Avoid re-expansion in ${sort }

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 14d7ce451471a8d734311c565360c16ac437e3bb..65c585d1c0cd6641eedcc52429ee6f7c33f76fb3 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -235,6 +235,7 @@ static uschar *op_table_main[] = {
   US"rxquote",
   US"s",
   US"sha1",
   US"rxquote",
   US"s",
   US"sha1",

+  US"sha2",

   US"sha256",
   US"sha3",
   US"stat",
   US"sha256",
   US"sha3",
   US"stat",


@@ -281,6 +282,7 @@ enum {
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,

+  EOP_SHA2,

   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,
   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,


@@ -668,9 +670,6 @@ static var_entry var_table[] = {
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },

-#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
-  { "requiretls",          vtype_bool,        &tls_requiretls },
-#endif

   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },
   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },


@@ -754,7 +753,10 @@ static var_entry var_table[] = {
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_in_resumption",   vtype_int,         &tls_in.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_out_bits",        vtype_int,         &tls_out.bits },


@@ -768,7 +770,10 @@ static var_entry var_table[] = {
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_out_resumption",  vtype_int,         &tls_out.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE
   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE


@@ -776,7 +781,7 @@ static var_entry var_table[] = {
 #endif
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */
 #endif
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */

-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS

   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 
   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 


@@ -962,7 +967,7 @@ weirdness they'll twist this into.  The result should ideally handle fork().
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 

-If SUPPORT_TLS is defined then this will not be used except as an emergency
+If DISABLE_TLS is not defined then this will not be used except as an emergency

 fallback.
 
 Arguments:
 fallback.
 
 Arguments:


@@ -970,56 +975,55 @@ Arguments:
 Returns     a random number in range [0, max-1]
 */
 
 Returns     a random number in range [0, max-1]
 */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {
 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # undef vaguely_random_number
 #endif
 # undef vaguely_random_number
 #endif

-  static pid_t pid = 0;
-  pid_t p2;
-#if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
-  struct timeval tv;
-#endif
+static pid_t pid = 0;
+pid_t p2;

 
 

-  p2 = getpid();
-  if (p2 != pid)
+if ((p2 = getpid()) != pid)
+  {
+  if (pid != 0)

     {
     {

-    if (pid != 0)
-      {

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-      /* cryptographically strong randomness, common on *BSD platforms, not
-      so much elsewhere.  Alas. */
-#ifndef NOT_HAVE_ARC4RANDOM_STIR
-      arc4random_stir();
-#endif
+    /* cryptographically strong randomness, common on *BSD platforms, not
+    so much elsewhere.  Alas. */
+# ifndef NOT_HAVE_ARC4RANDOM_STIR
+    arc4random_stir();
+# endif

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-#ifdef HAVE_SRANDOMDEV
-      /* uses random(4) for seeding */
-      srandomdev();
-#else
-      gettimeofday(&tv, NULL);
-      srandom(tv.tv_sec | tv.tv_usec | getpid());
-#endif
+# ifdef HAVE_SRANDOMDEV
+    /* uses random(4) for seeding */
+    srandomdev();
+# else
+    {
+    struct timeval tv;
+    gettimeofday(&tv, NULL);
+    srandom(tv.tv_sec | tv.tv_usec | getpid());
+    }
+# endif

 #else
 #else

-      /* Poor randomness and no seeding here */
+    /* Poor randomness and no seeding here */

 #endif
 
 #endif
 

-      }
-    pid = p2;

     }
     }

+  pid = p2;
+  }

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-  return arc4random() % max;
+return arc4random() % max;

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-  return random() % max;
+return random() % max;

 #else
 #else

-  /* This one returns a 16-bit number, definitely not crypto-strong */
-  return random_number(max);
+/* This one returns a 16-bit number, definitely not crypto-strong */
+return random_number(max);

 #endif
 }
 
 #endif
 }
 


@@ -1285,7 +1289,7 @@ return string_nextinlist(&list, &sep, NULL, 0);
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 typedef struct
 {
 uschar * name;
 typedef struct
 {
 uschar * name;


