Fix testcase 0373

[users/jgh/exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 34fb0346effe91d7160ed7ceecad80a2a91b2429..b02ea30a29fb4b183128c6b6b2cddc8829af10d0 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -205,6 +205,7 @@ static uschar *op_table_main[] = {
   US"rxquote",
   US"s",
   US"sha1",
   US"rxquote",
   US"s",
   US"sha1",

+  US"sha256",

   US"stat",
   US"str2b64",
   US"strlen",
   US"stat",
   US"str2b64",
   US"strlen",


@@ -242,6 +243,7 @@ enum {
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,

+  EOP_SHA256,

   EOP_STAT,
   EOP_STR2B64,
   EOP_STRLEN,
   EOP_STAT,
   EOP_STR2B64,
   EOP_STRLEN,


@@ -671,6 +673,7 @@ static var_entry var_table[] = {
   { "tls_in_bits",         vtype_int,         &tls_in.bits },
   { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
   { "tls_in_cipher",       vtype_stringptr,   &tls_in.cipher },
   { "tls_in_bits",         vtype_int,         &tls_in.bits },
   { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
   { "tls_in_cipher",       vtype_stringptr,   &tls_in.cipher },

+  { "tls_in_ocsp",         vtype_int,         &tls_in.ocsp },

   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },


@@ -680,6 +683,7 @@ static var_entry var_table[] = {
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
   { "tls_out_cipher",      vtype_stringptr,   &tls_out.cipher },
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
   { "tls_out_cipher",      vtype_stringptr,   &tls_out.cipher },

+  { "tls_out_ocsp",        vtype_int,         &tls_out.ocsp },

   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },


@@ -1185,26 +1189,28 @@ return string_nextinlist(&list, &sep, NULL, 0);
 
 
 /* Certificate fields, by name.  Worry about by-OID later */
 
 
 /* Certificate fields, by name.  Worry about by-OID later */

+/* Names are chosen to not have common prefixes */

 
 #ifdef SUPPORT_TLS
 typedef struct
 {
 uschar * name;
 
 #ifdef SUPPORT_TLS
 typedef struct
 {
 uschar * name;

-uschar * (*getfn)(void * cert);
+int      namelen;
+uschar * (*getfn)(void * cert, uschar * mod);

 } certfield;
 static certfield certfields[] =
 {                      /* linear search; no special order */
 } certfield;
 static certfield certfields[] =
 {                      /* linear search; no special order */

-  { US"version",       &tls_cert_version },
-  { US"serial_number", &tls_cert_serial_number },
-  { US"subject",       &tls_cert_subject },
-  { US"notbefore",     &tls_cert_not_before },
-  { US"notafter",      &tls_cert_not_after },
-  { US"issuer",                &tls_cert_issuer },
-  { US"signature",     &tls_cert_signature },
-  { US"signature_algorithm",   &tls_cert_signature_algorithm },
-  { US"subject_altname",       &tls_cert_subject_altname },
-  { US"ocsp_uri",      &tls_cert_ocsp_uri },
-  { US"crl_uri",       &tls_cert_crl_uri },
+  { US"version",        7,  &tls_cert_version },
+  { US"serial_number",  13, &tls_cert_serial_number },
+  { US"subject",        7,  &tls_cert_subject },
+  { US"notbefore",      9,  &tls_cert_not_before },
+  { US"notafter",       8,  &tls_cert_not_after },
+  { US"issuer",                 6,  &tls_cert_issuer },
+  { US"signature",      9,  &tls_cert_signature },
+  { US"sig_algorithm",  13, &tls_cert_signature_algorithm },
+  { US"subj_altname",    12, &tls_cert_subject_altname },
+  { US"ocsp_uri",       8,  &tls_cert_ocsp_uri },
+  { US"crl_uri",        7,  &tls_cert_crl_uri },

 };
 
 static uschar *
 };
 
 static uschar *


@@ -1236,8 +1242,12 @@ if (*field >= '0' && *field <= '9')
 for(cp = certfields;
     cp < certfields + nelements(certfields);
     cp++)
 for(cp = certfields;
     cp < certfields + nelements(certfields);
     cp++)

