1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) The Exim Maintainers 2020 - 2023 */
6 /* Copyright (c) University of Cambridge 1995 - 2018 */
7 /* See the file NOTICE for conditions of use and distribution. */
8 /* SPDX-License-Identifier: GPL-2.0-or-later */
11 /* Functions for handling string expansion. */
17 # include "macro_predef.h"
20 typedef unsigned esi_flags;
22 #define ESI_BRACE_ENDS BIT(0) /* expansion should stop at } */
23 #define ESI_HONOR_DOLLAR BIT(1) /* $ is meaningfull */
24 #define ESI_SKIPPING BIT(2) /* value will not be needed */
27 # ifndef SUPPORT_CRYPTEQ
28 # define SUPPORT_CRYPTEQ
30 #endif /*!STAND_ALONE*/
33 # include "lookups/ldap.h"
36 #ifdef SUPPORT_CRYPTEQ
41 extern char* crypt16(char*, char*);
45 /* The handling of crypt16() is a mess. I will record below the analysis of the
46 mess that was sent to me. We decided, however, to make changing this very low
47 priority, because in practice people are moving away from the crypt()
48 algorithms nowadays, so it doesn't seem worth it.
51 There is an algorithm named "crypt16" in Ultrix and Tru64. It crypts
52 the first 8 characters of the password using a 20-round version of crypt
53 (standard crypt does 25 rounds). It then crypts the next 8 characters,
54 or an empty block if the password is less than 9 characters, using a
55 20-round version of crypt and the same salt as was used for the first
56 block. Characters after the first 16 are ignored. It always generates
57 a 16-byte hash, which is expressed together with the salt as a string
58 of 24 base 64 digits. Here are some links to peruse:
60 http://cvs.pld.org.pl/pam/pamcrypt/crypt16.c?rev=1.2
61 http://seclists.org/bugtraq/1999/Mar/0076.html
63 There's a different algorithm named "bigcrypt" in HP-UX, Digital Unix,
64 and OSF/1. This is the same as the standard crypt if given a password
65 of 8 characters or less. If given more, it first does the same as crypt
66 using the first 8 characters, then crypts the next 8 (the 9th to 16th)
67 using as salt the first two base 64 digits from the first hash block.
68 If the password is more than 16 characters then it crypts the 17th to 24th
69 characters using as salt the first two base 64 digits from the second hash
70 block. And so on: I've seen references to it cutting off the password at
71 40 characters (5 blocks), 80 (10 blocks), or 128 (16 blocks). Some links:
73 http://cvs.pld.org.pl/pam/pamcrypt/bigcrypt.c?rev=1.2
74 http://seclists.org/bugtraq/1999/Mar/0109.html
75 http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/HTML/AA-Q0R2D-
76 TET1_html/sec.c222.html#no_id_208
78 Exim has something it calls "crypt16". It will either use a native
79 crypt16 or its own implementation. A native crypt16 will presumably
80 be the one that I called "crypt16" above. The internal "crypt16"
81 function, however, is a two-block-maximum implementation of what I called
82 "bigcrypt". The documentation matches the internal code.
84 I suspect that whoever did the "crypt16" stuff for Exim didn't realise
85 that crypt16 and bigcrypt were different things.
87 Exim uses the LDAP-style scheme identifier "{crypt16}" to refer
88 to whatever it is using under that name. This unfortunately sets a
89 precedent for using "{crypt16}" to identify two incompatible algorithms
90 whose output can't be distinguished. With "{crypt16}" thus rendered
91 ambiguous, I suggest you deprecate it and invent two new identifiers
92 for the two algorithms.
94 Both crypt16 and bigcrypt are very poor algorithms, btw. Hashing parts
95 of the password separately means they can be cracked separately, so
96 the double-length hash only doubles the cracking effort instead of
97 squaring it. I recommend salted SHA-1 ({SSHA}), or the Blowfish-based
104 /*************************************************
105 * Local statics and tables *
106 *************************************************/
108 /* Table of item names, and corresponding switch numbers. The names must be in
109 alphabetical order. */
111 static uschar *item_table[] = {
181 /* Tables of operator names, and corresponding switch numbers. The names must be
182 in alphabetical order. There are two tables, because underscore is used in some
183 cases to introduce arguments, whereas for other it is part of the name. This is
184 an historical mis-design. */
186 static uschar * op_table_underscore[] = {
189 US"quote_local_part",
194 ,US"utf8_domain_from_alabel",
195 US"utf8_domain_to_alabel",
196 US"utf8_localpart_from_alabel",
197 US"utf8_localpart_to_alabel"
204 EOP_QUOTE_LOCAL_PART,
209 ,EOP_UTF8_DOMAIN_FROM_ALABEL,
210 EOP_UTF8_DOMAIN_TO_ALABEL,
211 EOP_UTF8_LOCALPART_FROM_ALABEL,
212 EOP_UTF8_LOCALPART_TO_ALABEL
216 static uschar *op_table_main[] = {
265 EOP_ADDRESS = nelem(op_table_underscore),
313 /* Table of condition names, and corresponding switch numbers. The names must
314 be in alphabetical order. */
316 static uschar *cond_table[] = {
320 US"==", /* Backward compatibility */
360 US"match_local_part",
385 ECOND_FIRST_DELIVERY,
413 ECOND_MATCH_LOCAL_PART,
423 /* Types of table entry */
426 vtype_int, /* value is address of int */
427 vtype_filter_int, /* ditto, but recognized only when filtering */
428 vtype_ino, /* value is address of ino_t (not always an int) */
429 vtype_uid, /* value is address of uid_t (not always an int) */
430 vtype_gid, /* value is address of gid_t (not always an int) */
431 vtype_bool, /* value is address of bool */
432 vtype_stringptr, /* value is address of pointer to string */
433 vtype_msgbody, /* as stringptr, but read when first required */
434 vtype_msgbody_end, /* ditto, the end of the message */
435 vtype_msgheaders, /* the message's headers, processed */
436 vtype_msgheaders_raw, /* the message's headers, unprocessed */
437 vtype_localpart, /* extract local part from string */
438 vtype_domain, /* extract domain from string */
439 vtype_string_func, /* value is string returned by given function */
440 vtype_todbsdin, /* value not used; generate BSD inbox tod */
441 vtype_tode, /* value not used; generate tod in epoch format */
442 vtype_todel, /* value not used; generate tod in epoch/usec format */
443 vtype_todf, /* value not used; generate full tod */
444 vtype_todl, /* value not used; generate log tod */
445 vtype_todlf, /* value not used; generate log file datestamp tod */
446 vtype_todzone, /* value not used; generate time zone only */
447 vtype_todzulu, /* value not used; generate zulu tod */
448 vtype_reply, /* value not used; get reply from headers */
449 vtype_pid, /* value not used; result is pid */
450 vtype_host_lookup, /* value not used; get host name */
451 vtype_load_avg, /* value not used; result is int from os_getloadavg */
452 vtype_pspace, /* partition space; value is T/F for spool/log */
453 vtype_pinodes, /* partition inodes; value is T/F for spool/log */
454 vtype_cert /* SSL certificate */
456 ,vtype_dkim /* Lookup of value in DKIM signature */
460 /* Type for main variable table */
468 /* Type for entries pointing to address/length pairs. Not currently
476 typedef uschar * stringptr_fn_t(void);
477 static uschar * fn_recipients(void);
478 static uschar * fn_recipients_list(void);
479 static uschar * fn_queue_size(void);
481 /* This table must be kept in alphabetical order. */
483 static var_entry var_table[] = {
484 /* WARNING: Do not invent variables whose names start acl_c or acl_m because
485 they will be confused with user-creatable ACL variables. */
486 { "acl_arg1", vtype_stringptr, &acl_arg[0] },
487 { "acl_arg2", vtype_stringptr, &acl_arg[1] },
488 { "acl_arg3", vtype_stringptr, &acl_arg[2] },
489 { "acl_arg4", vtype_stringptr, &acl_arg[3] },
490 { "acl_arg5", vtype_stringptr, &acl_arg[4] },
491 { "acl_arg6", vtype_stringptr, &acl_arg[5] },
492 { "acl_arg7", vtype_stringptr, &acl_arg[6] },
493 { "acl_arg8", vtype_stringptr, &acl_arg[7] },
494 { "acl_arg9", vtype_stringptr, &acl_arg[8] },
495 { "acl_narg", vtype_int, &acl_narg },
496 { "acl_verify_message", vtype_stringptr, &acl_verify_message },
497 { "address_data", vtype_stringptr, &deliver_address_data },
498 { "address_file", vtype_stringptr, &address_file },
499 { "address_pipe", vtype_stringptr, &address_pipe },
500 #ifdef EXPERIMENTAL_ARC
501 { "arc_domains", vtype_string_func, (void *) &fn_arc_domains },
502 { "arc_oldest_pass", vtype_int, &arc_oldest_pass },
503 { "arc_state", vtype_stringptr, &arc_state },
504 { "arc_state_reason", vtype_stringptr, &arc_state_reason },
506 { "authenticated_fail_id",vtype_stringptr, &authenticated_fail_id },
507 { "authenticated_id", vtype_stringptr, &authenticated_id },
508 { "authenticated_sender",vtype_stringptr, &authenticated_sender },
509 { "authentication_failed",vtype_int, &authentication_failed },
510 #ifdef WITH_CONTENT_SCAN
511 { "av_failed", vtype_int, &av_failed },
513 #ifdef EXPERIMENTAL_BRIGHTMAIL
514 { "bmi_alt_location", vtype_stringptr, &bmi_alt_location },
515 { "bmi_base64_tracker_verdict", vtype_stringptr, &bmi_base64_tracker_verdict },
516 { "bmi_base64_verdict", vtype_stringptr, &bmi_base64_verdict },
517 { "bmi_deliver", vtype_int, &bmi_deliver },
519 { "body_linecount", vtype_int, &body_linecount },
520 { "body_zerocount", vtype_int, &body_zerocount },
521 { "bounce_recipient", vtype_stringptr, &bounce_recipient },
522 { "bounce_return_size_limit", vtype_int, &bounce_return_size_limit },
523 { "caller_gid", vtype_gid, &real_gid },
524 { "caller_uid", vtype_uid, &real_uid },
525 { "callout_address", vtype_stringptr, &callout_address },
526 { "compile_date", vtype_stringptr, &version_date },
527 { "compile_number", vtype_stringptr, &version_cnumber },
528 { "config_dir", vtype_stringptr, &config_main_directory },
529 { "config_file", vtype_stringptr, &config_main_filename },
530 { "csa_status", vtype_stringptr, &csa_status },
531 #ifdef EXPERIMENTAL_DCC
532 { "dcc_header", vtype_stringptr, &dcc_header },
533 { "dcc_result", vtype_stringptr, &dcc_result },
536 { "dkim_algo", vtype_dkim, (void *)DKIM_ALGO },
537 { "dkim_bodylength", vtype_dkim, (void *)DKIM_BODYLENGTH },
538 { "dkim_canon_body", vtype_dkim, (void *)DKIM_CANON_BODY },
539 { "dkim_canon_headers", vtype_dkim, (void *)DKIM_CANON_HEADERS },
540 { "dkim_copiedheaders", vtype_dkim, (void *)DKIM_COPIEDHEADERS },
541 { "dkim_created", vtype_dkim, (void *)DKIM_CREATED },
542 { "dkim_cur_signer", vtype_stringptr, &dkim_cur_signer },
543 { "dkim_domain", vtype_stringptr, &dkim_signing_domain },
544 { "dkim_expires", vtype_dkim, (void *)DKIM_EXPIRES },
545 { "dkim_headernames", vtype_dkim, (void *)DKIM_HEADERNAMES },
546 { "dkim_identity", vtype_dkim, (void *)DKIM_IDENTITY },
547 { "dkim_key_granularity",vtype_dkim, (void *)DKIM_KEY_GRANULARITY },
548 { "dkim_key_length", vtype_int, &dkim_key_length },
549 { "dkim_key_nosubdomains",vtype_dkim, (void *)DKIM_NOSUBDOMAINS },
550 { "dkim_key_notes", vtype_dkim, (void *)DKIM_KEY_NOTES },
551 { "dkim_key_srvtype", vtype_dkim, (void *)DKIM_KEY_SRVTYPE },
552 { "dkim_key_testing", vtype_dkim, (void *)DKIM_KEY_TESTING },
553 { "dkim_selector", vtype_stringptr, &dkim_signing_selector },
554 { "dkim_signers", vtype_stringptr, &dkim_signers },
555 { "dkim_verify_reason", vtype_stringptr, &dkim_verify_reason },
556 { "dkim_verify_status", vtype_stringptr, &dkim_verify_status },
559 { "dmarc_domain_policy", vtype_stringptr, &dmarc_domain_policy },
560 { "dmarc_status", vtype_stringptr, &dmarc_status },
561 { "dmarc_status_text", vtype_stringptr, &dmarc_status_text },
562 { "dmarc_used_domain", vtype_stringptr, &dmarc_used_domain },
564 { "dnslist_domain", vtype_stringptr, &dnslist_domain },
565 { "dnslist_matched", vtype_stringptr, &dnslist_matched },
566 { "dnslist_text", vtype_stringptr, &dnslist_text },
567 { "dnslist_value", vtype_stringptr, &dnslist_value },
568 { "domain", vtype_stringptr, &deliver_domain },
569 { "domain_data", vtype_stringptr, &deliver_domain_data },
570 #ifndef DISABLE_EVENT
571 { "event_data", vtype_stringptr, &event_data },
573 /*XXX want to use generic vars for as many of these as possible*/
574 { "event_defer_errno", vtype_int, &event_defer_errno },
576 { "event_name", vtype_stringptr, &event_name },
578 { "exim_gid", vtype_gid, &exim_gid },
579 { "exim_path", vtype_stringptr, &exim_path },
580 { "exim_uid", vtype_uid, &exim_uid },
581 { "exim_version", vtype_stringptr, &version_string },
582 { "headers_added", vtype_string_func, (void *) &fn_hdrs_added },
583 { "home", vtype_stringptr, &deliver_home },
584 { "host", vtype_stringptr, &deliver_host },
585 { "host_address", vtype_stringptr, &deliver_host_address },
586 { "host_data", vtype_stringptr, &host_data },
587 { "host_lookup_deferred",vtype_int, &host_lookup_deferred },
588 { "host_lookup_failed", vtype_int, &host_lookup_failed },
589 { "host_port", vtype_int, &deliver_host_port },
590 { "initial_cwd", vtype_stringptr, &initial_cwd },
591 { "inode", vtype_ino, &deliver_inode },
592 { "interface_address", vtype_stringptr, &interface_address },
593 { "interface_port", vtype_int, &interface_port },
594 { "item", vtype_stringptr, &iterate_item },
596 { "ldap_dn", vtype_stringptr, &eldap_dn },
598 { "load_average", vtype_load_avg, NULL },
599 { "local_part", vtype_stringptr, &deliver_localpart },
600 { "local_part_data", vtype_stringptr, &deliver_localpart_data },
601 { "local_part_prefix", vtype_stringptr, &deliver_localpart_prefix },
602 { "local_part_prefix_v", vtype_stringptr, &deliver_localpart_prefix_v },
603 { "local_part_suffix", vtype_stringptr, &deliver_localpart_suffix },
604 { "local_part_suffix_v", vtype_stringptr, &deliver_localpart_suffix_v },
605 #ifdef HAVE_LOCAL_SCAN
606 { "local_scan_data", vtype_stringptr, &local_scan_data },
608 { "local_user_gid", vtype_gid, &local_user_gid },
609 { "local_user_uid", vtype_uid, &local_user_uid },
610 { "localhost_number", vtype_int, &host_number },
611 { "log_inodes", vtype_pinodes, (void *)FALSE },
612 { "log_space", vtype_pspace, (void *)FALSE },
613 { "lookup_dnssec_authenticated",vtype_stringptr,&lookup_dnssec_authenticated},
614 { "mailstore_basename", vtype_stringptr, &mailstore_basename },
615 #ifdef WITH_CONTENT_SCAN
616 { "malware_name", vtype_stringptr, &malware_name },
618 { "max_received_linelength", vtype_int, &max_received_linelength },
619 { "message_age", vtype_int, &message_age },
620 { "message_body", vtype_msgbody, &message_body },
621 { "message_body_end", vtype_msgbody_end, &message_body_end },
622 { "message_body_size", vtype_int, &message_body_size },
623 { "message_exim_id", vtype_stringptr, &message_id },
624 { "message_headers", vtype_msgheaders, NULL },
625 { "message_headers_raw", vtype_msgheaders_raw, NULL },
626 { "message_id", vtype_stringptr, &message_id },
627 { "message_linecount", vtype_int, &message_linecount },
628 { "message_size", vtype_int, &message_size },
630 { "message_smtputf8", vtype_bool, &message_smtputf8 },
632 #ifdef WITH_CONTENT_SCAN
633 { "mime_anomaly_level", vtype_int, &mime_anomaly_level },
634 { "mime_anomaly_text", vtype_stringptr, &mime_anomaly_text },
635 { "mime_boundary", vtype_stringptr, &mime_boundary },
636 { "mime_charset", vtype_stringptr, &mime_charset },
637 { "mime_content_description", vtype_stringptr, &mime_content_description },
638 { "mime_content_disposition", vtype_stringptr, &mime_content_disposition },
639 { "mime_content_id", vtype_stringptr, &mime_content_id },
640 { "mime_content_size", vtype_int, &mime_content_size },
641 { "mime_content_transfer_encoding",vtype_stringptr, &mime_content_transfer_encoding },
642 { "mime_content_type", vtype_stringptr, &mime_content_type },
643 { "mime_decoded_filename", vtype_stringptr, &mime_decoded_filename },
644 { "mime_filename", vtype_stringptr, &mime_filename },
645 { "mime_is_coverletter", vtype_int, &mime_is_coverletter },
646 { "mime_is_multipart", vtype_int, &mime_is_multipart },
647 { "mime_is_rfc822", vtype_int, &mime_is_rfc822 },
648 { "mime_part_count", vtype_int, &mime_part_count },
650 { "n0", vtype_filter_int, &filter_n[0] },
651 { "n1", vtype_filter_int, &filter_n[1] },
652 { "n2", vtype_filter_int, &filter_n[2] },
653 { "n3", vtype_filter_int, &filter_n[3] },
654 { "n4", vtype_filter_int, &filter_n[4] },
655 { "n5", vtype_filter_int, &filter_n[5] },
656 { "n6", vtype_filter_int, &filter_n[6] },
657 { "n7", vtype_filter_int, &filter_n[7] },
658 { "n8", vtype_filter_int, &filter_n[8] },
659 { "n9", vtype_filter_int, &filter_n[9] },
660 { "original_domain", vtype_stringptr, &deliver_domain_orig },
661 { "original_local_part", vtype_stringptr, &deliver_localpart_orig },
662 { "originator_gid", vtype_gid, &originator_gid },
663 { "originator_uid", vtype_uid, &originator_uid },
664 { "parent_domain", vtype_stringptr, &deliver_domain_parent },
665 { "parent_local_part", vtype_stringptr, &deliver_localpart_parent },
666 { "pid", vtype_pid, NULL },
668 { "prdr_requested", vtype_bool, &prdr_requested },
670 { "primary_hostname", vtype_stringptr, &primary_hostname },
671 #if defined(SUPPORT_PROXY) || defined(SUPPORT_SOCKS)
672 { "proxy_external_address",vtype_stringptr, &proxy_external_address },
673 { "proxy_external_port", vtype_int, &proxy_external_port },
674 { "proxy_local_address", vtype_stringptr, &proxy_local_address },
675 { "proxy_local_port", vtype_int, &proxy_local_port },
676 { "proxy_session", vtype_bool, &proxy_session },
678 { "prvscheck_address", vtype_stringptr, &prvscheck_address },
679 { "prvscheck_keynum", vtype_stringptr, &prvscheck_keynum },
680 { "prvscheck_result", vtype_stringptr, &prvscheck_result },
681 { "qualify_domain", vtype_stringptr, &qualify_domain_sender },
682 { "qualify_recipient", vtype_stringptr, &qualify_domain_recipient },
683 { "queue_name", vtype_stringptr, &queue_name },
684 { "queue_size", vtype_string_func, (void *) &fn_queue_size },
685 { "rcpt_count", vtype_int, &rcpt_count },
686 { "rcpt_defer_count", vtype_int, &rcpt_defer_count },
687 { "rcpt_fail_count", vtype_int, &rcpt_fail_count },
688 { "received_count", vtype_int, &received_count },
689 { "received_for", vtype_stringptr, &received_for },
690 { "received_ip_address", vtype_stringptr, &interface_address },
691 { "received_port", vtype_int, &interface_port },
692 { "received_protocol", vtype_stringptr, &received_protocol },
693 { "received_time", vtype_int, &received_time.tv_sec },
694 { "recipient_data", vtype_stringptr, &recipient_data },
695 { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
696 { "recipients", vtype_string_func, (void *) &fn_recipients },
697 { "recipients_count", vtype_int, &recipients_count },
698 { "recipients_list", vtype_string_func, (void *) &fn_recipients_list },
699 { "regex_cachesize", vtype_int, ®ex_cachesize },/* undocumented; devel observability */
700 #ifdef WITH_CONTENT_SCAN
701 { "regex_match_string", vtype_stringptr, ®ex_match_string },
703 { "reply_address", vtype_reply, NULL },
704 { "return_path", vtype_stringptr, &return_path },
705 { "return_size_limit", vtype_int, &bounce_return_size_limit },
706 { "router_name", vtype_stringptr, &router_name },
707 { "runrc", vtype_int, &runrc },
708 { "self_hostname", vtype_stringptr, &self_hostname },
709 { "sender_address", vtype_stringptr, &sender_address },
710 { "sender_address_data", vtype_stringptr, &sender_address_data },
711 { "sender_address_domain", vtype_domain, &sender_address },
712 { "sender_address_local_part", vtype_localpart, &sender_address },
713 { "sender_data", vtype_stringptr, &sender_data },
714 { "sender_fullhost", vtype_stringptr, &sender_fullhost },
715 { "sender_helo_dnssec", vtype_bool, &sender_helo_dnssec },
716 { "sender_helo_name", vtype_stringptr, &sender_helo_name },
717 { "sender_helo_verified",vtype_string_func, (void *) &sender_helo_verified_boolstr },
718 { "sender_host_address", vtype_stringptr, &sender_host_address },
719 { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated },
720 { "sender_host_dnssec", vtype_bool, &sender_host_dnssec },
721 { "sender_host_name", vtype_host_lookup, NULL },
722 { "sender_host_port", vtype_int, &sender_host_port },
723 { "sender_ident", vtype_stringptr, &sender_ident },
724 { "sender_rate", vtype_stringptr, &sender_rate },
725 { "sender_rate_limit", vtype_stringptr, &sender_rate_limit },
726 { "sender_rate_period", vtype_stringptr, &sender_rate_period },
727 { "sender_rcvhost", vtype_stringptr, &sender_rcvhost },
728 { "sender_verify_failure",vtype_stringptr, &sender_verify_failure },
729 { "sending_ip_address", vtype_stringptr, &sending_ip_address },
730 { "sending_port", vtype_int, &sending_port },
731 { "smtp_active_hostname", vtype_stringptr, &smtp_active_hostname },
732 { "smtp_command", vtype_stringptr, &smtp_cmd_buffer },
733 { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
734 { "smtp_command_history", vtype_string_func, (void *) &smtp_cmd_hist },
735 { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
736 { "smtp_notquit_reason", vtype_stringptr, &smtp_notquit_reason },
737 { "sn0", vtype_filter_int, &filter_sn[0] },
738 { "sn1", vtype_filter_int, &filter_sn[1] },
739 { "sn2", vtype_filter_int, &filter_sn[2] },
740 { "sn3", vtype_filter_int, &filter_sn[3] },
741 { "sn4", vtype_filter_int, &filter_sn[4] },
742 { "sn5", vtype_filter_int, &filter_sn[5] },
743 { "sn6", vtype_filter_int, &filter_sn[6] },
744 { "sn7", vtype_filter_int, &filter_sn[7] },
745 { "sn8", vtype_filter_int, &filter_sn[8] },
746 { "sn9", vtype_filter_int, &filter_sn[9] },
747 #ifdef WITH_CONTENT_SCAN
748 { "spam_action", vtype_stringptr, &spam_action },
749 { "spam_bar", vtype_stringptr, &spam_bar },
750 { "spam_report", vtype_stringptr, &spam_report },
751 { "spam_score", vtype_stringptr, &spam_score },
752 { "spam_score_int", vtype_stringptr, &spam_score_int },
755 { "spf_guess", vtype_stringptr, &spf_guess },
756 { "spf_header_comment", vtype_stringptr, &spf_header_comment },
757 { "spf_received", vtype_stringptr, &spf_received },
758 { "spf_result", vtype_stringptr, &spf_result },
759 { "spf_result_guessed", vtype_bool, &spf_result_guessed },
760 { "spf_smtp_comment", vtype_stringptr, &spf_smtp_comment },
762 { "spool_directory", vtype_stringptr, &spool_directory },
763 { "spool_inodes", vtype_pinodes, (void *)TRUE },
764 { "spool_space", vtype_pspace, (void *)TRUE },
766 { "srs_recipient", vtype_stringptr, &srs_recipient },
768 { "thisaddress", vtype_stringptr, &filter_thisaddress },
770 /* The non-(in,out) variables are now deprecated */
771 { "tls_bits", vtype_int, &tls_in.bits },
772 { "tls_certificate_verified", vtype_int, &tls_in.certificate_verified },
773 { "tls_cipher", vtype_stringptr, &tls_in.cipher },
775 { "tls_in_bits", vtype_int, &tls_in.bits },
776 { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
777 { "tls_in_cipher", vtype_stringptr, &tls_in.cipher },
778 { "tls_in_cipher_std", vtype_stringptr, &tls_in.cipher_stdname },
779 { "tls_in_ocsp", vtype_int, &tls_in.ocsp },
780 { "tls_in_ourcert", vtype_cert, &tls_in.ourcert },
781 { "tls_in_peercert", vtype_cert, &tls_in.peercert },
782 { "tls_in_peerdn", vtype_stringptr, &tls_in.peerdn },
783 #ifndef DISABLE_TLS_RESUME
784 { "tls_in_resumption", vtype_int, &tls_in.resumption },
787 { "tls_in_sni", vtype_stringptr, &tls_in.sni },
789 { "tls_in_ver", vtype_stringptr, &tls_in.ver },
790 { "tls_out_bits", vtype_int, &tls_out.bits },
791 { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
792 { "tls_out_cipher", vtype_stringptr, &tls_out.cipher },
793 { "tls_out_cipher_std", vtype_stringptr, &tls_out.cipher_stdname },
795 { "tls_out_dane", vtype_bool, &tls_out.dane_verified },
797 { "tls_out_ocsp", vtype_int, &tls_out.ocsp },
798 { "tls_out_ourcert", vtype_cert, &tls_out.ourcert },
799 { "tls_out_peercert", vtype_cert, &tls_out.peercert },
800 { "tls_out_peerdn", vtype_stringptr, &tls_out.peerdn },
801 #ifndef DISABLE_TLS_RESUME
802 { "tls_out_resumption", vtype_int, &tls_out.resumption },
805 { "tls_out_sni", vtype_stringptr, &tls_out.sni },
808 { "tls_out_tlsa_usage", vtype_int, &tls_out.tlsa_usage },
810 { "tls_out_ver", vtype_stringptr, &tls_out.ver },
812 { "tls_peerdn", vtype_stringptr, &tls_in.peerdn }, /* mind the alphabetical order! */
814 { "tls_sni", vtype_stringptr, &tls_in.sni }, /* mind the alphabetical order! */
817 { "tod_bsdinbox", vtype_todbsdin, NULL },
818 { "tod_epoch", vtype_tode, NULL },
819 { "tod_epoch_l", vtype_todel, NULL },
820 { "tod_full", vtype_todf, NULL },
821 { "tod_log", vtype_todl, NULL },
822 { "tod_logfile", vtype_todlf, NULL },
823 { "tod_zone", vtype_todzone, NULL },
824 { "tod_zulu", vtype_todzulu, NULL },
825 { "transport_name", vtype_stringptr, &transport_name },
826 { "value", vtype_stringptr, &lookup_value },
827 { "verify_mode", vtype_stringptr, &verify_mode },
828 { "version_number", vtype_stringptr, &version_string },
829 { "warn_message_delay", vtype_stringptr, &warnmsg_delay },
830 { "warn_message_recipient",vtype_stringptr, &warnmsg_recipients },
831 { "warn_message_recipients",vtype_stringptr,&warnmsg_recipients },
832 { "warnmsg_delay", vtype_stringptr, &warnmsg_delay },
833 { "warnmsg_recipient", vtype_stringptr, &warnmsg_recipients },
834 { "warnmsg_recipients", vtype_stringptr, &warnmsg_recipients }
840 uschar * fn_arc_domains(void) {return NULL;}
841 uschar * fn_hdrs_added(void) {return NULL;}
842 uschar * fn_queue_size(void) {return NULL;}
843 uschar * fn_recipients(void) {return NULL;}
844 uschar * fn_recipients_list(void) {return NULL;}
845 uschar * sender_helo_verified_boolstr(void) {return NULL;}
846 uschar * smtp_cmd_hist(void) {return NULL;}
851 expansion_items(void)
854 for (int i = 0; i < nelem(item_table); i++)
856 spf(buf, sizeof(buf), CUS"_EXP_ITEM_%T", item_table[i]);
857 builtin_macro_create(buf);
861 expansion_operators(void)
864 for (int i = 0; i < nelem(op_table_underscore); i++)
866 spf(buf, sizeof(buf), CUS"_EXP_OP_%T", op_table_underscore[i]);
867 builtin_macro_create(buf);
869 for (int i = 0; i < nelem(op_table_main); i++)
871 spf(buf, sizeof(buf), CUS"_EXP_OP_%T", op_table_main[i]);
872 builtin_macro_create(buf);
876 expansion_conditions(void)
879 for (int i = 0; i < nelem(cond_table); i++)
881 spf(buf, sizeof(buf), CUS"_EXP_COND_%T", cond_table[i]);
882 builtin_macro_create(buf);
886 expansion_variables(void)
889 for (int i = 0; i < nelem(var_table); i++)
891 spf(buf, sizeof(buf), CUS"_EXP_VAR_%T", var_table[i].name);
892 builtin_macro_create(buf);
900 expansion_operators();
901 expansion_conditions();
902 expansion_variables();
905 #else /*!MACRO_PREDEF*/
907 static uschar var_buffer[256];
908 static BOOL malformed_header;
910 /* For textual hashes */
912 static const char *hashcodes = "abcdefghijklmnopqrtsuvwxyz"
913 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
916 enum { HMAC_MD5, HMAC_SHA1 };
918 /* For numeric hashes */
920 static unsigned int prime[] = {
921 2, 3, 5, 7, 11, 13, 17, 19, 23, 29,
922 31, 37, 41, 43, 47, 53, 59, 61, 67, 71,
923 73, 79, 83, 89, 97, 101, 103, 107, 109, 113};
925 /* For printing modes in symbolic form */
927 static uschar *mtable_normal[] =
928 { US"---", US"--x", US"-w-", US"-wx", US"r--", US"r-x", US"rw-", US"rwx" };
930 static uschar *mtable_setid[] =
931 { US"--S", US"--s", US"-wS", US"-ws", US"r-S", US"r-s", US"rwS", US"rws" };
933 static uschar *mtable_sticky[] =
934 { US"--T", US"--t", US"-wT", US"-wt", US"r-T", US"r-t", US"rwT", US"rwt" };
936 /* flags for find_header() */
937 #define FH_EXISTS_ONLY BIT(0)
938 #define FH_WANT_RAW BIT(1)
939 #define FH_WANT_LIST BIT(2)
941 /* Recursively called function */
942 static uschar *expand_string_internal(const uschar *, esi_flags, const uschar **, BOOL *, BOOL *);
943 static int_eximarith_t expanded_string_integer(const uschar *, BOOL);
946 /*************************************************
947 * Tables for UTF-8 support *
948 *************************************************/
950 /* Table of the number of extra characters, indexed by the first character
951 masked with 0x3f. The highest number for a valid UTF-8 character is in fact
954 static uschar utf8_table1[] = {
955 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
956 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
957 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
958 3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
960 /* These are the masks for the data bits in the first byte of a character,
961 indexed by the number of additional bytes. */
963 static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
965 /* Get the next UTF-8 character, advancing the pointer. */
967 #define GETUTF8INC(c, ptr) \
969 if ((c & 0xc0) == 0xc0) \
971 int a = utf8_table1[c & 0x3f]; /* Number of additional bytes */ \
973 c = (c & utf8_table2[a]) << s; \
977 c |= (*ptr++ & 0x3f) << s; \
983 static uschar * base32_chars = US"abcdefghijklmnopqrstuvwxyz234567";
985 /*************************************************
986 * Binary chop search on a table *
987 *************************************************/
989 /* This is used for matching expansion items and operators.
