1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
9 /* Functions for handling string expansion. */
14 /* Recursively called function */
16 static uschar *expand_string_internal(const uschar *, BOOL, const uschar **, BOOL, BOOL, BOOL *);
17 static int_eximarith_t expanded_string_integer(const uschar *, BOOL);
20 # ifndef SUPPORT_CRYPTEQ
21 # define SUPPORT_CRYPTEQ
26 # include "lookups/ldap.h"
29 #ifdef SUPPORT_CRYPTEQ
34 extern char* crypt16(char*, char*);
38 /* The handling of crypt16() is a mess. I will record below the analysis of the
39 mess that was sent to me. We decided, however, to make changing this very low
40 priority, because in practice people are moving away from the crypt()
41 algorithms nowadays, so it doesn't seem worth it.
44 There is an algorithm named "crypt16" in Ultrix and Tru64. It crypts
45 the first 8 characters of the password using a 20-round version of crypt
46 (standard crypt does 25 rounds). It then crypts the next 8 characters,
47 or an empty block if the password is less than 9 characters, using a
48 20-round version of crypt and the same salt as was used for the first
49 block. Characters after the first 16 are ignored. It always generates
50 a 16-byte hash, which is expressed together with the salt as a string
51 of 24 base 64 digits. Here are some links to peruse:
53 http://cvs.pld.org.pl/pam/pamcrypt/crypt16.c?rev=1.2
54 http://seclists.org/bugtraq/1999/Mar/0076.html
56 There's a different algorithm named "bigcrypt" in HP-UX, Digital Unix,
57 and OSF/1. This is the same as the standard crypt if given a password
58 of 8 characters or less. If given more, it first does the same as crypt
59 using the first 8 characters, then crypts the next 8 (the 9th to 16th)
60 using as salt the first two base 64 digits from the first hash block.
61 If the password is more than 16 characters then it crypts the 17th to 24th
62 characters using as salt the first two base 64 digits from the second hash
63 block. And so on: I've seen references to it cutting off the password at
64 40 characters (5 blocks), 80 (10 blocks), or 128 (16 blocks). Some links:
66 http://cvs.pld.org.pl/pam/pamcrypt/bigcrypt.c?rev=1.2
67 http://seclists.org/bugtraq/1999/Mar/0109.html
68 http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/HTML/AA-Q0R2D-
69 TET1_html/sec.c222.html#no_id_208
71 Exim has something it calls "crypt16". It will either use a native
72 crypt16 or its own implementation. A native crypt16 will presumably
73 be the one that I called "crypt16" above. The internal "crypt16"
74 function, however, is a two-block-maximum implementation of what I called
75 "bigcrypt". The documentation matches the internal code.
77 I suspect that whoever did the "crypt16" stuff for Exim didn't realise
78 that crypt16 and bigcrypt were different things.
80 Exim uses the LDAP-style scheme identifier "{crypt16}" to refer
81 to whatever it is using under that name. This unfortunately sets a
82 precedent for using "{crypt16}" to identify two incompatible algorithms
83 whose output can't be distinguished. With "{crypt16}" thus rendered
84 ambiguous, I suggest you deprecate it and invent two new identifiers
85 for the two algorithms.
87 Both crypt16 and bigcrypt are very poor algorithms, btw. Hashing parts
88 of the password separately means they can be cracked separately, so
89 the double-length hash only doubles the cracking effort instead of
90 squaring it. I recommend salted SHA-1 ({SSHA}), or the Blowfish-based
97 /*************************************************
98 * Local statics and tables *
99 *************************************************/
101 /* Table of item names, and corresponding switch numbers. The names must be in
102 alphabetical order. */
104 static uschar *item_table[] = {
166 /* Tables of operator names, and corresponding switch numbers. The names must be
167 in alphabetical order. There are two tables, because underscore is used in some
168 cases to introduce arguments, whereas for other it is part of the name. This is
169 an historical mis-design. */
171 static uschar *op_table_underscore[] = {
174 US"quote_local_part",
179 ,US"utf8_domain_from_alabel",
180 US"utf8_domain_to_alabel",
181 US"utf8_localpart_from_alabel",
182 US"utf8_localpart_to_alabel"
189 EOP_QUOTE_LOCAL_PART,
194 ,EOP_UTF8_DOMAIN_FROM_ALABEL,
195 EOP_UTF8_DOMAIN_TO_ALABEL,
196 EOP_UTF8_LOCALPART_FROM_ALABEL,
197 EOP_UTF8_LOCALPART_TO_ALABEL
201 static uschar *op_table_main[] = {
248 EOP_ADDRESS = nelem(op_table_underscore),
294 /* Table of condition names, and corresponding switch numbers. The names must
295 be in alphabetical order. */
297 static uschar *cond_table[] = {
301 US"==", /* Backward compatibility */
334 US"match_local_part",
359 ECOND_FIRST_DELIVERY,
380 ECOND_MATCH_LOCAL_PART,
390 /* Types of table entry */
393 vtype_int, /* value is address of int */
394 vtype_filter_int, /* ditto, but recognized only when filtering */
395 vtype_ino, /* value is address of ino_t (not always an int) */
396 vtype_uid, /* value is address of uid_t (not always an int) */
397 vtype_gid, /* value is address of gid_t (not always an int) */
398 vtype_bool, /* value is address of bool */
399 vtype_stringptr, /* value is address of pointer to string */
400 vtype_msgbody, /* as stringptr, but read when first required */
401 vtype_msgbody_end, /* ditto, the end of the message */
402 vtype_msgheaders, /* the message's headers, processed */
403 vtype_msgheaders_raw, /* the message's headers, unprocessed */
404 vtype_localpart, /* extract local part from string */
405 vtype_domain, /* extract domain from string */
406 vtype_string_func, /* value is string returned by given function */
407 vtype_todbsdin, /* value not used; generate BSD inbox tod */
408 vtype_tode, /* value not used; generate tod in epoch format */
409 vtype_todel, /* value not used; generate tod in epoch/usec format */
410 vtype_todf, /* value not used; generate full tod */
411 vtype_todl, /* value not used; generate log tod */
412 vtype_todlf, /* value not used; generate log file datestamp tod */
413 vtype_todzone, /* value not used; generate time zone only */
414 vtype_todzulu, /* value not used; generate zulu tod */
415 vtype_reply, /* value not used; get reply from headers */
416 vtype_pid, /* value not used; result is pid */
417 vtype_host_lookup, /* value not used; get host name */
418 vtype_load_avg, /* value not used; result is int from os_getloadavg */
419 vtype_pspace, /* partition space; value is T/F for spool/log */
420 vtype_pinodes, /* partition inodes; value is T/F for spool/log */
421 vtype_cert /* SSL certificate */
