
52 . regular expression - starts with ^
53 . tail match - starts with *
54 . lookup - starts with search type
55 . if at_is_special is set in the argument block:
56 @ matches the primary host name
57 @[] matches a local IP address in brackets
58 @mx_any matches any domain with an MX to the local host
59 @mx_primary matches any domain with a primary MX to the local host
60 @mx_secondary matches any domain with a secondary MX to the local host
61 . literal - anything else
63 Any of the @mx_xxx options can be followed by "/ignore=<list>" where <list> is
64 a list of IP addresses that are to be ignored (typically 127.0.0.1).
67 arg check_string_block pointer - see below
68 pattern the pattern to be matched
69 valueptr if not NULL, and a lookup is done, return the result here
70 instead of discarding it; else set it to point to NULL
71 error for error messages (not used in this function; it never
74 Contents of the argument block:
75 origsubject the subject in its original casing
76 subject the subject string to be checked, lowercased if caseless
77 expand_setup if < 0, don't set up any numeric expansion variables;
78 if = 0, set $0 to whole subject, and either
79 $1 to what matches * or
80 $1, $2, ... to r.e. bracketed items
81 if > 0, don't set $0, but do set either
82 $n to what matches *, or
83 $n, $n+1, ... to r.e. bracketed items
84 (where n = expand_setup)
85 use_partial if FALSE, override any partial- search types
86 caseless TRUE for caseless matching where possible
87 at_is_special enable special handling of items starting with @
89 Returns: OK if matched
91 DEFER if lookup deferred
95 check_string(void *arg, const uschar *pattern, const uschar **valueptr, uschar **error)
97 const check_string_block *cb = arg;
98 int search_type, partial, affixlen, starflags;
99 int expand_setup = cb->expand_setup;
102 uschar *filename = NULL;
103 uschar *keyquery, *result, *semicolon;
106 error = error; /* Keep clever compilers from complaining */
108 if (valueptr != NULL) *valueptr = NULL; /* For non-lookup matches */
110 /* For regular expressions, use cb->origsubject rather than cb->subject so that
111 it works if the pattern uses (?-i) to turn off case-independence, overriding
114 s = string_copy(pattern[0] == '^' ? cb->origsubject : cb->subject);
116 /* If required to set up $0, initialize the data but don't turn on by setting
117 expand_nmax until the match is assured. */
120 if (expand_setup == 0)
122 expand_nstring[0] = s;
123 expand_nlength[0] = Ustrlen(s);
125 else if (expand_setup > 0) expand_setup--;
127 /* Regular expression match: compile, match, and set up $ variables if
130 if (pattern[0] == '^')
132 const pcre *re = regex_must_compile(pattern, cb->caseless, FALSE);
133 return ((expand_setup < 0)?
134 pcre_exec(re, NULL, CCS s, Ustrlen(s), 0, PCRE_EOPT, NULL, 0) >= 0
136 regex_match_and_setup(re, s, 0, expand_setup)
143 if (pattern[0] == '*')
146 int slen = Ustrlen(s);
147 int patlen; /* Sun compiler doesn't like non-constant initializer */
149 patlen = Ustrlen(++pattern);
150 if (patlen > slen) return FAIL;
151 yield = cb->caseless?
