1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* Copyright (c) The Exim Maintainers 2020 */
7 /* See the file NOTICE for conditions of use and distribution. */
10 /* Functions for handling string expansion. */
15 /* Recursively called function */
17 static uschar *expand_string_internal(const uschar *, BOOL, const uschar **, BOOL, BOOL, BOOL *);
18 static int_eximarith_t expanded_string_integer(const uschar *, BOOL);
21 # ifndef SUPPORT_CRYPTEQ
22 # define SUPPORT_CRYPTEQ
27 # include "lookups/ldap.h"
30 #ifdef SUPPORT_CRYPTEQ
35 extern char* crypt16(char*, char*);
39 /* The handling of crypt16() is a mess. I will record below the analysis of the
40 mess that was sent to me. We decided, however, to make changing this very low
41 priority, because in practice people are moving away from the crypt()
42 algorithms nowadays, so it doesn't seem worth it.
45 There is an algorithm named "crypt16" in Ultrix and Tru64. It crypts
46 the first 8 characters of the password using a 20-round version of crypt
47 (standard crypt does 25 rounds). It then crypts the next 8 characters,
48 or an empty block if the password is less than 9 characters, using a
49 20-round version of crypt and the same salt as was used for the first
50 block. Characters after the first 16 are ignored. It always generates
51 a 16-byte hash, which is expressed together with the salt as a string
52 of 24 base 64 digits. Here are some links to peruse:
54 http://cvs.pld.org.pl/pam/pamcrypt/crypt16.c?rev=1.2
55 http://seclists.org/bugtraq/1999/Mar/0076.html
57 There's a different algorithm named "bigcrypt" in HP-UX, Digital Unix,
58 and OSF/1. This is the same as the standard crypt if given a password
59 of 8 characters or less. If given more, it first does the same as crypt
60 using the first 8 characters, then crypts the next 8 (the 9th to 16th)
61 using as salt the first two base 64 digits from the first hash block.
62 If the password is more than 16 characters then it crypts the 17th to 24th
63 characters using as salt the first two base 64 digits from the second hash
64 block. And so on: I've seen references to it cutting off the password at
65 40 characters (5 blocks), 80 (10 blocks), or 128 (16 blocks). Some links:
67 http://cvs.pld.org.pl/pam/pamcrypt/bigcrypt.c?rev=1.2
68 http://seclists.org/bugtraq/1999/Mar/0109.html
69 http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/HTML/AA-Q0R2D-
70 TET1_html/sec.c222.html#no_id_208
72 Exim has something it calls "crypt16". It will either use a native
73 crypt16 or its own implementation. A native crypt16 will presumably
74 be the one that I called "crypt16" above. The internal "crypt16"
75 function, however, is a two-block-maximum implementation of what I called
76 "bigcrypt". The documentation matches the internal code.
78 I suspect that whoever did the "crypt16" stuff for Exim didn't realise
79 that crypt16 and bigcrypt were different things.
81 Exim uses the LDAP-style scheme identifier "{crypt16}" to refer
82 to whatever it is using under that name. This unfortunately sets a
83 precedent for using "{crypt16}" to identify two incompatible algorithms
84 whose output can't be distinguished. With "{crypt16}" thus rendered
85 ambiguous, I suggest you deprecate it and invent two new identifiers
86 for the two algorithms.
88 Both crypt16 and bigcrypt are very poor algorithms, btw. Hashing parts
89 of the password separately means they can be cracked separately, so
90 the double-length hash only doubles the cracking effort instead of
91 squaring it. I recommend salted SHA-1 ({SSHA}), or the Blowfish-based
98 /*************************************************
99 * Local statics and tables *
100 *************************************************/
102 /* Table of item names, and corresponding switch numbers. The names must be in
103 alphabetical order. */
105 static uschar *item_table[] = {
175 /* Tables of operator names, and corresponding switch numbers. The names must be
176 in alphabetical order. There are two tables, because underscore is used in some
177 cases to introduce arguments, whereas for other it is part of the name. This is
178 an historical mis-design. */
180 static uschar *op_table_underscore[] = {
183 US"quote_local_part",
188 ,US"utf8_domain_from_alabel",
189 US"utf8_domain_to_alabel",
190 US"utf8_localpart_from_alabel",
191 US"utf8_localpart_to_alabel"
198 EOP_QUOTE_LOCAL_PART,
203 ,EOP_UTF8_DOMAIN_FROM_ALABEL,
204 EOP_UTF8_DOMAIN_TO_ALABEL,
205 EOP_UTF8_LOCALPART_FROM_ALABEL,
206 EOP_UTF8_LOCALPART_TO_ALABEL
210 static uschar *op_table_main[] = {
259 EOP_ADDRESS = nelem(op_table_underscore),
307 /* Table of condition names, and corresponding switch numbers. The names must
308 be in alphabetical order. */
310 static uschar *cond_table[] = {
314 US"==", /* Backward compatibility */
354 US"match_local_part",
380 ECOND_FIRST_DELIVERY,
408 ECOND_MATCH_LOCAL_PART,
419 /* Types of table entry */
422 vtype_int, /* value is address of int */
423 vtype_filter_int, /* ditto, but recognized only when filtering */
424 vtype_ino, /* value is address of ino_t (not always an int) */
425 vtype_uid, /* value is address of uid_t (not always an int) */
426 vtype_gid, /* value is address of gid_t (not always an int) */
427 vtype_bool, /* value is address of bool */
428 vtype_stringptr, /* value is address of pointer to string */
429 vtype_msgbody, /* as stringptr, but read when first required */
430 vtype_msgbody_end, /* ditto, the end of the message */
431 vtype_msgheaders, /* the message's headers, processed */
432 vtype_msgheaders_raw, /* the message's headers, unprocessed */
433 vtype_localpart, /* extract local part from string */
434 vtype_domain, /* extract domain from string */
435 vtype_string_func, /* value is string returned by given function */
436 vtype_todbsdin, /* value not used; generate BSD inbox tod */
437 vtype_tode, /* value not used; generate tod in epoch format */
438 vtype_todel, /* value not used; generate tod in epoch/usec format */
439 vtype_todf, /* value not used; generate full tod */
440 vtype_todl, /* value not used; generate log tod */
441 vtype_todlf, /* value not used; generate log file datestamp tod */
442 vtype_todzone, /* value not used; generate time zone only */
443 vtype_todzulu, /* value not used; generate zulu tod */
444 vtype_reply, /* value not used; get reply from headers */
445 vtype_pid, /* value not used; result is pid */
446 vtype_host_lookup, /* value not used; get host name */
447 vtype_load_avg, /* value not used; result is int from os_getloadavg */
448 vtype_pspace, /* partition space; value is T/F for spool/log */
449 vtype_pinodes, /* partition inodes; value is T/F for spool/log */
450 vtype_cert /* SSL certificate */
452 ,vtype_dkim /* Lookup of value in DKIM signature */
456 /* Type for main variable table */
464 /* Type for entries pointing to address/length pairs. Not currently
472 static uschar * fn_recipients(void);
473 typedef uschar * stringptr_fn_t(void);
474 static uschar * fn_queue_size(void);
476 /* This table must be kept in alphabetical order. */
478 static var_entry var_table[] = {
479 /* WARNING: Do not invent variables whose names start acl_c or acl_m because
480 they will be confused with user-creatable ACL variables. */
481 { "acl_arg1", vtype_stringptr, &acl_arg[0] },
482 { "acl_arg2", vtype_stringptr, &acl_arg[1] },
483 { "acl_arg3", vtype_stringptr, &acl_arg[2] },
484 { "acl_arg4", vtype_stringptr, &acl_arg[3] },
485 { "acl_arg5", vtype_stringptr, &acl_arg[4] },
486 { "acl_arg6", vtype_stringptr, &acl_arg[5] },
487 { "acl_arg7", vtype_stringptr, &acl_arg[6] },
488 { "acl_arg8", vtype_stringptr, &acl_arg[7] },
489 { "acl_arg9", vtype_stringptr, &acl_arg[8] },
490 { "acl_narg", vtype_int, &acl_narg },
491 { "acl_verify_message", vtype_stringptr, &acl_verify_message },
492 { "address_data", vtype_stringptr, &deliver_address_data },
493 { "address_file", vtype_stringptr, &address_file },
494 { "address_pipe", vtype_stringptr, &address_pipe },
495 #ifdef EXPERIMENTAL_ARC
496 { "arc_domains", vtype_string_func, (void *) &fn_arc_domains },
497 { "arc_oldest_pass", vtype_int, &arc_oldest_pass },
498 { "arc_state", vtype_stringptr, &arc_state },
499 { "arc_state_reason", vtype_stringptr, &arc_state_reason },
501 { "authenticated_fail_id",vtype_stringptr, &authenticated_fail_id },
502 { "authenticated_id", vtype_stringptr, &authenticated_id },
503 { "authenticated_sender",vtype_stringptr, &authenticated_sender },
504 { "authentication_failed",vtype_int, &authentication_failed },
505 #ifdef WITH_CONTENT_SCAN
506 { "av_failed", vtype_int, &av_failed },
508 #ifdef EXPERIMENTAL_BRIGHTMAIL
509 { "bmi_alt_location", vtype_stringptr, &bmi_alt_location },
510 { "bmi_base64_tracker_verdict", vtype_stringptr, &bmi_base64_tracker_verdict },
511 { "bmi_base64_verdict", vtype_stringptr, &bmi_base64_verdict },
512 { "bmi_deliver", vtype_int, &bmi_deliver },
514 { "body_linecount", vtype_int, &body_linecount },
515 { "body_zerocount", vtype_int, &body_zerocount },
516 { "bounce_recipient", vtype_stringptr, &bounce_recipient },
517 { "bounce_return_size_limit", vtype_int, &bounce_return_size_limit },
518 { "caller_gid", vtype_gid, &real_gid },
519 { "caller_uid", vtype_uid, &real_uid },
520 { "callout_address", vtype_stringptr, &callout_address },
521 { "compile_date", vtype_stringptr, &version_date },
522 { "compile_number", vtype_stringptr, &version_cnumber },
523 { "config_dir", vtype_stringptr, &config_main_directory },
524 { "config_file", vtype_stringptr, &config_main_filename },
525 { "csa_status", vtype_stringptr, &csa_status },
526 #ifdef EXPERIMENTAL_DCC
527 { "dcc_header", vtype_stringptr, &dcc_header },
528 { "dcc_result", vtype_stringptr, &dcc_result },
531 { "dkim_algo", vtype_dkim, (void *)DKIM_ALGO },
532 { "dkim_bodylength", vtype_dkim, (void *)DKIM_BODYLENGTH },
533 { "dkim_canon_body", vtype_dkim, (void *)DKIM_CANON_BODY },
534 { "dkim_canon_headers", vtype_dkim, (void *)DKIM_CANON_HEADERS },
535 { "dkim_copiedheaders", vtype_dkim, (void *)DKIM_COPIEDHEADERS },
536 { "dkim_created", vtype_dkim, (void *)DKIM_CREATED },
537 { "dkim_cur_signer", vtype_stringptr, &dkim_cur_signer },
538 { "dkim_domain", vtype_stringptr, &dkim_signing_domain },
539 { "dkim_expires", vtype_dkim, (void *)DKIM_EXPIRES },
540 { "dkim_headernames", vtype_dkim, (void *)DKIM_HEADERNAMES },
541 { "dkim_identity", vtype_dkim, (void *)DKIM_IDENTITY },
542 { "dkim_key_granularity",vtype_dkim, (void *)DKIM_KEY_GRANULARITY },
543 { "dkim_key_length", vtype_int, &dkim_key_length },
544 { "dkim_key_nosubdomains",vtype_dkim, (void *)DKIM_NOSUBDOMAINS },
545 { "dkim_key_notes", vtype_dkim, (void *)DKIM_KEY_NOTES },
546 { "dkim_key_srvtype", vtype_dkim, (void *)DKIM_KEY_SRVTYPE },
547 { "dkim_key_testing", vtype_dkim, (void *)DKIM_KEY_TESTING },
548 { "dkim_selector", vtype_stringptr, &dkim_signing_selector },
549 { "dkim_signers", vtype_stringptr, &dkim_signers },
550 { "dkim_verify_reason", vtype_stringptr, &dkim_verify_reason },
551 { "dkim_verify_status", vtype_stringptr, &dkim_verify_status },
554 { "dmarc_domain_policy", vtype_stringptr, &dmarc_domain_policy },
555 { "dmarc_status", vtype_stringptr, &dmarc_status },
556 { "dmarc_status_text", vtype_stringptr, &dmarc_status_text },
557 { "dmarc_used_domain", vtype_stringptr, &dmarc_used_domain },
559 { "dnslist_domain", vtype_stringptr, &dnslist_domain },
560 { "dnslist_matched", vtype_stringptr, &dnslist_matched },
561 { "dnslist_text", vtype_stringptr, &dnslist_text },
562 { "dnslist_value", vtype_stringptr, &dnslist_value },
563 { "domain", vtype_stringptr, &deliver_domain },
564 { "domain_data", vtype_stringptr, &deliver_domain_data },
565 #ifndef DISABLE_EVENT
566 { "event_data", vtype_stringptr, &event_data },
568 /*XXX want to use generic vars for as many of these as possible*/
569 { "event_defer_errno", vtype_int, &event_defer_errno },
571 { "event_name", vtype_stringptr, &event_name },
573 { "exim_gid", vtype_gid, &exim_gid },
574 { "exim_path", vtype_stringptr, &exim_path },
575 { "exim_uid", vtype_uid, &exim_uid },
576 { "exim_version", vtype_stringptr, &version_string },
577 { "headers_added", vtype_string_func, (void *) &fn_hdrs_added },
578 { "home", vtype_stringptr, &deliver_home },
579 { "host", vtype_stringptr, &deliver_host },
580 { "host_address", vtype_stringptr, &deliver_host_address },
581 { "host_data", vtype_stringptr, &host_data },
582 { "host_lookup_deferred",vtype_int, &host_lookup_deferred },
583 { "host_lookup_failed", vtype_int, &host_lookup_failed },
584 { "host_port", vtype_int, &deliver_host_port },
585 { "initial_cwd", vtype_stringptr, &initial_cwd },
586 { "inode", vtype_ino, &deliver_inode },
587 { "interface_address", vtype_stringptr, &interface_address },
588 { "interface_port", vtype_int, &interface_port },
589 { "item", vtype_stringptr, &iterate_item },
591 { "ldap_dn", vtype_stringptr, &eldap_dn },
593 { "load_average", vtype_load_avg, NULL },
594 { "local_part", vtype_stringptr, &deliver_localpart },
595 { "local_part_data", vtype_stringptr, &deliver_localpart_data },
596 { "local_part_prefix", vtype_stringptr, &deliver_localpart_prefix },
597 { "local_part_prefix_v", vtype_stringptr, &deliver_localpart_prefix_v },
598 { "local_part_suffix", vtype_stringptr, &deliver_localpart_suffix },
599 { "local_part_suffix_v", vtype_stringptr, &deliver_localpart_suffix_v },
600 #ifdef HAVE_LOCAL_SCAN
601 { "local_scan_data", vtype_stringptr, &local_scan_data },
603 { "local_user_gid", vtype_gid, &local_user_gid },
604 { "local_user_uid", vtype_uid, &local_user_uid },
605 { "localhost_number", vtype_int, &host_number },
606 { "log_inodes", vtype_pinodes, (void *)FALSE },
607 { "log_space", vtype_pspace, (void *)FALSE },
608 { "lookup_dnssec_authenticated",vtype_stringptr,&lookup_dnssec_authenticated},
609 { "mailstore_basename", vtype_stringptr, &mailstore_basename },
610 #ifdef WITH_CONTENT_SCAN
611 { "malware_name", vtype_stringptr, &malware_name },
613 { "max_received_linelength", vtype_int, &max_received_linelength },
614 { "message_age", vtype_int, &message_age },
615 { "message_body", vtype_msgbody, &message_body },
616 { "message_body_end", vtype_msgbody_end, &message_body_end },
617 { "message_body_size", vtype_int, &message_body_size },
618 { "message_exim_id", vtype_stringptr, &message_id },
619 { "message_headers", vtype_msgheaders, NULL },
620 { "message_headers_raw", vtype_msgheaders_raw, NULL },
621 { "message_id", vtype_stringptr, &message_id },
622 { "message_linecount", vtype_int, &message_linecount },
623 { "message_size", vtype_int, &message_size },
625 { "message_smtputf8", vtype_bool, &message_smtputf8 },
627 #ifdef WITH_CONTENT_SCAN
628 { "mime_anomaly_level", vtype_int, &mime_anomaly_level },
629 { "mime_anomaly_text", vtype_stringptr, &mime_anomaly_text },
630 { "mime_boundary", vtype_stringptr, &mime_boundary },
631 { "mime_charset", vtype_stringptr, &mime_charset },
632 { "mime_content_description", vtype_stringptr, &mime_content_description },
633 { "mime_content_disposition", vtype_stringptr, &mime_content_disposition },
634 { "mime_content_id", vtype_stringptr, &mime_content_id },
635 { "mime_content_size", vtype_int, &mime_content_size },
636 { "mime_content_transfer_encoding",vtype_stringptr, &mime_content_transfer_encoding },
637 { "mime_content_type", vtype_stringptr, &mime_content_type },
638 { "mime_decoded_filename", vtype_stringptr, &mime_decoded_filename },
639 { "mime_filename", vtype_stringptr, &mime_filename },
640 { "mime_is_coverletter", vtype_int, &mime_is_coverletter },
641 { "mime_is_multipart", vtype_int, &mime_is_multipart },
642 { "mime_is_rfc822", vtype_int, &mime_is_rfc822 },
643 { "mime_part_count", vtype_int, &mime_part_count },
645 { "n0", vtype_filter_int, &filter_n[0] },
646 { "n1", vtype_filter_int, &filter_n[1] },
647 { "n2", vtype_filter_int, &filter_n[2] },
648 { "n3", vtype_filter_int, &filter_n[3] },
649 { "n4", vtype_filter_int, &filter_n[4] },
650 { "n5", vtype_filter_int, &filter_n[5] },
651 { "n6", vtype_filter_int, &filter_n[6] },
652 { "n7", vtype_filter_int, &filter_n[7] },
653 { "n8", vtype_filter_int, &filter_n[8] },
654 { "n9", vtype_filter_int, &filter_n[9] },
655 { "original_domain", vtype_stringptr, &deliver_domain_orig },
656 { "original_local_part", vtype_stringptr, &deliver_localpart_orig },
657 { "originator_gid", vtype_gid, &originator_gid },
658 { "originator_uid", vtype_uid, &originator_uid },
659 { "parent_domain", vtype_stringptr, &deliver_domain_parent },
660 { "parent_local_part", vtype_stringptr, &deliver_localpart_parent },
661 { "pid", vtype_pid, NULL },
663 { "prdr_requested", vtype_bool, &prdr_requested },
665 { "primary_hostname", vtype_stringptr, &primary_hostname },
666 #if defined(SUPPORT_PROXY) || defined(SUPPORT_SOCKS)
667 { "proxy_external_address",vtype_stringptr, &proxy_external_address },
668 { "proxy_external_port", vtype_int, &proxy_external_port },
669 { "proxy_local_address", vtype_stringptr, &proxy_local_address },
670 { "proxy_local_port", vtype_int, &proxy_local_port },
671 { "proxy_session", vtype_bool, &proxy_session },
673 { "prvscheck_address", vtype_stringptr, &prvscheck_address },
674 { "prvscheck_keynum", vtype_stringptr, &prvscheck_keynum },
675 { "prvscheck_result", vtype_stringptr, &prvscheck_result },
676 { "qualify_domain", vtype_stringptr, &qualify_domain_sender },
677 { "qualify_recipient", vtype_stringptr, &qualify_domain_recipient },
678 { "queue_name", vtype_stringptr, &queue_name },
679 { "queue_size", vtype_string_func, &fn_queue_size },
680 { "rcpt_count", vtype_int, &rcpt_count },
681 { "rcpt_defer_count", vtype_int, &rcpt_defer_count },
682 { "rcpt_fail_count", vtype_int, &rcpt_fail_count },
683 { "received_count", vtype_int, &received_count },
684 { "received_for", vtype_stringptr, &received_for },
685 { "received_ip_address", vtype_stringptr, &interface_address },
686 { "received_port", vtype_int, &interface_port },
687 { "received_protocol", vtype_stringptr, &received_protocol },
688 { "received_time", vtype_int, &received_time.tv_sec },
689 { "recipient_data", vtype_stringptr, &recipient_data },
690 { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
691 { "recipients", vtype_string_func, (void *) &fn_recipients },
692 { "recipients_count", vtype_int, &recipients_count },
693 #ifdef WITH_CONTENT_SCAN
694 { "regex_match_string", vtype_stringptr, ®ex_match_string },
696 { "reply_address", vtype_reply, NULL },
697 { "return_path", vtype_stringptr, &return_path },
698 { "return_size_limit", vtype_int, &bounce_return_size_limit },
699 { "router_name", vtype_stringptr, &router_name },
700 { "runrc", vtype_int, &runrc },
701 { "self_hostname", vtype_stringptr, &self_hostname },
702 { "sender_address", vtype_stringptr, &sender_address },
703 { "sender_address_data", vtype_stringptr, &sender_address_data },
704 { "sender_address_domain", vtype_domain, &sender_address },
705 { "sender_address_local_part", vtype_localpart, &sender_address },
706 { "sender_data", vtype_stringptr, &sender_data },
707 { "sender_fullhost", vtype_stringptr, &sender_fullhost },
708 { "sender_helo_dnssec", vtype_bool, &sender_helo_dnssec },
709 { "sender_helo_name", vtype_stringptr, &sender_helo_name },
710 { "sender_host_address", vtype_stringptr, &sender_host_address },
711 { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated },
712 { "sender_host_dnssec", vtype_bool, &sender_host_dnssec },
713 { "sender_host_name", vtype_host_lookup, NULL },
714 { "sender_host_port", vtype_int, &sender_host_port },
715 { "sender_ident", vtype_stringptr, &sender_ident },
716 { "sender_rate", vtype_stringptr, &sender_rate },
717 { "sender_rate_limit", vtype_stringptr, &sender_rate_limit },
718 { "sender_rate_period", vtype_stringptr, &sender_rate_period },
719 { "sender_rcvhost", vtype_stringptr, &sender_rcvhost },
720 { "sender_verify_failure",vtype_stringptr, &sender_verify_failure },
721 { "sending_ip_address", vtype_stringptr, &sending_ip_address },
722 { "sending_port", vtype_int, &sending_port },
723 { "smtp_active_hostname", vtype_stringptr, &smtp_active_hostname },
724 { "smtp_command", vtype_stringptr, &smtp_cmd_buffer },
725 { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
726 { "smtp_command_history", vtype_string_func, (void *) &smtp_cmd_hist },
727 { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
728 { "smtp_notquit_reason", vtype_stringptr, &smtp_notquit_reason },
729 { "sn0", vtype_filter_int, &filter_sn[0] },
730 { "sn1", vtype_filter_int, &filter_sn[1] },
731 { "sn2", vtype_filter_int, &filter_sn[2] },
732 { "sn3", vtype_filter_int, &filter_sn[3] },
733 { "sn4", vtype_filter_int, &filter_sn[4] },
734 { "sn5", vtype_filter_int, &filter_sn[5] },
735 { "sn6", vtype_filter_int, &filter_sn[6] },
736 { "sn7", vtype_filter_int, &filter_sn[7] },
737 { "sn8", vtype_filter_int, &filter_sn[8] },
738 { "sn9", vtype_filter_int, &filter_sn[9] },
739 #ifdef WITH_CONTENT_SCAN
740 { "spam_action", vtype_stringptr, &spam_action },
741 { "spam_bar", vtype_stringptr, &spam_bar },
742 { "spam_report", vtype_stringptr, &spam_report },
743 { "spam_score", vtype_stringptr, &spam_score },
744 { "spam_score_int", vtype_stringptr, &spam_score_int },
747 { "spf_guess", vtype_stringptr, &spf_guess },
748 { "spf_header_comment", vtype_stringptr, &spf_header_comment },
749 { "spf_received", vtype_stringptr, &spf_received },
750 { "spf_result", vtype_stringptr, &spf_result },
751 { "spf_result_guessed", vtype_bool, &spf_result_guessed },
752 { "spf_smtp_comment", vtype_stringptr, &spf_smtp_comment },
754 { "spool_directory", vtype_stringptr, &spool_directory },
755 { "spool_inodes", vtype_pinodes, (void *)TRUE },
756 { "spool_space", vtype_pspace, (void *)TRUE },
757 #ifdef EXPERIMENTAL_SRS_ALT
758 { "srs_db_address", vtype_stringptr, &srs_db_address },
759 { "srs_db_key", vtype_stringptr, &srs_db_key },
760 { "srs_orig_recipient", vtype_stringptr, &srs_orig_recipient },
761 { "srs_orig_sender", vtype_stringptr, &srs_orig_sender },
763 #if defined(EXPERIMENTAL_SRS_ALT) || defined(SUPPORT_SRS)
764 { "srs_recipient", vtype_stringptr, &srs_recipient },
766 #ifdef EXPERIMENTAL_SRS_ALT
767 { "srs_status", vtype_stringptr, &srs_status },
769 { "thisaddress", vtype_stringptr, &filter_thisaddress },
771 /* The non-(in,out) variables are now deprecated */
772 { "tls_bits", vtype_int, &tls_in.bits },
773 { "tls_certificate_verified", vtype_int, &tls_in.certificate_verified },
774 { "tls_cipher", vtype_stringptr, &tls_in.cipher },
776 { "tls_in_bits", vtype_int, &tls_in.bits },
777 { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
778 { "tls_in_cipher", vtype_stringptr, &tls_in.cipher },
779 { "tls_in_cipher_std", vtype_stringptr, &tls_in.cipher_stdname },
780 { "tls_in_ocsp", vtype_int, &tls_in.ocsp },
781 { "tls_in_ourcert", vtype_cert, &tls_in.ourcert },
782 { "tls_in_peercert", vtype_cert, &tls_in.peercert },
783 { "tls_in_peerdn", vtype_stringptr, &tls_in.peerdn },
784 #ifndef DISABLE_TLS_RESUME
785 { "tls_in_resumption", vtype_int, &tls_in.resumption },
788 { "tls_in_sni", vtype_stringptr, &tls_in.sni },
790 { "tls_in_ver", vtype_stringptr, &tls_in.ver },
791 { "tls_out_bits", vtype_int, &tls_out.bits },
792 { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
793 { "tls_out_cipher", vtype_stringptr, &tls_out.cipher },
794 { "tls_out_cipher_std", vtype_stringptr, &tls_out.cipher_stdname },
796 { "tls_out_dane", vtype_bool, &tls_out.dane_verified },
798 { "tls_out_ocsp", vtype_int, &tls_out.ocsp },
799 { "tls_out_ourcert", vtype_cert, &tls_out.ourcert },
800 { "tls_out_peercert", vtype_cert, &tls_out.peercert },
801 { "tls_out_peerdn", vtype_stringptr, &tls_out.peerdn },
802 #ifndef DISABLE_TLS_RESUME
803 { "tls_out_resumption", vtype_int, &tls_out.resumption },
806 { "tls_out_sni", vtype_stringptr, &tls_out.sni },
809 { "tls_out_tlsa_usage", vtype_int, &tls_out.tlsa_usage },
811 { "tls_out_ver", vtype_stringptr, &tls_out.ver },
813 { "tls_peerdn", vtype_stringptr, &tls_in.peerdn }, /* mind the alphabetical order! */
815 { "tls_sni", vtype_stringptr, &tls_in.sni }, /* mind the alphabetical order! */
818 { "tod_bsdinbox", vtype_todbsdin, NULL },
819 { "tod_epoch", vtype_tode, NULL },
820 { "tod_epoch_l", vtype_todel, NULL },
821 { "tod_full", vtype_todf, NULL },
822 { "tod_log", vtype_todl, NULL },
823 { "tod_logfile", vtype_todlf, NULL },
824 { "tod_zone", vtype_todzone, NULL },
825 { "tod_zulu", vtype_todzulu, NULL },
826 { "transport_name", vtype_stringptr, &transport_name },
827 { "value", vtype_stringptr, &lookup_value },
828 { "verify_mode", vtype_stringptr, &verify_mode },
829 { "version_number", vtype_stringptr, &version_string },
830 { "warn_message_delay", vtype_stringptr, &warnmsg_delay },
831 { "warn_message_recipient",vtype_stringptr, &warnmsg_recipients },
832 { "warn_message_recipients",vtype_stringptr,&warnmsg_recipients },
833 { "warnmsg_delay", vtype_stringptr, &warnmsg_delay },
834 { "warnmsg_recipient", vtype_stringptr, &warnmsg_recipients },
835 { "warnmsg_recipients", vtype_stringptr, &warnmsg_recipients }
838 static int var_table_size = nelem(var_table);
839 static uschar var_buffer[256];
840 static BOOL malformed_header;
842 /* For textual hashes */
844 static const char *hashcodes = "abcdefghijklmnopqrtsuvwxyz"
845 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
848 enum { HMAC_MD5, HMAC_SHA1 };
850 /* For numeric hashes */
852 static unsigned int prime[] = {
853 2, 3, 5, 7, 11, 13, 17, 19, 23, 29,
854 31, 37, 41, 43, 47, 53, 59, 61, 67, 71,
855 73, 79, 83, 89, 97, 101, 103, 107, 109, 113};
857 /* For printing modes in symbolic form */
859 static uschar *mtable_normal[] =
860 { US"---", US"--x", US"-w-", US"-wx", US"r--", US"r-x", US"rw-", US"rwx" };
862 static uschar *mtable_setid[] =
863 { US"--S", US"--s", US"-wS", US"-ws", US"r-S", US"r-s", US"rwS", US"rws" };
865 static uschar *mtable_sticky[] =
866 { US"--T", US"--t", US"-wT", US"-wt", US"r-T", US"r-t", US"rwT", US"rwt" };
868 /* flags for find_header() */
869 #define FH_EXISTS_ONLY BIT(0)
870 #define FH_WANT_RAW BIT(1)
871 #define FH_WANT_LIST BIT(2)
874 /*************************************************
875 * Tables for UTF-8 support *
876 *************************************************/
878 /* Table of the number of extra characters, indexed by the first character
879 masked with 0x3f. The highest number for a valid UTF-8 character is in fact
882 static uschar utf8_table1[] = {
883 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
884 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
885 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
886 3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
888 /* These are the masks for the data bits in the first byte of a character,
889 indexed by the number of additional bytes. */
891 static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
893 /* Get the next UTF-8 character, advancing the pointer. */
895 #define GETUTF8INC(c, ptr) \
897 if ((c & 0xc0) == 0xc0) \
899 int a = utf8_table1[c & 0x3f]; /* Number of additional bytes */ \
901 c = (c & utf8_table2[a]) << s; \
905 c |= (*ptr++ & 0x3f) << s; \
911 static uschar * base32_chars = US"abcdefghijklmnopqrstuvwxyz234567";
913 /*************************************************
914 * Binary chop search on a table *
915 *************************************************/
917 /* This is used for matching expansion items and operators.