@@ -1346,7 +1350,7 @@ expand_string_message =
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
 /*************************************************
 *        Extract a substring from a string       *
 
 /*************************************************
 *        Extract a substring from a string       *


@@ -1769,8 +1773,13 @@ set, in which case give an error. */
 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
      !isalpha(name[5]))
   {
 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
      !isalpha(name[5]))
   {

-  tree_node *node =
-    tree_search((name[4] == 'c')? acl_var_c : acl_var_m, name + 4);
+  tree_node * node =
+    tree_search(name[4] == 'c' ? acl_var_c : acl_var_m, name + 4);
+  return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
+  }
+else if (Ustrncmp(name, "r_", 2) == 0)
+  {
+  tree_node * node = tree_search(router_var, name + 2);

   return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
   }
 
   return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
   }
 


@@ -2237,6 +2246,56 @@ return US item;
 
 
 
 
 
 

+/************************************************/
+/*  Return offset in ops table, or -1 if not found.
+Repoint to just after the operator in the string.
+
+Argument:
+ ss    string representation of operator
+ opname        split-out operator name
+*/
+
+static int
+identify_operator(const uschar ** ss, uschar ** opname)
+{
+const uschar * s = *ss;
+uschar name[256];
+
+/* Numeric comparisons are symbolic */
+
+if (*s == '=' || *s == '>' || *s == '<')
+  {
+  int p = 0;
+  name[p++] = *s++;
+  if (*s == '=')
+    {
+    name[p++] = '=';
+    s++;
+    }
+  name[p] = 0;
+  }
+
+/* All other conditions are named */
+
+else
+  s = read_name(name, sizeof(name), s, US"_");
+*ss = s;
+
+/* If we haven't read a name, it means some non-alpha character is first. */
+
+if (!name[0])
+  {
+  expand_string_message = string_sprintf("condition name expected, "
+    "but found \"%.16s\"", s);
+  return -1;
+  }
+if (opname)
+  *opname = string_copy(name);
+
+return chop_match(name, cond_table, nelem(cond_table));
+}
+
+

 /*************************************************
 *        Read and evaluate a condition           *
 *************************************************/
 /*************************************************
 *        Read and evaluate a condition           *
 *************************************************/


@@ -2267,6 +2326,7 @@ BOOL is_forany, is_json, is_jsons;
 int rc, cond_type, roffset;
 int_eximarith_t num[2];
 struct stat statbuf;
 int rc, cond_type, roffset;
 int_eximarith_t num[2];
 struct stat statbuf;

+uschar * opname;

 uschar name[256];
 const uschar *sub[10];
 
 uschar name[256];
 const uschar *sub[10];
 


@@ -2279,37 +2339,7 @@ for (;;)
   if (*s == '!') { testfor = !testfor; s++; } else break;
   }
 
   if (*s == '!') { testfor = !testfor; s++; } else break;
   }
 

-/* Numeric comparisons are symbolic */
-
-if (*s == '=' || *s == '>' || *s == '<')
-  {
-  int p = 0;
-  name[p++] = *s++;
-  if (*s == '=')
-    {
-    name[p++] = '=';
-    s++;
-    }
-  name[p] = 0;
-  }
-
-/* All other conditions are named */
-
-else s = read_name(name, 256, s, US"_");
-
-/* If we haven't read a name, it means some non-alpha character is first. */
-
-if (name[0] == 0)
-  {
-  expand_string_message = string_sprintf("condition name expected, "
-    "but found \"%.16s\"", s);
-  return NULL;
-  }
-
-/* Find which condition we are dealing with, and switch on it */
-
-cond_type = chop_match(name, cond_table, nelem(cond_table));
-switch(cond_type)
+switch(cond_type = identify_operator(&s, &opname))

   {
   /* def: tests for a non-empty variable, or for the existence of a header. If
   yield == NULL we are in a skipping state, and don't care about the answer. */
   {
   /* def: tests for a non-empty variable, or for the existence of a header. If
   yield == NULL we are in a skipping state, and don't care about the answer. */


@@ -2508,8 +2538,9 @@ switch(cond_type)
 
     if (yield != NULL)
       {
 
     if (yield != NULL)
       {

+      int rc;