992 name the name that is being sought
993 table the table to search
994 table_size the number of items in the table
996 Returns: the offset in the table, or -1
1000 chop_match(uschar *name, uschar **table, int table_size)
1002 uschar **bot = table;
1003 uschar **top = table + table_size;
1007 uschar **mid = bot + (top - bot)/2;
1008 int c = Ustrcmp(name, *mid);
1009 if (c == 0) return mid - table;
1010 if (c > 0) bot = mid + 1; else top = mid;
1018 /*************************************************
1019 * Check a condition string *
1020 *************************************************/
1022 /* This function is called to expand a string, and test the result for a "true"
1023 or "false" value. Failure of the expansion yields FALSE; logged unless it was a
1024 forced fail or lookup defer.
1026 We used to release all store used, but this is not not safe due
1027 to ${dlfunc } and ${acl }. In any case expand_string_internal()
1028 is reasonably careful to release what it can.
1030 The actual false-value tests should be replicated for ECOND_BOOL_LAX.
1033 condition the condition string
1034 m1 text to be incorporated in panic error
1037 Returns: TRUE if condition is met, FALSE if not
1041 expand_check_condition(uschar *condition, uschar *m1, uschar *m2)
1043 uschar * ss = expand_string(condition);
1046 if (!f.expand_string_forcedfail && !f.search_find_defer)
1047 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand condition \"%s\" "
1048 "for %s %s: %s", condition, m1, m2, expand_string_message);
1051 return *ss && Ustrcmp(ss, "0") != 0 && strcmpic(ss, US"no") != 0 &&
1052 strcmpic(ss, US"false") != 0;
1058 /*************************************************
1059 * Pseudo-random number generation *
1060 *************************************************/
1062 /* Pseudo-random number generation. The result is not "expected" to be
1063 cryptographically strong but not so weak that someone will shoot themselves
1064 in the foot using it as a nonce in some email header scheme or whatever
1065 weirdness they'll twist this into. The result should ideally handle fork().
1067 However, if we're stuck unable to provide this, then we'll fall back to
1068 appallingly bad randomness.
1070 If DISABLE_TLS is not defined then this will not be used except as an emergency
1075 Returns a random number in range [0, max-1]
1079 # define vaguely_random_number vaguely_random_number_fallback
1082 vaguely_random_number(int max)
1085 # undef vaguely_random_number
1087 static pid_t pid = 0;
1090 if ((p2 = getpid()) != pid)
1095 #ifdef HAVE_ARC4RANDOM
1096 /* cryptographically strong randomness, common on *BSD platforms, not
1097 so much elsewhere. Alas. */
1098 # ifndef NOT_HAVE_ARC4RANDOM_STIR
1101 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
1102 # ifdef HAVE_SRANDOMDEV
1103 /* uses random(4) for seeding */
1108 gettimeofday(&tv, NULL);
1109 srandom(tv.tv_sec | tv.tv_usec | getpid());
1113 /* Poor randomness and no seeding here */
1120 #ifdef HAVE_ARC4RANDOM
1121 return arc4random() % max;
1122 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
1123 return random() % max;
1125 /* This one returns a 16-bit number, definitely not crypto-strong */
1126 return random_number(max);
1133 /*************************************************
1134 * Pick out a name from a string *
1135 *************************************************/
1137 /* If the name is too long, it is silently truncated.
1140 name points to a buffer into which to put the name
1141 max is the length of the buffer
1142 s points to the first alphabetic character of the name
1143 extras chars other than alphanumerics to permit
1145 Returns: pointer to the first character after the name
1147 Note: The test for *s != 0 in the while loop is necessary because
1148 Ustrchr() yields non-NULL if the character is zero (which is not something
1151 static const uschar *
1152 read_name(uschar *name, int max, const uschar *s, uschar *extras)
1155 while (*s && (isalnum(*s) || Ustrchr(extras, *s) != NULL))
1157 if (ptr < max-1) name[ptr++] = *s;
1166 /*************************************************
1167 * Pick out the rest of a header name *
1168 *************************************************/
1170 /* A variable name starting $header_ (or just $h_ for those who like
1171 abbreviations) might not be the complete header name because headers can
1172 contain any printing characters in their names, except ':'. This function is
1173 called to read the rest of the name, chop h[eader]_ off the front, and put ':'
1174 on the end, if the name was terminated by white space.
1177 name points to a buffer in which the name read so far exists
1178 max is the length of the buffer
1179 s points to the first character after the name so far, i.e. the
1180 first non-alphameric character after $header_xxxxx
1182 Returns: a pointer to the first character after the header name
1185 static const uschar *
1186 read_header_name(uschar *name, int max, const uschar *s)
1188 int prelen = Ustrchr(name, '_') - name + 1;
1189 int ptr = Ustrlen(name) - prelen;
1190 if (ptr > 0) memmove(name, name+prelen, ptr);
1191 while (mac_isgraph(*s) && *s != ':')
1193 if (ptr < max-1) name[ptr++] = *s;
1204 /*************************************************
1205 * Pick out a number from a string *
1206 *************************************************/
1209 n points to an integer into which to put the number
1210 s points to the first digit of the number
1212 Returns: a pointer to the character after the last digit
1214 /*XXX consider expanding to int_eximarith_t. But the test for
1215 "overbig numbers" in 0002 still needs to overflow it. */
1218 read_number(int *n, uschar *s)
1221 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1225 static const uschar *
1226 read_cnumber(int *n, const uschar *s)
1229 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1235 /*************************************************
1236 * Extract keyed subfield from a string *
1237 *************************************************/
1239 /* The yield is in dynamic store; NULL means that the key was not found.
1242 key points to the name of the key
1243 s points to the string from which to extract the subfield
1245 Returns: NULL if the subfield was not found, or
1246 a pointer to the subfield's data
1250 expand_getkeyed(const uschar * key, const uschar * s)
1252 int length = Ustrlen(key);
1253 Uskip_whitespace(&s);
1255 /* Loop to search for the key */
1261 const uschar * dkey = s;
1263 while (*s && *s != '=' && !isspace(*s)) s++;
1264 dkeylength = s - dkey;
1265 if (Uskip_whitespace(&s) == '=') while (isspace(*++s));
1267 data = string_dequote(&s);
1268 if (length == dkeylength && strncmpic(key, dkey, length) == 0)
1271 Uskip_whitespace(&s);
1280 find_var_ent(uschar * name)
1283 int last = nelem(var_table);
1285 while (last > first)
1287 int middle = (first + last)/2;
1288 int c = Ustrcmp(name, var_table[middle].name);
1290 if (c > 0) { first = middle + 1; continue; }
1291 if (c < 0) { last = middle; continue; }
1292 return &var_table[middle];
1297 /*************************************************
1298 * Extract numbered subfield from string *
1299 *************************************************/
1301 /* Extracts a numbered field from a string that is divided by tokens - for
1302 example a line from /etc/passwd is divided by colon characters. First field is
1303 numbered one. Negative arguments count from the right. Zero returns the whole
1304 string. Returns NULL if there are insufficient tokens in the string
1307 Modifies final argument - this is a dynamically generated string, so that's OK.
1310 field number of field to be extracted,
1311 first field = 1, whole string = 0, last field = -1
1312 separators characters that are used to break string into tokens
1313 s points to the string from which to extract the subfield
1315 Returns: NULL if the field was not found,
1316 a pointer to the field's data inside s (modified to add 0)
1320 expand_gettokened (int field, uschar *separators, uschar *s)
1325 uschar *fieldtext = NULL;
1327 if (field == 0) return s;
1329 /* Break the line up into fields in place; for field > 0 we stop when we have
1330 done the number of fields we want. For field < 0 we continue till the end of
1331 the string, counting the number of fields. */
1333 count = (field > 0)? field : INT_MAX;
1339 /* Previous field was the last one in the string. For a positive field
1340 number, this means there are not enough fields. For a negative field number,
1341 check that there are enough, and scan back to find the one that is wanted. */
1345 if (field > 0 || (-field) > (INT_MAX - count - 1)) return NULL;
1346 if ((-field) == (INT_MAX - count - 1)) return s;
1350 while (ss[-1] != 0) ss--;
1356 /* Previous field was not last in the string; save its start and put a
1360 len = Ustrcspn(ss, separators);
1371 expand_getlistele(int field, const uschar * list)
1373 const uschar * tlist = list;
1375 /* Tainted mem for the throwaway element copies */
1376 uschar * dummy = store_get(2, GET_TAINTED);
1380 for (field++; string_nextinlist(&tlist, &sep, dummy, 1); ) field++;
1383 if (field == 0) return NULL;
1384 while (--field > 0 && (string_nextinlist(&list, &sep, dummy, 1))) ;
1385 return string_nextinlist(&list, &sep, NULL, 0);
1389 /* Certificate fields, by name. Worry about by-OID later */
1390 /* Names are chosen to not have common prefixes */
1397 uschar * (*getfn)(void * cert, uschar * mod);
1399 static certfield certfields[] =
1400 { /* linear search; no special order */
1401 { US"version", 7, &tls_cert_version },
1402 { US"serial_number", 13, &tls_cert_serial_number },
1403 { US"subject", 7, &tls_cert_subject },
1404 { US"notbefore", 9, &tls_cert_not_before },
1405 { US"notafter", 8, &tls_cert_not_after },
1406 { US"issuer", 6, &tls_cert_issuer },
1407 { US"signature", 9, &tls_cert_signature },
1408 { US"sig_algorithm", 13, &tls_cert_signature_algorithm },
1409 { US"subj_altname", 12, &tls_cert_subject_altname },
1410 { US"ocsp_uri", 8, &tls_cert_ocsp_uri },
1411 { US"crl_uri", 7, &tls_cert_crl_uri },
1415 expand_getcertele(uschar * field, uschar * certvar)
1419 if (!(vp = find_var_ent(certvar)))
1421 expand_string_message =
1422 string_sprintf("no variable named \"%s\"", certvar);
1423 return NULL; /* Unknown variable name */
1425 /* NB this stops us passing certs around in variable. Might
1426 want to do that in future */
1427 if (vp->type != vtype_cert)
1429 expand_string_message =
1430 string_sprintf("\"%s\" is not a certificate", certvar);
1431 return NULL; /* Unknown variable name */
1433 if (!*(void **)vp->value)
1436 if (*field >= '0' && *field <= '9')
1437 return tls_cert_ext_by_oid(*(void **)vp->value, field, 0);
1439 for (certfield * cp = certfields;
1440 cp < certfields + nelem(certfields);
1442 if (Ustrncmp(cp->name, field, cp->namelen) == 0)
1444 uschar * modifier = *(field += cp->namelen) == ','
1446 return (*cp->getfn)( *(void **)vp->value, modifier );
1449 expand_string_message =
1450 string_sprintf("bad field selector \"%s\" for certextract", field);
1453 #endif /*DISABLE_TLS*/
1455 /*************************************************
1456 * Extract a substring from a string *
1457 *************************************************/
1459 /* Perform the ${substr or ${length expansion operations.
1462 subject the input string
1463 value1 the offset from the start of the input string to the start of
1464 the output string; if negative, count from the right.
1465 value2 the length of the output string, or negative (-1) for unset
1466 if value1 is positive, unset means "all after"
1467 if value1 is negative, unset means "all before"
1468 len set to the length of the returned string
1470 Returns: pointer to the output string, or NULL if there is an error
1474 extract_substr(uschar *subject, int value1, int value2, int *len)
1476 int sublen = Ustrlen(subject);
1478 if (value1 < 0) /* count from right */
1482 /* If the position is before the start, skip to the start, and adjust the
1483 length. If the length ends up negative, the substring is null because nothing
1484 can precede. This falls out naturally when the length is unset, meaning "all
1490 if (value2 < 0) value2 = 0;
1494 /* Otherwise an unset length => characters before value1 */
1496 else if (value2 < 0)
1503 /* For a non-negative offset, if the starting position is past the end of the
1504 string, the result will be the null string. Otherwise, an unset length means
1505 "rest"; just set it to the maximum - it will be cut down below if necessary. */
1509 if (value1 > sublen)
1514 else if (value2 < 0) value2 = sublen;
1517 /* Cut the length down to the maximum possible for the offset value, and get
1518 the required characters. */
1520 if (value1 + value2 > sublen) value2 = sublen - value1;
1522 return subject + value1;
1528 /*************************************************
1529 * Old-style hash of a string *
1530 *************************************************/
1532 /* Perform the ${hash expansion operation.
1535 subject the input string (an expanded substring)
1536 value1 the length of the output string; if greater or equal to the
1537 length of the input string, the input string is returned
1538 value2 the number of hash characters to use, or 26 if negative
1539 len set to the length of the returned string
1541 Returns: pointer to the output string, or NULL if there is an error
1545 compute_hash(uschar *subject, int value1, int value2, int *len)
1547 int sublen = Ustrlen(subject);
1549 if (value2 < 0) value2 = 26;
1550 else if (value2 > Ustrlen(hashcodes))
1552 expand_string_message =
1553 string_sprintf("hash count \"%d\" too big", value2);
1557 /* Calculate the hash text. We know it is shorter than the original string, so
1558 can safely place it in subject[] (we know that subject is always itself an
1559 expanded substring). */
1561 if (value1 < sublen)
1566 while ((c = (subject[j])) != 0)
1568 int shift = (c + j++) & 7;
1569 subject[i] ^= (c << shift) | (c >> (8-shift));
1570 if (++i >= value1) i = 0;
1572 for (i = 0; i < value1; i++)
1573 subject[i] = hashcodes[(subject[i]) % value2];
1575 else value1 = sublen;
1584 /*************************************************
1585 * Numeric hash of a string *
1586 *************************************************/
1588 /* Perform the ${nhash expansion operation. The first characters of the
1589 string are treated as most important, and get the highest prime numbers.
1592 subject the input string
1593 value1 the maximum value of the first part of the result
1594 value2 the maximum value of the second part of the result,
1595 or negative to produce only a one-part result
1596 len set to the length of the returned string
1598 Returns: pointer to the output string, or NULL if there is an error.
1602 compute_nhash (uschar *subject, int value1, int value2, int *len)
1604 uschar *s = subject;
1606 unsigned long int total = 0; /* no overflow */
1610 if (i == 0) i = nelem(prime) - 1;
1611 total += prime[i--] * (unsigned int)(*s++);
1614 /* If value2 is unset, just compute one number */
1617 s = string_sprintf("%lu", total % value1);
1619 /* Otherwise do a div/mod hash */
1623 total = total % (value1 * value2);
1624 s = string_sprintf("%lu/%lu", total/value2, total % value2);
1635 /*************************************************
1636 * Find the value of a header or headers *
1637 *************************************************/
1639 /* Multiple instances of the same header get concatenated, and this function
1640 can also return a concatenation of all the header lines. When concatenating
1641 specific headers that contain lists of addresses, a comma is inserted between
1642 them. Otherwise we use a straight concatenation. Because some messages can have
1643 pathologically large number of lines, there is a limit on the length that is
1647 name the name of the header, without the leading $header_ or $h_,
1648 or NULL if a concatenation of all headers is required
1649 newsize return the size of memory block that was obtained; may be NULL
1650 if exists_only is TRUE
1651 flags FH_EXISTS_ONLY
1652 set if called from a def: test; don't need to build a string;
1653 just return a string that is not "" and not "0" if the header
1656 set if called for $rh_ or $rheader_ items; no processing,
1657 other than concatenating, will be done on the header. Also used
1658 for $message_headers_raw.
1660 Double colon chars in the content, and replace newline with
1661 colon between each element when concatenating; returning a
1662 colon-sep list (elements might contain newlines)
1663 charset name of charset to translate MIME words to; used only if
1664 want_raw is false; if NULL, no translation is done (this is
1665 used for $bh_ and $bheader_)
1667 Returns: NULL if the header does not exist, else a pointer to a new
1672 find_header(uschar * name, int * newsize, unsigned flags, const uschar * charset)
1675 int len = name ? Ustrlen(name) : 0;
1680 for (header_line * h = header_list; h; h = h->next)
1681 if (h->type != htype_old && h->text) /* NULL => Received: placeholder */
1682 if (!name || (len <= h->slen && strncmpic(name, h->text, len) == 0))
1687 if (flags & FH_EXISTS_ONLY)
1688 return US"1"; /* don't need actual string */
1691 s = h->text + len; /* text to insert */
1692 if (!(flags & FH_WANT_RAW)) /* unless wanted raw, */
1693 Uskip_whitespace(&s); /* remove leading white space */
1694 t = h->text + h->slen; /* end-point */
1696 /* Unless wanted raw, remove trailing whitespace, including the
1699 if (flags & FH_WANT_LIST)
1700 while (t > s && t[-1] == '\n') t--;
1701 else if (!(flags & FH_WANT_RAW))
1703 while (t > s && isspace(t[-1])) t--;
1705 /* Set comma if handling a single header and it's one of those
1706 that contains an address list, except when asked for raw headers. Only
1707 need to do this once. */
1709 if (name && !comma && Ustrchr("BCFRST", h->type)) comma = TRUE;
1712 /* Trim the header roughly if we're approaching limits */
1714 if (gstring_length(g) + inc > header_insert_maxlen)
1715 inc = header_insert_maxlen - gstring_length(g);
1717 /* For raw just copy the data; for a list, add the data as a colon-sep
1718 list-element; for comma-list add as an unchecked comma,newline sep
1719 list-elemment; for other nonraw add as an unchecked newline-sep list (we
1720 stripped trailing WS above including the newline). We ignore the potential
1721 expansion due to colon-doubling, just leaving the loop if the limit is met
1724 if (flags & FH_WANT_LIST)
1725 g = string_append_listele_n(g, ':', s, (unsigned)inc);
1726 else if (flags & FH_WANT_RAW)
1727 g = string_catn(g, s, (unsigned)inc);
1729 g = string_append2_listele_n(g, comma ? US",\n" : US"\n",
1732 if (gstring_length(g) >= header_insert_maxlen) break;
1735 if (!found) return NULL; /* No header found */
1736 if (!g) return US"";
1738 /* That's all we do for raw header expansion. */
1741 rawhdr = string_from_gstring(g);
1742 if (flags & FH_WANT_RAW)
1745 /* Otherwise do RFC 2047 decoding, translating the charset if requested.
1746 The rfc2047_decode2() function can return an error with decoded data if the
1747 charset translation fails. If decoding fails, it returns NULL. */
1751 uschar * error, * decoded = rfc2047_decode2(rawhdr,
1752 check_rfc2047_length, charset, '?', NULL, newsize, &error);
1754 DEBUG(D_any) debug_printf("*** error in RFC 2047 decoding: %s\n"
1755 " input was: %s\n", error, rawhdr);
1756 return decoded ? decoded : rawhdr;
1763 /* Append a "local" element to an Authentication-Results: header
1764 if this was a non-smtp message.
1768 authres_local(gstring * g, const uschar * sysname)
1770 if (!f.authentication_local)
1772 g = string_append(g, 3, US";\n\tlocal=pass (non-smtp, ", sysname, US")");
1773 if (authenticated_id) g = string_append(g, 2, " u=", authenticated_id);
1778 /* Append an "iprev" element to an Authentication-Results: header
1779 if we have attempted to get the calling host's name.
1783 authres_iprev(gstring * g)
1785 if (sender_host_name)
1786 g = string_append(g, 3, US";\n\tiprev=pass (", sender_host_name, US")");
1787 else if (host_lookup_deferred)
1788 g = string_cat(g, US";\n\tiprev=temperror");
1789 else if (host_lookup_failed)
1790 g = string_cat(g, US";\n\tiprev=fail");
1794 if (sender_host_address)
1795 g = string_append(g, 2, US" smtp.remote-ip=", sender_host_address);
1801 /*************************************************
1802 * Return list of recipients *
1803 *************************************************/
1804 /* A recipients list is available only during system message filtering,
1805 during ACL processing after DATA, and while expanding pipe commands
1806 generated from a system filter, but not elsewhere. Note that this does
1807 not check for commas in the elements, and uses comma-space as seperator -
1808 so cannot be used as an exim list as-is. */
1815 if (!f.enable_dollar_recipients) return NULL;
1817 for (int i = 0; i < recipients_count; i++)
1819 const uschar * s = recipients_list[i].address;
1820 g = string_append2_listele_n(g, US", ", s, Ustrlen(s));
1822 gstring_release_unused(g);
1823 return string_from_gstring(g);
1826 /* Similar, but as a properly-quoted exim list */
1830 fn_recipients_list(void)
1834 if (!f.enable_dollar_recipients) return NULL;
1836 for (int i = 0; i < recipients_count; i++)
1837 g = string_append_listele(g, ':', recipients_list[i].address);
1838 gstring_release_unused(g);
1839 return string_from_gstring(g);
1843 /*************************************************
1844 * Return size of queue *
1845 *************************************************/
1846 /* Ask the daemon for the queue size */
1851 struct sockaddr_un sa_un = {.sun_family = AF_UNIX};
1855 const uschar * where;
1858 if ((fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0)
1860 DEBUG(D_expand) debug_printf(" socket: %s\n", strerror(errno));
1864 len = daemon_client_sockname(&sa_un, &sname);
1866 if (bind(fd, (const struct sockaddr *)&sa_un, (socklen_t)len) < 0)
1867 { where = US"bind"; goto bad; }
1870 debug_printf("local addr '%s%s'\n",
1871 *sa_un.sun_path ? "" : "@",
1872 sa_un.sun_path + (*sa_un.sun_path ? 0 : 1));
1875 len = daemon_notifier_sockname(&sa_un);
1876 if (connect(fd, (const struct sockaddr *)&sa_un, len) < 0)
1877 { where = US"connect"; goto bad2; }
1879 buf[0] = NOTIFY_QUEUE_SIZE_REQ;
1880 if (send(fd, buf, 1, 0) < 0) { where = US"send"; goto bad; }
1882 if (poll_one_fd(fd, POLLIN, 2 * 1000) != 1)
1884 DEBUG(D_expand) debug_printf("no daemon response; using local evaluation\n");
1885 len = snprintf(CS buf, sizeof(buf), "%u", queue_count_cached());
1887 else if ((len = recv(fd, buf, sizeof(buf), 0)) < 0)
1888 { where = US"recv"; goto bad2; }
1891 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1894 return string_copyn(buf, len);
1897 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1902 DEBUG(D_expand) debug_printf(" %s: %s\n", where, strerror(errno));
1907 /*************************************************
1908 * Find value of a variable *
1909 *************************************************/
1911 /* The table of variables is kept in alphabetic order, so we can search it
1912 using a binary chop. The "choplen" variable is nothing to do with the binary
1916 name the name of the variable being sought
1917 exists_only TRUE if this is a def: test; passed on to find_header()
1918 skipping TRUE => skip any processing evaluation; this is not the same as
1919 exists_only because def: may test for values that are first
1921 newsize pointer to an int which is initially zero; if the answer is in
1922 a new memory buffer, *newsize is set to its size
1924 Returns: NULL if the variable does not exist, or
1925 a pointer to the variable's contents, or
1926 something non-NULL if exists_only is TRUE
1929 static const uschar *
1930 find_variable(uschar *name, BOOL exists_only, BOOL skipping, int *newsize)
1937 /* Handle ACL variables, whose names are of the form acl_cxxx or acl_mxxx.
1938 Originally, xxx had to be a number in the range 0-9 (later 0-19), but from
1939 release 4.64 onwards arbitrary names are permitted, as long as the first 5
1940 characters are acl_c or acl_m and the sixth is either a digit or an underscore
1941 (this gave backwards compatibility at the changeover). There may be built-in
1942 variables whose names start acl_ but they should never start in this way. This
1943 slightly messy specification is a consequence of the history, needless to say.