920 name the name that is being sought
921 table the table to search
922 table_size the number of items in the table
924 Returns: the offset in the table, or -1
928 chop_match(uschar *name, uschar **table, int table_size)
930 uschar **bot = table;
931 uschar **top = table + table_size;
935 uschar **mid = bot + (top - bot)/2;
936 int c = Ustrcmp(name, *mid);
937 if (c == 0) return mid - table;
938 if (c > 0) bot = mid + 1; else top = mid;
946 /*************************************************
947 * Check a condition string *
948 *************************************************/
950 /* This function is called to expand a string, and test the result for a "true"
951 or "false" value. Failure of the expansion yields FALSE; logged unless it was a
952 forced fail or lookup defer.
954 We used to release all store used, but this is not not safe due
955 to ${dlfunc } and ${acl }. In any case expand_string_internal()
956 is reasonably careful to release what it can.
958 The actual false-value tests should be replicated for ECOND_BOOL_LAX.
961 condition the condition string
962 m1 text to be incorporated in panic error
965 Returns: TRUE if condition is met, FALSE if not
969 expand_check_condition(uschar *condition, uschar *m1, uschar *m2)
971 uschar * ss = expand_string(condition);
974 if (!f.expand_string_forcedfail && !f.search_find_defer)
975 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand condition \"%s\" "
976 "for %s %s: %s", condition, m1, m2, expand_string_message);
979 return *ss && Ustrcmp(ss, "0") != 0 && strcmpic(ss, US"no") != 0 &&
980 strcmpic(ss, US"false") != 0;
986 /*************************************************
987 * Pseudo-random number generation *
988 *************************************************/
990 /* Pseudo-random number generation. The result is not "expected" to be
991 cryptographically strong but not so weak that someone will shoot themselves
992 in the foot using it as a nonce in some email header scheme or whatever
993 weirdness they'll twist this into. The result should ideally handle fork().
995 However, if we're stuck unable to provide this, then we'll fall back to
996 appallingly bad randomness.
998 If DISABLE_TLS is not defined then this will not be used except as an emergency
1003 Returns a random number in range [0, max-1]
1007 # define vaguely_random_number vaguely_random_number_fallback
1010 vaguely_random_number(int max)
1013 # undef vaguely_random_number
1015 static pid_t pid = 0;
1018 if ((p2 = getpid()) != pid)
1023 #ifdef HAVE_ARC4RANDOM
1024 /* cryptographically strong randomness, common on *BSD platforms, not
1025 so much elsewhere. Alas. */
1026 # ifndef NOT_HAVE_ARC4RANDOM_STIR
1029 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
1030 # ifdef HAVE_SRANDOMDEV
1031 /* uses random(4) for seeding */
1036 gettimeofday(&tv, NULL);
1037 srandom(tv.tv_sec | tv.tv_usec | getpid());
1041 /* Poor randomness and no seeding here */
1048 #ifdef HAVE_ARC4RANDOM
1049 return arc4random() % max;
1050 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
1051 return random() % max;
1053 /* This one returns a 16-bit number, definitely not crypto-strong */
1054 return random_number(max);
1061 /*************************************************
1062 * Pick out a name from a string *
1063 *************************************************/
1065 /* If the name is too long, it is silently truncated.
1068 name points to a buffer into which to put the name
1069 max is the length of the buffer
1070 s points to the first alphabetic character of the name
1071 extras chars other than alphanumerics to permit
1073 Returns: pointer to the first character after the name
1075 Note: The test for *s != 0 in the while loop is necessary because
1076 Ustrchr() yields non-NULL if the character is zero (which is not something
1079 static const uschar *
1080 read_name(uschar *name, int max, const uschar *s, uschar *extras)
1083 while (*s && (isalnum(*s) || Ustrchr(extras, *s) != NULL))
1085 if (ptr < max-1) name[ptr++] = *s;
1094 /*************************************************
1095 * Pick out the rest of a header name *
1096 *************************************************/
1098 /* A variable name starting $header_ (or just $h_ for those who like
1099 abbreviations) might not be the complete header name because headers can
1100 contain any printing characters in their names, except ':'. This function is
1101 called to read the rest of the name, chop h[eader]_ off the front, and put ':'
1102 on the end, if the name was terminated by white space.
1105 name points to a buffer in which the name read so far exists
1106 max is the length of the buffer
1107 s points to the first character after the name so far, i.e. the
1108 first non-alphameric character after $header_xxxxx
1110 Returns: a pointer to the first character after the header name
1113 static const uschar *
1114 read_header_name(uschar *name, int max, const uschar *s)
1116 int prelen = Ustrchr(name, '_') - name + 1;
1117 int ptr = Ustrlen(name) - prelen;
1118 if (ptr > 0) memmove(name, name+prelen, ptr);
1119 while (mac_isgraph(*s) && *s != ':')
1121 if (ptr < max-1) name[ptr++] = *s;
1132 /*************************************************
1133 * Pick out a number from a string *
1134 *************************************************/
1137 n points to an integer into which to put the number
1138 s points to the first digit of the number
1140 Returns: a pointer to the character after the last digit
1142 /*XXX consider expanding to int_eximarith_t. But the test for
1143 "overbig numbers" in 0002 still needs to overflow it. */
1146 read_number(int *n, uschar *s)
1149 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1153 static const uschar *
1154 read_cnumber(int *n, const uschar *s)
1157 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1163 /*************************************************
1164 * Extract keyed subfield from a string *
1165 *************************************************/
1167 /* The yield is in dynamic store; NULL means that the key was not found.
1170 key points to the name of the key
1171 s points to the string from which to extract the subfield
1173 Returns: NULL if the subfield was not found, or
1174 a pointer to the subfield's data
1178 expand_getkeyed(const uschar * key, const uschar * s)
1180 int length = Ustrlen(key);
1181 Uskip_whitespace(&s);
1183 /* Loop to search for the key */
1189 const uschar * dkey = s;
1191 while (*s && *s != '=' && !isspace(*s)) s++;
1192 dkeylength = s - dkey;
1193 if (Uskip_whitespace(&s) == '=') while (isspace(*++s));
1195 data = string_dequote(&s);
1196 if (length == dkeylength && strncmpic(key, dkey, length) == 0)
1199 Uskip_whitespace(&s);
1208 find_var_ent(uschar * name)
1211 int last = var_table_size;
1213 while (last > first)
1215 int middle = (first + last)/2;
1216 int c = Ustrcmp(name, var_table[middle].name);
1218 if (c > 0) { first = middle + 1; continue; }
1219 if (c < 0) { last = middle; continue; }
1220 return &var_table[middle];
1225 /*************************************************
1226 * Extract numbered subfield from string *
1227 *************************************************/
1229 /* Extracts a numbered field from a string that is divided by tokens - for
1230 example a line from /etc/passwd is divided by colon characters. First field is
1231 numbered one. Negative arguments count from the right. Zero returns the whole
1232 string. Returns NULL if there are insufficient tokens in the string
1235 Modifies final argument - this is a dynamically generated string, so that's OK.
1238 field number of field to be extracted,
1239 first field = 1, whole string = 0, last field = -1
1240 separators characters that are used to break string into tokens
1241 s points to the string from which to extract the subfield
1243 Returns: NULL if the field was not found,
1244 a pointer to the field's data inside s (modified to add 0)
1248 expand_gettokened (int field, uschar *separators, uschar *s)
1253 uschar *fieldtext = NULL;
1255 if (field == 0) return s;
1257 /* Break the line up into fields in place; for field > 0 we stop when we have
1258 done the number of fields we want. For field < 0 we continue till the end of
1259 the string, counting the number of fields. */
1261 count = (field > 0)? field : INT_MAX;
1267 /* Previous field was the last one in the string. For a positive field
1268 number, this means there are not enough fields. For a negative field number,
1269 check that there are enough, and scan back to find the one that is wanted. */
1273 if (field > 0 || (-field) > (INT_MAX - count - 1)) return NULL;
1274 if ((-field) == (INT_MAX - count - 1)) return s;
1278 while (ss[-1] != 0) ss--;
1284 /* Previous field was not last in the string; save its start and put a
1288 len = Ustrcspn(ss, separators);
1299 expand_getlistele(int field, const uschar * list)
1301 const uschar * tlist = list;
1307 for (field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
1310 if (field == 0) return NULL;
1311 while (--field > 0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
1312 return string_nextinlist(&list, &sep, NULL, 0);
1316 /* Certificate fields, by name. Worry about by-OID later */
1317 /* Names are chosen to not have common prefixes */
1324 uschar * (*getfn)(void * cert, uschar * mod);
1326 static certfield certfields[] =
1327 { /* linear search; no special order */
1328 { US"version", 7, &tls_cert_version },
1329 { US"serial_number", 13, &tls_cert_serial_number },
1330 { US"subject", 7, &tls_cert_subject },
1331 { US"notbefore", 9, &tls_cert_not_before },
1332 { US"notafter", 8, &tls_cert_not_after },
1333 { US"issuer", 6, &tls_cert_issuer },
1334 { US"signature", 9, &tls_cert_signature },
1335 { US"sig_algorithm", 13, &tls_cert_signature_algorithm },
1336 { US"subj_altname", 12, &tls_cert_subject_altname },
1337 { US"ocsp_uri", 8, &tls_cert_ocsp_uri },
1338 { US"crl_uri", 7, &tls_cert_crl_uri },
1342 expand_getcertele(uschar * field, uschar * certvar)
1346 if (!(vp = find_var_ent(certvar)))
1348 expand_string_message =
1349 string_sprintf("no variable named \"%s\"", certvar);
1350 return NULL; /* Unknown variable name */
1352 /* NB this stops us passing certs around in variable. Might
1353 want to do that in future */
1354 if (vp->type != vtype_cert)
1356 expand_string_message =
1357 string_sprintf("\"%s\" is not a certificate", certvar);
1358 return NULL; /* Unknown variable name */
1360 if (!*(void **)vp->value)
1363 if (*field >= '0' && *field <= '9')
1364 return tls_cert_ext_by_oid(*(void **)vp->value, field, 0);
1366 for (certfield * cp = certfields;
1367 cp < certfields + nelem(certfields);
1369 if (Ustrncmp(cp->name, field, cp->namelen) == 0)
1371 uschar * modifier = *(field += cp->namelen) == ','
1373 return (*cp->getfn)( *(void **)vp->value, modifier );
1376 expand_string_message =
1377 string_sprintf("bad field selector \"%s\" for certextract", field);
1380 #endif /*DISABLE_TLS*/
1382 /*************************************************
1383 * Extract a substring from a string *
1384 *************************************************/
1386 /* Perform the ${substr or ${length expansion operations.
1389 subject the input string
1390 value1 the offset from the start of the input string to the start of
1391 the output string; if negative, count from the right.
1392 value2 the length of the output string, or negative (-1) for unset
1393 if value1 is positive, unset means "all after"
1394 if value1 is negative, unset means "all before"
1395 len set to the length of the returned string
1397 Returns: pointer to the output string, or NULL if there is an error
1401 extract_substr(uschar *subject, int value1, int value2, int *len)
1403 int sublen = Ustrlen(subject);
1405 if (value1 < 0) /* count from right */
1409 /* If the position is before the start, skip to the start, and adjust the
1410 length. If the length ends up negative, the substring is null because nothing
1411 can precede. This falls out naturally when the length is unset, meaning "all
1417 if (value2 < 0) value2 = 0;
1421 /* Otherwise an unset length => characters before value1 */
1423 else if (value2 < 0)
1430 /* For a non-negative offset, if the starting position is past the end of the
1431 string, the result will be the null string. Otherwise, an unset length means
1432 "rest"; just set it to the maximum - it will be cut down below if necessary. */
1436 if (value1 > sublen)
1441 else if (value2 < 0) value2 = sublen;
1444 /* Cut the length down to the maximum possible for the offset value, and get
1445 the required characters. */
1447 if (value1 + value2 > sublen) value2 = sublen - value1;
1449 return subject + value1;
1455 /*************************************************
1456 * Old-style hash of a string *
1457 *************************************************/
1459 /* Perform the ${hash expansion operation.
1462 subject the input string (an expanded substring)
1463 value1 the length of the output string; if greater or equal to the
1464 length of the input string, the input string is returned
1465 value2 the number of hash characters to use, or 26 if negative
1466 len set to the length of the returned string
1468 Returns: pointer to the output string, or NULL if there is an error
1472 compute_hash(uschar *subject, int value1, int value2, int *len)
1474 int sublen = Ustrlen(subject);
1476 if (value2 < 0) value2 = 26;
1477 else if (value2 > Ustrlen(hashcodes))
1479 expand_string_message =
1480 string_sprintf("hash count \"%d\" too big", value2);
1484 /* Calculate the hash text. We know it is shorter than the original string, so
1485 can safely place it in subject[] (we know that subject is always itself an
1486 expanded substring). */
1488 if (value1 < sublen)
1493 while ((c = (subject[j])) != 0)
1495 int shift = (c + j++) & 7;
1496 subject[i] ^= (c << shift) | (c >> (8-shift));
1497 if (++i >= value1) i = 0;
1499 for (i = 0; i < value1; i++)
1500 subject[i] = hashcodes[(subject[i]) % value2];
1502 else value1 = sublen;
1511 /*************************************************
1512 * Numeric hash of a string *
1513 *************************************************/
1515 /* Perform the ${nhash expansion operation. The first characters of the
1516 string are treated as most important, and get the highest prime numbers.
1519 subject the input string
1520 value1 the maximum value of the first part of the result
1521 value2 the maximum value of the second part of the result,
1522 or negative to produce only a one-part result
1523 len set to the length of the returned string
1525 Returns: pointer to the output string, or NULL if there is an error.
1529 compute_nhash (uschar *subject, int value1, int value2, int *len)
1531 uschar *s = subject;
1533 unsigned long int total = 0; /* no overflow */
1537 if (i == 0) i = nelem(prime) - 1;
1538 total += prime[i--] * (unsigned int)(*s++);
1541 /* If value2 is unset, just compute one number */
1544 s = string_sprintf("%lu", total % value1);
1546 /* Otherwise do a div/mod hash */
1550 total = total % (value1 * value2);
1551 s = string_sprintf("%lu/%lu", total/value2, total % value2);
1562 /*************************************************
1563 * Find the value of a header or headers *
1564 *************************************************/
1566 /* Multiple instances of the same header get concatenated, and this function
1567 can also return a concatenation of all the header lines. When concatenating
1568 specific headers that contain lists of addresses, a comma is inserted between
1569 them. Otherwise we use a straight concatenation. Because some messages can have
1570 pathologically large number of lines, there is a limit on the length that is
1574 name the name of the header, without the leading $header_ or $h_,
1575 or NULL if a concatenation of all headers is required
1576 newsize return the size of memory block that was obtained; may be NULL
1577 if exists_only is TRUE
1578 flags FH_EXISTS_ONLY
1579 set if called from a def: test; don't need to build a string;
1580 just return a string that is not "" and not "0" if the header
1583 set if called for $rh_ or $rheader_ items; no processing,
1584 other than concatenating, will be done on the header. Also used
1585 for $message_headers_raw.
1587 Double colon chars in the content, and replace newline with
1588 colon between each element when concatenating; returning a
1589 colon-sep list (elements might contain newlines)
1590 charset name of charset to translate MIME words to; used only if
1591 want_raw is false; if NULL, no translation is done (this is
1592 used for $bh_ and $bheader_)
1594 Returns: NULL if the header does not exist, else a pointer to a new
1599 find_header(uschar *name, int *newsize, unsigned flags, uschar *charset)
1602 int len = name ? Ustrlen(name) : 0;
1606 for (header_line * h = header_list; h; h = h->next)
1607 if (h->type != htype_old && h->text) /* NULL => Received: placeholder */
1608 if (!name || (len <= h->slen && strncmpic(name, h->text, len) == 0))
1613 if (flags & FH_EXISTS_ONLY)
1614 return US"1"; /* don't need actual string */
1617 s = h->text + len; /* text to insert */
1618 if (!(flags & FH_WANT_RAW)) /* unless wanted raw, */
1619 Uskip_whitespace(&s); /* remove leading white space */
1620 t = h->text + h->slen; /* end-point */
1622 /* Unless wanted raw, remove trailing whitespace, including the
1625 if (flags & FH_WANT_LIST)
1626 while (t > s && t[-1] == '\n') t--;
1627 else if (!(flags & FH_WANT_RAW))
1629 while (t > s && isspace(t[-1])) t--;
1631 /* Set comma if handling a single header and it's one of those
1632 that contains an address list, except when asked for raw headers. Only
1633 need to do this once. */
1635 if (name && !comma && Ustrchr("BCFRST", h->type)) comma = TRUE;
1638 /* Trim the header roughly if we're approaching limits */
1640 if (gstring_length(g) + inc > header_insert_maxlen)
1641 inc = header_insert_maxlen - gstring_length(g);
1643 /* For raw just copy the data; for a list, add the data as a colon-sep
1644 list-element; for comma-list add as an unchecked comma,newline sep
1645 list-elemment; for other nonraw add as an unchecked newline-sep list (we
1646 stripped trailing WS above including the newline). We ignore the potential
1647 expansion due to colon-doubling, just leaving the loop if the limit is met
1650 if (flags & FH_WANT_LIST)
1651 g = string_append_listele_n(g, ':', s, (unsigned)inc);
1652 else if (flags & FH_WANT_RAW)
1653 g = string_catn(g, s, (unsigned)inc);
1655 g = string_append2_listele_n(g, comma ? US",\n" : US"\n",
1658 if (gstring_length(g) >= header_insert_maxlen) break;
1661 if (!found) return NULL; /* No header found */
1662 if (!g) return US"";
1664 /* That's all we do for raw header expansion. */
1667 if (flags & FH_WANT_RAW)
1668 return string_from_gstring(g);
1670 /* Otherwise do RFC 2047 decoding, translating the charset if requested.
1671 The rfc2047_decode2() function can return an error with decoded data if the
1672 charset translation fails. If decoding fails, it returns NULL. */
1676 uschar * error, * decoded = rfc2047_decode2(string_from_gstring(g),
1677 check_rfc2047_length, charset, '?', NULL, newsize, &error);
1679 DEBUG(D_any) debug_printf("*** error in RFC 2047 decoding: %s\n"
1680 " input was: %s\n", error, g->s);
1681 return decoded ? decoded : string_from_gstring(g);
1688 /* Append a "local" element to an Authentication-Results: header
1689 if this was a non-smtp message.
1693 authres_local(gstring * g, const uschar * sysname)
1695 if (!f.authentication_local)
1697 g = string_append(g, 3, US";\n\tlocal=pass (non-smtp, ", sysname, US")");
1698 if (authenticated_id) g = string_append(g, 2, " u=", authenticated_id);
1703 /* Append an "iprev" element to an Authentication-Results: header
1704 if we have attempted to get the calling host's name.
1708 authres_iprev(gstring * g)
1710 if (sender_host_name)
1711 g = string_append(g, 3, US";\n\tiprev=pass (", sender_host_name, US")");
1712 else if (host_lookup_deferred)
1713 g = string_catn(g, US";\n\tiprev=temperror", 19);
1714 else if (host_lookup_failed)
1715 g = string_catn(g, US";\n\tiprev=fail", 13);
1719 if (sender_host_address)
1720 g = string_append(g, 2, US" smtp.remote-ip=", sender_host_address);
1726 /*************************************************
1727 * Return list of recipients *
1728 *************************************************/
1729 /* A recipients list is available only during system message filtering,
1730 during ACL processing after DATA, and while expanding pipe commands
1731 generated from a system filter, but not elsewhere. */
1739 if (!f.enable_dollar_recipients) return NULL;
1741 for (int i = 0; i < recipients_count; i++)
1743 s = recipients_list[i].address;
1744 g = string_append2_listele_n(g, US", ", s, Ustrlen(s));
1746 return g ? g->s : NULL;
1750 /*************************************************
1751 * Return size of queue *
1752 *************************************************/
1753 /* Ask the daemon for the queue size */
1758 struct sockaddr_un sa_un = {.sun_family = AF_UNIX};
1762 const uschar * where;
1763 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1769 if ((fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0)
1771 DEBUG(D_expand) debug_printf(" socket: %s\n", strerror(errno));
1775 #ifdef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1776 sa_un.sun_path[0] = 0; /* Abstract local socket addr - Linux-specific? */
1777 len = offsetof(struct sockaddr_un, sun_path) + 1
1778 + snprintf(sa_un.sun_path+1, sizeof(sa_un.sun_path)-1, "exim_%d", getpid());
1780 sname = string_sprintf("%s/p_%d", spool_directory, getpid());
1781 len = offsetof(struct sockaddr_un, sun_path)
1782 + snprintf(sa_un.sun_path, sizeof(sa_un.sun_path), "%s", sname);
1785 if (bind(fd, (const struct sockaddr *)&sa_un, len) < 0)
1786 { where = US"bind"; goto bad; }
1789 debug_printf("local addr '%s%s'\n",
1790 *sa_un.sun_path ? "" : "@",
1791 sa_un.sun_path + (*sa_un.sun_path ? 0 : 1));
1794 #ifdef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1795 sa_un.sun_path[0] = 0; /* Abstract local socket addr - Linux-specific? */
1796 len = offsetof(struct sockaddr_un, sun_path) + 1
1797 + snprintf(sa_un.sun_path+1, sizeof(sa_un.sun_path)-1, "%s",
1798 expand_string(notifier_socket));
1800 len = offsetof(struct sockaddr_un, sun_path)
1801 + snprintf(sa_un.sun_path, sizeof(sa_un.sun_path), "%s",
1802 expand_string(notifier_socket));
1805 if (connect(fd, (const struct sockaddr *)&sa_un, len) < 0)
1806 { where = US"connect"; goto bad2; }
1808 buf[0] = NOTIFY_QUEUE_SIZE_REQ;
1809 if (send(fd, buf, 1, 0) < 0) { where = US"send"; goto bad; }
1811 FD_ZERO(&fds); FD_SET(fd, &fds);
1812 tv.tv_sec = 2; tv.tv_usec = 0;
1813 if (select(fd + 1, (SELECT_ARG2_TYPE *)&fds, NULL, NULL, &tv) != 1)
1815 DEBUG(D_expand) debug_printf("no daemon response; using local evaluation\n");
1816 len = snprintf(CS buf, sizeof(buf), "%u", queue_count_cached());
1818 else if ((len = recv(fd, buf, sizeof(buf), 0)) < 0)
1819 { where = US"recv"; goto bad2; }
1822 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1825 return string_copyn(buf, len);
1828 #ifndef EXIM_HAVE_ABSTRACT_UNIX_SOCKETS
1833 DEBUG(D_expand) debug_printf(" %s: %s\n", where, strerror(errno));
1838 /*************************************************
1839 * Find value of a variable *
1840 *************************************************/
1842 /* The table of variables is kept in alphabetic order, so we can search it
1843 using a binary chop. The "choplen" variable is nothing to do with the binary
1847 name the name of the variable being sought
1848 exists_only TRUE if this is a def: test; passed on to find_header()
1849 skipping TRUE => skip any processing evaluation; this is not the same as
1850 exists_only because def: may test for values that are first
1852 newsize pointer to an int which is initially zero; if the answer is in
1853 a new memory buffer, *newsize is set to its size
1855 Returns: NULL if the variable does not exist, or
1856 a pointer to the variable's contents, or
1857 something non-NULL if exists_only is TRUE
1861 find_variable(uschar *name, BOOL exists_only, BOOL skipping, int *newsize)
1868 /* Handle ACL variables, whose names are of the form acl_cxxx or acl_mxxx.
1869 Originally, xxx had to be a number in the range 0-9 (later 0-19), but from
1870 release 4.64 onwards arbitrary names are permitted, as long as the first 5
1871 characters are acl_c or acl_m and the sixth is either a digit or an underscore
1872 (this gave backwards compatibility at the changeover). There may be built-in
1873 variables whose names start acl_ but they should never start in this way. This
1874 slightly messy specification is a consequence of the history, needless to say.