       *resetok = FALSE;        /* eval_acl() might allocate; do not reclaim */
       *resetok = FALSE;        /* eval_acl() might allocate; do not reclaim */

-      switch(eval_acl(sub, nelem(sub), &user_msg))
+      switch(rc = eval_acl(sub, nelem(sub), &user_msg))

        {
        case OK:
          cond = TRUE;
        {
        case OK:
          cond = TRUE;


@@ -2524,7 +2555,8 @@ switch(cond_type)
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:

-          expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
+          expand_string_message = string_sprintf("%s from acl \"%s\"",
+           rc_names[rc], sub[0]);

          return NULL;
        }
       }
          return NULL;
        }
       }


@@ -2628,7 +2660,7 @@ switch(cond_type)
       {
       if (i == 0) goto COND_FAILED_CURLY_START;
       expand_string_message = string_sprintf("missing 2nd string in {} "
       {
       if (i == 0) goto COND_FAILED_CURLY_START;
       expand_string_message = string_sprintf("missing 2nd string in {} "

-        "after \"%s\"", name);
+        "after \"%s\"", opname);

       return NULL;
       }
     if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
       return NULL;
       }
     if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,


@@ -2643,7 +2675,7 @@ switch(cond_type)
     conditions that compare numbers do not start with a letter. This just saves
     checking for them individually. */
 
     conditions that compare numbers do not start with a letter. This just saves
     checking for them individually. */
 

-    if (!isalpha(name[0]) && yield != NULL)
+    if (!isalpha(opname[0]) && yield != NULL)

       if (sub[i][0] == 0)
         {
         num[i] = 0;
       if (sub[i][0] == 0)
         {
         num[i] = 0;


@@ -2955,7 +2987,7 @@ switch(cond_type)
       uschar *save_iterate_item = iterate_item;
       int (*compare)(const uschar *, const uschar *);
 
       uschar *save_iterate_item = iterate_item;
       int (*compare)(const uschar *, const uschar *);
 

-      DEBUG(D_expand) debug_printf_indent("condition: %s  item: %s\n", name, sub[0]);
+      DEBUG(D_expand) debug_printf_indent("condition: %s  item: %s\n", opname, sub[0]);

 
       tempcond = FALSE;
       compare = cond_type == ECOND_INLISTI
 
       tempcond = FALSE;
       compare = cond_type == ECOND_INLISTI


@@ -2997,14 +3029,14 @@ switch(cond_type)
     if (*s != '{')                                     /* }-for-text-editors */
       {
       expand_string_message = string_sprintf("each subcondition "
     if (*s != '{')                                     /* }-for-text-editors */
       {
       expand_string_message = string_sprintf("each subcondition "

-        "inside an \"%s{...}\" condition must be in its own {}", name);
+        "inside an \"%s{...}\" condition must be in its own {}", opname);

       return NULL;
       }
 
     if (!(s = eval_condition(s+1, resetok, subcondptr)))
       {
       expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
       return NULL;
       }
 
     if (!(s = eval_condition(s+1, resetok, subcondptr)))
       {
       expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",

-        expand_string_message, name);
+        expand_string_message, opname);

       return NULL;
       }
     while (isspace(*s)) s++;
       return NULL;
       }
     while (isspace(*s)) s++;


@@ -3014,7 +3046,7 @@ switch(cond_type)
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "

-        "inside \"%s\" group", name);
+        "inside \"%s\" group", opname);

       return NULL;
       }
 
       return NULL;
       }
 


@@ -3052,7 +3084,7 @@ switch(cond_type)
     int sep = 0;
     uschar *save_iterate_item = iterate_item;
 
     int sep = 0;
     uschar *save_iterate_item = iterate_item;
 

-    DEBUG(D_expand) debug_printf_indent("condition: %s\n", name);
+    DEBUG(D_expand) debug_printf_indent("condition: %s\n", opname);

 
     while (isspace(*s)) s++;
     if (*s++ != '{') goto COND_FAILED_CURLY_START;     /* }-for-text-editors */
 
     while (isspace(*s)) s++;
     if (*s++ != '{') goto COND_FAILED_CURLY_START;     /* }-for-text-editors */