1945 If an ACL variable does not exist, treat it as empty, unless strict_acl_vars is
1946 set, in which case give an error. */
1948 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
1952 tree_search(name[4] == 'c' ? acl_var_c : acl_var_m, name + 4);
1953 return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
1955 else if (Ustrncmp(name, "r_", 2) == 0)
1957 tree_node * node = tree_search(router_var, name + 2);
1958 return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
1961 /* Handle $auth<n>, $regex<n> variables. */
1963 if (Ustrncmp(name, "auth", 4) == 0)
1966 int n = Ustrtoul(name + 4, &endptr, 10);
1967 if (!*endptr && n != 0 && n <= AUTH_VARS)
1968 return auth_vars[n-1] ? auth_vars[n-1] : US"";
1970 #ifdef WITH_CONTENT_SCAN
1971 else if (Ustrncmp(name, "regex", 5) == 0)
1974 int n = Ustrtoul(name + 5, &endptr, 10);
1975 if (!*endptr && n != 0 && n <= REGEX_VARS)
1976 return regex_vars[n-1] ? regex_vars[n-1] : US"";
1980 /* For all other variables, search the table */
1982 if (!(vp = find_var_ent(name)))
1983 return NULL; /* Unknown variable name */
1985 /* Found an existing variable. If in skipping state, the value isn't needed,
1986 and we want to avoid processing (such as looking up the host name). */
1994 case vtype_filter_int:
1995 if (!f.filter_running) return NULL;
1999 sprintf(CS var_buffer, "%d", *(int *)(val)); /* Integer */
2003 sprintf(CS var_buffer, "%ld", (long int)(*(ino_t *)(val))); /* Inode */
2007 sprintf(CS var_buffer, "%ld", (long int)(*(gid_t *)(val))); /* gid */
2011 sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(val))); /* uid */
2015 sprintf(CS var_buffer, "%s", *(BOOL *)(val) ? "yes" : "no"); /* bool */
2018 case vtype_stringptr: /* Pointer to string */
2019 return (s = *((uschar **)(val))) ? s : US"";
2022 sprintf(CS var_buffer, "%d", (int)getpid()); /* pid */
2025 case vtype_load_avg:
2026 sprintf(CS var_buffer, "%d", OS_GETLOADAVG()); /* load_average */
2029 case vtype_host_lookup: /* Lookup if not done so */
2030 if ( !sender_host_name && sender_host_address
2031 && !host_lookup_failed && host_name_lookup() == OK)
2032 host_build_sender_fullhost();
2033 return sender_host_name ? sender_host_name : US"";
2035 case vtype_localpart: /* Get local part from address */
2036 if (!(s = *((uschar **)(val)))) return US"";
2037 if (!(domain = Ustrrchr(s, '@'))) return s;
2038 if (domain - s > sizeof(var_buffer) - 1)
2039 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
2040 " in string expansion", sizeof(var_buffer));
2041 return string_copyn(s, domain - s);
2043 case vtype_domain: /* Get domain from address */
2044 if (!(s = *((uschar **)(val)))) return US"";
2045 domain = Ustrrchr(s, '@');
2046 return domain ? domain + 1 : US"";
2048 case vtype_msgheaders:
2049 return find_header(NULL, newsize, exists_only ? FH_EXISTS_ONLY : 0, NULL);
2051 case vtype_msgheaders_raw:
2052 return find_header(NULL, newsize,
2053 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW, NULL);
2055 case vtype_msgbody: /* Pointer to msgbody string */
2056 case vtype_msgbody_end: /* Ditto, the end of the msg */
2057 ss = (uschar **)(val);
2058 if (!*ss && deliver_datafile >= 0) /* Read body when needed */
2061 off_t start_offset_o = spool_data_start_offset(message_id);
2062 off_t start_offset = start_offset_o;
2063 int len = message_body_visible;
2065 if (len > message_size) len = message_size;
2066 *ss = body = store_get(len+1, GET_TAINTED);
2068 if (vp->type == vtype_msgbody_end)
2070 struct stat statbuf;
2071 if (fstat(deliver_datafile, &statbuf) == 0)
2073 start_offset = statbuf.st_size - len;
2074 if (start_offset < start_offset_o)
2075 start_offset = start_offset_o;
2078 if (lseek(deliver_datafile, start_offset, SEEK_SET) < 0)
2079 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "deliver_datafile lseek: %s",
2081 if ((len = read(deliver_datafile, body, len)) > 0)
2084 if (message_body_newlines) /* Separate loops for efficiency */
2086 { if (body[--len] == 0) body[len] = ' '; }
2089 { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; }
2092 return *ss ? *ss : US"";
2094 case vtype_todbsdin: /* BSD inbox time of day */
2095 return tod_stamp(tod_bsdin);
2097 case vtype_tode: /* Unix epoch time of day */
2098 return tod_stamp(tod_epoch);
2100 case vtype_todel: /* Unix epoch/usec time of day */
2101 return tod_stamp(tod_epoch_l);
2103 case vtype_todf: /* Full time of day */
2104 return tod_stamp(tod_full);
2106 case vtype_todl: /* Log format time of day */
2107 return tod_stamp(tod_log_bare); /* (without timezone) */
2109 case vtype_todzone: /* Time zone offset only */
2110 return tod_stamp(tod_zone);
2112 case vtype_todzulu: /* Zulu time */
2113 return tod_stamp(tod_zulu);
2115 case vtype_todlf: /* Log file datestamp tod */
2116 return tod_stamp(tod_log_datestamp_daily);
2118 case vtype_reply: /* Get reply address */
2119 s = find_header(US"reply-to:", newsize,
2120 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW,
2122 if (s) Uskip_whitespace(&s);
2125 *newsize = 0; /* For the *s==0 case */
2126 s = find_header(US"from:", newsize,
2127 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW,
2133 Uskip_whitespace(&s);
2134 for (t = s; *t; t++) if (*t == '\n') *t = ' ';
2135 while (t > s && isspace(t[-1])) t--;
2138 return s ? s : US"";
2140 case vtype_string_func:
2142 stringptr_fn_t * fn = (stringptr_fn_t *) val;
2144 return s ? s : US"";
2150 sprintf(CS var_buffer, PR_EXIM_ARITH,
2151 receive_statvfs(val == (void *)TRUE, &inodes));
2158 (void) receive_statvfs(val == (void *)TRUE, &inodes);
2159 sprintf(CS var_buffer, "%d", inodes);
2164 return *(void **)val ? US"<cert>" : US"";
2166 #ifndef DISABLE_DKIM
2168 return dkim_exim_expand_query((int)(long)val);
2173 return NULL; /* Unknown variable. Silences static checkers. */
2180 modify_variable(uschar *name, void * value)
2183 if ((vp = find_var_ent(name))) vp->value = value;
2184 return; /* Unknown variable name, fail silently */
2192 /*************************************************
2193 * Read and expand substrings *
2194 *************************************************/
2196 /* This function is called to read and expand argument substrings for various
2197 expansion items. Some have a minimum requirement that is less than the maximum;
2198 in these cases, the first non-present one is set to NULL.
2201 sub points to vector of pointers to set
2202 n maximum number of substrings
2204 sptr points to current string pointer
2206 skipping the skipping flag
2207 check_end if TRUE, check for final '}'
2208 name name of item, for error message
2209 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
2211 textonly_p if not NULL, pointer to bitmask of which subs were text-only
2212 (did not change when expended)
2214 Returns: -1 OK; string pointer updated, but in "skipping" mode
2215 0 OK; string pointer updated
2216 1 curly bracketing error (too few arguments)
2217 2 too many arguments (only if check_end is set); message set
2218 3 other error (expansion failure)
2222 read_subs(uschar ** sub, int n, int m, const uschar ** sptr, esi_flags flags,
2223 BOOL check_end, uschar * name, BOOL * resetok, unsigned * textonly_p)
2225 const uschar * s = *sptr;
2226 unsigned textonly_l = 0;
2228 Uskip_whitespace(&s);
2229 for (int i = 0; i < n; i++)
2236 expand_string_message = string_sprintf("Not enough arguments for '%s' "
2237 "(min is %d)", name, m);
2243 if (!(sub[i] = expand_string_internal(s+1,
2244 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags & ESI_SKIPPING, &s, resetok,
2245 textonly_p ? &textonly : NULL)))
2247 if (*s++ != '}') return 1;
2248 if (textonly_p && textonly) textonly_l |= BIT(i);
2249 Uskip_whitespace(&s);
2251 if (check_end && *s++ != '}')
2255 expand_string_message = string_sprintf("Too many arguments for '%s' "
2256 "(max is %d)", name, n);
2259 expand_string_message = string_sprintf("missing '}' after '%s'", name);
2263 if (textonly_p) *textonly_p = textonly_l;
2265 return flags & ESI_SKIPPING ? -1 : 0;
2271 /*************************************************
2272 * Elaborate message for bad variable *
2273 *************************************************/
2275 /* For the "unknown variable" message, take a look at the variable's name, and
2276 give additional information about possible ACL variables. The extra information
2277 is added on to expand_string_message.
2279 Argument: the name of the variable
2284 check_variable_error_message(uschar *name)
2286 if (Ustrncmp(name, "acl_", 4) == 0)
2287 expand_string_message = string_sprintf("%s (%s)", expand_string_message,
2288 (name[4] == 'c' || name[4] == 'm')?
2290 US"6th character of a user-defined ACL variable must be a digit or underscore" :
2291 US"strict_acl_vars is set" /* Syntax is OK, it has to be this */
2293 US"user-defined ACL variables must start acl_c or acl_m");
2299 Load args from sub array to globals, and call acl_check().
2300 Sub array will be corrupted on return.
2302 Returns: OK access is granted by an ACCEPT verb
2303 DISCARD access is (apparently) granted by a DISCARD verb
2304 FAIL access is denied
2305 FAIL_DROP access is denied; drop the connection
2306 DEFER can't tell at the moment
2310 eval_acl(uschar ** sub, int nsub, uschar ** user_msgp)
2313 int sav_narg = acl_narg;
2315 uschar * dummy_logmsg;
2316 extern int acl_where;
2318 if(--nsub > nelem(acl_arg)) nsub = nelem(acl_arg);
2319 for (i = 0; i < nsub && sub[i+1]; i++)
2321 uschar * tmp = acl_arg[i];
2322 acl_arg[i] = sub[i+1]; /* place callers args in the globals */
2323 sub[i+1] = tmp; /* stash the old args using our caller's storage */
2328 sub[i+1] = acl_arg[i];
2329 acl_arg[i++] = NULL;
2333 debug_printf_indent("expanding: acl: %s arg: %s%s\n",
2335 acl_narg>0 ? acl_arg[0] : US"<none>",
2336 acl_narg>1 ? " +more" : "");
2338 ret = acl_eval(acl_where, sub[0], user_msgp, &dummy_logmsg);
2340 for (i = 0; i < nsub; i++)
2341 acl_arg[i] = sub[i+1]; /* restore old args */
2342 acl_narg = sav_narg;
2350 /* Return pointer to dewrapped string, with enclosing specified chars removed.
2351 The given string is modified on return. Leading whitespace is skipped while
2352 looking for the opening wrap character, then the rest is scanned for the trailing
2353 (non-escaped) wrap character. A backslash in the string will act as an escape.
2355 A nul is written over the trailing wrap, and a pointer to the char after the
2356 leading wrap is returned.
2359 s String for de-wrapping
2360 wrap Two-char string, the first being the opener, second the closer wrapping
2363 Pointer to de-wrapped string, or NULL on error (with expand_string_message set).
2367 dewrap(uschar * s, const uschar * wrap)
2371 BOOL quotesmode = wrap[0] == wrap[1];
2373 if (Uskip_whitespace(&p) == *wrap)
2379 if (*p == '\\') p++;
2380 else if (!quotesmode && *p == wrap[-1]) depth++;
2381 else if (*p == *wrap)
2392 expand_string_message = string_sprintf("missing '%c'", *wrap);
2397 /* Pull off the leading array or object element, returning
2398 a copy in an allocated string. Update the list pointer.
2400 The element may itself be an abject or array.
2401 Return NULL when the list is empty.
2405 json_nextinlist(const uschar ** list)
2407 unsigned array_depth = 0, object_depth = 0;
2408 BOOL quoted = FALSE;
2409 const uschar * s = *list, * item;
2411 skip_whitespace(&s);
2414 *s && (*s != ',' || array_depth != 0 || object_depth != 0 || quoted);
2416 if (!quoted) switch (*s)
2418 case '[': array_depth++; break;
2419 case ']': array_depth--; break;
2420 case '{': object_depth++; break;
2421 case '}': object_depth--; break;
2422 case '"': quoted = TRUE;
2426 case '\\': s++; break; /* backslash protects one char */
2427 case '"': quoted = FALSE; break;
2429 *list = *s ? s+1 : s;
2430 if (item == s) return NULL;
2431 item = string_copyn(item, s - item);
2432 DEBUG(D_expand) debug_printf_indent(" json ele: '%s'\n", item);
2438 /************************************************/
2439 /* Return offset in ops table, or -1 if not found.
2440 Repoint to just after the operator in the string.
2443 ss string representation of operator
2444 opname split-out operator name
2448 identify_operator(const uschar ** ss, uschar ** opname)
2450 const uschar * s = *ss;
2453 /* Numeric comparisons are symbolic */
2455 if (*s == '=' || *s == '>' || *s == '<')
2467 /* All other conditions are named */
2470 s = read_name(name, sizeof(name), s, US"_");
2473 /* If we haven't read a name, it means some non-alpha character is first. */
2477 expand_string_message = string_sprintf("condition name expected, "
2478 "but found \"%.16s\"", s);
2482 *opname = string_copy(name);
2484 return chop_match(name, cond_table, nelem(cond_table));
2488 /*************************************************
2489 * Handle MD5 or SHA-1 computation for HMAC *
2490 *************************************************/
2492 /* These are some wrapping functions that enable the HMAC code to be a bit
2493 cleaner. A good compiler will spot the tail recursion.
2496 type HMAC_MD5 or HMAC_SHA1
2497 remaining are as for the cryptographic hash functions
2503 chash_start(int type, void * base)
2505 if (type == HMAC_MD5)
2506 md5_start((md5 *)base);
2508 sha1_start((hctx *)base);
2512 chash_mid(int type, void * base, const uschar * string)
2514 if (type == HMAC_MD5)
2515 md5_mid((md5 *)base, string);
2517 sha1_mid((hctx *)base, string);
2521 chash_end(int type, void * base, const uschar * string, int length,
2524 if (type == HMAC_MD5)
2525 md5_end((md5 *)base, string, length, digest);
2527 sha1_end((hctx *)base, string, length, digest);
2534 /* Do an hmac_md5. The result is _not_ nul-terminated, and is sized as
2535 the smaller of a full hmac_md5 result (16 bytes) or the supplied output buffer.
2538 key encoding key, nul-terminated
2539 src data to be hashed, nul-terminated
2541 len size of output buffer
2545 hmac_md5(const uschar * key, const uschar * src, uschar * buf, unsigned len)
2548 const uschar * keyptr;
2550 unsigned int keylen;
2552 #define MD5_HASHLEN 16
2553 #define MD5_HASHBLOCKLEN 64
2555 uschar keyhash[MD5_HASHLEN];
2556 uschar innerhash[MD5_HASHLEN];
2557 uschar finalhash[MD5_HASHLEN];
2558 uschar innerkey[MD5_HASHBLOCKLEN];
2559 uschar outerkey[MD5_HASHBLOCKLEN];
2562 keylen = Ustrlen(keyptr);
2564 /* If the key is longer than the hash block length, then hash the key
2567 if (keylen > MD5_HASHBLOCKLEN)
2569 chash_start(HMAC_MD5, &md5_base);
2570 chash_end(HMAC_MD5, &md5_base, keyptr, keylen, keyhash);
2572 keylen = MD5_HASHLEN;
2575 /* Now make the inner and outer key values */
2577 memset(innerkey, 0x36, MD5_HASHBLOCKLEN);
2578 memset(outerkey, 0x5c, MD5_HASHBLOCKLEN);
2580 for (int i = 0; i < keylen; i++)
2582 innerkey[i] ^= keyptr[i];
2583 outerkey[i] ^= keyptr[i];
2586 /* Now do the hashes */
2588 chash_start(HMAC_MD5, &md5_base);
2589 chash_mid(HMAC_MD5, &md5_base, innerkey);
2590 chash_end(HMAC_MD5, &md5_base, src, Ustrlen(src), innerhash);
2592 chash_start(HMAC_MD5, &md5_base);
2593 chash_mid(HMAC_MD5, &md5_base, outerkey);
2594 chash_end(HMAC_MD5, &md5_base, innerhash, MD5_HASHLEN, finalhash);
2596 /* Encode the final hash as a hex string, limited by output buffer size */
2599 for (int i = 0, j = len; i < MD5_HASHLEN; i++)
2601 if (j-- <= 0) break;
2602 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
2603 if (j-- <= 0) break;
2604 *p++ = hex_digits[finalhash[i] & 0x0f];
2608 #endif /*SUPPORT_SRS*/
2611 /*************************************************
2612 * Read and evaluate a condition *
2613 *************************************************/
2617 s points to the start of the condition text
2618 resetok points to a BOOL which is written false if it is unsafe to
2619 free memory. Certain condition types (acl) may have side-effect
2620 allocation which must be preserved.
2621 yield points to a BOOL to hold the result of the condition test;
2622 if NULL, we are just reading through a condition that is
2623 part of an "or" combination to check syntax, or in a state
2624 where the answer isn't required
2626 Returns: a pointer to the first character after the condition, or
2630 static const uschar *
2631 eval_condition(const uschar * s, BOOL * resetok, BOOL * yield)
2633 BOOL testfor = TRUE;
2634 BOOL tempcond, combined_cond;
2636 BOOL sub2_honour_dollar = TRUE;
2637 BOOL is_forany, is_json, is_jsons;
2639 int_eximarith_t num[2];
2640 struct stat statbuf;
2643 const uschar * sub[10];
2644 unsigned sub_textonly = 0;
2647 if (Uskip_whitespace(&s) == '!') { testfor = !testfor; s++; } else break;
2649 switch(cond_type = identify_operator(&s, &opname))
2651 /* def: tests for a non-empty variable, or for the existence of a header. If
2652 yield == NULL we are in a skipping state, and don't care about the answer. */
2660 expand_string_message = US"\":\" expected after \"def\"";
2664 s = read_name(name, sizeof(name), s+1, US"_");
2666 /* Test for a header's existence. If the name contains a closing brace
2667 character, this may be a user error where the terminating colon has been
2668 omitted. Set a flag to adjust a subsequent error message in this case. */
2670 if ( ( *(t = name) == 'h'
2671 || (*t == 'r' || *t == 'l' || *t == 'b') && *++t == 'h'
2673 && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
2676 s = read_header_name(name, sizeof(name), s);
2677 /* {-for-text-editors */
2678 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
2680 (find_header(name, NULL, FH_EXISTS_ONLY, NULL) != NULL) == testfor;
2683 /* Test for a variable's having a non-empty value. A non-existent variable
2684 causes an expansion failure. */
2688 if (!(t = find_variable(name, TRUE, yield == NULL, NULL)))
2690 expand_string_message = name[0]
2691 ? string_sprintf("unknown variable \"%s\" after \"def:\"", name)
2692 : US"variable name omitted after \"def:\"";
2693 check_variable_error_message(name);
2696 if (yield) *yield = (t[0] != 0) == testfor;
2703 /* first_delivery tests for first delivery attempt */
2705 case ECOND_FIRST_DELIVERY:
2706 if (yield) *yield = f.deliver_firsttime == testfor;
2710 /* queue_running tests for any process started by a queue runner */
2712 case ECOND_QUEUE_RUNNING:
2713 if (yield) *yield = (queue_run_pid != (pid_t)0) == testfor;
2717 /* exists: tests for file existence
2718 isip: tests for any IP address
2719 isip4: tests for an IPv4 address
2720 isip6: tests for an IPv6 address
2721 pam: does PAM authentication
2722 radius: does RADIUS authentication
2723 ldapauth: does LDAP authentication
2724 pwcheck: does Cyrus SASL pwcheck authentication
2733 case ECOND_LDAPAUTH:
2736 if (Uskip_whitespace(&s) != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2740 sub[0] = expand_string_internal(s+1,
2741 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | (yield ? ESI_NOFLAGS : ESI_SKIPPING),
2742 &s, resetok, &textonly);
2743 if (!sub[0]) return NULL;
2744 if (textonly) sub_textonly |= BIT(0);
2746 /* {-for-text-editors */
2747 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2749 if (!yield) return s; /* No need to run the test if skipping */
2754 if ((expand_forbid & RDO_EXISTS) != 0)
2756 expand_string_message = US"File existence tests are not permitted";
2759 *yield = (Ustat(sub[0], &statbuf) == 0) == testfor;
2767 const uschar **errpp;
2768 DEBUG(D_expand) errpp = &errp; else errpp = 0;
2769 if (0 == (rc = string_is_ip_addressX(sub[0], NULL, errpp)))
2770 DEBUG(D_expand) debug_printf("failed: %s\n", errp);
2772 *yield = ( cond_type == ECOND_ISIP ? rc != 0 :
2773 cond_type == ECOND_ISIP4 ? rc == 4 : rc == 6) == testfor;
2778 /* Various authentication tests - all optionally compiled */
2782 rc = auth_call_pam(sub[0], &expand_string_message);
2785 goto COND_FAILED_NOT_COMPILED;
2786 #endif /* SUPPORT_PAM */
2789 #ifdef RADIUS_CONFIG_FILE
2790 rc = auth_call_radius(sub[0], &expand_string_message);
2793 goto COND_FAILED_NOT_COMPILED;
2794 #endif /* RADIUS_CONFIG_FILE */
2796 case ECOND_LDAPAUTH:
2799 /* Just to keep the interface the same */
2801 int old_pool = store_pool;
2802 store_pool = POOL_SEARCH;
2803 rc = eldapauth_find((void *)(-1), NULL, sub[0], Ustrlen(sub[0]), NULL,
2804 &expand_string_message, &do_cache);
2805 store_pool = old_pool;
2809 goto COND_FAILED_NOT_COMPILED;
2810 #endif /* LOOKUP_LDAP */
2813 #ifdef CYRUS_PWCHECK_SOCKET
2814 rc = auth_call_pwcheck(sub[0], &expand_string_message);
2817 goto COND_FAILED_NOT_COMPILED;
2818 #endif /* CYRUS_PWCHECK_SOCKET */
2820 #if defined(SUPPORT_PAM) || defined(RADIUS_CONFIG_FILE) || \
2821 defined(LOOKUP_LDAP) || defined(CYRUS_PWCHECK_SOCKET)
2823 if (rc == ERROR || rc == DEFER) return NULL;
2824 *yield = (rc == OK) == testfor;
2830 /* call ACL (in a conditional context). Accept true, deny false.
2831 Defer is a forced-fail. Anything set by message= goes to $value.
2832 Up to ten parameters are used; we use the braces round the name+args
2833 like the saslauthd condition does, to permit a variable number of args.
2834 See also the expansion-item version EITEM_ACL and the traditional
2835 acl modifier ACLC_ACL.
2836 Since the ACL may allocate new global variables, tell our caller to not
2841 /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */
2847 Uskip_whitespace(&s);
2848 if (*s++ != '{') goto COND_FAILED_CURLY_START; /*}*/
2850 switch(read_subs(sub, nelem(sub), 1, &s,
2851 yield ? ESI_NOFLAGS : ESI_SKIPPING, TRUE, name, resetok, NULL))
2853 case 1: expand_string_message = US"too few arguments or bracketing "
2856 case 3: return NULL;
2862 *resetok = FALSE; /* eval_acl() might allocate; do not reclaim */
2863 switch(rc = eval_acl(sub, nelem(sub), &user_msg))
2868 lookup_value = NULL;
2870 lookup_value = string_copy(user_msg);
2871 *yield = cond == testfor;
2875 f.expand_string_forcedfail = TRUE;
2878 expand_string_message = string_sprintf("%s from acl \"%s\"",
2879 rc_names[rc], sub[0]);
2887 /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used:
2889 ${if saslauthd {{username}{password}{service}{realm}} {yes}{no}}
2891 However, the last two are optional. That is why the whole set is enclosed
2892 in their own set of braces. */
2894 case ECOND_SASLAUTHD:
2895 #ifndef CYRUS_SASLAUTHD_SOCKET
2896 goto COND_FAILED_NOT_COMPILED;
2900 Uskip_whitespace(&s);
2901 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2902 switch(read_subs(sub, nelem(sub), 2, &s,
2903 yield ? ESI_NOFLAGS : ESI_SKIPPING, TRUE, name, resetok, NULL))
2905 case 1: expand_string_message = US"too few arguments or bracketing "
2906 "error for saslauthd";
2908 case 3: return NULL;
2910 if (!sub[2]) sub[3] = NULL; /* realm if no service */
2913 int rc = auth_call_saslauthd(sub[0], sub[1], sub[2], sub[3],
2914 &expand_string_message);
2915 if (rc == ERROR || rc == DEFER) return NULL;
2916 *yield = (rc == OK) == testfor;
2920 #endif /* CYRUS_SASLAUTHD_SOCKET */
2923 /* symbolic operators for numeric and string comparison, and a number of
2924 other operators, all requiring two arguments.
2926 crypteq: encrypts plaintext and compares against an encrypted text,
2927 using crypt(), crypt16(), MD5 or SHA-1
2928 inlist/inlisti: checks if first argument is in the list of the second
2929 match: does a regular expression match and sets up the numerical
2930 variables if it succeeds
2931 match_address: matches in an address list
2932 match_domain: matches in a domain list
2933 match_ip: matches a host list that is restricted to IP addresses
2934 match_local_part: matches in a local part list
2937 case ECOND_MATCH_ADDRESS:
2938 case ECOND_MATCH_DOMAIN:
2939 case ECOND_MATCH_IP:
2940 case ECOND_MATCH_LOCAL_PART:
2941 #ifndef EXPAND_LISTMATCH_RHS
2942 sub2_honour_dollar = FALSE;
2951 case ECOND_NUM_L: /* Numerical comparisons */
2958 case ECOND_STR_LT: /* String comparisons */
2969 for (int i = 0; i < 2; i++)
2972 /* Sometimes, we don't expand substrings; too many insecure configurations
2973 created using match_address{}{} and friends, where the second param
2974 includes information from untrustworthy sources. */
2975 /*XXX is this moot given taint-tracking? */
2977 esi_flags flags = ESI_BRACE_ENDS;
2979 if (!(i > 0 && !sub2_honour_dollar)) flags |= ESI_HONOR_DOLLAR;
2980 if (!yield) flags |= ESI_SKIPPING;
2982 if (Uskip_whitespace(&s) != '{')
2984 if (i == 0) goto COND_FAILED_CURLY_START;
2985 expand_string_message = string_sprintf("missing 2nd string in {} "
2986 "after \"%s\"", opname);
2989 if (!(sub[i] = expand_string_internal(s+1, flags, &s, resetok, &textonly)))
2991 if (textonly) sub_textonly |= BIT(i);
2992 DEBUG(D_expand) if (i == 1 && !sub2_honour_dollar && Ustrchr(sub[1], '$'))
2993 debug_printf_indent("WARNING: the second arg is NOT expanded,"
2994 " for security reasons\n");
2995 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2997 /* Convert to numerical if required; we know that the names of all the
2998 conditions that compare numbers do not start with a letter. This just saves
2999 checking for them individually. */
3001 if (!isalpha(opname[0]) && yield)
3006 debug_printf_indent("empty string cast to zero for numerical comparison\n");
3010 num[i] = expanded_string_integer(sub[i], FALSE);
3011 if (expand_string_message) return NULL;
3015 /* Result not required */
3017 if (!yield) return s;
3019 /* Do an appropriate comparison */
3025 tempcond = (num[0] == num[1]); break;
3028 tempcond = (num[0] > num[1]); break;
3031 tempcond = (num[0] >= num[1]); break;
3034 tempcond = (num[0] < num[1]); break;
3037 tempcond = (num[0] <= num[1]); break;
3040 tempcond = (Ustrcmp(sub[0], sub[1]) < 0); break;
3043 tempcond = (strcmpic(sub[0], sub[1]) < 0); break;
3046 tempcond = (Ustrcmp(sub[0], sub[1]) <= 0); break;
3049 tempcond = (strcmpic(sub[0], sub[1]) <= 0); break;
3052 tempcond = (Ustrcmp(sub[0], sub[1]) == 0); break;
3055 tempcond = (strcmpic(sub[0], sub[1]) == 0); break;
3058 tempcond = (Ustrcmp(sub[0], sub[1]) > 0); break;
3061 tempcond = (strcmpic(sub[0], sub[1]) > 0); break;
3064 tempcond = (Ustrcmp(sub[0], sub[1]) >= 0); break;
3067 tempcond = (strcmpic(sub[0], sub[1]) >= 0); break;
3069 case ECOND_MATCH: /* Regular expression match */
3071 const pcre2_code * re = regex_compile(sub[1],
3072 sub_textonly & BIT(1) ? MCS_CACHEABLE : MCS_NOFLAGS,
3073 &expand_string_message, pcre_gen_cmp_ctx);
3077 tempcond = regex_match_and_setup(re, sub[0], 0, -1);
3081 case ECOND_MATCH_ADDRESS: /* Match in an address list */
3082 rc = match_address_list(sub[0], TRUE, FALSE, &(sub[1]), NULL, -1, 0,
3083 CUSS &lookup_value);
3084 goto MATCHED_SOMETHING;
3086 case ECOND_MATCH_DOMAIN: /* Match in a domain list */
3087 rc = match_isinlist(sub[0], &(sub[1]), 0, &domainlist_anchor, NULL,
3088 MCL_DOMAIN + MCL_NOEXPAND, TRUE, CUSS &lookup_value);
3089 goto MATCHED_SOMETHING;
3091 case ECOND_MATCH_IP: /* Match IP address in a host list */
3092 if (sub[0][0] != 0 && string_is_ip_address(sub[0], NULL) == 0)
3094 expand_string_message = string_sprintf("\"%s\" is not an IP address",
3100 unsigned int *nullcache = NULL;
3101 check_host_block cb;
3103 cb.host_name = US"";
3104 cb.host_address = sub[0];
3106 /* If the host address starts off ::ffff: it is an IPv6 address in
3107 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3110 cb.host_ipv4 = (Ustrncmp(cb.host_address, "::ffff:", 7) == 0)?