152 (strncmpic(s + slen - patlen, pattern, patlen) == 0) :
153 (Ustrncmp(s + slen - patlen, pattern, patlen) == 0);
154 if (yield && expand_setup >= 0)
156 expand_nstring[++expand_setup] = s;
157 expand_nlength[expand_setup] = slen - patlen;
158 expand_nmax = expand_setup;
160 return yield? OK : FAIL;
163 /* Match a special item starting with @ if so enabled. On its own, "@" matches
164 the primary host name - implement this by changing the pattern. For the other
165 cases we have to do some more work. If we don't recognize a special pattern,
166 just fall through - the match will fail. */
168 if (cb->at_is_special && pattern[0] == '@')
172 pattern = primary_hostname;
173 goto NOT_AT_SPECIAL; /* Handle as exact string match */
176 if (Ustrcmp(pattern, "@[]") == 0)
179 int slen = Ustrlen(s);
180 if (s[0] != '[' && s[slen-1] != ']') return FAIL;
181 for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
182 if (Ustrncmp(ip->address, s+1, slen - 2) == 0
183 && ip->address[slen - 2] == 0)
188 if (strncmpic(pattern, US"@mx_", 4) == 0)
194 BOOL removed = FALSE;
195 const uschar *ss = pattern + 4;
196 const uschar *ignore_target_hosts = NULL;
198 if (strncmpic(ss, US"any", 3) == 0) ss += 3;
199 else if (strncmpic(ss, US"primary", 7) == 0)
204 else if (strncmpic(ss, US"secondary", 9) == 0)
209 else goto NOT_AT_SPECIAL;
211 if (strncmpic(ss, US"/ignore=", 8) == 0) ignore_target_hosts = ss + 8;
212 else if (*ss != 0) goto NOT_AT_SPECIAL;
218 rc = host_find_bydns(&h,
220 HOST_FIND_BY_MX, /* search only for MX, not SRV or A */
221 NULL, /* service name not relevant */
222 NULL, /* srv_fail_domains not relevant */
223 NULL, /* mx_fail_domains not relevant */
224 NULL, /* no dnssec request/require XXX ? */
225 NULL, /* no feedback FQDN */
226 &removed); /* feedback if local removed */
228 if (rc == HOST_FIND_AGAIN)
230 search_error_message = string_sprintf("DNS lookup of \"%s\" deferred", s);
234 if (rc == HOST_FOUND_LOCAL && !secy) return OK;
235 if (prim) return FAIL;
236 return removed? OK : FAIL;
238 /*** The above line used to be the following line, but this is incorrect,
239 because host_find_bydns() may return HOST_NOT_FOUND if it removed some MX
240 hosts, but the remaining ones were non-existent. All we are interested in
241 is whether or not it removed some hosts.
243 return (rc == HOST_FOUND && removed)? OK : FAIL;
248 /* Escape point from code for specials that start with "@" */
252 /* This is an exact string match if there is no semicolon in the pattern. */
254 if ((semicolon = Ustrchr(pattern, ';')) == NULL)
256 BOOL yield = cb->caseless?
257 (strcmpic(s, pattern) == 0) : (Ustrcmp(s, pattern) == 0);
258 if (yield && expand_setup >= 0) expand_nmax = expand_setup;
259 return yield? OK : FAIL;
262 /* Otherwise we have a lookup item. The lookup type, including partial, etc. is
263 the part of the string preceding the semicolon. */
266 search_type = search_findtype_partial(pattern, &partial, &affix, &affixlen,
269 if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
270 search_error_message);
272 /* Partial matching is not appropriate for certain lookups (e.g. when looking
273 up user@domain for sender rejection). There's a flag to disable it. */
275 if (!cb->use_partial) partial = -1;
277 /* Set the parameters for the three different kinds of lookup. */
279 keyquery = semicolon + 1;
280 while (isspace(*keyquery)) keyquery++;
282 if (mac_islookup(search_type, lookup_absfilequery))
285 while (*keyquery != 0 && !isspace(*keyquery)) keyquery++;
286 filename = string_copyn(filename, keyquery - filename);
287 while (isspace(*keyquery)) keyquery++;
290 else if (!mac_islookup(search_type, lookup_querystyle))
296 /* Now do the actual lookup; throw away the data returned unless it was asked
297 for; partial matching is all handled inside search_find(). Note that there is
298 no search_close() because of the caching arrangements. */
300 handle = search_open(filename, search_type, 0, NULL, NULL);
301 if (handle == NULL) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
302 search_error_message);
303 result = search_find(handle, filename, keyquery, partial, affix, affixlen,
304 starflags, &expand_setup);
306 if (result == NULL) return search_find_defer? DEFER : FAIL;
307 if (valueptr != NULL) *valueptr = result;
309 expand_nmax = expand_setup;
315 /*************************************************
316 * Public interface to check_string() *
317 *************************************************/
319 /* This function is called from several places where is it most convenient to
320 pass the arguments individually. It places them in a check_string_block
321 structure, and then calls check_string().
324 s the subject string to be checked
325 pattern the pattern to check it against
326 expand_setup expansion setup option (see check_string())
327 use_partial if FALSE, override any partial- search types
328 caseless TRUE for caseless matching where possible
329 at_is_special TRUE to recognize @, @[], etc.
330 valueptr if not NULL, and a file lookup was done, return the result
331 here instead of discarding it; else set it to point to NULL
333 Returns: OK if matched
335 DEFER if lookup deferred
339 match_check_string(const uschar *s, const uschar *pattern, int expand_setup,
340 BOOL use_partial, BOOL caseless, BOOL at_is_special, const uschar **valueptr)
342 check_string_block cb;
344 cb.subject = caseless? string_copylc(s) : string_copy(s);
345 cb.expand_setup = expand_setup;
346 cb.use_partial = use_partial;
347 cb.caseless = caseless;
348 cb.at_is_special = at_is_special;
349 return check_string(&cb, pattern, valueptr, NULL);
354 /*************************************************
355 * Get key string from check block *
356 *************************************************/
358 /* When caching the data from a lookup for a named list, we have to save the
359 key that was found, because other lookups of different keys on the same list
360 may occur. This function has knowledge of the different lookup types, and
361 extracts the appropriate key.
