X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/5fb822fc4839e253d2f839ba7966bc25a5329ac1..b7d3afcfad94edf99a8dbc50ab670ded417e6bea:/src/src/expand.c diff --git a/src/src/expand.c b/src/src/expand.c index 40b697a5d..a68849dc3 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -46,7 +46,7 @@ the first 8 characters of the password using a 20-round version of crypt (standard crypt does 25 rounds). It then crypts the next 8 characters, or an empty block if the password is less than 9 characters, using a 20-round version of crypt and the same salt as was used for the first -block. Charaters after the first 16 are ignored. It always generates +block. Characters after the first 16 are ignored. It always generates a 16-byte hash, which is expressed together with the salt as a string of 24 base 64 digits. Here are some links to peruse: @@ -199,12 +199,15 @@ enum { static uschar *op_table_main[] = { US"address", US"addresses", + US"base32", + US"base32d", US"base62", US"base62d", US"base64", US"base64d", US"domain", US"escape", + US"escape8bit", US"eval", US"eval10", US"expand", @@ -231,6 +234,7 @@ static uschar *op_table_main[] = { US"s", US"sha1", US"sha256", + US"sha3", US"stat", US"str2b64", US"strlen", @@ -241,12 +245,15 @@ static uschar *op_table_main[] = { enum { EOP_ADDRESS = nelem(op_table_underscore), EOP_ADDRESSES, + EOP_BASE32, + EOP_BASE32D, EOP_BASE62, EOP_BASE62D, EOP_BASE64, EOP_BASE64D, EOP_DOMAIN, EOP_ESCAPE, + EOP_ESCAPE8BIT, EOP_EVAL, EOP_EVAL10, EOP_EXPAND, @@ -273,6 +280,7 @@ enum { EOP_S, EOP_SHA1, EOP_SHA256, + EOP_SHA3, EOP_STAT, EOP_STR2B64, EOP_STRLEN, @@ -625,6 +633,7 @@ static var_entry var_table[] = { { "prvscheck_result", vtype_stringptr, &prvscheck_result }, { "qualify_domain", vtype_stringptr, &qualify_domain_sender }, { "qualify_recipient", vtype_stringptr, &qualify_domain_recipient }, + { "queue_name", vtype_stringptr, &queue_name }, { "rcpt_count", vtype_int, &rcpt_count }, { "rcpt_defer_count", vtype_int, &rcpt_defer_count }, { "rcpt_fail_count", vtype_int, &rcpt_fail_count }, @@ -835,6 +844,9 @@ static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01}; } + +static uschar * base32_chars = US"abcdefghijklmnopqrstuvwxyz234567"; + /************************************************* * Binary chop search on a table * *************************************************/ @@ -1542,11 +1554,9 @@ for (i = 0; i < 2; i++) int size = 0; header_line *h; - for (h = header_list; size < header_insert_maxlen && h != NULL; h = h->next) - { - if (h->type != htype_old && h->text != NULL) /* NULL => Received: placeholder */ - { - if (name == NULL || (len <= h->slen && strncmpic(name, h->text, len) == 0)) + for (h = header_list; size < header_insert_maxlen && h; h = h->next) + if (h->type != htype_old && h->text) /* NULL => Received: placeholder */ + if (!name || (len <= h->slen && strncmpic(name, h->text, len) == 0)) { int ilen; uschar *t; @@ -1568,7 +1578,7 @@ for (i = 0; i < 2; i++) that contains an address list, except when asked for raw headers. Only need to do this once. */ - if (!want_raw && name != NULL && comma == 0 && + if (!want_raw && name && comma == 0 && Ustrchr("BCFRST", h->type) != NULL) comma = 1; @@ -1577,7 +1587,7 @@ for (i = 0; i < 2; i++) size += ilen + comma + 1; /* +1 for the newline */ - /* Second pass - concatentate the data, up to a maximum. Note that + /* Second pass - concatenate the data, up to a maximum. Note that the loop stops when size hits the limit. */ if (i != 0) @@ -1601,8 +1611,6 @@ for (i = 0; i < 2; i++) } } } - } - } /* At end of first pass, return NULL if no header found. Then truncate size if necessary, and get the buffer to hold the data, returning the buffer size. @@ -1620,9 +1628,7 @@ for (i = 0; i < 2; i++) /* That's all we do for raw header expansion. */ if (want_raw) - { *ptr = 0; - } /* Otherwise, remove a final newline and a redundant added comma. Then we do RFC 2047 decoding, translating the charset if requested. The rfc2047_decode2() @@ -1826,7 +1832,7 @@ switch (vp->type) case vtype_msgbody: /* Pointer to msgbody string */ case vtype_msgbody_end: /* Ditto, the end of the msg */ ss = (uschar **)(val); - if (*ss == NULL && deliver_datafile >= 0) /* Read body when needed */ + if (!