423 ,vtype_dkim /* Lookup of value in DKIM signature */
427 /* Type for main variable table */
435 /* Type for entries pointing to address/length pairs. Not currently
443 static uschar * fn_recipients(void);
445 /* This table must be kept in alphabetical order. */
447 static var_entry var_table[] = {
448 /* WARNING: Do not invent variables whose names start acl_c or acl_m because
449 they will be confused with user-creatable ACL variables. */
450 { "acl_arg1", vtype_stringptr, &acl_arg[0] },
451 { "acl_arg2", vtype_stringptr, &acl_arg[1] },
452 { "acl_arg3", vtype_stringptr, &acl_arg[2] },
453 { "acl_arg4", vtype_stringptr, &acl_arg[3] },
454 { "acl_arg5", vtype_stringptr, &acl_arg[4] },
455 { "acl_arg6", vtype_stringptr, &acl_arg[5] },
456 { "acl_arg7", vtype_stringptr, &acl_arg[6] },
457 { "acl_arg8", vtype_stringptr, &acl_arg[7] },
458 { "acl_arg9", vtype_stringptr, &acl_arg[8] },
459 { "acl_narg", vtype_int, &acl_narg },
460 { "acl_verify_message", vtype_stringptr, &acl_verify_message },
461 { "address_data", vtype_stringptr, &deliver_address_data },
462 { "address_file", vtype_stringptr, &address_file },
463 { "address_pipe", vtype_stringptr, &address_pipe },
464 #ifdef EXPERIMENTAL_ARC
465 { "arc_state", vtype_stringptr, &arc_state },
466 { "arc_state_reason", vtype_stringptr, &arc_state_reason },
468 { "authenticated_fail_id",vtype_stringptr, &authenticated_fail_id },
469 { "authenticated_id", vtype_stringptr, &authenticated_id },
470 { "authenticated_sender",vtype_stringptr, &authenticated_sender },
471 { "authentication_failed",vtype_int, &authentication_failed },
472 #ifdef WITH_CONTENT_SCAN
473 { "av_failed", vtype_int, &av_failed },
475 #ifdef EXPERIMENTAL_BRIGHTMAIL
476 { "bmi_alt_location", vtype_stringptr, &bmi_alt_location },
477 { "bmi_base64_tracker_verdict", vtype_stringptr, &bmi_base64_tracker_verdict },
478 { "bmi_base64_verdict", vtype_stringptr, &bmi_base64_verdict },
479 { "bmi_deliver", vtype_int, &bmi_deliver },
481 { "body_linecount", vtype_int, &body_linecount },
482 { "body_zerocount", vtype_int, &body_zerocount },
483 { "bounce_recipient", vtype_stringptr, &bounce_recipient },
484 { "bounce_return_size_limit", vtype_int, &bounce_return_size_limit },
485 { "caller_gid", vtype_gid, &real_gid },
486 { "caller_uid", vtype_uid, &real_uid },
487 { "callout_address", vtype_stringptr, &callout_address },
488 { "compile_date", vtype_stringptr, &version_date },
489 { "compile_number", vtype_stringptr, &version_cnumber },
490 { "config_dir", vtype_stringptr, &config_main_directory },
491 { "config_file", vtype_stringptr, &config_main_filename },
492 { "csa_status", vtype_stringptr, &csa_status },
493 #ifdef EXPERIMENTAL_DCC
494 { "dcc_header", vtype_stringptr, &dcc_header },
495 { "dcc_result", vtype_stringptr, &dcc_result },
498 { "dkim_algo", vtype_dkim, (void *)DKIM_ALGO },
499 { "dkim_bodylength", vtype_dkim, (void *)DKIM_BODYLENGTH },
500 { "dkim_canon_body", vtype_dkim, (void *)DKIM_CANON_BODY },
501 { "dkim_canon_headers", vtype_dkim, (void *)DKIM_CANON_HEADERS },
502 { "dkim_copiedheaders", vtype_dkim, (void *)DKIM_COPIEDHEADERS },
503 { "dkim_created", vtype_dkim, (void *)DKIM_CREATED },
504 { "dkim_cur_signer", vtype_stringptr, &dkim_cur_signer },
505 { "dkim_domain", vtype_stringptr, &dkim_signing_domain },
506 { "dkim_expires", vtype_dkim, (void *)DKIM_EXPIRES },
507 { "dkim_headernames", vtype_dkim, (void *)DKIM_HEADERNAMES },
508 { "dkim_identity", vtype_dkim, (void *)DKIM_IDENTITY },
509 { "dkim_key_granularity",vtype_dkim, (void *)DKIM_KEY_GRANULARITY },
510 { "dkim_key_length", vtype_int, &dkim_key_length },
511 { "dkim_key_nosubdomains",vtype_dkim, (void *)DKIM_NOSUBDOMAINS },
512 { "dkim_key_notes", vtype_dkim, (void *)DKIM_KEY_NOTES },
513 { "dkim_key_srvtype", vtype_dkim, (void *)DKIM_KEY_SRVTYPE },
514 { "dkim_key_testing", vtype_dkim, (void *)DKIM_KEY_TESTING },
515 { "dkim_selector", vtype_stringptr, &dkim_signing_selector },
516 { "dkim_signers", vtype_stringptr, &dkim_signers },
517 { "dkim_verify_reason", vtype_stringptr, &dkim_verify_reason },
518 { "dkim_verify_status", vtype_stringptr, &dkim_verify_status },
520 #ifdef EXPERIMENTAL_DMARC
521 { "dmarc_domain_policy", vtype_stringptr, &dmarc_domain_policy },
522 { "dmarc_status", vtype_stringptr, &dmarc_status },
523 { "dmarc_status_text", vtype_stringptr, &dmarc_status_text },
524 { "dmarc_used_domain", vtype_stringptr, &dmarc_used_domain },
526 { "dnslist_domain", vtype_stringptr, &dnslist_domain },
527 { "dnslist_matched", vtype_stringptr, &dnslist_matched },
528 { "dnslist_text", vtype_stringptr, &dnslist_text },
529 { "dnslist_value", vtype_stringptr, &dnslist_value },
530 { "domain", vtype_stringptr, &deliver_domain },
531 { "domain_data", vtype_stringptr, &deliver_domain_data },
532 #ifndef DISABLE_EVENT
533 { "event_data", vtype_stringptr, &event_data },
535 /*XXX want to use generic vars for as many of these as possible*/
536 { "event_defer_errno", vtype_int, &event_defer_errno },
538 { "event_name", vtype_stringptr, &event_name },
540 { "exim_gid", vtype_gid, &exim_gid },
541 { "exim_path", vtype_stringptr, &exim_path },
542 { "exim_uid", vtype_uid, &exim_uid },
543 { "exim_version", vtype_stringptr, &version_string },
544 { "headers_added", vtype_string_func, &fn_hdrs_added },
545 { "home", vtype_stringptr, &deliver_home },
546 { "host", vtype_stringptr, &deliver_host },
547 { "host_address", vtype_stringptr, &deliver_host_address },
548 { "host_data", vtype_stringptr, &host_data },
549 { "host_lookup_deferred",vtype_int, &host_lookup_deferred },
550 { "host_lookup_failed", vtype_int, &host_lookup_failed },
551 { "host_port", vtype_int, &deliver_host_port },
552 { "initial_cwd", vtype_stringptr, &initial_cwd },
553 { "inode", vtype_ino, &deliver_inode },
554 { "interface_address", vtype_stringptr, &interface_address },
555 { "interface_port", vtype_int, &interface_port },
556 { "item", vtype_stringptr, &iterate_item },
558 { "ldap_dn", vtype_stringptr, &eldap_dn },
560 { "load_average", vtype_load_avg, NULL },
561 { "local_part", vtype_stringptr, &deliver_localpart },
562 { "local_part_data", vtype_stringptr, &deliver_localpart_data },
563 { "local_part_prefix", vtype_stringptr, &deliver_localpart_prefix },
564 { "local_part_suffix", vtype_stringptr, &deliver_localpart_suffix },
565 #ifdef HAVE_LOCAL_SCAN
566 { "local_scan_data", vtype_stringptr, &local_scan_data },
568 { "local_user_gid", vtype_gid, &local_user_gid },
569 { "local_user_uid", vtype_uid, &local_user_uid },
570 { "localhost_number", vtype_int, &host_number },
571 { "log_inodes", vtype_pinodes, (void *)FALSE },
