TLS: restore TLS protocol version to default Received: header

[exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 14d7ce451471a8d734311c565360c16ac437e3bb..21686e99ced7bdd72cf61d5daf37687d65fb2226 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -235,6 +235,7 @@ static uschar *op_table_main[] = {
   US"rxquote",
   US"s",
   US"sha1",
   US"rxquote",
   US"s",
   US"sha1",

+  US"sha2",

   US"sha256",
   US"sha3",
   US"stat",
   US"sha256",
   US"sha3",
   US"stat",


@@ -281,6 +282,7 @@ enum {
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,

+  EOP_SHA2,

   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,
   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,


@@ -449,6 +451,7 @@ typedef struct {
 } alblock;
 
 static uschar * fn_recipients(void);
 } alblock;
 
 static uschar * fn_recipients(void);

+typedef uschar * stringptr_fn_t(void);

 
 /* This table must be kept in alphabetical order. */
 
 
 /* This table must be kept in alphabetical order. */
 


@@ -470,7 +473,7 @@ static var_entry var_table[] = {
   { "address_file",        vtype_stringptr,   &address_file },
   { "address_pipe",        vtype_stringptr,   &address_pipe },
 #ifdef EXPERIMENTAL_ARC
   { "address_file",        vtype_stringptr,   &address_file },
   { "address_pipe",        vtype_stringptr,   &address_pipe },
 #ifdef EXPERIMENTAL_ARC

-  { "arc_domains",         vtype_string_func, &fn_arc_domains },
+  { "arc_domains",         vtype_string_func, (void *) &fn_arc_domains },

   { "arc_oldest_pass",     vtype_int,         &arc_oldest_pass },
   { "arc_state",           vtype_stringptr,   &arc_state },
   { "arc_state_reason",    vtype_stringptr,   &arc_state_reason },
   { "arc_oldest_pass",     vtype_int,         &arc_oldest_pass },
   { "arc_state",           vtype_stringptr,   &arc_state },
   { "arc_state_reason",    vtype_stringptr,   &arc_state_reason },


@@ -527,7 +530,7 @@ static var_entry var_table[] = {
   { "dkim_verify_reason",  vtype_stringptr,   &dkim_verify_reason },
   { "dkim_verify_status",  vtype_stringptr,   &dkim_verify_status },
 #endif
   { "dkim_verify_reason",  vtype_stringptr,   &dkim_verify_reason },
   { "dkim_verify_status",  vtype_stringptr,   &dkim_verify_status },
 #endif

-#ifdef EXPERIMENTAL_DMARC
+#ifdef SUPPORT_DMARC

   { "dmarc_domain_policy", vtype_stringptr,   &dmarc_domain_policy },
   { "dmarc_status",        vtype_stringptr,   &dmarc_status },
   { "dmarc_status_text",   vtype_stringptr,   &dmarc_status_text },
   { "dmarc_domain_policy", vtype_stringptr,   &dmarc_domain_policy },
   { "dmarc_status",        vtype_stringptr,   &dmarc_status },
   { "dmarc_status_text",   vtype_stringptr,   &dmarc_status_text },


@@ -551,7 +554,7 @@ static var_entry var_table[] = {
   { "exim_path",           vtype_stringptr,   &exim_path },
   { "exim_uid",            vtype_uid,         &exim_uid },
   { "exim_version",        vtype_stringptr,   &version_string },
   { "exim_path",           vtype_stringptr,   &exim_path },
   { "exim_uid",            vtype_uid,         &exim_uid },
   { "exim_version",        vtype_stringptr,   &version_string },

-  { "headers_added",       vtype_string_func, &fn_hdrs_added },
+  { "headers_added",       vtype_string_func, (void *) &fn_hdrs_added },

   { "home",                vtype_stringptr,   &deliver_home },
   { "host",                vtype_stringptr,   &deliver_host },
   { "host_address",        vtype_stringptr,   &deliver_host_address },
   { "home",                vtype_stringptr,   &deliver_home },
   { "host",                vtype_stringptr,   &deliver_host },
   { "host_address",        vtype_stringptr,   &deliver_host_address },


@@ -662,15 +665,12 @@ static var_entry var_table[] = {
   { "received_time",       vtype_int,         &received_time.tv_sec },
   { "recipient_data",      vtype_stringptr,   &recipient_data },
   { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
   { "received_time",       vtype_int,         &received_time.tv_sec },
   { "recipient_data",      vtype_stringptr,   &recipient_data },
   { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },

-  { "recipients",          vtype_string_func, &fn_recipients },
+  { "recipients",          vtype_string_func, (void *) &fn_recipients },

   { "recipients_count",    vtype_int,         &recipients_count },
 #ifdef WITH_CONTENT_SCAN
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },
   { "recipients_count",    vtype_int,         &recipients_count },
 #ifdef WITH_CONTENT_SCAN
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },

-#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
-  { "requiretls",          vtype_bool,        &tls_requiretls },
-#endif

   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },
   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },


@@ -700,7 +700,7 @@ static var_entry var_table[] = {
   { "smtp_active_hostname", vtype_stringptr,  &smtp_active_hostname },
   { "smtp_command",        vtype_stringptr,   &smtp_cmd_buffer },
   { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
   { "smtp_active_hostname", vtype_stringptr,  &smtp_active_hostname },
   { "smtp_command",        vtype_stringptr,   &smtp_cmd_buffer },
   { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },

-  { "smtp_command_history", vtype_string_func, &smtp_cmd_hist },
+  { "smtp_command_history", vtype_string_func, (void *) &smtp_cmd_hist },

   { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
   { "smtp_notquit_reason", vtype_stringptr,   &smtp_notquit_reason },
   { "sn0",                 vtype_filter_int,  &filter_sn[0] },
   { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
   { "smtp_notquit_reason", vtype_stringptr,   &smtp_notquit_reason },
   { "sn0",                 vtype_filter_int,  &filter_sn[0] },


@@ -754,9 +754,13 @@ static var_entry var_table[] = {
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_in_resumption",   vtype_int,         &tls_in.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif

+  { "tls_in_ver",          vtype_stringptr,   &tls_in.ver },

   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
   { "tls_out_cipher",      vtype_stringptr,   &tls_out.cipher },
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
   { "tls_out_cipher",      vtype_stringptr,   &tls_out.cipher },


@@ -768,15 +772,19 @@ static var_entry var_table[] = {
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_out_resumption",  vtype_int,         &tls_out.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE
   { "tls_out_tlsa_usage",  vtype_int,         &tls_out.tlsa_usage },
 #endif
   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE
   { "tls_out_tlsa_usage",  vtype_int,         &tls_out.tlsa_usage },
 #endif

+  { "tls_out_ver",         vtype_stringptr,   &tls_out.ver },

 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */

-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS

   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 
   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 


@@ -962,7 +970,7 @@ weirdness they'll twist this into.  The result should ideally handle fork().
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 

-If SUPPORT_TLS is defined then this will not be used except as an emergency
+If DISABLE_TLS is not defined then this will not be used except as an emergency

 fallback.
 