*ss && deliver_datafile >= 0) /* Read body when needed */ { uschar *body; off_t start_offset = SPOOL_DATA_START_OFFSET; @@ -1859,7 +1865,7 @@ switch (vp->type) { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; } } } - return (*ss == NULL)? US"" : *ss; + return *ss ? *ss : US""; case vtype_todbsdin: /* BSD inbox time of day */ return tod_stamp(tod_bsdin); @@ -1954,6 +1960,7 @@ return; /* Unknown variable name, fail silently */ + /************************************************* * Read and expand substrings * *************************************************/ @@ -2086,7 +2093,7 @@ while (i < nsub) } DEBUG(D_expand) - debug_printf("expanding: acl: %s arg: %s%s\n", + debug_printf_indent("expanding: acl: %s arg: %s%s\n", sub[0], acl_narg>0 ? acl_arg[0] : US"", acl_narg>1 ? " +more" : ""); @@ -2506,19 +2513,17 @@ switch(cond_type) checking for them individually. */ if (!isalpha(name[0]) && yield != NULL) - { if (sub[i][0] == 0) { num[i] = 0; DEBUG(D_expand) - debug_printf("empty string cast to zero for numerical comparison\n"); + debug_printf_indent("empty string cast to zero for numerical comparison\n"); } else { num[i] = expanded_string_integer(sub[i], FALSE); if (expand_string_message != NULL) return NULL; } - } } /* Result not required */ @@ -2686,7 +2691,7 @@ switch(cond_type) uschar digest[16]; md5_start(&base); - md5_end(&base, (uschar *)sub[0], Ustrlen(sub[0]), digest); + md5_end(&base, sub[0], Ustrlen(sub[0]), digest); /* If the length that we are comparing against is 24, the MD5 digest is expressed as a base64 string. This is the way LDAP does it. However, @@ -2695,7 +2700,7 @@ switch(cond_type) if (sublen == 24) { - uschar *coded = b64encode((uschar *)digest, 16); + uschar *coded = b64encode(digest, 16); DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+5); tempcond = (Ustrcmp(coded, sub[1]+5) == 0); @@ -2725,7 +2730,7 @@ switch(cond_type) uschar digest[20]; sha1_start(&h); - sha1_end(&h, (uschar *)sub[0], Ustrlen(sub[0]), digest); + sha1_end(&h, sub[0], Ustrlen(sub[0]), digest); /* If the length that we are comparing against is 28, assume the SHA1 digest is expressed as a base64 string. If the length is 40, assume a @@ -2733,7 +2738,7 @@ switch(cond_type) if (sublen == 28) { - uschar *coded = b64encode((uschar *)digest, 20); + uschar *coded = b64encode(digest, 20); DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+6); tempcond = (Ustrcmp(coded, sub[1]+6) == 0); @@ -2821,7 +2826,7 @@ switch(cond_type) uschar *save_iterate_item = iterate_item; int (*compare)(const uschar *, const uschar *); - DEBUG(D_expand) debug_printf("condition: %s\n", name); + DEBUG(D_expand) debug_printf_indent("condition: %s\n", name); tempcond = FALSE; compare = cond_type == ECOND_INLISTI @@ -2909,7 +2914,7 @@ switch(cond_type) int sep = 0; uschar *save_iterate_item = iterate_item; - DEBUG(D_expand) debug_printf("condition: %s\n", name); + DEBUG(D_expand) debug_printf_indent("condition: %s\n", name); while (isspace(*s)) s++; if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ @@ -2948,7 +2953,7 @@ switch(cond_type) list = sub[0]; while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL) { - DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item); + DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, iterate_item); if (!eval_condition(sub[1], resetok, &tempcond)) { expand_string_message = string_sprintf("%s inside \"%s\" condition", @@ -2956,7 +2961,7 @@ switch(cond_type) iterate_item = save_iterate_item; return NULL; } - DEBUG(D_expand) debug_printf("%s: condition evaluated to %s\n", name, + DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", name, tempcond? "true":"false"); if (yield != NULL) *yield = (tempcond == testfor); @@ -3013,7 +3018,7 @@ switch(cond_type) } } DEBUG(D_expand) - debug_printf("considering %s: %s\n", ourname, len ? t : US""); + debug_printf_indent("considering %s: %s\n", ourname, len ? t : US""); /* logic for the lax case from expand_check_condition(), which also does expands, and the logic is