3111 cb.host_address + 7 : cb.host_address;
3113 rc = match_check_list(
3114 &sub[1], /* the list */
3115 0, /* separator character */
3116 &hostlist_anchor, /* anchor pointer */
3117 &nullcache, /* cache pointer */
3118 check_host, /* function for testing */
3119 &cb, /* argument for function */
3120 MCL_HOST, /* type of check */
3121 sub[0], /* text for debugging */
3122 CUSS &lookup_value); /* where to pass back data */
3124 goto MATCHED_SOMETHING;
3126 case ECOND_MATCH_LOCAL_PART:
3127 rc = match_isinlist(sub[0], &(sub[1]), 0, &localpartlist_anchor, NULL,
3128 MCL_LOCALPART + MCL_NOEXPAND, TRUE, CUSS &lookup_value);
3134 case OK: tempcond = TRUE; break;
3135 case FAIL: tempcond = FALSE; break;
3138 expand_string_message = string_sprintf("unable to complete match "
3139 "against \"%s\": %s", sub[1], search_error_message);
3145 /* Various "encrypted" comparisons. If the second string starts with
3146 "{" then an encryption type is given. Default to crypt() or crypt16()
3147 (build-time choice). */
3148 /* }-for-text-editors */
3151 #ifndef SUPPORT_CRYPTEQ
3152 goto COND_FAILED_NOT_COMPILED;
3154 if (strncmpic(sub[1], US"{md5}", 5) == 0)
3156 int sublen = Ustrlen(sub[1]+5);
3161 md5_end(&base, sub[0], Ustrlen(sub[0]), digest);
3163 /* If the length that we are comparing against is 24, the MD5 digest
3164 is expressed as a base64 string. This is the way LDAP does it. However,
3165 some other software uses a straightforward hex representation. We assume
3166 this if the length is 32. Other lengths fail. */
3170 uschar *coded = b64encode(CUS digest, 16);
3171 DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
3172 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
3173 tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
3175 else if (sublen == 32)
3178 for (int i = 0; i < 16; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
3180 DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n"
3181 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
3182 tempcond = (strcmpic(coded, sub[1]+5) == 0);
3186 DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: "
3187 "fail\n crypted=%s\n", sub[1]+5);
3192 else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
3194 int sublen = Ustrlen(sub[1]+6);
3199 sha1_end(&h, sub[0], Ustrlen(sub[0]), digest);
3201 /* If the length that we are comparing against is 28, assume the SHA1
3202 digest is expressed as a base64 string. If the length is 40, assume a
3203 straightforward hex representation. Other lengths fail. */
3207 uschar *coded = b64encode(CUS digest, 20);
3208 DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
3209 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
3210 tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
3212 else if (sublen == 40)
3215 for (int i = 0; i < 20; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
3217 DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n"
3218 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
3219 tempcond = (strcmpic(coded, sub[1]+6) == 0);
3223 DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: "
3224 "fail\n crypted=%s\n", sub[1]+6);
3229 else /* {crypt} or {crypt16} and non-{ at start */
3230 /* }-for-text-editors */
3235 if (strncmpic(sub[1], US"{crypt}", 7) == 0)
3240 else if (strncmpic(sub[1], US"{crypt16}", 9) == 0)
3245 else if (sub[1][0] == '{') /* }-for-text-editors */
3247 expand_string_message = string_sprintf("unknown encryption mechanism "
3248 "in \"%s\"", sub[1]);
3254 case 0: coded = US DEFAULT_CRYPT(CS sub[0], CS sub[1]); break;
3255 case 1: coded = US crypt(CS sub[0], CS sub[1]); break;
3256 default: coded = US crypt16(CS sub[0], CS sub[1]); break;
3260 #define XSTR(s) STR(s)
3261 DEBUG(D_auth) debug_printf("crypteq: using %s()\n"
3262 " subject=%s\n crypted=%s\n",
3263 which == 0 ? XSTR(DEFAULT_CRYPT) : which == 1 ? "crypt" : "crypt16",
3268 /* If the encrypted string contains fewer than two characters (for the
3269 salt), force failure. Otherwise we get false positives: with an empty
3270 string the yield of crypt() is an empty string! */
3273 tempcond = Ustrlen(sub[1]) < 2 ? FALSE : Ustrcmp(coded, sub[1]) == 0;
3274 else if (errno == EINVAL)
3278 expand_string_message = string_sprintf("crypt error: %s\n",
3279 US strerror(errno));
3284 #endif /* SUPPORT_CRYPTEQ */
3289 const uschar * list = sub[1];
3291 uschar *save_iterate_item = iterate_item;
3292 int (*compare)(const uschar *, const uschar *);
3294 DEBUG(D_expand) debug_printf_indent("condition: %s item: %s\n", opname, sub[0]);
3297 compare = cond_type == ECOND_INLISTI
3298 ? strcmpic : (int (*)(const uschar *, const uschar *)) strcmp;
3300 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
3302 DEBUG(D_expand) debug_printf_indent(" compare %s\n", iterate_item);
3303 if (compare(sub[0], iterate_item) == 0)
3306 lookup_value = iterate_item;
3310 iterate_item = save_iterate_item;
3313 } /* Switch for comparison conditions */
3315 *yield = tempcond == testfor;
3316 return s; /* End of comparison conditions */
3319 /* and/or: computes logical and/or of several conditions */
3323 subcondptr = (yield == NULL) ? NULL : &tempcond;
3324 combined_cond = (cond_type == ECOND_AND);
3326 Uskip_whitespace(&s);
3327 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3331 /* {-for-text-editors */
3332 if (Uskip_whitespace(&s) == '}') break;
3333 if (*s != '{') /* }-for-text-editors */
3335 expand_string_message = string_sprintf("each subcondition "
3336 "inside an \"%s{...}\" condition must be in its own {}", opname);
3340 if (!(s = eval_condition(s+1, resetok, subcondptr)))
3342 expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
3343 expand_string_message, opname);
3346 Uskip_whitespace(&s);
3348 /* {-for-text-editors */
3351 /* {-for-text-editors */
3352 expand_string_message = string_sprintf("missing } at end of condition "
3353 "inside \"%s\" group", opname);
3358 if (cond_type == ECOND_AND)
3360 combined_cond &= tempcond;
3361 if (!combined_cond) subcondptr = NULL; /* once false, don't */
3362 } /* evaluate any more */
3365 combined_cond |= tempcond;
3366 if (combined_cond) subcondptr = NULL; /* once true, don't */
3367 } /* evaluate any more */
3370 if (yield) *yield = (combined_cond == testfor);
3374 /* forall/forany: iterates a condition with different values */
3376 case ECOND_FORALL: is_forany = FALSE; is_json = FALSE; is_jsons = FALSE; goto FORMANY;
3377 case ECOND_FORANY: is_forany = TRUE; is_json = FALSE; is_jsons = FALSE; goto FORMANY;
3378 case ECOND_FORALL_JSON: is_forany = FALSE; is_json = TRUE; is_jsons = FALSE; goto FORMANY;
3379 case ECOND_FORANY_JSON: is_forany = TRUE; is_json = TRUE; is_jsons = FALSE; goto FORMANY;
3380 case ECOND_FORALL_JSONS: is_forany = FALSE; is_json = TRUE; is_jsons = TRUE; goto FORMANY;
3381 case ECOND_FORANY_JSONS: is_forany = TRUE; is_json = TRUE; is_jsons = TRUE; goto FORMANY;
3385 const uschar * list;
3387 uschar *save_iterate_item = iterate_item;
3389 DEBUG(D_expand) debug_printf_indent("condition: %s\n", opname);
3391 Uskip_whitespace(&s);
3392 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3393 if (!(sub[0] = expand_string_internal(s,
3394 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | (yield ? ESI_NOFLAGS : ESI_SKIPPING),
3395 &s, resetok, NULL)))
3397 /* {-for-text-editors */
3398 if (*s++ != '}') goto COND_FAILED_CURLY_END;
3400 Uskip_whitespace(&s);
3401 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3405 /* Call eval_condition once, with result discarded (as if scanning a
3406 "false" part). This allows us to find the end of the condition, because if
3407 the list it empty, we won't actually evaluate the condition for real. */
3409 if (!(s = eval_condition(sub[1], resetok, NULL)))
3411 expand_string_message = string_sprintf("%s inside \"%s\" condition",
3412 expand_string_message, opname);
3415 Uskip_whitespace(&s);
3417 /* {-for-text-editors */
3420 /* {-for-text-editors */
3421 expand_string_message = string_sprintf("missing } at end of condition "
3422 "inside \"%s\"", opname);
3426 if (yield) *yield = !testfor;
3428 if (is_json) list = dewrap(string_copy(list), US"[]");
3429 while ((iterate_item = is_json
3430 ? json_nextinlist(&list) : string_nextinlist(&list, &sep, NULL, 0)))
3433 if (!(iterate_item = dewrap(iterate_item, US"\"\"")))
3435 expand_string_message =
3436 string_sprintf("%s wrapping string result for extract jsons",
3437 expand_string_message);
3438 iterate_item = save_iterate_item;
3442 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", opname, iterate_item);
3443 if (!eval_condition(sub[1], resetok, &tempcond))
3445 expand_string_message = string_sprintf("%s inside \"%s\" condition",
3446 expand_string_message, opname);
3447 iterate_item = save_iterate_item;
3450 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", opname,
3451 tempcond? "true":"false");
3453 if (yield) *yield = (tempcond == testfor);
3454 if (tempcond == is_forany) break;
3457 iterate_item = save_iterate_item;
3462 /* The bool{} expansion condition maps a string to boolean.
3463 The values supported should match those supported by the ACL condition
3464 (acl.c, ACLC_CONDITION) so that we keep to a minimum the different ideas
3465 of true/false. Note that Router "condition" rules have a different
3466 interpretation, where general data can be used and only a few values
3468 Note that readconf.c boolean matching, for boolean configuration options,
3469 only matches true/yes/false/no.
3470 The bool_lax{} condition matches the Router logic, which is much more
3473 case ECOND_BOOL_LAX:
3479 BOOL boolvalue = FALSE;
3481 if (Uskip_whitespace(&s) != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3482 ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool";
3483 switch(read_subs(sub_arg, 1, 1, &s,
3484 yield ? ESI_NOFLAGS : ESI_SKIPPING, FALSE, ourname, resetok, NULL))
3486 case 1: expand_string_message = string_sprintf(
3487 "too few arguments or bracketing error for %s",
3491 case 3: return NULL;
3494 Uskip_whitespace(&t);
3495 if ((len = Ustrlen(t)))
3497 /* trailing whitespace: seems like a good idea to ignore it too */
3499 while (isspace(*t2)) t2--;
3500 if (t2 != (t + len))
3507 debug_printf_indent("considering %s: %s\n", ourname, len ? t : US"<empty>");
3508 /* logic for the lax case from expand_check_condition(), which also does
3509 expands, and the logic is both short and stable enough that there should
3510 be no maintenance burden from replicating it. */
3514 ? Ustrspn(t+1, "0123456789") == len-1
3515 : Ustrspn(t, "0123456789") == len)
3517 boolvalue = (Uatoi(t) == 0) ? FALSE : TRUE;
3518 /* expand_check_condition only does a literal string "0" check */
3519 if ((cond_type == ECOND_BOOL_LAX) && (len > 1))
3522 else if (strcmpic(t, US"true") == 0 || strcmpic(t, US"yes") == 0)
3524 else if (strcmpic(t, US"false") == 0 || strcmpic(t, US"no") == 0)
3526 else if (cond_type == ECOND_BOOL_LAX)
3530 expand_string_message = string_sprintf("unrecognised boolean "
3534 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", ourname,
3535 boolvalue? "true":"false");
3536 if (yield) *yield = (boolvalue == testfor);
3541 case ECOND_INBOUND_SRS:
3542 /* ${if inbound_srs {local_part}{secret} {yes}{no}} */
3545 const pcre2_code * re;
3546 pcre2_match_data * md;
3550 BOOL boolvalue = FALSE;
3552 switch(read_subs(sub, 2, 2, CUSS &s,
3553 yield ? ESI_NOFLAGS : ESI_SKIPPING, FALSE, name, resetok, NULL))
3555 case 1: expand_string_message = US"too few arguments or bracketing "
3556 "error for inbound_srs";
3558 case 3: return NULL;
3561 /* Match the given local_part against the SRS-encoded pattern */
3563 re = regex_must_compile(US"^(?i)SRS0=([^=]+)=([A-Z2-7]{2})=([^=]*)=(.*)$",
3564 MCS_CASELESS | MCS_CACHEABLE, FALSE);
3565 md = pcre2_match_data_create(4+1, pcre_gen_ctx);
3566 if (pcre2_match(re, sub[0], PCRE2_ZERO_TERMINATED, 0, PCRE_EOPT,
3567 md, pcre_gen_mtc_ctx) < 0)
3569 DEBUG(D_expand) debug_printf("no match for SRS'd local-part pattern\n");
3572 ovec = pcre2_get_ovector_pointer(md);
3574 if (sub[0][0] == '"')
3576 else for (uschar * s = sub[0]; *s; s++)
3577 if (!isalnum(*s) && Ustrchr(".!#$%&'*+-/=?^_`{|}~", *s) == NULL)
3578 { quoting = 1; break; }
3580 DEBUG(D_expand) debug_printf_indent("auto-quoting local part\n");
3582 /* Record the (quoted, if needed) decoded recipient as $srs_recipient */
3584 srs_recipient = string_sprintf("%.*s%.*S%.*s@%.*S", /* lowercased */
3586 (int) (ovec[9]-ovec[8]), sub[0] + ovec[8], /* substr 4 */
3588 (int) (ovec[7]-ovec[6]), sub[0] + ovec[6]); /* substr 3 */
3590 /* If a zero-length secret was given, we're done. Otherwise carry on
3591 and validate the given SRS local_part againt our secret. */
3595 /* check the timestamp */
3598 uschar * ss = sub[0] + ovec[4]; /* substring 2, the timestamp */
3602 gettimeofday(&now, NULL);
3603 now.tv_sec /= 86400; /* days since epoch */
3605 /* Decode substring 2 from base32 to a number */
3607 for (d = 0, n = ovec[5]-ovec[4]; n; n--)
3609 uschar * t = Ustrchr(base32_chars, *ss++);
3610 d = d * 32 + (t - base32_chars);
3613 if (((now.tv_sec - d) & 0x3ff) > 10) /* days since SRS generated */
3615 DEBUG(D_expand) debug_printf("SRS too old\n");
3620 /* check length of substring 1, the offered checksum */
3622 if (ovec[3]-ovec[2] != 4)
3624 DEBUG(D_expand) debug_printf("SRS checksum wrong size\n");
3628 /* Hash the address with our secret, and compare that computed checksum
3629 with the one extracted from the arg */
3631 hmac_md5(sub[1], srs_recipient, cksum, sizeof(cksum));
3632 if (Ustrncmp(cksum, sub[0] + ovec[2], 4) != 0)
3634 DEBUG(D_expand) debug_printf("SRS checksum mismatch\n");
3641 /* pcre2_match_data_free(md); gen ctx needs no free */
3642 if (yield) *yield = (boolvalue == testfor);
3645 #endif /*SUPPORT_SRS*/
3647 /* Unknown condition */
3650 if (!expand_string_message || !*expand_string_message)
3651 expand_string_message = string_sprintf("unknown condition \"%s\"", opname);
3653 } /* End switch on condition type */
3655 /* Missing braces at start and end of data */
3657 COND_FAILED_CURLY_START:
3658 expand_string_message = string_sprintf("missing { after \"%s\"", opname);
3661 COND_FAILED_CURLY_END:
3662 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
3666 /* A condition requires code that is not compiled */
3668 #if !defined(SUPPORT_PAM) || !defined(RADIUS_CONFIG_FILE) || \
3669 !defined(LOOKUP_LDAP) || !defined(CYRUS_PWCHECK_SOCKET) || \
3670 !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
3671 COND_FAILED_NOT_COMPILED:
3672 expand_string_message = string_sprintf("support for \"%s\" not compiled",
3681 /*************************************************
3682 * Save numerical variables *
3683 *************************************************/
3685 /* This function is called from items such as "if" that want to preserve and
3686 restore the numbered variables.
3689 save_expand_string points to an array of pointers to set
3690 save_expand_nlength points to an array of ints for the lengths
3692 Returns: the value of expand max to save
3696 save_expand_strings(const uschar **save_expand_nstring, int *save_expand_nlength)
3698 for (int i = 0; i <= expand_nmax; i++)
3700 save_expand_nstring[i] = expand_nstring[i];
3701 save_expand_nlength[i] = expand_nlength[i];
3708 /*************************************************
3709 * Restore numerical variables *
3710 *************************************************/
3712 /* This function restored saved values of numerical strings.
3715 save_expand_nmax the number of strings to restore
3716 save_expand_string points to an array of pointers
3717 save_expand_nlength points to an array of ints
3723 restore_expand_strings(int save_expand_nmax, const uschar **save_expand_nstring,
3724 int *save_expand_nlength)
3726 expand_nmax = save_expand_nmax;
3727 for (int i = 0; i <= expand_nmax; i++)
3729 expand_nstring[i] = save_expand_nstring[i];
3730 expand_nlength[i] = save_expand_nlength[i];
3738 /*************************************************
3739 * Handle yes/no substrings *
3740 *************************************************/
3742 /* This function is used by ${if}, ${lookup} and ${extract} to handle the
3743 alternative substrings that depend on whether or not the condition was true,
3744 or the lookup or extraction succeeded. The substrings always have to be
3745 expanded, to check their syntax, but "skipping" is set when the result is not
3746 needed - this avoids unnecessary nested lookups.
3750 skipping TRUE if we were skipping when this item was reached
3751 yes TRUE if the first string is to be used, else use the second
3752 save_lookup a value to put back into lookup_value before the 2nd expansion
3753 sptr points to the input string pointer
3754 yieldptr points to the output growable-string pointer
3755 type "lookup", "if", "extract", "run", "env", "listextract" or
3756 "certextract" for error message
3757 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
3760 Returns: 0 OK; lookup_value has been reset to save_lookup
3762 2 expansion failed because of bracketing error
3766 process_yesno(esi_flags flags, BOOL yes, uschar *save_lookup, const uschar **sptr,
3767 gstring ** yieldptr, uschar *type, BOOL *resetok)
3770 const uschar *s = *sptr; /* Local value */
3771 uschar *sub1, *sub2;
3772 const uschar * errwhere;
3774 flags &= ESI_SKIPPING; /* Ignore all buf the skipping flag */
3776 /* If there are no following strings, we substitute the contents of $value for
3777 lookups and for extractions in the success case. For the ${if item, the string
3778 "true" is substituted. In the fail case, nothing is substituted for all three
3781 if (skip_whitespace(&s) == '}')
3785 if (yes && !(flags & ESI_SKIPPING))
3786 *yieldptr = string_catn(*yieldptr, US"true", 4);
3790 if (yes && lookup_value && !(flags & ESI_SKIPPING))
3791 *yieldptr = string_cat(*yieldptr, lookup_value);
3792 lookup_value = save_lookup;
3798 /* The first following string must be braced. */
3802 errwhere = US"'yes' part did not start with '{'"; /*}}*/
3806 /* Expand the first substring. Forced failures are noticed only if we actually
3807 want this string. Set skipping in the call in the fail case (this will always
3808 be the case if we were already skipping). */
3810 sub1 = expand_string_internal(s,
3811 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | (yes ? ESI_NOFLAGS : ESI_SKIPPING),
3813 if (sub1 == NULL && (yes || !f.expand_string_forcedfail)) goto FAILED;
3814 f.expand_string_forcedfail = FALSE;
3818 errwhere = US"'yes' part did not end with '}'";
3822 /* If we want the first string, add it to the output */
3825 *yieldptr = string_cat(*yieldptr, sub1);
3827 /* If this is called from a lookup/env or a (cert)extract, we want to restore
3828 $value to what it was at the start of the item, so that it has this value
3829 during the second string expansion. For the call from "if" or "run" to this
3830 function, save_lookup is set to lookup_value, so that this statement does
3833 lookup_value = save_lookup;
3835 /* There now follows either another substring, or "fail", or nothing. This
3836 time, forced failures are noticed only if we want the second string. We must
3837 set skipping in the nested call if we don't want this string, or if we were
3838 already skipping. */
3840 if (skip_whitespace(&s) == '{') /*}*/
3842 esi_flags s_flags = ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags;
3843 if (yes) s_flags |= ESI_SKIPPING;
3844 sub2 = expand_string_internal(s+1, s_flags, &s, resetok, NULL);
3845 if (!sub2 && (!yes || !f.expand_string_forcedfail)) goto FAILED;
3846 f.expand_string_forcedfail = FALSE; /*{*/
3849 errwhere = US"'no' part did not start with '{'"; /*}*/
3853 /* If we want the second string, add it to the output */
3856 *yieldptr = string_cat(*yieldptr, sub2);
3859 /* If there is no second string, but the word "fail" is present when the use of
3860 the second string is wanted, set a flag indicating it was a forced failure
3861 rather than a syntactic error. Swallow the terminating } in case this is nested
3862 inside another lookup or if or extract. */
3867 /* deconst cast ok here as source is s anyway */
3868 s = US read_name(name, sizeof(name), s, US"_");
3869 if (Ustrcmp(name, "fail") == 0)
3871 if (!yes && !(flags & ESI_SKIPPING))
3873 Uskip_whitespace(&s); /*{{*/
3876 errwhere = US"did not close with '}' after forcedfail";
3879 expand_string_message =
3880 string_sprintf("\"%s\" failed and \"fail\" requested", type);
3881 f.expand_string_forcedfail = TRUE;
3887 expand_string_message =
3888 string_sprintf("syntax error in \"%s\" item - \"fail\" expected", type);
3893 /* All we have to do now is to check on the final closing brace. */
3895 skip_whitespace(&s); /*{{*/
3898 errwhere = US"did not close with '}'";
3904 /* Update the input pointer value before returning */
3909 /* Get here if there is a bracketing failure */
3910 expand_string_message = string_sprintf(
3911 "curly-bracket problem in conditional yes/no parsing: %s\n"
3912 " remaining string is '%s'", errwhere, --s);
3917 /* Get here for other failures */
3925 /********************************************************
3926 * prvs: Get last three digits of days since Jan 1, 1970 *
3927 ********************************************************/
3929 /* This is needed to implement the "prvs" BATV reverse
3932 Argument: integer "days" offset to add or substract to
3933 or from the current number of days.
3935 Returns: pointer to string containing the last three
3936 digits of the number of days since Jan 1, 1970,
3937 modified by the offset argument, NULL if there
3938 was an error in the conversion.
3943 prvs_daystamp(int day_offset)
3945 uschar * days = store_get(32, GET_UNTAINTED); /* Need at least 24 for cases */
3946 (void)string_format(days, 32, TIME_T_FMT, /* where TIME_T_FMT is %lld */
3947 (time(NULL) + day_offset*86400)/86400);
3948 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
3953 /********************************************************
3954 * prvs: perform HMAC-SHA1 computation of prvs bits *
3955 ********************************************************/
3957 /* This is needed to implement the "prvs" BATV reverse
3961 address RFC2821 Address to use
3962 key The key to use (must be less than 64 characters
3964 key_num Single-digit key number to use. Defaults to
3967 Returns: pointer to string containing the first three
3968 bytes of the final hash in hex format, NULL if
3969 there was an error in the process.
3973 prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
3975 gstring * hash_source;
3978 uschar innerhash[20];
3979 uschar finalhash[20];
3980 uschar innerkey[64];
3981 uschar outerkey[64];
3982 uschar *finalhash_hex;
3987 if (Ustrlen(key) > 64)
3990 hash_source = string_catn(NULL, key_num, 1);
3991 hash_source = string_catn(hash_source, daystamp, 3);
3992 hash_source = string_cat(hash_source, address);
3995 debug_printf_indent("prvs: hash source is '%Y'\n", hash_source);
3997 memset(innerkey, 0x36, 64);
3998 memset(outerkey, 0x5c, 64);
4000 for (int i = 0; i < Ustrlen(key); i++)
4002 innerkey[i] ^= key[i];
4003 outerkey[i] ^= key[i];
4006 chash_start(HMAC_SHA1, &h);
4007 chash_mid(HMAC_SHA1, &h, innerkey);
4008 chash_end(HMAC_SHA1, &h, hash_source->s, hash_source->ptr, innerhash);
4010 chash_start(HMAC_SHA1, &h);
4011 chash_mid(HMAC_SHA1, &h, outerkey);
4012 chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
4014 /* Hashing is deemed sufficient to de-taint any input data */
4016 p = finalhash_hex = store_get(40, GET_UNTAINTED);
4017 for (int i = 0; i < 3; i++)
4019 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
4020 *p++ = hex_digits[finalhash[i] & 0x0f];
4024 return finalhash_hex;
4030 /*************************************************
4031 * Join a file onto the output string *
4032 *************************************************/
4034 /* This is used for readfile/readsock and after a run expansion.
4035 It joins the contents of a file onto the output string, globally replacing
4036 newlines with a given string (optionally).
4040 yield pointer to the expandable string struct
4041 eol newline replacement string, or NULL
4043 Returns: new pointer for expandable string, terminated if non-null
4047 cat_file(FILE * f, gstring * yield, uschar * eol)
4049 uschar buffer[1024];
4051 while (Ufgets(buffer, sizeof(buffer), f))
4053 int len = Ustrlen(buffer);
4054 if (eol && buffer[len-1] == '\n') len--;
4055 yield = string_catn(yield, buffer, len);
4056 if (eol && buffer[len])
4057 yield = string_cat(yield, eol);
4065 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
4068 uschar buffer[1024];
4070 /*XXX could we read direct into a pre-grown string? */
4072 while ((rc = tls_read(tls_ctx, buffer, sizeof(buffer))) > 0)
4073 for (uschar * s = buffer; rc--; s++)
4074 yield = eol && *s == '\n'
4075 ? string_cat(yield, eol) : string_catn(yield, s, 1);
4077 /* We assume that all errors, and any returns of zero bytes,
4078 are actually EOF. */
4085 /*************************************************
4086 * Evaluate numeric expression *
4087 *************************************************/
4089 /* This is a set of mutually recursive functions that evaluate an arithmetic
4090 expression involving + - * / % & | ^ ~ << >> and parentheses. The only one of
4091 these functions that is called from elsewhere is eval_expr, whose interface is:
4094 sptr pointer to the pointer to the string - gets updated
4095 decimal TRUE if numbers are to be assumed decimal
4096 error pointer to where to put an error message - must be NULL on input
4097 endket TRUE if ')' must terminate - FALSE for external call
4099 Returns: on success: the value of the expression, with *error still NULL
4100 on failure: an undefined value, with *error = a message
4103 static int_eximarith_t eval_op_or(uschar **, BOOL, uschar **);
4106 static int_eximarith_t
4107 eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
4110 int_eximarith_t x = eval_op_or(&s, decimal, error);
4115 *error = US"expecting closing parenthesis";
4117 while (isspace(*++s));
4119 *error = US"expecting operator";
4125 static int_eximarith_t
4126 eval_number(uschar **sptr, BOOL decimal, uschar **error)
4132 if (isdigit((c = Uskip_whitespace(&s))))
4135 (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
4137 switch (tolower(*s))
4140 case 'k': n *= 1024; s++; break;
4141 case 'm': n *= 1024*1024; s++; break;
4142 case 'g': n *= 1024*1024*1024; s++; break;
4144 Uskip_whitespace(&s);
4149 n = eval_expr(&s, decimal, error, 1);
4153 *error = US"expecting number or opening parenthesis";
4161 static int_eximarith_t
4162 eval_op_unary(uschar **sptr, BOOL decimal, uschar **error)
4166 Uskip_whitespace(&s);
4167 if (*s == '+' || *s == '-' || *s == '~')
4170 x = eval_op_unary(&s, decimal, error);
4171 if (op == '-') x = -x;
4172 else if (op == '~') x = ~x;
4175 x = eval_number(&s, decimal, error);
4182 static int_eximarith_t
4183 eval_op_mult(uschar **sptr, BOOL decimal, uschar **error)
4186 int_eximarith_t x = eval_op_unary(&s, decimal, error);
4189 while (*s == '*' || *s == '/' || *s == '%')
4192 int_eximarith_t y = eval_op_unary(&s, decimal, error);
4194 /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
4195 * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
4196 * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where
4197 * -N*M is INT_MIN will yield INT_MIN.
4198 * Since we don't support floating point, this is somewhat simpler.
4199 * Ideally, we'd return an error, but since we overflow for all other
4200 * arithmetic, consistency suggests otherwise, but what's the correct value
4201 * to use? There is none.
4202 * The C standard guarantees overflow for unsigned arithmetic but signed
4203 * overflow invokes undefined behaviour; in practice, this is overflow
4204 * except for converting INT_MIN to INT_MAX+1. We also can't guarantee
4205 * that long/longlong larger than int are available, or we could just work
4206 * with larger types. We should consider whether to guarantee 32bit eval
4207 * and 64-bit working variables, with errors returned. For now ...
4208 * So, the only SIGFPEs occur with a non-shrinking div/mod, thus -1; we
4209 * can just let the other invalid results occur otherwise, as they have
4210 * until now. For this one case, we can coerce.
4212 if (y == -1 && x == EXIM_ARITH_MIN && op != '*')
4215 debug_printf("Integer exception dodging: " PR_EXIM_ARITH "%c-1 coerced to " PR_EXIM_ARITH "\n",
4216 EXIM_ARITH_MIN, op, EXIM_ARITH_MAX);
4226 *error = (op == '/') ? US"divide by zero" : US"modulo by zero";
4242 static int_eximarith_t
4243 eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
4246 int_eximarith_t x = eval_op_mult(&s, decimal, error);
4249 while (*s == '+' || *s == '-')
4252 int_eximarith_t y = eval_op_mult(&s, decimal, error);
4254 if ( (x >= EXIM_ARITH_MAX/2 && x >= EXIM_ARITH_MAX/2)
4255 || (x <= -(EXIM_ARITH_MAX/2) && y <= -(EXIM_ARITH_MAX/2)))
4256 { /* over-conservative check */
4258 ? US"overflow in sum" : US"overflow in difference";
4261 if (op == '+') x += y; else x -= y;
4269 static int_eximarith_t
4270 eval_op_shift(uschar **sptr, BOOL decimal, uschar **error)
4273 int_eximarith_t x = eval_op_sum(&s, decimal, error);
4276 while ((*s == '<' || *s == '>') && s[1] == s[0])
4281 y = eval_op_sum(&s, decimal, error);
4283 if (op == '<') x <<= y; else x >>= y;
4291 static int_eximarith_t
4292 eval_op_and(uschar **sptr, BOOL decimal, uschar **error)
4295 int_eximarith_t x = eval_op_shift(&s, decimal, error);
4302 y = eval_op_shift(&s, decimal, error);
4312 static int_eximarith_t
4313 eval_op_xor(uschar **sptr, BOOL decimal, uschar **error)
4316 int_eximarith_t x = eval_op_and(&s, decimal, error);
4323 y = eval_op_and(&s, decimal, error);
4333 static int_eximarith_t
4334 eval_op_or(uschar **sptr, BOOL decimal, uschar **error)
4337 int_eximarith_t x = eval_op_xor(&s, decimal, error);
4344 y = eval_op_xor(&s, decimal, error);
4355 /************************************************/
4356 /* Comparison operation for sort expansion. We need to avoid
4357 re-expanding the fields being compared, so need a custom routine.