@@ -3073,7 +3105,7 @@ switch(cond_type)
     if (!(s = eval_condition(sub[1], resetok, NULL)))
       {
       expand_string_message = string_sprintf("%s inside \"%s\" condition",
     if (!(s = eval_condition(sub[1], resetok, NULL)))
       {
       expand_string_message = string_sprintf("%s inside \"%s\" condition",

-        expand_string_message, name);
+        expand_string_message, opname);

       return NULL;
       }
     while (isspace(*s)) s++;
       return NULL;
       }
     while (isspace(*s)) s++;


@@ -3083,7 +3115,7 @@ switch(cond_type)
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "

-        "inside \"%s\"", name);
+        "inside \"%s\"", opname);

       return NULL;
       }
 
       return NULL;
       }
 


@@ -3107,11 +3139,11 @@ switch(cond_type)
       if (!eval_condition(sub[1], resetok, &tempcond))
         {
         expand_string_message = string_sprintf("%s inside \"%s\" condition",
       if (!eval_condition(sub[1], resetok, &tempcond))
         {
         expand_string_message = string_sprintf("%s inside \"%s\" condition",

-          expand_string_message, name);
+          expand_string_message, opname);

         iterate_item = save_iterate_item;
         return NULL;
         }
         iterate_item = save_iterate_item;
         return NULL;
         }

-      DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", name,
+      DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", opname,

         tempcond? "true":"false");
 
       if (yield) *yield = (tempcond == testfor);
         tempcond? "true":"false");
 
       if (yield) *yield = (tempcond == testfor);


@@ -3204,19 +3236,20 @@ switch(cond_type)
   /* Unknown condition */
 
   default:
   /* Unknown condition */
 
   default:

-  expand_string_message = string_sprintf("unknown condition \"%s\"", name);
-  return NULL;
+    if (!expand_string_message || !*expand_string_message)
+      expand_string_message = string_sprintf("unknown condition \"%s\"", opname);
+    return NULL;

   }   /* End switch on condition type */
 
 /* Missing braces at start and end of data */
 
 COND_FAILED_CURLY_START:
   }   /* End switch on condition type */
 
 /* Missing braces at start and end of data */
 
 COND_FAILED_CURLY_START:

-expand_string_message = string_sprintf("missing { after \"%s\"", name);
+expand_string_message = string_sprintf("missing { after \"%s\"", opname);

 return NULL;
 
 COND_FAILED_CURLY_END:
 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
 return NULL;
 
 COND_FAILED_CURLY_END:
 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",

-  name);
+  opname);

 return NULL;
 
 /* A condition requires code that is not compiled */
 return NULL;
 
 /* A condition requires code that is not compiled */


@@ -3226,7 +3259,7 @@ return NULL;
     !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
 COND_FAILED_NOT_COMPILED:
 expand_string_message = string_sprintf("support for \"%s\" not compiled",
     !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
 COND_FAILED_NOT_COMPILED:
 expand_string_message = string_sprintf("support for \"%s\" not compiled",

-  name);
+  opname);

 return NULL;
 #endif
 }
 return NULL;
 #endif
 }


@@ -3656,7 +3689,7 @@ return yield;
 }
 
 
 }
 
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {
 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {


@@ -3705,17 +3738,15 @@ eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
 {
 uschar *s = *sptr;
 int_eximarith_t x = eval_op_or(&s, decimal, error);
 {
 uschar *s = *sptr;
 int_eximarith_t x = eval_op_or(&s, decimal, error);

-if (*error == NULL)
-  {
+
+if (!*error)

   if (endket)
   if (endket)

-    {

     if (*s != ')')
       *error = US"expecting closing parenthesis";
     else
       while (isspace(*(++s)));
     if (*s != ')')
       *error = US"expecting closing parenthesis";
     else
       while (isspace(*(++s)));

-    }
-  else if (*s != 0) *error = US"expecting operator";
-  }
+  else if (*s)
+    *error = US"expecting operator";