-  if (Ustrcmp(cp->name, field) == 0)
-    return (*cp->getfn)( *(void **)vp->value );
+  if (Ustrncmp(cp->name, field, cp->namelen) == 0)
+    {
+    uschar * modifier = *(field += cp->namelen) == ','
+      ? ++field : NULL;
+    return (*cp->getfn)( *(void **)vp->value, modifier );
+    }

 
 expand_string_message = 
   string_sprintf("bad field selector \"%s\" for certextract", field);
 
 expand_string_message = 
   string_sprintf("bad field selector \"%s\" for certextract", field);


@@ -3949,6 +3959,8 @@ while (*s != 0)
        {
        case OK:
        case FAIL:
        {
        case OK:
        case FAIL:

+         DEBUG(D_expand)
+           debug_printf("acl expansion yield: %s\n", user_msg);

          if (user_msg)
             yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg));
          continue;
          if (user_msg)
             yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg));
          continue;


@@ -4655,6 +4667,9 @@ while (*s != 0)
 
         DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]);
 
 
         DEBUG(D_expand) debug_printf("connected to socket %s\n", sub_arg[0]);
 

+       /* Allow sequencing of test actions */
+       if (running_in_test_harness) millisleep(100);
+

         /* Write the request string, if not empty */
 
         if (sub_arg[1][0] != 0)
         /* Write the request string, if not empty */
 
         if (sub_arg[1][0] != 0)


@@ -4678,6 +4693,8 @@ while (*s != 0)
         shutdown(fd, SHUT_WR);
         #endif
 
         shutdown(fd, SHUT_WR);
         #endif
 

+       if (running_in_test_harness) millisleep(100);
+

         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 


@@ -5355,8 +5372,6 @@ while (*s != 0)
 #ifdef SUPPORT_TLS
     case EITEM_CERTEXTRACT:
       {
 #ifdef SUPPORT_TLS
     case EITEM_CERTEXTRACT:
       {

-      int i;
-      int field_number = 1;

       uschar *save_lookup_value = lookup_value;
       uschar *sub[2];
       int save_expand_nmax =
       uschar *save_lookup_value = lookup_value;
       uschar *sub[2];
       int save_expand_nmax =


@@ -5372,7 +5387,6 @@ while (*s != 0)
       /* strip spaces fore & aft */
       {
       int len;
       /* strip spaces fore & aft */
       {
       int len;

-      int x = 0;

       uschar *p = sub[0];
 
       while (isspace(*p)) p++;
       uschar *p = sub[0];
 
       while (isspace(*p)) p++;


@@ -5714,19 +5728,16 @@ while (*s != 0)
     {
     int c;
     uschar *arg = NULL;
     {
     int c;
     uschar *arg = NULL;

-    uschar *sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
-    if (sub == NULL) goto EXPAND_FAILED;
-    s++;
+    uschar *sub;
+    var_entry *vp = NULL;

 
     /* Owing to an historical mis-design, an underscore may be part of the
     operator name, or it may introduce arguments.  We therefore first scan the
     table of names that contain underscores. If there is no match, we cut off
     the arguments and then scan the main table. */
 
 
     /* Owing to an historical mis-design, an underscore may be part of the
     operator name, or it may introduce arguments.  We therefore first scan the
     table of names that contain underscores. If there is no match, we cut off
     the arguments and then scan the main table. */
 

-    c = chop_match(name, op_table_underscore,
-      sizeof(op_table_underscore)/sizeof(uschar *));
-
-    if (c < 0)
+    if ((c = chop_match(name, op_table_underscore,
+       sizeof(op_table_underscore)/sizeof(uschar *))) < 0)

       {
       arg = Ustrchr(name, '_');
       if (arg != NULL) *arg = 0;
       {
       arg = Ustrchr(name, '_');
       if (arg != NULL) *arg = 0;