365 type MCL_STRING, MCL_DOMAIN, MCL_HOST, MCL_ADDRESS, or MCL_LOCALPART
368 static const uschar *
369 get_check_key(void *arg, int type)
376 return ((check_string_block *)arg)->subject;
379 return ((check_host_block *)arg)->host_address;
382 return ((check_address_block *)arg)->address;
384 return US""; /* In practice, should never happen */
389 /*************************************************
390 * Scan list and run matching function *
391 *************************************************/
393 /* This function scans a list of patterns, and runs a matching function for
394 each item in the list. It is called from the functions that match domains,
395 local parts, hosts, and addresses, because its overall structure is the same in
396 all cases. However, the details of each particular match is different, so it
397 calls back to a given function do perform an actual match.
399 We can't quite keep the different types anonymous here because they permit
400 different special cases. A pity.
402 If a list item starts with !, that implies negation if the subject matches the
403 rest of the item (ignoring white space after the !). The result when the end of
404 the list is reached is FALSE unless the last item on the list is negated, in
405 which case it is TRUE. A file name in the list causes its lines to be
406 interpolated as if items in the list. An item starting with + is a named
407 sublist, obtained by searching the tree pointed to by anchorptr, with possible
408 cached match results in cache_bits.
411 listptr pointer to the pointer to the list
412 sep separator character for string_nextinlist();
413 normally zero for a standard list;
414 sometimes UCHAR_MAX+1 for single items;
415 anchorptr -> tree of named items, or NULL if no named items
416 cache_ptr pointer to pointer to cache bits for named items, or
417 pointer to NULL if not caching; may get set NULL if an
418 uncacheable named list is encountered
419 func function to call back to do one test
420 arg pointer to pass to the function; the string to be matched is
421 in the structure it points to
422 type MCL_STRING, MCL_DOMAIN, MCL_HOST, MCL_ADDRESS, or MCL_LOCALPART
423 these are used for some special handling
424 MCL_NOEXPAND (whose value is greater than any of them) may
425 be added to any value to suppress expansion of the list
426 name string to use in debugging info
427 valueptr where to pass back data from a lookup
429 Returns: OK if matched a non-negated item
430 OK if hit end of list after a negated item
431 FAIL if expansion force-failed
432 FAIL if matched a negated item
433 FAIL if hit end of list after a non-negated item
434 DEFER if a something deferred or expansion failed
438 match_check_list(const uschar **listptr, int sep, tree_node **anchorptr,
439 unsigned int **cache_ptr, int (*func)(void *,const uschar *,const uschar **,uschar **),
440 void *arg, int type, const uschar *name, const uschar **valueptr)
443 unsigned int *original_cache_bits = *cache_ptr;
444 BOOL include_unknown = FALSE;
445 BOOL ignore_unknown = FALSE;
446 BOOL include_defer = FALSE;
447 BOOL ignore_defer = FALSE;
453 /* Save time by not scanning for the option name when we don't need it. */
457 uschar *listname = readconf_find_option(listptr);
458 if (listname[0] != 0) ot = string_sprintf("%s in %s?", name, listname);
461 /* If the list is empty, the answer is no. Skip the debugging output for
464 if (*listptr == NULL)
468 if (ot != NULL) debug_printf("%s no (option unset)\n", ot);
473 /* Expand the list before we scan it. A forced expansion gives the answer
474 "not in list"; other expansion errors cause DEFER to be returned. However,
475 if the type value is greater than or equal to than MCL_NOEXPAND, do not expand
478 if (type >= MCL_NOEXPAND)
481 type -= MCL_NOEXPAND; /* Remove the "no expand" flag */
485 /* If we are searching a domain list, and $domain is not set, set it to the
486 subject that is being sought for the duration of the expansion. */
488 if (type == MCL_DOMAIN && deliver_domain == NULL)
490 check_string_block *cb = (check_string_block *)arg;
491 deliver_domain = string_copy(cb->subject);
492 list = expand_cstring(*listptr);
493 deliver_domain = NULL;
496 else list = expand_cstring(*listptr);
500 if (expand_string_forcedfail)
502 HDEBUG(D_lists) debug_printf("expansion of \"%s\" forced failure: "
503 "assume not in this list\n", *listptr);
506 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand \"%s\" while checking "
507 "a list: %s", *listptr, expand_string_message);
512 /* For an unnamed list, use the expanded version in comments */
516 if (ot == NULL) ot = string_sprintf("%s in \"%s\"?", name, list);
519 /* Now scan the list and process each item in turn, until one of them matches,
520 or we hit an error. */
522 while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
526 /* Address lists may contain +caseful, to restore caseful matching of the
527 local part. We have to know the layout of the control block, unfortunately.