 Arguments:
 fallback.
 
 Arguments:


@@ -970,56 +978,55 @@ Arguments:
 Returns     a random number in range [0, max-1]
 */
 
 Returns     a random number in range [0, max-1]
 */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {
 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # undef vaguely_random_number
 #endif
 # undef vaguely_random_number
 #endif

-  static pid_t pid = 0;
-  pid_t p2;
-#if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
-  struct timeval tv;
-#endif
+static pid_t pid = 0;
+pid_t p2;

 
 

-  p2 = getpid();
-  if (p2 != pid)
+if ((p2 = getpid()) != pid)
+  {
+  if (pid != 0)

     {
     {

-    if (pid != 0)
-      {

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-      /* cryptographically strong randomness, common on *BSD platforms, not
-      so much elsewhere.  Alas. */
-#ifndef NOT_HAVE_ARC4RANDOM_STIR
-      arc4random_stir();
-#endif
+    /* cryptographically strong randomness, common on *BSD platforms, not
+    so much elsewhere.  Alas. */
+# ifndef NOT_HAVE_ARC4RANDOM_STIR
+    arc4random_stir();
+# endif

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-#ifdef HAVE_SRANDOMDEV
-      /* uses random(4) for seeding */
-      srandomdev();
-#else
-      gettimeofday(&tv, NULL);
-      srandom(tv.tv_sec | tv.tv_usec | getpid());
-#endif
+# ifdef HAVE_SRANDOMDEV
+    /* uses random(4) for seeding */
+    srandomdev();
+# else
+    {
+    struct timeval tv;
+    gettimeofday(&tv, NULL);
+    srandom(tv.tv_sec | tv.tv_usec | getpid());
+    }
+# endif

 #else
 #else

-      /* Poor randomness and no seeding here */
+    /* Poor randomness and no seeding here */

 #endif
 
 #endif
 

-      }
-    pid = p2;

     }
     }

+  pid = p2;
+  }

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-  return arc4random() % max;
+return arc4random() % max;

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-  return random() % max;
+return random() % max;

 #else
 #else

-  /* This one returns a 16-bit number, definitely not crypto-strong */
-  return random_number(max);
+/* This one returns a 16-bit number, definitely not crypto-strong */
+return random_number(max);

 #endif
 }
 
 #endif
 }
 


@@ -1285,7 +1292,7 @@ return string_nextinlist(&list, &sep, NULL, 0);
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 typedef struct
 {
 uschar * name;
 typedef struct
 {
 uschar * name;


@@ -1346,7 +1353,7 @@ expand_string_message =
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
 /*************************************************
 *        Extract a substring from a string       *
 
 /*************************************************
 *        Extract a substring from a string       *


@@ -1769,8 +1776,13 @@ set, in which case give an error. */
 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
      !isalpha(name[5]))
   {
 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
      !isalpha(name[5]))
   {

-  tree_node *node =
-    tree_search((name[4] == 'c')? acl_var_c : acl_var_m, name + 4);
+  tree_node * node =
+    tree_search(name[4] == 'c' ? acl_var_c : acl_var_m, name + 4);
+  return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
+  }
+else if (Ustrncmp(name, "r_", 2) == 0)
+  {
+  tree_node * node = tree_search(router_var, name + 2);

   return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
   }
 
   return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
   }
 


@@ -1847,22 +1859,17 @@ switch (vp->type)
     return sender_host_name ? sender_host_name : US"";
 
   case vtype_localpart:                      /* Get local part from address */
     return sender_host_name ? sender_host_name : US"";
 
   case vtype_localpart:                      /* Get local part from address */

-    s = *((uschar **)(val));
-    if (s == NULL) return US"";
-    domain = Ustrrchr(s, '@');
-    if (domain == NULL) return s;
+    if (!(s = *((uschar **)(val)))) return US"";
+    if (!(domain = Ustrrchr(s, '@'))) return s;

     if (domain - s > sizeof(var_buffer) - 1)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
          " in string expansion", sizeof(var_buffer));
     if (domain - s > sizeof(var_buffer) - 1)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
          " in string expansion", sizeof(var_buffer));

-    Ustrncpy(var_buffer, s, domain - s);
-    var_buffer[domain - s] = 0;
-    return var_buffer;
+    return string_copyn(s, domain - s);

 
   case vtype_domain:                         /* Get domain from address */
 
   case vtype_domain:                         /* Get domain from address */

-    s = *((uschar **)(val));
-    if (s == NULL) return US"";
+    if (!(s = *((uschar **)(val)))) return US"";

     domain = Ustrrchr(s, '@');
     domain = Ustrrchr(s, '@');

-    return (domain == NULL)? US"" : domain + 1;
+    return domain ? domain + 1 : US"";

 
   case vtype_msgheaders:
     return find_header(NULL, newsize, exists_only ? FH_EXISTS_ONLY : 0, NULL);
 
   case vtype_msgheaders:
     return find_header(NULL, newsize, exists_only ? FH_EXISTS_ONLY : 0, NULL);


@@ -1957,7 +1964,7 @@ switch (vp->type)
 
   case vtype_string_func:
     {
 
   case vtype_string_func:
     {

-    uschar * (*fn)() = val;
+    stringptr_fn_t * fn = (stringptr_fn_t *) val;

     return fn();
     }
 
     return fn();
     }
 


@@ -2237,6 +2244,56 @@ return US item;
 
 
 
 
 
 