 *sptr = s;
 return x;
 }
 *sptr = s;
 return x;
 }


@@ -3724,12 +3755,12 @@ return x;
 static int_eximarith_t
 eval_number(uschar **sptr, BOOL decimal, uschar **error)
 {
 static int_eximarith_t
 eval_number(uschar **sptr, BOOL decimal, uschar **error)
 {

-register int c;
+int c;

 int_eximarith_t n;
 uschar *s = *sptr;
 int_eximarith_t n;
 uschar *s = *sptr;

+

 while (isspace(*s)) s++;
 while (isspace(*s)) s++;

-c = *s;
-if (isdigit(c))
+if (isdigit((c = *s)))

   {
   int count;
   (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
   {
   int count;
   (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);


@@ -3772,9 +3803,8 @@ if (*s == '+' || *s == '-' || *s == '~')
     else if (op == '~') x = ~x;
   }
 else
     else if (op == '~') x = ~x;
   }
 else

-  {

   x = eval_number(&s, decimal, error);
   x = eval_number(&s, decimal, error);

-  }
+

 *sptr = s;
 return x;
 }
 *sptr = s;
 return x;
 }


@@ -3953,6 +3983,56 @@ return x;
 
 
 
 
 
 

+/************************************************/
+/* Comparison operation for sort expansion.  We need to avoid
+re-expanding the fields being compared, so need a custom routine.
+
+Arguments:
+ cond_type             Comparison operator code
+ leftarg, rightarg     Arguments for comparison
+
+Return true iff (leftarg compare rightarg)
+*/
+
+static BOOL
+sortsbefore(int cond_type, BOOL alpha_cond,
+  const uschar * leftarg, const uschar * rightarg)
+{
+int_eximarith_t l_num, r_num;
+
+if (!alpha_cond)
+  {
+  l_num = expanded_string_integer(leftarg, FALSE);
+  if (expand_string_message) return FALSE;
+  r_num = expanded_string_integer(rightarg, FALSE);
+  if (expand_string_message) return FALSE;
+
+  switch (cond_type)
+    {
+    case ECOND_NUM_G:  return l_num >  r_num;
+    case ECOND_NUM_GE: return l_num >= r_num;
+    case ECOND_NUM_L:  return l_num <  r_num;
+    case ECOND_NUM_LE: return l_num <= r_num;
+    default: break;
+    }
+  }
+else
+  switch (cond_type)
+    {
+    case ECOND_STR_LT: return Ustrcmp (leftarg, rightarg) <  0;
+    case ECOND_STR_LTI:        return strcmpic(leftarg, rightarg) <  0;
+    case ECOND_STR_LE: return Ustrcmp (leftarg, rightarg) <= 0;
+    case ECOND_STR_LEI:        return strcmpic(leftarg, rightarg) <= 0;
+    case ECOND_STR_GT: return Ustrcmp (leftarg, rightarg) >  0;
+    case ECOND_STR_GTI:        return strcmpic(leftarg, rightarg) >  0;
+    case ECOND_STR_GE: return Ustrcmp (leftarg, rightarg) >= 0;
+    case ECOND_STR_GEI:        return strcmpic(leftarg, rightarg) >= 0;
+    default: break;
+    }
+return FALSE;  /* should not happen */
+}
+
+

 /*************************************************
 *                 Expand string                  *
 *************************************************/
 /*************************************************
 *                 Expand string                  *
 *************************************************/


@@ -4244,6 +4324,7 @@ while (*s != 0)
       {
       uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
       uschar *user_msg;
       {
       uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
       uschar *user_msg;

+      int rc;

 
       switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, US"acl",
                      &resetok))
 
       switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, US"acl",
                      &resetok))


@@ -4255,7 +4336,7 @@ while (*s != 0)
       if (skipping) continue;
 
       resetok = FALSE;
       if (skipping) continue;
 
       resetok = FALSE;

-      switch(eval_acl(sub, nelem(sub), &user_msg))
+      switch(rc = eval_acl(sub, nelem(sub), &user_msg))

        {
        case OK:
        case FAIL:
        {
        case OK:
        case FAIL:


@@ -4269,7 +4350,8 @@ while (*s != 0)
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:

-          expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
+          expand_string_message = string_sprintf("%s from acl \"%s\"",
+           rc_names[rc], sub[0]);

          goto EXPAND_FAILED;
        }
       }
          goto EXPAND_FAILED;
        }
       }


@@ -4937,13 +5019,13 @@ while (*s != 0)
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;

-      FILE * fp;
+      FILE * fp = NULL;

       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;
       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;

-      BOOL do_tls = FALSE;     /* Only set under SUPPORT_TLS */
+      BOOL do_tls = FALSE;     /* Only set under ! DISABLE_TLS */

       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)
       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)


@@ -4987,7 +5069,7 @@ while (*s != 0)
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif
          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif


@@ -5043,7 +5125,7 @@ while (*s != 0)
             port = ntohs(service_info->s_port);
             }
 
             port = ntohs(service_info->s_port);
             }
 

-         /*XXX we trust that the request is idempotent.  Hmm. */
+         /*XXX we trust that the request is idempotent for TFO.  Hmm. */

          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);
          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);


@@ -5094,7 +5176,7 @@ while (*s != 0)
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };
        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };


@@ -5119,8 +5201,8 @@ while (*s != 0)
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (

-#ifdef SUPPORT_TLS
-             cctx.tls_ctx ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :
+#ifndef DISABLE_TLS
+             do_tls ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :

 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {
 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {


@@ -5135,7 +5217,7 @@ while (*s != 0)
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR

-       if (!cctx.tls_ctx && do_shutdown) shutdown(cctx.sock, SHUT_WR);
+       if (!do_tls && do_shutdown) shutdown(cctx.sock, SHUT_WR);

 #endif
 
        if (f.running_in_test_harness) millisleep(100);
 #endif
 
        if (f.running_in_test_harness) millisleep(100);


@@ -5143,19 +5225,19 @@ while (*s != 0)
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 

-       if (!cctx.tls_ctx)
+       if (!do_tls)

          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =
          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =

-#ifdef SUPPORT_TLS
-         cctx.tls_ctx ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :
+#ifndef DISABLE_TLS
+         do_tls ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :

 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 
 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 

-#ifdef SUPPORT_TLS
-       if (cctx.tls_ctx)
+#ifndef DISABLE_TLS
+       if (do_tls)

          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);
          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);


@@ -5988,7 +6070,7 @@ while (*s != 0)
       continue;
       }
 
       continue;
       }
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;
     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;


@@ -6068,7 +6150,7 @@ while (*s != 0)
         save_expand_nlength);
       continue;
       }
         save_expand_nlength);
       continue;
       }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
     /* Handle list operations */
 
 
     /* Handle list operations */
 


@@ -6274,9 +6356,10 @@ while (*s != 0)
 
     case EITEM_SORT:
       {
 
     case EITEM_SORT:
       {

+      int cond_type;

       int sep = 0;
       const uschar *srclist, *cmp, *xtract;
       int sep = 0;
       const uschar *srclist, *cmp, *xtract;

-      uschar *srcitem;
+      uschar * opname, * srcitem;

       const uschar *dstlist = NULL, *dstkeylist = NULL;
       uschar * tmp;
       uschar *save_iterate_item = iterate_item;
       const uschar *dstlist = NULL, *dstkeylist = NULL;
       uschar * tmp;
       uschar *save_iterate_item = iterate_item;


@@ -6311,6 +6394,25 @@ while (*s != 0)
        goto EXPAND_FAILED_CURLY;
        }
 
        goto EXPAND_FAILED_CURLY;
        }
 

+      if ((cond_type = identify_operator(&cmp, &opname)) == -1)
+       {
+       if (!expand_string_message)
+         expand_string_message = string_sprintf("unknown condition \"%s\"", s);
+       goto EXPAND_FAILED;
+       }
+      switch(cond_type)
+       {
+       case ECOND_NUM_L: case ECOND_NUM_LE:
+       case ECOND_NUM_G: case ECOND_NUM_GE:
+       case ECOND_STR_GE: case ECOND_STR_GEI: case ECOND_STR_GT: case ECOND_STR_GTI:
+       case ECOND_STR_LE: case ECOND_STR_LEI: case ECOND_STR_LT: case ECOND_STR_LTI:
+         break;
+
+       default:
+         expand_string_message = US"comparator not handled for sort";
+         goto EXPAND_FAILED;
+       }
+

       while (isspace(*s)) s++;
       if (*s++ != '{')
         {
       while (isspace(*s)) s++;
       if (*s++ != '{')
         {