528 The lower cased address is in a temporary buffer, so we just copy the local
529 part back to the start of it (if a local part exists). */
531 if (type == MCL_ADDRESS)
533 if (Ustrcmp(ss, "+caseful") == 0)
535 check_address_block *cb = (check_address_block *)arg;
536 uschar *at = Ustrrchr(cb->origaddress, '@');
538 Ustrncpy(cb->address, cb->origaddress, at - cb->origaddress);
539 cb->caseless = FALSE;
544 /* Similar processing for local parts */
546 else if (type == MCL_LOCALPART)
548 if (Ustrcmp(ss, "+caseful") == 0)
550 check_string_block *cb = (check_string_block *)arg;
551 Ustrcpy(cb->subject, cb->origsubject);
552 cb->caseless = FALSE;
557 /* If the host item is "+include_unknown" or "+ignore_unknown", remember it
558 in case there's a subsequent failed reverse lookup. There is similar
559 processing for "defer". */
561 else if (type == MCL_HOST && *ss == '+')
563 if (Ustrcmp(ss, "+include_unknown") == 0)
565 include_unknown = TRUE;
566 ignore_unknown = FALSE;
569 if (Ustrcmp(ss, "+ignore_unknown") == 0)
571 ignore_unknown = TRUE;
572 include_unknown = FALSE;
575 if (Ustrcmp(ss, "+include_defer") == 0)
577 include_defer = TRUE;
578 ignore_defer = FALSE;
581 if (Ustrcmp(ss, "+ignore_defer") == 0)
584 include_defer = FALSE;
589 /* Starting with ! specifies a negative item. It is theoretically possible
590 for a local part to start with !. In that case, a regex has to be used. */
595 while (isspace((*(++ss))));
599 /* If the item does not begin with '/', it might be a + item for a named
600 list. Otherwise, it is just a single list entry that has to be matched.
601 We recognize '+' only when supplied with a tree of named lists. */
605 if (*ss == '+' && anchorptr != NULL)
610 unsigned int *use_cache_bits = original_cache_bits;
611 uschar *cached = US"";
613 tree_node *t = tree_search(*anchorptr, ss+1);
616 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unknown named%s list \"%s\"",
617 (type == MCL_DOMAIN)? " domain" :
618 (type == MCL_HOST)? " host" :
619 (type == MCL_ADDRESS)? " address" :
620 (type == MCL_LOCALPART)? " local part" : "",
624 /* If the list number is negative, it means that this list is not
625 cacheable because it contains expansion items. */
627 if (nb->number < 0) use_cache_bits = NULL;
629 /* If we have got a cache pointer, get the bits. This is not an "else"
630 because the pointer may be NULL from the start if caching is not
633 if (use_cache_bits != NULL)
635 offset = (nb->number)/16;
636 shift = ((nb->number)%16)*2;
637 bits = use_cache_bits[offset] & (3 << shift);
640 /* Not previously tested or no cache - run the full test */
644 switch (match_check_list(&(nb->string), 0, anchorptr, &use_cache_bits,
645 func, arg, type, name, valueptr))
647 case OK: bits = 1; break;
648 case FAIL: bits = 3; break;
649 case DEFER: goto DEFER_RETURN;
652 /* If this list was uncacheable, or a sublist turned out to be
653 uncacheable, the value of use_cache_bits will now be NULL, even if it
654 wasn't before. Ensure that this is passed up to the next level.