+/************************************************/
+/*  Return offset in ops table, or -1 if not found.
+Repoint to just after the operator in the string.
+
+Argument:
+ ss    string representation of operator
+ opname        split-out operator name
+*/
+
+static int
+identify_operator(const uschar ** ss, uschar ** opname)
+{
+const uschar * s = *ss;
+uschar name[256];
+
+/* Numeric comparisons are symbolic */
+
+if (*s == '=' || *s == '>' || *s == '<')
+  {
+  int p = 0;
+  name[p++] = *s++;
+  if (*s == '=')
+    {
+    name[p++] = '=';
+    s++;
+    }
+  name[p] = 0;
+  }
+
+/* All other conditions are named */
+
+else
+  s = read_name(name, sizeof(name), s, US"_");
+*ss = s;
+
+/* If we haven't read a name, it means some non-alpha character is first. */
+
+if (!name[0])
+  {
+  expand_string_message = string_sprintf("condition name expected, "
+    "but found \"%.16s\"", s);
+  return -1;
+  }
+if (opname)
+  *opname = string_copy(name);
+
+return chop_match(name, cond_table, nelem(cond_table));
+}
+
+

 /*************************************************
 *        Read and evaluate a condition           *
 *************************************************/
 /*************************************************
 *        Read and evaluate a condition           *
 *************************************************/


@@ -2267,6 +2324,7 @@ BOOL is_forany, is_json, is_jsons;
 int rc, cond_type, roffset;
 int_eximarith_t num[2];
 struct stat statbuf;
 int rc, cond_type, roffset;
 int_eximarith_t num[2];
 struct stat statbuf;

+uschar * opname;

 uschar name[256];
 const uschar *sub[10];
 
 uschar name[256];
 const uschar *sub[10];
 


@@ -2279,37 +2337,7 @@ for (;;)
   if (*s == '!') { testfor = !testfor; s++; } else break;
   }
 
   if (*s == '!') { testfor = !testfor; s++; } else break;
   }
 

-/* Numeric comparisons are symbolic */
-
-if (*s == '=' || *s == '>' || *s == '<')
-  {
-  int p = 0;
-  name[p++] = *s++;
-  if (*s == '=')
-    {
-    name[p++] = '=';
-    s++;
-    }
-  name[p] = 0;
-  }
-
-/* All other conditions are named */
-
-else s = read_name(name, 256, s, US"_");
-
-/* If we haven't read a name, it means some non-alpha character is first. */
-
-if (name[0] == 0)
-  {
-  expand_string_message = string_sprintf("condition name expected, "
-    "but found \"%.16s\"", s);
-  return NULL;
-  }
-
-/* Find which condition we are dealing with, and switch on it */
-
-cond_type = chop_match(name, cond_table, nelem(cond_table));
-switch(cond_type)
+switch(cond_type = identify_operator(&s, &opname))

   {
   /* def: tests for a non-empty variable, or for the existence of a header. If
   yield == NULL we are in a skipping state, and don't care about the answer. */
   {
   /* def: tests for a non-empty variable, or for the existence of a header. If
   yield == NULL we are in a skipping state, and don't care about the answer. */


@@ -2324,7 +2352,7 @@ switch(cond_type)
       return NULL;
       }
 
       return NULL;
       }
 

-    s = read_name(name, 256, s+1, US"_");
+    s = read_name(name, sizeof(name), s+1, US"_");

 
     /* Test for a header's existence. If the name contains a closing brace
     character, this may be a user error where the terminating colon has been
 
     /* Test for a header's existence. If the name contains a closing brace
     character, this may be a user error where the terminating colon has been


@@ -2336,7 +2364,7 @@ switch(cond_type)
        && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
        )
       {
        && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
        )
       {

-      s = read_header_name(name, 256, s);
+      s = read_header_name(name, sizeof(name), s);

       /* {-for-text-editors */
       if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
       if (yield) *yield =
       /* {-for-text-editors */
       if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
       if (yield) *yield =


@@ -2350,9 +2378,9 @@ switch(cond_type)
       {
       if (!(t = find_variable(name, TRUE, yield == NULL, NULL)))
        {
       {
       if (!(t = find_variable(name, TRUE, yield == NULL, NULL)))
        {

-       expand_string_message = (name[0] == 0)?
-         string_sprintf("variable name omitted after \"def:\"") :
-         string_sprintf("unknown variable \"%s\" after \"def:\"", name);
+       expand_string_message = name[0]
+         ? string_sprintf("unknown variable \"%s\" after \"def:\"", name)
+         : US"variable name omitted after \"def:\"";

        check_variable_error_message(name);
        return NULL;
        }
        check_variable_error_message(name);
        return NULL;
        }


@@ -2508,8 +2536,9 @@ switch(cond_type)
 
     if (yield != NULL)
       {
 
     if (yield != NULL)
       {

+      int rc;

       *resetok = FALSE;        /* eval_acl() might allocate; do not reclaim */
       *resetok = FALSE;        /* eval_acl() might allocate; do not reclaim */

-      switch(eval_acl(sub, nelem(sub), &user_msg))
+      switch(rc = eval_acl(sub, nelem(sub), &user_msg))

        {
        case OK:
          cond = TRUE;
        {
        case OK:
          cond = TRUE;


@@ -2524,7 +2553,8 @@ switch(cond_type)
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:

-          expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
+          expand_string_message = string_sprintf("%s from acl \"%s\"",
+           rc_names[rc], sub[0]);

          return NULL;
        }
       }
          return NULL;
        }
       }


@@ -2628,7 +2658,7 @@ switch(cond_type)
       {
       if (i == 0) goto COND_FAILED_CURLY_START;
       expand_string_message = string_sprintf("missing 2nd string in {} "
       {
       if (i == 0) goto COND_FAILED_CURLY_START;
       expand_string_message = string_sprintf("missing 2nd string in {} "

-        "after \"%s\"", name);
+        "after \"%s\"", opname);

       return NULL;
       }
     if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
       return NULL;
       }
     if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,


@@ -2643,7 +2673,7 @@ switch(cond_type)
     conditions that compare numbers do not start with a letter. This just saves
     checking for them individually. */
 
     conditions that compare numbers do not start with a letter. This just saves
     checking for them individually. */
 

-    if (!isalpha(name[0]) && yield != NULL)
+    if (!isalpha(opname[0]) && yield != NULL)

       if (sub[i][0] == 0)
         {
         num[i] = 0;
       if (sub[i][0] == 0)
         {
         num[i] = 0;


@@ -2955,7 +2985,7 @@ switch(cond_type)
       uschar *save_iterate_item = iterate_item;
       int (*compare)(const uschar *, const uschar *);
 
       uschar *save_iterate_item = iterate_item;
       int (*compare)(const uschar *, const uschar *);
 