1876 If an ACL variable does not exist, treat it as empty, unless strict_acl_vars is
1877 set, in which case give an error. */
1879 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
1883 tree_search(name[4] == 'c' ? acl_var_c : acl_var_m, name + 4);
1884 return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
1886 else if (Ustrncmp(name, "r_", 2) == 0)
1888 tree_node * node = tree_search(router_var, name + 2);
1889 return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
1892 /* Handle $auth<n> variables. */
1894 if (Ustrncmp(name, "auth", 4) == 0)
1897 int n = Ustrtoul(name + 4, &endptr, 10);
1898 if (*endptr == 0 && n != 0 && n <= AUTH_VARS)
1899 return !auth_vars[n-1] ? US"" : auth_vars[n-1];
1901 else if (Ustrncmp(name, "regex", 5) == 0)
1904 int n = Ustrtoul(name + 5, &endptr, 10);
1905 if (*endptr == 0 && n != 0 && n <= REGEX_VARS)
1906 return !regex_vars[n-1] ? US"" : regex_vars[n-1];
1909 /* For all other variables, search the table */
1911 if (!(vp = find_var_ent(name)))
1912 return NULL; /* Unknown variable name */
1914 /* Found an existing variable. If in skipping state, the value isn't needed,
1915 and we want to avoid processing (such as looking up the host name). */
1923 case vtype_filter_int:
1924 if (!f.filter_running) return NULL;
1928 sprintf(CS var_buffer, "%d", *(int *)(val)); /* Integer */
1932 sprintf(CS var_buffer, "%ld", (long int)(*(ino_t *)(val))); /* Inode */
1936 sprintf(CS var_buffer, "%ld", (long int)(*(gid_t *)(val))); /* gid */
1940 sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(val))); /* uid */
1944 sprintf(CS var_buffer, "%s", *(BOOL *)(val) ? "yes" : "no"); /* bool */
1947 case vtype_stringptr: /* Pointer to string */
1948 return (s = *((uschar **)(val))) ? s : US"";
1951 sprintf(CS var_buffer, "%d", (int)getpid()); /* pid */
1954 case vtype_load_avg:
1955 sprintf(CS var_buffer, "%d", OS_GETLOADAVG()); /* load_average */
1958 case vtype_host_lookup: /* Lookup if not done so */
1959 if ( !sender_host_name && sender_host_address
1960 && !host_lookup_failed && host_name_lookup() == OK)
1961 host_build_sender_fullhost();
1962 return sender_host_name ? sender_host_name : US"";
1964 case vtype_localpart: /* Get local part from address */
1965 if (!(s = *((uschar **)(val)))) return US"";
1966 if (!(domain = Ustrrchr(s, '@'))) return s;
1967 if (domain - s > sizeof(var_buffer) - 1)
1968 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
1969 " in string expansion", sizeof(var_buffer));
1970 return string_copyn(s, domain - s);
1972 case vtype_domain: /* Get domain from address */
1973 if (!(s = *((uschar **)(val)))) return US"";
1974 domain = Ustrrchr(s, '@');
1975 return domain ? domain + 1 : US"";
1977 case vtype_msgheaders:
1978 return find_header(NULL, newsize, exists_only ? FH_EXISTS_ONLY : 0, NULL);
1980 case vtype_msgheaders_raw:
1981 return find_header(NULL, newsize,
1982 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW, NULL);
1984 case vtype_msgbody: /* Pointer to msgbody string */
1985 case vtype_msgbody_end: /* Ditto, the end of the msg */
1986 ss = (uschar **)(val);
1987 if (!*ss && deliver_datafile >= 0) /* Read body when needed */
1990 off_t start_offset = SPOOL_DATA_START_OFFSET;
1991 int len = message_body_visible;
1993 if (len > message_size) len = message_size;
1994 *ss = body = store_get(len+1, TRUE);
1996 if (vp->type == vtype_msgbody_end)
1998 struct stat statbuf;
1999 if (fstat(deliver_datafile, &statbuf) == 0)
2001 start_offset = statbuf.st_size - len;
2002 if (start_offset < SPOOL_DATA_START_OFFSET)
2003 start_offset = SPOOL_DATA_START_OFFSET;
2006 if (lseek(deliver_datafile, start_offset, SEEK_SET) < 0)
2007 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "deliver_datafile lseek: %s",
2009 if ((len = read(deliver_datafile, body, len)) > 0)
2012 if (message_body_newlines) /* Separate loops for efficiency */
2014 { if (body[--len] == 0) body[len] = ' '; }
2017 { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; }
2020 return *ss ? *ss : US"";
2022 case vtype_todbsdin: /* BSD inbox time of day */
2023 return tod_stamp(tod_bsdin);
2025 case vtype_tode: /* Unix epoch time of day */
2026 return tod_stamp(tod_epoch);
2028 case vtype_todel: /* Unix epoch/usec time of day */
2029 return tod_stamp(tod_epoch_l);
2031 case vtype_todf: /* Full time of day */
2032 return tod_stamp(tod_full);
2034 case vtype_todl: /* Log format time of day */
2035 return tod_stamp(tod_log_bare); /* (without timezone) */
2037 case vtype_todzone: /* Time zone offset only */
2038 return tod_stamp(tod_zone);
2040 case vtype_todzulu: /* Zulu time */
2041 return tod_stamp(tod_zulu);
2043 case vtype_todlf: /* Log file datestamp tod */
2044 return tod_stamp(tod_log_datestamp_daily);
2046 case vtype_reply: /* Get reply address */
2047 s = find_header(US"reply-to:", newsize,
2048 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW,
2050 if (s) Uskip_whitespace(&s);
2053 *newsize = 0; /* For the *s==0 case */
2054 s = find_header(US"from:", newsize,
2055 exists_only ? FH_EXISTS_ONLY|FH_WANT_RAW : FH_WANT_RAW,
2061 Uskip_whitespace(&s);
2062 for (t = s; *t; t++) if (*t == '\n') *t = ' ';
2063 while (t > s && isspace(t[-1])) t--;
2066 return s ? s : US"";
2068 case vtype_string_func:
2070 stringptr_fn_t * fn = (stringptr_fn_t *) val;
2072 return s ? s : US"";
2078 sprintf(CS var_buffer, PR_EXIM_ARITH,
2079 receive_statvfs(val == (void *)TRUE, &inodes));
2086 (void) receive_statvfs(val == (void *)TRUE, &inodes);
2087 sprintf(CS var_buffer, "%d", inodes);
2092 return *(void **)val ? US"<cert>" : US"";
2094 #ifndef DISABLE_DKIM
2096 return dkim_exim_expand_query((int)(long)val);
2101 return NULL; /* Unknown variable. Silences static checkers. */
2108 modify_variable(uschar *name, void * value)
2111 if ((vp = find_var_ent(name))) vp->value = value;
2112 return; /* Unknown variable name, fail silently */
2120 /*************************************************
2121 * Read and expand substrings *
2122 *************************************************/
2124 /* This function is called to read and expand argument substrings for various
2125 expansion items. Some have a minimum requirement that is less than the maximum;
2126 in these cases, the first non-present one is set to NULL.
2129 sub points to vector of pointers to set
2130 n maximum number of substrings
2132 sptr points to current string pointer
2133 skipping the skipping flag
2134 check_end if TRUE, check for final '}'
2135 name name of item, for error message
2136 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
2139 Returns: 0 OK; string pointer updated
2140 1 curly bracketing error (too few arguments)
2141 2 too many arguments (only if check_end is set); message set
2142 3 other error (expansion failure)
2146 read_subs(uschar **sub, int n, int m, const uschar **sptr, BOOL skipping,
2147 BOOL check_end, uschar *name, BOOL *resetok)
2149 const uschar *s = *sptr;
2151 Uskip_whitespace(&s);
2152 for (int i = 0; i < n; i++)
2158 expand_string_message = string_sprintf("Not enough arguments for '%s' "
2159 "(min is %d)", name, m);
2165 if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok)))
2167 if (*s++ != '}') return 1;
2168 Uskip_whitespace(&s);
2170 if (check_end && *s++ != '}')
2174 expand_string_message = string_sprintf("Too many arguments for '%s' "
2175 "(max is %d)", name, n);
2178 expand_string_message = string_sprintf("missing '}' after '%s'", name);
2189 /*************************************************
2190 * Elaborate message for bad variable *
2191 *************************************************/
2193 /* For the "unknown variable" message, take a look at the variable's name, and
2194 give additional information about possible ACL variables. The extra information
2195 is added on to expand_string_message.
2197 Argument: the name of the variable
2202 check_variable_error_message(uschar *name)
2204 if (Ustrncmp(name, "acl_", 4) == 0)
2205 expand_string_message = string_sprintf("%s (%s)", expand_string_message,
2206 (name[4] == 'c' || name[4] == 'm')?
2208 US"6th character of a user-defined ACL variable must be a digit or underscore" :
2209 US"strict_acl_vars is set" /* Syntax is OK, it has to be this */
2211 US"user-defined ACL variables must start acl_c or acl_m");
2217 Load args from sub array to globals, and call acl_check().
2218 Sub array will be corrupted on return.
2220 Returns: OK access is granted by an ACCEPT verb
2221 DISCARD access is (apparently) granted by a DISCARD verb
2222 FAIL access is denied
2223 FAIL_DROP access is denied; drop the connection
2224 DEFER can't tell at the moment
2228 eval_acl(uschar ** sub, int nsub, uschar ** user_msgp)
2231 int sav_narg = acl_narg;
2233 uschar * dummy_logmsg;
2234 extern int acl_where;
2236 if(--nsub > nelem(acl_arg)) nsub = nelem(acl_arg);
2237 for (i = 0; i < nsub && sub[i+1]; i++)
2239 uschar * tmp = acl_arg[i];
2240 acl_arg[i] = sub[i+1]; /* place callers args in the globals */
2241 sub[i+1] = tmp; /* stash the old args using our caller's storage */
2246 sub[i+1] = acl_arg[i];
2247 acl_arg[i++] = NULL;
2251 debug_printf_indent("expanding: acl: %s arg: %s%s\n",
2253 acl_narg>0 ? acl_arg[0] : US"<none>",
2254 acl_narg>1 ? " +more" : "");
2256 ret = acl_eval(acl_where, sub[0], user_msgp, &dummy_logmsg);
2258 for (i = 0; i < nsub; i++)
2259 acl_arg[i] = sub[i+1]; /* restore old args */
2260 acl_narg = sav_narg;
2268 /* Return pointer to dewrapped string, with enclosing specified chars removed.
2269 The given string is modified on return. Leading whitespace is skipped while
2270 looking for the opening wrap character, then the rest is scanned for the trailing
2271 (non-escaped) wrap character. A backslash in the string will act as an escape.
2273 A nul is written over the trailing wrap, and a pointer to the char after the
2274 leading wrap is returned.
2277 s String for de-wrapping
2278 wrap Two-char string, the first being the opener, second the closer wrapping
2281 Pointer to de-wrapped string, or NULL on error (with expand_string_message set).
2285 dewrap(uschar * s, const uschar * wrap)
2289 BOOL quotesmode = wrap[0] == wrap[1];
2291 if (Uskip_whitespace(&p) == *wrap)
2297 if (*p == '\\') p++;
2298 else if (!quotesmode && *p == wrap[-1]) depth++;
2299 else if (*p == *wrap)
2310 expand_string_message = string_sprintf("missing '%c'", *wrap);
2315 /* Pull off the leading array or object element, returning
2316 a copy in an allocated string. Update the list pointer.
2318 The element may itself be an abject or array.
2319 Return NULL when the list is empty.
2323 json_nextinlist(const uschar ** list)
2325 unsigned array_depth = 0, object_depth = 0;
2326 const uschar * s = *list, * item;
2328 skip_whitespace(&s);
2331 *s && (*s != ',' || array_depth != 0 || object_depth != 0);
2335 case '[': array_depth++; break;
2336 case ']': array_depth--; break;
2337 case '{': object_depth++; break;
2338 case '}': object_depth--; break;
2340 *list = *s ? s+1 : s;
2341 if (item == s) return NULL;
2342 item = string_copyn(item, s - item);
2343 DEBUG(D_expand) debug_printf_indent(" json ele: '%s'\n", item);
2349 /************************************************/
2350 /* Return offset in ops table, or -1 if not found.
2351 Repoint to just after the operator in the string.
2354 ss string representation of operator
2355 opname split-out operator name
2359 identify_operator(const uschar ** ss, uschar ** opname)
2361 const uschar * s = *ss;
2364 /* Numeric comparisons are symbolic */
2366 if (*s == '=' || *s == '>' || *s == '<')
2378 /* All other conditions are named */
2381 s = read_name(name, sizeof(name), s, US"_");
2384 /* If we haven't read a name, it means some non-alpha character is first. */
2388 expand_string_message = string_sprintf("condition name expected, "
2389 "but found \"%.16s\"", s);
2393 *opname = string_copy(name);
2395 return chop_match(name, cond_table, nelem(cond_table));
2399 /*************************************************
2400 * Handle MD5 or SHA-1 computation for HMAC *
2401 *************************************************/
2403 /* These are some wrapping functions that enable the HMAC code to be a bit
2404 cleaner. A good compiler will spot the tail recursion.
2407 type HMAC_MD5 or HMAC_SHA1
2408 remaining are as for the cryptographic hash functions
2414 chash_start(int type, void * base)
2416 if (type == HMAC_MD5)
2417 md5_start((md5 *)base);
2419 sha1_start((hctx *)base);
2423 chash_mid(int type, void * base, const uschar * string)
2425 if (type == HMAC_MD5)
2426 md5_mid((md5 *)base, string);
2428 sha1_mid((hctx *)base, string);
2432 chash_end(int type, void * base, const uschar * string, int length,
2435 if (type == HMAC_MD5)
2436 md5_end((md5 *)base, string, length, digest);
2438 sha1_end((hctx *)base, string, length, digest);
2445 /* Do an hmac_md5. The result is _not_ nul-terminated, and is sized as
2446 the smaller of a full hmac_md5 result (16 bytes) or the supplied output buffer.
2449 key encoding key, nul-terminated
2450 src data to be hashed, nul-terminated
2452 len size of output buffer
2456 hmac_md5(const uschar * key, const uschar * src, uschar * buf, unsigned len)
2459 const uschar * keyptr;
2461 unsigned int keylen;
2463 #define MD5_HASHLEN 16
2464 #define MD5_HASHBLOCKLEN 64
2466 uschar keyhash[MD5_HASHLEN];
2467 uschar innerhash[MD5_HASHLEN];
2468 uschar finalhash[MD5_HASHLEN];
2469 uschar innerkey[MD5_HASHBLOCKLEN];
2470 uschar outerkey[MD5_HASHBLOCKLEN];
2473 keylen = Ustrlen(keyptr);
2475 /* If the key is longer than the hash block length, then hash the key
2478 if (keylen > MD5_HASHBLOCKLEN)
2480 chash_start(HMAC_MD5, &md5_base);
2481 chash_end(HMAC_MD5, &md5_base, keyptr, keylen, keyhash);
2483 keylen = MD5_HASHLEN;
2486 /* Now make the inner and outer key values */
2488 memset(innerkey, 0x36, MD5_HASHBLOCKLEN);
2489 memset(outerkey, 0x5c, MD5_HASHBLOCKLEN);
2491 for (int i = 0; i < keylen; i++)
2493 innerkey[i] ^= keyptr[i];
2494 outerkey[i] ^= keyptr[i];
2497 /* Now do the hashes */
2499 chash_start(HMAC_MD5, &md5_base);
2500 chash_mid(HMAC_MD5, &md5_base, innerkey);
2501 chash_end(HMAC_MD5, &md5_base, src, Ustrlen(src), innerhash);
2503 chash_start(HMAC_MD5, &md5_base);
2504 chash_mid(HMAC_MD5, &md5_base, outerkey);
2505 chash_end(HMAC_MD5, &md5_base, innerhash, MD5_HASHLEN, finalhash);
2507 /* Encode the final hash as a hex string, limited by output buffer size */
2510 for (int i = 0, j = len; i < MD5_HASHLEN; i++)
2512 if (j-- <= 0) break;
2513 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
2514 if (j-- <= 0) break;
2515 *p++ = hex_digits[finalhash[i] & 0x0f];
2519 #endif /*SUPPORT_SRS*/
2522 /*************************************************
2523 * Read and evaluate a condition *
2524 *************************************************/
2528 s points to the start of the condition text
2529 resetok points to a BOOL which is written false if it is unsafe to
2530 free memory. Certain condition types (acl) may have side-effect
2531 allocation which must be preserved.
2532 yield points to a BOOL to hold the result of the condition test;
2533 if NULL, we are just reading through a condition that is
2534 part of an "or" combination to check syntax, or in a state
2535 where the answer isn't required
2537 Returns: a pointer to the first character after the condition, or
2541 static const uschar *
2542 eval_condition(const uschar *s, BOOL *resetok, BOOL *yield)
2544 BOOL testfor = TRUE;
2545 BOOL tempcond, combined_cond;
2547 BOOL sub2_honour_dollar = TRUE;
2548 BOOL is_forany, is_json, is_jsons;
2549 int rc, cond_type, roffset;
2550 int_eximarith_t num[2];
2551 struct stat statbuf;
2554 const uschar *sub[10];
2557 const uschar *rerror;
2560 if (Uskip_whitespace(&s) == '!') { testfor = !testfor; s++; } else break;
2562 switch(cond_type = identify_operator(&s, &opname))
2564 /* def: tests for a non-empty variable, or for the existence of a header. If
2565 yield == NULL we are in a skipping state, and don't care about the answer. */
2574 expand_string_message = US"\":\" expected after \"def\"";
2578 s = read_name(name, sizeof(name), s+1, US"_");
2580 /* Test for a header's existence. If the name contains a closing brace
2581 character, this may be a user error where the terminating colon has been
2582 omitted. Set a flag to adjust a subsequent error message in this case. */
2584 if ( ( *(t = name) == 'h'
2585 || (*t == 'r' || *t == 'l' || *t == 'b') && *++t == 'h'
2587 && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
2590 s = read_header_name(name, sizeof(name), s);
2591 /* {-for-text-editors */
2592 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
2594 (find_header(name, NULL, FH_EXISTS_ONLY, NULL) != NULL) == testfor;
2597 /* Test for a variable's having a non-empty value. A non-existent variable
2598 causes an expansion failure. */
2602 if (!(t = find_variable(name, TRUE, yield == NULL, NULL)))
2604 expand_string_message = name[0]
2605 ? string_sprintf("unknown variable \"%s\" after \"%s:\"", name, cond_type == ECOND_DEF ? "def" : "tainted")
2606 : string_sprintf("variable name omitted after \"%s:\"", cond_type == ECOND_DEF ? "def" : "tainted");
2607 check_variable_error_message(name);
2610 if (yield) *yield = (cond_type == ECOND_DEF ? (t[0] != 0) : is_tainted(name)) == testfor;
2617 /* first_delivery tests for first delivery attempt */
2619 case ECOND_FIRST_DELIVERY:
2620 if (yield) *yield = f.deliver_firsttime == testfor;
2624 /* queue_running tests for any process started by a queue runner */
2626 case ECOND_QUEUE_RUNNING:
2627 if (yield) *yield = (queue_run_pid != (pid_t)0) == testfor;
2631 /* exists: tests for file existence
2632 isip: tests for any IP address
2633 isip4: tests for an IPv4 address
2634 isip6: tests for an IPv6 address
2635 pam: does PAM authentication
2636 radius: does RADIUS authentication
2637 ldapauth: does LDAP authentication
2638 pwcheck: does Cyrus SASL pwcheck authentication
2647 case ECOND_LDAPAUTH:
2650 if (Uskip_whitespace(&s) != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2652 sub[0] = expand_string_internal(s+1, TRUE, &s, yield == NULL, TRUE, resetok);
2653 if (!sub[0]) return NULL;
2654 /* {-for-text-editors */
2655 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2657 if (!yield) return s; /* No need to run the test if skipping */
2662 if ((expand_forbid & RDO_EXISTS) != 0)
2664 expand_string_message = US"File existence tests are not permitted";
2667 *yield = (Ustat(sub[0], &statbuf) == 0) == testfor;
2673 rc = string_is_ip_address(sub[0], NULL);
2674 *yield = ((cond_type == ECOND_ISIP)? (rc != 0) :
2675 (cond_type == ECOND_ISIP4)? (rc == 4) : (rc == 6)) == testfor;
2678 /* Various authentication tests - all optionally compiled */
2682 rc = auth_call_pam(sub[0], &expand_string_message);
2685 goto COND_FAILED_NOT_COMPILED;
2686 #endif /* SUPPORT_PAM */
2689 #ifdef RADIUS_CONFIG_FILE
2690 rc = auth_call_radius(sub[0], &expand_string_message);
2693 goto COND_FAILED_NOT_COMPILED;
2694 #endif /* RADIUS_CONFIG_FILE */
2696 case ECOND_LDAPAUTH:
2699 /* Just to keep the interface the same */
2701 int old_pool = store_pool;
2702 store_pool = POOL_SEARCH;
2703 rc = eldapauth_find((void *)(-1), NULL, sub[0], Ustrlen(sub[0]), NULL,
2704 &expand_string_message, &do_cache);
2705 store_pool = old_pool;
2709 goto COND_FAILED_NOT_COMPILED;
2710 #endif /* LOOKUP_LDAP */
2713 #ifdef CYRUS_PWCHECK_SOCKET
2714 rc = auth_call_pwcheck(sub[0], &expand_string_message);
2717 goto COND_FAILED_NOT_COMPILED;
2718 #endif /* CYRUS_PWCHECK_SOCKET */
2720 #if defined(SUPPORT_PAM) || defined(RADIUS_CONFIG_FILE) || \
2721 defined(LOOKUP_LDAP) || defined(CYRUS_PWCHECK_SOCKET)
2723 if (rc == ERROR || rc == DEFER) return NULL;
2724 *yield = (rc == OK) == testfor;
2730 /* call ACL (in a conditional context). Accept true, deny false.
2731 Defer is a forced-fail. Anything set by message= goes to $value.
2732 Up to ten parameters are used; we use the braces round the name+args
2733 like the saslauthd condition does, to permit a variable number of args.
2734 See also the expansion-item version EITEM_ACL and the traditional
2735 acl modifier ACLC_ACL.
2736 Since the ACL may allocate new global variables, tell our caller to not
2741 /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */
2747 Uskip_whitespace(&s);
2748 if (*s++ != '{') goto COND_FAILED_CURLY_START; /*}*/
2750 switch(read_subs(sub, nelem(sub), 1,
2751 &s, yield == NULL, TRUE, name, resetok))
2753 case 1: expand_string_message = US"too few arguments or bracketing "
2756 case 3: return NULL;
2762 *resetok = FALSE; /* eval_acl() might allocate; do not reclaim */
2763 switch(rc = eval_acl(sub, nelem(sub), &user_msg))
2768 lookup_value = NULL;
2770 lookup_value = string_copy(user_msg);
2771 *yield = cond == testfor;
2775 f.expand_string_forcedfail = TRUE;
2778 expand_string_message = string_sprintf("%s from acl \"%s\"",
2779 rc_names[rc], sub[0]);
2787 /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used:
2789 ${if saslauthd {{username}{password}{service}{realm}} {yes}{no}}
2791 However, the last two are optional. That is why the whole set is enclosed
2792 in their own set of braces. */
2794 case ECOND_SASLAUTHD:
2795 #ifndef CYRUS_SASLAUTHD_SOCKET
2796 goto COND_FAILED_NOT_COMPILED;
2800 Uskip_whitespace(&s);
2801 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2802 switch(read_subs(sub, nelem(sub), 2, &s, yield == NULL, TRUE, name,
2805 case 1: expand_string_message = US"too few arguments or bracketing "
2806 "error for saslauthd";
2808 case 3: return NULL;
2810 if (!sub[2]) sub[3] = NULL; /* realm if no service */
2813 int rc = auth_call_saslauthd(sub[0], sub[1], sub[2], sub[3],
2814 &expand_string_message);
2815 if (rc == ERROR || rc == DEFER) return NULL;
2816 *yield = (rc == OK) == testfor;
2820 #endif /* CYRUS_SASLAUTHD_SOCKET */
2823 /* symbolic operators for numeric and string comparison, and a number of
2824 other operators, all requiring two arguments.
2826 crypteq: encrypts plaintext and compares against an encrypted text,
2827 using crypt(), crypt16(), MD5 or SHA-1
2828 inlist/inlisti: checks if first argument is in the list of the second
2829 match: does a regular expression match and sets up the numerical
2830 variables if it succeeds
2831 match_address: matches in an address list
2832 match_domain: matches in a domain list
2833 match_ip: matches a host list that is restricted to IP addresses
2834 match_local_part: matches in a local part list
2837 case ECOND_MATCH_ADDRESS:
2838 case ECOND_MATCH_DOMAIN:
2839 case ECOND_MATCH_IP:
2840 case ECOND_MATCH_LOCAL_PART:
2841 #ifndef EXPAND_LISTMATCH_RHS
2842 sub2_honour_dollar = FALSE;
2851 case ECOND_NUM_L: /* Numerical comparisons */
2858 case ECOND_STR_LT: /* String comparisons */
2869 for (int i = 0; i < 2; i++)
2871 /* Sometimes, we don't expand substrings; too many insecure configurations
2872 created using match_address{}{} and friends, where the second param
2873 includes information from untrustworthy sources. */
2874 BOOL honour_dollar = TRUE;
2875 if ((i > 0) && !sub2_honour_dollar)
2876 honour_dollar = FALSE;
2878 if (Uskip_whitespace(&s) != '{')
2880 if (i == 0) goto COND_FAILED_CURLY_START;
2881 expand_string_message = string_sprintf("missing 2nd string in {} "
2882 "after \"%s\"", opname);
2885 if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
2886 honour_dollar, resetok)))
2888 DEBUG(D_expand) if (i == 1 && !sub2_honour_dollar && Ustrchr(sub[1], '$'))
2889 debug_printf_indent("WARNING: the second arg is NOT expanded,"
2890 " for security reasons\n");
2891 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2893 /* Convert to numerical if required; we know that the names of all the
2894 conditions that compare numbers do not start with a letter. This just saves
2895 checking for them individually. */
2897 if (!isalpha(opname[0]) && yield)
2902 debug_printf_indent("empty string cast to zero for numerical comparison\n");
2906 num[i] = expanded_string_integer(sub[i], FALSE);
2907 if (expand_string_message) return NULL;
2911 /* Result not required */
2913 if (!yield) return s;
2915 /* Do an appropriate comparison */
2921 tempcond = (num[0] == num[1]);
2925 tempcond = (num[0] > num[1]);
2929 tempcond = (num[0] >= num[1]);
2933 tempcond = (num[0] < num[1]);
2937 tempcond = (num[0] <= num[1]);
2941 tempcond = (Ustrcmp(sub[0], sub[1]) < 0);
2945 tempcond = (strcmpic(sub[0], sub[1]) < 0);
2949 tempcond = (Ustrcmp(sub[0], sub[1]) <= 0);
2953 tempcond = (strcmpic(sub[0], sub[1]) <= 0);
2957 tempcond = (Ustrcmp(sub[0], sub[1]) == 0);
2961 tempcond = (strcmpic(sub[0], sub[1]) == 0);
2965 tempcond = (Ustrcmp(sub[0], sub[1]) > 0);
2969 tempcond = (strcmpic(sub[0], sub[1]) > 0);
2973 tempcond = (Ustrcmp(sub[0], sub[1]) >= 0);
2977 tempcond = (strcmpic(sub[0], sub[1]) >= 0);
2980 case ECOND_MATCH: /* Regular expression match */
2981 if (!(re = pcre_compile(CS sub[1], PCRE_COPT, CCSS &rerror,
2984 expand_string_message = string_sprintf("regular expression error in "
2985 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
2988 tempcond = regex_match_and_setup(re, sub[0], 0, -1);
2991 case ECOND_MATCH_ADDRESS: /* Match in an address list */
2992 rc = match_address_list(sub[0], TRUE, FALSE, &(sub[1]), NULL, -1, 0, NULL);
2993 goto MATCHED_SOMETHING;
2995 case ECOND_MATCH_DOMAIN: /* Match in a domain list */
2996 rc = match_isinlist(sub[0], &(sub[1]), 0, &domainlist_anchor, NULL,
2997 MCL_DOMAIN + MCL_NOEXPAND, TRUE, NULL);
2998 goto MATCHED_SOMETHING;
3000 case ECOND_MATCH_IP: /* Match IP address in a host list */
3001 if (sub[0][0] != 0 && string_is_ip_address(sub[0], NULL) == 0)
3003 expand_string_message = string_sprintf("\"%s\" is not an IP address",
3009 unsigned int *nullcache = NULL;
3010 check_host_block cb;
3012 cb.host_name = US"";
3013 cb.host_address = sub[0];
3015 /* If the host address starts off ::ffff: it is an IPv6 address in
3016 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
3019 cb.host_ipv4 = (Ustrncmp(cb.host_address, "::ffff:", 7) == 0)?
