X-Git-Url: https://git.exim.org/users/jgh/exim.git/blobdiff_plain/8fd715e80d7848fa463f06951a42967bd7123756..b5b871aca49fbf0fcc2c91997e70c3c57f77faa9:/src/src/expand.c diff --git a/src/src/expand.c b/src/src/expand.c index dcc813801..780386273 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -2,7 +2,7 @@ * Exim - an Internet mail transport agent * *************************************************/ -/* Copyright (c) University of Cambridge 1995 - 2009 */ +/* Copyright (c) University of Cambridge 1995 - 2012 */ /* See the file NOTICE for conditions of use and distribution. */ @@ -102,6 +102,7 @@ bcrypt ({CRYPT}$2a$). alphabetical order. */ static uschar *item_table[] = { + US"acl", US"dlfunc", US"extract", US"filter", @@ -124,6 +125,7 @@ static uschar *item_table[] = { US"tr" }; enum { + EITEM_ACL, EITEM_DLFUNC, EITEM_EXTRACT, EITEM_FILTER, @@ -182,6 +184,8 @@ static uschar *op_table_main[] = { US"l", US"lc", US"length", + US"listcount", + US"listnamed", US"mask", US"md5", US"nh", @@ -215,6 +219,8 @@ enum { EOP_L, EOP_LC, EOP_LENGTH, + EOP_LISTCOUNT, + EOP_LISTNAMED, EOP_MASK, EOP_MD5, EOP_NH, @@ -243,6 +249,7 @@ static uschar *cond_table[] = { US"==", /* Backward compatibility */ US">", US">=", + US"acl", US"and", US"bool", US"bool_lax", @@ -288,6 +295,7 @@ enum { ECOND_NUM_EE, ECOND_NUM_G, ECOND_NUM_GE, + ECOND_ACL, ECOND_AND, ECOND_BOOL, ECOND_BOOL_LAX, @@ -351,6 +359,7 @@ enum { vtype_ino, /* value is address of ino_t (not always an int) */ vtype_uid, /* value is address of uid_t (not always an int) */ vtype_gid, /* value is address of gid_t (not always an int) */ + vtype_bool, /* value is address of bool */ vtype_stringptr, /* value is address of pointer to string */ vtype_msgbody, /* as stringptr, but read when first required */ vtype_msgbody_end, /* ditto, the end of the message */ @@ -363,6 +372,7 @@ enum { /* local_scan()) */ vtype_todbsdin, /* value not used; generate BSD inbox tod */ vtype_tode, /* value not used; generate tod in epoch format */ + vtype_todel, /* value not used; generate tod in epoch/usec format */ vtype_todf, /* value not used; generate full tod */ vtype_todl, /* value not used; generate log tod */ vtype_todlf, /* value not used; generate log file datestamp tod */ @@ -384,6 +394,16 @@ enum { static var_entry var_table[] = { /* WARNING: Do not invent variables whose names start acl_c or acl_m because they will be confused with user-creatable ACL variables. */ + { "acl_arg1", vtype_stringptr, &acl_arg[0] }, + { "acl_arg2", vtype_stringptr, &acl_arg[1] }, + { "acl_arg3", vtype_stringptr, &acl_arg[2] }, + { "acl_arg4", vtype_stringptr, &acl_arg[3] }, + { "acl_arg5", vtype_stringptr, &acl_arg[4] }, + { "acl_arg6", vtype_stringptr, &acl_arg[5] }, + { "acl_arg7", vtype_stringptr, &acl_arg[6] }, + { "acl_arg8", vtype_stringptr, &acl_arg[7] }, + { "acl_arg9", vtype_stringptr, &acl_arg[8] }, + { "acl_narg", vtype_int, &acl_narg }, { "acl_verify_message", vtype_stringptr, &acl_verify_message }, { "address_data", vtype_stringptr, &deliver_address_data }, { "address_file", vtype_stringptr, &address_file }, @@ -561,6 +581,7 @@ static var_entry var_table[] = { { "sender_helo_name", vtype_stringptr, &sender_helo_name }, { "sender_host_address", vtype_stringptr, &sender_host_address }, { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated }, + { "sender_host_dnssec", vtype_bool, &sender_host_dnssec }, { "sender_host_name", vtype_host_lookup, NULL }, { "sender_host_port", vtype_int, &sender_host_port }, { "sender_ident", vtype_stringptr, &sender_ident }, @@ -611,15 +632,35 @@ static var_entry var_table[] = { { "srs_status", vtype_stringptr, &srs_status }, #endif { "thisaddress", vtype_stringptr, &filter_thisaddress }, - { "tls_bits", vtype_int, &tls_bits }, - { "tls_certificate_verified", vtype_int, &tls_certificate_verified }, - { "tls_cipher", vtype_stringptr, &tls_cipher }, - { "tls_peerdn", vtype_stringptr, &tls_peerdn }, + + /* The non-(in,out) variables are now deprecated */ + { "tls_bits", vtype_int, &tls_in.bits }, + { "tls_certificate_verified", vtype_int, &tls_in.certificate_verified }, + { "tls_cipher", vtype_stringptr, &tls_in.cipher }, + + { "tls_in_bits", vtype_int, &tls_in.bits }, + { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified }, + { "tls_in_cipher", vtype_stringptr, &tls_in.cipher }, + { "tls_in_peerdn", vtype_stringptr, &tls_in.peerdn }, +#if defined(SUPPORT_TLS) && !defined(USE_GNUTLS) + { "tls_in_sni", vtype_stringptr, &tls_in.sni }, +#endif + { "tls_out_bits", vtype_int, &tls_out.bits }, + { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified }, + { "tls_out_cipher", vtype_stringptr, &tls_out.cipher }, + { "tls_out_peerdn", vtype_stringptr, &tls_out.peerdn }, +#if defined(SUPPORT_TLS) && !defined(USE_GNUTLS) + { "tls_out_sni", vtype_stringptr, &tls_out.sni }, +#endif + + { "tls_peerdn", vtype_stringptr, &tls_in.peerdn }, /* mind the alphabetical order! */ #if defined(SUPPORT_TLS) && !defined(USE_GNUTLS) - { "tls_sni", vtype_stringptr, &tls_sni }, + { "tls_sni", vtype_stringptr, &tls_in.sni }, /* mind the alphabetical order! */ #endif + { "tod_bsdinbox", vtype_todbsdin, NULL }, { "tod_epoch", vtype_tode, NULL }, + { "tod_epoch_l", vtype_todel, NULL }, { "tod_full", vtype_todf, NULL }, { "tod_log", vtype_todl, NULL }, { "tod_logfile", vtype_todlf, NULL }, @@ -776,6 +817,7 @@ return rc; + /************************************************* * Pseudo-random number generation * *************************************************/ @@ -788,19 +830,23 @@ weirdness they'll twist this into. The result should ideally handle fork(). However, if we're stuck unable to provide this, then we'll fall back to appallingly bad randomness. -If SUPPORT_TLS is defined and OpenSSL is used, then this will not be used. -The GNUTLS randomness functions found do not seem amenable to extracting -random numbers outside of a TLS context. Any volunteers? +If SUPPORT_TLS is defined then this will not be used except as an emergency +fallback. Arguments: max range maximum Returns a random number in range [0, max-1] */ -#if !defined(SUPPORT_TLS) || defined(USE_GNUTLS) +#ifdef SUPPORT_TLS +# define vaguely_random_number vaguely_random_number_fallback +#endif int -pseudo_random_number(int max) +vaguely_random_number(int max) { +#ifdef SUPPORT_TLS +# undef vaguely_random_number +#endif static pid_t pid = 0; pid_t p2; #if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV) @@ -843,7 +889,8 @@ pseudo_random_number(int max) #endif } -#endif + + /************************************************* * Pick out a name from a string * @@ -1495,6 +1542,10 @@ while (last > first) sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(var_table[middle].value))); /* uid */ return var_buffer; + case vtype_bool: + sprintf(CS var_buffer, "%s", *(BOOL *)(var_table[middle].value) ? "yes" : "no"); /* bool */ + return var_buffer; + case vtype_stringptr: /* Pointer to string */ s = *((uschar **)(var_table[middle].value)); return (s == NULL)? US"" : s; @@ -1519,8 +1570,8 @@ while (last > first) domain = Ustrrchr(s, '@'); if (domain == NULL) return s; if (domain - s > sizeof(var_buffer) - 