-      DEBUG(D_expand) debug_printf_indent("condition: %s  item: %s\n", name, sub[0]);
+      DEBUG(D_expand) debug_printf_indent("condition: %s  item: %s\n", opname, sub[0]);

 
       tempcond = FALSE;
       compare = cond_type == ECOND_INLISTI
 
       tempcond = FALSE;
       compare = cond_type == ECOND_INLISTI


@@ -2997,14 +3027,14 @@ switch(cond_type)
     if (*s != '{')                                     /* }-for-text-editors */
       {
       expand_string_message = string_sprintf("each subcondition "
     if (*s != '{')                                     /* }-for-text-editors */
       {
       expand_string_message = string_sprintf("each subcondition "

-        "inside an \"%s{...}\" condition must be in its own {}", name);
+        "inside an \"%s{...}\" condition must be in its own {}", opname);

       return NULL;
       }
 
     if (!(s = eval_condition(s+1, resetok, subcondptr)))
       {
       expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
       return NULL;
       }
 
     if (!(s = eval_condition(s+1, resetok, subcondptr)))
       {
       expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",

-        expand_string_message, name);
+        expand_string_message, opname);

       return NULL;
       }
     while (isspace(*s)) s++;
       return NULL;
       }
     while (isspace(*s)) s++;


@@ -3014,7 +3044,7 @@ switch(cond_type)
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "

-        "inside \"%s\" group", name);
+        "inside \"%s\" group", opname);

       return NULL;
       }
 
       return NULL;
       }
 


@@ -3052,7 +3082,7 @@ switch(cond_type)
     int sep = 0;
     uschar *save_iterate_item = iterate_item;
 
     int sep = 0;
     uschar *save_iterate_item = iterate_item;
 

-    DEBUG(D_expand) debug_printf_indent("condition: %s\n", name);
+    DEBUG(D_expand) debug_printf_indent("condition: %s\n", opname);

 
     while (isspace(*s)) s++;
     if (*s++ != '{') goto COND_FAILED_CURLY_START;     /* }-for-text-editors */
 
     while (isspace(*s)) s++;
     if (*s++ != '{') goto COND_FAILED_CURLY_START;     /* }-for-text-editors */


@@ -3073,7 +3103,7 @@ switch(cond_type)
     if (!(s = eval_condition(sub[1], resetok, NULL)))
       {
       expand_string_message = string_sprintf("%s inside \"%s\" condition",
     if (!(s = eval_condition(sub[1], resetok, NULL)))
       {
       expand_string_message = string_sprintf("%s inside \"%s\" condition",

-        expand_string_message, name);
+        expand_string_message, opname);

       return NULL;
       }
     while (isspace(*s)) s++;
       return NULL;
       }
     while (isspace(*s)) s++;


@@ -3083,7 +3113,7 @@ switch(cond_type)
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "
       {
       /* {-for-text-editors */
       expand_string_message = string_sprintf("missing } at end of condition "

-        "inside \"%s\"", name);
+        "inside \"%s\"", opname);

       return NULL;
       }
 
       return NULL;
       }
 


@@ -3103,15 +3133,15 @@ switch(cond_type)
          return NULL;
          }
 
          return NULL;
          }
 

-      DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, iterate_item);
+      DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", opname, iterate_item);

       if (!eval_condition(sub[1], resetok, &tempcond))
         {
         expand_string_message = string_sprintf("%s inside \"%s\" condition",
       if (!eval_condition(sub[1], resetok, &tempcond))
         {
         expand_string_message = string_sprintf("%s inside \"%s\" condition",

-          expand_string_message, name);
+          expand_string_message, opname);

         iterate_item = save_iterate_item;
         return NULL;
         }
         iterate_item = save_iterate_item;
         return NULL;
         }

-      DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", name,
+      DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", opname,

         tempcond? "true":"false");
 
       if (yield) *yield = (tempcond == testfor);
         tempcond? "true":"false");
 
       if (yield) *yield = (tempcond == testfor);


@@ -3204,19 +3234,20 @@ switch(cond_type)
   /* Unknown condition */
 
   default:
   /* Unknown condition */
 
   default:

-  expand_string_message = string_sprintf("unknown condition \"%s\"", name);
-  return NULL;
+    if (!expand_string_message || !*expand_string_message)
+      expand_string_message = string_sprintf("unknown condition \"%s\"", opname);
+    return NULL;

   }   /* End switch on condition type */
 
 /* Missing braces at start and end of data */
 
 COND_FAILED_CURLY_START:
   }   /* End switch on condition type */
 
 /* Missing braces at start and end of data */
 
 COND_FAILED_CURLY_START:

-expand_string_message = string_sprintf("missing { after \"%s\"", name);
+expand_string_message = string_sprintf("missing { after \"%s\"", opname);

 return NULL;
 
 COND_FAILED_CURLY_END:
 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
 return NULL;
 
 COND_FAILED_CURLY_END:
 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",

-  name);
+  opname);

 return NULL;
 
 /* A condition requires code that is not compiled */
 return NULL;
 
 /* A condition requires code that is not compiled */


@@ -3226,7 +3257,7 @@ return NULL;
     !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
 COND_FAILED_NOT_COMPILED:
 expand_string_message = string_sprintf("support for \"%s\" not compiled",
     !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
 COND_FAILED_NOT_COMPILED:
 expand_string_message = string_sprintf("support for \"%s\" not compiled",

-  name);
+  opname);

 return NULL;
 #endif
 }
 return NULL;
 #endif
 }


@@ -3487,7 +3518,7 @@ Returns:       nothing
 */
 
 static void
 */
 
 static void

-chash_start(int type, void *base)
+chash_start(int type, void * base)

 {
 if (type == HMAC_MD5)
   md5_start((md5 *)base);
 {
 if (type == HMAC_MD5)
   md5_start((md5 *)base);


@@ -3496,7 +3527,7 @@ else
 }
 
 static void
 }
 
 static void

-chash_mid(int type, void *base, uschar *string)
+chash_mid(int type, void * base, const uschar * string)

 {
 if (type == HMAC_MD5)
   md5_mid((md5 *)base, string);
 {
 if (type == HMAC_MD5)
   md5_mid((md5 *)base, string);


@@ -3505,7 +3536,8 @@ else
 }
 
 static void
 }
 
 static void

-chash_end(int type, void *base, uschar *string, int length, uschar *digest)
+chash_end(int type, void * base, const uschar * string, int length,
+  uschar * digest)

 {
 if (type == HMAC_MD5)
   md5_end((md5 *)base, string, length, digest);
 {
 if (type == HMAC_MD5)
   md5_end((md5 *)base, string, length, digest);


