ARC: add guard in verify against lack of the dkim-verify context

[exim.git] / src / src / match.c

diff --git a/src/src/match.c b/src/src/match.c
index 18787e8acd63c95fcbe060c2bd0c31a114ba9b21..3539aaab20b2d0e3f822ef501aba4f24458c8110 100644 (file)
--- a/src/src/match.c
+++ b/src/src/match.c
@@ -1,10 +1,8 @@
-/* $Cambridge: exim/src/src/match.c,v 1.9 2005/09/12 13:39:31 ph10 Exp $ */
-

 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 
 /*************************************************
 *     Exim - an Internet mail transport agent    *
 *************************************************/
 

-/* Copyright (c) University of Cambridge 1995 - 2005 */
+/* Copyright (c) University of Cambridge 1995 - 2018 */

 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for matching strings */
 /* See the file NOTICE for conditions of use and distribution. */
 
 /* Functions for matching strings */


@@ -17,8 +15,8 @@
 strings, domains, and local parts. */
 
 typedef struct check_string_block {
 strings, domains, and local parts. */
 
 typedef struct check_string_block {

-  uschar *origsubject;               /* caseful; keep these two first, in */
-  uschar *subject;                   /* step with the block below */
+  const uschar *origsubject;           /* caseful; keep these two first, in */
+  const uschar *subject;               /* step with the block below */

   int    expand_setup;
   BOOL   use_partial;
   BOOL   caseless;
   int    expand_setup;
   BOOL   use_partial;
   BOOL   caseless;


@@ -30,7 +28,7 @@ typedef struct check_string_block {
 addresses. */
 
 typedef struct check_address_block {
 addresses. */
 
 typedef struct check_address_block {

-  uschar *origaddress;               /* caseful; keep these two first, in */
+  const uschar *origaddress;         /* caseful; keep these two first, in */

   uschar *address;                   /* step with the block above */
   int    expand_setup;
   BOOL   caseless;
   uschar *address;                   /* step with the block above */
   int    expand_setup;
   BOOL   caseless;


@@ -74,7 +72,8 @@ Arguments:
                    returns ERROR)
 
 Contents of the argument block:
                    returns ERROR)
 
 Contents of the argument block:

-  subject        the subject string to be checked
+  origsubject    the subject in its original casing
+  subject        the subject string to be checked, lowercased if caseless

   expand_setup   if < 0, don't set up any numeric expansion variables;
                  if = 0, set $0 to whole subject, and either
                    $1 to what matches * or
   expand_setup   if < 0, don't set up any numeric expansion variables;
                  if = 0, set $0 to whole subject, and either
                    $1 to what matches * or


@@ -93,13 +92,13 @@ Returns:       OK    if matched
 */
 
 static int
 */
 
 static int

-check_string(void *arg, uschar *pattern, uschar **valueptr, uschar **error)
+check_string(void *arg, const uschar *pattern, const uschar **valueptr, uschar **error)

 {
 {

-check_string_block *cb = (check_string_block *)arg;
+const check_string_block *cb = arg;

 int search_type, partial, affixlen, starflags;
 int expand_setup = cb->expand_setup;
 int search_type, partial, affixlen, starflags;
 int expand_setup = cb->expand_setup;

-uschar *affix;
-uschar *s = cb->subject;
+const uschar *affix;
+uschar *s;

 uschar *filename = NULL;
 uschar *keyquery, *result, *semicolon;
 void *handle;
 uschar *filename = NULL;
 uschar *keyquery, *result, *semicolon;
 void *handle;


@@ -108,6 +107,12 @@ error = error;  /* Keep clever compilers from complaining */
 
 if (valueptr != NULL) *valueptr = NULL;  /* For non-lookup matches */
 
 
 if (valueptr != NULL) *valueptr = NULL;  /* For non-lookup matches */
 

+/* For regular expressions, use cb->origsubject rather than cb->subject so that
+it works if the pattern uses (?-i) to turn off case-independence, overriding
+"caseless". */
+
+s = string_copy(pattern[0] == '^' ? cb->origsubject : cb->subject);
+

 /* If required to set up $0, initialize the data but don't turn on by setting
 expand_nmax until the match is assured. */
 
 /* If required to set up $0, initialize the data but don't turn on by setting
 expand_nmax until the match is assured. */
 


@@ -126,7 +131,7 @@ if (pattern[0] == '^')
   {
   const pcre *re = regex_must_compile(pattern, cb->caseless, FALSE);
   return ((expand_setup < 0)?
   {
   const pcre *re = regex_must_compile(pattern, cb->caseless, FALSE);
   return ((expand_setup < 0)?