4360 cond_type Comparison operator code
4361 leftarg, rightarg Arguments for comparison
4363 Return true iff (leftarg compare rightarg)
4367 sortsbefore(int cond_type, BOOL alpha_cond,
4368 const uschar * leftarg, const uschar * rightarg)
4370 int_eximarith_t l_num, r_num;
4374 l_num = expanded_string_integer(leftarg, FALSE);
4375 if (expand_string_message) return FALSE;
4376 r_num = expanded_string_integer(rightarg, FALSE);
4377 if (expand_string_message) return FALSE;
4381 case ECOND_NUM_G: return l_num > r_num;
4382 case ECOND_NUM_GE: return l_num >= r_num;
4383 case ECOND_NUM_L: return l_num < r_num;
4384 case ECOND_NUM_LE: return l_num <= r_num;
4391 case ECOND_STR_LT: return Ustrcmp (leftarg, rightarg) < 0;
4392 case ECOND_STR_LTI: return strcmpic(leftarg, rightarg) < 0;
4393 case ECOND_STR_LE: return Ustrcmp (leftarg, rightarg) <= 0;
4394 case ECOND_STR_LEI: return strcmpic(leftarg, rightarg) <= 0;
4395 case ECOND_STR_GT: return Ustrcmp (leftarg, rightarg) > 0;
4396 case ECOND_STR_GTI: return strcmpic(leftarg, rightarg) > 0;
4397 case ECOND_STR_GE: return Ustrcmp (leftarg, rightarg) >= 0;
4398 case ECOND_STR_GEI: return strcmpic(leftarg, rightarg) >= 0;
4401 return FALSE; /* should not happen */
4405 /* Expand a named list. Return false on failure. */
4407 expand_listnamed(gstring * yield, const uschar * name, const uschar * listtype)
4409 tree_node *t = NULL;
4410 const uschar * list;
4413 BOOL needsep = FALSE;
4414 #define LISTNAMED_BUF_SIZE 256
4415 uschar b[LISTNAMED_BUF_SIZE];
4416 uschar * buffer = b;
4418 if (*name == '+') name++;
4419 if (!listtype) /* no-argument version */
4421 if ( !(t = tree_search(addresslist_anchor, name))
4422 && !(t = tree_search(domainlist_anchor, name))
4423 && !(t = tree_search(hostlist_anchor, name)))
4424 t = tree_search(localpartlist_anchor, name);
4426 else switch(*listtype) /* specific list-type version */
4428 case 'a': t = tree_search(addresslist_anchor, name); break;
4429 case 'd': t = tree_search(domainlist_anchor, name); break;
4430 case 'h': t = tree_search(hostlist_anchor, name); break;
4431 case 'l': t = tree_search(localpartlist_anchor, name); break;
4433 expand_string_message = US"bad suffix on \"list\" operator";
4439 expand_string_message = string_sprintf("\"%s\" is not a %snamed list",
4441 : *listtype=='a'?"address "
4442 : *listtype=='d'?"domain "
4443 : *listtype=='h'?"host "
4444 : *listtype=='l'?"localpart "
4449 list = ((namedlist_block *)(t->data.ptr))->string;
4451 /* The list could be quite long so we (re)use a buffer for each element
4452 rather than getting each in new memory */
4454 if (is_tainted(list)) buffer = store_get(LISTNAMED_BUF_SIZE, GET_TAINTED);
4455 while ((item = string_nextinlist(&list, &sep, buffer, LISTNAMED_BUF_SIZE)))
4457 uschar * buf = US" : ";
4459 yield = string_catn(yield, buf, 3);
4463 if (*item == '+') /* list item is itself a named list */
4465 yield = expand_listnamed(yield, item, listtype);
4466 if (expand_string_message)
4470 else if (sep != ':') /* item from non-colon-sep list, re-quote for colon list-separator */
4473 tok[0] = sep; tok[1] = ':'; tok[2] = 0;
4475 for(char * cp; cp = strpbrk(CCS item, tok); item = US cp)
4477 yield = string_catn(yield, item, cp - CS item);
4478 if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */
4479 yield = string_catn(yield, US"::", 2);
4480 else /* sep in item; should already be doubled; emit once */
4482 yield = string_catn(yield, US tok, 1);
4483 if (*cp == sep) cp++;
4486 yield = string_cat(yield, item);
4489 yield = string_cat(yield, item);
4496 /************************************************/
4498 debug_expansion_interim(const uschar * what, const uschar * value, int nchar,
4501 debug_printf_indent("%V", "K");
4503 for (int fill = 11 - Ustrlen(what); fill > 0; fill--)
4504 debug_printf("%V", "-");
4506 debug_printf("%s: %.*W\n", what, nchar, value);
4507 if (is_tainted(value))
4508 debug_printf_indent("%V %V(tainted)\n",
4509 flags & ESI_SKIPPING ? "|" : " ", "\\__");
4513 /*************************************************
4515 *************************************************/
4517 /* Returns either an unchanged string, or the expanded string in stacking pool
4518 store. Interpreted sequences are:
4520 \... normal escaping rules
4521 $name substitutes the variable
4523 ${op:string} operates on the expanded string value
4524 ${item{arg1}{arg2}...} expands the args and then does the business
4525 some literal args are not enclosed in {}
4527 There are now far too many operators and item types to make it worth listing
4528 them here in detail any more.
4530 We use an internal routine recursively to handle embedded substrings. The
4531 external function follows. The yield is NULL if the expansion failed, and there
4532 are two cases: if something collapsed syntactically, or if "fail" was given
4533 as the action on a lookup failure. These can be distinguished by looking at the
4534 variable expand_string_forcedfail, which is TRUE in the latter case.
4536 The skipping flag is set true when expanding a substring that isn't actually
4537 going to be used (after "if" or "lookup") and it prevents lookups from
4538 happening lower down.
4540 Store usage: At start, a store block of the length of the input plus 64
4541 is obtained. This is expanded as necessary by string_cat(), which might have to
4542 get a new block, or might be able to expand the original. At the end of the
4543 function we can release any store above that portion of the yield block that
4544 was actually used. In many cases this will be optimal.
4546 However: if the first item in the expansion is a variable name or header name,
4547 we reset the store before processing it; if the result is in fresh store, we
4548 use that without copying. This is helpful for expanding strings like
4549 $message_headers which can get very long.
4551 There's a problem if a ${dlfunc item has side-effects that cause allocation,
4552 since resetting the store at the end of the expansion will free store that was
4553 allocated by the plugin code as well as the slop after the expanded string. So
4554 we skip any resets if ${dlfunc } has been used. The same applies for ${acl }
4555 and, given the acl condition, ${if }. This is an unfortunate consequence of
4556 string expansion becoming too powerful.
4559 string the string to be expanded
4561 brace_ends expansion is to stop at }
4562 honour_dollar TRUE if $ is to be expanded,
4563 FALSE if it's just another character
4564 skipping TRUE for recursive calls when the value isn't actually going
4565 to be used (to allow for optimisation)
4566 left if not NULL, a pointer to the first character after the
4567 expansion is placed here (typically used with brace_ends)
4568 resetok_p if not NULL, pointer to flag - write FALSE if unsafe to reset
4570 textonly_p if not NULL, pointer to flag - write bool for only-met-text
4572 Returns: NULL if expansion fails:
4573 expand_string_forcedfail is set TRUE if failure was forced
4574 expand_string_message contains a textual error message
4575 a pointer to the expanded string on success
4579 expand_string_internal(const uschar * string, esi_flags flags, const uschar ** left,
4580 BOOL *resetok_p, BOOL * textonly_p)
4582 rmark reset_point = store_mark();
4583 gstring * yield = string_get(Ustrlen(string) + 64);
4585 const uschar * s = string;
4586 const uschar * save_expand_nstring[EXPAND_MAXN+1];
4587 int save_expand_nlength[EXPAND_MAXN+1];
4588 BOOL resetok = TRUE, first = TRUE, textonly = TRUE;
4591 f.expand_string_forcedfail = FALSE;
4592 expand_string_message = US"";
4594 if (is_tainted(string))
4596 expand_string_message =
4597 string_sprintf("attempt to expand tainted string '%s'", s);
4598 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
4608 debug_printf_indent("%V%V%s: %W\n",
4610 flags & ESI_SKIPPING ? "---" : "",
4611 flags & ESI_SKIPPING ? "scanning" : "considering", s);
4615 /* \ escapes the next character, which must exist, or else
4616 the expansion fails. There's a special escape, \N, which causes
4617 copying of the subject verbatim up to the next \N. Otherwise,
4618 the escapes are the standard set. */
4624 expand_string_message = US"\\ at end of string";
4630 const uschar * t = s + 2;
4631 for (s = t; *s ; s++) if (*s == '\\' && s[1] == 'N') break;
4634 debug_expansion_interim(US"protected", t, (int)(s - t), flags);
4635 if (!(flags & ESI_SKIPPING))
4636 yield = string_catn(yield, t, s - t);
4643 debug_printf_indent("%Vbackslashed: '\\%c'\n", "K", s[1]);
4644 ch[0] = string_interpret_escape(&s);
4645 if (!(flags & ESI_SKIPPING))
4646 yield = string_catn(yield, ch, 1);
4653 /* Anything other than $ is just copied verbatim, unless we are
4654 looking for a terminating } character. */
4656 if (flags & ESI_BRACE_ENDS && *s == '}') break;
4658 if (*s != '$' || !(flags & ESI_HONOR_DOLLAR))
4661 for (const uschar * t = s+1;
4662 *t && *t != '$' && *t != '}' && *t != '\\'; t++) i++;
4664 DEBUG(D_expand) debug_expansion_interim(US"text", s, i, flags);
4666 if (!(flags & ESI_SKIPPING))
4667 yield = string_catn(yield, s, i);
4673 /* No { after the $ - must be a plain name or a number for string
4674 match variable. There has to be a fudge for variables that are the
4675 names of header fields preceded by "$header_" because header field
4676 names can contain any printing characters except space and colon.
4677 For those that don't like typing this much, "$h_" is a synonym for
4678 "$header_". A non-existent header yields a NULL value; nothing is
4683 const uschar * value;
4684 int newsize = 0, len;
4688 s = read_name(name, sizeof(name), s, US"_");
4690 /* If this is the first thing to be expanded, release the pre-allocated
4693 if (!(flags & ESI_SKIPPING))
4695 g = store_get(sizeof(gstring), GET_UNTAINTED);
4696 else if (yield->ptr == 0)
4698 if (resetok) reset_point = store_reset(reset_point);
4700 reset_point = store_mark();
4701 g = store_get(sizeof(gstring), GET_UNTAINTED); /* alloc _before_ calling find_variable() */
4706 if ( ( *(t = name) == 'h'
4707 || (*t == 'r' || *t == 'l' || *t == 'b') && *++t == 'h'
4709 && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
4712 unsigned flags = *name == 'r' ? FH_WANT_RAW
4713 : *name == 'l' ? FH_WANT_RAW|FH_WANT_LIST
4715 const uschar * charset = *name == 'b' ? NULL : headers_charset;
4717 s = read_header_name(name, sizeof(name), s);
4718 value = find_header(name, &newsize, flags, charset);
4720 /* If we didn't find the header, and the header contains a closing brace
4721 character, this may be a user error where the terminating colon
4722 has been omitted. Set a flag to adjust the error message in this case.
4723 But there is no error here - nothing gets inserted. */
4727 if (Ustrchr(name, '}')) malformed_header = TRUE;
4734 else if (!(value = find_variable(name, FALSE, !!(flags & ESI_SKIPPING), &newsize)))
4736 expand_string_message =
4737 string_sprintf("unknown variable name \"%s\"", name);
4738 check_variable_error_message(name);
4742 /* If the data is known to be in a new buffer, newsize will be set to the
4743 size of that buffer. If this is the first thing in an expansion string,
4744 yield will be NULL; just point it at the new store instead of copying. Many
4745 expansion strings contain just one reference, so this is a useful
4746 optimization, especially for humungous headers. We need to use a gstring
4747 structure that is not allocated after that new-buffer, else a later store
4748 reset in the middle of the buffer will make it inaccessible. */
4750 len = Ustrlen(value);
4751 DEBUG(D_expand) debug_expansion_interim(US"value", value, len, flags);
4752 if (!(flags & ESI_SKIPPING))
4753 if (!yield && newsize != 0)
4756 yield->size = newsize;
4758 yield->s = US value; /* known to be in new store i.e. a copy, so deconst safe */
4761 yield = string_catn(yield, value, len);
4766 if (isdigit(*s)) /* A $<n> variable */
4769 s = read_cnumber(&n, s);
4770 if (n >= 0 && n <= expand_nmax)
4772 DEBUG(D_expand) debug_expansion_interim(US"value", expand_nstring[n], expand_nlength[n], flags);
4773 if (!(flags & ESI_SKIPPING))
4774 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4779 /* Otherwise, if there's no '{' after $ it's an error. */ /*}*/
4781 if (*s != '{') /*}*/
4783 expand_string_message = US"$ not followed by letter, digit, or {"; /*}*/
4787 /* After { there can be various things, but they all start with
4788 an initial word, except for a number for a string match variable. */ /*}*/
4793 s = read_cnumber(&n, s); /*{{*/
4796 expand_string_message = US"} expected after number";
4799 if (n >= 0 && n <= expand_nmax)
4801 DEBUG(D_expand) debug_expansion_interim(US"value", expand_nstring[n], expand_nlength[n], flags);
4802 if (!(flags & ESI_SKIPPING))
4803 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4810 expand_string_message = US"letter or digit expected after ${"; /*}*/
4814 /* Allow "-" in names to cater for substrings with negative
4815 arguments. Since we are checking for known names after { this is
4818 s = read_name(name, sizeof(name), s, US"_-");
4819 item_type = chop_match(name, item_table, nelem(item_table));
4821 /* Switch on item type. All nondefault choices should "continue* when
4822 skipping, but "break" otherwise so we get debug output for the item
4825 int expansion_start = gstring_length(yield);
4828 /* Call an ACL from an expansion. We feed data in via $acl_arg1 - $acl_arg9.
4829 If the ACL returns accept or reject we return content set by "message ="
4830 There is currently no limit on recursion; this would have us call
4831 acl_check_internal() directly and get a current level from somewhere.
4832 See also the acl expansion condition ECOND_ACL and the traditional
4833 acl modifier ACLC_ACL.
4834 Assume that the function has side-effects on the store that must be preserved.
4838 /* ${acl {name} {arg1}{arg2}...} */
4840 uschar * sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
4844 switch(read_subs(sub, nelem(sub), 1, &s, flags, TRUE, name, &resetok, NULL))
4846 case -1: continue; /* skipping */
4847 case 1: goto EXPAND_FAILED_CURLY;
4849 case 3: goto EXPAND_FAILED;
4853 switch(rc = eval_acl(sub, nelem(sub), &user_msg))
4858 debug_printf_indent("acl expansion yield: %s\n", user_msg);
4860 yield = string_cat(yield, user_msg);
4864 f.expand_string_forcedfail = TRUE;
4867 expand_string_message = string_sprintf("%s from acl \"%s\"",
4868 rc_names[rc], sub[0]);
4874 case EITEM_AUTHRESULTS:
4875 /* ${authresults {mysystemname}} */
4877 uschar * sub_arg[1];
4879 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, flags, TRUE, name, &resetok, NULL))
4881 case -1: continue; /* If skipping, we don't actually do anything */
4882 case 1: goto EXPAND_FAILED_CURLY;
4884 case 3: goto EXPAND_FAILED;
4887 yield = string_append(yield, 3,
4888 US"Authentication-Results: ", sub_arg[0], US"; none");
4889 yield->ptr -= 6; /* ignore tha ": none" for now */
4891 yield = authres_local(yield, sub_arg[0]);
4892 yield = authres_iprev(yield);
4893 yield = authres_smtpauth(yield);
4895 yield = authres_spf(yield);
4897 #ifndef DISABLE_DKIM
4898 yield = authres_dkim(yield);
4900 #ifdef SUPPORT_DMARC
4901 yield = authres_dmarc(yield);
4903 #ifdef EXPERIMENTAL_ARC
4904 yield = authres_arc(yield);
4909 /* Handle conditionals - preserve the values of the numerical expansion
4910 variables in case they get changed by a regular expression match in the
4911 condition. If not, they retain their external settings. At the end
4912 of this "if" section, they get restored to their previous values. */
4917 const uschar *next_s;
4918 int save_expand_nmax =
4919 save_expand_strings(save_expand_nstring, save_expand_nlength);
4920 uschar * save_lookup_value = lookup_value;
4922 Uskip_whitespace(&s);
4923 if (!(next_s = eval_condition(s, &resetok, flags & ESI_SKIPPING ? NULL : &cond)))
4924 goto EXPAND_FAILED; /* message already set */
4928 debug_expansion_interim(US"condition", s, (int)(next_s - s), flags);
4929 debug_expansion_interim(US"result",
4930 cond ? US"true" : US"false", cond ? 4 : 5, flags);
4935 /* The handling of "yes" and "no" result strings is now in a separate
4936 function that is also used by ${lookup} and ${extract} and ${run}. */
4938 switch(process_yesno(
4939 flags, /* were previously skipping */
4940 cond, /* success/failure indicator */
4941 lookup_value, /* value to reset for string2 */
4942 &s, /* input pointer */
4943 &yield, /* output pointer */
4944 US"if", /* condition type */
4947 case 1: goto EXPAND_FAILED; /* when all is well, the */
4948 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4951 /* Restore external setting of expansion variables for continuation
4954 lookup_value = save_lookup_value;
4955 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4956 save_expand_nlength);
4961 case EITEM_IMAPFOLDER:
4962 { /* ${imapfolder {name}{sep}{specials}} */
4966 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, flags, TRUE, name, &resetok, NULL))
4968 case 1: goto EXPAND_FAILED_CURLY;
4970 case 3: goto EXPAND_FAILED;
4973 if (!sub_arg[1]) /* One argument */
4975 sub_arg[1] = US"/"; /* default separator */
4978 else if (Ustrlen(sub_arg[1]) != 1)
4980 expand_string_message =
4982 "IMAP folder separator must be one character, found \"%s\"",
4987 if (flags & ESI_SKIPPING) continue;
4989 if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
4990 sub_arg[1][0], sub_arg[2], &expand_string_message)))
4992 yield = string_cat(yield, encoded);
4997 /* Handle database lookups unless locked out. If "skipping" is TRUE, we are
4998 expanding an internal string that isn't actually going to be used. All we
4999 need to do is check the syntax, so don't do a lookup at all. Preserve the
5000 values of the numerical expansion variables in case they get changed by a
5001 partial lookup. If not, they retain their external settings. At the end
5002 of this "lookup" section, they get restored to their previous values. */
5006 int stype, partial, affixlen, starflags;
5007 int expand_setup = 0;
5009 uschar * key, * filename;
5010 const uschar * affix, * opts;
5011 uschar * save_lookup_value = lookup_value;
5012 int save_expand_nmax =
5013 save_expand_strings(save_expand_nstring, save_expand_nlength);
5015 if (expand_forbid & RDO_LOOKUP)
5017 expand_string_message = US"lookup expansions are not permitted";
5021 /* Get the key we are to look up for single-key+file style lookups.
5022 Otherwise set the key NULL pro-tem. */
5024 if (Uskip_whitespace(&s) == '{') /*}*/
5026 key = expand_string_internal(s+1,
5027 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
5028 if (!key) goto EXPAND_FAILED; /*{{*/
5031 expand_string_message = US"missing '}' after lookup key";
5032 goto EXPAND_FAILED_CURLY;
5034 Uskip_whitespace(&s);
5038 /* Find out the type of database */
5042 expand_string_message = US"missing lookup type";
5046 /* The type is a string that may contain special characters of various
5047 kinds. Allow everything except space or { to appear; the actual content
5048 is checked by search_findtype_partial. */ /*}*/
5050 while (*s && *s != '{' && !isspace(*s)) /*}*/
5052 if (nameptr < sizeof(name) - 1) name[nameptr++] = *s;
5055 name[nameptr] = '\0';
5056 Uskip_whitespace(&s);
5058 /* Now check for the individual search type and any partial or default
5059 options. Only those types that are actually in the binary are valid. */
5061 if ((stype = search_findtype_partial(name, &partial, &affix, &affixlen,
5062 &starflags, &opts)) < 0)
5064 expand_string_message = search_error_message;
5068 /* Check that a key was provided for those lookup types that need it,
5069 and was not supplied for those that use the query style. */
5071 if (!mac_islookup(stype, lookup_querystyle|lookup_absfilequery))
5075 expand_string_message = string_sprintf("missing {key} for single-"
5076 "key \"%s\" lookup", name);
5082 expand_string_message = string_sprintf("a single key was given for "
5083 "lookup type \"%s\", which is not a single-key lookup type", name);
5087 /* Get the next string in brackets and expand it. It is the file name for
5088 single-key+file lookups, and the whole query otherwise. In the case of
5089 queries that also require a file name (e.g. sqlite), the file name comes
5094 expand_string_message = US"missing '{' for lookup file-or-query arg";
5095 goto EXPAND_FAILED_CURLY; /*}}*/
5097 if (!(filename = expand_string_internal(s+1,
5098 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL)))
5103 expand_string_message = US"missing '}' closing lookup file-or-query arg";
5104 goto EXPAND_FAILED_CURLY;
5106 Uskip_whitespace(&s);
5108 /* If this isn't a single-key+file lookup, re-arrange the variables
5109 to be appropriate for the search_ functions. For query-style lookups,
5110 there is just a "key", and no file name. For the special query-style +
5111 file types, the query (i.e. "key") starts with a file name. */
5114 key = search_args(stype, name, filename, &filename, opts);
5116 /* If skipping, don't do the next bit - just lookup_value == NULL, as if
5117 the entry was not found. Note that there is no search_close() function.
5118 Files are left open in case of re-use. At suitable places in higher logic,
5119 search_tidyup() is called to tidy all open files. This can save opening
5120 the same file several times. However, files may also get closed when
5121 others are opened, if too many are open at once. The rule is that a
5122 handle should not be used after a second search_open().
5124 Request that a partial search sets up $1 and maybe $2 by passing
5125 expand_setup containing zero. If its value changes, reset expand_nmax,
5126 since new variables will have been set. Note that at the end of this
5127 "lookup" section, the old numeric variables are restored. */
5129 if (flags & ESI_SKIPPING)
5130 lookup_value = NULL;
5133 void * handle = search_open(filename, stype, 0, NULL, NULL);
5136 expand_string_message = search_error_message;
5139 lookup_value = search_find(handle, filename, key, partial, affix,
5140 affixlen, starflags, &expand_setup, opts);
5141 if (f.search_find_defer)
5143 expand_string_message =
5144 string_sprintf("lookup of \"%s\" gave DEFER: %s",
5145 string_printing2(key, SP_TAB), search_error_message);
5148 if (expand_setup > 0) expand_nmax = expand_setup;
5151 /* The handling of "yes" and "no" result strings is now in a separate
5152 function that is also used by ${if} and ${extract}. */
5154 switch(process_yesno(
5155 flags, /* were previously skipping */
5156 lookup_value != NULL, /* success/failure indicator */
5157 save_lookup_value, /* value to reset for string2 */
5158 &s, /* input pointer */
5159 &yield, /* output pointer */
5160 US"lookup", /* condition type */
5163 case 1: goto EXPAND_FAILED; /* when all is well, the */
5164 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5167 /* Restore external setting of expansion variables for carrying on
5168 at this level, and continue. */
5170 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5171 save_expand_nlength);
5173 if (flags & ESI_SKIPPING) continue;
5177 /* If Perl support is configured, handle calling embedded perl subroutines,
5178 unless locked out at this time. Syntax is ${perl{sub}} or ${perl{sub}{arg}}
5179 or ${perl{sub}{arg1}{arg2}} or up to a maximum of EXIM_PERL_MAX_ARGS
5180 arguments (defined below). */
5182 #define EXIM_PERL_MAX_ARGS 8
5186 expand_string_message = US"\"${perl\" encountered, but this facility " /*}*/
5187 "is not included in this binary";
5190 #else /* EXIM_PERL */
5192 uschar * sub_arg[EXIM_PERL_MAX_ARGS + 2];
5193 gstring * new_yield;
5195 if (expand_forbid & RDO_PERL)
5197 expand_string_message = US"Perl calls are not permitted";
5201 switch(read_subs(sub_arg, EXIM_PERL_MAX_ARGS + 1, 1, &s, flags, TRUE,
5202 name, &resetok, NULL))
5204 case -1: continue; /* If skipping, we don't actually do anything */
5205 case 1: goto EXPAND_FAILED_CURLY;
5207 case 3: goto EXPAND_FAILED;
5210 /* Start the interpreter if necessary */
5212 if (!opt_perl_started)
5215 if (!opt_perl_startup)
5217 expand_string_message = US"A setting of perl_startup is needed when "
5218 "using the Perl interpreter";
5221 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
5222 if ((initerror = init_perl(opt_perl_startup)))
5224 expand_string_message =
5225 string_sprintf("error in perl_startup code: %s\n", initerror);
5228 opt_perl_started = TRUE;
5231 /* Call the function */
5233 sub_arg[EXIM_PERL_MAX_ARGS + 1] = NULL;
5234 new_yield = call_perl_cat(yield, &expand_string_message,
5235 sub_arg[0], sub_arg + 1);
5237 /* NULL yield indicates failure; if the message pointer has been set to
5238 NULL, the yield was undef, indicating a forced failure. Otherwise the
5239 message will indicate some kind of Perl error. */
5243 if (!expand_string_message)
5245 expand_string_message =
5246 string_sprintf("Perl subroutine \"%s\" returned undef to force "
5247 "failure", sub_arg[0]);
5248 f.expand_string_forcedfail = TRUE;
5253 /* Yield succeeded. Ensure forcedfail is unset, just in case it got
5254 set during a callback from Perl. */
5256 f.expand_string_forcedfail = FALSE;
5260 #endif /* EXIM_PERL */
5262 /* Transform email address to "prvs" scheme to use
5263 as BATV-signed return path */
5267 uschar * sub_arg[3], * p, * domain;
5269 switch(read_subs(sub_arg, 3, 2, &s, flags, TRUE, name, &resetok, NULL))
5271 case -1: continue; /* If skipping, we don't actually do anything */
5272 case 1: goto EXPAND_FAILED_CURLY;
5274 case 3: goto EXPAND_FAILED;
5277 /* sub_arg[0] is the address */
5278 if ( !(domain = Ustrrchr(sub_arg[0],'@'))
5279 || domain == sub_arg[0] || Ustrlen(domain) == 1)
5281 expand_string_message = US"prvs first argument must be a qualified email address";
5285 /* Calculate the hash. The third argument must be a single-digit
5286 key number, or unset. */
5289 && (!isdigit(sub_arg[2][0]) || sub_arg[2][1] != 0))
5291 expand_string_message = US"prvs third argument must be a single digit";
5295 p = prvs_hmac_sha1(sub_arg[0], sub_arg[1], sub_arg[2], prvs_daystamp(7));
5298 expand_string_message = US"prvs hmac-sha1 conversion failed";
5302 /* Now separate the domain from the local part */
5305 yield = string_catn(yield, US"prvs=", 5);
5306 yield = string_catn(yield, sub_arg[2] ? sub_arg[2] : US"0", 1);
5307 yield = string_catn(yield, prvs_daystamp(7), 3);
5308 yield = string_catn(yield, p, 6);
5309 yield = string_catn(yield, US"=", 1);
5310 yield = string_cat (yield, sub_arg[0]);
5311 yield = string_catn(yield, US"@", 1);
5312 yield = string_cat (yield, domain);
5317 /* Check a prvs-encoded address for validity */
5319 case EITEM_PRVSCHECK:
5321 uschar * sub_arg[3], * p;
5323 const pcre2_code * re;
5325 /* Reset expansion variables */
5326 prvscheck_result = NULL;
5327 prvscheck_address = NULL;
5328 prvscheck_keynum = NULL;
5330 switch(read_subs(sub_arg, 1, 1, &s, flags, FALSE, name, &resetok, NULL))
5332 case 1: goto EXPAND_FAILED_CURLY;
5334 case 3: goto EXPAND_FAILED;
5337 re = regex_must_compile(
5338 US"^prvs\\=([0-9])([0-9]{3})([A-F0-9]{6})\\=(.+)\\@(.+)$",
5339 MCS_CASELESS | MCS_CACHEABLE, FALSE);
5341 if (regex_match_and_setup(re,sub_arg[0],0,-1))
5343 uschar * local_part = string_copyn(expand_nstring[4],expand_nlength[4]);
5344 uschar * key_num = string_copyn(expand_nstring[1],expand_nlength[1]);
5345 uschar * daystamp = string_copyn(expand_nstring[2],expand_nlength[2]);
5346 uschar * hash = string_copyn(expand_nstring[3],expand_nlength[3]);
5347 uschar * domain = string_copyn(expand_nstring[5],expand_nlength[5]);
5351 debug_printf_indent("prvscheck localpart: %s\n", local_part);
5352 debug_printf_indent("prvscheck key number: %s\n", key_num);
5353 debug_printf_indent("prvscheck daystamp: %s\n", daystamp);
5354 debug_printf_indent("prvscheck hash: %s\n", hash);
5355 debug_printf_indent("prvscheck domain: %s\n", domain);
5358 /* Set up expansion variables */
5359 g = string_cat (NULL, local_part);
5360 g = string_catn(g, US"@", 1);
5361 g = string_cat (g, domain);
5362 prvscheck_address = string_from_gstring(g);
5363 prvscheck_keynum = string_copy(key_num);
5365 /* Now expand the second argument */
5366 switch(read_subs(sub_arg, 1, 1, &s, flags, FALSE, name, &resetok, NULL))
5368 case 1: goto EXPAND_FAILED_CURLY;
5370 case 3: goto EXPAND_FAILED;
5373 /* Now we have the key and can check the address. */
5375 p = prvs_hmac_sha1(prvscheck_address, sub_arg[0], prvscheck_keynum,
5379 expand_string_message = US"hmac-sha1 conversion failed";
5383 DEBUG(D_expand) debug_printf_indent("prvscheck: received hash is %s\n", hash);
5384 DEBUG(D_expand) debug_printf_indent("prvscheck: own hash is %s\n", p);
5386 if (Ustrcmp(p,hash) == 0)
5388 /* Success, valid BATV address. Now check the expiry date. */
5389 uschar *now = prvs_daystamp(0);
5390 unsigned int inow = 0,iexpire = 1;
5392 (void)sscanf(CS now,"%u",&inow);
5393 (void)sscanf(CS daystamp,"%u",&iexpire);
5395 /* When "iexpire" is < 7, a "flip" has occurred.
5396 Adjust "inow" accordingly. */
5397 if ( (iexpire < 7) && (inow >= 993) ) inow = 0;
5399 if (iexpire >= inow)
5401 prvscheck_result = US"1";
5402 DEBUG(D_expand) debug_printf_indent("prvscheck: success, $prvscheck_result set to 1\n");
5406 prvscheck_result = NULL;
5407 DEBUG(D_expand) debug_printf_indent("prvscheck: signature expired, $prvscheck_result unset\n");
5412 prvscheck_result = NULL;
5413 DEBUG(D_expand) debug_printf_indent("prvscheck: hash failure, $prvscheck_result unset\n");
5416 /* Now expand the final argument. We leave this till now so that
5417 it can include $prvscheck_result. */
5419 switch(read_subs(sub_arg, 1, 0, &s, flags, TRUE, name, &resetok, NULL))
5421 case 1: goto EXPAND_FAILED_CURLY;
5423 case 3: goto EXPAND_FAILED;
5426 yield = string_cat(yield,
5427 !sub_arg[0] || !*sub_arg[0] ? prvscheck_address : sub_arg[0]);
5429 /* Reset the "internal" variables afterwards, because they are in
5430 dynamic store that will be reclaimed if the expansion succeeded. */
5432 prvscheck_address = NULL;
5433 prvscheck_keynum = NULL;
5436 /* Does not look like a prvs encoded address, return the empty string.