3020 cb.host_address + 7 : cb.host_address;
3022 rc = match_check_list(
3023 &sub[1], /* the list */
3024 0, /* separator character */
3025 &hostlist_anchor, /* anchor pointer */
3026 &nullcache, /* cache pointer */
3027 check_host, /* function for testing */
3028 &cb, /* argument for function */
3029 MCL_HOST, /* type of check */
3030 sub[0], /* text for debugging */
3031 NULL); /* where to pass back data */
3033 goto MATCHED_SOMETHING;
3035 case ECOND_MATCH_LOCAL_PART:
3036 rc = match_isinlist(sub[0], &(sub[1]), 0, &localpartlist_anchor, NULL,
3037 MCL_LOCALPART + MCL_NOEXPAND, TRUE, NULL);
3052 expand_string_message = string_sprintf("unable to complete match "
3053 "against \"%s\": %s", sub[1], search_error_message);
3059 /* Various "encrypted" comparisons. If the second string starts with
3060 "{" then an encryption type is given. Default to crypt() or crypt16()
3061 (build-time choice). */
3062 /* }-for-text-editors */
3065 #ifndef SUPPORT_CRYPTEQ
3066 goto COND_FAILED_NOT_COMPILED;
3068 if (strncmpic(sub[1], US"{md5}", 5) == 0)
3070 int sublen = Ustrlen(sub[1]+5);
3075 md5_end(&base, sub[0], Ustrlen(sub[0]), digest);
3077 /* If the length that we are comparing against is 24, the MD5 digest
3078 is expressed as a base64 string. This is the way LDAP does it. However,
3079 some other software uses a straightforward hex representation. We assume
3080 this if the length is 32. Other lengths fail. */
3084 uschar *coded = b64encode(CUS digest, 16);
3085 DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
3086 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
3087 tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
3089 else if (sublen == 32)
3092 for (int i = 0; i < 16; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
3094 DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n"
3095 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
3096 tempcond = (strcmpic(coded, sub[1]+5) == 0);
3100 DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: "
3101 "fail\n crypted=%s\n", sub[1]+5);
3106 else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
3108 int sublen = Ustrlen(sub[1]+6);
3113 sha1_end(&h, sub[0], Ustrlen(sub[0]), digest);
3115 /* If the length that we are comparing against is 28, assume the SHA1
3116 digest is expressed as a base64 string. If the length is 40, assume a
3117 straightforward hex representation. Other lengths fail. */
3121 uschar *coded = b64encode(CUS digest, 20);
3122 DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
3123 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
3124 tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
3126 else if (sublen == 40)
3129 for (int i = 0; i < 20; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
3131 DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n"
3132 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
3133 tempcond = (strcmpic(coded, sub[1]+6) == 0);
3137 DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: "
3138 "fail\n crypted=%s\n", sub[1]+6);
3143 else /* {crypt} or {crypt16} and non-{ at start */
3144 /* }-for-text-editors */
3149 if (strncmpic(sub[1], US"{crypt}", 7) == 0)
3154 else if (strncmpic(sub[1], US"{crypt16}", 9) == 0)
3159 else if (sub[1][0] == '{') /* }-for-text-editors */
3161 expand_string_message = string_sprintf("unknown encryption mechanism "
3162 "in \"%s\"", sub[1]);
3168 case 0: coded = US DEFAULT_CRYPT(CS sub[0], CS sub[1]); break;
3169 case 1: coded = US crypt(CS sub[0], CS sub[1]); break;
3170 default: coded = US crypt16(CS sub[0], CS sub[1]); break;
3174 #define XSTR(s) STR(s)
3175 DEBUG(D_auth) debug_printf("crypteq: using %s()\n"
3176 " subject=%s\n crypted=%s\n",
3177 which == 0 ? XSTR(DEFAULT_CRYPT) : which == 1 ? "crypt" : "crypt16",
3182 /* If the encrypted string contains fewer than two characters (for the
3183 salt), force failure. Otherwise we get false positives: with an empty
3184 string the yield of crypt() is an empty string! */
3187 tempcond = Ustrlen(sub[1]) < 2 ? FALSE : Ustrcmp(coded, sub[1]) == 0;
3188 else if (errno == EINVAL)
3192 expand_string_message = string_sprintf("crypt error: %s\n",
3193 US strerror(errno));
3198 #endif /* SUPPORT_CRYPTEQ */
3203 const uschar * list = sub[1];
3205 uschar *save_iterate_item = iterate_item;
3206 int (*compare)(const uschar *, const uschar *);
3208 DEBUG(D_expand) debug_printf_indent("condition: %s item: %s\n", opname, sub[0]);
3211 compare = cond_type == ECOND_INLISTI
3212 ? strcmpic : (int (*)(const uschar *, const uschar *)) strcmp;
3214 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
3216 DEBUG(D_expand) debug_printf_indent(" compare %s\n", iterate_item);
3217 if (compare(sub[0], iterate_item) == 0)
3223 iterate_item = save_iterate_item;
3226 } /* Switch for comparison conditions */
3228 *yield = tempcond == testfor;
3229 return s; /* End of comparison conditions */
3232 /* and/or: computes logical and/or of several conditions */
3236 subcondptr = (yield == NULL) ? NULL : &tempcond;
3237 combined_cond = (cond_type == ECOND_AND);
3239 Uskip_whitespace(&s);
3240 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3244 /* {-for-text-editors */
3245 if (Uskip_whitespace(&s) == '}') break;
3246 if (*s != '{') /* }-for-text-editors */
3248 expand_string_message = string_sprintf("each subcondition "
3249 "inside an \"%s{...}\" condition must be in its own {}", opname);
3253 if (!(s = eval_condition(s+1, resetok, subcondptr)))
3255 expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
3256 expand_string_message, opname);
3259 Uskip_whitespace(&s);
3261 /* {-for-text-editors */
3264 /* {-for-text-editors */
3265 expand_string_message = string_sprintf("missing } at end of condition "
3266 "inside \"%s\" group", opname);
3271 if (cond_type == ECOND_AND)
3273 combined_cond &= tempcond;
3274 if (!combined_cond) subcondptr = NULL; /* once false, don't */
3275 } /* evaluate any more */
3278 combined_cond |= tempcond;
3279 if (combined_cond) subcondptr = NULL; /* once true, don't */
3280 } /* evaluate any more */
3283 if (yield) *yield = (combined_cond == testfor);
3287 /* forall/forany: iterates a condition with different values */
3289 case ECOND_FORALL: is_forany = FALSE; is_json = FALSE; is_jsons = FALSE; goto FORMANY;
3290 case ECOND_FORANY: is_forany = TRUE; is_json = FALSE; is_jsons = FALSE; goto FORMANY;
3291 case ECOND_FORALL_JSON: is_forany = FALSE; is_json = TRUE; is_jsons = FALSE; goto FORMANY;
3292 case ECOND_FORANY_JSON: is_forany = TRUE; is_json = TRUE; is_jsons = FALSE; goto FORMANY;
3293 case ECOND_FORALL_JSONS: is_forany = FALSE; is_json = TRUE; is_jsons = TRUE; goto FORMANY;
3294 case ECOND_FORANY_JSONS: is_forany = TRUE; is_json = TRUE; is_jsons = TRUE; goto FORMANY;
3298 const uschar * list;
3300 uschar *save_iterate_item = iterate_item;
3302 DEBUG(D_expand) debug_printf_indent("condition: %s\n", opname);
3304 Uskip_whitespace(&s);
3305 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3306 if (!(sub[0] = expand_string_internal(s, TRUE, &s, yield == NULL, TRUE, resetok)))
3308 /* {-for-text-editors */
3309 if (*s++ != '}') goto COND_FAILED_CURLY_END;
3311 Uskip_whitespace(&s);
3312 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3316 /* Call eval_condition once, with result discarded (as if scanning a
3317 "false" part). This allows us to find the end of the condition, because if
3318 the list it empty, we won't actually evaluate the condition for real. */
3320 if (!(s = eval_condition(sub[1], resetok, NULL)))
3322 expand_string_message = string_sprintf("%s inside \"%s\" condition",
3323 expand_string_message, opname);
3326 Uskip_whitespace(&s);
3328 /* {-for-text-editors */
3331 /* {-for-text-editors */
3332 expand_string_message = string_sprintf("missing } at end of condition "
3333 "inside \"%s\"", opname);
3337 if (yield) *yield = !testfor;
3339 if (is_json) list = dewrap(string_copy(list), US"[]");
3340 while ((iterate_item = is_json
3341 ? json_nextinlist(&list) : string_nextinlist(&list, &sep, NULL, 0)))
3344 if (!(iterate_item = dewrap(iterate_item, US"\"\"")))
3346 expand_string_message =
3347 string_sprintf("%s wrapping string result for extract jsons",
3348 expand_string_message);
3349 iterate_item = save_iterate_item;
3353 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", opname, iterate_item);
3354 if (!eval_condition(sub[1], resetok, &tempcond))
3356 expand_string_message = string_sprintf("%s inside \"%s\" condition",
3357 expand_string_message, opname);
3358 iterate_item = save_iterate_item;
3361 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", opname,
3362 tempcond? "true":"false");
3364 if (yield) *yield = (tempcond == testfor);
3365 if (tempcond == is_forany) break;
3368 iterate_item = save_iterate_item;
3373 /* The bool{} expansion condition maps a string to boolean.
3374 The values supported should match those supported by the ACL condition
3375 (acl.c, ACLC_CONDITION) so that we keep to a minimum the different ideas
3376 of true/false. Note that Router "condition" rules have a different
3377 interpretation, where general data can be used and only a few values
3379 Note that readconf.c boolean matching, for boolean configuration options,
3380 only matches true/yes/false/no.
3381 The bool_lax{} condition matches the Router logic, which is much more
3384 case ECOND_BOOL_LAX:
3390 BOOL boolvalue = FALSE;
3392 if (Uskip_whitespace(&s) != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3393 ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool";
3394 switch(read_subs(sub_arg, 1, 1, &s, yield == NULL, FALSE, ourname, resetok))
3396 case 1: expand_string_message = string_sprintf(
3397 "too few arguments or bracketing error for %s",
3401 case 3: return NULL;
3404 Uskip_whitespace(&t);
3405 if ((len = Ustrlen(t)))
3407 /* trailing whitespace: seems like a good idea to ignore it too */
3409 while (isspace(*t2)) t2--;
3410 if (t2 != (t + len))
3417 debug_printf_indent("considering %s: %s\n", ourname, len ? t : US"<empty>");
3418 /* logic for the lax case from expand_check_condition(), which also does
3419 expands, and the logic is both short and stable enough that there should
3420 be no maintenance burden from replicating it. */
3424 ? Ustrspn(t+1, "0123456789") == len-1
3425 : Ustrspn(t, "0123456789") == len)
3427 boolvalue = (Uatoi(t) == 0) ? FALSE : TRUE;
3428 /* expand_check_condition only does a literal string "0" check */
3429 if ((cond_type == ECOND_BOOL_LAX) && (len > 1))
3432 else if (strcmpic(t, US"true") == 0 || strcmpic(t, US"yes") == 0)
3434 else if (strcmpic(t, US"false") == 0 || strcmpic(t, US"no") == 0)
3436 else if (cond_type == ECOND_BOOL_LAX)
3440 expand_string_message = string_sprintf("unrecognised boolean "
3444 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", ourname,
3445 boolvalue? "true":"false");
3446 if (yield) *yield = (boolvalue == testfor);
3451 case ECOND_INBOUND_SRS:
3452 /* ${if inbound_srs {local_part}{secret} {yes}{no}} */
3459 BOOL boolvalue = FALSE;
3461 switch(read_subs(sub, 2, 2, CUSS &s, yield == NULL, FALSE, name, resetok))
3463 case 1: expand_string_message = US"too few arguments or bracketing "
3464 "error for inbound_srs";
3466 case 3: return NULL;
3469 /* Match the given local_part against the SRS-encoded pattern */
3471 re = regex_must_compile(US"^(?i)SRS0=([^=]+)=([A-Z2-7]+)=([^=]*)=(.*)$",
3473 if (pcre_exec(re, NULL, CS sub[0], Ustrlen(sub[0]), 0, PCRE_EOPT,
3474 ovec, nelem(ovec)) < 0)
3476 DEBUG(D_expand) debug_printf("no match for SRS'd local-part pattern\n");
3480 if (sub[0][0] == '"')
3482 else for (uschar * s = sub[0]; *s; s++)
3483 if (!isalnum(*s) && Ustrchr(".!#$%&'*+-/=?^_`{|}~", *s) == NULL)
3484 { quoting = 1; break; }
3486 DEBUG(D_expand) debug_printf_indent("auto-quoting local part\n");
3488 /* Record the (quoted, if needed) decoded recipient as $srs_recipient */
3490 srs_recipient = string_sprintf("%.*s%.*S%.*s@%.*S", /* lowercased */
3492 ovec[9]-ovec[8], sub[0] + ovec[8], /* substring 4 */
3494 ovec[7]-ovec[6], sub[0] + ovec[6]); /* substring 3 */
3496 /* If a zero-length secret was given, we're done. Otherwise carry on
3497 and validate the given SRS local_part againt our secret. */
3505 /* check the timestamp */
3508 uschar * ss = sub[0] + ovec[4]; /* substring 2, the timestamp */
3511 gettimeofday(&now, NULL);
3512 now.tv_sec /= 86400; /* days since epoch */
3514 /* Decode substring 2 from base32 to a number */
3516 for (d = 0, n = ovec[5]-ovec[4]; n; n--)
3518 uschar * t = Ustrchr(base32_chars, *ss++);
3519 d = d * 32 + (t - base32_chars);
3522 if (((now.tv_sec - d) & 0x3ff) > 10) /* days since SRS generated */
3524 DEBUG(D_expand) debug_printf("SRS too old\n");
3529 /* check length of substring 1, the offered checksum */
3531 if (ovec[3]-ovec[2] != 4)
3533 DEBUG(D_expand) debug_printf("SRS checksum wrong size\n");
3537 /* Hash the address with our secret, and compare that computed checksum
3538 with the one extracted from the arg */
3540 hmac_md5(sub[1], srs_recipient, cksum, sizeof(cksum));
3541 if (Ustrncmp(cksum, sub[0] + ovec[2], 4) != 0)
3543 DEBUG(D_expand) debug_printf("SRS checksum mismatch\n");
3549 if (yield) *yield = (boolvalue == testfor);
3552 #endif /*SUPPORT_SRS*/
3554 /* Unknown condition */
3557 if (!expand_string_message || !*expand_string_message)
3558 expand_string_message = string_sprintf("unknown condition \"%s\"", opname);
3560 } /* End switch on condition type */
3562 /* Missing braces at start and end of data */
3564 COND_FAILED_CURLY_START:
3565 expand_string_message = string_sprintf("missing { after \"%s\"", opname);
3568 COND_FAILED_CURLY_END:
3569 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
3573 /* A condition requires code that is not compiled */
3575 #if !defined(SUPPORT_PAM) || !defined(RADIUS_CONFIG_FILE) || \
3576 !defined(LOOKUP_LDAP) || !defined(CYRUS_PWCHECK_SOCKET) || \
3577 !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
3578 COND_FAILED_NOT_COMPILED:
3579 expand_string_message = string_sprintf("support for \"%s\" not compiled",
3588 /*************************************************
3589 * Save numerical variables *
3590 *************************************************/
3592 /* This function is called from items such as "if" that want to preserve and
3593 restore the numbered variables.
3596 save_expand_string points to an array of pointers to set
3597 save_expand_nlength points to an array of ints for the lengths
3599 Returns: the value of expand max to save
3603 save_expand_strings(uschar **save_expand_nstring, int *save_expand_nlength)
3605 for (int i = 0; i <= expand_nmax; i++)
3607 save_expand_nstring[i] = expand_nstring[i];
3608 save_expand_nlength[i] = expand_nlength[i];
3615 /*************************************************
3616 * Restore numerical variables *
3617 *************************************************/
3619 /* This function restored saved values of numerical strings.
3622 save_expand_nmax the number of strings to restore
3623 save_expand_string points to an array of pointers
3624 save_expand_nlength points to an array of ints
3630 restore_expand_strings(int save_expand_nmax, uschar **save_expand_nstring,
3631 int *save_expand_nlength)
3633 expand_nmax = save_expand_nmax;
3634 for (int i = 0; i <= expand_nmax; i++)
3636 expand_nstring[i] = save_expand_nstring[i];
3637 expand_nlength[i] = save_expand_nlength[i];
3645 /*************************************************
3646 * Handle yes/no substrings *
3647 *************************************************/
3649 /* This function is used by ${if}, ${lookup} and ${extract} to handle the
3650 alternative substrings that depend on whether or not the condition was true,
3651 or the lookup or extraction succeeded. The substrings always have to be
3652 expanded, to check their syntax, but "skipping" is set when the result is not
3653 needed - this avoids unnecessary nested lookups.
3656 skipping TRUE if we were skipping when this item was reached
3657 yes TRUE if the first string is to be used, else use the second
3658 save_lookup a value to put back into lookup_value before the 2nd expansion
3659 sptr points to the input string pointer
3660 yieldptr points to the output growable-string pointer
3661 type "lookup", "if", "extract", "run", "env", "listextract" or
3662 "certextract" for error message
3663 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
3666 Returns: 0 OK; lookup_value has been reset to save_lookup
3668 2 expansion failed because of bracketing error
3672 process_yesno(BOOL skipping, BOOL yes, uschar *save_lookup, const uschar **sptr,
3673 gstring ** yieldptr, uschar *type, BOOL *resetok)
3676 const uschar *s = *sptr; /* Local value */
3677 uschar *sub1, *sub2;
3678 const uschar * errwhere;
3680 /* If there are no following strings, we substitute the contents of $value for
3681 lookups and for extractions in the success case. For the ${if item, the string
3682 "true" is substituted. In the fail case, nothing is substituted for all three
3685 if (skip_whitespace(&s) == '}')
3689 if (yes && !skipping)
3690 *yieldptr = string_catn(*yieldptr, US"true", 4);
3694 if (yes && lookup_value && !skipping)
3695 *yieldptr = string_cat(*yieldptr, lookup_value);
3696 lookup_value = save_lookup;
3702 /* The first following string must be braced. */
3706 errwhere = US"'yes' part did not start with '{'";
3710 /* Expand the first substring. Forced failures are noticed only if we actually
3711 want this string. Set skipping in the call in the fail case (this will always
3712 be the case if we were already skipping). */
3714 sub1 = expand_string_internal(s, TRUE, &s, !yes, TRUE, resetok);
3715 if (sub1 == NULL && (yes || !f.expand_string_forcedfail)) goto FAILED;
3716 f.expand_string_forcedfail = FALSE;
3719 errwhere = US"'yes' part did not end with '}'";
3723 /* If we want the first string, add it to the output */
3726 *yieldptr = string_cat(*yieldptr, sub1);
3728 /* If this is called from a lookup/env or a (cert)extract, we want to restore
3729 $value to what it was at the start of the item, so that it has this value
3730 during the second string expansion. For the call from "if" or "run" to this
3731 function, save_lookup is set to lookup_value, so that this statement does
3734 lookup_value = save_lookup;
3736 /* There now follows either another substring, or "fail", or nothing. This
3737 time, forced failures are noticed only if we want the second string. We must
3738 set skipping in the nested call if we don't want this string, or if we were
3739 already skipping. */
3741 if (skip_whitespace(&s) == '{')
3743 sub2 = expand_string_internal(s+1, TRUE, &s, yes || skipping, TRUE, resetok);
3744 if (sub2 == NULL && (!yes || !f.expand_string_forcedfail)) goto FAILED;
3745 f.expand_string_forcedfail = FALSE;
3748 errwhere = US"'no' part did not start with '{'";
3752 /* If we want the second string, add it to the output */
3755 *yieldptr = string_cat(*yieldptr, sub2);
3758 /* If there is no second string, but the word "fail" is present when the use of
3759 the second string is wanted, set a flag indicating it was a forced failure
3760 rather than a syntactic error. Swallow the terminating } in case this is nested
3761 inside another lookup or if or extract. */
3766 /* deconst cast ok here as source is s anyway */
3767 s = US read_name(name, sizeof(name), s, US"_");
3768 if (Ustrcmp(name, "fail") == 0)
3770 if (!yes && !skipping)
3772 Uskip_whitespace(&s);
3775 errwhere = US"did not close with '}' after forcedfail";
3778 expand_string_message =
3779 string_sprintf("\"%s\" failed and \"fail\" requested", type);
3780 f.expand_string_forcedfail = TRUE;
3786 expand_string_message =
3787 string_sprintf("syntax error in \"%s\" item - \"fail\" expected", type);
3792 /* All we have to do now is to check on the final closing brace. */
3794 skip_whitespace(&s);
3797 errwhere = US"did not close with '}'";
3803 /* Update the input pointer value before returning */
3808 /* Get here if there is a bracketing failure */
3809 expand_string_message = string_sprintf(
3810 "curly-bracket problem in conditional yes/no parsing: %s\n"
3811 " remaining string is '%s'", errwhere, --s);
3816 /* Get here for other failures */
3824 /********************************************************
3825 * prvs: Get last three digits of days since Jan 1, 1970 *
3826 ********************************************************/
3828 /* This is needed to implement the "prvs" BATV reverse
3831 Argument: integer "days" offset to add or substract to
3832 or from the current number of days.
3834 Returns: pointer to string containing the last three
3835 digits of the number of days since Jan 1, 1970,
3836 modified by the offset argument, NULL if there
3837 was an error in the conversion.
3842 prvs_daystamp(int day_offset)
3844 uschar *days = store_get(32, FALSE); /* Need at least 24 for cases */
3845 (void)string_format(days, 32, TIME_T_FMT, /* where TIME_T_FMT is %lld */
3846 (time(NULL) + day_offset*86400)/86400);
3847 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
3852 /********************************************************
3853 * prvs: perform HMAC-SHA1 computation of prvs bits *
3854 ********************************************************/
3856 /* This is needed to implement the "prvs" BATV reverse
3860 address RFC2821 Address to use
3861 key The key to use (must be less than 64 characters
3863 key_num Single-digit key number to use. Defaults to
3866 Returns: pointer to string containing the first three
3867 bytes of the final hash in hex format, NULL if
3868 there was an error in the process.
3872 prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
3874 gstring * hash_source;
3877 uschar innerhash[20];
3878 uschar finalhash[20];
3879 uschar innerkey[64];
3880 uschar outerkey[64];
3881 uschar *finalhash_hex;
3886 if (Ustrlen(key) > 64)
3889 hash_source = string_catn(NULL, key_num, 1);
3890 hash_source = string_catn(hash_source, daystamp, 3);
3891 hash_source = string_cat(hash_source, address);
3892 (void) string_from_gstring(hash_source);
3895 debug_printf_indent("prvs: hash source is '%s'\n", hash_source->s);
3897 memset(innerkey, 0x36, 64);
3898 memset(outerkey, 0x5c, 64);
3900 for (int i = 0; i < Ustrlen(key); i++)
3902 innerkey[i] ^= key[i];
3903 outerkey[i] ^= key[i];
3906 chash_start(HMAC_SHA1, &h);
3907 chash_mid(HMAC_SHA1, &h, innerkey);
3908 chash_end(HMAC_SHA1, &h, hash_source->s, hash_source->ptr, innerhash);
3910 chash_start(HMAC_SHA1, &h);
3911 chash_mid(HMAC_SHA1, &h, outerkey);
3912 chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
3914 /* Hashing is deemed sufficient to de-taint any input data */
3916 p = finalhash_hex = store_get(40, FALSE);
3917 for (int i = 0; i < 3; i++)
3919 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
3920 *p++ = hex_digits[finalhash[i] & 0x0f];
3924 return finalhash_hex;
3930 /*************************************************
3931 * Join a file onto the output string *
3932 *************************************************/
3934 /* This is used for readfile/readsock and after a run expansion.
3935 It joins the contents of a file onto the output string, globally replacing
3936 newlines with a given string (optionally).
3940 yield pointer to the expandable string struct
3941 eol newline replacement string, or NULL
3943 Returns: new pointer for expandable string, terminated if non-null
3947 cat_file(FILE *f, gstring *yield, uschar *eol)
3949 uschar buffer[1024];
3951 while (Ufgets(buffer, sizeof(buffer), f))
3953 int len = Ustrlen(buffer);
3954 if (eol && buffer[len-1] == '\n') len--;
3955 yield = string_catn(yield, buffer, len);
3956 if (eol && buffer[len])
3957 yield = string_cat(yield, eol);
3960 (void) string_from_gstring(yield);
3967 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
3970 uschar buffer[1024];
3972 /*XXX could we read direct into a pre-grown string? */
3974 while ((rc = tls_read(tls_ctx, buffer, sizeof(buffer))) > 0)
3975 for (uschar * s = buffer; rc--; s++)
3976 yield = eol && *s == '\n'
3977 ? string_cat(yield, eol) : string_catn(yield, s, 1);
3979 /* We assume that all errors, and any returns of zero bytes,
3980 are actually EOF. */
3982 (void) string_from_gstring(yield);
3988 /*************************************************
3989 * Evaluate numeric expression *
3990 *************************************************/
3992 /* This is a set of mutually recursive functions that evaluate an arithmetic
3993 expression involving + - * / % & | ^ ~ << >> and parentheses. The only one of
3994 these functions that is called from elsewhere is eval_expr, whose interface is:
3997 sptr pointer to the pointer to the string - gets updated
3998 decimal TRUE if numbers are to be assumed decimal
3999 error pointer to where to put an error message - must be NULL on input
4000 endket TRUE if ')' must terminate - FALSE for external call
4002 Returns: on success: the value of the expression, with *error still NULL
4003 on failure: an undefined value, with *error = a message
4006 static int_eximarith_t eval_op_or(uschar **, BOOL, uschar **);
4009 static int_eximarith_t
4010 eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
4013 int_eximarith_t x = eval_op_or(&s, decimal, error);
4018 *error = US"expecting closing parenthesis";
4020 while (isspace(*++s));
4022 *error = US"expecting operator";
4028 static int_eximarith_t
4029 eval_number(uschar **sptr, BOOL decimal, uschar **error)
4035 if (isdigit((c = Uskip_whitespace(&s))))
4038 (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
4040 switch (tolower(*s))
4043 case 'k': n *= 1024; s++; break;
4044 case 'm': n *= 1024*1024; s++; break;
4045 case 'g': n *= 1024*1024*1024; s++; break;
4047 Uskip_whitespace(&s);
4052 n = eval_expr(&s, decimal, error, 1);
4056 *error = US"expecting number or opening parenthesis";
4064 static int_eximarith_t
4065 eval_op_unary(uschar **sptr, BOOL decimal, uschar **error)
4069 Uskip_whitespace(&s);
4070 if (*s == '+' || *s == '-' || *s == '~')
4073 x = eval_op_unary(&s, decimal, error);
4074 if (op == '-') x = -x;
4075 else if (op == '~') x = ~x;
4078 x = eval_number(&s, decimal, error);
4085 static int_eximarith_t
4086 eval_op_mult(uschar **sptr, BOOL decimal, uschar **error)
4089 int_eximarith_t x = eval_op_unary(&s, decimal, error);
4092 while (*s == '*' || *s == '/' || *s == '%')
4095 int_eximarith_t y = eval_op_unary(&s, decimal, error);
4097 /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
4098 * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
4099 * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where
4100 * -N*M is INT_MIN will yield INT_MIN.
4101 * Since we don't support floating point, this is somewhat simpler.
4102 * Ideally, we'd return an error, but since we overflow for all other
4103 * arithmetic, consistency suggests otherwise, but what's the correct value
4104 * to use? There is none.
4105 * The C standard guarantees overflow for unsigned arithmetic but signed
4106 * overflow invokes undefined behaviour; in practice, this is overflow
4107 * except for converting INT_MIN to INT_MAX+1. We also can't guarantee
4108 * that long/longlong larger than int are available, or we could just work
4109 * with larger types. We should consider whether to guarantee 32bit eval
4110 * and 64-bit working variables, with errors returned. For now ...