572 { "log_space", vtype_pspace, (void *)FALSE },
573 { "lookup_dnssec_authenticated",vtype_stringptr,&lookup_dnssec_authenticated},
574 { "mailstore_basename", vtype_stringptr, &mailstore_basename },
575 #ifdef WITH_CONTENT_SCAN
576 { "malware_name", vtype_stringptr, &malware_name },
578 { "max_received_linelength", vtype_int, &max_received_linelength },
579 { "message_age", vtype_int, &message_age },
580 { "message_body", vtype_msgbody, &message_body },
581 { "message_body_end", vtype_msgbody_end, &message_body_end },
582 { "message_body_size", vtype_int, &message_body_size },
583 { "message_exim_id", vtype_stringptr, &message_id },
584 { "message_headers", vtype_msgheaders, NULL },
585 { "message_headers_raw", vtype_msgheaders_raw, NULL },
586 { "message_id", vtype_stringptr, &message_id },
587 { "message_linecount", vtype_int, &message_linecount },
588 { "message_size", vtype_int, &message_size },
590 { "message_smtputf8", vtype_bool, &message_smtputf8 },
592 #ifdef WITH_CONTENT_SCAN
593 { "mime_anomaly_level", vtype_int, &mime_anomaly_level },
594 { "mime_anomaly_text", vtype_stringptr, &mime_anomaly_text },
595 { "mime_boundary", vtype_stringptr, &mime_boundary },
596 { "mime_charset", vtype_stringptr, &mime_charset },
597 { "mime_content_description", vtype_stringptr, &mime_content_description },
598 { "mime_content_disposition", vtype_stringptr, &mime_content_disposition },
599 { "mime_content_id", vtype_stringptr, &mime_content_id },
600 { "mime_content_size", vtype_int, &mime_content_size },
601 { "mime_content_transfer_encoding",vtype_stringptr, &mime_content_transfer_encoding },
602 { "mime_content_type", vtype_stringptr, &mime_content_type },
603 { "mime_decoded_filename", vtype_stringptr, &mime_decoded_filename },
604 { "mime_filename", vtype_stringptr, &mime_filename },
605 { "mime_is_coverletter", vtype_int, &mime_is_coverletter },
606 { "mime_is_multipart", vtype_int, &mime_is_multipart },
607 { "mime_is_rfc822", vtype_int, &mime_is_rfc822 },
608 { "mime_part_count", vtype_int, &mime_part_count },
610 { "n0", vtype_filter_int, &filter_n[0] },
611 { "n1", vtype_filter_int, &filter_n[1] },
612 { "n2", vtype_filter_int, &filter_n[2] },
613 { "n3", vtype_filter_int, &filter_n[3] },
614 { "n4", vtype_filter_int, &filter_n[4] },
615 { "n5", vtype_filter_int, &filter_n[5] },
616 { "n6", vtype_filter_int, &filter_n[6] },
617 { "n7", vtype_filter_int, &filter_n[7] },
618 { "n8", vtype_filter_int, &filter_n[8] },
619 { "n9", vtype_filter_int, &filter_n[9] },
620 { "original_domain", vtype_stringptr, &deliver_domain_orig },
621 { "original_local_part", vtype_stringptr, &deliver_localpart_orig },
622 { "originator_gid", vtype_gid, &originator_gid },
623 { "originator_uid", vtype_uid, &originator_uid },
624 { "parent_domain", vtype_stringptr, &deliver_domain_parent },
625 { "parent_local_part", vtype_stringptr, &deliver_localpart_parent },
626 { "pid", vtype_pid, NULL },
628 { "prdr_requested", vtype_bool, &prdr_requested },
630 { "primary_hostname", vtype_stringptr, &primary_hostname },
631 #if defined(SUPPORT_PROXY) || defined(SUPPORT_SOCKS)
632 { "proxy_external_address",vtype_stringptr, &proxy_external_address },
633 { "proxy_external_port", vtype_int, &proxy_external_port },
634 { "proxy_local_address", vtype_stringptr, &proxy_local_address },
635 { "proxy_local_port", vtype_int, &proxy_local_port },
636 { "proxy_session", vtype_bool, &proxy_session },
638 { "prvscheck_address", vtype_stringptr, &prvscheck_address },
639 { "prvscheck_keynum", vtype_stringptr, &prvscheck_keynum },
640 { "prvscheck_result", vtype_stringptr, &prvscheck_result },
641 { "qualify_domain", vtype_stringptr, &qualify_domain_sender },
642 { "qualify_recipient", vtype_stringptr, &qualify_domain_recipient },
643 { "queue_name", vtype_stringptr, &queue_name },
644 { "rcpt_count", vtype_int, &rcpt_count },
645 { "rcpt_defer_count", vtype_int, &rcpt_defer_count },
646 { "rcpt_fail_count", vtype_int, &rcpt_fail_count },
647 { "received_count", vtype_int, &received_count },
648 { "received_for", vtype_stringptr, &received_for },
649 { "received_ip_address", vtype_stringptr, &interface_address },
650 { "received_port", vtype_int, &interface_port },
651 { "received_protocol", vtype_stringptr, &received_protocol },
652 { "received_time", vtype_int, &received_time.tv_sec },
653 { "recipient_data", vtype_stringptr, &recipient_data },
654 { "recipient_verify_failure",vtype_stringptr,&recipient_verify_failure },
655 { "recipients", vtype_string_func, &fn_recipients },
656 { "recipients_count", vtype_int, &recipients_count },
657 #ifdef WITH_CONTENT_SCAN
658 { "regex_match_string", vtype_stringptr, ®ex_match_string },
660 { "reply_address", vtype_reply, NULL },
661 { "return_path", vtype_stringptr, &return_path },
662 { "return_size_limit", vtype_int, &bounce_return_size_limit },
663 { "router_name", vtype_stringptr, &router_name },
664 { "runrc", vtype_int, &runrc },
665 { "self_hostname", vtype_stringptr, &self_hostname },
666 { "sender_address", vtype_stringptr, &sender_address },
667 { "sender_address_data", vtype_stringptr, &sender_address_data },
668 { "sender_address_domain", vtype_domain, &sender_address },
669 { "sender_address_local_part", vtype_localpart, &sender_address },
670 { "sender_data", vtype_stringptr, &sender_data },
671 { "sender_fullhost", vtype_stringptr, &sender_fullhost },
672 { "sender_helo_dnssec", vtype_bool, &sender_helo_dnssec },
673 { "sender_helo_name", vtype_stringptr, &sender_helo_name },
674 { "sender_host_address", vtype_stringptr, &sender_host_address },
675 { "sender_host_authenticated",vtype_stringptr, &sender_host_authenticated },
676 { "sender_host_dnssec", vtype_bool, &sender_host_dnssec },
677 { "sender_host_name", vtype_host_lookup, NULL },
678 { "sender_host_port", vtype_int, &sender_host_port },
679 { "sender_ident", vtype_stringptr, &sender_ident },
680 { "sender_rate", vtype_stringptr, &sender_rate },
681 { "sender_rate_limit", vtype_stringptr, &sender_rate_limit },
682 { "sender_rate_period", vtype_stringptr, &sender_rate_period },
683 { "sender_rcvhost", vtype_stringptr, &sender_rcvhost },
684 { "sender_verify_failure",vtype_stringptr, &sender_verify_failure },
685 { "sending_ip_address", vtype_stringptr, &sending_ip_address },
686 { "sending_port", vtype_int, &sending_port },
687 { "smtp_active_hostname", vtype_stringptr, &smtp_active_hostname },
688 { "smtp_command", vtype_stringptr, &smtp_cmd_buffer },
689 { "smtp_command_argument", vtype_stringptr, &smtp_cmd_argument },
690 { "smtp_command_history", vtype_string_func, &smtp_cmd_hist },
