X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/c58803fd11185cbcf673e99cebf8397c9194357a..b008f54f89a3e1a0aae0c301122820b87a84d21a:/src/src/verify.c diff --git a/src/src/verify.c b/src/src/verify.c index e12c3f46c..9955bd1ff 100644 --- a/src/src/verify.c +++ b/src/src/verify.c @@ -574,6 +574,7 @@ else { smtp_transport_options_block *ob = (smtp_transport_options_block *)addr->transport->options_block; + smtp_context * sx = NULL; /* The information wasn't available in the cache, so we have to do a real callout and save the result in the cache for next time, unless no_cache is set, @@ -630,7 +631,6 @@ coding means skipping this whole loop and doing the append separately. */ int host_af; int port = 25; uschar * interface = NULL; /* Outgoing interface to use; NULL => any */ - smtp_context * sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */ if (!host->address) { @@ -670,6 +670,9 @@ coding means skipping this whole loop and doing the append separately. */ log_write(0, LOG_MAIN|LOG_PANIC, "<%s>: %s", addr->address, addr->message); + if (!sx) sx = store_get(sizeof(*sx), TRUE); /* tainted buffers */ + memset(sx, 0, sizeof(*sx)); + sx->addrlist = addr; sx->conn_args.host = host; sx->conn_args.host_af = host_af, @@ -2257,7 +2260,7 @@ for (header_line * h = header_list; h && yield == OK; h = h->next) colon = Ustrchr(h->text, ':'); s = colon + 1; - while (isspace(*s)) s++; + Uskip_whitespace(&s); /* Loop for multiple addresses in the header, enabling group syntax. Note that we have to reset this after the header has been scanned. */ @@ -2291,7 +2294,7 @@ for (header_line * h = header_list; h && yield == OK; h = h->next) { if (!f.allow_unqualified_recipient) recipient = NULL; } - if (recipient == NULL) errmess = US"unqualified address not permitted"; + if (!recipient) errmess = US"unqualified address not permitted"; } /* It's an error if no address could be extracted, except for the special @@ -2336,7 +2339,7 @@ for (header_line * h = header_list; h && yield == OK; h = h->next) /* Advance to the next address */ s = ss + (terminator ? 1 : 0); - while (isspace(*s)) s++; + Uskip_whitespace(&s); } /* Next address */ f.parse_allow_group = FALSE; @@ -2414,7 +2417,7 @@ for (int i = 0; i < recipients_count; i++) colon = Ustrchr(h->text, ':'); s = colon + 1; - while (isspace(*s)) s++; + Uskip_whitespace(&s); /* Loop for multiple addresses in the header, enabling group syntax. Note that we have to reset this after the header has been scanned. */ @@ -2452,7 +2455,7 @@ for (int i = 0; i < recipients_count; i++) /* Advance to the next address */ s = ss + (terminator ? 1:0); - while (isspace(*s)) s++; + Uskip_whitespace(&s); } /* Next address */ f.parse_allow_group = FALSE; @@ -2605,7 +2608,7 @@ for (int i = 0; i < 3 && !done; i++) /* If we found an empty address, just carry on with the next one, but kill the message. */ - if (address == NULL && Ustrcmp(*log_msgptr, "empty address") == 0) + if (!address && Ustrcmp(*log_msgptr, "empty address") == 0) { *log_msgptr = NULL; s = ss; @@ -2616,7 +2619,7 @@ for (int i = 0; i < 3 && !done; i++) function, and ensure that the failing address gets added to the error message. */ - if (address == NULL) + if (!address) { new_ok = FAIL; while (ss > s && isspace(ss[-1])) ss--; @@ -2887,7 +2890,7 @@ BOOL iplookup = FALSE; BOOL isquery = FALSE; BOOL isiponly = cb->host_name != NULL && cb->host_name[0] == 0; const uschar *t; -uschar *semicolon; +uschar * semicolon, * endname, * opts; uschar **aliases; /* Optimize for the special case when the pattern is "*". */ @@ -2906,7 +2909,6 @@ provided that host name matching is permitted; if it's "@[]" match against the local host's IP addresses. */ if (*ss == '@') - { if (ss[1] == 0) { if (isiponly) return ERROR; @@ -2918,7 +2920,6 @@ if (*ss == '@') if (Ustrcmp(ip->address, cb->host_address) == 0) return OK; return FAIL; } - } /* If the pattern is an IP address, optionally followed by a bitmask count, do a (possibly masked) comparison with the current IP address. */ @@ -2944,17 +2945,26 @@ if (*t == 0 || (*t == '/' && t != ss)) return ERROR; } -/* See if there is a semicolon in the pattern */ +/* See if there is a semicolon in the pattern, separating a searchtype +prefix. If there is one then check for comma-sep options. */ -semicolon = Ustrchr(ss, ';'); +if ((semicolon = Ustrchr(ss, ';'))) + if ((opts = Ustrchr(ss, ',')) && opts < semicolon) + { + endname = opts++; + opts = string_copyn(opts, semicolon - opts); + } + else + { + endname = semicolon; + opts = NULL; + } /* If we are doing an IP address only match, then all lookups must be IP address lookups, even if there is no "net-". */ if (isiponly) - { iplookup = semicolon != NULL; - } /* Otherwise, if the item is of the form net[n]-lookup; then it is a lookup on a masked IP network, in textual form. We obey this code even if we @@ -2964,12 +2974,12 @@ key is implicit. For query-style lookups the key is specified in the query. From release 4.30, the use of net- for query style is no longer needed, but we retain it for backward compatibility. */ -if (Ustrncmp(ss, "net", 3) == 0 && semicolon != NULL) +if (Ustrncmp(ss, "net", 3) == 0 && semicolon) { mlen = 0; for (t = ss + 3; isdigit(*t); t++) mlen = mlen * 10 + *t - '0'; if (mlen == 0 && t == ss+3) mlen = -1; /* No mask supplied */ - iplookup = (*t++ == '-'); + iplookup = *t++ == '-'; } else t = ss; @@ -2987,7 +2997,7 @@ if (iplookup) /* Find the search type */ - search_type = search_findtype(t, semicolon - t); + search_type = search_findtype(t, endname - t); if (search_type < 0) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message); @@ -3030,7 +3040,7 @@ if (iplookup) if (!(handle = search_open(filename, search_type, 0, NULL, NULL))) log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s", search_error_message); - result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL); + result = search_find(handle, filename, key, -1, NULL, 0, 0, NULL, opts); if (valueptr) *valueptr = result; return result ? OK : f.search_find_defer ? DEFER: FAIL; } @@ -3088,7 +3098,7 @@ using the general string matching function. When this function is called for outgoing hosts, the name is always given explicitly. If it is NULL, it means we must use sender_host_name and its aliases, looking them up if necessary. */ -if (cb->host_name != NULL) /* Explicit host name given */ +if (cb->host_name) /* Explicit host name given */ return match_check_string(cb->host_name, ss, -1, TRUE, TRUE, TRUE, valueptr); @@ -3098,13 +3108,14 @@ query does not contain $sender_host_name. From release 4.23, a reference to $sender_host_name causes it to be looked up, so we don't need to do the lookup on spec. */ -if ((semicolon = Ustrchr(ss, ';')) != NULL) +if ((semicolon = Ustrchr(ss, ';'))) { - const uschar *affix; + const uschar * affix, * opts; int partial, affixlen, starflags, id; *semicolon = 0; - id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags); + id = search_findtype_partial(ss, &partial, &affix, &affixlen, &starflags, + &opts); *semicolon=';'; if (id < 0) /* Unknown lookup type */ @@ -3380,11 +3391,13 @@ dns_scan dnss; tree_node *t; dnsbl_cache_block *cb; int old_pool = store_pool; -uschar query[256]; /* DNS domain max length */ +uschar * query; +int qlen; /* Construct the specific query domainname */ -if (!string_format(query, sizeof(query), "%s.%s", prepend, domain)) +query = string_sprintf("%s.%s", prepend, domain); +if ((qlen = Ustrlen(query)) >= 256) { log_write(0, LOG_MAIN|LOG_PANIC, "dnslist query is too long " "(ignored): %s...", query); @@ -3419,7 +3432,7 @@ else else { /* Set up a tree entry to cache the lookup */ - t = store_get(sizeof(tree_node) + Ustrlen(query), is_tainted(query)); + t = store_get(sizeof(tree_node) + qlen + 1 + 1, is_tainted(query)); Ustrcpy(t->name, query); t->data.ptr = cb = store_get(sizeof(dnsbl_cache_block), FALSE); (void)tree_insertnode(&dnsbl_cache, t); @@ -3526,7 +3539,6 @@ if (cb->rc == DNS_SUCCEED) for (da = cb->rhs; da; da = da->next) { int ipsep = ','; - uschar ip[46]; const uschar *ptr = iplist; uschar *res; @@ -3534,8 +3546,8 @@ if (cb->rc == DNS_SUCCEED) if (!bitmask) { - while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip)))) - if (Ustrcmp(CS da->address, ip) == 0) + while ((res = string_nextinlist(&ptr, &ipsep, NULL, 0))) + if (Ustrcmp(CS da->address, res) == 0) break; } @@ -3557,9 +3569,9 @@ if (cb->rc == DNS_SUCCEED) /* Scan the returned addresses, skipping any that are IPv6 */ - while ((res = string_nextinlist(&ptr, &ipsep, ip, sizeof(ip)))) + while ((res = string_nextinlist(&ptr, &ipsep, NULL, 0))) { - if (host_aton(ip, address) != 1) continue; + if (host_aton(res, address) != 1) continue; if ((address[0] & mask) == address[0]) break; } } @@ -3729,7 +3741,6 @@ int sep = 0; int defer_return = FAIL; const uschar *list = *listptr; uschar *domain; -uschar buffer[1024]; uschar revadd[128]; /* Long enough for IPv6 address */ /* Indicate that the inverted IP address is not yet set up */ @@ -3742,7 +3753,7 @@ dns_init(FALSE, FALSE, FALSE); /*XXX dnssec? */ /* Loop through all the domains supplied, until something matches */ -while ((domain = string_nextinlist(&list, &sep, buffer, sizeof(buffer)))) +while ((domain = string_nextinlist(&list, &sep, NULL, 0))) { int rc; BOOL bitmask = FALSE;