@@ -3537,7 +3569,7 @@ Returns:  pointer to string containing the last three
 static uschar *
 prvs_daystamp(int day_offset)
 {
 static uschar *
 prvs_daystamp(int day_offset)
 {

-uschar *days = store_get(32);                /* Need at least 24 for cases */
+uschar *days = store_get(32, FALSE);         /* Need at least 24 for cases */

 (void)string_format(days, 32, TIME_T_FMT,    /* where TIME_T_FMT is %lld */
   (time(NULL) + day_offset*86400)/86400);
 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
 (void)string_format(days, 32, TIME_T_FMT,    /* where TIME_T_FMT is %lld */
   (time(NULL) + day_offset*86400)/86400);
 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";


@@ -3574,7 +3606,7 @@ uschar innerhash[20];
 uschar finalhash[20];
 uschar innerkey[64];
 uschar outerkey[64];
 uschar finalhash[20];
 uschar innerkey[64];
 uschar outerkey[64];

-uschar *finalhash_hex = store_get(40);
+uschar *finalhash_hex;

 
 if (key_num == NULL)
   key_num = US"0";
 
 if (key_num == NULL)
   key_num = US"0";


@@ -3607,7 +3639,9 @@ chash_start(HMAC_SHA1, &h);
 chash_mid(HMAC_SHA1, &h, outerkey);
 chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
 
 chash_mid(HMAC_SHA1, &h, outerkey);
 chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
 

-p = finalhash_hex;
+/* Hashing is deemed sufficient to de-taint any input data */
+
+p = finalhash_hex = store_get(40, FALSE);

 for (int i = 0; i < 3; i++)
   {
   *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
 for (int i = 0; i < 3; i++)
   {
   *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];


@@ -3656,7 +3690,7 @@ return yield;
 }
 
 
 }
 
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {
 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {


@@ -3705,17 +3739,15 @@ eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
 {
 uschar *s = *sptr;
 int_eximarith_t x = eval_op_or(&s, decimal, error);
 {
 uschar *s = *sptr;
 int_eximarith_t x = eval_op_or(&s, decimal, error);

-if (*error == NULL)
-  {
+
+if (!*error)

   if (endket)
   if (endket)

-    {

     if (*s != ')')
       *error = US"expecting closing parenthesis";
     else
       while (isspace(*(++s)));
     if (*s != ')')
       *error = US"expecting closing parenthesis";
     else
       while (isspace(*(++s)));

-    }
-  else if (*s != 0) *error = US"expecting operator";
-  }
+  else if (*s)
+    *error = US"expecting operator";

 *sptr = s;
 return x;
 }
 *sptr = s;
 return x;
 }


@@ -3724,12 +3756,12 @@ return x;
 static int_eximarith_t
 eval_number(uschar **sptr, BOOL decimal, uschar **error)
 {
 static int_eximarith_t
 eval_number(uschar **sptr, BOOL decimal, uschar **error)
 {

-register int c;
+int c;

 int_eximarith_t n;
 uschar *s = *sptr;
 int_eximarith_t n;
 uschar *s = *sptr;

+

 while (isspace(*s)) s++;
 while (isspace(*s)) s++;

-c = *s;
-if (isdigit(c))
+if (isdigit((c = *s)))

   {
   int count;
   (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
   {
   int count;
   (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);


@@ -3772,9 +3804,8 @@ if (*s == '+' || *s == '-' || *s == '~')
     else if (op == '~') x = ~x;
   }
 else
     else if (op == '~') x = ~x;
   }
 else

-  {

   x = eval_number(&s, decimal, error);
   x = eval_number(&s, decimal, error);

-  }
+

 *sptr = s;
 return x;
 }
 *sptr = s;
 return x;
 }


@@ -3953,6 +3984,56 @@ return x;
 
 
 
 
 
 

+/************************************************/
+/* Comparison operation for sort expansion.  We need to avoid
+re-expanding the fields being compared, so need a custom routine.
+
+Arguments:
+ cond_type             Comparison operator code
+ leftarg, rightarg     Arguments for comparison
+
+Return true iff (leftarg compare rightarg)
+*/
+
+static BOOL
+sortsbefore(int cond_type, BOOL alpha_cond,
+  const uschar * leftarg, const uschar * rightarg)
+{
+int_eximarith_t l_num, r_num;
+
+if (!alpha_cond)
+  {
+  l_num = expanded_string_integer(leftarg, FALSE);
+  if (expand_string_message) return FALSE;
+  r_num = expanded_string_integer(rightarg, FALSE);
+  if (expand_string_message) return FALSE;
+
+  switch (cond_type)
+    {
+    case ECOND_NUM_G:  return l_num >  r_num;
+    case ECOND_NUM_GE: return l_num >= r_num;
+    case ECOND_NUM_L:  return l_num <  r_num;
+    case ECOND_NUM_LE: return l_num <= r_num;
+    default: break;
+    }
+  }
+else
+  switch (cond_type)
+    {
+    case ECOND_STR_LT: return Ustrcmp (leftarg, rightarg) <  0;
+    case ECOND_STR_LTI:        return strcmpic(leftarg, rightarg) <  0;
+    case ECOND_STR_LE: return Ustrcmp (leftarg, rightarg) <= 0;
+    case ECOND_STR_LEI:        return strcmpic(leftarg, rightarg) <= 0;
+    case ECOND_STR_GT: return Ustrcmp (leftarg, rightarg) >  0;
+    case ECOND_STR_GTI:        return strcmpic(leftarg, rightarg) >  0;
+    case ECOND_STR_GE: return Ustrcmp (leftarg, rightarg) >= 0;
+    case ECOND_STR_GEI:        return strcmpic(leftarg, rightarg) >= 0;
+    default: break;
+    }
+return FALSE;  /* should not happen */
+}
+
+

 /*************************************************
 *                 Expand string                  *
 *************************************************/
 /*************************************************
 *                 Expand string                  *
 *************************************************/


@@ -4020,6 +4101,7 @@ static uschar *
 expand_string_internal(const uschar *string, BOOL ket_ends, const uschar **left,
   BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
 {
 expand_string_internal(const uschar *string, BOOL ket_ends, const uschar **left,
   BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
 {

+rmark reset_point = store_mark();

 gstring * yield = string_get(Ustrlen(string) + 64);
 int item_type;
 const uschar *s = string;
 gstring * yield = string_get(Ustrlen(string) + 64);
 int item_type;
 const uschar *s = string;