4111 * So, the only SIGFPEs occur with a non-shrinking div/mod, thus -1; we
4112 * can just let the other invalid results occur otherwise, as they have
4113 * until now. For this one case, we can coerce.
4115 if (y == -1 && x == EXIM_ARITH_MIN && op != '*')
4118 debug_printf("Integer exception dodging: " PR_EXIM_ARITH "%c-1 coerced to " PR_EXIM_ARITH "\n",
4119 EXIM_ARITH_MIN, op, EXIM_ARITH_MAX);
4129 *error = (op == '/') ? US"divide by zero" : US"modulo by zero";
4145 static int_eximarith_t
4146 eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
4149 int_eximarith_t x = eval_op_mult(&s, decimal, error);
4152 while (*s == '+' || *s == '-')
4155 int_eximarith_t y = eval_op_mult(&s, decimal, error);
4157 if ( (x >= EXIM_ARITH_MAX/2 && x >= EXIM_ARITH_MAX/2)
4158 || (x <= -(EXIM_ARITH_MAX/2) && y <= -(EXIM_ARITH_MAX/2)))
4159 { /* over-conservative check */
4161 ? US"overflow in sum" : US"overflow in difference";
4164 if (op == '+') x += y; else x -= y;
4172 static int_eximarith_t
4173 eval_op_shift(uschar **sptr, BOOL decimal, uschar **error)
4176 int_eximarith_t x = eval_op_sum(&s, decimal, error);
4179 while ((*s == '<' || *s == '>') && s[1] == s[0])
4184 y = eval_op_sum(&s, decimal, error);
4186 if (op == '<') x <<= y; else x >>= y;
4194 static int_eximarith_t
4195 eval_op_and(uschar **sptr, BOOL decimal, uschar **error)
4198 int_eximarith_t x = eval_op_shift(&s, decimal, error);
4205 y = eval_op_shift(&s, decimal, error);
4215 static int_eximarith_t
4216 eval_op_xor(uschar **sptr, BOOL decimal, uschar **error)
4219 int_eximarith_t x = eval_op_and(&s, decimal, error);
4226 y = eval_op_and(&s, decimal, error);
4236 static int_eximarith_t
4237 eval_op_or(uschar **sptr, BOOL decimal, uschar **error)
4240 int_eximarith_t x = eval_op_xor(&s, decimal, error);
4247 y = eval_op_xor(&s, decimal, error);
4258 /************************************************/
4259 /* Comparison operation for sort expansion. We need to avoid
4260 re-expanding the fields being compared, so need a custom routine.
4263 cond_type Comparison operator code
4264 leftarg, rightarg Arguments for comparison
4266 Return true iff (leftarg compare rightarg)
4270 sortsbefore(int cond_type, BOOL alpha_cond,
4271 const uschar * leftarg, const uschar * rightarg)
4273 int_eximarith_t l_num, r_num;
4277 l_num = expanded_string_integer(leftarg, FALSE);
4278 if (expand_string_message) return FALSE;
4279 r_num = expanded_string_integer(rightarg, FALSE);
4280 if (expand_string_message) return FALSE;
4284 case ECOND_NUM_G: return l_num > r_num;
4285 case ECOND_NUM_GE: return l_num >= r_num;
4286 case ECOND_NUM_L: return l_num < r_num;
4287 case ECOND_NUM_LE: return l_num <= r_num;
4294 case ECOND_STR_LT: return Ustrcmp (leftarg, rightarg) < 0;
4295 case ECOND_STR_LTI: return strcmpic(leftarg, rightarg) < 0;
4296 case ECOND_STR_LE: return Ustrcmp (leftarg, rightarg) <= 0;
4297 case ECOND_STR_LEI: return strcmpic(leftarg, rightarg) <= 0;
4298 case ECOND_STR_GT: return Ustrcmp (leftarg, rightarg) > 0;
4299 case ECOND_STR_GTI: return strcmpic(leftarg, rightarg) > 0;
4300 case ECOND_STR_GE: return Ustrcmp (leftarg, rightarg) >= 0;
4301 case ECOND_STR_GEI: return strcmpic(leftarg, rightarg) >= 0;
4304 return FALSE; /* should not happen */
4308 /*************************************************
4310 *************************************************/
4312 /* Returns either an unchanged string, or the expanded string in stacking pool
4313 store. Interpreted sequences are:
4315 \... normal escaping rules
4316 $name substitutes the variable
4318 ${op:string} operates on the expanded string value
4319 ${item{arg1}{arg2}...} expands the args and then does the business
4320 some literal args are not enclosed in {}
4322 There are now far too many operators and item types to make it worth listing
4323 them here in detail any more.
4325 We use an internal routine recursively to handle embedded substrings. The
4326 external function follows. The yield is NULL if the expansion failed, and there
4327 are two cases: if something collapsed syntactically, or if "fail" was given
4328 as the action on a lookup failure. These can be distinguished by looking at the
4329 variable expand_string_forcedfail, which is TRUE in the latter case.
4331 The skipping flag is set true when expanding a substring that isn't actually
4332 going to be used (after "if" or "lookup") and it prevents lookups from
4333 happening lower down.
4335 Store usage: At start, a store block of the length of the input plus 64
4336 is obtained. This is expanded as necessary by string_cat(), which might have to
4337 get a new block, or might be able to expand the original. At the end of the
4338 function we can release any store above that portion of the yield block that
4339 was actually used. In many cases this will be optimal.
4341 However: if the first item in the expansion is a variable name or header name,
4342 we reset the store before processing it; if the result is in fresh store, we
4343 use that without copying. This is helpful for expanding strings like
4344 $message_headers which can get very long.
4346 There's a problem if a ${dlfunc item has side-effects that cause allocation,
4347 since resetting the store at the end of the expansion will free store that was
4348 allocated by the plugin code as well as the slop after the expanded string. So
4349 we skip any resets if ${dlfunc } has been used. The same applies for ${acl }
4350 and, given the acl condition, ${if }. This is an unfortunate consequence of
4351 string expansion becoming too powerful.
4354 string the string to be expanded
4355 ket_ends true if expansion is to stop at }
4356 left if not NULL, a pointer to the first character after the
4357 expansion is placed here (typically used with ket_ends)
4358 skipping TRUE for recursive calls when the value isn't actually going
4359 to be used (to allow for optimisation)
4360 honour_dollar TRUE if $ is to be expanded,
4361 FALSE if it's just another character
4362 resetok_p if not NULL, pointer to flag - write FALSE if unsafe to reset
4365 Returns: NULL if expansion fails:
4366 expand_string_forcedfail is set TRUE if failure was forced
4367 expand_string_message contains a textual error message
4368 a pointer to the expanded string on success
4372 expand_string_internal(const uschar *string, BOOL ket_ends, const uschar **left,
4373 BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
4375 rmark reset_point = store_mark();
4376 gstring * yield = string_get(Ustrlen(string) + 64);
4378 const uschar *s = string;
4379 uschar *save_expand_nstring[EXPAND_MAXN+1];
4380 int save_expand_nlength[EXPAND_MAXN+1];
4381 BOOL resetok = TRUE;
4386 debug_printf_indent("/%s: %s\n",
4387 skipping ? "---scanning" : "considering", string);
4389 debug_printf_indent(UTF8_DOWN_RIGHT "%s: %s\n",
4391 ? UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ "scanning"
4395 f.expand_string_forcedfail = FALSE;
4396 expand_string_message = US"";
4398 if (is_tainted(string))
4400 expand_string_message =
4401 string_sprintf("attempt to expand tainted string '%s'", s);
4402 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
4411 /* \ escapes the next character, which must exist, or else
4412 the expansion fails. There's a special escape, \N, which causes
4413 copying of the subject verbatim up to the next \N. Otherwise,
4414 the escapes are the standard set. */
4420 expand_string_message = US"\\ at end of string";
4426 const uschar * t = s + 2;
4427 for (s = t; *s != 0; s++) if (*s == '\\' && s[1] == 'N') break;
4428 yield = string_catn(yield, t, s - t);
4429 if (*s != 0) s += 2;
4435 ch[0] = string_interpret_escape(&s);
4437 yield = string_catn(yield, ch, 1);
4444 /* Anything other than $ is just copied verbatim, unless we are
4445 looking for a terminating } character. */
4448 if (ket_ends && *s == '}') break;
4450 if (*s != '$' || !honour_dollar)
4452 yield = string_catn(yield, s++, 1);
4456 /* No { after the $ - must be a plain name or a number for string
4457 match variable. There has to be a fudge for variables that are the
4458 names of header fields preceded by "$header_" because header field
4459 names can contain any printing characters except space and colon.
4460 For those that don't like typing this much, "$h_" is a synonym for
4461 "$header_". A non-existent header yields a NULL value; nothing is
4464 if (isalpha((*(++s))))
4471 s = read_name(name, sizeof(name), s, US"_");
4473 /* If this is the first thing to be expanded, release the pre-allocated
4477 g = store_get(sizeof(gstring), FALSE);
4478 else if (yield->ptr == 0)
4480 if (resetok) reset_point = store_reset(reset_point);
4482 reset_point = store_mark();
4483 g = store_get(sizeof(gstring), FALSE); /* alloc _before_ calling find_variable() */
4488 if ( ( *(t = name) == 'h'
4489 || (*t == 'r' || *t == 'l' || *t == 'b') && *++t == 'h'
4491 && (*++t == '_' || Ustrncmp(t, "eader_", 6) == 0)
4494 unsigned flags = *name == 'r' ? FH_WANT_RAW
4495 : *name == 'l' ? FH_WANT_RAW|FH_WANT_LIST
4497 uschar * charset = *name == 'b' ? NULL : headers_charset;
4499 s = read_header_name(name, sizeof(name), s);
4500 value = find_header(name, &newsize, flags, charset);
4502 /* If we didn't find the header, and the header contains a closing brace
4503 character, this may be a user error where the terminating colon
4504 has been omitted. Set a flag to adjust the error message in this case.
4505 But there is no error here - nothing gets inserted. */
4509 if (Ustrchr(name, '}')) malformed_header = TRUE;
4516 else if (!(value = find_variable(name, FALSE, skipping, &newsize)))
4518 expand_string_message =
4519 string_sprintf("unknown variable name \"%s\"", name);
4520 check_variable_error_message(name);
4524 /* If the data is known to be in a new buffer, newsize will be set to the
4525 size of that buffer. If this is the first thing in an expansion string,
4526 yield will be NULL; just point it at the new store instead of copying. Many
4527 expansion strings contain just one reference, so this is a useful
4528 optimization, especially for humungous headers. We need to use a gstring
4529 structure that is not allocated after that new-buffer, else a later store
4530 reset in the middle of the buffer will make it inaccessible. */
4532 len = Ustrlen(value);
4533 if (!yield && newsize != 0)
4536 yield->size = newsize;
4541 yield = string_catn(yield, value, len);
4549 s = read_cnumber(&n, s);
4550 if (n >= 0 && n <= expand_nmax)
4551 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4555 /* Otherwise, if there's no '{' after $ it's an error. */ /*}*/
4557 if (*s != '{') /*}*/
4559 expand_string_message = US"$ not followed by letter, digit, or {"; /*}*/
4563 /* After { there can be various things, but they all start with
4564 an initial word, except for a number for a string match variable. */
4566 if (isdigit((*(++s))))
4569 s = read_cnumber(&n, s); /*{*/
4572 expand_string_message = US"} expected after number";
4575 if (n >= 0 && n <= expand_nmax)
4576 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4582 expand_string_message = US"letter or digit expected after ${"; /*}*/
4586 /* Allow "-" in names to cater for substrings with negative
4587 arguments. Since we are checking for known names after { this is
4590 s = read_name(name, sizeof(name), s, US"_-");
4591 item_type = chop_match(name, item_table, nelem(item_table));
4595 /* Call an ACL from an expansion. We feed data in via $acl_arg1 - $acl_arg9.
4596 If the ACL returns accept or reject we return content set by "message ="
4597 There is currently no limit on recursion; this would have us call
4598 acl_check_internal() directly and get a current level from somewhere.
4599 See also the acl expansion condition ECOND_ACL and the traditional
4600 acl modifier ACLC_ACL.
4601 Assume that the function has side-effects on the store that must be preserved.
4605 /* ${acl {name} {arg1}{arg2}...} */
4607 uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
4611 switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, name,
4614 case 1: goto EXPAND_FAILED_CURLY;
4616 case 3: goto EXPAND_FAILED;
4618 if (skipping) continue;
4621 switch(rc = eval_acl(sub, nelem(sub), &user_msg))
4626 debug_printf_indent("acl expansion yield: %s\n", user_msg);
4628 yield = string_cat(yield, user_msg);
4632 f.expand_string_forcedfail = TRUE;
4635 expand_string_message = string_sprintf("%s from acl \"%s\"",
4636 rc_names[rc], sub[0]);
4641 case EITEM_AUTHRESULTS:
4642 /* ${authresults {mysystemname}} */
4646 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, skipping, TRUE, name,
4649 case 1: goto EXPAND_FAILED_CURLY;
4651 case 3: goto EXPAND_FAILED;
4654 yield = string_append(yield, 3,
4655 US"Authentication-Results: ", sub_arg[0], US"; none");
4658 yield = authres_local(yield, sub_arg[0]);
4659 yield = authres_iprev(yield);
4660 yield = authres_smtpauth(yield);
4662 yield = authres_spf(yield);
4664 #ifndef DISABLE_DKIM
4665 yield = authres_dkim(yield);
4667 #ifdef SUPPORT_DMARC
4668 yield = authres_dmarc(yield);
4670 #ifdef EXPERIMENTAL_ARC
4671 yield = authres_arc(yield);
4676 /* Handle conditionals - preserve the values of the numerical expansion
4677 variables in case they get changed by a regular expression match in the
4678 condition. If not, they retain their external settings. At the end
4679 of this "if" section, they get restored to their previous values. */
4684 const uschar *next_s;
4685 int save_expand_nmax =
4686 save_expand_strings(save_expand_nstring, save_expand_nlength);
4688 Uskip_whitespace(&s);
4689 if (!(next_s = eval_condition(s, &resetok, skipping ? NULL : &cond)))
4690 goto EXPAND_FAILED; /* message already set */
4695 debug_printf_indent("|--condition: %.*s\n", (int)(next_s - s), s);
4696 debug_printf_indent("|-----result: %s\n", cond ? "true" : "false");
4700 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
4701 "condition: %.*s\n",
4702 (int)(next_s - s), s);
4703 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
4704 UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
4706 cond ? "true" : "false");
4711 /* The handling of "yes" and "no" result strings is now in a separate
4712 function that is also used by ${lookup} and ${extract} and ${run}. */
4714 switch(process_yesno(
4715 skipping, /* were previously skipping */
4716 cond, /* success/failure indicator */
4717 lookup_value, /* value to reset for string2 */
4718 &s, /* input pointer */
4719 &yield, /* output pointer */
4720 US"if", /* condition type */
4723 case 1: goto EXPAND_FAILED; /* when all is well, the */
4724 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4727 /* Restore external setting of expansion variables for continuation
4730 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4731 save_expand_nlength);
4736 case EITEM_IMAPFOLDER:
4737 { /* ${imapfolder {name}{sep]{specials}} */
4741 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, skipping, TRUE, name,
4744 case 1: goto EXPAND_FAILED_CURLY;
4746 case 3: goto EXPAND_FAILED;
4749 if (!sub_arg[1]) /* One argument */
4751 sub_arg[1] = US"/"; /* default separator */
4754 else if (Ustrlen(sub_arg[1]) != 1)
4756 expand_string_message =
4758 "IMAP folder separator must be one character, found \"%s\"",
4765 if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
4766 sub_arg[1][0], sub_arg[2], &expand_string_message)))
4768 yield = string_cat(yield, encoded);
4774 /* Handle database lookups unless locked out. If "skipping" is TRUE, we are
4775 expanding an internal string that isn't actually going to be used. All we
4776 need to do is check the syntax, so don't do a lookup at all. Preserve the
4777 values of the numerical expansion variables in case they get changed by a
4778 partial lookup. If not, they retain their external settings. At the end
4779 of this "lookup" section, they get restored to their previous values. */
4783 int stype, partial, affixlen, starflags;
4784 int expand_setup = 0;
4786 uschar *key, *filename;
4787 const uschar * affix, * opts;
4788 uschar *save_lookup_value = lookup_value;
4789 int save_expand_nmax =
4790 save_expand_strings(save_expand_nstring, save_expand_nlength);
4792 if (expand_forbid & RDO_LOOKUP)
4794 expand_string_message = US"lookup expansions are not permitted";
4798 /* Get the key we are to look up for single-key+file style lookups.
4799 Otherwise set the key NULL pro-tem. */
4801 if (Uskip_whitespace(&s) == '{') /*}*/
4803 key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4804 if (!key) goto EXPAND_FAILED; /*{{*/
4807 expand_string_message = US"missing '}' after lookup key";
4808 goto EXPAND_FAILED_CURLY;
4810 Uskip_whitespace(&s);
4814 /* Find out the type of database */
4818 expand_string_message = US"missing lookup type";
4822 /* The type is a string that may contain special characters of various
4823 kinds. Allow everything except space or { to appear; the actual content
4824 is checked by search_findtype_partial. */ /*}*/
4826 while (*s && *s != '{' && !isspace(*s)) /*}*/
4828 if (nameptr < sizeof(name) - 1) name[nameptr++] = *s;
4831 name[nameptr] = '\0';
4832 Uskip_whitespace(&s);
4834 /* Now check for the individual search type and any partial or default
4835 options. Only those types that are actually in the binary are valid. */
4837 if ((stype = search_findtype_partial(name, &partial, &affix, &affixlen,
4838 &starflags, &opts)) < 0)
4840 expand_string_message = search_error_message;
4844 /* Check that a key was provided for those lookup types that need it,
4845 and was not supplied for those that use the query style. */
4847 if (!mac_islookup(stype, lookup_querystyle|lookup_absfilequery))
4851 expand_string_message = string_sprintf("missing {key} for single-"
4852 "key \"%s\" lookup", name);
4860 expand_string_message = string_sprintf("a single key was given for "
4861 "lookup type \"%s\", which is not a single-key lookup type", name);
4866 /* Get the next string in brackets and expand it. It is the file name for
4867 single-key+file lookups, and the whole query otherwise. In the case of
4868 queries that also require a file name (e.g. sqlite), the file name comes
4873 expand_string_message = US"missing '{' for lookup file-or-query arg";
4874 goto EXPAND_FAILED_CURLY;
4876 if (!(filename = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok)))
4880 expand_string_message = US"missing '}' closing lookup file-or-query arg";
4881 goto EXPAND_FAILED_CURLY;
4883 Uskip_whitespace(&s);
4885 /* If this isn't a single-key+file lookup, re-arrange the variables
4886 to be appropriate for the search_ functions. For query-style lookups,
4887 there is just a "key", and no file name. For the special query-style +
4888 file types, the query (i.e. "key") starts with a file name. */
4891 key = search_args(stype, name, filename, &filename, opts);
4893 /* If skipping, don't do the next bit - just lookup_value == NULL, as if
4894 the entry was not found. Note that there is no search_close() function.
4895 Files are left open in case of re-use. At suitable places in higher logic,
4896 search_tidyup() is called to tidy all open files. This can save opening
4897 the same file several times. However, files may also get closed when
4898 others are opened, if too many are open at once. The rule is that a
4899 handle should not be used after a second search_open().
4901 Request that a partial search sets up $1 and maybe $2 by passing
4902 expand_setup containing zero. If its value changes, reset expand_nmax,
4903 since new variables will have been set. Note that at the end of this
4904 "lookup" section, the old numeric variables are restored. */
4907 lookup_value = NULL;
4910 void *handle = search_open(filename, stype, 0, NULL, NULL);
4913 expand_string_message = search_error_message;
4916 lookup_value = search_find(handle, filename, key, partial, affix,
4917 affixlen, starflags, &expand_setup, opts);
4918 if (f.search_find_defer)
4920 expand_string_message =
4921 string_sprintf("lookup of \"%s\" gave DEFER: %s",
4922 string_printing2(key, FALSE), search_error_message);
4925 if (expand_setup > 0) expand_nmax = expand_setup;
4928 /* The handling of "yes" and "no" result strings is now in a separate
4929 function that is also used by ${if} and ${extract}. */
4931 switch(process_yesno(
4932 skipping, /* were previously skipping */
4933 lookup_value != NULL, /* success/failure indicator */
4934 save_lookup_value, /* value to reset for string2 */
4935 &s, /* input pointer */
4936 &yield, /* output pointer */
4937 US"lookup", /* condition type */
4940 case 1: goto EXPAND_FAILED; /* when all is well, the */
4941 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4944 /* Restore external setting of expansion variables for carrying on
4945 at this level, and continue. */
4947 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4948 save_expand_nlength);
4952 /* If Perl support is configured, handle calling embedded perl subroutines,
4953 unless locked out at this time. Syntax is ${perl{sub}} or ${perl{sub}{arg}}
4954 or ${perl{sub}{arg1}{arg2}} or up to a maximum of EXIM_PERL_MAX_ARGS
4955 arguments (defined below). */
4957 #define EXIM_PERL_MAX_ARGS 8
4961 expand_string_message = US"\"${perl\" encountered, but this facility " /*}*/
4962 "is not included in this binary";
4965 #else /* EXIM_PERL */
4967 uschar *sub_arg[EXIM_PERL_MAX_ARGS + 2];
4970 if ((expand_forbid & RDO_PERL) != 0)
4972 expand_string_message = US"Perl calls are not permitted";
4976 switch(read_subs(sub_arg, EXIM_PERL_MAX_ARGS + 1, 1, &s, skipping, TRUE,
4979 case 1: goto EXPAND_FAILED_CURLY;
4981 case 3: goto EXPAND_FAILED;
4984 /* If skipping, we don't actually do anything */
4986 if (skipping) continue;
4988 /* Start the interpreter if necessary */
4990 if (!opt_perl_started)
4993 if (!opt_perl_startup)
4995 expand_string_message = US"A setting of perl_startup is needed when "
4996 "using the Perl interpreter";
4999 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
5000 if ((initerror = init_perl(opt_perl_startup)))
5002 expand_string_message =
5003 string_sprintf("error in perl_startup code: %s\n", initerror);
5006 opt_perl_started = TRUE;
5009 /* Call the function */
5011 sub_arg[EXIM_PERL_MAX_ARGS + 1] = NULL;
5012 new_yield = call_perl_cat(yield, &expand_string_message,
5013 sub_arg[0], sub_arg + 1);
5015 /* NULL yield indicates failure; if the message pointer has been set to
5016 NULL, the yield was undef, indicating a forced failure. Otherwise the
5017 message will indicate some kind of Perl error. */
5021 if (!expand_string_message)
5023 expand_string_message =
5024 string_sprintf("Perl subroutine \"%s\" returned undef to force "
5025 "failure", sub_arg[0]);
5026 f.expand_string_forcedfail = TRUE;
5031 /* Yield succeeded. Ensure forcedfail is unset, just in case it got
5032 set during a callback from Perl. */
5034 f.expand_string_forcedfail = FALSE;
5038 #endif /* EXIM_PERL */
5040 /* Transform email address to "prvs" scheme to use
5041 as BATV-signed return path */
5048 switch(read_subs(sub_arg, 3, 2, &s, skipping, TRUE, name, &resetok))
5050 case 1: goto EXPAND_FAILED_CURLY;
5052 case 3: goto EXPAND_FAILED;
5055 /* If skipping, we don't actually do anything */
5056 if (skipping) continue;
5058 /* sub_arg[0] is the address */
5059 if ( !(domain = Ustrrchr(sub_arg[0],'@'))
5060 || domain == sub_arg[0] || Ustrlen(domain) == 1)
5062 expand_string_message = US"prvs first argument must be a qualified email address";
5066 /* Calculate the hash. The third argument must be a single-digit
5067 key number, or unset. */
5070 && (!isdigit(sub_arg[2][0]) || sub_arg[2][1] != 0))
5072 expand_string_message = US"prvs third argument must be a single digit";
5076 p = prvs_hmac_sha1(sub_arg[0], sub_arg[1], sub_arg[2], prvs_daystamp(7));
5079 expand_string_message = US"prvs hmac-sha1 conversion failed";
5083 /* Now separate the domain from the local part */
5086 yield = string_catn(yield, US"prvs=", 5);
5087 yield = string_catn(yield, sub_arg[2] ? sub_arg[2] : US"0", 1);
5088 yield = string_catn(yield, prvs_daystamp(7), 3);
5089 yield = string_catn(yield, p, 6);
5090 yield = string_catn(yield, US"=", 1);
5091 yield = string_cat (yield, sub_arg[0]);
5092 yield = string_catn(yield, US"@", 1);
5093 yield = string_cat (yield, domain);
5098 /* Check a prvs-encoded address for validity */
5100 case EITEM_PRVSCHECK:
5107 /* TF: Ugliness: We want to expand parameter 1 first, then set
5108 up expansion variables that are used in the expansion of
5109 parameter 2. So we clone the string for the first
5110 expansion, where we only expand parameter 1.
5112 PH: Actually, that isn't necessary. The read_subs() function is
5113 designed to work this way for the ${if and ${lookup expansions. I've
5117 /* Reset expansion variables */
5118 prvscheck_result = NULL;
5119 prvscheck_address = NULL;
5120 prvscheck_keynum = NULL;
5122 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, name, &resetok))
5124 case 1: goto EXPAND_FAILED_CURLY;
5126 case 3: goto EXPAND_FAILED;
5129 re = regex_must_compile(US"^prvs\\=([0-9])([0-9]{3})([A-F0-9]{6})\\=(.+)\\@(.+)$",
5132 if (regex_match_and_setup(re,sub_arg[0],0,-1))
5134 uschar *local_part = string_copyn(expand_nstring[4],expand_nlength[4]);
5135 uschar *key_num = string_copyn(expand_nstring[1],expand_nlength[1]);
5136 uschar *daystamp = string_copyn(expand_nstring[2],expand_nlength[2]);
5137 uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]);
5138 uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]);
5140 DEBUG(D_expand) debug_printf_indent("prvscheck localpart: %s\n", local_part);
5141 DEBUG(D_expand) debug_printf_indent("prvscheck key number: %s\n", key_num);
5142 DEBUG(D_expand) debug_printf_indent("prvscheck daystamp: %s\n", daystamp);
5143 DEBUG(D_expand) debug_printf_indent("prvscheck hash: %s\n", hash);
5144 DEBUG(D_expand) debug_printf_indent("prvscheck domain: %s\n", domain);
5146 /* Set up expansion variables */
5147 g = string_cat (NULL, local_part);
5148 g = string_catn(g, US"@", 1);
5149 g = string_cat (g, domain);
5150 prvscheck_address = string_from_gstring(g);
5151 prvscheck_keynum = string_copy(key_num);
5153 /* Now expand the second argument */
5154 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, name, &resetok))
5156 case 1: goto EXPAND_FAILED_CURLY;
5158 case 3: goto EXPAND_FAILED;
5161 /* Now we have the key and can check the address. */
5163 p = prvs_hmac_sha1(prvscheck_address, sub_arg[0], prvscheck_keynum,
5168 expand_string_message = US"hmac-sha1 conversion failed";
5172 DEBUG(D_expand) debug_printf_indent("prvscheck: received hash is %s\n", hash);
5173 DEBUG(D_expand) debug_printf_indent("prvscheck: own hash is %s\n", p);
5175 if (Ustrcmp(p,hash) == 0)
5177 /* Success, valid BATV address. Now check the expiry date. */
5178 uschar *now = prvs_daystamp(0);
5179 unsigned int inow = 0,iexpire = 1;
5181 (void)sscanf(CS now,"%u",&inow);
5182 (void)sscanf(CS daystamp,"%u",&iexpire);
5184 /* When "iexpire" is < 7, a "flip" has occurred.