691 { "smtp_count_at_connection_start", vtype_int, &smtp_accept_count },
692 { "smtp_notquit_reason", vtype_stringptr, &smtp_notquit_reason },
693 { "sn0", vtype_filter_int, &filter_sn[0] },
694 { "sn1", vtype_filter_int, &filter_sn[1] },
695 { "sn2", vtype_filter_int, &filter_sn[2] },
696 { "sn3", vtype_filter_int, &filter_sn[3] },
697 { "sn4", vtype_filter_int, &filter_sn[4] },
698 { "sn5", vtype_filter_int, &filter_sn[5] },
699 { "sn6", vtype_filter_int, &filter_sn[6] },
700 { "sn7", vtype_filter_int, &filter_sn[7] },
701 { "sn8", vtype_filter_int, &filter_sn[8] },
702 { "sn9", vtype_filter_int, &filter_sn[9] },
703 #ifdef WITH_CONTENT_SCAN
704 { "spam_action", vtype_stringptr, &spam_action },
705 { "spam_bar", vtype_stringptr, &spam_bar },
706 { "spam_report", vtype_stringptr, &spam_report },
707 { "spam_score", vtype_stringptr, &spam_score },
708 { "spam_score_int", vtype_stringptr, &spam_score_int },
711 { "spf_guess", vtype_stringptr, &spf_guess },
712 { "spf_header_comment", vtype_stringptr, &spf_header_comment },
713 { "spf_received", vtype_stringptr, &spf_received },
714 { "spf_result", vtype_stringptr, &spf_result },
715 { "spf_result_guessed", vtype_bool, &spf_result_guessed },
716 { "spf_smtp_comment", vtype_stringptr, &spf_smtp_comment },
718 { "spool_directory", vtype_stringptr, &spool_directory },
719 { "spool_inodes", vtype_pinodes, (void *)TRUE },
720 { "spool_space", vtype_pspace, (void *)TRUE },
721 #ifdef EXPERIMENTAL_SRS
722 { "srs_db_address", vtype_stringptr, &srs_db_address },
723 { "srs_db_key", vtype_stringptr, &srs_db_key },
724 { "srs_orig_recipient", vtype_stringptr, &srs_orig_recipient },
725 { "srs_orig_sender", vtype_stringptr, &srs_orig_sender },
726 { "srs_recipient", vtype_stringptr, &srs_recipient },
727 { "srs_status", vtype_stringptr, &srs_status },
729 { "thisaddress", vtype_stringptr, &filter_thisaddress },
731 /* The non-(in,out) variables are now deprecated */
732 { "tls_bits", vtype_int, &tls_in.bits },
733 { "tls_certificate_verified", vtype_int, &tls_in.certificate_verified },
734 { "tls_cipher", vtype_stringptr, &tls_in.cipher },
736 { "tls_in_bits", vtype_int, &tls_in.bits },
737 { "tls_in_certificate_verified", vtype_int, &tls_in.certificate_verified },
738 { "tls_in_cipher", vtype_stringptr, &tls_in.cipher },
739 { "tls_in_ocsp", vtype_int, &tls_in.ocsp },
740 { "tls_in_ourcert", vtype_cert, &tls_in.ourcert },
741 { "tls_in_peercert", vtype_cert, &tls_in.peercert },
742 { "tls_in_peerdn", vtype_stringptr, &tls_in.peerdn },
743 #if defined(SUPPORT_TLS)
744 { "tls_in_sni", vtype_stringptr, &tls_in.sni },
746 { "tls_out_bits", vtype_int, &tls_out.bits },
747 { "tls_out_certificate_verified", vtype_int,&tls_out.certificate_verified },
748 { "tls_out_cipher", vtype_stringptr, &tls_out.cipher },
750 { "tls_out_dane", vtype_bool, &tls_out.dane_verified },
752 { "tls_out_ocsp", vtype_int, &tls_out.ocsp },
753 { "tls_out_ourcert", vtype_cert, &tls_out.ourcert },
754 { "tls_out_peercert", vtype_cert, &tls_out.peercert },
755 { "tls_out_peerdn", vtype_stringptr, &tls_out.peerdn },
756 #if defined(SUPPORT_TLS)
757 { "tls_out_sni", vtype_stringptr, &tls_out.sni },
760 { "tls_out_tlsa_usage", vtype_int, &tls_out.tlsa_usage },
763 { "tls_peerdn", vtype_stringptr, &tls_in.peerdn }, /* mind the alphabetical order! */
764 #if defined(SUPPORT_TLS)
765 { "tls_sni", vtype_stringptr, &tls_in.sni }, /* mind the alphabetical order! */
768 { "tod_bsdinbox", vtype_todbsdin, NULL },
769 { "tod_epoch", vtype_tode, NULL },
770 { "tod_epoch_l", vtype_todel, NULL },
771 { "tod_full", vtype_todf, NULL },
772 { "tod_log", vtype_todl, NULL },
773 { "tod_logfile", vtype_todlf, NULL },
774 { "tod_zone", vtype_todzone, NULL },
775 { "tod_zulu", vtype_todzulu, NULL },
776 { "transport_name", vtype_stringptr, &transport_name },
777 { "value", vtype_stringptr, &lookup_value },
778 { "verify_mode", vtype_stringptr, &verify_mode },
779 { "version_number", vtype_stringptr, &version_string },
780 { "warn_message_delay", vtype_stringptr, &warnmsg_delay },
781 { "warn_message_recipient",vtype_stringptr, &warnmsg_recipients },
782 { "warn_message_recipients",vtype_stringptr,&warnmsg_recipients },
783 { "warnmsg_delay", vtype_stringptr, &warnmsg_delay },
784 { "warnmsg_recipient", vtype_stringptr, &warnmsg_recipients },
785 { "warnmsg_recipients", vtype_stringptr, &warnmsg_recipients }
788 static int var_table_size = nelem(var_table);
789 static uschar var_buffer[256];
790 static BOOL malformed_header;
792 /* For textual hashes */
794 static const char *hashcodes = "abcdefghijklmnopqrtsuvwxyz"
795 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
798 enum { HMAC_MD5, HMAC_SHA1 };
800 /* For numeric hashes */
802 static unsigned int prime[] = {
803 2, 3, 5, 7, 11, 13, 17, 19, 23, 29,
804 31, 37, 41, 43, 47, 53, 59, 61, 67, 71,
805 73, 79, 83, 89, 97, 101, 103, 107, 109, 113};
807 /* For printing modes in symbolic form */
809 static uschar *mtable_normal[] =
810 { US"---", US"--x", US"-w-", US"-wx", US"r--", US"r-x", US"rw-", US"rwx" };
812 static uschar *mtable_setid[] =
813 { US"--S", US"--s", US"-wS", US"-ws", US"r-S", US"r-s", US"rwS", US"rws" };
815 static uschar *mtable_sticky[] =
816 { US"--T", US"--t", US"-wT", US"-wt", US"r-T", US"r-t", US"rwT", US"rwt" };
820 /*************************************************
821 * Tables for UTF-8 support *
822 *************************************************/
824 /* Table of the number of extra characters, indexed by the first character
825 masked with 0x3f. The highest number for a valid UTF-8 character is in fact
828 static uschar utf8_table1[] = {
829 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
830 1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
831 2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,2,
832 3,3,3,3,3,3,3,3,4,4,4,4,5,5,5,5 };
834 /* These are the masks for the data bits in the first byte of a character,
835 indexed by the number of additional bytes. */
837 static int utf8_table2[] = { 0xff, 0x1f, 0x0f, 0x07, 0x03, 0x01};
839 /* Get the next UTF-8 character, advancing the pointer. */
841 #define GETUTF8INC(c, ptr) \
843 if ((c & 0xc0) == 0xc0) \
845 int a = utf8_table1[c & 0x3f]; /* Number of additional bytes */ \
847 c = (c & utf8_table2[a]) << s; \
851 c |= (*ptr++ & 0x3f) << s; \
857 static uschar * base32_chars = US"abcdefghijklmnopqrstuvwxyz234567";
859 /*************************************************
860 * Binary chop search on a table *
861 *************************************************/
863 /* This is used for matching expansion items and operators.