5437 We need to make sure all subs are expanded first, so as to skip over
5440 switch(read_subs(sub_arg, 2, 1, &s, flags, TRUE, name, &resetok, NULL))
5442 case 1: goto EXPAND_FAILED_CURLY;
5444 case 3: goto EXPAND_FAILED;
5447 if (flags & ESI_SKIPPING) continue;
5451 /* Handle "readfile" to insert an entire file */
5453 case EITEM_READFILE:
5456 uschar * sub_arg[2];
5458 if ((expand_forbid & RDO_READFILE) != 0)
5460 expand_string_message = US"file insertions are not permitted";
5464 switch(read_subs(sub_arg, 2, 1, &s, flags, TRUE, name, &resetok, NULL))
5466 case -1: continue; /* If skipping, we don't actually do anything */
5467 case 1: goto EXPAND_FAILED_CURLY;
5469 case 3: goto EXPAND_FAILED;
5472 /* Open the file and read it */
5474 if (!(f = Ufopen(sub_arg[0], "rb")))
5476 expand_string_message = string_open_failed("%s", sub_arg[0]);
5480 yield = cat_file(f, yield, sub_arg[1]);
5485 /* Handle "readsocket" to insert data from a socket, either
5486 Inet or Unix domain */
5488 case EITEM_READSOCK:
5491 uschar * sub_arg[4];
5493 if (expand_forbid & RDO_READSOCK)
5495 expand_string_message = US"socket insertions are not permitted";
5499 /* Read up to 4 arguments, but don't do the end of item check afterwards,
5500 because there may be a string for expansion on failure. */
5502 switch(read_subs(sub_arg, 4, 2, &s, flags, FALSE, name, &resetok, NULL))
5504 case 1: goto EXPAND_FAILED_CURLY;
5505 case 2: /* Won't occur: no end check */
5506 case 3: goto EXPAND_FAILED;
5509 /* If skipping, we don't actually do anything. Otherwise, arrange to
5510 connect to either an IP or a Unix socket. */
5512 if (!(flags & ESI_SKIPPING))
5514 int stype = search_findtype(US"readsock", 8);
5517 int expand_setup = -1;
5520 /* If the reqstr is empty, flag that and set a dummy */
5524 g = string_append_listele(g, ',', US"send=no");
5525 sub_arg[1] = US"DUMMY";
5528 /* Re-marshall the options */
5532 const uschar * list = sub_arg[2];
5536 /* First option has no tag and is timeout */
5537 if ((item = string_nextinlist(&list, &sep, NULL, 0)))
5538 g = string_append_listele(g, ',',
5539 string_sprintf("timeout=%s", item));
5541 /* The rest of the options from the expansion */
5542 while ((item = string_nextinlist(&list, &sep, NULL, 0)))
5543 g = string_append_listele(g, ',', item);
5545 /* possibly plus an EOL string. Process with escapes, to protect
5546 from list-processing. The only current user of eol= in search
5547 options is the readsock expansion. */
5549 if (sub_arg[3] && *sub_arg[3])
5550 g = string_append_listele(g, ',',
5551 string_sprintf("eol=%s",
5552 string_printing2(sub_arg[3], SP_TAB|SP_SPACE)));
5555 /* Gat a (possibly cached) handle for the connection */
5557 if (!(handle = search_open(sub_arg[0], stype, 0, NULL, NULL)))
5559 if (*expand_string_message) goto EXPAND_FAILED;
5560 expand_string_message = search_error_message;
5561 search_error_message = NULL;
5565 /* Get (possibly cached) results for the lookup */
5566 /* sspec: sub_arg[0] req: sub_arg[1] opts: g */
5568 if ((s = search_find(handle, sub_arg[0], sub_arg[1], -1, NULL, 0, 0,
5569 &expand_setup, string_from_gstring(g))))
5570 yield = string_cat(yield, s);
5571 else if (f.search_find_defer)
5573 expand_string_message = search_error_message;
5574 search_error_message = NULL;
5578 { /* should not happen, at present */
5579 expand_string_message = search_error_message;
5580 search_error_message = NULL;
5585 /* The whole thing has worked (or we were skipping). If there is a
5586 failure string following, we need to skip it. */
5588 if (*s == '{') /*}*/
5590 if (!expand_string_internal(s+1,
5591 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | ESI_SKIPPING, &s, &resetok, NULL))
5592 goto EXPAND_FAILED; /*{*/
5595 expand_string_message = US"missing '}' closing failstring for readsocket";
5596 goto EXPAND_FAILED_CURLY;
5598 Uskip_whitespace(&s);
5601 READSOCK_DONE: /*{*/
5604 expand_string_message = US"missing '}' closing readsocket";
5605 goto EXPAND_FAILED_CURLY;
5607 if (flags & ESI_SKIPPING) continue;
5610 /* Come here on failure to create socket, connect socket, write to the
5611 socket, or timeout on reading. If another substring follows, expand and
5612 use it. Otherwise, those conditions give expand errors. */
5615 if (*s != '{') goto EXPAND_FAILED; /*}*/
5616 DEBUG(D_any) debug_printf("%s\n", expand_string_message);
5617 if (!(arg = expand_string_internal(s+1,
5618 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR, &s, &resetok, NULL)))
5620 yield = string_cat(yield, arg); /*{*/
5623 expand_string_message = US"missing '}' closing failstring for readsocket";
5624 goto EXPAND_FAILED_CURLY;
5626 Uskip_whitespace(&s);
5630 /* Handle "run" to execute a program. */
5635 const uschar * arg, ** argv;
5636 unsigned late_expand = TSUC_EXPAND_ARGS | TSUC_ALLOW_TAINTED_ARGS | TSUC_ALLOW_RECIPIENTS;
5638 if (expand_forbid & RDO_RUN)
5640 expand_string_message = US"running a command is not permitted";
5644 /* Handle options to the "run" */
5647 if (Ustrncmp(++s, "preexpand", 9) == 0)
5648 { late_expand = 0; s += 9; }
5651 const uschar * t = s;
5652 while (isalpha(*++t)) ;
5653 expand_string_message = string_sprintf("bad option '%.*s' for run",
5657 Uskip_whitespace(&s);
5659 if (*s != '{') /*}*/
5661 expand_string_message = US"missing '{' for command arg of run";
5662 goto EXPAND_FAILED_CURLY; /*"}*/
5666 if (late_expand) /* this is the default case */
5670 /* Locate the end of the args */
5671 (void) expand_string_internal(s,
5672 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | ESI_SKIPPING, &t, NULL, NULL);
5674 arg = flags & ESI_SKIPPING ? NULL : string_copyn(s, n);
5680 debug_printf_indent("args string for ${run} expand before split\n");
5681 if (!(arg = expand_string_internal(s,
5682 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL)))
5684 Uskip_whitespace(&s);
5689 expand_string_message = US"missing '}' closing command arg of run";
5690 goto EXPAND_FAILED_CURLY;
5693 if (flags & ESI_SKIPPING) /* Just pretend it worked when we're skipping */
5696 lookup_value = NULL;
5703 if (!transport_set_up_command(&argv, /* anchor for arg list */
5704 arg, /* raw command */
5705 late_expand, /* expand args if not already done */
5706 0, /* not relevant when... */
5707 NULL, /* no transporting address */
5708 US"${run} expansion", /* for error messages */
5709 &expand_string_message)) /* where to put error message */
5712 /* Create the child process, making it a group leader. */
5714 if ((pid = child_open(USS argv, NULL, 0077, &fd_in, &fd_out, TRUE,
5715 US"expand-run")) < 0)
5717 expand_string_message =
5718 string_sprintf("couldn't create child process: %s", strerror(errno));
5722 /* Nothing is written to the standard input. */
5726 /* Read the pipe to get the command's output into $value (which is kept
5727 in lookup_value). Read during execution, so that if the output exceeds
5728 the OS pipe buffer limit, we don't block forever. Remember to not release
5729 memory just allocated for $value. */
5732 f = fdopen(fd_out, "rb");
5733 sigalrm_seen = FALSE;
5735 lookup_value = string_from_gstring(cat_file(f, NULL, NULL));
5739 /* Wait for the process to finish, applying the timeout, and inspect its
5740 return code for serious disasters. Simple non-zero returns are passed on.
5743 if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0)
5745 if (sigalrm_seen || runrc == -256)
5747 expand_string_message = US"command timed out";
5748 killpg(pid, SIGKILL); /* Kill the whole process group */
5751 else if (runrc == -257)
5752 expand_string_message = string_sprintf("wait() failed: %s",
5756 expand_string_message = string_sprintf("command killed by signal %d",
5763 /* Process the yes/no strings; $value may be useful in both cases */
5765 switch(process_yesno(
5766 flags, /* were previously skipping */
5767 runrc == 0, /* success/failure indicator */
5768 lookup_value, /* value to reset for string2 */
5769 &s, /* input pointer */
5770 &yield, /* output pointer */
5771 US"run", /* condition type */
5774 case 1: goto EXPAND_FAILED; /* when all is well, the */
5775 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5778 if (flags & ESI_SKIPPING) continue;
5782 /* Handle character translation for "tr" */
5786 int oldptr = gstring_length(yield);
5790 switch(read_subs(sub, 3, 3, &s, flags, TRUE, name, &resetok, NULL))
5792 case -1: continue; /* skipping */
5793 case 1: goto EXPAND_FAILED_CURLY;
5795 case 3: goto EXPAND_FAILED;
5798 if ( (yield = string_cat(yield, sub[0]))
5799 && (o2m = Ustrlen(sub[2]) - 1) >= 0)
5800 for (; oldptr < yield->ptr; oldptr++)
5802 uschar * m = Ustrrchr(sub[1], yield->s[oldptr]);
5806 yield->s[oldptr] = sub[2][o < o2m ? o : o2m];
5813 /* Handle "hash", "length", "nhash", and "substr" when they are given with
5814 expanded arguments. */
5823 int val[2] = { 0, -1 };
5826 /* "length" takes only 2 arguments whereas the others take 2 or 3.
5827 Ensure that sub[2] is set in the ${length } case. */
5830 switch(read_subs(sub, item_type == EITEM_LENGTH ? 2:3, 2, &s, flags,
5831 TRUE, name, &resetok, NULL))
5833 case -1: continue; /* skipping */
5834 case 1: goto EXPAND_FAILED_CURLY;
5836 case 3: goto EXPAND_FAILED;
5839 /* Juggle the arguments if there are only two of them: always move the
5840 string to the last position and make ${length{n}{str}} equivalent to
5841 ${substr{0}{n}{str}}. See the defaults for val[] above. */
5847 if (item_type == EITEM_LENGTH)
5854 for (int i = 0; i < 2; i++) if (sub[i])
5856 val[i] = (int)Ustrtol(sub[i], &ret, 10);
5857 if (*ret != 0 || (i != 0 && val[i] < 0))
5859 expand_string_message = string_sprintf("\"%s\" is not a%s number "
5860 "(in \"%s\" expansion)", sub[i], (i != 0)? " positive" : "", name);
5866 item_type == EITEM_HASH
5867 ? compute_hash(sub[2], val[0], val[1], &len)
5868 : item_type == EITEM_NHASH
5869 ? compute_nhash(sub[2], val[0], val[1], &len)
5870 : extract_substr(sub[2], val[0], val[1], &len);
5873 yield = string_catn(yield, ret, len);
5877 /* Handle HMAC computation: ${hmac{<algorithm>}{<secret>}{<text>}}
5878 This code originally contributed by Steve Haslam. It currently supports
5879 the use of MD5 and SHA-1 hashes.
5881 We need some workspace that is large enough to handle all the supported
5882 hash types. Use macros to set the sizes rather than be too elaborate. */
5884 #define MAX_HASHLEN 20
5885 #define MAX_HASHBLOCKLEN 64
5894 int hashlen; /* Number of octets for the hash algorithm's output */
5895 int hashblocklen; /* Number of octets the hash algorithm processes */
5896 uschar * keyptr, * p;
5897 unsigned int keylen;
5899 uschar keyhash[MAX_HASHLEN];
5900 uschar innerhash[MAX_HASHLEN];
5901 uschar finalhash[MAX_HASHLEN];
5902 uschar finalhash_hex[2*MAX_HASHLEN];
5903 uschar innerkey[MAX_HASHBLOCKLEN];
5904 uschar outerkey[MAX_HASHBLOCKLEN];
5906 switch (read_subs(sub, 3, 3, &s, flags, TRUE, name, &resetok, NULL))
5908 case -1: continue; /* skipping */
5909 case 1: goto EXPAND_FAILED_CURLY;
5911 case 3: goto EXPAND_FAILED;
5914 if (Ustrcmp(sub[0], "md5") == 0)
5917 use_base = &md5_base;
5921 else if (Ustrcmp(sub[0], "sha1") == 0)
5924 use_base = &sha1_ctx;
5930 expand_string_message =
5931 string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
5936 keylen = Ustrlen(keyptr);
5938 /* If the key is longer than the hash block length, then hash the key
5941 if (keylen > hashblocklen)
5943 chash_start(type, use_base);
5944 chash_end(type, use_base, keyptr, keylen, keyhash);
5949 /* Now make the inner and outer key values */
5951 memset(innerkey, 0x36, hashblocklen);
5952 memset(outerkey, 0x5c, hashblocklen);
5954 for (int i = 0; i < keylen; i++)
5956 innerkey[i] ^= keyptr[i];
5957 outerkey[i] ^= keyptr[i];
5960 /* Now do the hashes */
5962 chash_start(type, use_base);
5963 chash_mid(type, use_base, innerkey);
5964 chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
5966 chash_start(type, use_base);
5967 chash_mid(type, use_base, outerkey);
5968 chash_end(type, use_base, innerhash, hashlen, finalhash);
5970 /* Encode the final hash as a hex string */
5973 for (int i = 0; i < hashlen; i++)
5975 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
5976 *p++ = hex_digits[finalhash[i] & 0x0f];
5979 DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n",
5980 sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex);
5982 yield = string_catn(yield, finalhash_hex, hashlen*2);
5986 /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
5987 We have to save the numerical variables and restore them afterwards. */
5991 const pcre2_code * re;
5992 int moffset, moffsetextra, slen;
5993 pcre2_match_data * md;
5995 uschar * subject, * sub[3];
5996 int save_expand_nmax =
5997 save_expand_strings(save_expand_nstring, save_expand_nlength);
5998 unsigned sub_textonly = 0;
6000 switch(read_subs(sub, 3, 3, &s, flags, TRUE, name, &resetok, &sub_textonly))
6002 case -1: continue; /* skipping */
6003 case 1: goto EXPAND_FAILED_CURLY;
6005 case 3: goto EXPAND_FAILED;
6008 /* Compile the regular expression */
6010 re = regex_compile(sub[1],
6011 sub_textonly & BIT(1) ? MCS_CACHEABLE : MCS_NOFLAGS,
6012 &expand_string_message, pcre_gen_cmp_ctx);
6016 md = pcre2_match_data_create(EXPAND_MAXN + 1, pcre_gen_ctx);
6018 /* Now run a loop to do the substitutions as often as necessary. It ends
6019 when there are no more matches. Take care over matches of the null string;
6020 do the same thing as Perl does. */
6023 slen = Ustrlen(sub[0]);
6024 moffset = moffsetextra = 0;
6029 PCRE2_SIZE * ovec = pcre2_get_ovector_pointer(md);
6030 int n = pcre2_match(re, (PCRE2_SPTR)subject, slen, moffset + moffsetextra,
6031 PCRE_EOPT | emptyopt, md, pcre_gen_mtc_ctx);
6034 /* No match - if we previously set PCRE_NOTEMPTY after a null match, this
6035 is not necessarily the end. We want to repeat the match from one
6036 character further along, but leaving the basic offset the same (for
6037 copying below). We can't be at the end of the string - that was checked
6038 before setting PCRE_NOTEMPTY. If PCRE_NOTEMPTY is not set, we are
6039 finished; copy the remaining string and end the loop. */
6049 yield = string_catn(yield, subject+moffset, slen-moffset);
6053 /* Match - set up for expanding the replacement. */
6054 DEBUG(D_expand) debug_printf_indent("%s: match\n", name);
6056 if (n == 0) n = EXPAND_MAXN + 1;
6058 for (int nn = 0; nn < n*2; nn += 2)
6060 expand_nstring[expand_nmax] = subject + ovec[nn];
6061 expand_nlength[expand_nmax++] = ovec[nn+1] - ovec[nn];
6065 /* Copy the characters before the match, plus the expanded insertion. */
6067 yield = string_catn(yield, subject + moffset, ovec[0] - moffset);
6069 if (!(insert = expand_string(sub[2])))
6071 yield = string_cat(yield, insert);
6077 /* If we have matched an empty string, first check to see if we are at
6078 the end of the subject. If so, the loop is over. Otherwise, mimic
6079 what Perl's /g options does. This turns out to be rather cunning. First
6080 we set PCRE_NOTEMPTY and PCRE_ANCHORED and try the match a non-empty
6081 string at the same point. If this fails (picked up above) we advance to
6082 the next character. */
6084 if (ovec[0] == ovec[1])
6086 if (ovec[0] == slen) break;
6087 emptyopt = PCRE2_NOTEMPTY | PCRE2_ANCHORED;
6091 /* All done - restore numerical variables. */
6093 /* pcre2_match_data_free(md); gen ctx needs no free */
6094 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6095 save_expand_nlength);
6099 /* Handle keyed and numbered substring extraction. If the first argument
6100 consists entirely of digits, then a numerical extraction is assumed. */
6104 int field_number = 1;
6105 BOOL field_number_set = FALSE;
6106 uschar * save_lookup_value = lookup_value, * sub[3];
6107 int save_expand_nmax =
6108 save_expand_strings(save_expand_nstring, save_expand_nlength);
6110 /* On reflection the original behaviour of extract-json for a string
6111 result, leaving it quoted, was a mistake. But it was already published,
6112 hence the addition of jsons. In a future major version, make json
6113 work like josons, and withdraw jsons. */
6115 enum {extract_basic, extract_json, extract_jsons} fmt = extract_basic;
6117 /* Check for a format-variant specifier */
6119 if (Uskip_whitespace(&s) != '{') /*}*/
6120 if (Ustrncmp(s, "json", 4) == 0)
6121 if (*(s += 4) == 's')
6122 {fmt = extract_jsons; s++;}
6126 /* While skipping we cannot rely on the data for expansions being
6127 available (eg. $item) hence cannot decide on numeric vs. keyed.
6128 Read a maximum of 5 arguments (including the yes/no) */
6130 if (flags & ESI_SKIPPING)
6132 for (int j = 5; j > 0 && *s == '{'; j--) /*'}'*/
6134 if (!expand_string_internal(s+1,
6135 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL))
6136 goto EXPAND_FAILED; /*'{'*/
6139 expand_string_message = US"missing '{' for arg of extract";
6140 goto EXPAND_FAILED_CURLY;
6142 Uskip_whitespace(&s);
6144 if ( Ustrncmp(s, "fail", 4) == 0 /*'{'*/
6145 && (s[4] == '}' || s[4] == ' ' || s[4] == '\t' || !s[4])
6149 Uskip_whitespace(&s);
6153 expand_string_message = US"missing '}' closing extract";
6154 goto EXPAND_FAILED_CURLY;
6158 else for (int i = 0, j = 2; i < j; i++) /* Read the proper number of arguments */
6160 if (Uskip_whitespace(&s) == '{') /*'}'*/
6162 if (!(sub[i] = expand_string_internal(s+1,
6163 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL)))
6164 goto EXPAND_FAILED; /*'{'*/
6167 expand_string_message = string_sprintf(
6168 "missing '}' closing arg %d of extract", i+1);
6169 goto EXPAND_FAILED_CURLY;
6172 /* After removal of leading and trailing white space, the first
6173 argument must not be empty; if it consists entirely of digits
6174 (optionally preceded by a minus sign), this is a numerical
6175 extraction, and we expect 3 arguments (normal) or 2 (json). */
6181 uschar * p = sub[0];
6183 Uskip_whitespace(&p);
6187 while (len > 0 && isspace(p[len-1])) len--;
6192 expand_string_message = US"first argument of \"extract\" must "
6202 while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
6206 if (fmt == extract_basic) j = 3; /* Need 3 args */
6207 field_number_set = TRUE;
6213 expand_string_message = string_sprintf(
6214 "missing '{' for arg %d of extract", i+1);
6215 goto EXPAND_FAILED_CURLY;
6219 /* Extract either the numbered or the keyed substring into $value. If
6220 skipping, just pretend the extraction failed. */
6222 if (flags & ESI_SKIPPING)
6223 lookup_value = NULL;
6227 lookup_value = field_number_set
6228 ? expand_gettokened(field_number, sub[1], sub[2])
6229 : expand_getkeyed(sub[0], sub[1]);
6236 const uschar * list;
6238 /* Array: Bracket-enclosed and comma-separated.
6239 Object: Brace-enclosed, comma-sep list of name:value pairs */
6241 if (!(s = dewrap(sub[1], field_number_set ? US"[]" : US"{}")))
6243 expand_string_message =
6244 string_sprintf("%s wrapping %s for extract json",
6245 expand_string_message,
6246 field_number_set ? "array" : "object");
6247 goto EXPAND_FAILED_CURLY;
6251 if (field_number_set)
6253 if (field_number <= 0)
6255 expand_string_message = US"first argument of \"extract\" must "
6256 "be greater than zero";
6259 while (field_number > 0 && (item = json_nextinlist(&list)))
6261 if ((lookup_value = s = item))
6264 while (--s >= lookup_value && isspace(*s)) *s = '\0';
6269 lookup_value = NULL;
6270 while ((item = json_nextinlist(&list)))
6272 /* Item is: string name-sep value. string is quoted.