5185 Adjust "inow" accordingly. */
5186 if ( (iexpire < 7) && (inow >= 993) ) inow = 0;
5188 if (iexpire >= inow)
5190 prvscheck_result = US"1";
5191 DEBUG(D_expand) debug_printf_indent("prvscheck: success, $pvrs_result set to 1\n");
5195 prvscheck_result = NULL;
5196 DEBUG(D_expand) debug_printf_indent("prvscheck: signature expired, $pvrs_result unset\n");
5201 prvscheck_result = NULL;
5202 DEBUG(D_expand) debug_printf_indent("prvscheck: hash failure, $pvrs_result unset\n");
5205 /* Now expand the final argument. We leave this till now so that
5206 it can include $prvscheck_result. */
5208 switch(read_subs(sub_arg, 1, 0, &s, skipping, TRUE, name, &resetok))
5210 case 1: goto EXPAND_FAILED_CURLY;
5212 case 3: goto EXPAND_FAILED;
5215 yield = string_cat(yield,
5216 !sub_arg[0] || !*sub_arg[0] ? prvscheck_address : sub_arg[0]);
5218 /* Reset the "internal" variables afterwards, because they are in
5219 dynamic store that will be reclaimed if the expansion succeeded. */
5221 prvscheck_address = NULL;
5222 prvscheck_keynum = NULL;
5225 /* Does not look like a prvs encoded address, return the empty string.
5226 We need to make sure all subs are expanded first, so as to skip over
5229 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, name, &resetok))
5231 case 1: goto EXPAND_FAILED_CURLY;
5233 case 3: goto EXPAND_FAILED;
5239 /* Handle "readfile" to insert an entire file */
5241 case EITEM_READFILE:
5246 if ((expand_forbid & RDO_READFILE) != 0)
5248 expand_string_message = US"file insertions are not permitted";
5252 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, name, &resetok))
5254 case 1: goto EXPAND_FAILED_CURLY;
5256 case 3: goto EXPAND_FAILED;
5259 /* If skipping, we don't actually do anything */
5261 if (skipping) continue;
5263 /* Open the file and read it */
5265 if (!(f = Ufopen(sub_arg[0], "rb")))
5267 expand_string_message = string_open_failed(errno, "%s", sub_arg[0]);
5271 yield = cat_file(f, yield, sub_arg[1]);
5276 /* Handle "readsocket" to insert data from a socket, either
5277 Inet or Unix domain */
5279 case EITEM_READSOCK:
5282 uschar * sub_arg[4];
5284 if (expand_forbid & RDO_READSOCK)
5286 expand_string_message = US"socket insertions are not permitted";
5290 /* Read up to 4 arguments, but don't do the end of item check afterwards,
5291 because there may be a string for expansion on failure. */
5293 switch(read_subs(sub_arg, 4, 2, &s, skipping, FALSE, name, &resetok))
5295 case 1: goto EXPAND_FAILED_CURLY;
5296 case 2: /* Won't occur: no end check */
5297 case 3: goto EXPAND_FAILED;
5300 /* If skipping, we don't actually do anything. Otherwise, arrange to
5301 connect to either an IP or a Unix socket. */
5305 int stype = search_findtype(US"readsock", 8);
5308 int expand_setup = -1;
5311 /* If the reqstr is empty, flag that and set a dummy */
5315 g = string_append_listele(g, ',', US"send=no");
5316 sub_arg[1] = US"DUMMY";
5319 /* Re-marshall the options */
5323 const uschar * list = sub_arg[2];
5327 /* First option has no tag and is timeout */
5328 if ((item = string_nextinlist(&list, &sep, NULL, 0)))
5329 g = string_append_listele(g, ',',
5330 string_sprintf("timeout=%s", item));
5332 /* The rest of the options from the expansion */
5333 while ((item = string_nextinlist(&list, &sep, NULL, 0)))
5334 g = string_append_listele(g, ',', item);
5336 /* possibly plus an EOL string */
5337 if (sub_arg[3] && *sub_arg[3])
5338 g = string_append_listele(g, ',',
5339 string_sprintf("eol=%s", sub_arg[3]));
5343 /* Gat a (possibly cached) handle for the connection */
5345 if (!(handle = search_open(sub_arg[0], stype, 0, NULL, NULL)))
5347 if (*expand_string_message) goto EXPAND_FAILED;
5348 expand_string_message = search_error_message;
5349 search_error_message = NULL;
5353 /* Get (possibly cached) results for the lookup */
5354 /* sspec: sub_arg[0] req: sub_arg[1] opts: g */
5356 if ((s = search_find(handle, sub_arg[0], sub_arg[1], -1, NULL, 0, 0,
5357 &expand_setup, string_from_gstring(g))))
5358 yield = string_cat(yield, s);
5359 else if (f.search_find_defer)
5361 expand_string_message = search_error_message;
5362 search_error_message = NULL;
5366 { /* should not happen, at present */
5367 expand_string_message = search_error_message;
5368 search_error_message = NULL;
5373 /* The whole thing has worked (or we were skipping). If there is a
5374 failure string following, we need to skip it. */
5378 if (!expand_string_internal(s+1, TRUE, &s, TRUE, TRUE, &resetok))
5382 expand_string_message = US"missing '}' closing failstring for readsocket";
5383 goto EXPAND_FAILED_CURLY;
5385 Uskip_whitespace(&s);
5391 expand_string_message = US"missing '}' closing readsocket";
5392 goto EXPAND_FAILED_CURLY;
5396 /* Come here on failure to create socket, connect socket, write to the
5397 socket, or timeout on reading. If another substring follows, expand and
5398 use it. Otherwise, those conditions give expand errors. */
5401 if (*s != '{') goto EXPAND_FAILED;
5402 DEBUG(D_any) debug_printf("%s\n", expand_string_message);
5403 if (!(arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok)))
5405 yield = string_cat(yield, arg);
5408 expand_string_message = US"missing '}' closing failstring for readsocket";
5409 goto EXPAND_FAILED_CURLY;
5411 Uskip_whitespace(&s);
5415 /* Handle "run" to execute a program. */
5421 const uschar **argv;
5425 if ((expand_forbid & RDO_RUN) != 0)
5427 expand_string_message = US"running a command is not permitted";
5431 Uskip_whitespace(&s);
5434 expand_string_message = US"missing '{' for command arg of run";
5435 goto EXPAND_FAILED_CURLY;
5437 if (!(arg = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok)))
5439 Uskip_whitespace(&s);
5442 expand_string_message = US"missing '}' closing command arg of run";
5443 goto EXPAND_FAILED_CURLY;
5446 if (skipping) /* Just pretend it worked when we're skipping */
5449 lookup_value = NULL;
5453 if (!transport_set_up_command(&argv, /* anchor for arg list */
5454 arg, /* raw command */
5455 FALSE, /* don't expand the arguments */
5456 0, /* not relevant when... */
5457 NULL, /* no transporting address */
5458 US"${run} expansion", /* for error messages */
5459 &expand_string_message)) /* where to put error message */
5462 /* Create the child process, making it a group leader. */
5464 if ((pid = child_open(USS argv, NULL, 0077, &fd_in, &fd_out, TRUE,
5465 US"expand-run")) < 0)
5467 expand_string_message =
5468 string_sprintf("couldn't create child process: %s", strerror(errno));
5472 /* Nothing is written to the standard input. */
5476 /* Read the pipe to get the command's output into $value (which is kept
5477 in lookup_value). Read during execution, so that if the output exceeds
5478 the OS pipe buffer limit, we don't block forever. Remember to not release
5479 memory just allocated for $value. */
5482 f = fdopen(fd_out, "rb");
5483 sigalrm_seen = FALSE;
5485 lookup_value = string_from_gstring(cat_file(f, NULL, NULL));
5489 /* Wait for the process to finish, applying the timeout, and inspect its
5490 return code for serious disasters. Simple non-zero returns are passed on.
5493 if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0)
5495 if (sigalrm_seen || runrc == -256)
5497 expand_string_message = US"command timed out";
5498 killpg(pid, SIGKILL); /* Kill the whole process group */
5501 else if (runrc == -257)
5502 expand_string_message = string_sprintf("wait() failed: %s",
5506 expand_string_message = string_sprintf("command killed by signal %d",
5513 /* Process the yes/no strings; $value may be useful in both cases */
5515 switch(process_yesno(
5516 skipping, /* were previously skipping */
5517 runrc == 0, /* success/failure indicator */
5518 lookup_value, /* value to reset for string2 */
5519 &s, /* input pointer */
5520 &yield, /* output pointer */
5521 US"run", /* condition type */
5524 case 1: goto EXPAND_FAILED; /* when all is well, the */
5525 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5531 /* Handle character translation for "tr" */
5535 int oldptr = gstring_length(yield);
5539 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
5541 case 1: goto EXPAND_FAILED_CURLY;
5543 case 3: goto EXPAND_FAILED;
5546 yield = string_cat(yield, sub[0]);
5547 o2m = Ustrlen(sub[2]) - 1;
5549 if (o2m >= 0) for (; oldptr < yield->ptr; oldptr++)
5551 uschar *m = Ustrrchr(sub[1], yield->s[oldptr]);
5555 yield->s[oldptr] = sub[2][(o < o2m)? o : o2m];
5562 /* Handle "hash", "length", "nhash", and "substr" when they are given with
5563 expanded arguments. */
5572 int val[2] = { 0, -1 };
5575 /* "length" takes only 2 arguments whereas the others take 2 or 3.
5576 Ensure that sub[2] is set in the ${length } case. */
5579 switch(read_subs(sub, (item_type == EITEM_LENGTH)? 2:3, 2, &s, skipping,
5580 TRUE, name, &resetok))
5582 case 1: goto EXPAND_FAILED_CURLY;
5584 case 3: goto EXPAND_FAILED;
5587 /* Juggle the arguments if there are only two of them: always move the
5588 string to the last position and make ${length{n}{str}} equivalent to
5589 ${substr{0}{n}{str}}. See the defaults for val[] above. */
5595 if (item_type == EITEM_LENGTH)
5602 for (int i = 0; i < 2; i++) if (sub[i])
5604 val[i] = (int)Ustrtol(sub[i], &ret, 10);
5605 if (*ret != 0 || (i != 0 && val[i] < 0))
5607 expand_string_message = string_sprintf("\"%s\" is not a%s number "
5608 "(in \"%s\" expansion)", sub[i], (i != 0)? " positive" : "", name);
5614 item_type == EITEM_HASH
5615 ? compute_hash(sub[2], val[0], val[1], &len)
5616 : item_type == EITEM_NHASH
5617 ? compute_nhash(sub[2], val[0], val[1], &len)
5618 : extract_substr(sub[2], val[0], val[1], &len);
5621 yield = string_catn(yield, ret, len);
5625 /* Handle HMAC computation: ${hmac{<algorithm>}{<secret>}{<text>}}
5626 This code originally contributed by Steve Haslam. It currently supports
5627 the use of MD5 and SHA-1 hashes.
5629 We need some workspace that is large enough to handle all the supported
5630 hash types. Use macros to set the sizes rather than be too elaborate. */
5632 #define MAX_HASHLEN 20
5633 #define MAX_HASHBLOCKLEN 64
5642 int hashlen; /* Number of octets for the hash algorithm's output */
5643 int hashblocklen; /* Number of octets the hash algorithm processes */
5645 unsigned int keylen;
5647 uschar keyhash[MAX_HASHLEN];
5648 uschar innerhash[MAX_HASHLEN];
5649 uschar finalhash[MAX_HASHLEN];
5650 uschar finalhash_hex[2*MAX_HASHLEN];
5651 uschar innerkey[MAX_HASHBLOCKLEN];
5652 uschar outerkey[MAX_HASHBLOCKLEN];
5654 switch (read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
5656 case 1: goto EXPAND_FAILED_CURLY;
5658 case 3: goto EXPAND_FAILED;
5663 if (Ustrcmp(sub[0], "md5") == 0)
5666 use_base = &md5_base;
5670 else if (Ustrcmp(sub[0], "sha1") == 0)
5673 use_base = &sha1_ctx;
5679 expand_string_message =
5680 string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
5685 keylen = Ustrlen(keyptr);
5687 /* If the key is longer than the hash block length, then hash the key
5690 if (keylen > hashblocklen)
5692 chash_start(type, use_base);
5693 chash_end(type, use_base, keyptr, keylen, keyhash);
5698 /* Now make the inner and outer key values */
5700 memset(innerkey, 0x36, hashblocklen);
5701 memset(outerkey, 0x5c, hashblocklen);
5703 for (int i = 0; i < keylen; i++)
5705 innerkey[i] ^= keyptr[i];
5706 outerkey[i] ^= keyptr[i];
5709 /* Now do the hashes */
5711 chash_start(type, use_base);
5712 chash_mid(type, use_base, innerkey);
5713 chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
5715 chash_start(type, use_base);
5716 chash_mid(type, use_base, outerkey);
5717 chash_end(type, use_base, innerhash, hashlen, finalhash);
5719 /* Encode the final hash as a hex string */
5722 for (int i = 0; i < hashlen; i++)
5724 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
5725 *p++ = hex_digits[finalhash[i] & 0x0f];
5728 DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n",
5729 sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex);
5731 yield = string_catn(yield, finalhash_hex, hashlen*2);
5736 /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
5737 We have to save the numerical variables and restore them afterwards. */
5742 int moffset, moffsetextra, slen;
5745 const uschar *rerror;
5748 int save_expand_nmax =
5749 save_expand_strings(save_expand_nstring, save_expand_nlength);
5751 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
5753 case 1: goto EXPAND_FAILED_CURLY;
5755 case 3: goto EXPAND_FAILED;
5758 /* Compile the regular expression */
5760 if (!(re = pcre_compile(CS sub[1], PCRE_COPT, CCSS &rerror,
5763 expand_string_message = string_sprintf("regular expression error in "
5764 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
5768 /* Now run a loop to do the substitutions as often as necessary. It ends
5769 when there are no more matches. Take care over matches of the null string;
5770 do the same thing as Perl does. */
5773 slen = Ustrlen(sub[0]);
5774 moffset = moffsetextra = 0;
5779 int ovector[3*(EXPAND_MAXN+1)];
5780 int n = pcre_exec(re, NULL, CS subject, slen, moffset + moffsetextra,
5781 PCRE_EOPT | emptyopt, ovector, nelem(ovector));
5784 /* No match - if we previously set PCRE_NOTEMPTY after a null match, this
5785 is not necessarily the end. We want to repeat the match from one
5786 character further along, but leaving the basic offset the same (for
5787 copying below). We can't be at the end of the string - that was checked
5788 before setting PCRE_NOTEMPTY. If PCRE_NOTEMPTY is not set, we are
5789 finished; copy the remaining string and end the loop. */
5799 yield = string_catn(yield, subject+moffset, slen-moffset);
5803 /* Match - set up for expanding the replacement. */
5805 if (n == 0) n = EXPAND_MAXN + 1;
5807 for (int nn = 0; nn < n*2; nn += 2)
5809 expand_nstring[expand_nmax] = subject + ovector[nn];
5810 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
5814 /* Copy the characters before the match, plus the expanded insertion. */
5816 yield = string_catn(yield, subject + moffset, ovector[0] - moffset);
5817 if (!(insert = expand_string(sub[2])))
5819 yield = string_cat(yield, insert);
5821 moffset = ovector[1];
5825 /* If we have matched an empty string, first check to see if we are at
5826 the end of the subject. If so, the loop is over. Otherwise, mimic
5827 what Perl's /g options does. This turns out to be rather cunning. First
5828 we set PCRE_NOTEMPTY and PCRE_ANCHORED and try the match a non-empty
5829 string at the same point. If this fails (picked up above) we advance to
5830 the next character. */
5832 if (ovector[0] == ovector[1])
5834 if (ovector[0] == slen) break;
5835 emptyopt = PCRE_NOTEMPTY | PCRE_ANCHORED;
5839 /* All done - restore numerical variables. */
5841 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5842 save_expand_nlength);
5846 /* Handle keyed and numbered substring extraction. If the first argument
5847 consists entirely of digits, then a numerical extraction is assumed. */
5851 int field_number = 1;
5852 BOOL field_number_set = FALSE;
5853 uschar *save_lookup_value = lookup_value;
5855 int save_expand_nmax =
5856 save_expand_strings(save_expand_nstring, save_expand_nlength);
5858 /* On reflection the original behaviour of extract-json for a string
5859 result, leaving it quoted, was a mistake. But it was already published,
5860 hence the addition of jsons. In a future major version, make json
5861 work like josons, and withdraw jsons. */
5863 enum {extract_basic, extract_json, extract_jsons} fmt = extract_basic;
5865 /* Check for a format-variant specifier */
5867 if (Uskip_whitespace(&s) != '{') /*}*/
5868 if (Ustrncmp(s, "json", 4) == 0)
5869 if (*(s += 4) == 's')
5870 {fmt = extract_jsons; s++;}
5874 /* While skipping we cannot rely on the data for expansions being
5875 available (eg. $item) hence cannot decide on numeric vs. keyed.
5876 Read a maximum of 5 arguments (including the yes/no) */
5880 for (int j = 5; j > 0 && *s == '{'; j--) /*'}'*/
5882 if (!expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok))
5883 goto EXPAND_FAILED; /*'{'*/
5886 expand_string_message = US"missing '{' for arg of extract";
5887 goto EXPAND_FAILED_CURLY;
5889 Uskip_whitespace(&s);
5891 if ( Ustrncmp(s, "fail", 4) == 0 /*'{'*/
5892 && (s[4] == '}' || s[4] == ' ' || s[4] == '\t' || !s[4])
5896 Uskip_whitespace(&s);
5900 expand_string_message = US"missing '}' closing extract";
5901 goto EXPAND_FAILED_CURLY;
5905 else for (int i = 0, j = 2; i < j; i++) /* Read the proper number of arguments */
5907 if (Uskip_whitespace(&s) == '{') /*'}'*/
5909 if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok)))
5910 goto EXPAND_FAILED; /*'{'*/
5913 expand_string_message = string_sprintf(
5914 "missing '}' closing arg %d of extract", i+1);
5915 goto EXPAND_FAILED_CURLY;
5918 /* After removal of leading and trailing white space, the first
5919 argument must not be empty; if it consists entirely of digits
5920 (optionally preceded by a minus sign), this is a numerical
5921 extraction, and we expect 3 arguments (normal) or 2 (json). */
5929 Uskip_whitespace(&p);
5933 while (len > 0 && isspace(p[len-1])) len--;
5938 expand_string_message = US"first argument of \"extract\" must "
5948 while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
5952 if (fmt == extract_basic) j = 3; /* Need 3 args */
5953 field_number_set = TRUE;
5959 expand_string_message = string_sprintf(
5960 "missing '{' for arg %d of extract", i+1);
5961 goto EXPAND_FAILED_CURLY;
5965 /* Extract either the numbered or the keyed substring into $value. If
5966 skipping, just pretend the extraction failed. */
5969 lookup_value = NULL;
5973 lookup_value = field_number_set
5974 ? expand_gettokened(field_number, sub[1], sub[2])
5975 : expand_getkeyed(sub[0], sub[1]);
5982 const uschar * list;
5984 /* Array: Bracket-enclosed and comma-separated.
5985 Object: Brace-enclosed, comma-sep list of name:value pairs */
5987 if (!(s = dewrap(sub[1], field_number_set ? US"[]" : US"{}")))
5989 expand_string_message =
5990 string_sprintf("%s wrapping %s for extract json",
5991 expand_string_message,
5992 field_number_set ? "array" : "object");
5993 goto EXPAND_FAILED_CURLY;
5997 if (field_number_set)
5999 if (field_number <= 0)
6001 expand_string_message = US"first argument of \"extract\" must "
6002 "be greater than zero";
6005 while (field_number > 0 && (item = json_nextinlist(&list)))
6007 if ((lookup_value = s = item))
6010 while (--s >= lookup_value && isspace(*s)) *s = '\0';
6015 lookup_value = NULL;
6016 while ((item = json_nextinlist(&list)))
6018 /* Item is: string name-sep value. string is quoted.