866 name the name that is being sought
867 table the table to search
868 table_size the number of items in the table
870 Returns: the offset in the table, or -1
874 chop_match(uschar *name, uschar **table, int table_size)
876 uschar **bot = table;
877 uschar **top = table + table_size;
881 uschar **mid = bot + (top - bot)/2;
882 int c = Ustrcmp(name, *mid);
883 if (c == 0) return mid - table;
884 if (c > 0) bot = mid + 1; else top = mid;
892 /*************************************************
893 * Check a condition string *
894 *************************************************/
896 /* This function is called to expand a string, and test the result for a "true"
897 or "false" value. Failure of the expansion yields FALSE; logged unless it was a
898 forced fail or lookup defer.
900 We used to release all store used, but this is not not safe due
901 to ${dlfunc } and ${acl }. In any case expand_string_internal()
902 is reasonably careful to release what it can.
904 The actual false-value tests should be replicated for ECOND_BOOL_LAX.
907 condition the condition string
908 m1 text to be incorporated in panic error
911 Returns: TRUE if condition is met, FALSE if not
915 expand_check_condition(uschar *condition, uschar *m1, uschar *m2)
918 uschar *ss = expand_string(condition);
921 if (!expand_string_forcedfail && !search_find_defer)
922 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand condition \"%s\" "
923 "for %s %s: %s", condition, m1, m2, expand_string_message);
926 rc = ss[0] != 0 && Ustrcmp(ss, "0") != 0 && strcmpic(ss, US"no") != 0 &&
927 strcmpic(ss, US"false") != 0;
934 /*************************************************
935 * Pseudo-random number generation *
936 *************************************************/
938 /* Pseudo-random number generation. The result is not "expected" to be
939 cryptographically strong but not so weak that someone will shoot themselves
940 in the foot using it as a nonce in some email header scheme or whatever
941 weirdness they'll twist this into. The result should ideally handle fork().
943 However, if we're stuck unable to provide this, then we'll fall back to
944 appallingly bad randomness.
946 If SUPPORT_TLS is defined then this will not be used except as an emergency
951 Returns a random number in range [0, max-1]
955 # define vaguely_random_number vaguely_random_number_fallback
958 vaguely_random_number(int max)
961 # undef vaguely_random_number
963 static pid_t pid = 0;
965 #if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
975 #ifdef HAVE_ARC4RANDOM
976 /* cryptographically strong randomness, common on *BSD platforms, not
977 so much elsewhere. Alas. */
978 #ifndef NOT_HAVE_ARC4RANDOM_STIR
981 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
982 #ifdef HAVE_SRANDOMDEV
983 /* uses random(4) for seeding */
986 gettimeofday(&tv, NULL);
987 srandom(tv.tv_sec | tv.tv_usec | getpid());
990 /* Poor randomness and no seeding here */
997 #ifdef HAVE_ARC4RANDOM
998 return arc4random() % max;
999 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
1000 return random() % max;
1002 /* This one returns a 16-bit number, definitely not crypto-strong */
1003 return random_number(max);
1010 /*************************************************
1011 * Pick out a name from a string *
1012 *************************************************/
1014 /* If the name is too long, it is silently truncated.
1017 name points to a buffer into which to put the name
1018 max is the length of the buffer
1019 s points to the first alphabetic character of the name
1020 extras chars other than alphanumerics to permit
1022 Returns: pointer to the first character after the name
1024 Note: The test for *s != 0 in the while loop is necessary because
1025 Ustrchr() yields non-NULL if the character is zero (which is not something
1028 static const uschar *
1029 read_name(uschar *name, int max, const uschar *s, uschar *extras)
1032 while (*s != 0 && (isalnum(*s) || Ustrchr(extras, *s) != NULL))
1034 if (ptr < max-1) name[ptr++] = *s;
1043 /*************************************************
1044 * Pick out the rest of a header name *
1045 *************************************************/
1047 /* A variable name starting $header_ (or just $h_ for those who like
1048 abbreviations) might not be the complete header name because headers can
1049 contain any printing characters in their names, except ':'. This function is
1050 called to read the rest of the name, chop h[eader]_ off the front, and put ':'
1051 on the end, if the name was terminated by white space.
1054 name points to a buffer in which the name read so far exists
1055 max is the length of the buffer
1056 s points to the first character after the name so far, i.e. the
1057 first non-alphameric character after $header_xxxxx
1059 Returns: a pointer to the first character after the header name
1062 static const uschar *
1063 read_header_name(uschar *name, int max, const uschar *s)
1065 int prelen = Ustrchr(name, '_') - name + 1;
1066 int ptr = Ustrlen(name) - prelen;
1067 if (ptr > 0) memmove(name, name+prelen, ptr);
1068 while (mac_isgraph(*s) && *s != ':')
1070 if (ptr < max-1) name[ptr++] = *s;
1081 /*************************************************
1082 * Pick out a number from a string *
1083 *************************************************/
1086 n points to an integer into which to put the number
1087 s points to the first digit of the number
1089 Returns: a pointer to the character after the last digit
1091 /*XXX consider expanding to int_eximarith_t. But the test for
1092 "overbig numbers" in 0002 still needs to overflow it. */
1095 read_number(int *n, uschar *s)
1098 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1102 static const uschar *
1103 read_cnumber(int *n, const uschar *s)
1106 while (isdigit(*s)) *n = *n * 10 + (*s++ - '0');
1112 /*************************************************
1113 * Extract keyed subfield from a string *
1114 *************************************************/
1116 /* The yield is in dynamic store; NULL means that the key was not found.
1119 key points to the name of the key
1120 s points to the string from which to extract the subfield
1122 Returns: NULL if the subfield was not found, or
1123 a pointer to the subfield's data
1127 expand_getkeyed(uschar *key, const uschar *s)
1129 int length = Ustrlen(key);
1130 while (isspace(*s)) s++;
1132 /* Loop to search for the key */
1138 const uschar *dkey = s;
1140 while (*s != 0 && *s != '=' && !isspace(*s)) s++;
1141 dkeylength = s - dkey;
1142 while (isspace(*s)) s++;
1143 if (*s == '=') while (isspace((*(++s))));
1145 data = string_dequote(&s);
1146 if (length == dkeylength && strncmpic(key, dkey, length) == 0)
1149 while (isspace(*s)) s++;
1158 find_var_ent(uschar * name)
1161 int last = var_table_size;
1163 while (last > first)
1165 int middle = (first + last)/2;
1166 int c = Ustrcmp(name, var_table[middle].name);
1168 if (c > 0) { first = middle + 1; continue; }
1169 if (c < 0) { last = middle; continue; }
1170 return &var_table[middle];
1175 /*************************************************
1176 * Extract numbered subfield from string *
1177 *************************************************/
1179 /* Extracts a numbered field from a string that is divided by tokens - for
1180 example a line from /etc/passwd is divided by colon characters. First field is
1181 numbered one. Negative arguments count from the right. Zero returns the whole