@@ -5736,6 +5747,37 @@ while (*s != 0)
       if (arg != NULL) *arg++ = '_';   /* Put back for error messages */
       }
 
       if (arg != NULL) *arg++ = '_';   /* Put back for error messages */
       }
 

+    /* Deal specially with operators that might take a certificate variable
+    as we do not want to do the usual expansion. For most, expand the string.*/
+    switch(c)
+      {
+#ifdef SUPPORT_TLS
+      case EOP_MD5:
+      case EOP_SHA1:
+      case EOP_SHA256:
+       if (s[1] == '$')
+         {
+         uschar * s1 = s;
+         sub = expand_string_internal(s+2, TRUE, &s1, skipping,
+                 FALSE, &resetok);
+         if (!sub)       goto EXPAND_FAILED;           /*{*/
+         if (*s1 != '}') goto EXPAND_FAILED_CURLY;
+         if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
+           {
+           s = s1+1;
+           break;
+           }
+         vp = NULL;
+         }
+        /*FALLTHROUGH*/
+#endif
+      default:
+       sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
+       if (!sub) goto EXPAND_FAILED;
+       s++;
+       break;
+      }
+

     /* If we are skipping, we don't need to perform the operation at all.
     This matters for operations like "mask", because the data may not be
     in the correct format when skipping. For example, the expression may test
     /* If we are skipping, we don't need to perform the operation at all.
     This matters for operations like "mask", because the data may not be
     in the correct format when skipping. For example, the expression may test


@@ -5820,30 +5862,58 @@ while (*s != 0)
         }
 
       case EOP_MD5:
         }
 
       case EOP_MD5:

-        {
-        md5 base;
-        uschar digest[16];
-        int j;
-        char st[33];
-        md5_start(&base);
-        md5_end(&base, sub, Ustrlen(sub), digest);
-        for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
-        yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+#ifdef SUPPORT_TLS
+       if (vp && *(void **)vp->value)
+         {
+         uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
+         yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
+         }
+       else
+#endif
+         {
+         md5 base;
+         uschar digest[16];
+         int j;
+         char st[33];
+         md5_start(&base);
+         md5_end(&base, sub, Ustrlen(sub), digest);
+         for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
+         yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+         }

         continue;
         continue;

-        }

 
       case EOP_SHA1:
 
       case EOP_SHA1:

-        {
-        sha1 base;
-        uschar digest[20];
-        int j;
-        char st[41];
-        sha1_start(&base);
-        sha1_end(&base, sub, Ustrlen(sub), digest);
-        for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
-        yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+#ifdef SUPPORT_TLS
+       if (vp && *(void **)vp->value)
+         {
+         uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
+         yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp));
+         }
+       else
+#endif
+         {
+         sha1 base;
+         uschar digest[20];
+         int j;
+         char st[41];
+         sha1_start(&base);
+         sha1_end(&base, sub, Ustrlen(sub), digest);
+         for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
+         yield = string_cat(yield, &size, &ptr, US st, (int)strlen(st));
+         }
+        continue;
+
+      case EOP_SHA256:
+#ifdef SUPPORT_TLS
+       if (vp && *(void **)vp->value)
+         {
+         uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
+         yield = string_cat(yield, &size, &ptr, cp, (int)strlen(cp));
+         }
+       else
+#endif
+         expand_string_message = US"sha256 only supported for certificates";

         continue;
         continue;

-        }

 
       /* Convert hex encoding to base64 encoding */
 
 
       /* Convert hex encoding to base64 encoding */
 


@@ -6296,7 +6366,7 @@ while (*s != 0)
       case EOP_UTF8CLEAN:
         {
         int seq_len, index = 0;
       case EOP_UTF8CLEAN:
         {
         int seq_len, index = 0;

-        int bytes_left  = 0;
+        int bytes_left = 0;

         uschar seq_buff[4];                    /* accumulate utf-8 here */
         
         while (*sub != 0)
         uschar seq_buff[4];                    /* accumulate utf-8 here */
         
         while (*sub != 0)


@@ -6307,7 +6377,7 @@ while (*s != 0)
 
          complete = 0;
          c = *sub++;
 
          complete = 0;
          c = *sub++;

-         if(bytes_left)
+         if (bytes_left)

            {
            if ((c & 0xc0) != 0x80)
              {
            {
            if ((c & 0xc0) != 0x80)
              {


@@ -7005,7 +7075,6 @@ return 0;
 
 #endif
 
 
 #endif
 

-/*
- vi: aw ai sw=2
+/* vi: aw ai sw=2

 */
 /* End of expand.c */
 */
 /* End of expand.c */