6273 Dequote the string and compare with the search key. */
6275 if (!(item = dewrap(item, US"\"\"")))
6277 expand_string_message =
6278 string_sprintf("%s wrapping string key for extract json",
6279 expand_string_message);
6280 goto EXPAND_FAILED_CURLY;
6282 if (Ustrcmp(item, sub[0]) == 0) /*XXX should be a UTF8-compare */
6284 s = item + Ustrlen(item) + 1;
6285 if (Uskip_whitespace(&s) != ':')
6287 expand_string_message =
6288 US"missing object value-separator for extract json";
6289 goto EXPAND_FAILED_CURLY;
6292 Uskip_whitespace(&s);
6300 if ( fmt == extract_jsons
6302 && !(lookup_value = dewrap(lookup_value, US"\"\"")))
6304 expand_string_message =
6305 string_sprintf("%s wrapping string result for extract jsons",
6306 expand_string_message);
6307 goto EXPAND_FAILED_CURLY;
6312 /* If no string follows, $value gets substituted; otherwise there can
6313 be yes/no strings, as for lookup or if. */
6315 switch(process_yesno(
6316 flags, /* were previously skipping */
6317 lookup_value != NULL, /* success/failure indicator */
6318 save_lookup_value, /* value to reset for string2 */
6319 &s, /* input pointer */
6320 &yield, /* output pointer */
6321 US"extract", /* condition type */
6324 case 1: goto EXPAND_FAILED; /* when all is well, the */
6325 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6328 /* All done - restore numerical variables. */
6330 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6331 save_expand_nlength);
6333 if (flags & ESI_SKIPPING) continue;
6337 /* return the Nth item from a list */
6339 case EITEM_LISTEXTRACT:
6341 int field_number = 1;
6342 uschar * save_lookup_value = lookup_value, * sub[2];
6343 int save_expand_nmax =
6344 save_expand_strings(save_expand_nstring, save_expand_nlength);
6346 /* Read the field & list arguments */
6347 /*XXX Could we use read_subs here (and get better efficiency for skipping)? */
6349 for (int i = 0; i < 2; i++)
6351 if (Uskip_whitespace(&s) != '{') /*}*/
6353 expand_string_message = string_sprintf(
6354 "missing '{' for arg %d of listextract", i+1); /*}*/
6355 goto EXPAND_FAILED_CURLY;
6358 sub[i] = expand_string_internal(s+1,
6359 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
6360 if (!sub[i]) goto EXPAND_FAILED; /*{{*/
6363 expand_string_message = string_sprintf(
6364 "missing '}' closing arg %d of listextract", i+1);
6365 goto EXPAND_FAILED_CURLY;
6368 /* After removal of leading and trailing white space, the first
6369 argument must be numeric and nonempty. */
6377 Uskip_whitespace(&p);
6381 while (len > 0 && isspace(p[len-1])) len--;
6384 if (!*p && !(flags & ESI_SKIPPING))
6386 expand_string_message = US"first argument of \"listextract\" must "
6396 while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
6399 expand_string_message = US"first argument of \"listextract\" must "
6407 /* Extract the numbered element into $value. If
6408 skipping, just pretend the extraction failed. */
6410 lookup_value = flags & ESI_SKIPPING ? NULL : expand_getlistele(field_number, sub[1]);
6412 /* If no string follows, $value gets substituted; otherwise there can
6413 be yes/no strings, as for lookup or if. */
6415 switch(process_yesno(
6416 flags, /* were previously skipping */
6417 lookup_value != NULL, /* success/failure indicator */
6418 save_lookup_value, /* value to reset for string2 */
6419 &s, /* input pointer */
6420 &yield, /* output pointer */
6421 US"listextract", /* condition type */
6424 case 1: goto EXPAND_FAILED; /* when all is well, the */
6425 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6428 /* All done - restore numerical variables. */
6430 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6431 save_expand_nlength);
6433 if (flags & ESI_SKIPPING) continue;
6437 case EITEM_LISTQUOTE:
6440 switch(read_subs(sub, 2, 2, &s, flags, TRUE, name, &resetok, NULL))
6442 case -1: continue; /* skipping */
6443 case 1: goto EXPAND_FAILED_CURLY;
6445 case 3: goto EXPAND_FAILED;
6447 if (*sub[1]) for (uschar sep = *sub[0], c; c = *sub[1]; sub[1]++)
6449 if (c == sep) yield = string_catn(yield, sub[1], 1);
6450 yield = string_catn(yield, sub[1], 1);
6452 else yield = string_catn(yield, US" ", 1);
6457 case EITEM_CERTEXTRACT:
6459 uschar * save_lookup_value = lookup_value, * sub[2];
6460 int save_expand_nmax =
6461 save_expand_strings(save_expand_nstring, save_expand_nlength);
6463 /* Read the field argument */
6464 if (Uskip_whitespace(&s) != '{') /*}*/
6466 expand_string_message = US"missing '{' for field arg of certextract";
6467 goto EXPAND_FAILED_CURLY; /*}*/
6469 sub[0] = expand_string_internal(s+1,
6470 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
6471 if (!sub[0]) goto EXPAND_FAILED; /*{{*/
6474 expand_string_message = US"missing '}' closing field arg of certextract";
6475 goto EXPAND_FAILED_CURLY;
6477 /* strip spaces fore & aft */
6482 Uskip_whitespace(&p);
6486 while (len > 0 && isspace(p[len-1])) len--;
6490 /* inspect the cert argument */
6491 if (Uskip_whitespace(&s) != '{') /*}*/
6493 expand_string_message = US"missing '{' for cert variable arg of certextract";
6494 goto EXPAND_FAILED_CURLY; /*}*/
6498 expand_string_message = US"second argument of \"certextract\" must "
6499 "be a certificate variable";
6502 sub[1] = expand_string_internal(s+1,
6503 ESI_BRACE_ENDS | flags & ESI_SKIPPING, &s, &resetok, NULL);
6504 if (!sub[1]) goto EXPAND_FAILED; /*{{*/
6507 expand_string_message = US"missing '}' closing cert variable arg of certextract";
6508 goto EXPAND_FAILED_CURLY;
6511 if (flags & ESI_SKIPPING)
6512 lookup_value = NULL;
6515 lookup_value = expand_getcertele(sub[0], sub[1]);
6516 if (*expand_string_message) goto EXPAND_FAILED;
6518 switch(process_yesno(
6519 flags, /* were previously skipping */
6520 lookup_value != NULL, /* success/failure indicator */
6521 save_lookup_value, /* value to reset for string2 */
6522 &s, /* input pointer */
6523 &yield, /* output pointer */
6524 US"certextract", /* condition type */
6527 case 1: goto EXPAND_FAILED; /* when all is well, the */
6528 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6531 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6532 save_expand_nlength);
6533 if (flags & ESI_SKIPPING) continue;
6536 #endif /*DISABLE_TLS*/
6538 /* Handle list operations */
6544 int sep = 0, save_ptr = gstring_length(yield);
6545 uschar outsep[2] = { '\0', '\0' };
6546 const uschar *list, *expr, *temp;
6547 uschar * save_iterate_item = iterate_item;
6548 uschar * save_lookup_value = lookup_value;
6550 Uskip_whitespace(&s);
6551 if (*s++ != '{') /*}*/
6553 expand_string_message =
6554 string_sprintf("missing '{' for first arg of %s", name);
6555 goto EXPAND_FAILED_CURLY; /*}*/
6558 DEBUG(D_expand) debug_printf_indent("%s: evaluate input list list\n", name);
6559 if (!(list = expand_string_internal(s,
6560 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL)))
6561 goto EXPAND_FAILED; /*{{*/
6564 expand_string_message =
6565 string_sprintf("missing '}' closing first arg of %s", name);
6566 goto EXPAND_FAILED_CURLY;
6569 if (item_type == EITEM_REDUCE)
6572 Uskip_whitespace(&s);
6573 if (*s++ != '{') /*}*/
6575 expand_string_message = US"missing '{' for second arg of reduce";
6576 goto EXPAND_FAILED_CURLY; /*}*/
6578 DEBUG(D_expand) debug_printf_indent("reduce: initial result list\n");
6579 t = expand_string_internal(s,
6580 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
6581 if (!t) goto EXPAND_FAILED;
6582 lookup_value = t; /*{{*/
6585 expand_string_message = US"missing '}' closing second arg of reduce";
6586 goto EXPAND_FAILED_CURLY;
6590 Uskip_whitespace(&s);
6591 if (*s++ != '{') /*}*/
6593 expand_string_message =
6594 string_sprintf("missing '{' for last arg of %s", name); /*}*/
6595 goto EXPAND_FAILED_CURLY;
6600 /* For EITEM_FILTER, call eval_condition once, with result discarded (as
6601 if scanning a "false" part). This allows us to find the end of the
6602 condition, because if the list is empty, we won't actually evaluate the
6603 condition for real. For EITEM_MAP and EITEM_REDUCE, do the same, using
6604 the normal internal expansion function. */
6606 DEBUG(D_expand) debug_printf_indent("%s: find end of conditionn\n", name);
6607 if (item_type != EITEM_FILTER)
6608 temp = expand_string_internal(s,
6609 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | ESI_SKIPPING, &s, &resetok, NULL);
6611 if ((temp = eval_condition(expr, &resetok, NULL))) s = temp;
6615 expand_string_message = string_sprintf("%s inside \"%s\" item",
6616 expand_string_message, name);
6620 Uskip_whitespace(&s); /*{{{*/
6623 expand_string_message = string_sprintf("missing } at end of condition "
6624 "or expression inside \"%s\"; could be an unquoted } in the content",
6629 Uskip_whitespace(&s); /*{{*/
6632 expand_string_message = string_sprintf("missing } at end of \"%s\"",
6637 /* If we are skipping, we can now just move on to the next item. When
6638 processing for real, we perform the iteration. */
6640 if (flags & ESI_SKIPPING) continue;
6641 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
6643 *outsep = (uschar)sep; /* Separator as a string */
6645 DEBUG(D_expand) debug_printf_indent("%s: $item = '%s' $value = '%s'\n",
6646 name, iterate_item, lookup_value);
6648 if (item_type == EITEM_FILTER)
6651 /* the condition could modify $value, as a side-effect */
6652 uschar * save_value = lookup_value;
6654 if (!eval_condition(expr, &resetok, &condresult))
6656 iterate_item = save_iterate_item;
6657 lookup_value = save_lookup_value;
6658 expand_string_message = string_sprintf("%s inside \"%s\" condition",
6659 expand_string_message, name);
6662 lookup_value = save_value;
6663 DEBUG(D_expand) debug_printf_indent("%s: condition is %s\n", name,
6664 condresult? "true":"false");
6666 temp = iterate_item; /* TRUE => include this item */
6668 continue; /* FALSE => skip this item */
6671 else /* EITEM_MAP and EITEM_REDUCE */
6673 /* the expansion could modify $value, as a side-effect */
6674 uschar * t = expand_string_internal(expr,
6675 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, NULL, &resetok, NULL);
6678 iterate_item = save_iterate_item;
6679 expand_string_message = string_sprintf("%s inside \"%s\" item",
6680 expand_string_message, name);
6683 if (item_type == EITEM_REDUCE)
6685 lookup_value = t; /* Update the value of $value */
6686 continue; /* and continue the iteration */
6690 /* We reach here for FILTER if the condition is true, always for MAP,
6691 and never for REDUCE. The value in "temp" is to be added to the output
6692 list that is being created, ensuring that any occurrences of the
6693 separator character are doubled. Unless we are dealing with the first
6694 item of the output list, add in a space if the new item begins with the
6695 separator character, or is an empty string. */
6697 /*XXX is there not a standard support function for this, appending to a list? */
6698 /* yes, string_append_listele(), but it depends on lack of text before the list */
6700 if ( yield && yield->ptr != save_ptr
6701 && (temp[0] == *outsep || temp[0] == 0))
6702 yield = string_catn(yield, US" ", 1);
6704 /* Add the string in "temp" to the output list that we are building,
6705 This is done in chunks by searching for the separator character. */
6709 size_t seglen = Ustrcspn(temp, outsep);
6711 yield = string_catn(yield, temp, seglen + 1);
6713 /* If we got to the end of the string we output one character
6714 too many; backup and end the loop. Otherwise arrange to double the
6717 if (!temp[seglen]) { yield->ptr--; break; }
6718 yield = string_catn(yield, outsep, 1);
6722 /* Output a separator after the string: we will remove the redundant
6723 final one at the end. */
6725 yield = string_catn(yield, outsep, 1);
6726 } /* End of iteration over the list loop */
6728 /* REDUCE has generated no output above: output the final value of
6731 if (item_type == EITEM_REDUCE)
6733 yield = string_cat(yield, lookup_value);
6734 lookup_value = save_lookup_value; /* Restore $value */
6737 /* FILTER and MAP generate lists: if they have generated anything, remove
6738 the redundant final separator. Even though an empty item at the end of a
6739 list does not count, this is tidier. */
6741 else if (yield && yield->ptr != save_ptr) yield->ptr--;
6743 /* Restore preserved $item */
6745 iterate_item = save_iterate_item;
6746 if (flags & ESI_SKIPPING) continue;
6752 int sep = 0, cond_type;
6753 const uschar * srclist, * cmp, * xtract;
6754 uschar * opname, * srcitem;
6755 const uschar * dstlist = NULL, * dstkeylist = NULL;
6756 uschar * tmp, * save_iterate_item = iterate_item;
6758 Uskip_whitespace(&s);
6759 if (*s++ != '{') /*}*/
6761 expand_string_message = US"missing '{' for list arg of sort";
6762 goto EXPAND_FAILED_CURLY; /*}*/
6765 srclist = expand_string_internal(s,
6766 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
6767 if (!srclist) goto EXPAND_FAILED; /*{{*/
6770 expand_string_message = US"missing '}' closing list arg of sort";
6771 goto EXPAND_FAILED_CURLY;
6774 Uskip_whitespace(&s);
6775 if (*s++ != '{') /*}*/
6777 expand_string_message = US"missing '{' for comparator arg of sort";
6778 goto EXPAND_FAILED_CURLY; /*}*/
6781 cmp = expand_string_internal(s,
6782 ESI_BRACE_ENDS | flags & ESI_SKIPPING, &s, &resetok, NULL);
6783 if (!cmp) goto EXPAND_FAILED; /*{{*/
6786 expand_string_message = US"missing '}' closing comparator arg of sort";
6787 goto EXPAND_FAILED_CURLY;
6790 if ((cond_type = identify_operator(&cmp, &opname)) == -1)
6792 if (!expand_string_message)
6793 expand_string_message = string_sprintf("unknown condition \"%s\"", s);
6798 case ECOND_NUM_L: case ECOND_NUM_LE:
6799 case ECOND_NUM_G: case ECOND_NUM_GE:
6800 case ECOND_STR_GE: case ECOND_STR_GEI: case ECOND_STR_GT: case ECOND_STR_GTI:
6801 case ECOND_STR_LE: case ECOND_STR_LEI: case ECOND_STR_LT: case ECOND_STR_LTI:
6805 expand_string_message = US"comparator not handled for sort";
6809 Uskip_whitespace(&s);
6810 if (*s++ != '{') /*}*/
6812 expand_string_message = US"missing '{' for extractor arg of sort";
6813 goto EXPAND_FAILED_CURLY; /*}*/
6817 if (!(tmp = expand_string_internal(s,
6818 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | ESI_SKIPPING, &s, &resetok, NULL)))
6820 xtract = string_copyn(xtract, s - xtract);
6824 expand_string_message = US"missing '}' closing extractor arg of sort";
6825 goto EXPAND_FAILED_CURLY;
6830 expand_string_message = US"missing } at end of \"sort\"";
6834 if (flags & ESI_SKIPPING) continue;
6836 while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
6838 uschar * srcfield, * dstitem;
6839 gstring * newlist = NULL, * newkeylist = NULL;
6841 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
6843 /* extract field for comparisons */
6844 iterate_item = srcitem;
6845 if ( !(srcfield = expand_string_internal(xtract,
6846 ESI_HONOR_DOLLAR, NULL, &resetok, NULL))
6849 expand_string_message = string_sprintf(
6850 "field-extract in sort: \"%s\"", xtract);
6854 /* Insertion sort */
6856 /* copy output list until new-item < list-item */
6857 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6861 /* field for comparison */
6862 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6865 /* String-comparator names start with a letter; numeric names do not */
6867 if (sortsbefore(cond_type, isalpha(opname[0]),
6868 srcfield, dstfield))
6870 /* New-item sorts before this dst-item. Append new-item,
6871 then dst-item, then remainder of dst list. */
6873 newlist = string_append_listele(newlist, sep, srcitem);
6874 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6877 newlist = string_append_listele(newlist, sep, dstitem);
6878 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6880 /*XXX why field-at-a-time copy? Why not just dup the rest of the list? */
6881 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6883 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6885 newlist = string_append_listele(newlist, sep, dstitem);
6886 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6892 newlist = string_append_listele(newlist, sep, dstitem);
6893 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6896 /* If we ran out of dstlist without consuming srcitem, append it */
6899 newlist = string_append_listele(newlist, sep, srcitem);
6900 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6903 dstlist = newlist->s;
6904 dstkeylist = newkeylist->s;
6906 DEBUG(D_expand) debug_printf_indent("%s: dstlist = \"%s\"\n", name, dstlist);
6907 DEBUG(D_expand) debug_printf_indent("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
6911 yield = string_cat(yield, dstlist);
6913 /* Restore preserved $item */
6914 iterate_item = save_iterate_item;
6918 expand_string_message = US"Internal error in sort (list mismatch)";
6923 /* If ${dlfunc } support is configured, handle calling dynamically-loaded
6924 functions, unless locked out at this time. Syntax is ${dlfunc{file}{func}}
6925 or ${dlfunc{file}{func}{arg}} or ${dlfunc{file}{func}{arg1}{arg2}} or up to
6926 a maximum of EXPAND_DLFUNC_MAX_ARGS arguments (defined below). */
6928 #define EXPAND_DLFUNC_MAX_ARGS 8
6931 #ifndef EXPAND_DLFUNC
6932 expand_string_message = US"\"${dlfunc\" encountered, but this facility " /*}*/
6933 "is not included in this binary";
6936 #else /* EXPAND_DLFUNC */
6939 exim_dlfunc_t * func;
6942 uschar * argv[EXPAND_DLFUNC_MAX_ARGS + 3];
6944 if (expand_forbid & RDO_DLFUNC)
6946 expand_string_message =
6947 US"dynamically-loaded functions are not permitted";
6951 switch(read_subs(argv, EXPAND_DLFUNC_MAX_ARGS + 2, 2, &s, flags,
6952 TRUE, name, &resetok, NULL))
6954 case -1: continue; /* skipping */
6955 case 1: goto EXPAND_FAILED_CURLY;
6957 case 3: goto EXPAND_FAILED;
6960 /* Look up the dynamically loaded object handle in the tree. If it isn't
6961 found, dlopen() the file and put the handle in the tree for next time. */
6963 if (!(t = tree_search(dlobj_anchor, argv[0])))
6965 void * handle = dlopen(CS argv[0], RTLD_LAZY);
6968 expand_string_message = string_sprintf("dlopen \"%s\" failed: %s",
6969 argv[0], dlerror());
6970 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6973 t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]), argv[0]);
6974 Ustrcpy(t->name, argv[0]);
6975 t->data.ptr = handle;
6976 (void)tree_insertnode(&dlobj_anchor, t);
6979 /* Having obtained the dynamically loaded object handle, look up the
6980 function pointer. */
6982 if (!(func = (exim_dlfunc_t *)dlsym(t->data.ptr, CS argv[1])))
6984 expand_string_message = string_sprintf("dlsym \"%s\" in \"%s\" failed: "
6985 "%s", argv[1], argv[0], dlerror());
6986 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6990 /* Call the function and work out what to do with the result. If it
6991 returns OK, we have a replacement string; if it returns DEFER then
6992 expansion has failed in a non-forced manner; if it returns FAIL then
6993 failure was forced; if it returns ERROR or any other value there's a
6994 problem, so panic slightly. In any case, assume that the function has
6995 side-effects on the store that must be preserved. */
6999 for (argc = 0; argv[argc]; argc++) ;
7001 if ((status = func(&result, argc - 2, &argv[2])) != OK)
7003 expand_string_message = result ? result : US"(no message)";
7004 if (status == FAIL_FORCED)
7005 f.expand_string_forcedfail = TRUE;
7006 else if (status != FAIL)
7007 log_write(0, LOG_MAIN|LOG_PANIC, "dlfunc{%s}{%s} failed (%d): %s",
7008 argv[0], argv[1], status, expand_string_message);
7012 if (result) yield = string_cat(yield, result);
7015 #endif /* EXPAND_DLFUNC */
7017 case EITEM_ENV: /* ${env {name} {val_if_found} {val_if_unfound}} */
7020 uschar *save_lookup_value = lookup_value;
7022 if (Uskip_whitespace(&s) != '{') /*}*/
7025 key = expand_string_internal(s+1,
7026 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
7027 if (!key) goto EXPAND_FAILED; /*{{*/
7030 expand_string_message = US"missing '}' for name arg of env";
7031 goto EXPAND_FAILED_CURLY;
7034 lookup_value = US getenv(CS key);
7036 switch(process_yesno(
7037 flags, /* were previously skipping */
7038 lookup_value != NULL, /* success/failure indicator */
7039 save_lookup_value, /* value to reset for string2 */
7040 &s, /* input pointer */
7041 &yield, /* output pointer */
7042 US"env", /* condition type */
7045 case 1: goto EXPAND_FAILED; /* when all is well, the */
7046 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
7048 if (flags & ESI_SKIPPING) continue;
7053 case EITEM_SRS_ENCODE:
7054 /* ${srs_encode {secret} {return_path} {orig_domain}} */
7059 BOOL quoted = FALSE;
7061 switch (read_subs(sub, 3, 3, CUSS &s, flags, TRUE, name, &resetok, NULL))
7063 case -1: continue; /* skipping */
7064 case 1: goto EXPAND_FAILED_CURLY;
7066 case 3: goto EXPAND_FAILED;
7068 if (flags & ESI_SKIPPING) continue;
7070 if (sub[1] && *(sub[1]))
7072 g = string_catn(g, US"SRS0=", 5);
7074 /* ${l_4:${hmac{md5}{SRS_SECRET}{${lc:$return_path}}}}= */
7075 hmac_md5(sub[0], string_copylc(sub[1]), cksum, sizeof(cksum));
7076 g = string_catn(g, cksum, sizeof(cksum));
7077 g = string_catn(g, US"=", 1);
7079 /* ${base32:${eval:$tod_epoch/86400&0x3ff}}= */
7084 gettimeofday(&now, NULL);
7085 i = (now.tv_sec / 86400) & 0x3ff;
7086 g = string_catn(g, &base32_chars[i >> 5], 1);
7087 g = string_catn(g, &base32_chars[i & 0x1f], 1);
7089 g = string_catn(g, US"=", 1);
7091 /* ${domain:$return_path}=${local_part:$return_path} */
7093 int start, end, domain;
7094 uschar * t = parse_extract_address(sub[1], &expand_string_message,
7095 &start, &end, &domain, FALSE);
7101 if (domain > 0) g = string_cat(g, t + domain);
7102 g = string_catn(g, US"=", 1);
7104 s = domain > 0 ? string_copyn(t, domain - 1) : t;
7105 if ((quoted = Ustrchr(s, '"') != NULL))
7108 DEBUG(D_expand) debug_printf_indent("auto-quoting local part\n");
7109 while (*s) /* de-quote */
7111 while (*s && *s != '"') h = string_catn(h, s++, 1);
7113 while (*s && *s != '"') h = string_catn(h, s++, 1);
7116 gstring_release_unused(h);
7117 s = string_from_gstring(h);
7119 g = string_cat(g, s);
7122 /* Assume that if the original local_part had quotes
7123 it was for good reason */
7125 if (quoted) yield = string_catn(yield, US"\"", 1);
7126 yield = gstring_append(yield, g);
7127 if (quoted) yield = string_catn(yield, US"\"", 1);
7129 /* @$original_domain */
7130 yield = string_catn(yield, US"@", 1);
7131 yield = string_cat(yield, sub[2]);
7134 DEBUG(D_expand) debug_printf_indent("null return_path for srs-encode\n");
7138 #endif /*SUPPORT_SRS*/
7142 } /* EITEM_* switch */
7145 DEBUG(D_expand) /* only if not the sole expansion of the line */
7146 if (yield && (expansion_start > 0 || *s))
7147 debug_expansion_interim(US"item-res",
7148 yield->s + expansion_start, yield->ptr - expansion_start,
7155 /* Control reaches here if the name is not recognized as one of the more
7156 complicated expansion items. Check for the "operator" syntax (name terminated
7157 by a colon). Some of the operators have arguments, separated by _ from the
7163 uschar * arg = NULL, * sub;
7165 var_entry * vp = NULL;
7168 /* Owing to an historical mis-design, an underscore may be part of the
7169 operator name, or it may introduce arguments. We therefore first scan the
7170 table of names that contain underscores. If there is no match, we cut off
7171 the arguments and then scan the main table. */
7173 if ((c = chop_match(name, op_table_underscore,
7174 nelem(op_table_underscore))) < 0)
7176 if ((arg = Ustrchr(name, '_')))
7178 if ((c = chop_match(name, op_table_main, nelem(op_table_main))) >= 0)
7179 c += nelem(op_table_underscore);
7180 if (arg) *arg++ = '_'; /* Put back for error messages */
7183 /* Deal specially with operators that might take a certificate variable
7184 as we do not want to do the usual expansion. For most, expand the string.*/
7195 const uschar * s1 = s;
7196 sub = expand_string_internal(s+2,
7197 ESI_BRACE_ENDS | flags & ESI_SKIPPING, &s1, &resetok, NULL);
7198 if (!sub) goto EXPAND_FAILED; /*{*/
7201 expand_string_message =
7202 string_sprintf("missing '}' closing cert arg of %s", name);
7203 goto EXPAND_FAILED_CURLY;
7205 if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
7215 sub = expand_string_internal(s+1,
7216 ESI_BRACE_ENDS | ESI_HONOR_DOLLAR | flags, &s, &resetok, NULL);
7217 if (!sub) goto EXPAND_FAILED;
7222 /* If we are skipping, we don't need to perform the operation at all.
7223 This matters for operations like "mask", because the data may not be
7224 in the correct format when skipping. For example, the expression may test
7225 for the existence of $sender_host_address before trying to mask it. For
7226 other operations, doing them may not fail, but it is a waste of time. */
7228 if (flags & ESI_SKIPPING && c >= 0) continue;
7230 /* Otherwise, switch on the operator type. After handling go back
7231 to the main loop top. */
7234 unsigned expansion_start = gstring_length(yield);
7240 unsigned long int n = Ustrtoul(sub, &t, 10);
7245 expand_string_message = string_sprintf("argument for base32 "
7246 "operator is \"%s\", which is not a decimal number", sub);
7250 g = string_catn(g, &base32_chars[n & 0x1f], 1);
7252 if (g) while (g->ptr > 0) yield = string_catn(yield, &g->s[--g->ptr], 1);
7259 unsigned long int n = 0;
7262 uschar * t = Ustrchr(base32_chars, *tt++);
7265 expand_string_message = string_sprintf("argument for base32d "
7266 "operator is \"%s\", which is not a base 32 number", sub);
7269 n = n * 32 + (t - base32_chars);
7271 yield = string_fmt_append(yield, "%ld", n);
7278 unsigned long int n = Ustrtoul(sub, &t, 10);
7281 expand_string_message = string_sprintf("argument for base62 "
7282 "operator is \"%s\", which is not a decimal number", sub);
7285 yield = string_cat(yield, string_base62_32(n)); /*XXX only handles 32b input range. Need variants? */
7289 /* Note that for Darwin and Cygwin, BASE_62 actually has the value 36 */
7294 unsigned long int n = 0;
7297 uschar *t = Ustrchr(base62_chars, *tt++);
7300 expand_string_message = string_sprintf("argument for base62d "
7301 "operator is \"%s\", which is not a base %d number", sub,
7305 n = n * BASE_62 + (t - base62_chars);
7307 yield = string_fmt_append(yield, "%ld", n);
7313 uschar *expanded = expand_string_internal(sub,
7314 ESI_HONOR_DOLLAR | flags & ESI_SKIPPING, NULL, &resetok, NULL);
7317 expand_string_message =
7318 string_sprintf("internal expansion of \"%s\" failed: %s", sub,
7319 expand_string_message);
7322 yield = string_cat(yield, expanded);
7329 uschar *t = sub - 1;
7330 while (*(++t) != 0) { *t = tolower(*t); count++; }
7331 yield = string_catn(yield, sub, count);
7338 uschar *t = sub - 1;
7339 while (*(++t) != 0) { *t = toupper(*t); count++; }
7340 yield = string_catn(yield, sub, count);
7346 if (vp && *(void **)vp->value)
7348 uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
7349 yield = string_cat(yield, cp);
7357 md5_end(&base, sub, Ustrlen(sub), digest);
7358 for (int j = 0; j < 16; j++)
7359 yield = string_fmt_append(yield, "%02x", digest[j]);
7365 if (vp && *(void **)vp->value)
7367 uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
7368 yield = string_cat(yield, cp);
7376 sha1_end(&h, sub, Ustrlen(sub), digest);
7377 for (int j = 0; j < 20; j++)
7378 yield = string_fmt_append(yield, "%02X", digest[j]);
7384 #ifdef EXIM_HAVE_SHA2
7385 if (vp && *(void **)vp->value)
7386 if (c == EOP_SHA256)
7387 yield = string_cat(yield, tls_cert_fprt_sha256(*(void **)vp->value));
7389 expand_string_message = US"sha2_N not supported with certificates";
7394 hashmethod m = !arg ? HASH_SHA2_256
7395 : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
7396 : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
7397 : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
7400 if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
7402 expand_string_message = US"unrecognised sha2 variant";
7406 exim_sha_update_string(&h, sub);
7407 exim_sha_finish(&h, &b);
7409 yield = string_fmt_append(yield, "%02X", *b.data++);
7412 expand_string_message = US"sha256 only supported with TLS";
7417 #ifdef EXIM_HAVE_SHA3
7421 hashmethod m = !arg ? HASH_SHA3_256
7422 : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224
7423 : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256
7424 : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384
7425 : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512
7428 if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
7430 expand_string_message = US"unrecognised sha3 variant";
7434 exim_sha_update_string(&h, sub);
7435 exim_sha_finish(&h, &b);
7437 yield = string_fmt_append(yield, "%02X", *b.data++);
7441 expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 + or OpenSSL 1.1.1 +";
7445 /* Line-wrap a string as if it is a header line */
7447 case EOP_HEADERWRAP:
7449 unsigned col = 80, lim = 998;
7454 const uschar * list = arg;
7456 if ((s = string_nextinlist(&list, &sep, NULL, 0)))
7459 if ((s = string_nextinlist(&list, &sep, NULL, 0)))
7463 if ((s = wrap_header(sub, col, lim, US"\t", 8)))
7464 yield = string_cat(yield, s);
7468 /* Convert hex encoding to base64 encoding */
7478 for (enc = sub; *enc; enc++)
7480 if (!isxdigit(*enc))
7482 expand_string_message = string_sprintf("\"%s\" is not a hex "
7491 expand_string_message = string_sprintf("\"%s\" contains an odd "
7492 "number of characters", sub);
7496 while ((c = *in++) != 0)
7498 if (isdigit(c)) c -= '0';
7499 else c = toupper(c) - 'A' + 10;
7509 enc = b64encode(CUS sub, out - sub);
7510 yield = string_cat(yield, enc);
7514 /* Convert octets outside 0x21..0x7E to \xXX form */
7518 uschar *t = sub - 1;
7521 if (*t < 0x21 || 0x7E < *t)
7522 yield = string_fmt_append(yield, "\\x%02x", *t);
7524 yield = string_catn(yield, t, 1);
7529 /* count the number of list elements */
7533 int cnt = 0, sep = 0;
7534 uschar * buf = store_get(2, sub);
7536 while (string_nextinlist(CUSS &sub, &sep, buf, 1)) cnt++;
7537 yield = string_fmt_append(yield, "%d", cnt);
7541 /* expand a named list given the name */
7542 /* handles nested named lists; requotes as colon-sep list */
7545 expand_string_message = NULL;
7546 yield = expand_listnamed(yield, sub, arg);
7547 if (expand_string_message)
7551 /* quote a list-item for the given list-separator */
7553 /* mask applies a mask to an IP address; for example the result of
7554 ${mask:131.111.10.206/28} is 131.111.10.192/28. */
7561 int type, mask, maskoffset;
7565 if ((type = string_is_ip_address(sub, &maskoffset)) == 0)
7567 expand_string_message = string_sprintf("\"%s\" is not an IP address",
7572 if (maskoffset == 0)
7574 expand_string_message = string_sprintf("missing mask value in \"%s\"",
7579 mask = Ustrtol(sub + maskoffset + 1, &endptr, 10);
7581 if (*endptr || mask < 0 || mask > (type == 4 ? 32 : 128))
7583 expand_string_message = string_sprintf("mask value too big in \"%s\"",
7588 /* If an optional 'n' was given, ipv6 gets normalised output:
7589 colons rather than dots, and zero-compressed. */
7591 normalised = arg && *arg == 'n';
7593 /* Convert the address to binary integer(s) and apply the mask */
7595 sub[maskoffset] = 0;
7596 count = host_aton(sub, binary);
7597 host_mask(count, binary, mask);
7599 /* Convert to masked textual format and add to output. */
7601 if (type == 4 || !normalised)
7602 yield = string_catn(yield, buffer,
7603 host_nmtoa(count, binary, mask, buffer, '.'));
7606 ipv6_nmtoa(binary, buffer);
7607 yield = string_fmt_append(yield, "%s/%d", buffer, mask);
7613 case EOP_IPV6DENORM:
7615 int type = string_is_ip_address(sub, NULL);
7622 (void) host_aton(sub, binary);
7625 case 4: /* convert to IPv4-mapped IPv6 */
7626 binary[0] = binary[1] = 0;
7627 binary[2] = 0x0000ffff;
7628 (void) host_aton(sub, binary+3);
7632 expand_string_message =
7633 string_sprintf("\"%s\" is not an IP address", sub);
7637 yield = string_catn(yield, buffer, c == EOP_IPV6NORM
7638 ? ipv6_nmtoa(binary, buffer)
7639 : host_nmtoa(4, binary, -1, buffer, ':')
7645 case EOP_LOCAL_PART:
7649 int start, end, domain;
7650 uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
7653 if (c != EOP_DOMAIN)
7654 yield = c == EOP_LOCAL_PART && domain > 0
7655 ? string_catn(yield, t, domain - 1)
7656 : string_cat(yield, t);
7657 else if (domain > 0)
7658 yield = string_cat(yield, t + domain);
7664 uschar outsep[2] = { ':', '\0' };
7665 uschar *address, *error;
7666 int save_ptr = gstring_length(yield);
7667 int start, end, domain; /* Not really used */
7669 if (Uskip_whitespace(&sub) == '>')
7670 if (*outsep = *++sub) ++sub;
7673 expand_string_message = string_sprintf("output separator "
7674 "missing in expanding ${addresses:%s}", --sub);
7677 f.parse_allow_group = TRUE;
7681 uschar * p = parse_find_address_end(sub, FALSE);
7682 uschar saveend = *p;
7684 address = parse_extract_address(sub, &error, &start, &end, &domain,
7688 /* Add the address to the output list that we are building. This is
7689 done in chunks by searching for the separator character. At the
7690 start, unless we are dealing with the first address of the output
7691 list, add in a space if the new address begins with the separator
7692 character, or is an empty string. */
7696 if (yield && yield->ptr != save_ptr && address[0] == *outsep)
7697 yield = string_catn(yield, US" ", 1);
7701 size_t seglen = Ustrcspn(address, outsep);
7702 yield = string_catn(yield, address, seglen + 1);
7704 /* If we got to the end of the string we output one character
7707 if (address[seglen] == '\0') { yield->ptr--; break; }
7708 yield = string_catn(yield, outsep, 1);
7709 address += seglen + 1;
7712 /* Output a separator after the string: we will remove the
7713 redundant final one at the end. */
7715 yield = string_catn(yield, outsep, 1);
7718 if (saveend == '\0') break;
7722 /* If we have generated anything, remove the redundant final
7725 if (yield && yield->ptr != save_ptr) yield->ptr--;
7726 f.parse_allow_group = FALSE;
7731 /* quote puts a string in quotes if it is empty or contains anything
7732 other than alphamerics, underscore, dot, or hyphen.
7734 quote_local_part puts a string in quotes if RFC 2821/2822 requires it to
7735 be quoted in order to be a valid local part.