1182 string. Returns NULL if there are insufficient tokens in the string
1185 Modifies final argument - this is a dynamically generated string, so that's OK.
1188 field number of field to be extracted,
1189 first field = 1, whole string = 0, last field = -1
1190 separators characters that are used to break string into tokens
1191 s points to the string from which to extract the subfield
1193 Returns: NULL if the field was not found,
1194 a pointer to the field's data inside s (modified to add 0)
1198 expand_gettokened (int field, uschar *separators, uschar *s)
1203 uschar *fieldtext = NULL;
1205 if (field == 0) return s;
1207 /* Break the line up into fields in place; for field > 0 we stop when we have
1208 done the number of fields we want. For field < 0 we continue till the end of
1209 the string, counting the number of fields. */
1211 count = (field > 0)? field : INT_MAX;
1217 /* Previous field was the last one in the string. For a positive field
1218 number, this means there are not enough fields. For a negative field number,
1219 check that there are enough, and scan back to find the one that is wanted. */
1223 if (field > 0 || (-field) > (INT_MAX - count - 1)) return NULL;
1224 if ((-field) == (INT_MAX - count - 1)) return s;
1228 while (ss[-1] != 0) ss--;
1234 /* Previous field was not last in the string; save its start and put a
1238 len = Ustrcspn(ss, separators);
1249 expand_getlistele(int field, const uschar * list)
1251 const uschar * tlist= list;
1257 for(field++; string_nextinlist(&tlist, &sep, &dummy, 1); ) field++;
1260 if(field==0) return NULL;
1261 while(--field>0 && (string_nextinlist(&list, &sep, &dummy, 1))) ;
1262 return string_nextinlist(&list, &sep, NULL, 0);
1266 /* Certificate fields, by name. Worry about by-OID later */
1267 /* Names are chosen to not have common prefixes */
1274 uschar * (*getfn)(void * cert, uschar * mod);
1276 static certfield certfields[] =
1277 { /* linear search; no special order */
1278 { US"version", 7, &tls_cert_version },
1279 { US"serial_number", 13, &tls_cert_serial_number },
1280 { US"subject", 7, &tls_cert_subject },
1281 { US"notbefore", 9, &tls_cert_not_before },
1282 { US"notafter", 8, &tls_cert_not_after },
1283 { US"issuer", 6, &tls_cert_issuer },
1284 { US"signature", 9, &tls_cert_signature },
1285 { US"sig_algorithm", 13, &tls_cert_signature_algorithm },
1286 { US"subj_altname", 12, &tls_cert_subject_altname },
1287 { US"ocsp_uri", 8, &tls_cert_ocsp_uri },
1288 { US"crl_uri", 7, &tls_cert_crl_uri },
1292 expand_getcertele(uschar * field, uschar * certvar)
1297 if (!(vp = find_var_ent(certvar)))
1299 expand_string_message =
1300 string_sprintf("no variable named \"%s\"", certvar);
1301 return NULL; /* Unknown variable name */
1303 /* NB this stops us passing certs around in variable. Might
1304 want to do that in future */
1305 if (vp->type != vtype_cert)
1307 expand_string_message =
1308 string_sprintf("\"%s\" is not a certificate", certvar);
1309 return NULL; /* Unknown variable name */
1311 if (!*(void **)vp->value)
1314 if (*field >= '0' && *field <= '9')
1315 return tls_cert_ext_by_oid(*(void **)vp->value, field, 0);
1317 for(cp = certfields;
1318 cp < certfields + nelem(certfields);
1320 if (Ustrncmp(cp->name, field, cp->namelen) == 0)
1322 uschar * modifier = *(field += cp->namelen) == ','
1324 return (*cp->getfn)( *(void **)vp->value, modifier );
1327 expand_string_message =
1328 string_sprintf("bad field selector \"%s\" for certextract", field);
1331 #endif /*SUPPORT_TLS*/
1333 /*************************************************
1334 * Extract a substring from a string *
1335 *************************************************/
1337 /* Perform the ${substr or ${length expansion operations.
1340 subject the input string
1341 value1 the offset from the start of the input string to the start of
1342 the output string; if negative, count from the right.
1343 value2 the length of the output string, or negative (-1) for unset
1344 if value1 is positive, unset means "all after"
1345 if value1 is negative, unset means "all before"
1346 len set to the length of the returned string
1348 Returns: pointer to the output string, or NULL if there is an error
1352 extract_substr(uschar *subject, int value1, int value2, int *len)
1354 int sublen = Ustrlen(subject);
1356 if (value1 < 0) /* count from right */
1360 /* If the position is before the start, skip to the start, and adjust the
1361 length. If the length ends up negative, the substring is null because nothing
1362 can precede. This falls out naturally when the length is unset, meaning "all
1368 if (value2 < 0) value2 = 0;
1372 /* Otherwise an unset length => characters before value1 */
1374 else if (value2 < 0)
1381 /* For a non-negative offset, if the starting position is past the end of the
1382 string, the result will be the null string. Otherwise, an unset length means
1383 "rest"; just set it to the maximum - it will be cut down below if necessary. */
1387 if (value1 > sublen)
1392 else if (value2 < 0) value2 = sublen;
1395 /* Cut the length down to the maximum possible for the offset value, and get
1396 the required characters. */
1398 if (value1 + value2 > sublen) value2 = sublen - value1;
1400 return subject + value1;
1406 /*************************************************
1407 * Old-style hash of a string *
1408 *************************************************/
1410 /* Perform the ${hash expansion operation.
1413 subject the input string (an expanded substring)
1414 value1 the length of the output string; if greater or equal to the
1415 length of the input string, the input string is returned
1416 value2 the number of hash characters to use, or 26 if negative
1417 len set to the length of the returned string
1419 Returns: pointer to the output string, or NULL if there is an error
1423 compute_hash(uschar *subject, int value1, int value2, int *len)
1425 int sublen = Ustrlen(subject);
1427 if (value2 < 0) value2 = 26;
1428 else if (value2 > Ustrlen(hashcodes))
1430 expand_string_message =
1431 string_sprintf("hash count \"%d\" too big", value2);
1435 /* Calculate the hash text. We know it is shorter than the original string, so
1436 can safely place it in subject[] (we know that subject is always itself an
1437 expanded substring). */
1439 if (value1 < sublen)
1444 while ((c = (subject[j])) != 0)
1446 int shift = (c + j++) & 7;
1447 subject[i] ^= (c << shift) | (c >> (8-shift));
1448 if (++i >= value1) i = 0;
1450 for (i = 0; i < value1; i++)
1451 subject[i] = hashcodes[(subject[i]) % value2];
1453 else value1 = sublen;
1462 /*************************************************
1463 * Numeric hash of a string *
1464 *************************************************/
1466 /* Perform the ${nhash expansion operation. The first characters of the
1467 string are treated as most important, and get the highest prime numbers.
1470 subject the input string
1471 value1 the maximum value of the first part of the result
1472 value2 the maximum value of the second part of the result,
1473 or negative to produce only a one-part result
1474 len set to the length of the returned string
1476 Returns: pointer to the output string, or NULL if there is an error.
1480 compute_nhash (uschar *subject, int value1, int value2, int *len)
1482 uschar *s = subject;
1484 unsigned long int total = 0; /* no overflow */
1488 if (i == 0) i = nelem(prime) - 1;
1489 total += prime[i--] * (unsigned int)(*s++);
1492 /* If value2 is unset, just compute one number */
1495 s = string_sprintf("%lu", total % value1);
1497 /* Otherwise do a div/mod hash */
1501 total = total % (value1 * value2);
1502 s = string_sprintf("%lu/%lu", total/value2, total % value2);
1513 /*************************************************
1514 * Find the value of a header or headers *
1515 *************************************************/
1517 /* Multiple instances of the same header get concatenated, and this function
1518 can also return a concatenation of all the header lines. When concatenating
1519 specific headers that contain lists of addresses, a comma is inserted between
1520 them. Otherwise we use a straight concatenation. Because some messages can have
1521 pathologically large number of lines, there is a limit on the length that is
1522 returned. Also, to avoid massive store use which would result from using
1523 string_cat() as it copies and extends strings, we do a preliminary pass to find
1524 out exactly how much store will be needed. On "normal" messages this will be
1528 name the name of the header, without the leading $header_ or $h_,
1529 or NULL if a concatenation of all headers is required
1530 exists_only TRUE if called from a def: test; don't need to build a string;
1531 just return a string that is not "" and not "0" if the header
1533 newsize return the size of memory block that was obtained; may be NULL
1534 if exists_only is TRUE
1535 want_raw TRUE if called for $rh_ or $rheader_ variables; no processing,
1536 other than concatenating, will be done on the header. Also used
1537 for $message_headers_raw.