1) - log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than %d in " - "string expansion", sizeof(var_buffer)); + log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT + " in string expansion", sizeof(var_buffer)); Ustrncpy(var_buffer, s, domain - s); var_buffer[domain - s] = 0; return var_buffer; @@ -1583,6 +1634,9 @@ while (last > first) case vtype_tode: /* Unix epoch time of day */ return tod_stamp(tod_epoch); + case vtype_todel: /* Unix epoch/usec time of day */ + return tod_stamp(tod_epoch_l); + case vtype_todf: /* Full time of day */ return tod_stamp(tod_full); @@ -1668,6 +1722,31 @@ return NULL; /* Unknown variable name */ +void +modify_variable(uschar *name, void * value) +{ +int first = 0; +int last = var_table_size; + +while (last > first) + { + int middle = (first + last)/2; + int c = Ustrcmp(name, var_table[middle].name); + + if (c > 0) { first = middle + 1; continue; } + if (c < 0) { last = middle; continue; } + + /* Found an existing variable; change the item it refers to */ + var_table[middle].value = value; + return; + } +return; /* Unknown variable name, fail silently */ +} + + + + + /************************************************* * Read and expand substrings * *************************************************/ @@ -1757,6 +1836,40 @@ if (Ustrncmp(name, "acl_", 4) == 0) +/* +Load args from sub array to globals, and call acl_check(). + +Returns: OK access is granted by an ACCEPT verb + DISCARD access is granted by a DISCARD verb + FAIL access is denied + FAIL_DROP access is denied; drop the connection + DEFER can't tell at the moment + ERROR disaster +*/ +static int +eval_acl(uschar ** sub, int nsub, uschar ** user_msgp) +{ +int i; +uschar *dummy_log_msg; + +for (i = 1; i < nsub && sub[i]; i++) + acl_arg[i-1] = sub[i]; +acl_narg = i-1; +while (i < nsub) + acl_arg[i++ - 1] = NULL; + +DEBUG(D_expand) + debug_printf("expanding: acl: %s arg: %s%s\n", + sub[0], + acl_narg>0 ? sub[1] : US"", + acl_narg>1 ? " +more" : ""); + +return acl_check(ACL_WHERE_EXPANSION, NULL, sub[0], user_msgp, &dummy_log_msg); +} + + + + /************************************************* * Read and evaluate a condition * *************************************************/ @@ -1784,7 +1897,7 @@ int i, rc, cond_type, roffset; int_eximarith_t num[2]; struct stat statbuf; uschar name[256]; -uschar *sub[4]; +uschar *sub[10]; const pcre *re; const uschar *rerror; @@ -1851,6 +1964,7 @@ switch(cond_type) Ustrncmp(name, "bheader_", 8) == 0) { s = read_header_name(name, 256, s); + /* {-for-text-editors */ if (Ustrchr(name, '}') != NULL) malformed_header = TRUE; if (yield != NULL) *yield = (find_header(name, TRUE, NULL, FALSE, NULL) != NULL) == testfor; @@ -1910,10 +2024,11 @@ switch(cond_type) case ECOND_PWCHECK: while (isspace(*s)) s++; - if (*s != '{') goto COND_FAILED_CURLY_START; + if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ sub[0] = expand_string_internal(s+1, TRUE, &s, yield == NULL, TRUE); if (sub[0] == NULL) return NULL; + /* {-for-text-editors */ if (*s++ != '}') goto COND_FAILED_CURLY_END; if (yield == NULL) return s; /* No need to run the test if skipping */ @@ -1989,19 +2104,72 @@ switch(cond_type) return s; + /* call ACL (in a conditional context). Accept true, deny false. + Defer is a forced-fail. Anything set by message= goes to $value. + Up to ten parameters are used; we use the braces round the name+args + like the saslauthd condition does, to permit a variable number of args. + See also the expansion-item version EITEM_ACL and the traditional + acl modifier ACLC_ACL. + */ + + case