both short and stable enough that there should be no maintenance burden from replicating it. */ @@ -3040,6 +3045,8 @@ switch(cond_type) "value \"%s\"", t); return NULL; } + DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", ourname, + boolvalue? "true":"false"); if (yield != NULL) *yield = (boolvalue == testfor); return s; } @@ -3183,11 +3190,12 @@ if (*s == '}') { if (type[0] == 'i') { - if (yes) *yieldptr = string_catn(*yieldptr, sizeptr, ptrptr, US"true", 4); + if (yes && !skipping) + *yieldptr = string_catn(*yieldptr, sizeptr, ptrptr, US"true", 4); } else { - if (yes && lookup_value) + if (yes && lookup_value && !skipping) *yieldptr = string_cat(*yieldptr, sizeptr, ptrptr, lookup_value); lookup_value = save_lookup; } @@ -3433,7 +3441,7 @@ hash_source = string_catn(hash_source, &size, &offset, daystamp, 3); hash_source = string_cat(hash_source, &size, &offset, address); hash_source[offset] = '\0'; -DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source); +DEBUG(D_expand) debug_printf_indent("prvs: hash source is '%s'\n", hash_source); memset(innerkey, 0x36, 64); memset(outerkey, 0x5c, 64); @@ -3487,7 +3495,6 @@ Returns: new value of string pointer static uschar * cat_file(FILE *f, uschar *yield, int *sizep, int *ptrp, uschar *eol) { -int eollen = eol ? Ustrlen(eol) : 0; uschar buffer[1024]; while (Ufgets(buffer, sizeof(buffer), f)) @@ -3495,8 +3502,8 @@ while (Ufgets(buffer, sizeof(buffer), f)) int len = Ustrlen(buffer); if (eol && buffer[len-1] == '\n') len--; yield = string_catn(yield, sizep, ptrp, buffer, len); - if (buffer[len] != 0) - yield = string_catn(yield, sizep, ptrp, eol, eollen); + if (eol && buffer[len]) + yield = string_cat(yield, sizep, ptrp, eol); } if (yield) yield[*ptrp] = 0; @@ -3623,7 +3630,7 @@ if (*error == NULL) /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where - * -N*M is INT_MIN will yielf INT_MIN. + * -N*M is INT_MIN will yield INT_MIN. * Since we don't support floating point, this is somewhat simpler. * Ideally, we'd return an error, but since we overflow for all other * arithmetic, consistency suggests otherwise, but what's the correct value @@ -3801,7 +3808,7 @@ them here in detail any more. We use an internal routine recursively to handle embedded substrings. The external function follows. The yield is NULL if the expansion failed, and there are two cases: if something collapsed syntactically, or if "fail" was given -as the action on a lookup failure. These can be distinguised by looking at the +as the action on a lookup failure. These can be distinguished by looking at the variable expand_string_forcedfail, which is TRUE in the latter case. The skipping flag is set true when expanding a substring that isn't actually @@ -3857,8 +3864,13 @@ uschar *save_expand_nstring[EXPAND_MAXN+1]; int save_expand_nlength[EXPAND_MAXN+1]; BOOL resetok = TRUE; +expand_level++; DEBUG(D_expand) - debug_printf("%s: %s\n", skipping ? " scanning" : "considering", string); + debug_printf_indent(UTF8_DOWN_RIGHT "%s: %s\n", + skipping + ? UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ "scanning" + : "considering", + string); expand_string_forcedfail = FALSE; expand_string_message = US""; @@ -4073,7 +4085,7 @@ while (*s != 0) case OK: case FAIL: DEBUG(D_expand) - debug_printf("acl expansion yield: %s\n", user_msg); + debug_printf_indent("acl expansion yield: %s\n", user_msg); if (user_msg) yield = string_cat(yield, &size, &ptr, user_msg); continue; @@ -4100,12 +4112,19 @@ while (*s != 0) save_expand_strings(save_expand_nstring, save_expand_nlength); while (isspace(*s)) s++; - next_s = eval_condition(s, &resetok, skipping? NULL : &cond); + next_s = eval_condition(s, &resetok, skipping ? NULL : &cond); if (next_s == NULL) goto EXPAND_FAILED; /* message already set */ DEBUG(D_expand) - debug_printf("condition: %.*s\n result: %s\n", (int)(next_s - s), s, - cond? "true" : "false"); + { + debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ + "condition: %.