-           pcre_exec(re, NULL, CS s, Ustrlen(s), 0, PCRE_EOPT, NULL, 0) >= 0
+           pcre_exec(re, NULL, CCS s, Ustrlen(s), 0, PCRE_EOPT, NULL, 0) >= 0

            :
            regex_match_and_setup(re, s, 0, expand_setup)
          )?
            :
            regex_match_and_setup(re, s, 0, expand_setup)
          )?


@@ -174,7 +179,9 @@ if (cb->at_is_special && pattern[0] == '@')
     int slen = Ustrlen(s);
     if (s[0] != '[' && s[slen-1] != ']') return FAIL;
     for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)
     int slen = Ustrlen(s);
     if (s[0] != '[' && s[slen-1] != ']') return FAIL;
     for (ip = host_find_interfaces(); ip != NULL; ip = ip->next)

-      if (Ustrncmp(ip->address, s+1, slen - 2) == 0) return OK;
+      if (Ustrncmp(ip->address, s+1, slen - 2) == 0
+            && ip->address[slen - 2] == 0)
+        return OK;

     return FAIL;
     }
 
     return FAIL;
     }
 


@@ -185,8 +192,8 @@ if (cb->at_is_special && pattern[0] == '@')
     BOOL prim = FALSE;
     BOOL secy = FALSE;
     BOOL removed = FALSE;
     BOOL prim = FALSE;
     BOOL secy = FALSE;
     BOOL removed = FALSE;

-    uschar *ss = pattern + 4;
-    uschar *ignore_target_hosts = NULL;
+    const uschar *ss = pattern + 4;
+    const uschar *ignore_target_hosts = NULL;

 
     if (strncmpic(ss, US"any", 3) == 0) ss += 3;
     else if (strncmpic(ss, US"primary", 7) == 0)
 
     if (strncmpic(ss, US"any", 3) == 0) ss += 3;
     else if (strncmpic(ss, US"primary", 7) == 0)


@@ -214,6 +221,7 @@ if (cb->at_is_special && pattern[0] == '@')
       NULL,                /* service name not relevant */
       NULL,                /* srv_fail_domains not relevant */
       NULL,                /* mx_fail_domains not relevant */
       NULL,                /* service name not relevant */
       NULL,                /* srv_fail_domains not relevant */
       NULL,                /* mx_fail_domains not relevant */

+      NULL,                /* no dnssec request/require XXX ? */

       NULL,                /* no feedback FQDN */
       &removed);           /* feedback if local removed */
 
       NULL,                /* no feedback FQDN */
       &removed);           /* feedback if local removed */
 


@@ -328,8 +336,8 @@ Returns:       OK    if matched
 */
 
 int
 */
 
 int

-match_check_string(uschar *s, uschar *pattern, int expand_setup,
-  BOOL use_partial, BOOL caseless, BOOL at_is_special, uschar **valueptr)
+match_check_string(const uschar *s, const uschar *pattern, int expand_setup,
+  BOOL use_partial, BOOL caseless, BOOL at_is_special, const uschar **valueptr)

 {
 check_string_block cb;
 cb.origsubject = s;
 {
 check_string_block cb;
 cb.origsubject = s;


@@ -357,7 +365,7 @@ Arguments:
   type         MCL_STRING, MCL_DOMAIN, MCL_HOST, MCL_ADDRESS, or MCL_LOCALPART
 */
 
   type         MCL_STRING, MCL_DOMAIN, MCL_HOST, MCL_ADDRESS, or MCL_LOCALPART
 */
 

-static uschar *
+static const uschar *

 get_check_key(void *arg, int type)
 {
 switch(type)
 get_check_key(void *arg, int type)
 {
 switch(type)