1538 charset name of charset to translate MIME words to; used only if
1539 want_raw is false; if NULL, no translation is done (this is
1540 used for $bh_ and $bheader_)
1542 Returns: NULL if the header does not exist, else a pointer to a new
1547 find_header(uschar *name, BOOL exists_only, int *newsize, BOOL want_raw,
1550 BOOL found = name == NULL;
1552 int len = found? 0 : Ustrlen(name);
1554 uschar *yield = NULL;
1557 /* Loop for two passes - saves code repetition */
1559 for (i = 0; i < 2; i++)
1564 for (h = header_list; size < header_insert_maxlen && h; h = h->next)
1565 if (h->type != htype_old && h->text) /* NULL => Received: placeholder */
1566 if (!name || (len <= h->slen && strncmpic(name, h->text, len) == 0))
1571 if (exists_only) return US"1"; /* don't need actual string */
1573 t = h->text + len; /* text to insert */
1574 if (!want_raw) /* unless wanted raw, */
1575 while (isspace(*t)) t++; /* remove leading white space */
1576 ilen = h->slen - (t - h->text); /* length to insert */
1578 /* Unless wanted raw, remove trailing whitespace, including the
1582 while (ilen > 0 && isspace(t[ilen-1])) ilen--;
1584 /* Set comma = 1 if handling a single header and it's one of those
1585 that contains an address list, except when asked for raw headers. Only
1586 need to do this once. */
1588 if (!want_raw && name && comma == 0 &&
1589 Ustrchr("BCFRST", h->type) != NULL)
1592 /* First pass - compute total store needed; second pass - compute
1593 total store used, including this header. */
1595 size += ilen + comma + 1; /* +1 for the newline */
1597 /* Second pass - concatenate the data, up to a maximum. Note that
1598 the loop stops when size hits the limit. */
1602 if (size > header_insert_maxlen)
1604 ilen -= size - header_insert_maxlen - 1;
1607 Ustrncpy(ptr, t, ilen);
1610 /* For a non-raw header, put in the comma if needed, then add
1611 back the newline we removed above, provided there was some text in
1614 if (!want_raw && ilen > 0)
1616 if (comma != 0) *ptr++ = ',';
1622 /* At end of first pass, return NULL if no header found. Then truncate size
1623 if necessary, and get the buffer to hold the data, returning the buffer size.
1628 if (!found) return NULL;
1629 if (size > header_insert_maxlen) size = header_insert_maxlen;
1630 *newsize = size + 1;
1631 ptr = yield = store_get(*newsize);
1635 /* That's all we do for raw header expansion. */
1640 /* Otherwise, remove a final newline and a redundant added comma. Then we do
1641 RFC 2047 decoding, translating the charset if requested. The rfc2047_decode2()
1642 function can return an error with decoded data if the charset translation
1643 fails. If decoding fails, it returns NULL. */
1647 uschar *decoded, *error;
1648 if (ptr > yield && ptr[-1] == '\n') ptr--;
1649 if (ptr > yield && comma != 0 && ptr[-1] == ',') ptr--;
1651 decoded = rfc2047_decode2(yield, check_rfc2047_length, charset, '?', NULL,
1655 DEBUG(D_any) debug_printf("*** error in RFC 2047 decoding: %s\n"
1656 " input was: %s\n", error, yield);
1658 if (decoded != NULL) yield = decoded;
1667 /* Append a "local" element to an Autherntication-Results: header
1668 if this was a non-smtp message.
1672 authres_local(gstring * g, const uschar * sysname)
1674 if (!authentication_local)
1676 g = string_append(g, 3, US";\n\tlocal=pass (non-smtp, ", sysname, US")");
1677 if (authenticated_id) g = string_append(g, 2, " u=", authenticated_id);
1682 /* Append an "iprev" element to an Autherntication-Results: header
1683 if we have attempted to get the calling host's name.
1687 authres_iprev(gstring * g)
1689 if (sender_host_name)
1690 return string_append(g, 3, US";\n\tiprev=pass (", sender_host_name, US")");
1691 if (host_lookup_deferred)
1692 return string_catn(g, US";\n\tiprev=temperror", 19);
1693 if (host_lookup_failed)
1694 return string_catn(g, US";\n\tiprev=fail", 13);
1700 /*************************************************
1701 * Return list of recipients *
1702 *************************************************/
1703 /* A recipients list is available only during system message filtering,
1704 during ACL processing after DATA, and while expanding pipe commands
1705 generated from a system filter, but not elsewhere. */
1713 if (!enable_dollar_recipients) return NULL;
1715 for (i = 0; i < recipients_count; i++)
1717 /*XXX variant of list_appendele? */
1718 if (i != 0) g = string_catn(g, US", ", 2);
1719 g = string_cat(g, recipients_list[i].address);
1721 return string_from_gstring(g);
1725 /*************************************************
1726 * Find value of a variable *
1727 *************************************************/
1729 /* The table of variables is kept in alphabetic order, so we can search it
1730 using a binary chop. The "choplen" variable is nothing to do with the binary
1734 name the name of the variable being sought
1735 exists_only TRUE if this is a def: test; passed on to find_header()
1736 skipping TRUE => skip any processing evaluation; this is not the same as
1737 exists_only because def: may test for values that are first
1739 newsize pointer to an int which is initially zero; if the answer is in
1740 a new memory buffer, *newsize is set to its size
1742 Returns: NULL if the variable does not exist, or
1743 a pointer to the variable's contents, or
1744 something non-NULL if exists_only is TRUE
1748 find_variable(uschar *name, BOOL exists_only, BOOL skipping, int *newsize)
1755 /* Handle ACL variables, whose names are of the form acl_cxxx or acl_mxxx.
1756 Originally, xxx had to be a number in the range 0-9 (later 0-19), but from
1757 release 4.64 onwards arbitrary names are permitted, as long as the first 5
1758 characters are acl_c or acl_m and the sixth is either a digit or an underscore
1759 (this gave backwards compatibility at the changeover). There may be built-in
1760 variables whose names start acl_ but they should never start in this way. This
1761 slightly messy specification is a consequence of the history, needless to say.