*s\n", + (int)(next_s - s), s); + debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ + UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ + "result: %s\n", + cond ? "true" : "false"); + } s = next_s; @@ -4163,11 +4182,13 @@ while (*s != 0) goto EXPAND_FAILED; } - if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset, - sub_arg[1][0], sub_arg[2], &expand_string_message))) - goto EXPAND_FAILED; if (!skipping) + { + if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset, + sub_arg[1][0], sub_arg[2], &expand_string_message))) + goto EXPAND_FAILED; yield = string_cat(yield, &size, &ptr, encoded); + } continue; } #endif @@ -4560,11 +4581,11 @@ while (*s != 0) uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]); uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]); - DEBUG(D_expand) debug_printf("prvscheck localpart: %s\n", local_part); - DEBUG(D_expand) debug_printf("prvscheck key number: %s\n", key_num); - DEBUG(D_expand) debug_printf("prvscheck daystamp: %s\n", daystamp); - DEBUG(D_expand) debug_printf("prvscheck hash: %s\n", hash); - DEBUG(D_expand) debug_printf("prvscheck domain: %s\n", domain); + DEBUG(D_expand) debug_printf_indent("prvscheck localpart: %s\n", local_part); + DEBUG(D_expand) debug_printf_indent("prvscheck key number: %s\n", key_num); + DEBUG(D_expand) debug_printf_indent("prvscheck daystamp: %s\n", daystamp); + DEBUG(D_expand) debug_printf_indent("prvscheck hash: %s\n", hash); + DEBUG(D_expand) debug_printf_indent("prvscheck domain: %s\n", domain); /* Set up expansion variables */ prvscheck_address = string_cat (NULL, &mysize, &myptr, local_part); @@ -4592,8 +4613,8 @@ while (*s != 0) goto EXPAND_FAILED; } - DEBUG(D_expand) debug_printf("prvscheck: received hash is %s\n", hash); - DEBUG(D_expand) debug_printf("prvscheck: own hash is %s\n", p); + DEBUG(D_expand) debug_printf_indent("prvscheck: received hash is %s\n", hash); + DEBUG(D_expand) debug_printf_indent("prvscheck: own hash is %s\n", p); if (Ustrcmp(p,hash) == 0) { @@ -4611,18 +4632,18 @@ while (*s != 0) if (iexpire >= inow) { prvscheck_result = US"1"; - DEBUG(D_expand) debug_printf("prvscheck: success, $pvrs_result set to 1\n"); + DEBUG(D_expand) debug_printf_indent("prvscheck: success, $pvrs_result set to 1\n"); } else { prvscheck_result = NULL; - DEBUG(D_expand) debug_printf("prvscheck: signature expired, $pvrs_result unset\n"); + DEBUG(D_expand) debug_printf_indent("prvscheck: signature expired, $pvrs_result unset\n"); } } else { prvscheck_result = NULL; - DEBUG(D_expand) debug_printf("prvscheck: hash failure, $pvrs_result unset\n"); + DEBUG(D_expand) debug_printf_indent("prvscheck: hash failure, $pvrs_result unset\n"); } /* Now expand the final argument. We leave this till now so that @@ -4645,7 +4666,6 @@ while (*s != 0) prvscheck_keynum = NULL; } else - { /* Does not look like a prvs encoded address, return the empty string. We need to make sure all subs are expanded first, so as to skip over the entire item. */ @@ -4656,7 +4676,6 @@ while (*s != 0) case 2: case 3: goto EXPAND_FAILED; } - } continue; } @@ -4710,8 +4729,9 @@ while (*s != 0) struct sockaddr_un sockun; /* don't call this "sun" ! */ uschar *arg; uschar *sub_arg[4]; + BOOL do_shutdown = TRUE; - if ((expand_forbid & RDO_READSOCK) != 0) + if (expand_forbid & RDO_READSOCK) { expand_string_message = US"socket insertions are not permitted"; goto EXPAND_FAILED; @@ -4727,17 +4747,27 @@ while (*s != 0) case 3: goto EXPAND_FAILED; } - /* Sort out timeout, if given */ + /* Sort out timeout, if given. The second arg is a list with the first element + being a time value. Any more are options of form "name=value". Currently the + only option recognised is "shutdown". */ - if (sub_arg[2] != NULL) + if (sub_arg[2]) { - timeout = readconf_readtime(sub_arg[2], 0, FALSE); - if (timeout < 0) + const uschar * list = sub_arg[2]; + uschar * item; + int sep = 0; + + item = string_nextinlist(&list, &sep, NULL, 0); + if ((timeout = readconf_readtime(item, 0, FALSE)) < 0) { - expand_string_message = string_sprintf("bad time value %s", - sub_arg[2]); + expand_string_message = string_sprintf("bad time value %s", item); goto EXPAND_FAILED; } + + while ((item = string_nextinlist(&list, &sep, NULL, 0))) + if (Ustrncmp(item, US"shutdown=", 9) == 