@@ -423,19 +431,21 @@ Returns:       OK    if matched a non-negated item
                FAIL  if expansion force-failed
                FAIL  if matched a negated item
                FAIL  if hit end of list after a non-negated item
                FAIL  if expansion force-failed
                FAIL  if matched a negated item
                FAIL  if hit end of list after a non-negated item

-               DEFER if a lookup deferred or expansion failed
+               DEFER if a something deferred or expansion failed

 */
 
 int
 */
 
 int

-match_check_list(uschar **listptr, int sep, tree_node **anchorptr,
-  unsigned int **cache_ptr, int (*func)(void *,uschar *,uschar **,uschar **),
-  void *arg, int type, uschar *name, uschar **valueptr)
+match_check_list(const uschar **listptr, int sep, tree_node **anchorptr,
+  unsigned int **cache_ptr, int (*func)(void *,const uschar *,const uschar **,uschar **),
+  void *arg, int type, const uschar *name, const uschar **valueptr)

 {
 int yield = OK;
 unsigned int *original_cache_bits = *cache_ptr;
 BOOL include_unknown = FALSE;
 BOOL ignore_unknown = FALSE;
 {
 int yield = OK;
 unsigned int *original_cache_bits = *cache_ptr;
 BOOL include_unknown = FALSE;
 BOOL ignore_unknown = FALSE;

-uschar *list;
+BOOL include_defer = FALSE;
+BOOL ignore_defer = FALSE;
+const uschar *list;

 uschar *sss;
 uschar *ot = NULL;
 uschar buffer[1024];
 uschar *sss;
 uschar *ot = NULL;
 uschar buffer[1024];


@@ -451,12 +461,9 @@ HDEBUG(D_any)
 /* If the list is empty, the answer is no. Skip the debugging output for
 an unnamed list. */
 
 /* If the list is empty, the answer is no. Skip the debugging output for
 an unnamed list. */
 

-if (*listptr == NULL)
+if (!*listptr)

   {
   {

-  HDEBUG(D_lists)
-    {
-    if (ot != NULL) debug_printf("%s no (option unset)\n", ot);
-    }
+  HDEBUG(D_lists) if (ot) debug_printf("%s no (option unset)\n", ot);

   return FAIL;
   }
 
   return FAIL;
   }
 


@@ -472,8 +479,20 @@ if (type >= MCL_NOEXPAND)
   }
 else
   {
   }
 else
   {

-  list = expand_string(*listptr);
-  if (list == NULL)
+  /* If we are searching a domain list, and $domain is not set, set it to the
+  subject that is being sought for the duration of the expansion. */
+
+  if (type == MCL_DOMAIN && !deliver_domain)
+    {
+    check_string_block *cb = (check_string_block *)arg;
+    deliver_domain = string_copy(cb->subject);
+    list = expand_cstring(*listptr);
+    deliver_domain = NULL;
+    }
+  else
+    list = expand_cstring(*listptr);
+
+  if (!list)

     {
     if (expand_string_forcedfail)
       {
     {
     if (expand_string_forcedfail)
       {


@@ -489,17 +508,14 @@ else
 
 /* For an unnamed list, use the expanded version in comments */
 
 
 /* For an unnamed list, use the expanded version in comments */
 

-HDEBUG(D_any)
-  {
-  if (ot == NULL) ot = string_sprintf("%s in \"%s\"?", name, list);
-  }
+HDEBUG(D_any) if (ot == NULL) ot = string_sprintf("%s in \"%s\"?", name, list);

 
 /* Now scan the list and process each item in turn, until one of them matches,
 or we hit an error. */
 
 
 /* Now scan the list and process each item in turn, until one of them matches,
 or we hit an error. */
 

-while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
+while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))

   {
   {

-  uschar *ss = sss;
+  uschar * ss = sss;

 
   /* Address lists may contain +caseful, to restore caseful matching of the
   local part. We have to know the layout of the control block, unfortunately.
 
   /* Address lists may contain +caseful, to restore caseful matching of the
   local part. We have to know the layout of the control block, unfortunately.


