TLS: move from SUPPORT_TLS to DISABLE_TLS macro for the build

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index d8ea87dee165e5401f849950780d093acbe599bd..31059c432af1176fd0da00119c548230bfba0e12 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -235,6 +235,7 @@ static uschar *op_table_main[] = {
   US"rxquote",
   US"s",
   US"sha1",
+  US"sha2",
   US"sha256",
   US"sha3",
   US"stat",
@@ -281,6 +282,7 @@ enum {
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,
+  EOP_SHA2,
   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,
@@ -754,7 +756,7 @@ static var_entry var_table[] = {
 #ifdef EXPERIMENTAL_TLS_RESUME
   { "tls_in_resumption",   vtype_int,         &tls_in.resumption },
 #endif
-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS
   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
@@ -771,7 +773,7 @@ static var_entry var_table[] = {
 #ifdef EXPERIMENTAL_TLS_RESUME
   { "tls_out_resumption",  vtype_int,         &tls_out.resumption },
 #endif
-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS
   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE
@@ -779,7 +781,7 @@ static var_entry var_table[] = {
 #endif
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */
-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS
   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 
@@ -965,7 +967,7 @@ weirdness they'll twist this into.  The result should ideally handle fork().
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 
-If SUPPORT_TLS is defined then this will not be used except as an emergency
+If DISABLE_TLS is not defined then this will not be used except as an emergency
 fallback.
 
 Arguments:
@@ -973,13 +975,13 @@ Arguments:
 Returns     a random number in range [0, max-1]
 */
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
 # undef vaguely_random_number
 #endif
 static pid_t pid = 0;
@@ -1287,7 +1289,7 @@ return string_nextinlist(&list, &sep, NULL, 0);
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
 typedef struct
 {
 uschar * name;
@@ -1348,7 +1350,7 @@ expand_string_message =
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }
-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/
 
 /*************************************************
 *        Extract a substring from a string       *
@@ -3658,7 +3660,7 @@ return yield;
 }
 
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {
@@ -4945,7 +4947,7 @@ while (*s != 0)
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;
-      BOOL do_tls = FALSE;     /* Only set under SUPPORT_TLS */
+      BOOL do_tls = FALSE;     /* Only set under ! DISABLE_TLS */
       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)
@@ -4989,7 +4991,7 @@ while (*s != 0)
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif
@@ -5096,7 +5098,7 @@ while (*s != 0)
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };
@@ -5121,7 +5123,7 @@ while (*s != 0)
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
              do_tls ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :
 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
@@ -5150,13 +5152,13 @@ while (*s != 0)
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
          do_tls ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :
 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
        if (do_tls)
          {
          tls_close(cctx.tls_ctx, TRUE);
@@ -5990,7 +5992,7 @@ while (*s != 0)
       continue;
       }
 
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;
@@ -6070,7 +6072,7 @@ while (*s != 0)
         save_expand_nlength);
       continue;
       }
-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/
 
     /* Handle list operations */
 
@@ -6582,7 +6584,7 @@ while (*s != 0)
     int c;
     uschar *arg = NULL;
     uschar *sub;
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
     var_entry *vp = NULL;
 #endif
 
@@ -6605,7 +6607,7 @@ while (*s != 0)
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:
@@ -6760,7 +6762,7 @@ while (*s != 0)
         }
 
       case EOP_MD5:
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
@@ -6779,7 +6781,7 @@ while (*s != 0)
         continue;
 
       case EOP_SHA1:
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
@@ -6797,23 +6799,35 @@ while (*s != 0)
          }
         continue;
 
+      case EOP_SHA2:
       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)
          {
-         uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
-         yield = string_cat(yield, cp);
+         if (c == EOP_SHA256)
+           {
+           uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
+           yield = string_cat(yield, cp);
+           }
+         else
+           expand_string_message = US"sha2_N not supported with certificates";
          }
        else
          {
          hctx h;
          blob b;
+         hashmethod m = !arg ? HASH_SHA2_256
+           : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
+           : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
+           : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
+           : HASH_BADTYPE;
 
-         if (!exim_sha_init(&h, HASH_SHA2_256))
+         if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
            {
-           expand_string_message = US"unrecognised sha256 variant";
+           expand_string_message = US"unrecognised sha2 variant";
            goto EXPAND_FAILED;
            }
+
          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)
@@ -7550,7 +7564,7 @@ while (*s != 0)
       case EOP_STR2B64:
       case EOP_BASE64:
        {
-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS
        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));