655 Otherwise, remember the result of the search in the cache. */
657 if (use_cache_bits == NULL)
663 use_cache_bits[offset] |= bits << shift;
665 if (valueptr != NULL)
667 int old_pool = store_pool;
668 namedlist_cacheblock *p;
670 /* Cached data for hosts persists over more than one message,
671 so we use the permanent store pool */
673 store_pool = POOL_PERM;
674 p = store_get(sizeof(namedlist_cacheblock));
675 p->key = string_copy(get_check_key(arg, type));
678 p->data = (*valueptr == NULL)? NULL : string_copy(*valueptr);
679 store_pool = old_pool;
681 p->next = nb->cache_data;
683 if (*valueptr != NULL)
685 DEBUG(D_lists) debug_printf("data from lookup saved for "
686 "cache for %s: %s\n", ss, *valueptr);
692 /* Previously cached; to find a lookup value, search a chain of values
693 and compare keys. Typically, there is only one such, but it is possible
694 for different keys to have matched the same named list. */
698 DEBUG(D_lists) debug_printf("cached %s match for %s\n",
699 ((bits & (-bits)) == bits)? "yes" : "no", ss);
700 cached = US" - cached";
701 if (valueptr != NULL)
703 const uschar *key = get_check_key(arg, type);
704 namedlist_cacheblock *p;
705 for (p = nb->cache_data; p != NULL; p = p->next)
707 if (Ustrcmp(key, p->key) == 0)
713 DEBUG(D_lists) debug_printf("cached lookup data = %s\n", *valueptr);
717 /* Result of test is indicated by value in bits. For each test, we
718 have 00 => untested, 01 => tested yes, 11 => tested no. */
720 if ((bits & (-bits)) == bits) /* Only one of the two bits is set */
722 HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\"%s)\n", ot,
723 (yield == OK)? "yes" : "no", sss, cached);
728 /* Run the provided function to do the individual test. */
732 uschar *error = NULL;
733 switch ((func)(arg, ss, valueptr, &error))
736 HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\")\n", ot,
737 (yield == OK)? "yes" : "no", sss);
742 error = string_sprintf("DNS lookup of \"%s\" deferred", ss);
745 HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_defer\n",
751 log_write(0, LOG_MAIN, "%s: accepted by +include_defer", error);
754 if (!search_error_message) search_error_message = error;
757 /* The ERROR return occurs when checking hosts, when either a forward
758 or reverse lookup has failed. It can also occur in a match_ip list if a
759 non-IP address item is encountered. The error string gives details of
765 HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown\n",
770 HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
771 include_unknown? "yes":"no", error);
772 if (!include_unknown)
774 if (LOGGING(unknown_in_list))
775 log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
778 log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
785 /* If the item is a file name, we read the file and do a match attempt
786 on each line in the file, including possibly more negation processing. */
790 int file_yield = yield; /* In case empty file */
791 uschar *filename = ss;
792 FILE *f = Ufopen(filename, "rb");
793 uschar filebuffer[1024];
795 /* ot will be null in non-debugging cases, and anyway, we get better
796 wording by reworking it. */
800 uschar *listname = readconf_find_option(listptr);
801 if (listname[0] == 0)
802 listname = string_sprintf("\"%s\"", *listptr);
803 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
804 string_open_failed(errno, "%s when checking %s", sss, listname));
807 /* Trailing comments are introduced by #, but in an address list or local
808 part list, the # must be preceded by white space or the start of the line,
809 because the # character is a legal character in local parts. */
811 while (Ufgets(filebuffer, sizeof(filebuffer), f) != NULL)
814 uschar *sss = filebuffer;
816 while ((ss = Ustrchr(sss, '#')) != NULL)
818 if ((type != MCL_ADDRESS && type != MCL_LOCALPART) ||
819 ss == filebuffer || isspace(ss[-1]))
827 ss = filebuffer + Ustrlen(filebuffer); /* trailing space */
828 while (ss > filebuffer && isspace(ss[-1])) ss--;
832 while (isspace(*ss)) ss++; /* leading space */
834 if (*ss == 0) continue; /* ignore empty */
836 file_yield = yield; /* positive yield */
837 sss = ss; /* for debugging */
839 if (*ss == '!') /* negation */
841 file_yield = (file_yield == OK)? FAIL : OK;
842 while (isspace((*(++ss))));
845 switch ((func)(arg, ss, valueptr, &error))
849 HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\" in %s)\n", ot,
850 (yield == OK)? "yes" : "no", sss, filename);
855 error = string_sprintf("DNS lookup of %s deferred", ss);
858 HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_defer\n",
865 log_write(0, LOG_MAIN, "%s: accepted by +include_defer", error);
870 case ERROR: /* host name lookup failed - this can only */
871 if (ignore_unknown) /* be for an incoming host (not outgoing) */
873 HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown\n",
878 HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
879 include_unknown? "yes":"no", error);
881 if (!include_unknown)
883 if (LOGGING(unknown_in_list))
884 log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
887 log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
893 /* At the end of the file, leave the yield setting at the final setting
894 for the file, in case this is the last item in the list. */
899 } /* Loop for the next item on the top-level list */
901 /* End of list reached: if the last item was negated yield OK, else FAIL. */
904 debug_printf("%s %s (end of list)\n", ot, (yield == OK)? "no":"yes");
905 return (yield == OK)? FAIL : OK;
907 /* Something deferred */
910 HDEBUG(D_lists) debug_printf("%s list match deferred for %s\n", ot, sss);
915 /*************************************************
916 * Match in colon-separated list *
917 *************************************************/
919 /* This function is used for domain lists and local part lists. It is not used
920 for host lists or address lists, which have additional interpretation of the
921 patterns. Some calls of it set sep > UCHAR_MAX in order to use its matching
922 facilities on single items. When this is done, it arranges to set the numerical
923 variables as a result of the match.