@@ -512,7 +528,8 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       {
       check_address_block *cb = (check_address_block *)arg;
       uschar *at = Ustrrchr(cb->origaddress, '@');
       {
       check_address_block *cb = (check_address_block *)arg;
       uschar *at = Ustrrchr(cb->origaddress, '@');

-      if (at != NULL)
+
+      if (at)

         Ustrncpy(cb->address, cb->origaddress, at - cb->origaddress);
       cb->caseless = FALSE;
       continue;
         Ustrncpy(cb->address, cb->origaddress, at - cb->origaddress);
       cb->caseless = FALSE;
       continue;


@@ -532,10 +549,11 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       }
     }
 
       }
     }
 

-  /* If the host item is "+include_unknown", remember it in case there's a
-  subsequent failed reverse lookup. */
+  /* If the host item is "+include_unknown" or "+ignore_unknown", remember it
+  in case there's a subsequent failed reverse lookup. There is similar
+  processing for "defer". */

 
 

-  else if (type == MCL_HOST)
+  else if (type == MCL_HOST && *ss == '+')

     {
     if (Ustrcmp(ss, "+include_unknown") == 0)
       {
     {
     if (Ustrcmp(ss, "+include_unknown") == 0)
       {


@@ -549,6 +567,18 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       include_unknown = FALSE;
       continue;
       }
       include_unknown = FALSE;
       continue;
       }

+    if (Ustrcmp(ss, "+include_defer") == 0)
+      {
+      include_defer = TRUE;
+      ignore_defer = FALSE;
+      continue;
+      }
+    if (Ustrcmp(ss, "+ignore_defer") == 0)
+      {
+      ignore_defer = TRUE;
+      include_defer = FALSE;
+      continue;
+      }

     }
 
   /* Starting with ! specifies a negative item. It is theoretically possible
     }
 
   /* Starting with ! specifies a negative item. It is theoretically possible


@@ -559,7 +589,8 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
     yield = FAIL;
     while (isspace((*(++ss))));
     }
     yield = FAIL;
     while (isspace((*(++ss))));
     }

-  else yield = OK;
+  else
+    yield = OK;

 
   /* If the item does not begin with '/', it might be a + item for a named
   list. Otherwise, it is just a single list entry that has to be matched.
 
   /* If the item does not begin with '/', it might be a + item for a named
   list. Otherwise, it is just a single list entry that has to be matched.


@@ -567,7 +598,7 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
 
   if (*ss != '/')
     {
 
   if (*ss != '/')
     {

-    if (*ss == '+' && anchorptr != NULL)
+    if (*ss == '+' && anchorptr)

       {
       int bits = 0;
       int offset = 0;
       {
       int bits = 0;
       int offset = 0;


@@ -575,15 +606,18 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       unsigned int *use_cache_bits = original_cache_bits;
       uschar *cached = US"";
       namedlist_block *nb;
       unsigned int *use_cache_bits = original_cache_bits;
       uschar *cached = US"";
       namedlist_block *nb;

-      tree_node *t = tree_search(*anchorptr, ss+1);
-
-      if (t == NULL)
-        log_write(0, LOG_MAIN|LOG_PANIC_DIE, "unknown named%s list \"%s\"",
-          (type == MCL_DOMAIN)?    " domain" :
-          (type == MCL_HOST)?      " host" :
-          (type == MCL_ADDRESS)?   " address" :
-          (type == MCL_LOCALPART)? " local part" : "",
+      tree_node * t;
+
+      if (!(t = tree_search(*anchorptr, ss+1)))
+       {
+        log_write(0, LOG_MAIN|LOG_PANIC, "unknown named%s list \"%s\"",
+          type == MCL_DOMAIN ?    " domain" :
+          type == MCL_HOST ?      " host" :
+          type == MCL_ADDRESS ?   " address" :
+          type == MCL_LOCALPART ? " local part" : "",

           ss);
           ss);

+       return DEFER;
+       }

       nb = t->data.ptr;
 
       /* If the list number is negative, it means that this list is not
       nb = t->data.ptr;
 
       /* If the list number is negative, it means that this list is not


@@ -595,7 +629,7 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       because the pointer may be NULL from the start if caching is not
       required. */
 
       because the pointer may be NULL from the start if caching is not
       required. */
 