ECOND_ACL: + /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */ + { + uschar *nameargs; + uschar *user_msg; + BOOL cond = FALSE; + int size = 0; + int ptr = 0; + + while (isspace(*s)) s++; + if (*s++ != '{') goto COND_FAILED_CURLY_START; + + switch(read_subs(sub, sizeof(sub)/sizeof(*sub), 1, + &s, yield == NULL, TRUE, US"acl")) + { + case 1: expand_string_message = US"too few arguments or bracketing " + "error for acl"; + case 2: + case 3: return NULL; + } + + if (yield != NULL) switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg)) + { + case OK: + cond = TRUE; + case FAIL: + lookup_value = NULL; + if (user_msg) + { + lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg)); + lookup_value[ptr] = '\0'; + } + *yield = cond == testfor; + break; + + case DEFER: + expand_string_forcedfail = TRUE; + default: + expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]); + return NULL; + } + return s; + } + + /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used: ${if saslauthd {{username}{password}{service}{realm}} {yes}[no}} However, the last two are optional. That is why the whole set is enclosed - in their own set or braces. */ + in their own set of braces. */ case ECOND_SASLAUTHD: #ifndef CYRUS_SASLAUTHD_SOCKET goto COND_FAILED_NOT_COMPILED; #else while (isspace(*s)) s++; - if (*s++ != '{') goto COND_FAILED_CURLY_START; + if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ switch(read_subs(sub, 4, 2, &s, yield == NULL, TRUE, US"saslauthd")) { case 1: expand_string_message = US"too few arguments or bracketing " @@ -2120,63 +2288,63 @@ switch(cond_type) { case ECOND_NUM_E: case ECOND_NUM_EE: - *yield = (num[0] == num[1]) == testfor; + tempcond = (num[0] == num[1]); break; case ECOND_NUM_G: - *yield = (num[0] > num[1]) == testfor; + tempcond = (num[0] > num[1]); break; case ECOND_NUM_GE: - *yield = (num[0] >= num[1]) == testfor; + tempcond = (num[0] >= num[1]); break; case ECOND_NUM_L: - *yield = (num[0] < num[1]) == testfor; + tempcond = (num[0] < num[1]); break; case ECOND_NUM_LE: - *yield = (num[0] <= num[1]) == testfor; + tempcond = (num[0] <= num[1]); break; case ECOND_STR_LT: - *yield = (Ustrcmp(sub[0], sub[1]) < 0) == testfor; + tempcond = (Ustrcmp(sub[0], sub[1]) < 0); break; case ECOND_STR_LTI: - *yield = (strcmpic(sub[0], sub[1]) < 0) == testfor; + tempcond = (strcmpic(sub[0], sub[1]) < 0); break; case ECOND_STR_LE: - *yield = (Ustrcmp(sub[0], sub[1]) <= 0) == testfor; + tempcond = (Ustrcmp(sub[0], sub[1]) <= 0); break; case ECOND_STR_LEI: - *yield = (strcmpic(sub[0], sub[1]) <= 0) == testfor; + tempcond = (strcmpic(sub[0], sub[1]) <= 0); break; case ECOND_STR_EQ: - *yield = (Ustrcmp(sub[0], sub[1]) == 0) == testfor; + tempcond = (Ustrcmp(sub[0], sub[1]) == 0); break; case ECOND_STR_EQI: - *yield = (strcmpic(sub[0], sub[1]) == 0) == testfor; + tempcond = (strcmpic(sub[0], sub[1]) == 0); break; case ECOND_STR_GT: - *yield = (Ustrcmp(sub[0], sub[1]) > 0) == testfor; + tempcond = (Ustrcmp(sub[0], sub[1]) > 0); break; case ECOND_STR_GTI: - *yield = (strcmpic(sub[0], sub[1]) > 0) == testfor; + tempcond = (strcmpic(sub[0], sub[1]) > 0); break; case ECOND_STR_GE: - *yield = (Ustrcmp(sub[0], sub[1]) >= 0) == testfor; + tempcond = (Ustrcmp(sub[0], sub[1]) >= 0); break; case ECOND_STR_GEI: - *yield = (strcmpic(sub[0], sub[1]) >= 0) == testfor; + tempcond = (strcmpic(sub[0], sub[1]) >= 0); break; case ECOND_MATCH: /* Regular expression match */ @@ -2188,7 +2356,7 @@ switch(cond_type) "\"%s\": %s at offset %d", sub[1], rerror, roffset); return NULL; } - *yield = regex_match_and_setup(re, sub[0], 0, -1) == testfor; + tempcond = regex_match_and_setup(re, sub[0], 0, -1); break; case ECOND_MATCH_ADDRESS: /* Match in an address list */ @@ -2244,11 +2412,11 @@ switch(cond_type) switch(rc) { case OK: - *yield = testfor; + tempcond = TRUE; break; case FAIL: - *yield = !testfor; + tempcond = FALSE; break; case DEFER: @@ -2262,6 +2430,7 @@ switch(cond_type) /* Various "encrypted" comparisons. If the second string starts with "{" then an encryption type is given. Default to crypt() or crypt16() (build-time choice). */ + /* }-for-text-editors */ case ECOND_CRYPTEQ: #ifndef SUPPORT_CRYPTEQ @@ -2286,7 +2455,7 @@ switch(cond_type) uschar *coded = auth_b64encode((uschar *)digest, 16); DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+5); - *yield = (Ustrcmp(coded, sub[1]+5) == 0) == testfor; + tempcond = (Ustrcmp(coded, sub[1]+5) == 0); } else if (sublen == 32) { @@ -2296,13 +2465,13 @@ switch(cond_type) coded[32] = 0; DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+5); - *yield = (strcmpic(coded, sub[1]+5) == 0) == testfor; + tempcond = (strcmpic(coded, sub[1]+5) == 0); } else { DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: " "fail\n crypted=%s\n", sub[1]+5); - *yield = !testfor; + tempcond = FALSE; } } @@ -2324,7 +2493,7 @@ switch(cond_type) uschar *coded = auth_b64encode((uschar *)digest, 20); DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+6); - *yield = (Ustrcmp(coded, sub[1]+6) == 0) == testfor; + tempcond = (Ustrcmp(coded, sub[1]+6) == 0); } else if (sublen == 40) { @@ -2334,13 +2503,13 @@ switch(cond_type) coded[40] = 0; DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n" " subject=%s\n crypted=%s\n", coded, sub[1]+6); - *yield = (strcmpic(coded, sub[1]+6) == 0) == testfor; + tempcond = (strcmpic(coded, sub[1]+6) == 0); } else { DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: " "fail\n crypted=%s\n", sub[1]+6); - *yield = !testfor; + tempcond = FALSE; } } @@ -2360,7 +2529,7 @@ switch(cond_type) sub[1] += 9; which = 2; } - else if (sub[1][0] == '{') + else if (sub[1][0] == '{') /* }-for-text-editors */ { expand_string_message = string_sprintf("unknown encryption mechanism " "in \"%s\"", sub[1]); @@ -2387,8 +2556,8 @@ switch(cond_type) salt), force failure. Otherwise we get false positives: with an empty string the yield of crypt() is an empty string! */ - *yield = (Ustrlen(sub[1]) < 2)? !testfor : - (Ustrcmp(coded, sub[1]) == 0) == testfor; + tempcond = (Ustrlen(sub[1]) < 2)? FALSE : + (Ustrcmp(coded, sub[1]) == 0); } break; #endif /* SUPPORT_CRYPTEQ */ @@ -2397,10 +2566,10 @@ switch(cond_type) case ECOND_INLISTI: { int sep = 0; - BOOL found = FALSE; uschar *save_iterate_item = iterate_item; int (*compare)(const uschar *, const uschar *); + tempcond = FALSE; if (cond_type == ECOND_INLISTI) compare = strcmpic; else @@ -2409,15 +2578,15 @@ switch(cond_type) while ((iterate_item = string_nextinlist(&sub[1], &sep, NULL, 0)) != NULL) if (compare(sub[0], iterate_item) == 0) { - found = TRUE; + tempcond = TRUE; break; } iterate_item = save_iterate_item; - *yield = found; } } /* Switch for comparison conditions */ + *yield = tempcond == testfor; return s; /* End of comparison conditions */ @@ -2429,13 +2598,14 @@ switch(cond_type) combined_cond = (cond_type == ECOND_AND); while (isspace(*s)) s++; - if (*s++ != '{') goto COND_FAILED_CURLY_START; + if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ for (;;) { while (isspace(*s)) s++; + /* {-for-text-editors */ if (*s == '}') break; - if (*s != '{') + if (*s != '{') /* }-for-text-editors */ { expand_string_message = string_sprintf("each subcondition " "inside an \"%s{...