@@ -4042,6 +4124,14 @@ DEBUG(D_expand)
 f.expand_string_forcedfail = FALSE;
 expand_string_message = US"";
 
 f.expand_string_forcedfail = FALSE;
 expand_string_message = US"";
 

+if (is_tainted(string))
+  {
+  expand_string_message =
+    string_sprintf("attempt to expand tainted string '%s'", s);
+  log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
+  goto EXPAND_FAILED;
+  }
+

 while (*s != 0)
   {
   uschar *value;
 while (*s != 0)
   {
   uschar *value;


@@ -4113,12 +4203,13 @@ while (*s != 0)
     buffer. */
 
     if (!yield)
     buffer. */
 
     if (!yield)

-      g = store_get(sizeof(gstring));
+      g = store_get(sizeof(gstring), FALSE);

     else if (yield->ptr == 0)
       {
     else if (yield->ptr == 0)
       {

-      if (resetok) store_reset(yield);
+      if (resetok) reset_point = store_reset(reset_point);

       yield = NULL;
       yield = NULL;

-      g = store_get(sizeof(gstring));  /* alloc _before_ calling find_variable() */
+      reset_point = store_mark();
+      g = store_get(sizeof(gstring), FALSE);   /* alloc _before_ calling find_variable() */

       }
 
     /* Header */
       }
 
     /* Header */


@@ -4244,6 +4335,7 @@ while (*s != 0)
       {
       uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
       uschar *user_msg;
       {
       uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
       uschar *user_msg;

+      int rc;

 
       switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, US"acl",
                      &resetok))
 
       switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, US"acl",
                      &resetok))


@@ -4255,7 +4347,7 @@ while (*s != 0)
       if (skipping) continue;
 
       resetok = FALSE;
       if (skipping) continue;
 
       resetok = FALSE;

-      switch(eval_acl(sub, nelem(sub), &user_msg))
+      switch(rc = eval_acl(sub, nelem(sub), &user_msg))

        {
        case OK:
        case FAIL:
        {
        case OK:
        case FAIL:


@@ -4269,7 +4361,8 @@ while (*s != 0)
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:
           f.expand_string_forcedfail = TRUE;
          /*FALLTHROUGH*/
        default:

-          expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
+          expand_string_message = string_sprintf("%s from acl \"%s\"",
+           rc_names[rc], sub[0]);

          goto EXPAND_FAILED;
        }
       }
          goto EXPAND_FAILED;
        }
       }


@@ -4300,7 +4393,7 @@ while (*s != 0)
 #ifndef DISABLE_DKIM
       yield = authres_dkim(yield);
 #endif
 #ifndef DISABLE_DKIM
       yield = authres_dkim(yield);
 #endif

-#ifdef EXPERIMENTAL_DMARC
+#ifdef SUPPORT_DMARC

       yield = authres_dmarc(yield);
 #endif
 #ifdef EXPERIMENTAL_ARC
       yield = authres_dmarc(yield);
 #endif
 #ifdef EXPERIMENTAL_ARC


@@ -4937,13 +5030,13 @@ while (*s != 0)
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;

-      FILE * fp;
+      FILE * fp = NULL;

       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;
       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;

-      BOOL do_tls = FALSE;     /* Only set under SUPPORT_TLS */
+      BOOL do_tls = FALSE;     /* Only set under ! DISABLE_TLS */

       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)
       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)


@@ -4987,7 +5080,7 @@ while (*s != 0)
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif
          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif


@@ -5043,7 +5136,7 @@ while (*s != 0)
             port = ntohs(service_info->s_port);
             }
 
             port = ntohs(service_info->s_port);
             }
 

-         /*XXX we trust that the request is idempotent.  Hmm. */
+         /*XXX we trust that the request is idempotent for TFO.  Hmm. */

          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);
          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);


@@ -5094,7 +5187,7 @@ while (*s != 0)
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };
        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };


@@ -5110,7 +5203,7 @@ while (*s != 0)
 #endif
 
        /* Allow sequencing of test actions */
 #endif
 
        /* Allow sequencing of test actions */

-       if (f.running_in_test_harness) millisleep(100);
+       testharness_pause_ms(100);

 
         /* Write the request string, if not empty or already done */
 
 
         /* Write the request string, if not empty or already done */
 


@@ -5119,8 +5212,8 @@ while (*s != 0)
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (

-#ifdef SUPPORT_TLS
-             cctx.tls_ctx ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :
+#ifndef DISABLE_TLS
+             do_tls ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :

 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {
 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {


@@ -5135,27 +5228,27 @@ while (*s != 0)
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR

-       if (!cctx.tls_ctx && do_shutdown) shutdown(cctx.sock, SHUT_WR);
+       if (!do_tls && do_shutdown) shutdown(cctx.sock, SHUT_WR);

 #endif
 
 #endif
 

-       if (f.running_in_test_harness) millisleep(100);
+       testharness_pause_ms(100);

 
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 
 
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 

-       if (!cctx.tls_ctx)
+       if (!do_tls)

          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =
          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =

-#ifdef SUPPORT_TLS
-         cctx.tls_ctx ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :
+#ifndef DISABLE_TLS
+         do_tls ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :

 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 
 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 

-#ifdef SUPPORT_TLS
-       if (cctx.tls_ctx)
+#ifndef DISABLE_TLS
+       if (do_tls)

          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);
          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);


@@ -5298,7 +5391,7 @@ while (*s != 0)
           {
           if (sigalrm_seen || runrc == -256)
             {
           {
           if (sigalrm_seen || runrc == -256)
             {

-            expand_string_message = string_sprintf("command timed out");
+            expand_string_message = US"command timed out";

             killpg(pid, SIGKILL);       /* Kill the whole process group */
             }
 
             killpg(pid, SIGKILL);       /* Kill the whole process group */
             }
 


@@ -5840,8 +5933,8 @@ while (*s != 0)
                while (isspace(*s)) s++;
                if (*s != ':')
                  {
                while (isspace(*s)) s++;
                if (*s != ':')
                  {

-                 expand_string_message = string_sprintf(
-                   "missing object value-separator for extract json");
+                 expand_string_message =
+                   US"missing object value-separator for extract json";

                  goto EXPAND_FAILED_CURLY;
                  }
                s++;
                  goto EXPAND_FAILED_CURLY;
                  }
                s++;


@@ -5988,7 +6081,7 @@ while (*s != 0)
       continue;
       }
 
       continue;
       }
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;
     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;