-      if (use_cache_bits != NULL)
+      if (use_cache_bits)

         {
         offset = (nb->number)/16;
         shift = ((nb->number)%16)*2;
         {
         offset = (nb->number)/16;
         shift = ((nb->number)%16)*2;


@@ -619,15 +653,13 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
         wasn't before. Ensure that this is passed up to the next level.
         Otherwise, remember the result of the search in the cache. */
 
         wasn't before. Ensure that this is passed up to the next level.
         Otherwise, remember the result of the search in the cache. */
 

-        if (use_cache_bits == NULL)
-          {
+        if (!use_cache_bits)

           *cache_ptr = NULL;
           *cache_ptr = NULL;

-          }

         else
           {
           use_cache_bits[offset] |= bits << shift;
 
         else
           {
           use_cache_bits[offset] |= bits << shift;
 

-          if (valueptr != NULL)
+          if (valueptr)

             {
             int old_pool = store_pool;
             namedlist_cacheblock *p;
             {
             int old_pool = store_pool;
             namedlist_cacheblock *p;


@@ -640,16 +672,14 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
             p->key = string_copy(get_check_key(arg, type));
 
 
             p->key = string_copy(get_check_key(arg, type));
 
 

-            p->data = (*valueptr == NULL)? NULL : string_copy(*valueptr);
+            p->data = *valueptr ? string_copy(*valueptr) : NULL;

             store_pool = old_pool;
 
             p->next = nb->cache_data;
             nb->cache_data = p;
             store_pool = old_pool;
 
             p->next = nb->cache_data;
             nb->cache_data = p;

-            if (*valueptr != NULL)
-              {
+            if (*valueptr)

               DEBUG(D_lists) debug_printf("data from lookup saved for "
                 "cache for %s: %s\n", ss, *valueptr);
               DEBUG(D_lists) debug_printf("data from lookup saved for "
                 "cache for %s: %s\n", ss, *valueptr);

-              }

             }
           }
         }
             }
           }
         }


@@ -662,19 +692,18 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
         {
         DEBUG(D_lists) debug_printf("cached %s match for %s\n",
           ((bits & (-bits)) == bits)? "yes" : "no", ss);
         {
         DEBUG(D_lists) debug_printf("cached %s match for %s\n",
           ((bits & (-bits)) == bits)? "yes" : "no", ss);

+

         cached = US" - cached";
         cached = US" - cached";

-        if (valueptr != NULL)
+        if (valueptr)

           {
           {

-          uschar *key = get_check_key(arg, type);
+          const uschar *key = get_check_key(arg, type);

           namedlist_cacheblock *p;
           namedlist_cacheblock *p;

-          for (p = nb->cache_data; p != NULL; p = p->next)
-            {
+          for (p = nb->cache_data; p; p = p->next)

             if (Ustrcmp(key, p->key) == 0)
               {
               *valueptr = p->data;
               break;
               }
             if (Ustrcmp(key, p->key) == 0)
               {
               *valueptr = p->data;
               break;
               }

-            }

           DEBUG(D_lists) debug_printf("cached lookup data = %s\n", *valueptr);
           }
         }
           DEBUG(D_lists) debug_printf("cached lookup data = %s\n", *valueptr);
           }
         }


@@ -694,16 +723,30 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
 
     else
       {
 
     else
       {

-      uschar *error;
+      uschar * error = NULL;

       switch ((func)(arg, ss, valueptr, &error))
         {
         case OK:
       switch ((func)(arg, ss, valueptr, &error))
         {
         case OK:

-        HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\")\n", ot,
-          (yield == OK)? "yes" : "no", sss);
-        return yield;
+         HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\")\n", ot,
+           (yield == OK)? "yes" : "no", sss);
+         return yield;

 
         case DEFER:
 
         case DEFER:

-        goto DEFER_RETURN;
+         if (!error)
+           error = string_sprintf("DNS lookup of \"%s\" deferred", ss);
+         if (ignore_defer)
+           {
+           HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_defer\n",
+             error);
+           break;
+           }
+         if (include_defer)
+           {
+           log_write(0, LOG_MAIN, "%s: accepted by +include_defer", error);
+           return OK;
+           }
+         if (!search_error_message) search_error_message = error;
+         goto DEFER_RETURN;