@@ -6338,11 +6440,10 @@ while (*s != 0)
       if (skipping) continue;
 
       while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
       if (skipping) continue;
 
       while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))

-        {
-       uschar * dstitem;
+       {
+       uschar * srcfield, * dstitem;

        gstring * newlist = NULL;
        gstring * newkeylist = NULL;
        gstring * newlist = NULL;
        gstring * newkeylist = NULL;

-       uschar * srcfield;

 
         DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
 
 
         DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
 


@@ -6363,25 +6464,15 @@ while (*s != 0)
        while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
          {
          uschar * dstfield;
        while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
          {
          uschar * dstfield;

-         uschar * expr;
-         BOOL before;

 
          /* field for comparison */
          if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
            goto sort_mismatch;
 
 
          /* field for comparison */
          if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
            goto sort_mismatch;
 

-         /* build and run condition string */
-         expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield);
-
-         DEBUG(D_expand) debug_printf_indent("%s: cond = \"%s\"\n", name, expr);
-         if (!eval_condition(expr, &resetok, &before))
-           {
-           expand_string_message = string_sprintf("comparison in sort: %s",
-               expr);
-           goto EXPAND_FAILED;
-           }
+         /* String-comparator names start with a letter; numeric names do not */

 
 

-         if (before)
+         if (sortsbefore(cond_type, isalpha(opname[0]),
+             srcfield, dstfield))

            {
            /* New-item sorts before this dst-item.  Append new-item,
            then dst-item, then remainder of dst list. */
            {
            /* New-item sorts before this dst-item.  Append new-item,
            then dst-item, then remainder of dst list. */


@@ -6580,7 +6671,7 @@ while (*s != 0)
     int c;
     uschar *arg = NULL;
     uschar *sub;
     int c;
     uschar *arg = NULL;
     uschar *sub;

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     var_entry *vp = NULL;
 #endif
 
     var_entry *vp = NULL;
 #endif
 


@@ -6603,7 +6694,7 @@ while (*s != 0)
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:
       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:


@@ -6758,7 +6849,7 @@ while (*s != 0)
         }
 
       case EOP_MD5:
         }
 
       case EOP_MD5:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);


@@ -6777,7 +6868,7 @@ while (*s != 0)
         continue;
 
       case EOP_SHA1:
         continue;
 
       case EOP_SHA1:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);


@@ -6795,23 +6886,30 @@ while (*s != 0)
          }
         continue;
 
          }
         continue;
 

+      case EOP_SHA2:

       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)
       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)

-         {
-         uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
-         yield = string_cat(yield, cp);
-         }
+         if (c == EOP_SHA256)
+           yield = string_cat(yield, tls_cert_fprt_sha256(*(void **)vp->value));
+         else
+           expand_string_message = US"sha2_N not supported with certificates";

        else
          {
          hctx h;
          blob b;
        else
          {
          hctx h;
          blob b;

+         hashmethod m = !arg ? HASH_SHA2_256
+           : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
+           : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
+           : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
+           : HASH_BADTYPE;

 
 

-         if (!exim_sha_init(&h, HASH_SHA2_256))
+         if (m == HASH_BADTYPE || !exim_sha_init(&h, m))

            {
            {

-           expand_string_message = US"unrecognised sha256 variant";
+           expand_string_message = US"unrecognised sha2 variant";

            goto EXPAND_FAILED;
            }
            goto EXPAND_FAILED;
            }

+

          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)
          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)


@@ -7548,7 +7646,7 @@ while (*s != 0)
       case EOP_STR2B64:
       case EOP_BASE64:
        {
       case EOP_STR2B64:
       case EOP_BASE64:
        {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));
        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));