@@ -6068,7 +6161,7 @@ while (*s != 0)
         save_expand_nlength);
       continue;
       }
         save_expand_nlength);
       continue;
       }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
     /* Handle list operations */
 
 
     /* Handle list operations */
 


@@ -6274,9 +6367,10 @@ while (*s != 0)
 
     case EITEM_SORT:
       {
 
     case EITEM_SORT:
       {

+      int cond_type;

       int sep = 0;
       const uschar *srclist, *cmp, *xtract;
       int sep = 0;
       const uschar *srclist, *cmp, *xtract;

-      uschar *srcitem;
+      uschar * opname, * srcitem;

       const uschar *dstlist = NULL, *dstkeylist = NULL;
       uschar * tmp;
       uschar *save_iterate_item = iterate_item;
       const uschar *dstlist = NULL, *dstkeylist = NULL;
       uschar * tmp;
       uschar *save_iterate_item = iterate_item;


@@ -6311,6 +6405,25 @@ while (*s != 0)
        goto EXPAND_FAILED_CURLY;
        }
 
        goto EXPAND_FAILED_CURLY;
        }
 

+      if ((cond_type = identify_operator(&cmp, &opname)) == -1)
+       {
+       if (!expand_string_message)
+         expand_string_message = string_sprintf("unknown condition \"%s\"", s);
+       goto EXPAND_FAILED;
+       }
+      switch(cond_type)
+       {
+       case ECOND_NUM_L: case ECOND_NUM_LE:
+       case ECOND_NUM_G: case ECOND_NUM_GE:
+       case ECOND_STR_GE: case ECOND_STR_GEI: case ECOND_STR_GT: case ECOND_STR_GTI:
+       case ECOND_STR_LE: case ECOND_STR_LEI: case ECOND_STR_LT: case ECOND_STR_LTI:
+         break;
+
+       default:
+         expand_string_message = US"comparator not handled for sort";
+         goto EXPAND_FAILED;
+       }
+

       while (isspace(*s)) s++;
       if (*s++ != '{')
         {
       while (isspace(*s)) s++;
       if (*s++ != '{')
         {


@@ -6319,8 +6432,8 @@ while (*s != 0)
        }
 
       xtract = s;
        }
 
       xtract = s;

-      tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
-      if (!tmp) goto EXPAND_FAILED;
+      if (!(tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok)))
+       goto EXPAND_FAILED;

       xtract = string_copyn(xtract, s - xtract);
 
       if (*s++ != '}')
       xtract = string_copyn(xtract, s - xtract);
 
       if (*s++ != '}')


@@ -6338,11 +6451,10 @@ while (*s != 0)
       if (skipping) continue;
 
       while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
       if (skipping) continue;
 
       while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))

-        {
-       uschar * dstitem;
+       {
+       uschar * srcfield, * dstitem;

        gstring * newlist = NULL;
        gstring * newkeylist = NULL;
        gstring * newlist = NULL;
        gstring * newkeylist = NULL;

-       uschar * srcfield;

 
         DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
 
 
         DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
 


@@ -6363,25 +6475,15 @@ while (*s != 0)
        while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
          {
          uschar * dstfield;
        while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
          {
          uschar * dstfield;

-         uschar * expr;
-         BOOL before;

 
          /* field for comparison */
          if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
            goto sort_mismatch;
 
 
          /* field for comparison */
          if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
            goto sort_mismatch;
 

-         /* build and run condition string */
-         expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield);
+         /* String-comparator names start with a letter; numeric names do not */

 
 

-         DEBUG(D_expand) debug_printf_indent("%s: cond = \"%s\"\n", name, expr);
-         if (!eval_condition(expr, &resetok, &before))
-           {
-           expand_string_message = string_sprintf("comparison in sort: %s",
-               expr);
-           goto EXPAND_FAILED;
-           }
-
-         if (before)
+         if (sortsbefore(cond_type, isalpha(opname[0]),
+             srcfield, dstfield))

            {
            /* New-item sorts before this dst-item.  Append new-item,
            then dst-item, then remainder of dst list. */
            {
            /* New-item sorts before this dst-item.  Append new-item,
            then dst-item, then remainder of dst list. */


@@ -6393,6 +6495,7 @@ while (*s != 0)
            newlist = string_append_listele(newlist, sep, dstitem);
            newkeylist = string_append_listele(newkeylist, sep, dstfield);
 
            newlist = string_append_listele(newlist, sep, dstitem);
            newkeylist = string_append_listele(newkeylist, sep, dstfield);
 

+/*XXX why field-at-a-time copy?  Why not just dup the rest of the list? */

            while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
              {
              if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
            while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
              {
              if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))


@@ -6488,7 +6591,7 @@ while (*s != 0)
           log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
           goto EXPAND_FAILED;
           }
           log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
           goto EXPAND_FAILED;
           }

-        t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]));
+        t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]), is_tainted(argv[0]));

         Ustrcpy(t->name, argv[0]);
         t->data.ptr = handle;
         (void)tree_insertnode(&dlobj_anchor, t);
         Ustrcpy(t->name, argv[0]);
         t->data.ptr = handle;
         (void)tree_insertnode(&dlobj_anchor, t);


@@ -6580,7 +6683,7 @@ while (*s != 0)
     int c;
     uschar *arg = NULL;
     uschar *sub;
     int c;
     uschar *arg = NULL;
     uschar *sub;

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     var_entry *vp = NULL;
 #endif
 
     var_entry *vp = NULL;
 #endif
 


@@ -6603,7 +6706,7 @@ while (*s != 0)
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:
       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:


@@ -6758,7 +6861,7 @@ while (*s != 0)
         }
 
       case EOP_MD5:
         }
 
       case EOP_MD5:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);


@@ -6777,7 +6880,7 @@ while (*s != 0)
         continue;
 
       case EOP_SHA1:
         continue;
 
       case EOP_SHA1:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);


@@ -6795,23 +6898,30 @@ while (*s != 0)
          }
         continue;
 
          }
         continue;
 

+      case EOP_SHA2:

       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)
       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)

-         {
-         uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
-         yield = string_cat(yield, cp);
-         }
+         if (c == EOP_SHA256)
+           yield = string_cat(yield, tls_cert_fprt_sha256(*(void **)vp->value));
+         else
+           expand_string_message = US"sha2_N not supported with certificates";

        else
          {
          hctx h;
          blob b;
        else
          {
          hctx h;
          blob b;