 
         /* The ERROR return occurs when checking hosts, when either a forward
         or reverse lookup has failed. It can also occur in a match_ip list if a
 
         /* The ERROR return occurs when checking hosts, when either a forward
         or reverse lookup has failed. It can also occur in a match_ip list if a


@@ -711,24 +754,24 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
         which it was. */
 
         case ERROR:
         which it was. */
 
         case ERROR:

-        if (ignore_unknown)
-          {
-          HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown",
-            error);
-          }
-        else
-          {
-          HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
-            include_unknown? "yes":"no", error);
-          if (!include_unknown)
-            {
-            if ((log_extra_selector & LX_unknown_in_list) != 0)
-              log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
-            return FAIL;
-            }
-          log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
-          return OK;
-          }
+         if (ignore_unknown)
+           {
+           HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown\n",
+             error);
+           }
+         else
+           {
+           HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
+             include_unknown? "yes":"no", error);
+           if (!include_unknown)
+             {
+             if (LOGGING(unknown_in_list))
+               log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
+             return FAIL;
+             }
+           log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
+           return OK;
+           }

         }
       }
     }
         }
       }
     }


@@ -739,16 +782,16 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
   else
     {
     int file_yield = yield;       /* In case empty file */
   else
     {
     int file_yield = yield;       /* In case empty file */

-    uschar *filename = ss;
-    FILE *f = Ufopen(filename, "rb");
+    uschar * filename = ss;
+    FILE * f = Ufopen(filename, "rb");

     uschar filebuffer[1024];
 
     /* ot will be null in non-debugging cases, and anyway, we get better
     wording by reworking it. */
 
     uschar filebuffer[1024];
 
     /* ot will be null in non-debugging cases, and anyway, we get better
     wording by reworking it. */
 

-    if (f == NULL)
+    if (!f)

       {
       {

-      uschar *listname = readconf_find_option(listptr);
+      uschar * listname = readconf_find_option(listptr);

       if (listname[0] == 0)
         listname = string_sprintf("\"%s\"", *listptr);
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",
       if (listname[0] == 0)
         listname = string_sprintf("\"%s\"", *listptr);
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s",


@@ -796,35 +839,48 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
       switch ((func)(arg, ss, valueptr, &error))
         {
         case OK:
       switch ((func)(arg, ss, valueptr, &error))
         {
         case OK:

-        (void)fclose(f);
-        HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\" in %s)\n", ot,
-          (yield == OK)? "yes" : "no", sss, filename);
-        return file_yield;
+         (void)fclose(f);
+         HDEBUG(D_lists) debug_printf("%s %s (matched \"%s\" in %s)\n", ot,
+           yield == OK ? "yes" : "no", sss, filename);
+         return file_yield;

 
         case DEFER:
 
         case DEFER:

-        (void)fclose(f);
-        goto DEFER_RETURN;
-
-        case ERROR:          /* host name lookup failed - this can only */
-        if (ignore_unknown)  /* be for an incoming host (not outgoing) */
-          {
-          HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown",
-            error);
-          }
-        else
-         {
-          HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
-            include_unknown? "yes":"no", error);
-          (void)fclose(f);
-          if (!include_unknown)
-            {
-            if ((log_extra_selector & LX_unknown_in_list) != 0)
-              log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
-            return FAIL;
-            }
-          log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
-          return OK;
-          }
+         if (!error)
+           error = string_sprintf("DNS lookup of %s deferred", ss);
+         if (ignore_defer)
+           {
+           HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_defer\n",
+             error);
+           break;
+           }
+         (void)fclose(f);
+         if (include_defer)
+           {
+           log_write(0, LOG_MAIN, "%s: accepted by +include_defer", error);
+           return OK;
+           }
+         goto DEFER_RETURN;
+
+        case ERROR:            /* host name lookup failed - this can only */
+         if (ignore_unknown)   /* be for an incoming host (not outgoing) */
+           {
+           HDEBUG(D_lists) debug_printf("%s: item ignored by +ignore_unknown\n",
+             error);
+           }
+         else
+          {
+           HDEBUG(D_lists) debug_printf("%s %s (%s)\n", ot,
+             include_unknown? "yes":"no", error);
+           (void)fclose(f);
+           if (!include_unknown)
+             {
+             if (LOGGING(unknown_in_list))
+               log_write(0, LOG_MAIN, "list matching forced to fail: %s", error);
+             return FAIL;
+             }
+           log_write(0, LOG_MAIN, "%s: accepted by +include_unknown", error);
+           return OK;
+           }