6019 Dequote the string and compare with the search key. */
6021 if (!(item = dewrap(item, US"\"\"")))
6023 expand_string_message =
6024 string_sprintf("%s wrapping string key for extract json",
6025 expand_string_message);
6026 goto EXPAND_FAILED_CURLY;
6028 if (Ustrcmp(item, sub[0]) == 0) /*XXX should be a UTF8-compare */
6030 s = item + Ustrlen(item) + 1;
6031 if (Uskip_whitespace(&s) != ':')
6033 expand_string_message =
6034 US"missing object value-separator for extract json";
6035 goto EXPAND_FAILED_CURLY;
6038 Uskip_whitespace(&s);
6046 if ( fmt == extract_jsons
6048 && !(lookup_value = dewrap(lookup_value, US"\"\"")))
6050 expand_string_message =
6051 string_sprintf("%s wrapping string result for extract jsons",
6052 expand_string_message);
6053 goto EXPAND_FAILED_CURLY;
6058 /* If no string follows, $value gets substituted; otherwise there can
6059 be yes/no strings, as for lookup or if. */
6061 switch(process_yesno(
6062 skipping, /* were previously skipping */
6063 lookup_value != NULL, /* success/failure indicator */
6064 save_lookup_value, /* value to reset for string2 */
6065 &s, /* input pointer */
6066 &yield, /* output pointer */
6067 US"extract", /* condition type */
6070 case 1: goto EXPAND_FAILED; /* when all is well, the */
6071 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6074 /* All done - restore numerical variables. */
6076 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6077 save_expand_nlength);
6082 /* return the Nth item from a list */
6084 case EITEM_LISTEXTRACT:
6086 int field_number = 1;
6087 uschar *save_lookup_value = lookup_value;
6089 int save_expand_nmax =
6090 save_expand_strings(save_expand_nstring, save_expand_nlength);
6092 /* Read the field & list arguments */
6094 for (int i = 0; i < 2; i++)
6096 if (Uskip_whitespace(&s) != '{') /*'}'*/
6098 expand_string_message = string_sprintf(
6099 "missing '{' for arg %d of listextract", i+1);
6100 goto EXPAND_FAILED_CURLY;
6103 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6104 if (!sub[i]) goto EXPAND_FAILED; /*{*/
6107 expand_string_message = string_sprintf(
6108 "missing '}' closing arg %d of listextract", i+1);
6109 goto EXPAND_FAILED_CURLY;
6112 /* After removal of leading and trailing white space, the first
6113 argument must be numeric and nonempty. */
6121 Uskip_whitespace(&p);
6125 while (len > 0 && isspace(p[len-1])) len--;
6128 if (!*p && !skipping)
6130 expand_string_message = US"first argument of \"listextract\" must "
6140 while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
6143 expand_string_message = US"first argument of \"listextract\" must "
6151 /* Extract the numbered element into $value. If
6152 skipping, just pretend the extraction failed. */
6154 lookup_value = skipping ? NULL : expand_getlistele(field_number, sub[1]);
6156 /* If no string follows, $value gets substituted; otherwise there can
6157 be yes/no strings, as for lookup or if. */
6159 switch(process_yesno(
6160 skipping, /* were previously skipping */
6161 lookup_value != NULL, /* success/failure indicator */
6162 save_lookup_value, /* value to reset for string2 */
6163 &s, /* input pointer */
6164 &yield, /* output pointer */
6165 US"listextract", /* condition type */
6168 case 1: goto EXPAND_FAILED; /* when all is well, the */
6169 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6172 /* All done - restore numerical variables. */
6174 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6175 save_expand_nlength);
6180 case EITEM_LISTQUOTE:
6183 switch(read_subs(sub, 2, 2, &s, skipping, TRUE, name, &resetok))
6185 case 1: goto EXPAND_FAILED_CURLY;
6187 case 3: goto EXPAND_FAILED;
6189 if (*sub[1]) for (uschar sep = *sub[0], c; c = *sub[1]; sub[1]++)
6191 if (c == sep) yield = string_catn(yield, sub[1], 1);
6192 yield = string_catn(yield, sub[1], 1);
6194 else yield = string_catn(yield, US" ", 1);
6199 case EITEM_CERTEXTRACT:
6201 uschar *save_lookup_value = lookup_value;
6203 int save_expand_nmax =
6204 save_expand_strings(save_expand_nstring, save_expand_nlength);
6206 /* Read the field argument */
6207 if (Uskip_whitespace(&s) != '{') /*}*/
6209 expand_string_message = US"missing '{' for field arg of certextract";
6210 goto EXPAND_FAILED_CURLY;
6212 sub[0] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6213 if (!sub[0]) goto EXPAND_FAILED; /*{*/
6216 expand_string_message = US"missing '}' closing field arg of certextract";
6217 goto EXPAND_FAILED_CURLY;
6219 /* strip spaces fore & aft */
6224 Uskip_whitespace(&p);
6228 while (len > 0 && isspace(p[len-1])) len--;
6232 /* inspect the cert argument */
6233 if (Uskip_whitespace(&s) != '{') /*}*/
6235 expand_string_message = US"missing '{' for cert variable arg of certextract";
6236 goto EXPAND_FAILED_CURLY;
6240 expand_string_message = US"second argument of \"certextract\" must "
6241 "be a certificate variable";
6244 sub[1] = expand_string_internal(s+1, TRUE, &s, skipping, FALSE, &resetok);
6245 if (!sub[1]) goto EXPAND_FAILED; /*{*/
6248 expand_string_message = US"missing '}' closing cert variable arg of certextract";
6249 goto EXPAND_FAILED_CURLY;
6253 lookup_value = NULL;
6256 lookup_value = expand_getcertele(sub[0], sub[1]);
6257 if (*expand_string_message) goto EXPAND_FAILED;
6259 switch(process_yesno(
6260 skipping, /* were previously skipping */
6261 lookup_value != NULL, /* success/failure indicator */
6262 save_lookup_value, /* value to reset for string2 */
6263 &s, /* input pointer */
6264 &yield, /* output pointer */
6265 US"certextract", /* condition type */
6268 case 1: goto EXPAND_FAILED; /* when all is well, the */
6269 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6272 restore_expand_strings(save_expand_nmax, save_expand_nstring,
6273 save_expand_nlength);
6276 #endif /*DISABLE_TLS*/
6278 /* Handle list operations */
6285 int save_ptr = gstring_length(yield);
6286 uschar outsep[2] = { '\0', '\0' };
6287 const uschar *list, *expr, *temp;
6288 uschar *save_iterate_item = iterate_item;
6289 uschar *save_lookup_value = lookup_value;
6291 Uskip_whitespace(&s);
6294 expand_string_message =
6295 string_sprintf("missing '{' for first arg of %s", name);
6296 goto EXPAND_FAILED_CURLY;
6299 if (!(list = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok)))
6303 expand_string_message =
6304 string_sprintf("missing '}' closing first arg of %s", name);
6305 goto EXPAND_FAILED_CURLY;
6308 if (item_type == EITEM_REDUCE)
6311 Uskip_whitespace(&s);
6314 expand_string_message = US"missing '{' for second arg of reduce";
6315 goto EXPAND_FAILED_CURLY;
6317 t = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
6318 if (!t) goto EXPAND_FAILED;
6322 expand_string_message = US"missing '}' closing second arg of reduce";
6323 goto EXPAND_FAILED_CURLY;
6327 Uskip_whitespace(&s);
6330 expand_string_message =
6331 string_sprintf("missing '{' for last arg of %s", name);
6332 goto EXPAND_FAILED_CURLY;
6337 /* For EITEM_FILTER, call eval_condition once, with result discarded (as
6338 if scanning a "false" part). This allows us to find the end of the
6339 condition, because if the list is empty, we won't actually evaluate the
6340 condition for real. For EITEM_MAP and EITEM_REDUCE, do the same, using
6341 the normal internal expansion function. */
6343 if (item_type == EITEM_FILTER)
6345 if ((temp = eval_condition(expr, &resetok, NULL)))
6349 temp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
6353 expand_string_message = string_sprintf("%s inside \"%s\" item",
6354 expand_string_message, name);
6358 Uskip_whitespace(&s);
6361 expand_string_message = string_sprintf("missing } at end of condition "
6362 "or expression inside \"%s\"; could be an unquoted } in the content",
6367 Uskip_whitespace(&s); /*{*/
6370 expand_string_message = string_sprintf("missing } at end of \"%s\"",
6375 /* If we are skipping, we can now just move on to the next item. When
6376 processing for real, we perform the iteration. */
6378 if (skipping) continue;
6379 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
6381 *outsep = (uschar)sep; /* Separator as a string */
6383 DEBUG(D_expand) debug_printf_indent("%s: $item = '%s' $value = '%s'\n",
6384 name, iterate_item, lookup_value);
6386 if (item_type == EITEM_FILTER)
6389 if (!eval_condition(expr, &resetok, &condresult))
6391 iterate_item = save_iterate_item;
6392 lookup_value = save_lookup_value;
6393 expand_string_message = string_sprintf("%s inside \"%s\" condition",
6394 expand_string_message, name);
6397 DEBUG(D_expand) debug_printf_indent("%s: condition is %s\n", name,
6398 condresult? "true":"false");
6400 temp = iterate_item; /* TRUE => include this item */
6402 continue; /* FALSE => skip this item */
6405 /* EITEM_MAP and EITEM_REDUCE */
6409 uschar * t = expand_string_internal(expr, TRUE, NULL, skipping, TRUE, &resetok);
6413 iterate_item = save_iterate_item;
6414 expand_string_message = string_sprintf("%s inside \"%s\" item",
6415 expand_string_message, name);
6418 if (item_type == EITEM_REDUCE)
6420 lookup_value = t; /* Update the value of $value */
6421 continue; /* and continue the iteration */
6425 /* We reach here for FILTER if the condition is true, always for MAP,
6426 and never for REDUCE. The value in "temp" is to be added to the output
6427 list that is being created, ensuring that any occurrences of the
6428 separator character are doubled. Unless we are dealing with the first
6429 item of the output list, add in a space if the new item begins with the
6430 separator character, or is an empty string. */
6432 if ( yield && yield->ptr != save_ptr
6433 && (temp[0] == *outsep || temp[0] == 0))
6434 yield = string_catn(yield, US" ", 1);
6436 /* Add the string in "temp" to the output list that we are building,
6437 This is done in chunks by searching for the separator character. */
6441 size_t seglen = Ustrcspn(temp, outsep);
6443 yield = string_catn(yield, temp, seglen + 1);
6445 /* If we got to the end of the string we output one character
6446 too many; backup and end the loop. Otherwise arrange to double the
6449 if (temp[seglen] == '\0') { yield->ptr--; break; }
6450 yield = string_catn(yield, outsep, 1);
6454 /* Output a separator after the string: we will remove the redundant
6455 final one at the end. */
6457 yield = string_catn(yield, outsep, 1);
6458 } /* End of iteration over the list loop */
6460 /* REDUCE has generated no output above: output the final value of
6463 if (item_type == EITEM_REDUCE)
6465 yield = string_cat(yield, lookup_value);
6466 lookup_value = save_lookup_value; /* Restore $value */
6469 /* FILTER and MAP generate lists: if they have generated anything, remove
6470 the redundant final separator. Even though an empty item at the end of a
6471 list does not count, this is tidier. */
6473 else if (yield && yield->ptr != save_ptr) yield->ptr--;
6475 /* Restore preserved $item */
6477 iterate_item = save_iterate_item;
6485 const uschar *srclist, *cmp, *xtract;
6486 uschar * opname, * srcitem;
6487 const uschar *dstlist = NULL, *dstkeylist = NULL;
6489 uschar *save_iterate_item = iterate_item;
6491 Uskip_whitespace(&s);
6494 expand_string_message = US"missing '{' for list arg of sort";
6495 goto EXPAND_FAILED_CURLY;
6498 srclist = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
6499 if (!srclist) goto EXPAND_FAILED;
6502 expand_string_message = US"missing '}' closing list arg of sort";
6503 goto EXPAND_FAILED_CURLY;
6506 Uskip_whitespace(&s);
6509 expand_string_message = US"missing '{' for comparator arg of sort";
6510 goto EXPAND_FAILED_CURLY;
6513 cmp = expand_string_internal(s, TRUE, &s, skipping, FALSE, &resetok);
6514 if (!cmp) goto EXPAND_FAILED;
6517 expand_string_message = US"missing '}' closing comparator arg of sort";
6518 goto EXPAND_FAILED_CURLY;
6521 if ((cond_type = identify_operator(&cmp, &opname)) == -1)
6523 if (!expand_string_message)
6524 expand_string_message = string_sprintf("unknown condition \"%s\"", s);
6529 case ECOND_NUM_L: case ECOND_NUM_LE:
6530 case ECOND_NUM_G: case ECOND_NUM_GE:
6531 case ECOND_STR_GE: case ECOND_STR_GEI: case ECOND_STR_GT: case ECOND_STR_GTI:
6532 case ECOND_STR_LE: case ECOND_STR_LEI: case ECOND_STR_LT: case ECOND_STR_LTI:
6536 expand_string_message = US"comparator not handled for sort";
6540 Uskip_whitespace(&s);
6543 expand_string_message = US"missing '{' for extractor arg of sort";
6544 goto EXPAND_FAILED_CURLY;
6548 if (!(tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok)))
6550 xtract = string_copyn(xtract, s - xtract);
6554 expand_string_message = US"missing '}' closing extractor arg of sort";
6555 goto EXPAND_FAILED_CURLY;
6560 expand_string_message = US"missing } at end of \"sort\"";
6564 if (skipping) continue;
6566 while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
6568 uschar * srcfield, * dstitem;
6569 gstring * newlist = NULL;
6570 gstring * newkeylist = NULL;
6572 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
6574 /* extract field for comparisons */
6575 iterate_item = srcitem;
6576 if ( !(srcfield = expand_string_internal(xtract, FALSE, NULL, FALSE,
6580 expand_string_message = string_sprintf(
6581 "field-extract in sort: \"%s\"", xtract);
6585 /* Insertion sort */
6587 /* copy output list until new-item < list-item */
6588 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6592 /* field for comparison */
6593 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6596 /* String-comparator names start with a letter; numeric names do not */
6598 if (sortsbefore(cond_type, isalpha(opname[0]),
6599 srcfield, dstfield))
6601 /* New-item sorts before this dst-item. Append new-item,
6602 then dst-item, then remainder of dst list. */
6604 newlist = string_append_listele(newlist, sep, srcitem);
6605 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6608 newlist = string_append_listele(newlist, sep, dstitem);
6609 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6611 /*XXX why field-at-a-time copy? Why not just dup the rest of the list? */
6612 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6614 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6616 newlist = string_append_listele(newlist, sep, dstitem);
6617 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6623 newlist = string_append_listele(newlist, sep, dstitem);
6624 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6627 /* If we ran out of dstlist without consuming srcitem, append it */
6630 newlist = string_append_listele(newlist, sep, srcitem);
6631 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6634 dstlist = newlist->s;
6635 dstkeylist = newkeylist->s;
6637 DEBUG(D_expand) debug_printf_indent("%s: dstlist = \"%s\"\n", name, dstlist);
6638 DEBUG(D_expand) debug_printf_indent("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
6642 yield = string_cat(yield, dstlist);
6644 /* Restore preserved $item */
6645 iterate_item = save_iterate_item;
6649 expand_string_message = US"Internal error in sort (list mismatch)";
6654 /* If ${dlfunc } support is configured, handle calling dynamically-loaded
6655 functions, unless locked out at this time. Syntax is ${dlfunc{file}{func}}
6656 or ${dlfunc{file}{func}{arg}} or ${dlfunc{file}{func}{arg1}{arg2}} or up to
6657 a maximum of EXPAND_DLFUNC_MAX_ARGS arguments (defined below). */
6659 #define EXPAND_DLFUNC_MAX_ARGS 8
6662 #ifndef EXPAND_DLFUNC
6663 expand_string_message = US"\"${dlfunc\" encountered, but this facility " /*}*/
6664 "is not included in this binary";
6667 #else /* EXPAND_DLFUNC */
6670 exim_dlfunc_t *func;
6673 uschar *argv[EXPAND_DLFUNC_MAX_ARGS + 3];
6675 if ((expand_forbid & RDO_DLFUNC) != 0)
6677 expand_string_message =
6678 US"dynamically-loaded functions are not permitted";
6682 switch(read_subs(argv, EXPAND_DLFUNC_MAX_ARGS + 2, 2, &s, skipping,
6683 TRUE, name, &resetok))
6685 case 1: goto EXPAND_FAILED_CURLY;
6687 case 3: goto EXPAND_FAILED;
6690 /* If skipping, we don't actually do anything */
6692 if (skipping) continue;
6694 /* Look up the dynamically loaded object handle in the tree. If it isn't
6695 found, dlopen() the file and put the handle in the tree for next time. */
6697 if (!(t = tree_search(dlobj_anchor, argv[0])))
6699 void *handle = dlopen(CS argv[0], RTLD_LAZY);
6702 expand_string_message = string_sprintf("dlopen \"%s\" failed: %s",
6703 argv[0], dlerror());
6704 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6707 t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]), is_tainted(argv[0]));
6708 Ustrcpy(t->name, argv[0]);
6709 t->data.ptr = handle;
6710 (void)tree_insertnode(&dlobj_anchor, t);
6713 /* Having obtained the dynamically loaded object handle, look up the
6714 function pointer. */
6716 if (!(func = (exim_dlfunc_t *)dlsym(t->data.ptr, CS argv[1])))
6718 expand_string_message = string_sprintf("dlsym \"%s\" in \"%s\" failed: "
6719 "%s", argv[1], argv[0], dlerror());
6720 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6724 /* Call the function and work out what to do with the result. If it
6725 returns OK, we have a replacement string; if it returns DEFER then
6726 expansion has failed in a non-forced manner; if it returns FAIL then
6727 failure was forced; if it returns ERROR or any other value there's a
6728 problem, so panic slightly. In any case, assume that the function has
6729 side-effects on the store that must be preserved. */
6733 for (argc = 0; argv[argc]; argc++);
6734 status = func(&result, argc - 2, &argv[2]);
6737 if (!result) result = US"";
6738 yield = string_cat(yield, result);
6743 expand_string_message = result ? result : US"(no message)";
6744 if (status == FAIL_FORCED)
6745 f.expand_string_forcedfail = TRUE;
6746 else if (status != FAIL)
6747 log_write(0, LOG_MAIN|LOG_PANIC, "dlfunc{%s}{%s} failed (%d): %s",
6748 argv[0], argv[1], status, expand_string_message);
6752 #endif /* EXPAND_DLFUNC */
6754 case EITEM_ENV: /* ${env {name} {val_if_found} {val_if_unfound}} */
6757 uschar *save_lookup_value = lookup_value;
6759 if (Uskip_whitespace(&s) != '{') /*}*/
6762 key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6763 if (!key) goto EXPAND_FAILED; /*{*/
6766 expand_string_message = US"missing '{' for name arg of env";
6767 goto EXPAND_FAILED_CURLY;
6770 lookup_value = US getenv(CS key);
6772 switch(process_yesno(
6773 skipping, /* were previously skipping */
6774 lookup_value != NULL, /* success/failure indicator */
6775 save_lookup_value, /* value to reset for string2 */
6776 &s, /* input pointer */
6777 &yield, /* output pointer */
6778 US"env", /* condition type */
6781 case 1: goto EXPAND_FAILED; /* when all is well, the */
6782 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6788 case EITEM_SRS_ENCODE:
6789 /* ${srs_encode {secret} {return_path} {orig_domain}} */
6794 BOOL quoted = FALSE;
6796 switch (read_subs(sub, 3, 3, CUSS &s, skipping, TRUE, name, &resetok))
6798 case 1: goto EXPAND_FAILED_CURLY;
6800 case 3: goto EXPAND_FAILED;
6803 g = string_catn(g, US"SRS0=", 5);
6805 /* ${l_4:${hmac{md5}{SRS_SECRET}{${lc:$return_path}}}}= */
6806 hmac_md5(sub[0], string_copylc(sub[1]), cksum, sizeof(cksum));
6807 g = string_catn(g, cksum, sizeof(cksum));
6808 g = string_catn(g, US"=", 1);
6810 /* ${base32:${eval:$tod_epoch/86400&0x3ff}}= */
6816 gettimeofday(&now, NULL);
6817 for (unsigned long i = (now.tv_sec / 86400) & 0x3ff; i; i >>= 5)
6818 h = string_catn(h, &base32_chars[i & 0x1f], 1);
6819 if (h) while (h->ptr > 0)
6820 g = string_catn(g, &h->s[--h->ptr], 1);
6822 g = string_catn(g, US"=", 1);
6824 /* ${domain:$return_path}=${local_part:$return_path} */
6826 int start, end, domain;
6827 uschar * t = parse_extract_address(sub[1], &expand_string_message,
6828 &start, &end, &domain, FALSE);
6834 if (domain > 0) g = string_cat(g, t + domain);
6835 g = string_catn(g, US"=", 1);
6837 s = domain > 0 ? string_copyn(t, domain - 1) : t;
6838 if ((quoted = Ustrchr(s, '"') != NULL))
6841 DEBUG(D_expand) debug_printf_indent("auto-quoting local part\n");
6842 while (*s) /* de-quote */
6844 while (*s && *s != '"') h = string_catn(h, s++, 1);
6846 while (*s && *s != '"') h = string_catn(h, s++, 1);
6849 gstring_release_unused(h);
6850 s = string_from_gstring(h);
6852 g = string_cat(g, s);
6855 /* Assume that if the original local_part had quotes
6856 it was for good reason */
6858 if (quoted) yield = string_catn(yield, US"\"", 1);
6859 yield = string_catn(yield, g->s, g->ptr);
6860 if (quoted) yield = string_catn(yield, US"\"", 1);
6862 /* @$original_domain */
6863 yield = string_catn(yield, US"@", 1);
6864 yield = string_cat(yield, sub[2]);
6867 #endif /*SUPPORT_SRS*/
6868 } /* EITEM_* switch */
6870 /* Control reaches here if the name is not recognized as one of the more
6871 complicated expansion items. Check for the "operator" syntax (name terminated
6872 by a colon). Some of the operators have arguments, separated by _ from the
6881 var_entry *vp = NULL;
6884 /* Owing to an historical mis-design, an underscore may be part of the
6885 operator name, or it may introduce arguments. We therefore first scan the
6886 table of names that contain underscores. If there is no match, we cut off
6887 the arguments and then scan the main table. */
6889 if ((c = chop_match(name, op_table_underscore,
6890 nelem(op_table_underscore))) < 0)
6892 if ((arg = Ustrchr(name, '_')))
6894 if ((c = chop_match(name, op_table_main, nelem(op_table_main))) >= 0)
6895 c += nelem(op_table_underscore);
6896 if (arg) *arg++ = '_'; /* Put back for error messages */
6899 /* Deal specially with operators that might take a certificate variable
6900 as we do not want to do the usual expansion. For most, expand the string.*/
6910 const uschar * s1 = s;
6911 sub = expand_string_internal(s+2, TRUE, &s1, skipping,
6913 if (!sub) goto EXPAND_FAILED; /*{*/
6916 expand_string_message =
6917 string_sprintf("missing '}' closing cert arg of %s", name);
6918 goto EXPAND_FAILED_CURLY;
6920 if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
6930 sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6931 if (!sub) goto EXPAND_FAILED;
6936 /* If we are skipping, we don't need to perform the operation at all.
6937 This matters for operations like "mask", because the data may not be
6938 in the correct format when skipping. For example, the expression may test
6939 for the existence of $sender_host_address before trying to mask it. For
6940 other operations, doing them may not fail, but it is a waste of time. */
6942 if (skipping && c >= 0) continue;
6944 /* Otherwise, switch on the operator type */
6951 unsigned long int n = Ustrtoul(sub, &t, 10);
6956 expand_string_message = string_sprintf("argument for base32 "
6957 "operator is \"%s\", which is not a decimal number", sub);
6961 g = string_catn(g, &base32_chars[n & 0x1f], 1);
6963 if (g) while (g->ptr > 0) yield = string_catn(yield, &g->s[--g->ptr], 1);
6970 unsigned long int n = 0;
6973 uschar * t = Ustrchr(base32_chars, *tt++);
6976 expand_string_message = string_sprintf("argument for base32d "
6977 "operator is \"%s\", which is not a base 32 number", sub);
6980 n = n * 32 + (t - base32_chars);
6982 yield = string_fmt_append(yield, "%ld", n);
6989 unsigned long int n = Ustrtoul(sub, &t, 10);
6992 expand_string_message = string_sprintf("argument for base62 "
6993 "operator is \"%s\", which is not a decimal number", sub);
6996 yield = string_cat(yield, string_base62(n));
7000 /* Note that for Darwin and Cygwin, BASE_62 actually has the value 36 */
7005 unsigned long int n = 0;
7008 uschar *t = Ustrchr(base62_chars, *tt++);
7011 expand_string_message = string_sprintf("argument for base62d "
7012 "operator is \"%s\", which is not a base %d number", sub,
7016 n = n * BASE_62 + (t - base62_chars);
7018 yield = string_fmt_append(yield, "%ld", n);
7023 /* This is purely for the convenience of the test harness. Do not enable
7024 it otherwise as it defeats the taint-checking security. */
7026 if (f.running_in_test_harness)
7027 yield = string_cat(yield, is_tainted(sub)
7028 ? string_copy_taint(sub, FALSE) : sub);
7031 DEBUG(D_expand) debug_printf_indent("bless operator not supported\n");
7032 yield = string_cat(yield, sub);
7038 uschar *expanded = expand_string_internal(sub, FALSE, NULL, skipping, TRUE, &resetok);
7041 expand_string_message =
7042 string_sprintf("internal expansion of \"%s\" failed: %s", sub,
7043 expand_string_message);
7046 yield = string_cat(yield, expanded);
7053 uschar *t = sub - 1;
7054 while (*(++t) != 0) { *t = tolower(*t); count++; }
7055 yield = string_catn(yield, sub, count);
7062 uschar *t = sub - 1;
7063 while (*(++t) != 0) { *t = toupper(*t); count++; }
7064 yield = string_catn(yield, sub, count);
7070 if (vp && *(void **)vp->value)
7072 uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
7073 yield = string_cat(yield, cp);
7081 md5_end(&base, sub, Ustrlen(sub), digest);
7082 for (int j = 0; j < 16; j++)
7083 yield = string_fmt_append(yield, "%02x", digest[j]);
7089 if (vp && *(void **)vp->value)
7091 uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
7092 yield = string_cat(yield, cp);
7100 sha1_end(&h, sub, Ustrlen(sub), digest);
7101 for (int j = 0; j < 20; j++)
7102 yield = string_fmt_append(yield, "%02X", digest[j]);
7108 #ifdef EXIM_HAVE_SHA2
7109 if (vp && *(void **)vp->value)
7110 if (c == EOP_SHA256)
7111 yield = string_cat(yield, tls_cert_fprt_sha256(*(void **)vp->value));
7113 expand_string_message = US"sha2_N not supported with certificates";
7118 hashmethod m = !arg ? HASH_SHA2_256
7119 : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
7120 : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
7121 : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
7124 if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
7126 expand_string_message = US"unrecognised sha2 variant";
7130 exim_sha_update(&h, sub, Ustrlen(sub));
7131 exim_sha_finish(&h, &b);
7133 yield = string_fmt_append(yield, "%02X", *b.data++);
7136 expand_string_message = US"sha256 only supported with TLS";
7141 #ifdef EXIM_HAVE_SHA3
7145 hashmethod m = !arg ? HASH_SHA3_256
7146 : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224
7147 : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256
7148 : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384
7149 : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512
7152 if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
7154 expand_string_message = US"unrecognised sha3 variant";
7158 exim_sha_update(&h, sub, Ustrlen(sub));
7159 exim_sha_finish(&h, &b);
7161 yield = string_fmt_append(yield, "%02X", *b.data++);
7165 expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 + or OpenSSL 1.1.1 +";
7169 /* Convert hex encoding to base64 encoding */
7179 for (enc = sub; *enc; enc++)
7181 if (!isxdigit(*enc))
7183 expand_string_message = string_sprintf("\"%s\" is not a hex "
7192 expand_string_message = string_sprintf("\"%s\" contains an odd "
7193 "number of characters", sub);
7197 while ((c = *in++) != 0)
7199 if (isdigit(c)) c -= '0';
7200 else c = toupper(c) - 'A' + 10;
7210 enc = b64encode(CUS sub, out - sub);
7211 yield = string_cat(yield, enc);
7215 /* Convert octets outside 0x21..0x7E to \xXX form */
7219 uschar *t = sub - 1;
7222 if (*t < 0x21 || 0x7E < *t)
7223 yield = string_fmt_append(yield, "\\x%02x", *t);
7225 yield = string_catn(yield, t, 1);
7230 /* count the number of list elements */
7237 while (string_nextinlist(CUSS &sub, &sep, NULL, 0)) cnt++;
7238 yield = string_fmt_append(yield, "%d", cnt);
7242 /* expand a named list given the name */
7243 /* handles nested named lists; requotes as colon-sep list */
7247 tree_node *t = NULL;
7248 const uschar * list;
7251 uschar * suffix = US"";
7252 BOOL needsep = FALSE;
7255 if (*sub == '+') sub++;
7256 if (!arg) /* no-argument version */
7258 if (!(t = tree_search(addresslist_anchor, sub)) &&
7259 !(t = tree_search(domainlist_anchor, sub)) &&
7260 !(t = tree_search(hostlist_anchor, sub)))
7261 t = tree_search(localpartlist_anchor, sub);
7263 else switch(*arg) /* specific list-type version */
7265 case 'a': t = tree_search(addresslist_anchor, sub); suffix = US"_a"; break;
7266 case 'd': t = tree_search(domainlist_anchor, sub); suffix = US"_d"; break;
7267 case 'h': t = tree_search(hostlist_anchor, sub); suffix = US"_h"; break;
7268 case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
7270 expand_string_message = US"bad suffix on \"list\" operator";
7276 expand_string_message = string_sprintf("\"%s\" is not a %snamed list",
7278 : *arg=='a'?"address "
7279 : *arg=='d'?"domain "
7281 : *arg=='l'?"localpart "
7286 list = ((namedlist_block *)(t->data.ptr))->string;
7288 while ((item = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
7290 uschar * buf = US" : ";
7292 yield = string_catn(yield, buf, 3);
7296 if (*item == '+') /* list item is itself a named list */
7298 uschar * sub = string_sprintf("${listnamed%s:%s}", suffix, item);
7299 item = expand_string_internal(sub, FALSE, NULL, FALSE, TRUE, &resetok);
7301 else if (sep != ':') /* item from non-colon-sep list, re-quote for colon list-separator */
7305 tok[0] = sep; tok[1] = ':'; tok[2] = 0;
7306 while ((cp= strpbrk(CCS item, tok)))
7308 yield = string_catn(yield, item, cp - CS item);
7309 if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */
7311 yield = string_catn(yield, US"::", 2);
7314 else /* sep in item; should already be doubled; emit once */
7316 yield = string_catn(yield, US tok, 1);
7317 if (*cp == sep) cp++;
7322 yield = string_cat(yield, item);
7327 /* quote a list-item for the given list-separator */
7329 /* mask applies a mask to an IP address; for example the result of
7330 ${mask:131.111.10.206/28} is 131.111.10.192/28. */
7337 int mask, maskoffset;
7338 int type = string_is_ip_address(sub, &maskoffset);
7343 expand_string_message = string_sprintf("\"%s\" is not an IP address",
7348 if (maskoffset == 0)
7350 expand_string_message = string_sprintf("missing mask value in \"%s\"",
7355 mask = Ustrtol(sub + maskoffset + 1, &endptr, 10);
7357 if (*endptr != 0 || mask < 0 || mask > ((type == 4)? 32 : 128))
7359 expand_string_message = string_sprintf("mask value too big in \"%s\"",
7364 /* Convert the address to binary integer(s) and apply the mask */
7366 sub[maskoffset] = 0;
7367 count = host_aton(sub, binary);
7368 host_mask(count, binary, mask);
7370 /* Convert to masked textual format and add to output. */
7372 yield = string_catn(yield, buffer,
7373 host_nmtoa(count, binary, mask, buffer, '.'));
7378 case EOP_IPV6DENORM:
7380 int type = string_is_ip_address(sub, NULL);
7387 (void) host_aton(sub, binary);
7390 case 4: /* convert to IPv4-mapped IPv6 */
7391 binary[0] = binary[1] = 0;
7392 binary[2] = 0x0000ffff;
7393 (void) host_aton(sub, binary+3);
7397 expand_string_message =
7398 string_sprintf("\"%s\" is not an IP address", sub);
7402 yield = string_catn(yield, buffer, c == EOP_IPV6NORM
7403 ? ipv6_nmtoa(binary, buffer)
7404 : host_nmtoa(4, binary, -1, buffer, ':')
7410 case EOP_LOCAL_PART:
7414 int start, end, domain;
7415 uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
7418 if (c != EOP_DOMAIN)
7419 yield = c == EOP_LOCAL_PART && domain > 0
7420 ? string_catn(yield, t, domain - 1)
7421 : string_cat(yield, t);
7422 else if (domain > 0)
7423 yield = string_cat(yield, t + domain);
7429 uschar outsep[2] = { ':', '\0' };
7430 uschar *address, *error;
7431 int save_ptr = gstring_length(yield);
7432 int start, end, domain; /* Not really used */
7434 if (Uskip_whitespace(&sub) == '>')
7435 if (*outsep = *++sub) ++sub;
7438 expand_string_message = string_sprintf("output separator "
7439 "missing in expanding ${addresses:%s}", --sub);
7442 f.parse_allow_group = TRUE;
7446 uschar * p = parse_find_address_end(sub, FALSE);
7447 uschar saveend = *p;
7449 address = parse_extract_address(sub, &error, &start, &end, &domain,
7453 /* Add the address to the output list that we are building. This is
7454 done in chunks by searching for the separator character. At the
7455 start, unless we are dealing with the first address of the output
7456 list, add in a space if the new address begins with the separator
7457 character, or is an empty string. */
7461 if (yield && yield->ptr != save_ptr && address[0] == *outsep)
7462 yield = string_catn(yield, US" ", 1);
7466 size_t seglen = Ustrcspn(address, outsep);
7467 yield = string_catn(yield, address, seglen + 1);
7469 /* If we got to the end of the string we output one character
7472 if (address[seglen] == '\0') { yield->ptr--; break; }
7473 yield = string_catn(yield, outsep, 1);
7474 address += seglen + 1;
7477 /* Output a separator after the string: we will remove the
7478 redundant final one at the end. */
7480 yield = string_catn(yield, outsep, 1);
7483 if (saveend == '\0') break;
7487 /* If we have generated anything, remove the redundant final
7490 if (yield && yield->ptr != save_ptr) yield->ptr--;
7491 f.parse_allow_group = FALSE;
7496 /* quote puts a string in quotes if it is empty or contains anything
7497 other than alphamerics, underscore, dot, or hyphen.
7499 quote_local_part puts a string in quotes if RFC 2821/2822 requires it to
7500 be quoted in order to be a valid local part.