7737 In both cases, newlines and carriage returns are converted into \n and \r
7741 case EOP_QUOTE_LOCAL_PART:
7744 BOOL needs_quote = (!*sub); /* TRUE for empty string */
7745 uschar *t = sub - 1;
7748 while (!needs_quote && *++t)
7749 needs_quote = !isalnum(*t) && !strchr("_-.", *t);
7751 else /* EOP_QUOTE_LOCAL_PART */
7752 while (!needs_quote && *++t)
7753 needs_quote = !isalnum(*t)
7754 && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL
7755 && (*t != '.' || t == sub || !t[1]);
7759 yield = string_catn(yield, US"\"", 1);
7763 yield = string_catn(yield, US"\\n", 2);
7764 else if (*t == '\r')
7765 yield = string_catn(yield, US"\\r", 2);
7768 if (*t == '\\' || *t == '"')
7769 yield = string_catn(yield, US"\\", 1);
7770 yield = string_catn(yield, t, 1);
7772 yield = string_catn(yield, US"\"", 1);
7775 yield = string_cat(yield, sub);
7779 /* quote_lookuptype does lookup-specific quoting */
7784 uschar * opt = Ustrchr(arg, '_');
7786 if (opt) *opt++ = 0;
7788 if ((n = search_findtype(arg, Ustrlen(arg))) < 0)
7790 expand_string_message = search_error_message;
7794 if (lookup_list[n]->quote)
7795 sub = (lookup_list[n]->quote)(sub, opt, (unsigned)n);
7801 expand_string_message = string_sprintf(
7802 "\"%s\" unrecognized after \"${quote_%s\"", /*}*/
7807 yield = string_cat(yield, sub);
7811 /* rx quote sticks in \ before any non-alphameric character so that
7812 the insertion works in a regular expression. */
7816 uschar *t = sub - 1;
7820 yield = string_catn(yield, US"\\", 1);
7821 yield = string_catn(yield, t, 1);
7826 /* RFC 2047 encodes, assuming headers_charset (default ISO 8859-1) as
7827 prescribed by the RFC, if there are characters that need to be encoded */
7830 yield = string_cat(yield,
7831 parse_quote_2047(sub, Ustrlen(sub), headers_charset,
7835 /* RFC 2047 decode */
7841 uschar *decoded = rfc2047_decode(sub, check_rfc2047_length,
7842 headers_charset, '?', &len, &error);
7845 expand_string_message = error;
7848 yield = string_catn(yield, decoded, len);
7852 /* from_utf8 converts UTF-8 to 8859-1, turning non-existent chars into
7857 uschar * buff = store_get(4, sub);
7862 if (c > 255) c = '_';
7864 yield = string_catn(yield, buff, 1);
7869 /* replace illegal UTF-8 sequences by replacement character */
7871 #define UTF8_REPLACEMENT_CHAR US"?"
7875 int seq_len = 0, index = 0, bytes_left = 0, complete;
7876 u_long codepoint = (u_long)-1;
7877 uschar seq_buff[4]; /* accumulate utf-8 here */
7879 /* Manually track tainting, as we deal in individual chars below */
7882 yield = string_get_tainted(Ustrlen(sub), sub);
7883 else if (!yield->s || !yield->ptr)
7885 yield->s = store_get(yield->size = Ustrlen(sub), sub);
7886 gstring_reset(yield);
7888 else if (is_incompatible(yield->s, sub))
7889 gstring_rebuffer(yield, sub);
7891 /* Check the UTF-8, byte-by-byte */
7900 if ((c & 0xc0) != 0x80)
7901 /* wrong continuation byte; invalidate all bytes */
7902 complete = 1; /* error */
7905 codepoint = (codepoint << 6) | (c & 0x3f);
7906 seq_buff[index++] = c;
7907 if (--bytes_left == 0) /* codepoint complete */
7908 if(codepoint > 0x10FFFF) /* is it too large? */
7909 complete = -1; /* error (RFC3629 limit) */
7910 else if ( (codepoint & 0x1FF800 ) == 0xD800 ) /* surrogate */
7911 /* A UTF-16 surrogate (which should be one of a pair that
7912 encode a Unicode codepoint that is outside the Basic
7913 Multilingual Plane). Error, not UTF8.
7914 RFC2279.2 is slightly unclear on this, but
7915 https://unicodebook.readthedocs.io/issues.html#strict-utf8-decoder
7916 says "Surrogates characters are also invalid in UTF-8:
7917 characters in U+D800—U+DFFF have to be rejected." */
7920 { /* finished; output utf-8 sequence */
7921 yield = string_catn(yield, seq_buff, seq_len);
7926 else /* no bytes left: new sequence */
7928 if (!(c & 0x80)) /* 1-byte sequence, US-ASCII, keep it */
7930 yield = string_catn(yield, &c, 1);
7933 if ((c & 0xe0) == 0xc0) /* 2-byte sequence */
7934 if (c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */
7939 codepoint = c & 0x1f;
7941 else if ((c & 0xf0) == 0xe0) /* 3-byte sequence */
7944 codepoint = c & 0x0f;
7946 else if ((c & 0xf8) == 0xf0) /* 4-byte sequence */
7949 codepoint = c & 0x07;
7951 else /* invalid or too long (RFC3629 allows only 4 bytes) */
7954 seq_buff[index++] = c;
7955 seq_len = bytes_left + 1;
7956 } /* if(bytes_left) */
7960 bytes_left = index = 0;
7961 yield = string_catn(yield, UTF8_REPLACEMENT_CHAR, 1);
7963 if ((complete == 1) && ((c & 0x80) == 0))
7964 /* ASCII character follows incomplete sequence */
7965 yield = string_catn(yield, &c, 1);
7967 /* If given a sequence truncated mid-character, we also want to report ?
7968 Eg, ${length_1:フィル} is one byte, not one character, so we expect
7969 ${utf8clean:${length_1:フィル}} to yield '?' */
7971 if (bytes_left != 0)
7972 yield = string_catn(yield, UTF8_REPLACEMENT_CHAR, 1);
7978 case EOP_UTF8_DOMAIN_TO_ALABEL:
7980 uschar * error = NULL;
7981 uschar * s = string_domain_utf8_to_alabel(sub, &error);
7984 expand_string_message = string_sprintf(
7985 "error converting utf8 (%s) to alabel: %s",
7986 string_printing(sub), error);
7989 yield = string_cat(yield, s);
7993 case EOP_UTF8_DOMAIN_FROM_ALABEL:
7995 uschar * error = NULL;
7996 uschar * s = string_domain_alabel_to_utf8(sub, &error);
7999 expand_string_message = string_sprintf(
8000 "error converting alabel (%s) to utf8: %s",
8001 string_printing(sub), error);
8004 yield = string_cat(yield, s);
8008 case EOP_UTF8_LOCALPART_TO_ALABEL:
8010 uschar * error = NULL;
8011 uschar * s = string_localpart_utf8_to_alabel(sub, &error);
8014 expand_string_message = string_sprintf(
8015 "error converting utf8 (%s) to alabel: %s",
8016 string_printing(sub), error);
8019 yield = string_cat(yield, s);
8020 DEBUG(D_expand) debug_printf_indent("yield: '%Y'\n", yield);
8024 case EOP_UTF8_LOCALPART_FROM_ALABEL:
8026 uschar * error = NULL;
8027 uschar * s = string_localpart_alabel_to_utf8(sub, &error);
8030 expand_string_message = string_sprintf(
8031 "error converting alabel (%s) to utf8: %s",
8032 string_printing(sub), error);
8035 yield = string_cat(yield, s);
8038 #endif /* EXPERIMENTAL_INTERNATIONAL */
8040 /* escape turns all non-printing characters into escape sequences. */
8044 const uschar * t = string_printing(sub);
8045 yield = string_cat(yield, t);
8049 case EOP_ESCAPE8BIT:
8053 for (const uschar * s = sub; (c = *s); s++)
8054 yield = c < 127 && c != '\\'
8055 ? string_catn(yield, s, 1)
8056 : string_fmt_append(yield, "\\%03o", c);
8060 /* Handle numeric expression evaluation */
8065 uschar *save_sub = sub;
8066 uschar *error = NULL;
8067 int_eximarith_t n = eval_expr(&sub, (c == EOP_EVAL10), &error, FALSE);
8070 expand_string_message = string_sprintf("error in expression "
8071 "evaluation: %s (after processing \"%.*s\")", error,
8072 (int)(sub-save_sub), save_sub);
8075 yield = string_fmt_append(yield, PR_EXIM_ARITH, n);
8079 /* Handle time period formatting */
8083 int n = readconf_readtime(sub, 0, FALSE);
8086 expand_string_message = string_sprintf("string \"%s\" is not an "
8087 "Exim time interval in \"%s\" operator", sub, name);
8090 yield = string_fmt_append(yield, "%d", n);
8094 case EOP_TIME_INTERVAL:
8097 uschar *t = read_number(&n, sub);
8098 if (*t != 0) /* Not A Number*/
8100 expand_string_message = string_sprintf("string \"%s\" is not a "
8101 "positive number in \"%s\" operator", sub, name);
8104 t = readconf_printtime(n);
8105 yield = string_cat(yield, t);
8109 /* Convert string to base64 encoding */
8115 uschar * s = vp && *(void **)vp->value
8116 ? tls_cert_der_b64(*(void **)vp->value)
8117 : b64encode(CUS sub, Ustrlen(sub));
8119 uschar * s = b64encode(CUS sub, Ustrlen(sub));
8121 yield = string_cat(yield, s);
8128 int len = b64decode(sub, &s, sub);
8131 expand_string_message = string_sprintf("string \"%s\" is not "
8132 "well-formed for \"%s\" operator", sub, name);
8135 yield = string_cat(yield, s);
8139 /* strlen returns the length of the string */
8142 yield = string_fmt_append(yield, "%d", Ustrlen(sub));
8145 /* length_n or l_n takes just the first n characters or the whole string,
8146 whichever is the shorter;
8148 substr_m_n, and s_m_n take n characters from offset m; negative m take
8149 from the end; l_n is synonymous with s_0_n. If n is omitted in substr it
8150 takes the rest, either to the right or to the left.
8152 hash_n or h_n makes a hash of length n from the string, yielding n
8153 characters from the set a-z; hash_n_m makes a hash of length n, but
8154 uses m characters from the set a-zA-Z0-9.
8156 nhash_n returns a single number between 0 and n-1 (in text form), while
8157 nhash_n_m returns a div/mod hash as two numbers "a/b". The first lies
8158 between 0 and n-1 and the second between 0 and m-1. */
8178 expand_string_message = string_sprintf("missing values after %s",
8183 /* "length" has only one argument, effectively being synonymous with
8186 if (c == EOP_LENGTH || c == EOP_L)
8192 /* The others have one or two arguments; for "substr" the first may be
8193 negative. The second being negative means "not supplied". */
8198 if (name[0] == 's' && *arg == '-') { sign = -1; arg++; }
8201 /* Read up to two numbers, separated by underscores */
8206 if (arg != ret && *arg == '_' && pn == &value1)
8210 if (arg[1] != 0) arg++;
8212 else if (!isdigit(*arg))
8214 expand_string_message =
8215 string_sprintf("non-digit after underscore in \"%s\"", name);
8218 else *pn = (*pn)*10 + *arg++ - '0';
8222 /* Perform the required operation */
8224 ret = c == EOP_HASH || c == EOP_H
8225 ? compute_hash(sub, value1, value2, &len)
8226 : c == EOP_NHASH || c == EOP_NH
8227 ? compute_nhash(sub, value1, value2, &len)
8228 : extract_substr(sub, value1, value2, &len);
8229 if (!ret) goto EXPAND_FAILED;
8231 yield = string_catn(yield, ret, len);
8240 uschar **modetable[3];
8244 if (expand_forbid & RDO_EXISTS)
8246 expand_string_message = US"Use of the stat() expansion is not permitted";
8250 if (stat(CS sub, &st) < 0)
8252 expand_string_message = string_sprintf("stat(%s) failed: %s",
8253 sub, strerror(errno));
8257 switch (mode & S_IFMT)
8259 case S_IFIFO: smode[0] = 'p'; break;
8260 case S_IFCHR: smode[0] = 'c'; break;
8261 case S_IFDIR: smode[0] = 'd'; break;
8262 case S_IFBLK: smode[0] = 'b'; break;
8263 case S_IFREG: smode[0] = '-'; break;
8264 default: smode[0] = '?'; break;
8267 modetable[0] = ((mode & 01000) == 0)? mtable_normal : mtable_sticky;
8268 modetable[1] = ((mode & 02000) == 0)? mtable_normal : mtable_setid;
8269 modetable[2] = ((mode & 04000) == 0)? mtable_normal : mtable_setid;
8271 for (int i = 0; i < 3; i++)
8273 memcpy(CS(smode + 7 - i*3), CS(modetable[i][mode & 7]), 3);
8278 yield = string_fmt_append(yield,
8279 "mode=%04lo smode=%s inode=%ld device=%ld links=%ld "
8280 "uid=%ld gid=%ld size=" OFF_T_FMT " atime=%ld mtime=%ld ctime=%ld",
8281 (long)(st.st_mode & 077777), smode, (long)st.st_ino,
8282 (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
8283 (long)st.st_gid, st.st_size, (long)st.st_atime,
8284 (long)st.st_mtime, (long)st.st_ctime);
8288 /* vaguely random number less than N */
8292 int_eximarith_t max = expanded_string_integer(sub, TRUE);
8294 if (expand_string_message)
8296 yield = string_fmt_append(yield, "%d", vaguely_random_number((int)max));
8300 /* Reverse IP, including IPv6 to dotted-nibble */
8302 case EOP_REVERSE_IP:
8304 int family, maskptr;
8305 uschar reversed[128];
8307 family = string_is_ip_address(sub, &maskptr);
8310 expand_string_message = string_sprintf(
8311 "reverse_ip() not given an IP address [%s]", sub);
8314 invert_address(reversed, sub);
8315 yield = string_cat(yield, reversed);
8319 /* Unknown operator */
8322 expand_string_message =
8323 string_sprintf("unknown expansion operator \"%s\"", name);
8325 } /* EOP_* switch */
8329 const uschar * res = string_from_gstring(yield);
8330 const uschar * s = res + expansion_start;
8331 int i = gstring_length(yield) - expansion_start;
8332 BOOL tainted = is_tainted(s);
8334 debug_printf_indent("%Vop-res: %.*s\n", "K-----", i, s);
8337 debug_printf_indent("%V %V",
8338 flags & ESI_SKIPPING ? "|" : " ",
8340 debug_print_taint(res);
8347 /* Not an item or an operator */
8348 /* Handle a plain name. If this is the first thing in the expansion, release
8349 the pre-allocated buffer. If the result data is known to be in a new buffer,
8350 newsize will be set to the size of that buffer, and we can just point at that
8351 store instead of copying. Many expansion strings contain just one reference,
8352 so this is a useful optimization, especially for humungous headers
8353 ($message_headers). */
8357 const uschar * value;
8363 g = store_get(sizeof(gstring), GET_UNTAINTED);
8364 else if (yield->ptr == 0)
8366 if (resetok) reset_point = store_reset(reset_point);
8368 reset_point = store_mark();
8369 g = store_get(sizeof(gstring), GET_UNTAINTED); /* alloc _before_ calling find_variable() */
8371 if (!(value = find_variable(name, FALSE, !!(flags & ESI_SKIPPING), &newsize)))
8373 expand_string_message =
8374 string_sprintf("unknown variable in \"${%s}\"", name);
8375 check_variable_error_message(name);
8378 len = Ustrlen(value);
8379 if (!yield && newsize)
8382 yield->size = newsize;
8384 yield->s = US value; /* known to be in new store i.e. a copy, so deconst safe */
8387 yield = string_catn(yield, value, len);
8391 /* Else there's something wrong */
8393 expand_string_message =
8394 string_sprintf("\"${%s\" is not a known operator (or a } is missing "
8395 "in a variable reference)", name);
8399 /* If we hit the end of the string when brace_ends is set, there is a missing
8400 terminating brace. */
8402 if (flags & ESI_BRACE_ENDS && !*s)
8404 expand_string_message = malformed_header
8405 ? US"missing } at end of string - could be header name not terminated by colon"
8406 : US"missing } at end of string";
8410 /* Expansion succeeded; yield may still be NULL here if nothing was actually
8411 added to the string. If so, set up an empty string. Add a terminating zero. If
8412 left != NULL, return a pointer to the terminator. */
8418 yield = string_get(1);
8419 res = string_from_gstring(yield);
8420 if (left) *left = s;
8422 /* Any stacking store that was used above the final string is no longer needed.
8423 In many cases the final string will be the first one that was got and so there
8424 will be optimal store usage. */
8426 if (resetok) gstring_release_unused(yield);
8427 else if (resetok_p) *resetok_p = FALSE;
8431 BOOL tainted = is_tainted(res);
8432 debug_printf_indent("%Vexpanded: %.*W\n",
8434 (int)(s - string), string);
8435 debug_printf_indent("%Vresult: ",
8436 flags & ESI_SKIPPING ? "K-----" : "\\_____");
8437 if (*res || !(flags & ESI_SKIPPING))
8438 debug_printf("%W\n", res);
8440 debug_printf(" %Vskipped%V\n", "<", ">");
8443 debug_printf_indent("%V %V",
8444 flags & ESI_SKIPPING ? "|" : " ",
8447 debug_print_taint(res);
8449 if (flags & ESI_SKIPPING)
8450 debug_printf_indent("%Vskipping: result is not used\n", "\\___");
8452 if (textonly_p) *textonly_p = textonly;
8457 /* This is the failure exit: easiest to program with a goto. We still need
8458 to update the pointer to the terminator, for cases of nested calls with "fail".
8461 EXPAND_FAILED_CURLY:
8462 if (malformed_header)
8463 expand_string_message =
8464 US"missing or misplaced { or } - could be header name not terminated by colon";
8466 else if (!expand_string_message || !*expand_string_message)
8467 expand_string_message = US"missing or misplaced { or }";
8469 /* At one point, Exim reset the store to yield (if yield was not NULL), but
8470 that is a bad idea, because expand_string_message is in dynamic store. */
8473 if (left) *left = s;
8476 debug_printf_indent("%Vfailed to expand: %s\n", "K", string);
8477 debug_printf_indent("%Verror message: %s\n",
8478 f.expand_string_forcedfail ? "K---" : "\\___", expand_string_message);
8479 if (f.expand_string_forcedfail)
8480 debug_printf_indent("%Vfailure was forced\n", "\\");
8482 if (resetok_p && !resetok) *resetok_p = FALSE;
8489 /* This is the external function call. Do a quick check for any expansion
8490 metacharacters, and if there are none, just return the input string.
8493 the string to be expanded
8494 optional pointer for return boolean indicating no-dynamic-expansions
8496 Returns: the expanded string, or NULL if expansion failed; if failure was
8497 due to a lookup deferring, search_find_defer will be TRUE
8501 expand_string_2(const uschar * string, BOOL * textonly_p)
8503 f.expand_string_forcedfail = f.search_find_defer = malformed_header = FALSE;
8504 if (Ustrpbrk(string, "$\\") != NULL)
8506 int old_pool = store_pool;
8509 store_pool = POOL_MAIN;
8510 s = expand_string_internal(string, ESI_HONOR_DOLLAR, NULL, NULL, textonly_p);
8511 store_pool = old_pool;
8514 if (textonly_p) *textonly_p = TRUE;
8519 expand_cstring(const uschar * string)
8520 { return expand_string_2(string, NULL); }
8523 expand_string(uschar * string)
8524 { return US expand_string_2(CUS string, NULL); }
8531 /*************************************************
8533 *************************************************/
8535 /* Now and again we want to expand a string and be sure that the result is in a
8536 new bit of store. This function does that.
8537 Since we know it has been copied, the de-const cast is safe.
8539 Argument: the string to be expanded
8540 Returns: the expanded string, always in a new bit of store, or NULL
8544 expand_string_copy(const uschar *string)
8546 const uschar *yield = expand_cstring(string);
8547 if (yield == string) yield = string_copy(string);
8553 /*************************************************
8554 * Expand and interpret as an integer *
8555 *************************************************/
8557 /* Expand a string, and convert the result into an integer.
8560 string the string to be expanded
8561 isplus TRUE if a non-negative number is expected
8563 Returns: the integer value, or
8564 -1 for an expansion error ) in both cases, message in
8565 -2 for an integer interpretation error ) expand_string_message
8566 expand_string_message is set NULL for an OK integer
8570 expand_string_integer(uschar *string, BOOL isplus)
8572 return expanded_string_integer(expand_string(string), isplus);
8576 /*************************************************
8577 * Interpret string as an integer *
8578 *************************************************/
8580 /* Convert a string (that has already been expanded) into an integer.
8582 This function is used inside the expansion code.
8585 s the string to be expanded
8586 isplus TRUE if a non-negative number is expected
8588 Returns: the integer value, or
8589 -1 if string is NULL (which implies an expansion error)
8590 -2 for an integer interpretation error
8591 expand_string_message is set NULL for an OK integer
8594 static int_eximarith_t
8595 expanded_string_integer(const uschar *s, BOOL isplus)
8597 int_eximarith_t value;
8598 uschar *msg = US"invalid integer \"%s\"";
8601 /* If expansion failed, expand_string_message will be set. */
8605 /* On an overflow, strtol() returns LONG_MAX or LONG_MIN, and sets errno
8606 to ERANGE. When there isn't an overflow, errno is not changed, at least on some
8607 systems, so we set it zero ourselves. */
8610 expand_string_message = NULL; /* Indicates no error */
8612 /* Before Exim 4.64, strings consisting entirely of whitespace compared
8613 equal to 0. Unfortunately, people actually relied upon that, so preserve
8614 the behaviour explicitly. Stripping leading whitespace is a harmless
8615 noop change since strtol skips it anyway (provided that there is a number
8618 if (Uskip_whitespace(&s) == '\0')
8621 debug_printf_indent("treating blank string as number 0\n");
8625 value = strtoll(CS s, CSS &endptr, 10);
8628 msg = US"integer expected but \"%s\" found";
8629 else if (value < 0 && isplus)
8630 msg = US"non-negative integer expected but \"%s\" found";
8633 switch (tolower(*endptr))
8638 if (value > EXIM_ARITH_MAX/1024 || value < EXIM_ARITH_MIN/1024) errno = ERANGE;
8643 if (value > EXIM_ARITH_MAX/(1024*1024) || value < EXIM_ARITH_MIN/(1024*1024)) errno = ERANGE;
8644 else value *= 1024*1024;
8648 if (value > EXIM_ARITH_MAX/(1024*1024*1024) || value < EXIM_ARITH_MIN/(1024*1024*1024)) errno = ERANGE;
8649 else value *= 1024*1024*1024;
8653 if (errno == ERANGE)
8654 msg = US"absolute value of integer \"%s\" is too large (overflow)";
8656 if (Uskip_whitespace(&endptr) == 0) return value;
8659 expand_string_message = string_sprintf(CS msg, s);
8664 /* These values are usually fixed boolean values, but they are permitted to be
8668 addr address being routed
8669 mtype the module type
8670 mname the module name
8671 dbg_opt debug selectors
8672 oname the option name
8673 bvalue the router's boolean value
8674 svalue the router's string value
8675 rvalue where to put the returned value
8677 Returns: OK value placed in rvalue
8678 DEFER expansion failed
8682 exp_bool(address_item * addr,
8683 uschar * mtype, uschar * mname, unsigned dbg_opt,
8684 uschar * oname, BOOL bvalue,
8685 uschar * svalue, BOOL * rvalue)
8689 DEBUG(D_expand) debug_printf("try option %s\n", oname);
8690 if (!svalue) { *rvalue = bvalue; return OK; }
8692 if (!(expanded = expand_string(svalue)))
8694 if (f.expand_string_forcedfail)
8696 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" forced failure\n", oname);
8700 addr->message = string_sprintf("failed to expand \"%s\" in %s %s: %s",
8701 oname, mname, mtype, expand_string_message);
8702 DEBUG(dbg_opt) debug_printf("%s\n", addr->message);
8706 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" yields \"%s\"\n", oname,
8709 if (strcmpic(expanded, US"true") == 0 || strcmpic(expanded, US"yes") == 0)
8711 else if (strcmpic(expanded, US"false") == 0 || strcmpic(expanded, US"no") == 0)
8715 addr->message = string_sprintf("\"%s\" is not a valid value for the "
8716 "\"%s\" option in the %s %s", expanded, oname, mname, mtype);
8725 /* Avoid potentially exposing a password in a string about to be logged */
8728 expand_hide_passwords(uschar * s)
8730 return ( ( Ustrstr(s, "failed to expand") != NULL
8731 || Ustrstr(s, "expansion of ") != NULL
8733 && ( Ustrstr(s, "mysql") != NULL
8734 || Ustrstr(s, "pgsql") != NULL
8735 || Ustrstr(s, "redis") != NULL
8736 || Ustrstr(s, "sqlite") != NULL
8737 || Ustrstr(s, "ldap:") != NULL
8738 || Ustrstr(s, "ldaps:") != NULL
8739 || Ustrstr(s, "ldapi:") != NULL
8740 || Ustrstr(s, "ldapdn:") != NULL
8741 || Ustrstr(s, "ldapm:") != NULL
8743 ? US"Temporary internal error" : s;
8747 /* Read given named file into big_buffer. Use for keying material etc.
8748 The content will have an ascii NUL appended.
8753 Return: pointer to buffer, or NULL on error.
8757 expand_file_big_buffer(const uschar * filename)
8759 int fd, off = 0, len;
8761 if ((fd = exim_open2(CS filename, O_RDONLY)) < 0)
8763 log_write(0, LOG_MAIN | LOG_PANIC, "unable to open file for reading: %s",
8770 if ((len = read(fd, big_buffer + off, big_buffer_size - 2 - off)) < 0)
8773 log_write(0, LOG_MAIN|LOG_PANIC, "unable to read file: %s", filename);
8781 big_buffer[off] = '\0';
8787 /*************************************************
8788 * Error-checking for testsuite *
8789 *************************************************/
8791 uschar * region_start;
8792 uschar * region_end;
8793 const uschar *var_name;
8794 const uschar *var_data;
8797 /* Called via tree_walk, which allows nonconst name/data. Our usage is const. */
8799 assert_variable_notin(uschar * var_name, uschar * var_data, void * ctx)
8802 if (var_data >= e->region_start && var_data < e->region_end)
8804 e->var_name = CUS var_name;
8805 e->var_data = CUS var_data;
8810 assert_no_variables(void * ptr, int len, const char * filename, int linenumber)
8812 err_ctx e = { .region_start = ptr, .region_end = US ptr + len,
8813 .var_name = NULL, .var_data = NULL };
8815 /* check acl_ variables */
8816 tree_walk(acl_var_c, assert_variable_notin, &e);
8817 tree_walk(acl_var_m, assert_variable_notin, &e);
8819 /* check auth<n> variables.
8820 assert_variable_notin() treats as const, so deconst is safe. */
8821 for (int i = 0; i < AUTH_VARS; i++) if (auth_vars[i])
8822 assert_variable_notin(US"auth<n>", US auth_vars[i], &e);
8824 #ifdef WITH_CONTENT_SCAN
8825 /* check regex<n> variables. assert_variable_notin() treats as const. */
8826 for (int i = 0; i < REGEX_VARS; i++) if (regex_vars[i])
8827 assert_variable_notin(US"regex<n>", US regex_vars[i], &e);
8830 /* check known-name variables */
8831 for (var_entry * v = var_table; v < var_table + nelem(var_table); v++)
8832 if (v->type == vtype_stringptr)
8833 assert_variable_notin(US v->name, *(USS v->value), &e);
8835 /* check dns and address trees */
8836 tree_walk(tree_dns_fails, assert_variable_notin, &e);
8837 tree_walk(tree_duplicates, assert_variable_notin, &e);
8838 tree_walk(tree_nonrecipients, assert_variable_notin, &e);
8839 tree_walk(tree_unusable, assert_variable_notin, &e);
8842 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
8843 "live variable '%s' destroyed by reset_store at %s:%d\n- value '%.64s'",
8844 e.var_name, filename, linenumber, e.var_data);
8849 /*************************************************
8850 **************************************************
8851 * Stand-alone test program *
8852 **************************************************
8853 *************************************************/
8859 regex_match_and_setup(const pcre2_code *re, uschar *subject, int options, int setup)
8861 int ovec[3*(EXPAND_MAXN+1)];
8862 int n = pcre_exec(re, NULL, subject, Ustrlen(subject), 0, PCRE_EOPT|options,
8864 BOOL yield = n >= 0;
8865 if (n == 0) n = EXPAND_MAXN + 1;
8868 expand_nmax = setup < 0 ? 0 : setup + 1;
8869 for (int nn = setup < 0 ? 0 : 2; nn < n*2; nn += 2)
8871 expand_nstring[expand_nmax] = subject + ovec[nn];
8872 expand_nlength[expand_nmax++] = ovec[nn+1] - ovec[nn];
8880 int main(int argc, uschar **argv)
8882 uschar buffer[1024];
8884 debug_selector = D_v;
8885 debug_file = stderr;
8886 debug_fd = fileno(debug_file);
8887 big_buffer = malloc(big_buffer_size);
8890 for (int i = 1; i < argc; i++)
8892 if (argv[i][0] == '+')
8894 debug_trace_memory = 2;
8897 if (isdigit(argv[i][0]))
8898 debug_selector = Ustrtol(argv[i], NULL, 0);
8900 if (Ustrspn(argv[i], "abcdefghijklmnopqrtsuvwxyz0123456789-.:/") ==
8904 eldap_default_servers = argv[i];
8907 mysql_servers = argv[i];
8910 pgsql_servers = argv[i];
8913 redis_servers = argv[i];
8917 else opt_perl_startup = argv[i];
8921 printf("Testing string expansion: debug_level = %d\n\n", debug_level);
8923 expand_nstring[1] = US"string 1....";
8924 expand_nlength[1] = 8;
8928 if (opt_perl_startup != NULL)
8931 printf("Starting Perl interpreter\n");
8932 errstr = init_perl(opt_perl_startup);
8935 printf("** error in perl_startup code: %s\n", errstr);
8936 return EXIT_FAILURE;
8939 #endif /* EXIM_PERL */
8941 /* Thie deliberately regards the input as untainted, so that it can be
8942 expanded; only reasonable since this is a test for string-expansions. */
8944 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
8946 rmark reset_point = store_mark();
8947 uschar *yield = expand_string(buffer);
8949 printf("%s\n", yield);
8952 if (f.search_find_defer) printf("search_find deferred\n");
8953 printf("Failed: %s\n", expand_string_message);
8954 if (f.expand_string_forcedfail) printf("Forced failure\n");
8957 store_reset(reset_point);
8965 #endif /*STAND_ALONE*/
8967 #endif /*!MACRO_PREDEF*/
8970 /* End of expand.c */