         }
       }
 
         }
       }
 


@@ -839,13 +895,13 @@ while ((sss = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL)
 /* End of list reached: if the last item was negated yield OK, else FAIL. */
 
 HDEBUG(D_lists)
 /* End of list reached: if the last item was negated yield OK, else FAIL. */
 
 HDEBUG(D_lists)

-  debug_printf("%s %s (end of list)\n", ot, (yield == OK)? "no":"yes");
-return (yield == OK)? FAIL : OK;
+  debug_printf("%s %s (end of list)\n", ot, yield == OK ? "no":"yes");
+return yield == OK ? FAIL : OK;

 
 

-/* Handle lookup defer */
+/* Something deferred */

 
 DEFER_RETURN:
 
 DEFER_RETURN:

-HDEBUG(D_lists) debug_printf("%s lookup deferred for %s\n", ot, sss);
+HDEBUG(D_lists) debug_printf("%s list match deferred for %s\n", ot, sss);

 return DEFER;
 }
 
 return DEFER;
 }
 


@@ -890,8 +946,9 @@ Returns:         OK    if matched a non-negated item
 */
 
 int
 */
 
 int

-match_isinlist(uschar *s, uschar **listptr, int sep, tree_node **anchorptr,
-  unsigned int *cache_bits, int type, BOOL caseless, uschar **valueptr)
+match_isinlist(const uschar *s, const uschar **listptr, int sep,
+   tree_node **anchorptr,
+  unsigned int *cache_bits, int type, BOOL caseless, const uschar **valueptr)

 {
 unsigned int *local_cache_bits = cache_bits;
 check_string_block cb;
 {
 unsigned int *local_cache_bits = cache_bits;
 check_string_block cb;


@@ -937,22 +994,37 @@ Returns:         OK     for a match
 */
 
 static int
 */
 
 static int

-check_address(void *arg, uschar *pattern, uschar **valueptr, uschar **error)
+check_address(void *arg, const uschar *pattern, const uschar **valueptr, uschar **error)

 {
 check_address_block *cb = (check_address_block *)arg;
 check_string_block csb;
 int rc;
 int expand_inc = 0;
 unsigned int *null = NULL;
 {
 check_address_block *cb = (check_address_block *)arg;
 check_string_block csb;
 int rc;
 int expand_inc = 0;
 unsigned int *null = NULL;

-uschar *listptr;
+const uschar *listptr;

 uschar *subject = cb->address;
 uschar *subject = cb->address;

-uschar *s, *pdomain, *sdomain;
+const uschar *s;
+uschar *pdomain, *sdomain;

 
 error = error;  /* Keep clever compilers from complaining */
 
 
 error = error;  /* Keep clever compilers from complaining */
 

-DEBUG(D_lists) debug_printf("address match: subject=%s pattern=%s\n",
+DEBUG(D_lists) debug_printf("address match test: subject=%s pattern=%s\n",

   subject, pattern);
 
   subject, pattern);
 

+/* Find the subject's domain */
+
+sdomain = Ustrrchr(subject, '@');
+
+/* The only case where a subject may not have a domain is if the subject is
+empty. Otherwise, a subject with no domain is a serious configuration error. */
+
+if (sdomain == NULL && *subject != 0)
+  {
+  log_write(0, LOG_MAIN|LOG_PANIC, "no @ found in the subject of an "
+    "address list match: subject=\"%s\" pattern=\"%s\"", subject, pattern);
+  return FAIL;
+  }
+

 /* Handle a regular expression, which must match the entire incoming address.
 This may be the empty address. */
 