7502 In both cases, newlines and carriage returns are converted into \n and \r
7506 case EOP_QUOTE_LOCAL_PART:
7509 BOOL needs_quote = (!*sub); /* TRUE for empty string */
7510 uschar *t = sub - 1;
7513 while (!needs_quote && *++t)
7514 needs_quote = !isalnum(*t) && !strchr("_-.", *t);
7516 else /* EOP_QUOTE_LOCAL_PART */
7517 while (!needs_quote && *++t)
7518 needs_quote = !isalnum(*t)
7519 && strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL
7520 && (*t != '.' || t == sub || !t[1]);
7524 yield = string_catn(yield, US"\"", 1);
7528 yield = string_catn(yield, US"\\n", 2);
7529 else if (*t == '\r')
7530 yield = string_catn(yield, US"\\r", 2);
7533 if (*t == '\\' || *t == '"')
7534 yield = string_catn(yield, US"\\", 1);
7535 yield = string_catn(yield, t, 1);
7537 yield = string_catn(yield, US"\"", 1);
7540 yield = string_cat(yield, sub);
7544 /* quote_lookuptype does lookup-specific quoting */
7549 uschar *opt = Ustrchr(arg, '_');
7551 if (opt) *opt++ = 0;
7553 if ((n = search_findtype(arg, Ustrlen(arg))) < 0)
7555 expand_string_message = search_error_message;
7559 if (lookup_list[n]->quote)
7560 sub = (lookup_list[n]->quote)(sub, opt);
7566 expand_string_message = string_sprintf(
7567 "\"%s\" unrecognized after \"${quote_%s\"",
7572 yield = string_cat(yield, sub);
7576 /* rx quote sticks in \ before any non-alphameric character so that
7577 the insertion works in a regular expression. */
7581 uschar *t = sub - 1;
7585 yield = string_catn(yield, US"\\", 1);
7586 yield = string_catn(yield, t, 1);
7591 /* RFC 2047 encodes, assuming headers_charset (default ISO 8859-1) as
7592 prescribed by the RFC, if there are characters that need to be encoded */
7596 uschar buffer[2048];
7597 yield = string_cat(yield,
7598 parse_quote_2047(sub, Ustrlen(sub), headers_charset,
7599 buffer, sizeof(buffer), FALSE));
7603 /* RFC 2047 decode */
7609 uschar *decoded = rfc2047_decode(sub, check_rfc2047_length,
7610 headers_charset, '?', &len, &error);
7613 expand_string_message = error;
7616 yield = string_catn(yield, decoded, len);
7620 /* from_utf8 converts UTF-8 to 8859-1, turning non-existent chars into
7625 uschar * buff = store_get(4, is_tainted(sub));
7630 if (c > 255) c = '_';
7632 yield = string_catn(yield, buff, 1);
7637 /* replace illegal UTF-8 sequences by replacement character */
7639 #define UTF8_REPLACEMENT_CHAR US"?"
7643 int seq_len = 0, index = 0;
7645 long codepoint = -1;
7647 uschar seq_buff[4]; /* accumulate utf-8 here */
7649 /* Manually track tainting, as we deal in individual chars below */
7651 if (is_tainted(sub))
7652 if (yield->s && yield->ptr)
7653 gstring_rebuffer(yield);
7655 yield->s = store_get(yield->size = Ustrlen(sub), TRUE);
7657 /* Check the UTF-8, byte-by-byte */
7666 if ((c & 0xc0) != 0x80)
7667 /* wrong continuation byte; invalidate all bytes */
7668 complete = 1; /* error */
7671 codepoint = (codepoint << 6) | (c & 0x3f);
7672 seq_buff[index++] = c;
7673 if (--bytes_left == 0) /* codepoint complete */
7674 if(codepoint > 0x10FFFF) /* is it too large? */
7675 complete = -1; /* error (RFC3629 limit) */
7677 { /* finished; output utf-8 sequence */
7678 yield = string_catn(yield, seq_buff, seq_len);
7683 else /* no bytes left: new sequence */
7685 if(!(c & 0x80)) /* 1-byte sequence, US-ASCII, keep it */
7687 yield = string_catn(yield, &c, 1);
7690 if((c & 0xe0) == 0xc0) /* 2-byte sequence */
7692 if(c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */
7697 codepoint = c & 0x1f;
7700 else if((c & 0xf0) == 0xe0) /* 3-byte sequence */
7703 codepoint = c & 0x0f;
7705 else if((c & 0xf8) == 0xf0) /* 4-byte sequence */
7708 codepoint = c & 0x07;
7710 else /* invalid or too long (RFC3629 allows only 4 bytes) */
7713 seq_buff[index++] = c;
7714 seq_len = bytes_left + 1;
7715 } /* if(bytes_left) */
7719 bytes_left = index = 0;
7720 yield = string_catn(yield, UTF8_REPLACEMENT_CHAR, 1);
7722 if ((complete == 1) && ((c & 0x80) == 0))
7723 /* ASCII character follows incomplete sequence */
7724 yield = string_catn(yield, &c, 1);
7726 /* If given a sequence truncated mid-character, we also want to report ?
7727 * Eg, ${length_1:フィル} is one byte, not one character, so we expect
7728 * ${utf8clean:${length_1:フィル}} to yield '?' */
7729 if (bytes_left != 0)
7730 yield = string_catn(yield, UTF8_REPLACEMENT_CHAR, 1);
7736 case EOP_UTF8_DOMAIN_TO_ALABEL:
7738 uschar * error = NULL;
7739 uschar * s = string_domain_utf8_to_alabel(sub, &error);
7742 expand_string_message = string_sprintf(
7743 "error converting utf8 (%s) to alabel: %s",
7744 string_printing(sub), error);
7747 yield = string_cat(yield, s);
7751 case EOP_UTF8_DOMAIN_FROM_ALABEL:
7753 uschar * error = NULL;
7754 uschar * s = string_domain_alabel_to_utf8(sub, &error);
7757 expand_string_message = string_sprintf(
7758 "error converting alabel (%s) to utf8: %s",
7759 string_printing(sub), error);
7762 yield = string_cat(yield, s);
7766 case EOP_UTF8_LOCALPART_TO_ALABEL:
7768 uschar * error = NULL;
7769 uschar * s = string_localpart_utf8_to_alabel(sub, &error);
7772 expand_string_message = string_sprintf(
7773 "error converting utf8 (%s) to alabel: %s",
7774 string_printing(sub), error);
7777 yield = string_cat(yield, s);
7778 DEBUG(D_expand) debug_printf_indent("yield: '%s'\n", yield->s);
7782 case EOP_UTF8_LOCALPART_FROM_ALABEL:
7784 uschar * error = NULL;
7785 uschar * s = string_localpart_alabel_to_utf8(sub, &error);
7788 expand_string_message = string_sprintf(
7789 "error converting alabel (%s) to utf8: %s",
7790 string_printing(sub), error);
7793 yield = string_cat(yield, s);
7796 #endif /* EXPERIMENTAL_INTERNATIONAL */
7798 /* escape turns all non-printing characters into escape sequences. */
7802 const uschar * t = string_printing(sub);
7803 yield = string_cat(yield, t);
7807 case EOP_ESCAPE8BIT:
7811 for (const uschar * s = sub; (c = *s); s++)
7812 yield = c < 127 && c != '\\'
7813 ? string_catn(yield, s, 1)
7814 : string_fmt_append(yield, "\\%03o", c);
7818 /* Handle numeric expression evaluation */
7823 uschar *save_sub = sub;
7824 uschar *error = NULL;
7825 int_eximarith_t n = eval_expr(&sub, (c == EOP_EVAL10), &error, FALSE);
7828 expand_string_message = string_sprintf("error in expression "
7829 "evaluation: %s (after processing \"%.*s\")", error,
7830 (int)(sub-save_sub), save_sub);
7833 yield = string_fmt_append(yield, PR_EXIM_ARITH, n);
7837 /* Handle time period formatting */
7841 int n = readconf_readtime(sub, 0, FALSE);
7844 expand_string_message = string_sprintf("string \"%s\" is not an "
7845 "Exim time interval in \"%s\" operator", sub, name);
7848 yield = string_fmt_append(yield, "%d", n);
7852 case EOP_TIME_INTERVAL:
7855 uschar *t = read_number(&n, sub);
7856 if (*t != 0) /* Not A Number*/
7858 expand_string_message = string_sprintf("string \"%s\" is not a "
7859 "positive number in \"%s\" operator", sub, name);
7862 t = readconf_printtime(n);
7863 yield = string_cat(yield, t);
7867 /* Convert string to base64 encoding */
7873 uschar * s = vp && *(void **)vp->value
7874 ? tls_cert_der_b64(*(void **)vp->value)
7875 : b64encode(CUS sub, Ustrlen(sub));
7877 uschar * s = b64encode(CUS sub, Ustrlen(sub));
7879 yield = string_cat(yield, s);
7886 int len = b64decode(sub, &s);
7889 expand_string_message = string_sprintf("string \"%s\" is not "
7890 "well-formed for \"%s\" operator", sub, name);
7893 yield = string_cat(yield, s);
7897 /* strlen returns the length of the string */
7900 yield = string_fmt_append(yield, "%d", Ustrlen(sub));
7903 /* length_n or l_n takes just the first n characters or the whole string,
7904 whichever is the shorter;
7906 substr_m_n, and s_m_n take n characters from offset m; negative m take
7907 from the end; l_n is synonymous with s_0_n. If n is omitted in substr it
7908 takes the rest, either to the right or to the left.
7910 hash_n or h_n makes a hash of length n from the string, yielding n
7911 characters from the set a-z; hash_n_m makes a hash of length n, but
7912 uses m characters from the set a-zA-Z0-9.
7914 nhash_n returns a single number between 0 and n-1 (in text form), while
7915 nhash_n_m returns a div/mod hash as two numbers "a/b". The first lies
7916 between 0 and n-1 and the second between 0 and m-1. */
7936 expand_string_message = string_sprintf("missing values after %s",
7941 /* "length" has only one argument, effectively being synonymous with
7944 if (c == EOP_LENGTH || c == EOP_L)
7950 /* The others have one or two arguments; for "substr" the first may be
7951 negative. The second being negative means "not supplied". */
7956 if (name[0] == 's' && *arg == '-') { sign = -1; arg++; }
7959 /* Read up to two numbers, separated by underscores */
7964 if (arg != ret && *arg == '_' && pn == &value1)
7968 if (arg[1] != 0) arg++;
7970 else if (!isdigit(*arg))
7972 expand_string_message =
7973 string_sprintf("non-digit after underscore in \"%s\"", name);
7976 else *pn = (*pn)*10 + *arg++ - '0';
7980 /* Perform the required operation */
7982 ret = c == EOP_HASH || c == EOP_H
7983 ? compute_hash(sub, value1, value2, &len)
7984 : c == EOP_NHASH || c == EOP_NH
7985 ? compute_nhash(sub, value1, value2, &len)
7986 : extract_substr(sub, value1, value2, &len);
7987 if (!ret) goto EXPAND_FAILED;
7989 yield = string_catn(yield, ret, len);
7998 uschar **modetable[3];
8002 if (expand_forbid & RDO_EXISTS)
8004 expand_string_message = US"Use of the stat() expansion is not permitted";
8008 if (stat(CS sub, &st) < 0)
8010 expand_string_message = string_sprintf("stat(%s) failed: %s",
8011 sub, strerror(errno));
8015 switch (mode & S_IFMT)
8017 case S_IFIFO: smode[0] = 'p'; break;
8018 case S_IFCHR: smode[0] = 'c'; break;
8019 case S_IFDIR: smode[0] = 'd'; break;
8020 case S_IFBLK: smode[0] = 'b'; break;
8021 case S_IFREG: smode[0] = '-'; break;
8022 default: smode[0] = '?'; break;
8025 modetable[0] = ((mode & 01000) == 0)? mtable_normal : mtable_sticky;
8026 modetable[1] = ((mode & 02000) == 0)? mtable_normal : mtable_setid;
8027 modetable[2] = ((mode & 04000) == 0)? mtable_normal : mtable_setid;
8029 for (int i = 0; i < 3; i++)
8031 memcpy(CS(smode + 7 - i*3), CS(modetable[i][mode & 7]), 3);
8036 yield = string_fmt_append(yield,
8037 "mode=%04lo smode=%s inode=%ld device=%ld links=%ld "
8038 "uid=%ld gid=%ld size=" OFF_T_FMT " atime=%ld mtime=%ld ctime=%ld",
8039 (long)(st.st_mode & 077777), smode, (long)st.st_ino,
8040 (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
8041 (long)st.st_gid, st.st_size, (long)st.st_atime,
8042 (long)st.st_mtime, (long)st.st_ctime);
8046 /* vaguely random number less than N */
8050 int_eximarith_t max = expanded_string_integer(sub, TRUE);
8052 if (expand_string_message)
8054 yield = string_fmt_append(yield, "%d", vaguely_random_number((int)max));
8058 /* Reverse IP, including IPv6 to dotted-nibble */
8060 case EOP_REVERSE_IP:
8062 int family, maskptr;
8063 uschar reversed[128];
8065 family = string_is_ip_address(sub, &maskptr);
8068 expand_string_message = string_sprintf(
8069 "reverse_ip() not given an IP address [%s]", sub);
8072 invert_address(reversed, sub);
8073 yield = string_cat(yield, reversed);
8077 /* Unknown operator */
8080 expand_string_message =
8081 string_sprintf("unknown expansion operator \"%s\"", name);
8086 /* Handle a plain name. If this is the first thing in the expansion, release
8087 the pre-allocated buffer. If the result data is known to be in a new buffer,
8088 newsize will be set to the size of that buffer, and we can just point at that
8089 store instead of copying. Many expansion strings contain just one reference,
8090 so this is a useful optimization, especially for humungous headers
8091 ($message_headers). */
8100 g = store_get(sizeof(gstring), FALSE);
8101 else if (yield->ptr == 0)
8103 if (resetok) reset_point = store_reset(reset_point);
8105 reset_point = store_mark();
8106 g = store_get(sizeof(gstring), FALSE); /* alloc _before_ calling find_variable() */
8108 if (!(value = find_variable(name, FALSE, skipping, &newsize)))
8110 expand_string_message =
8111 string_sprintf("unknown variable in \"${%s}\"", name);
8112 check_variable_error_message(name);
8115 len = Ustrlen(value);
8116 if (!yield && newsize)
8119 yield->size = newsize;
8124 yield = string_catn(yield, value, len);
8128 /* Else there's something wrong */
8130 expand_string_message =
8131 string_sprintf("\"${%s\" is not a known operator (or a } is missing "
8132 "in a variable reference)", name);
8136 /* If we hit the end of the string when ket_ends is set, there is a missing
8137 terminating brace. */
8139 if (ket_ends && *s == 0)
8141 expand_string_message = malformed_header
8142 ? US"missing } at end of string - could be header name not terminated by colon"
8143 : US"missing } at end of string";
8147 /* Expansion succeeded; yield may still be NULL here if nothing was actually
8148 added to the string. If so, set up an empty string. Add a terminating zero. If
8149 left != NULL, return a pointer to the terminator. */
8152 yield = string_get(1);
8153 (void) string_from_gstring(yield);
8154 if (left) *left = s;
8156 /* Any stacking store that was used above the final string is no longer needed.
8157 In many cases the final string will be the first one that was got and so there
8158 will be optimal store usage. */
8160 if (resetok) gstring_release_unused(yield);
8161 else if (resetok_p) *resetok_p = FALSE;
8165 BOOL tainted = is_tainted(yield->s);
8168 debug_printf_indent("|--expanding: %.*s\n", (int)(s - string), string);
8169 debug_printf_indent("%sresult: %s\n",
8170 skipping ? "|-----" : "\\_____", yield->s);
8172 debug_printf_indent("%s \\__(tainted)\n",
8173 skipping ? "| " : " ");
8175 debug_printf_indent("\\___skipping: result is not used\n");
8179 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
8180 "expanding: %.*s\n",
8181 (int)(s - string), string);
8182 debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
8184 skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
8187 debug_printf_indent("%s(tainted)\n",
8189 ? UTF8_VERT " " : " " UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ);
8191 debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
8192 "skipping: result is not used\n");
8198 /* This is the failure exit: easiest to program with a goto. We still need
8199 to update the pointer to the terminator, for cases of nested calls with "fail".
8202 EXPAND_FAILED_CURLY:
8203 if (malformed_header)
8204 expand_string_message =
8205 US"missing or misplaced { or } - could be header name not terminated by colon";
8207 else if (!expand_string_message || !*expand_string_message)
8208 expand_string_message = US"missing or misplaced { or }";
8210 /* At one point, Exim reset the store to yield (if yield was not NULL), but
8211 that is a bad idea, because expand_string_message is in dynamic store. */
8214 if (left) *left = s;
8218 debug_printf_indent("|failed to expand: %s\n", string);
8219 debug_printf_indent("%serror message: %s\n",
8220 f.expand_string_forcedfail ? "|---" : "\\___", expand_string_message);
8221 if (f.expand_string_forcedfail)
8222 debug_printf_indent("\\failure was forced\n");
8226 debug_printf_indent(UTF8_VERT_RIGHT "failed to expand: %s\n",
8228 debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
8229 "error message: %s\n",
8230 f.expand_string_forcedfail ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
8231 expand_string_message);
8232 if (f.expand_string_forcedfail)
8233 debug_printf_indent(UTF8_UP_RIGHT "failure was forced\n");
8235 if (resetok_p && !resetok) *resetok_p = FALSE;
8241 /* This is the external function call. Do a quick check for any expansion
8242 metacharacters, and if there are none, just return the input string.
8244 Argument: the string to be expanded
8245 Returns: the expanded string, or NULL if expansion failed; if failure was
8246 due to a lookup deferring, search_find_defer will be TRUE
8250 expand_cstring(const uschar * string)
8252 if (Ustrpbrk(string, "$\\") != NULL)
8254 int old_pool = store_pool;
8257 f.search_find_defer = FALSE;
8258 malformed_header = FALSE;
8259 store_pool = POOL_MAIN;
8260 s = expand_string_internal(string, FALSE, NULL, FALSE, TRUE, NULL);
8261 store_pool = old_pool;
8269 expand_string(uschar * string)
8271 return US expand_cstring(CUS string);
8278 /*************************************************
8280 *************************************************/
8282 /* Now and again we want to expand a string and be sure that the result is in a
8283 new bit of store. This function does that.
8284 Since we know it has been copied, the de-const cast is safe.
8286 Argument: the string to be expanded
8287 Returns: the expanded string, always in a new bit of store, or NULL
8291 expand_string_copy(const uschar *string)
8293 const uschar *yield = expand_cstring(string);
8294 if (yield == string) yield = string_copy(string);
8300 /*************************************************
8301 * Expand and interpret as an integer *
8302 *************************************************/
8304 /* Expand a string, and convert the result into an integer.
8307 string the string to be expanded
8308 isplus TRUE if a non-negative number is expected
8310 Returns: the integer value, or
8311 -1 for an expansion error ) in both cases, message in
8312 -2 for an integer interpretation error ) expand_string_message
8313 expand_string_message is set NULL for an OK integer
8317 expand_string_integer(uschar *string, BOOL isplus)
8319 return expanded_string_integer(expand_string(string), isplus);
8323 /*************************************************
8324 * Interpret string as an integer *
8325 *************************************************/
8327 /* Convert a string (that has already been expanded) into an integer.
8329 This function is used inside the expansion code.
8332 s the string to be expanded
8333 isplus TRUE if a non-negative number is expected
8335 Returns: the integer value, or
8336 -1 if string is NULL (which implies an expansion error)
8337 -2 for an integer interpretation error
8338 expand_string_message is set NULL for an OK integer
8341 static int_eximarith_t
8342 expanded_string_integer(const uschar *s, BOOL isplus)
8344 int_eximarith_t value;
8345 uschar *msg = US"invalid integer \"%s\"";
8348 /* If expansion failed, expand_string_message will be set. */
8352 /* On an overflow, strtol() returns LONG_MAX or LONG_MIN, and sets errno
8353 to ERANGE. When there isn't an overflow, errno is not changed, at least on some
8354 systems, so we set it zero ourselves. */
8357 expand_string_message = NULL; /* Indicates no error */
8359 /* Before Exim 4.64, strings consisting entirely of whitespace compared
8360 equal to 0. Unfortunately, people actually relied upon that, so preserve
8361 the behaviour explicitly. Stripping leading whitespace is a harmless
8362 noop change since strtol skips it anyway (provided that there is a number
8365 if (Uskip_whitespace(&s) == '\0')
8368 debug_printf_indent("treating blank string as number 0\n");
8372 value = strtoll(CS s, CSS &endptr, 10);
8375 msg = US"integer expected but \"%s\" found";
8376 else if (value < 0 && isplus)
8377 msg = US"non-negative integer expected but \"%s\" found";
8380 switch (tolower(*endptr))
8385 if (value > EXIM_ARITH_MAX/1024 || value < EXIM_ARITH_MIN/1024) errno = ERANGE;
8390 if (value > EXIM_ARITH_MAX/(1024*1024) || value < EXIM_ARITH_MIN/(1024*1024)) errno = ERANGE;
8391 else value *= 1024*1024;
8395 if (value > EXIM_ARITH_MAX/(1024*1024*1024) || value < EXIM_ARITH_MIN/(1024*1024*1024)) errno = ERANGE;
8396 else value *= 1024*1024*1024;
8400 if (errno == ERANGE)
8401 msg = US"absolute value of integer \"%s\" is too large (overflow)";
8403 if (Uskip_whitespace(&endptr) == 0) return value;
8406 expand_string_message = string_sprintf(CS msg, s);
8411 /* These values are usually fixed boolean values, but they are permitted to be
8415 addr address being routed
8416 mtype the module type
8417 mname the module name
8418 dbg_opt debug selectors
8419 oname the option name
8420 bvalue the router's boolean value
8421 svalue the router's string value
8422 rvalue where to put the returned value
8424 Returns: OK value placed in rvalue
8425 DEFER expansion failed
8429 exp_bool(address_item *addr,
8430 uschar *mtype, uschar *mname, unsigned dbg_opt,
8431 uschar *oname, BOOL bvalue,
8432 uschar *svalue, BOOL *rvalue)
8435 if (!svalue) { *rvalue = bvalue; return OK; }
8437 if (!(expanded = expand_string(svalue)))
8439 if (f.expand_string_forcedfail)
8441 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" forced failure\n", oname);
8445 addr->message = string_sprintf("failed to expand \"%s\" in %s %s: %s",
8446 oname, mname, mtype, expand_string_message);
8447 DEBUG(dbg_opt) debug_printf("%s\n", addr->message);
8451 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" yields \"%s\"\n", oname,
8454 if (strcmpic(expanded, US"true") == 0 || strcmpic(expanded, US"yes") == 0)
8456 else if (strcmpic(expanded, US"false") == 0 || strcmpic(expanded, US"no") == 0)
8460 addr->message = string_sprintf("\"%s\" is not a valid value for the "
8461 "\"%s\" option in the %s %s", expanded, oname, mname, mtype);
8470 /* Avoid potentially exposing a password in a string about to be logged */
8473 expand_hide_passwords(uschar * s)
8475 return ( ( Ustrstr(s, "failed to expand") != NULL
8476 || Ustrstr(s, "expansion of ") != NULL
8478 && ( Ustrstr(s, "mysql") != NULL
8479 || Ustrstr(s, "pgsql") != NULL
8480 || Ustrstr(s, "redis") != NULL
8481 || Ustrstr(s, "sqlite") != NULL
8482 || Ustrstr(s, "ldap:") != NULL
8483 || Ustrstr(s, "ldaps:") != NULL
8484 || Ustrstr(s, "ldapi:") != NULL
8485 || Ustrstr(s, "ldapdn:") != NULL
8486 || Ustrstr(s, "ldapm:") != NULL
8488 ? US"Temporary internal error" : s;
8492 /* Read given named file into big_buffer. Use for keying material etc.
8493 The content will have an ascii NUL appended.
8498 Return: pointer to buffer, or NULL on error.
8502 expand_file_big_buffer(const uschar * filename)
8504 int fd, off = 0, len;
8506 if ((fd = exim_open2(CS filename, O_RDONLY)) < 0)
8508 log_write(0, LOG_MAIN | LOG_PANIC, "unable to open file for reading: %s",
8515 if ((len = read(fd, big_buffer + off, big_buffer_size - 2 - off)) < 0)
8518 log_write(0, LOG_MAIN|LOG_PANIC, "unable to read file: %s", filename);
8526 big_buffer[off] = '\0';
8532 /*************************************************
8533 * Error-checking for testsuite *
8534 *************************************************/
8536 uschar * region_start;
8537 uschar * region_end;
8538 const uschar *var_name;
8539 const uschar *var_data;
8543 assert_variable_notin(uschar * var_name, uschar * var_data, void * ctx)
8546 if (var_data >= e->region_start && var_data < e->region_end)
8548 e->var_name = CUS var_name;
8549 e->var_data = CUS var_data;
8554 assert_no_variables(void * ptr, int len, const char * filename, int linenumber)
8556 err_ctx e = { .region_start = ptr, .region_end = US ptr + len,
8557 .var_name = NULL, .var_data = NULL };
8559 /* check acl_ variables */
8560 tree_walk(acl_var_c, assert_variable_notin, &e);
8561 tree_walk(acl_var_m, assert_variable_notin, &e);
8563 /* check auth<n> variables */
8564 for (int i = 0; i < AUTH_VARS; i++) if (auth_vars[i])
8565 assert_variable_notin(US"auth<n>", auth_vars[i], &e);
8567 /* check regex<n> variables */
8568 for (int i = 0; i < REGEX_VARS; i++) if (regex_vars[i])
8569 assert_variable_notin(US"regex<n>", regex_vars[i], &e);
8571 /* check known-name variables */
8572 for (var_entry * v = var_table; v < var_table + var_table_size; v++)
8573 if (v->type == vtype_stringptr)
8574 assert_variable_notin(US v->name, *(USS v->value), &e);
8576 /* check dns and address trees */
8577 tree_walk(tree_dns_fails, assert_variable_notin, &e);
8578 tree_walk(tree_duplicates, assert_variable_notin, &e);
8579 tree_walk(tree_nonrecipients, assert_variable_notin, &e);
8580 tree_walk(tree_unusable, assert_variable_notin, &e);
8583 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
8584 "live variable '%s' destroyed by reset_store at %s:%d\n- value '%.64s'",
8585 e.var_name, filename, linenumber, e.var_data);
8590 /*************************************************
8591 **************************************************
8592 * Stand-alone test program *
8593 **************************************************
8594 *************************************************/
8600 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
8602 int ovector[3*(EXPAND_MAXN+1)];
8603 int n = pcre_exec(re, NULL, subject, Ustrlen(subject), 0, PCRE_EOPT|options,
8604 ovector, nelem(ovector));
8605 BOOL yield = n >= 0;
8606 if (n == 0) n = EXPAND_MAXN + 1;
8609 expand_nmax = setup < 0 ? 0 : setup + 1;
8610 for (int nn = setup < 0 ? 0 : 2; nn < n*2; nn += 2)
8612 expand_nstring[expand_nmax] = subject + ovector[nn];
8613 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
8621 int main(int argc, uschar **argv)
8623 uschar buffer[1024];
8625 debug_selector = D_v;
8626 debug_file = stderr;
8627 debug_fd = fileno(debug_file);
8628 big_buffer = malloc(big_buffer_size);
8630 for (int i = 1; i < argc; i++)
8632 if (argv[i][0] == '+')
8634 debug_trace_memory = 2;
8637 if (isdigit(argv[i][0]))
8638 debug_selector = Ustrtol(argv[i], NULL, 0);
8640 if (Ustrspn(argv[i], "abcdefghijklmnopqrtsuvwxyz0123456789-.:/") ==
8644 eldap_default_servers = argv[i];
8647 mysql_servers = argv[i];
8650 pgsql_servers = argv[i];
8653 redis_servers = argv[i];
8657 else opt_perl_startup = argv[i];
8661 printf("Testing string expansion: debug_level = %d\n\n", debug_level);
8663 expand_nstring[1] = US"string 1....";
8664 expand_nlength[1] = 8;
8668 if (opt_perl_startup != NULL)
8671 printf("Starting Perl interpreter\n");
8672 errstr = init_perl(opt_perl_startup);
8675 printf("** error in perl_startup code: %s\n", errstr);
8676 return EXIT_FAILURE;
8679 #endif /* EXIM_PERL */
8681 /* Thie deliberately regards the input as untainted, so that it can be
8682 expanded; only reasonable since this is a test for string-expansions. */
8684 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
8686 rmark reset_point = store_mark();
8687 uschar *yield = expand_string(buffer);
8689 printf("%s\n", yield);
8692 if (f.search_find_defer) printf("search_find deferred\n");
8693 printf("Failed: %s\n", expand_string_message);
8694 if (f.expand_string_forcedfail) printf("Forced failure\n");
8697 store_reset(reset_point);
8709 /* End of expand.c */