}\" condition must be in its own {}", name); @@ -2451,8 +2621,10 @@ switch(cond_type) } while (isspace(*s)) s++; + /* {-for-text-editors */ if (*s++ != '}') { + /* {-for-text-editors */ expand_string_message = string_sprintf("missing } at end of condition " "inside \"%s\" group", name); return NULL; @@ -2486,13 +2658,14 @@ switch(cond_type) uschar *save_iterate_item = iterate_item; while (isspace(*s)) s++; - if (*s++ != '{') goto COND_FAILED_CURLY_START; + if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ sub[0] = expand_string_internal(s, TRUE, &s, (yield == NULL), TRUE); if (sub[0] == NULL) return NULL; + /* {-for-text-editors */ if (*s++ != '}') goto COND_FAILED_CURLY_END; while (isspace(*s)) s++; - if (*s++ != '{') goto COND_FAILED_CURLY_START; + if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ sub[1] = s; @@ -2509,8 +2682,10 @@ switch(cond_type) } while (isspace(*s)) s++; + /* {-for-text-editors */ if (*s++ != '}') { + /* {-for-text-editors */ expand_string_message = string_sprintf("missing } at end of condition " "inside \"%s\"", name); return NULL; @@ -2558,7 +2733,7 @@ switch(cond_type) size_t len; BOOL boolvalue = FALSE; while (isspace(*s)) s++; - if (*s != '{') goto COND_FAILED_CURLY_START; + if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */ ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool"; switch(read_subs(sub_arg, 1, 1, &s, yield == NULL, FALSE, ourname)) { @@ -3576,6 +3751,44 @@ while (*s != 0) switch(item_type) { + /* Call an ACL from an expansion. We feed data in via $acl_arg1 - $acl_arg9. + If the ACL returns accept or reject we return content set by "message =" + There is currently no limit on recursion; this would have us call + acl_check_internal() directly and get a current level from somewhere. + See also the acl expansion condition ECOND_ACL and the traditional + acl modifier ACLC_ACL. + */ + + case EITEM_ACL: + /* ${acl {name} {arg1}{arg2}...} */ + { + uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */ + uschar *user_msg; + + switch(read_subs(sub, 10, 1, &s, skipping, TRUE, US"acl")) + { + case 1: goto EXPAND_FAILED_CURLY; + case 2: + case 3: goto EXPAND_FAILED; + } + if (skipping) continue; + + switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg)) + { + case OK: + case FAIL: + if (user_msg) + yield = string_cat(yield, &size, &ptr, user_msg, Ustrlen(user_msg)); + continue; + + case DEFER: + expand_string_forcedfail = TRUE; + default: + expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]); + goto EXPAND_FAILED; + } + } + /* Handle conditionals - preserve the values of the numerical expansion variables in case they get changed by a regular expression match in the condition. If not, they retain their external settings. At the end @@ -5409,6 +5622,106 @@ while (*s != 0) continue; } + /* count the number of list elements */ + + case EOP_LISTCOUNT: + { + int cnt = 0; + int sep = 0; + uschar * cp; + uschar buffer[256]; + + while (string_nextinlist(&sub, &sep, buffer, sizeof(buffer)) != NULL) cnt++; + cp = string_sprintf("%d", cnt); + yield = string_cat(yield, &size, &ptr, cp, Ustrlen(cp)); + continue; + } + + /* expand a named list given the name */ + /* handles nested named lists; requotes as colon-sep list */ + + case EOP_LISTNAMED: + { + tree_node *t = NULL; + uschar * list; + int sep = 0; + uschar * item; + uschar * suffix = ""; + BOOL needsep = FALSE; + uschar buffer[256]; + + if (*sub == '+') sub++; + if (arg == NULL) /* no-argument version */ + { + if (!