925 This function is now just a short interface to match_check_list(), which does
926 list scanning in a general way. A good compiler will optimize the tail
930 s string to search for
931 listptr ptr to ptr to colon separated list of patterns, or NULL
932 sep a separator value for the list (see string_nextinlist())
933 anchorptr ptr to tree for named items, or NULL if no named items
934 cache_bits ptr to cache_bits for ditto, or NULL if not caching
935 type MCL_DOMAIN when matching a domain list
936 MCL_LOCALPART when matching a local part list (address lists
937 have their own function)
938 MCL_STRING for others (e.g. list of ciphers)
939 MCL_NOEXPAND (whose value is greater than any of them) may
940 be added to any value to suppress expansion of the list
941 caseless TRUE for (mostly) caseless matching - passed directly to
943 valueptr pointer to where any lookup data is to be passed back,
944 or NULL (just passed on to match_check_string)
946 Returns: OK if matched a non-negated item
947 OK if hit end of list after a negated item
948 FAIL if expansion force-failed
949 FAIL if matched a negated item
950 FAIL if hit end of list after a non-negated item
951 DEFER if a lookup deferred
955 match_isinlist(const uschar *s, const uschar **listptr, int sep,
956 tree_node **anchorptr,
957 unsigned int *cache_bits, int type, BOOL caseless, const uschar **valueptr)
959 unsigned int *local_cache_bits = cache_bits;
960 check_string_block cb;
962 cb.subject = caseless? string_copylc(s) : string_copy(s);
963 cb.expand_setup = (sep > UCHAR_MAX)? 0 : -1;
964 cb.use_partial = TRUE;
965 cb.caseless = caseless;
966 cb.at_is_special = (type == MCL_DOMAIN || type == MCL_DOMAIN + MCL_NOEXPAND);
967 if (valueptr != NULL) *valueptr = NULL;
968 return match_check_list(listptr, sep, anchorptr, &local_cache_bits,
969 check_string, &cb, type, s, valueptr);
974 /*************************************************
975 * Match address to single address-list item *
976 *************************************************/
978 /* This function matches an address to an item from an address list. It is
979 called from match_address_list() via match_check_list(). That is why most of
980 its arguments are in an indirect block.
983 arg the argument block (see below)
984 pattern the pattern to match
985 valueptr where to return a value
986 error for error messages (not used in this function; it never
989 The argument block contains:
990 address the start of the subject address; when called from retry.c
991 it may be *@domain if the local part isn't relevant
992 origaddress the original, un-case-forced address (not used here, but used
993 in match_check_list() when +caseful is encountered)
994 expand_setup controls setting up of $n variables
995 caseless TRUE for caseless local part matching
997 Returns: OK for a match
999 DEFER if a lookup deferred
1003 check_address(void *arg, const uschar *pattern, const uschar **valueptr, uschar **error)
1005 check_address_block *cb = (check_address_block *)arg;
1006 check_string_block csb;
1009 unsigned int *null = NULL;
1010 const uschar *listptr;
1011 uschar *subject = cb->address;
1013 uschar *pdomain, *sdomain;
1015 error = error; /* Keep clever compilers from complaining */
1017 DEBUG(D_lists) debug_printf("address match test: subject=%s pattern=%s\n",
1020 /* Find the subject's domain */
1022 sdomain = Ustrrchr(subject, '@');
1024 /* The only case where a subject may not have a domain is if the subject is
1025 empty. Otherwise, a subject with no domain is a serious configuration error. */
1027 if (sdomain == NULL && *subject != 0)
1029 log_write(0, LOG_MAIN|LOG_PANIC, "no @ found in the subject of an "
1030 "address list match: subject=\"%s\" pattern=\"%s\"", subject, pattern);
1034 /* Handle a regular expression, which must match the entire incoming address.