0) + if (Ustrcmp(item + 9, US"no") == 0) + do_shutdown = FALSE; } else sub_arg[3] = NULL; /* No eol if no timeout */ @@ -4787,8 +4817,10 @@ while (*s != 0) port = ntohs(service_info->s_port); } - if ((fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port, - timeout, NULL, &expand_string_message)) < 0) + fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port, + timeout, NULL, &expand_string_message); + callout_address = NULL; + if (fd < 0) goto SOCK_FAIL; } @@ -4825,7 +4857,7 @@ while (*s != 0) } } - DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]); + DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]); /* Allow sequencing of test actions */ if (running_in_test_harness) millisleep(100); @@ -4835,7 +4867,7 @@ while (*s != 0) if (sub_arg[1][0] != 0) { int len = Ustrlen(sub_arg[1]); - DEBUG(D_expand) debug_printf("writing \"%s\" to socket\n", + DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n", sub_arg[1]); if (write(fd, sub_arg[1], len) != len) { @@ -4849,9 +4881,9 @@ while (*s != 0) recognise that it is their turn to do some work. Just in case some system doesn't have this function, make it conditional. */ - #ifdef SHUT_WR - shutdown(fd, SHUT_WR); - #endif +#ifdef SHUT_WR + if (do_shutdown) shutdown(fd, SHUT_WR); +#endif if (running_in_test_harness) millisleep(100); @@ -4891,7 +4923,7 @@ while (*s != 0) while (isspace(*s)) s++; } - readsock_done: + READSOCK_DONE: if (*s++ != '}') { expand_string_message = US"missing '}' closing readsocket"; @@ -4903,7 +4935,7 @@ while (*s != 0) socket, or timeout on reading. If another substring follows, expand and use it. Otherwise, those conditions give expand errors. */ - SOCK_FAIL: + SOCK_FAIL: if (*s != '{') goto EXPAND_FAILED; DEBUG(D_any) debug_printf("%s\n", expand_string_message); if (!(arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok))) @@ -4915,7 +4947,7 @@ while (*s != 0) goto EXPAND_FAILED_CURLY; } while (isspace(*s)) s++; - goto readsock_done; + goto READSOCK_DONE; } /* Handle "run" to execute a program. */ @@ -4951,7 +4983,10 @@ while (*s != 0) } if (skipping) /* Just pretend it worked when we're skipping */ + { runrc = 0; + lookup_value = NULL; + } else { if (!transport_set_up_command(&argv, /* anchor for arg list */ @@ -4993,9 +5028,9 @@ while (*s != 0) return code for serious disasters. Simple non-zero returns are passed on. */ - if (sigalrm_seen == TRUE || (runrc = child_close(pid, 30)) < 0) + if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0) { - if (sigalrm_seen == TRUE || runrc == -256) + if (sigalrm_seen || runrc == -256) { expand_string_message = string_sprintf("command timed out"); killpg(pid, SIGKILL); /* Kill the whole process group */ @@ -5165,79 +5200,81 @@ while (*s != 0) case 3: goto EXPAND_FAILED; } - if (Ustrcmp(sub[0], "md5") == 0) - { - type = HMAC_MD5; - use_base = &md5_base; - hashlen = 16; - hashblocklen = 64; - } - else if (Ustrcmp(sub[0], "sha1") == 0) - { - type = HMAC_SHA1; - use_base = &sha1_ctx; - hashlen = 20; - hashblocklen = 64; - } - else - { - expand_string_message = - string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]); - goto EXPAND_FAILED; - } + if (!skipping) + { + if (Ustrcmp(sub[0], "md5") == 0) + { + type = HMAC_MD5; + use_base = &md5_base; + hashlen = 16; + hashblocklen = 64; + } + else if (Ustrcmp(sub[0], "sha1") == 0) + { + type = HMAC_SHA1; + use_base = &sha1_ctx; + hashlen = 20; + hashblocklen = 64; + } + else + { + expand_string_message = + string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]); + goto EXPAND_FAILED; + } - keyptr = sub[1]; - keylen = Ustrlen(keyptr); + keyptr = sub[1]; + keylen = Ustrlen(keyptr); - /* If the key is longer than the hash block length, then hash the key - first */ + /* If the key is longer than the hash block length, then hash the key + first */ - if (keylen > hashblocklen) - { - chash_start(type, use_base); - chash_end(type, use_base, keyptr, keylen, keyhash); - keyptr = keyhash; - keylen = hashlen; - } + if (keylen > hashblocklen) + { + chash_start(type, use_base); + chash_end(type, use_base, keyptr, keylen, keyhash); + keyptr = keyhash; + keylen = hashlen; + } - /* Now make the inner and outer key values */ + /* Now make the inner and outer key values */ - memset(innerkey, 0x36, hashblocklen); - memset(outerkey, 0x5c, hashblocklen); + memset(innerkey, 0x36, hashblocklen); + memset(outerkey, 0x5c, hashblocklen); - for (i = 0; i < keylen; i++) - { - innerkey[i] ^= keyptr[i]; - outerkey[i] ^= keyptr[i]; - } + for (i = 0; i < keylen; i++) + { + innerkey[i] ^= keyptr[i]; + outerkey[i] ^= keyptr[i]; + } - /* Now do the hashes */ + /* Now do the hashes */ - chash_start(type, use_base); - chash_mid(type, use_base, innerkey); - chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash); + chash_start(type, use_base); + chash_mid(type, use_base, innerkey); + chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash); - chash_start(type, use_base); - chash_mid(type, use_base, outerkey); - chash_end(type, use_base, innerhash, hashlen, finalhash); + chash_start(type, use_base); + chash_mid(type, use_base, outerkey); + chash_end(type, use_base, innerhash, hashlen, finalhash); - /* Encode the final hash as a hex string */ + /* Encode the final hash as a hex string */ - p = finalhash_hex; - for (i = 0; i < hashlen; i++) - { - *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4]; - *p++ = hex_digits[finalhash[i] & 0x0f]; - } + p = finalhash_hex; + for (i = 0; i < hashlen; i++) + { + *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4]; + *p++ = hex_digits[finalhash[i] & 0x0f]; + } - DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%.*s)=%.*s\n", sub[0], - (int)keylen, keyptr, Ustrlen(sub[2]), sub[2], hashlen*2, finalhash_hex); + DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n", + sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex); - yield = string_catn(yield, &size, &ptr, finalhash_hex, hashlen*2); + yield = string_catn(yield, &size, &ptr, finalhash_hex, hashlen*2); + } + continue; } - continue; - /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator. We have to save the numerical variables and restore them afterwards. */ @@ -5368,7 +5405,7 @@ while (*s != 0) /* While skipping we cannot rely on the data for expansions being available (eg. $item) hence cannot decide on numeric vs. keyed. - Read a maximum of 5 arguments (inclding the yes/no) */ + Read a maximum of 5 arguments (including the yes/no) */ if (skipping) { @@ -5778,11 +5815,12 @@ while (*s != 0) processing for real, we perform the iteration. */ if (skipping) continue; - while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL) + while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0))) { *outsep = (uschar)sep; /* Separator as a string */ - DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, iterate_item); + DEBUG(D_expand) debug_printf_indent("%s: $item = '%s' $value = '%s'\n", + name, iterate_item, lookup_value); if (item_type == EITEM_FILTER) { @@ -5795,7 +5833,7 @@ while (*s != 0) expand_string_message, name); goto EXPAND_FAILED; } - DEBUG(D_expand) debug_printf("%s: condition is %s\n", name, + DEBUG(D_expand) debug_printf_indent("%s: condition is %s\n", name, condresult? "true":"false"); if (condresult) temp = iterate_item; /* TRUE => include this item */ @@ -5950,7 +5988,7 @@ while (*s != 0) uschar * newkeylist = NULL; uschar * srcfield; - DEBUG(D_expand) debug_printf("%s: $item = \"%s\"\n", name, srcitem); + DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem); /* extract field for comparisons */ iterate_item = srcitem; @@ -5979,7 +6017,7 @@ while (*s != 0) /* build and run condition string */ expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield); - DEBUG(D_expand) debug_printf("%s: cond = \"%s\"\n", name, expr); + DEBUG(D_expand) debug_printf_indent("%s: cond = \"%s\"\n", name, expr); if (!eval_condition(expr, &resetok, &before)) { expand_string_message = string_sprintf("comparison in sort: %s", @@ -6024,8 +6062,8 @@ while (*s != 0) dstlist = newlist; dstkeylist = newkeylist; - DEBUG(D_expand) debug_printf("%s: dstlist = \"%s\"\n", name, dstlist); - DEBUG(D_expand) debug_printf("%s: dstkeylist = \"%s\"\n", name, dstkeylist); + DEBUG(D_expand) debug_printf_indent("%s: dstlist = \"%s\"\n", name, dstlist); + DEBUG(D_expand) debug_printf_indent("%s: dstkeylist = \"%s\"\n", name, dstkeylist); } if (dstlist) @@ -6255,6 +6293,47 @@ while (*s != 0) switch(c) { + case EOP_BASE32: + { + uschar *t; + unsigned long int n = Ustrtoul(sub, &t, 10); + uschar * s = NULL; + int sz = 0, i = 0; + + if (*t != 0) + { + expand_string_message = string_sprintf("argument for base32 " + "operator is \"%s\", which is not a decimal number", sub); + goto EXPAND_FAILED; + } + for ( ; n; n >>= 5) + s = string_catn(s, &sz, &i, &base32_chars[n & 0x1f], 1); + + while (i > 0) yield = string_catn(yield, &size, &ptr, &s[--i], 1); + continue; + } + + case EOP_BASE32D: + { + uschar *tt = sub; + unsigned long int n = 0; + uschar * s; + while (*tt) + { + uschar * t = Ustrchr(base32_chars, *tt++); + if (t == NULL) + { + expand_string_message = string_sprintf("argument for base32d " + "operator is \"%s\", which is not a base 32 number", sub); + goto EXPAND_FAILED; + } + n = n * 32 + (t - base32_chars); + } + s = string_sprintf("%ld", n); + yield = string_cat(yield, &size, &ptr, s); + continue; + } + case EOP_BASE62: { uschar *t; @@ -6364,22 +6443,74 @@ while (*s != 0) sha1_start(&h); sha1_end(&h, sub, Ustrlen(sub), digest); for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]); - yield = string_cat(yield, &size, &ptr, US st); + yield = string_catn(yield, &size, &ptr, US st, 40); } continue; case EOP_SHA256: -#ifdef SUPPORT_TLS +#ifdef EXIM_HAVE_SHA2 if (vp && *(void **)vp->value) { uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value); yield = string_cat(yield, &size, &ptr, cp); } else + { + hctx h; + blob b; + char st[3]; + + if (!exim_sha_init(&h, HASH_SHA256)) + { + expand_string_message = US"unrecognised sha256 variant"; + goto EXPAND_FAILED; + } + exim_sha_update(&h, sub, Ustrlen(sub)); + exim_sha_finish(&h, &b); + while (b.len-- > 0) + { + sprintf(st, "%02X", *b.data++); + yield = string_catn(yield, &size, &ptr, US st, 2); + } + } +#else + expand_string_message = US"sha256 only supported with TLS"; #endif - expand_string_message = US"sha256 only supported for certificates"; continue; + case EOP_SHA3: +#ifdef EXIM_HAVE_SHA3 + { + hctx h; + blob b; + char st[3]; + hashmethod m = !arg ? HASH_SHA3_256 + : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224 + : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256 + : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384 + : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512 + : HASH_BADTYPE; + + if (m == HASH_BADTYPE || !exim_sha_init(&h, m)) + { + expand_string_message = US"unrecognised sha3 variant"; + goto EXPAND_FAILED; + } + + exim_sha_update(&h, sub, Ustrlen(sub)); + exim_sha_finish(&h, &b); + while (b.len-- > 0) + { + sprintf(st, "%02X", *b.data++); + yield = string_catn(yield, &size, &ptr, US st, 2); + } + } + continue; +#else + expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 +"; + goto EXPAND_FAILED; +#endif + /* Convert hex encoding to base64 encoding */ case EOP_HEX2B64: @@ -6629,12 +6760,11 @@ while (*s != 0) case EOP_LOCAL_PART: case EOP_DOMAIN: { - uschar *error; + uschar * error; int start, end, domain; - uschar *t = parse_extract_address(sub, &error, &start, &end, &domain, + uschar * t = parse_extract_address(sub, &error, &start, &end, &domain, FALSE); - if (t != NULL) - { + if (t) if (c != EOP_DOMAIN) { if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1; @@ -6645,7 +6775,6 @@ while (*s != 0) domain += start; yield = string_catn(yield, &size, &ptr, sub+domain, end-domain); } - } continue; } @@ -6981,7 +7110,7 @@ while (*s != 0) goto EXPAND_FAILED; } yield = string_cat(yield, &size, &ptr, s); - DEBUG(D_expand) debug_printf("yield: '%s'\n", yield); + DEBUG(D_expand) debug_printf_indent("yield: '%s'\n", yield); continue; } @@ -7005,11 +7134,23 @@ while (*s != 0) case EOP_ESCAPE: { - const uschar *t = string_printing(sub); + const uschar * t = string_printing(sub); yield = string_cat(yield, &size, &ptr, t); continue; } + case EOP_ESCAPE8BIT: + { + const uschar * s = sub; + uschar c; + + for (s = sub; (c = *s); s++) + yield = c < 127 && c != '\\' + ? string_catn(yield, &size, &ptr, s, 1) + : string_catn(yield, &size, &ptr, string_sprintf("\\%03o", c), 4); + continue; + } + /* Handle numeric expression evaluation */ case EOP_EVAL: @@ -7307,8 +7448,7 @@ while (*s != 0) yield = NULL; size = 0; } - value = find_variable(name, FALSE, skipping, &newsize); - if (value == NULL) + if (!