 /* Handle a regular expression, which must match the entire incoming address.
 This may be the empty address. */
 


@@ -987,10 +1059,6 @@ against. */
 
 if (*subject == 0) return (*pattern == 0)? OK : FAIL;
 
 
 if (*subject == 0) return (*pattern == 0)? OK : FAIL;
 

-/* Find the subject's domain */
-
-sdomain = Ustrrchr(subject, '@');
-

 /* If the pattern starts with "@@" we have a split lookup, where the domain is
 looked up to obtain a list of local parts. If the subject's local part is just
 "*" (called from retry) the match always fails. */
 /* If the pattern starts with "@@" we have a split lookup, where the domain is
 looked up to obtain a list of local parts. If the subject's local part is just
 "*" (called from retry) the match always fails. */


@@ -998,7 +1066,8 @@ looked up to obtain a list of local parts. If the subject's local part is just
 if (pattern[0] == '@' && pattern[1] == '@')
   {
   int watchdog = 50;
 if (pattern[0] == '@' && pattern[1] == '@')
   {
   int watchdog = 50;

-  uschar *list, *key, *ss;
+  const uschar *key;
+  uschar *list, *ss;

   uschar buffer[1024];
 
   if (sdomain == subject + 1 && *subject == '*') return FAIL;
   uschar buffer[1024];
 
   if (sdomain == subject + 1 && *subject == '*') return FAIL;


@@ -1011,7 +1080,7 @@ if (pattern[0] == '@' && pattern[1] == '@')
     int sep = 0;
 
     if ((rc = match_check_string(key, pattern + 2, -1, TRUE, FALSE, FALSE,
     int sep = 0;
 
     if ((rc = match_check_string(key, pattern + 2, -1, TRUE, FALSE, FALSE,

-      &list)) != OK) return rc;
+      CUSS &list)) != OK) return rc;

 
     /* Check for chaining from the last item; set up the next key if one
     is found. */
 
     /* Check for chaining from the last item; set up the next key if one
     is found. */


@@ -1030,8 +1099,7 @@ if (pattern[0] == '@' && pattern[1] == '@')
     /* Look up the local parts provided by the list; negation is permitted.
     If a local part has to begin with !, a regex can be used. */
 
     /* Look up the local parts provided by the list; negation is permitted.
     If a local part has to begin with !, a regex can be used. */
 

-    while ((ss = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))
-           != NULL)
+    while ((ss = string_nextinlist(CUSS &list, &sep, buffer, sizeof(buffer))))

       {
       int local_yield;
 
       {
       int local_yield;
 


@@ -1206,9 +1274,9 @@ Returns:          OK    for a positive match, or end list after a negation;
 */
 
 int
 */
 
 int

-match_address_list(uschar *address, BOOL caseless, BOOL expand,
-  uschar **listptr, unsigned int *cache_bits, int expand_setup, int sep,
-  uschar **valueptr)
+match_address_list(const uschar *address, BOOL caseless, BOOL expand,
+  const uschar **listptr, unsigned int *cache_bits, int expand_setup, int sep,
+  const uschar **valueptr)

 {
 uschar *p;
 check_address_block ab;
 {
 uschar *p;
 check_address_block ab;


@@ -1252,4 +1320,25 @@ return match_check_list(listptr, sep, &addresslist_anchor, &local_cache_bits,
     valueptr);
 }
 
     valueptr);
 }
 

+/* Simpler version of match_address_list; always caseless, expanding,
+no cache bits, no value-return.
+
+Arguments:
+  address         address to test
+  listptr         list to check against
+  sep             separator character for the list;
+                  may be 0 to get separator from the list;
+                  may be UCHAR_MAX+1 for one-item list
+
+Returns:          OK    for a positive match, or end list after a negation;
+                  FAIL  for a negative match, or end list after non-negation;
+                  DEFER if a lookup deferred
+*/
+
+int
+match_address_list_basic(const uschar *address, const uschar **listptr, int sep)
+{
+return match_address_list(address, TRUE, TRUE, listptr, NULL, -1, sep, NULL);
+}
+

 /* End of match.c */
 /* End of match.c */