1035 This may be the empty address. */
1037 if (*pattern == '^')
1038 return match_check_string(subject, pattern, cb->expand_setup, TRUE,
1039 cb->caseless, FALSE, NULL);
1041 /* Handle a pattern that is just a lookup. Skip over possible lookup names
1042 (letters, digits, hyphens). Skip over a possible * or *@ at the end. Then we
1043 must have a semicolon for it to be a lookup. */
1045 for (s = pattern; isalnum(*s) || *s == '-'; s++);
1049 /* If it is a straight lookup, do a lookup for the whole address. This may be
1050 the empty address. Partial matching doesn't make sense here, so we ignore it,
1051 but write a panic log entry. However, *@ matching will be honoured. */
1055 if (Ustrncmp(pattern, "partial-", 8) == 0)
1056 log_write(0, LOG_MAIN|LOG_PANIC, "partial matching is not applicable to "
1057 "whole-address lookups: ignored \"partial-\" in \"%s\"", pattern);
1058 return match_check_string(subject, pattern, -1, FALSE, cb->caseless, FALSE,
1062 /* For the remaining cases, an empty subject matches only an empty pattern,
1063 because other patterns expect to have a local part and a domain to match
1066 if (*subject == 0) return (*pattern == 0)? OK : FAIL;
1068 /* If the pattern starts with "@@" we have a split lookup, where the domain is
1069 looked up to obtain a list of local parts. If the subject's local part is just
1070 "*" (called from retry) the match always fails. */
1072 if (pattern[0] == '@' && pattern[1] == '@')
1077 uschar buffer[1024];
1079 if (sdomain == subject + 1 && *subject == '*') return FAIL;
1081 /* Loop for handling chains. The last item in any list may be of the form
1082 ">name" in order to chain on to another list. */
1084 for (key = sdomain + 1; key != NULL && watchdog-- > 0; )
1088 if ((rc = match_check_string(key, pattern + 2, -1, TRUE, FALSE, FALSE,
1089 CUSS &list)) != OK) return rc;
1091 /* Check for chaining from the last item; set up the next key if one
1094 ss = Ustrrchr(list, ':');
1095 if (ss == NULL) ss = list; else ss++;
1096 while (isspace(*ss)) ss++;
1100 while (isspace(*ss)) ss++;
1101 key = string_copy(ss);
1105 /* Look up the local parts provided by the list; negation is permitted.
1106 If a local part has to begin with !, a regex can be used. */
1108 while ((ss = string_nextinlist(CUSS &list, &sep, buffer, sizeof(buffer))))
1115 while (isspace((*(++ss))));
1117 else local_yield = OK;
1120 rc = match_check_string(subject, ss, -1, TRUE, cb->caseless, FALSE,
1135 /* End of chain loop; panic if too many times */
1138 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Loop detected in lookup of "
1139 "local part of %s in %s", subject, pattern);
1141 /* Otherwise the local part check has failed, so the whole match
1148 /* We get here if the pattern is not a lookup or a regular expression. If it
1149 contains an @ there is both a local part and a domain. */
1151 pdomain = Ustrrchr(pattern, '@');
1152 if (pdomain != NULL)
1156 /* If the domain in the pattern is empty or one of the special cases [] or
1157 mx_{any,primary,secondary}, and the local part in the pattern ends in "@",
1158 we have a pattern of the form <something>@@, <something>@@[], or
1159 <something>@@mx_{any,primary,secondary}. These magic "domains" are
1160 automatically interpreted in match_check_string. We just need to arrange that
1161 the leading @ is included in the domain. */
1163 if (pdomain > pattern && pdomain[-1] == '@' &&
1165 Ustrcmp(pdomain+1, "[]") == 0 ||
1166 Ustrcmp(pdomain+1, "mx_any") == 0 ||
1167 Ustrcmp(pdomain+1, "mx_primary") == 0 ||
1168 Ustrcmp(pdomain+1, "mx_secondary") == 0))
1171 pllen = pdomain - pattern;
1172 sllen = sdomain - subject;
1174 /* Compare the local parts in the subject and the pattern */
1176 if (*pattern == '*')
1178 int cllen = pllen - 1;
1179 if (sllen < cllen) return FAIL;
1182 if (strncmpic(subject+sllen-cllen, pattern + 1, cllen) != 0)
1187 if (Ustrncmp(subject+sllen-cllen, pattern + 1, cllen) != 0)
1190 if (cb->expand_setup > 0)
1192 expand_nstring[cb->expand_setup] = subject;
1193 expand_nlength[cb->expand_setup] = sllen - cllen;
1199 if (sllen != pllen) return FAIL;
1202 if (strncmpic(subject, pattern, sllen) != 0) return FAIL;
1206 if (Ustrncmp(subject, pattern, sllen) != 0) return FAIL;
1211 /* If the local part matched, or was not being checked, check the domain using
1212 the generalized function, which supports file lookups (which may defer). The
1213 original code read as follows:
1215 return match_check_string(sdomain + 1,
1216 (pdomain == NULL)? pattern : pdomain + 1,
1217 cb->expand_setup + expand_inc, TRUE, cb->caseless, TRUE, NULL);
1219 This supported only literal domains and *.x.y patterns. In order to allow for
1220 named domain lists (so that you can right, for example, "senders=+xxxx"), it
1221 was changed to use the list scanning function. */
1223 csb.origsubject = sdomain + 1;
1224 csb.subject = (cb->caseless)? string_copylc(sdomain+1) : string_copy(sdomain+1);
1225 csb.expand_setup = cb->expand_setup + expand_inc;
1226 csb.use_partial = TRUE;
1227 csb.caseless = cb->caseless;
1228 csb.at_is_special = TRUE;
1230 listptr = (pdomain == NULL)? pattern : pdomain + 1;
1231 if (valueptr != NULL) *valueptr = NULL;
1233 return match_check_list(
1234 &listptr, /* list of one item */
1235 UCHAR_MAX+1, /* impossible separator; single item */
1236 &domainlist_anchor, /* it's a domain list */
1237 &null, /* ptr to NULL means no caching */
1238 check_string, /* the function to do one test */
1239 &csb, /* its data */
1240 MCL_DOMAIN + MCL_NOEXPAND, /* domain list; don't expand */
1241 csb.subject, /* string for messages */
1242 valueptr); /* where to pass back lookup data */
1248 /*************************************************
1249 * Test whether address matches address list *
1250 *************************************************/
1252 /* This function is given an address and a list of things to match it against.
1253 The list may contain individual addresses, regular expressions, lookup
1254 specifications, and indirection via bare files. Negation is supported. The
1255 address to check can consist of just a domain, which will then match only
1256 domain items or items specified as *@domain.
1258 Domains are always lower cased before the match. Local parts are also lower
1259 cased unless "caseless" is false. The work of actually scanning the list is
1260 done by match_check_list(), with an appropriate block of arguments and a
1261 callback to check_address(). During caseless matching, it will recognize
1262 +caseful and revert to caseful matching.
1265 address address to test
1266 caseless TRUE to start in caseless state
1267 expand TRUE to allow list expansion
1268 listptr list to check against
1269 cache_bits points to cache bits for named address lists, or NULL
1270 expand_setup controls setting up of $n variables - passed through
1271 to check_address (q.v.)
1272 sep separator character for the list;
1273 may be 0 to get separator from the list;
1274 may be UCHAR_MAX+1 for one-item list
1275 valueptr where to return a lookup value, or NULL
1277 Returns: OK for a positive match, or end list after a negation;
1278 FAIL for a negative match, or end list after non-negation;
1279 DEFER if a lookup deferred
1283 match_address_list(const uschar *address, BOOL caseless, BOOL expand,
1284 const uschar **listptr, unsigned int *cache_bits, int expand_setup, int sep,
1285 const uschar **valueptr)
1288 check_address_block ab;
1289 unsigned int *local_cache_bits = cache_bits;
1291 /* RFC 2505 recommends that for spam checking, local parts should be caselessly
1292 compared. Therefore, Exim now forces the entire address into lower case here,
1293 provided that "caseless" is set. (It is FALSE for calls for matching rewriting
1294 patterns.) Otherwise just the domain is lower cases. A magic item "+caseful" in
1295 the list can be used to restore a caseful copy of the local part from the
1296 original address. */
1298 sprintf(CS big_buffer, "%.*s", big_buffer_size - 1, address);
1299 for (p = big_buffer + Ustrlen(big_buffer) - 1; p >= big_buffer; p--)
1301 if (!caseless && *p == '@') break;
1305 /* If expand_setup is zero, we need to set up $0 to the whole thing, in
1306 case there is a match. Can't use the built-in facilities of match_check_string
1307 (via check_address), as we may just be calling that for part of the address
1310 if (expand_setup == 0)
1312 expand_nstring[0] = string_copy(address);
1313 expand_nlength[0] = Ustrlen(address);
1317 /* Set up the data to be passed ultimately to check_address. */
1319 ab.origaddress = address;
1320 ab.address = big_buffer;
1321 ab.expand_setup = expand_setup;
1322 ab.caseless = caseless;
1324 return match_check_list(listptr, sep, &addresslist_anchor, &local_cache_bits,
1325 check_address, &ab, MCL_ADDRESS + (expand? 0:MCL_NOEXPAND), address,
1329 /* End of match.c */