(t = tree_search(addresslist_anchor, sub)) && + !(t = tree_search(domainlist_anchor, sub)) && + !(t = tree_search(hostlist_anchor, sub))) + t = tree_search(localpartlist_anchor, sub); + } + else switch(*arg) /* specific list-type version */ + { + case 'a': t = tree_search(addresslist_anchor, sub); suffix = "_a"; break; + case 'd': t = tree_search(domainlist_anchor, sub); suffix = "_d"; break; + case 'h': t = tree_search(hostlist_anchor, sub); suffix = "_h"; break; + case 'l': t = tree_search(localpartlist_anchor, sub); suffix = "_l"; break; + default: + expand_string_message = string_sprintf("bad suffix on \"list\" operator"); + goto EXPAND_FAILED; + } + + if(!t) + { + expand_string_message = string_sprintf("\"%s\" is not a %snamed list", + sub, !arg?"" + : *arg=='a'?"address " + : *arg=='d'?"domain " + : *arg=='h'?"host " + : *arg=='l'?"localpart " + : 0); + goto EXPAND_FAILED; + } + + list = ((namedlist_block *)(t->data.ptr))->string; + + while ((item = string_nextinlist(&list, &sep, buffer, sizeof(buffer))) != NULL) + { + uschar * buf = US" : "; + if (needsep) + yield = string_cat(yield, &size, &ptr, buf, 3); + else + needsep = TRUE; + + if (*item == '+') /* list item is itself a named list */ + { + uschar * sub = string_sprintf("${listnamed%s:%s}", suffix, item); + item = expand_string_internal(sub, FALSE, NULL, FALSE, TRUE); + } + else if (sep != ':') /* item from non-colon-sep list, re-quote for colon list-separator */ + { + char * cp; + char tok[3]; + tok[0] = sep; tok[1] = ':'; tok[2] = 0; + while ((cp= strpbrk((const char *)item, tok))) + { + yield = string_cat(yield, &size, &ptr, item, cp-(char *)item); + if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */ + { + yield = string_cat(yield, &size, &ptr, US"::", 2); + item = cp; + } + else /* sep in item; should already be doubled; emit once */ + { + yield = string_cat(yield, &size, &ptr, (uschar *)tok, 1); + if (*cp == sep) cp++; + item = cp; + } + } + } + yield = string_cat(yield, &size, &ptr, item, Ustrlen(item)); + } + continue; + } + /* mask applies a mask to an IP address; for example the result of ${mask:131.111.10.206/28} is 131.111.10.192/28. */ @@ -5914,7 +6227,7 @@ while (*s != 0) continue; } - /* pseudo-random number less than N */ + /* vaguely random number less than N */ case EOP_RANDINT: { @@ -5924,7 +6237,7 @@ while (*s != 0) max = expand_string_integer(sub, TRUE); if (expand_string_message != NULL) goto EXPAND_FAILED; - s = string_sprintf("%d", pseudo_random_number((int)max)); + s = string_sprintf("%d", vaguely_random_number((int)max)); yield = string_cat(yield, &size, &ptr, s, Ustrlen(s)); continue; } @@ -6162,18 +6475,25 @@ else if (value < 0 && isplus) } else { - if (tolower(*endptr) == 'k') + switch (tolower(*endptr)) { - if (value > LLONG_MAX/1024 || value < LLONG_MIN/1024) errno = ERANGE; + default: + break; + case 'k': + if (value > LLONG_MAX/1024 || value < LLONG_MIN/1024) errno = ERANGE; else value *= 1024; - endptr++; - } - else if (tolower(*endptr) == 'm') - { - if (value > LLONG_MAX/(1024*1024) || value < LLONG_MIN/(1024*1024)) - errno = ERANGE; - else value *= 1024*1024; - endptr++; + endptr++; + break; + case 'm': + if (value > LLONG_MAX/(1024*1024) || value < LLONG_MIN/(1024*1024)) errno = ERANGE; + else value *= 1024*1024; + endptr++; + break; + case 'g': + if (value > LLONG_MAX/(1024*1024*1024) || value < LLONG_MIN/(1024*1024*1024)) errno = ERANGE; + else value *= 1024*1024*1024; + endptr++; + break; } if (errno == ERANGE) msg = US"absolute value of integer \"%s\" is too large (overflow)";