(value = find_variable(name, FALSE, skipping, &newsize))) { expand_string_message = string_sprintf("unknown variable in \"${%s}\"", name); @@ -7316,13 +7456,14 @@ while (*s != 0) goto EXPAND_FAILED; } len = Ustrlen(value); - if (yield == NULL && newsize != 0) + if (!yield && newsize) { yield = value; size = newsize; ptr = len; } - else yield = string_catn(yield, &size, &ptr, value, len); + else + yield = string_catn(yield, &size, &ptr, value, len); continue; } @@ -7363,10 +7504,19 @@ else if (resetok_p) *resetok_p = FALSE; DEBUG(D_expand) { - debug_printf(" expanding: %.*s\n result: %s\n", (int)(s - string), string, + debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ + "expanding: %.*s\n", + (int)(s - string), string); + debug_printf_indent("%s" + UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ + "result: %s\n", + skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT, yield); - if (skipping) debug_printf(" skipping: result is not used\n"); + if (skipping) + debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ + "skipping: result is not used\n"); } +expand_level--; return yield; /* This is the failure exit: easiest to program with a goto. We still need @@ -7388,11 +7538,17 @@ EXPAND_FAILED: if (left != NULL) *left = s; DEBUG(D_expand) { - debug_printf("failed to expand: %s\n", string); - debug_printf(" error message: %s\n", expand_string_message); - if (expand_string_forcedfail) debug_printf("failure was forced\n"); + debug_printf_indent(UTF8_VERT_RIGHT "failed to expand: %s\n", + string); + debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ + "error message: %s\n", + expand_string_forcedfail ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT, + expand_string_message); + if (expand_string_forcedfail) + debug_printf_indent(UTF8_UP_RIGHT "failure was forced\n"); } if (resetok_p) *resetok_p = resetok; +expand_level--; return NULL; } @@ -7519,7 +7675,7 @@ if (isspace(*s)) if (*s == '\0') { DEBUG(D_expand) - debug_printf("treating blank string as number 0\n"); + debug_printf_indent("treating blank string as number 0\n"); return 0; } } @@ -7653,6 +7809,60 @@ return ( ( Ustrstr(s, "failed to expand") != NULL +/************************************************* +* Error-checking for testsuite * +*************************************************/ +typedef struct { + const char * filename; + int linenumber; + uschar * region_start; + uschar * region_end; + const uschar *var_name; + const uschar *var_data; +} err_ctx; + +static void +assert_variable_notin(uschar * var_name, uschar * var_data, void * ctx) +{ +err_ctx * e = ctx; +if (var_data >= e->region_start && var_data < e->region_end) + { + e->var_name = CUS var_name; + e->var_data = CUS var_data; + } +} + +void +assert_no_variables(void * ptr, int len, const char * filename, int linenumber) +{ +err_ctx e = {filename, linenumber, ptr, US ptr + len, NULL }; +int i; +var_entry * v; + +/* check acl_ variables */ +tree_walk(acl_var_c, assert_variable_notin, &e); +tree_walk(acl_var_m, assert_variable_notin, &e); + +/* check auth variables */ +for (i = 0; i < AUTH_VARS; i++) if (auth_vars[i]) + assert_variable_notin(US"auth", auth_vars[i], &e); + +/* check regex variables */ +for (i = 0; i < REGEX_VARS; i++) if (regex_vars[i]) + assert_variable_notin(US"regex", regex_vars[i], &e); + +/* check known-name variables */ +for (v = var_table; v < var_table + var_table_size; v++) + if (v->type == vtype_stringptr) + assert_variable_notin(US v->name, *(USS v->value), &e); + +if (e.var_name) + log_write(0, LOG_MAIN|LOG_PANIC_DIE, + "live variable '%s' destroyed by reset_store at %s:%d\n- value '%.64s'", + e.var_name, e.filename, e.linenumber, e.var_data); +} + + /************************************************* **************************************************