+         hashmethod m = !arg ? HASH_SHA2_256
+           : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
+           : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
+           : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
+           : HASH_BADTYPE;

 
 

-         if (!exim_sha_init(&h, HASH_SHA2_256))
+         if (m == HASH_BADTYPE || !exim_sha_init(&h, m))

            {
            {

-           expand_string_message = US"unrecognised sha256 variant";
+           expand_string_message = US"unrecognised sha2 variant";

            goto EXPAND_FAILED;
            }
            goto EXPAND_FAILED;
            }

+

          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)
          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)


@@ -6953,7 +7063,7 @@ while (*s != 0)
          case 'h': t = tree_search(hostlist_anchor,      sub); suffix = US"_h"; break;
          case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
          default:
          case 'h': t = tree_search(hostlist_anchor,      sub); suffix = US"_h"; break;
          case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
          default:

-            expand_string_message = string_sprintf("bad suffix on \"list\" operator");
+            expand_string_message = US"bad suffix on \"list\" operator";

            goto EXPAND_FAILED;
          }
 
            goto EXPAND_FAILED;
          }
 


@@ -7099,11 +7209,12 @@ while (*s != 0)
         uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
           FALSE);
         if (t)
         uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
           FALSE);
         if (t)

-         yield = c == EOP_DOMAIN
-           ? string_cat(yield, t + domain)
-           : c == EOP_LOCAL_PART && domain > 0
-           ? string_catn(yield, t, domain - 1 )
-           : string_cat(yield, t);
+         if (c != EOP_DOMAIN)
+           yield = c == EOP_LOCAL_PART && domain > 0
+             ? string_catn(yield, t, domain - 1)
+             : string_cat(yield, t);
+         else if (domain > 0)
+           yield = string_cat(yield, t + domain);

         continue;
         }
 
         continue;
         }
 


@@ -7548,7 +7659,7 @@ while (*s != 0)
       case EOP_STR2B64:
       case EOP_BASE64:
        {
       case EOP_STR2B64:
       case EOP_BASE64:
        {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));
        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));


@@ -7777,12 +7888,13 @@ while (*s != 0)
     gstring * g = NULL;
 
     if (!yield)
     gstring * g = NULL;
 
     if (!yield)

-      g = store_get(sizeof(gstring));
+      g = store_get(sizeof(gstring), FALSE);

     else if (yield->ptr == 0)
       {
     else if (yield->ptr == 0)
       {

-      if (resetok) store_reset(yield);
+      if (resetok) reset_point = store_reset(reset_point);

       yield = NULL;
       yield = NULL;

-      g = store_get(sizeof(gstring));  /* alloc _before_ calling find_variable() */
+      reset_point = store_mark();
+      g = store_get(sizeof(gstring), FALSE);   /* alloc _before_ calling find_variable() */

       }
     if (!(value = find_variable(name, FALSE, skipping, &newsize)))
       {
       }
     if (!(value = find_variable(name, FALSE, skipping, &newsize)))
       {


@@ -7836,15 +7948,20 @@ if (left) *left = s;
 In many cases the final string will be the first one that was got and so there
 will be optimal store usage. */
 
 In many cases the final string will be the first one that was got and so there
 will be optimal store usage. */
 

-if (resetok) store_reset(yield->s + (yield->size = yield->ptr + 1));
+if (resetok) gstring_release_unused(yield);

 else if (resetok_p) *resetok_p = FALSE;
 
 DEBUG(D_expand)
 else if (resetok_p) *resetok_p = FALSE;
 
 DEBUG(D_expand)

+  {
+  BOOL tainted = is_tainted(yield->s);

   DEBUG(D_noutf8)
     {
     debug_printf_indent("|--expanding: %.*s\n", (int)(s - string), string);
     debug_printf_indent("%sresult: %s\n",
       skipping ? "|-----" : "\\_____", yield->s);
   DEBUG(D_noutf8)
     {
     debug_printf_indent("|--expanding: %.*s\n", (int)(s - string), string);
     debug_printf_indent("%sresult: %s\n",
       skipping ? "|-----" : "\\_____", yield->s);

+    if (tainted)
+      debug_printf_indent("%s     \\__(tainted)\n",
+       skipping ? "|     " : "      ");

     if (skipping)
       debug_printf_indent("\\___skipping: result is not used\n");
     }
     if (skipping)
       debug_printf_indent("\\___skipping: result is not used\n");
     }


@@ -7853,15 +7970,19 @@ DEBUG(D_expand)
     debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
       "expanding: %.*s\n",
       (int)(s - string), string);
     debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
       "expanding: %.*s\n",
       (int)(s - string), string);

-    debug_printf_indent("%s"
-      UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
+    debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ

       "result: %s\n",
       skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
       yield->s);
       "result: %s\n",
       skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
       yield->s);

+    if (tainted)
+      debug_printf_indent("%s(tainted)\n",
+       skipping
+       ? UTF8_VERT "             " : "           " UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ);

     if (skipping)
       debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
        "skipping: result is not used\n");
     }
     if (skipping)
       debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
        "skipping: result is not used\n");
     }

+  }

 expand_level--;
 return yield->s;
 
 expand_level--;
 return yield->s;
 


@@ -8359,15 +8480,15 @@ if (opt_perl_startup != NULL)
   }
 #endif /* EXIM_PERL */
 
   }
 #endif /* EXIM_PERL */
 

+/* Thie deliberately regards the input as untainted, so that it can be
+expanded; only reasonable since this is a test for string-expansions. */
+

 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
   {
 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
   {

-  void *reset_point = store_get(0);
+  rmark reset_point = store_mark();

   uschar *yield = expand_string(buffer);
   uschar *yield = expand_string(buffer);

-  if (yield != NULL)
-    {
+  if (yield)

     printf("%s\n", yield);
     printf("%s\n", yield);

-    store_reset(reset_point);
-    }

   else
     {
     if (f.search_find_defer) printf("search_find deferred\n");
   else
     {
     if (f.search_find_defer) printf("search_find deferred\n");


@@ -8375,6 +8496,7 @@ while (fgets(buffer, sizeof(buffer), stdin) != NULL)
     if (f.expand_string_forcedfail) printf("Forced failure\n");
     printf("\n");
     }
     if (f.expand_string_forcedfail) printf("Forced failure\n");
     printf("\n");
     }

+  store_reset(reset_point);

   }
 
 search_tidyup();
   }
 
 search_tidyup();