1763 If an ACL variable does not exist, treat it as empty, unless strict_acl_vars is
1764 set, in which case give an error. */
1766 if ((Ustrncmp(name, "acl_c", 5) == 0 || Ustrncmp(name, "acl_m", 5) == 0) &&
1770 tree_search((name[4] == 'c')? acl_var_c : acl_var_m, name + 4);
1771 return node ? node->data.ptr : strict_acl_vars ? NULL : US"";
1774 /* Handle $auth<n> variables. */
1776 if (Ustrncmp(name, "auth", 4) == 0)
1779 int n = Ustrtoul(name + 4, &endptr, 10);
1780 if (*endptr == 0 && n != 0 && n <= AUTH_VARS)
1781 return !auth_vars[n-1] ? US"" : auth_vars[n-1];
1783 else if (Ustrncmp(name, "regex", 5) == 0)
1786 int n = Ustrtoul(name + 5, &endptr, 10);
1787 if (*endptr == 0 && n != 0 && n <= REGEX_VARS)
1788 return !regex_vars[n-1] ? US"" : regex_vars[n-1];
1791 /* For all other variables, search the table */
1793 if (!(vp = find_var_ent(name)))
1794 return NULL; /* Unknown variable name */
1796 /* Found an existing variable. If in skipping state, the value isn't needed,
1797 and we want to avoid processing (such as looking up the host name). */
1805 case vtype_filter_int:
1806 if (!filter_running) return NULL;
1810 sprintf(CS var_buffer, "%d", *(int *)(val)); /* Integer */
1814 sprintf(CS var_buffer, "%ld", (long int)(*(ino_t *)(val))); /* Inode */
1818 sprintf(CS var_buffer, "%ld", (long int)(*(gid_t *)(val))); /* gid */
1822 sprintf(CS var_buffer, "%ld", (long int)(*(uid_t *)(val))); /* uid */
1826 sprintf(CS var_buffer, "%s", *(BOOL *)(val) ? "yes" : "no"); /* bool */
1829 case vtype_stringptr: /* Pointer to string */
1830 return (s = *((uschar **)(val))) ? s : US"";
1833 sprintf(CS var_buffer, "%d", (int)getpid()); /* pid */
1836 case vtype_load_avg:
1837 sprintf(CS var_buffer, "%d", OS_GETLOADAVG()); /* load_average */
1840 case vtype_host_lookup: /* Lookup if not done so */
1841 if ( !sender_host_name && sender_host_address
1842 && !host_lookup_failed && host_name_lookup() == OK)
1843 host_build_sender_fullhost();
1844 return sender_host_name ? sender_host_name : US"";
1846 case vtype_localpart: /* Get local part from address */
1847 s = *((uschar **)(val));
1848 if (s == NULL) return US"";
1849 domain = Ustrrchr(s, '@');
1850 if (domain == NULL) return s;
1851 if (domain - s > sizeof(var_buffer) - 1)
1852 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "local part longer than " SIZE_T_FMT
1853 " in string expansion", sizeof(var_buffer));
1854 Ustrncpy(var_buffer, s, domain - s);
1855 var_buffer[domain - s] = 0;
1858 case vtype_domain: /* Get domain from address */
1859 s = *((uschar **)(val));
1860 if (s == NULL) return US"";
1861 domain = Ustrrchr(s, '@');
1862 return (domain == NULL)? US"" : domain + 1;
1864 case vtype_msgheaders:
1865 return find_header(NULL, exists_only, newsize, FALSE, NULL);
1867 case vtype_msgheaders_raw:
1868 return find_header(NULL, exists_only, newsize, TRUE, NULL);
1870 case vtype_msgbody: /* Pointer to msgbody string */
1871 case vtype_msgbody_end: /* Ditto, the end of the msg */
1872 ss = (uschar **)(val);
1873 if (!*ss && deliver_datafile >= 0) /* Read body when needed */
1876 off_t start_offset = SPOOL_DATA_START_OFFSET;
1877 int len = message_body_visible;
1878 if (len > message_size) len = message_size;
1879 *ss = body = store_malloc(len+1);
1881 if (vp->type == vtype_msgbody_end)
1883 struct stat statbuf;
1884 if (fstat(deliver_datafile, &statbuf) == 0)
1886 start_offset = statbuf.st_size - len;
1887 if (start_offset < SPOOL_DATA_START_OFFSET)
1888 start_offset = SPOOL_DATA_START_OFFSET;
1891 if (lseek(deliver_datafile, start_offset, SEEK_SET) < 0)
1892 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "deliver_datafile lseek: %s",
1894 len = read(deliver_datafile, body, len);
1898 if (message_body_newlines) /* Separate loops for efficiency */
1900 { if (body[--len] == 0) body[len] = ' '; }
1903 { if (body[--len] == '\n' || body[len] == 0) body[len] = ' '; }
1906 return *ss ? *ss : US"";
1908 case vtype_todbsdin: /* BSD inbox time of day */
1909 return tod_stamp(tod_bsdin);
1911 case vtype_tode: /* Unix epoch time of day */
1912 return tod_stamp(tod_epoch);
1914 case vtype_todel: /* Unix epoch/usec time of day */
1915 return tod_stamp(tod_epoch_l);
1917 case vtype_todf: /* Full time of day */
1918 return tod_stamp(tod_full);
1920 case vtype_todl: /* Log format time of day */
1921 return tod_stamp(tod_log_bare); /* (without timezone) */
1923 case vtype_todzone: /* Time zone offset only */
1924 return tod_stamp(tod_zone);
1926 case vtype_todzulu: /* Zulu time */
1927 return tod_stamp(tod_zulu);
1929 case vtype_todlf: /* Log file datestamp tod */
1930 return tod_stamp(tod_log_datestamp_daily);
1932 case vtype_reply: /* Get reply address */
1933 s = find_header(US"reply-to:", exists_only, newsize, TRUE,
1935 if (s != NULL) while (isspace(*s)) s++;
1936 if (s == NULL || *s == 0)
1938 *newsize = 0; /* For the *s==0 case */
1939 s = find_header(US"from:", exists_only, newsize, TRUE, headers_charset);
1944 while (isspace(*s)) s++;
1945 for (t = s; *t != 0; t++) if (*t == '\n') *t = ' ';
1946 while (t > s && isspace(t[-1])) t--;
1949 return (s == NULL)? US"" : s;
1951 case vtype_string_func:
1953 uschar * (*fn)() = val;
1960 sprintf(CS var_buffer, "%d",
1961 receive_statvfs(val == (void *)TRUE, &inodes));
1968 (void) receive_statvfs(val == (void *)TRUE, &inodes);
1969 sprintf(CS var_buffer, "%d", inodes);
1974 return *(void **)val ? US"<cert>" : US"";
1976 #ifndef DISABLE_DKIM
1978 return dkim_exim_expand_query((int)(long)val);
1983 return NULL; /* Unknown variable. Silences static checkers. */
1990 modify_variable(uschar *name, void * value)
1993 if ((vp = find_var_ent(name))) vp->value = value;
1994 return; /* Unknown variable name, fail silently */
2002 /*************************************************
2003 * Read and expand substrings *
2004 *************************************************/
2006 /* This function is called to read and expand argument substrings for various
2007 expansion items. Some have a minimum requirement that is less than the maximum;
2008 in these cases, the first non-present one is set to NULL.
2011 sub points to vector of pointers to set
2012 n maximum number of substrings
2014 sptr points to current string pointer
2015 skipping the skipping flag
2016 check_end if TRUE, check for final '}'
2017 name name of item, for error message
2018 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
2021 Returns: 0 OK; string pointer updated
2022 1 curly bracketing error (too few arguments)
2023 2 too many arguments (only if check_end is set); message set
2024 3 other error (expansion failure)
2028 read_subs(uschar **sub, int n, int m, const uschar **sptr, BOOL skipping,
2029 BOOL check_end, uschar *name, BOOL *resetok)
2032 const uschar *s = *sptr;
2034 while (isspace(*s)) s++;
2035 for (i = 0; i < n; i++)
2041 expand_string_message = string_sprintf("Not enough arguments for '%s' "
2042 "(min is %d)", name, m);
2048 if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, resetok)))
2050 if (*s++ != '}') return 1;
2051 while (isspace(*s)) s++;
2053 if (check_end && *s++ != '}')
2057 expand_string_message = string_sprintf("Too many arguments for '%s' "
2058 "(max is %d)", name, n);
2061 expand_string_message = string_sprintf("missing '}' after '%s'", name);
2072 /*************************************************
2073 * Elaborate message for bad variable *
2074 *************************************************/
2076 /* For the "unknown variable" message, take a look at the variable's name, and
2077 give additional information about possible ACL variables. The extra information
2078 is added on to expand_string_message.
2080 Argument: the name of the variable
2085 check_variable_error_message(uschar *name)
2087 if (Ustrncmp(name, "acl_", 4) == 0)
2088 expand_string_message = string_sprintf("%s (%s)", expand_string_message,
2089 (name[4] == 'c' || name[4] == 'm')?
2091 US"6th character of a user-defined ACL variable must be a digit or underscore" :
2092 US"strict_acl_vars is set" /* Syntax is OK, it has to be this */
2094 US"user-defined ACL variables must start acl_c or acl_m");
2100 Load args from sub array to globals, and call acl_check().
2101 Sub array will be corrupted on return.
2103 Returns: OK access is granted by an ACCEPT verb
2104 DISCARD access is (apparently) granted by a DISCARD verb
2105 FAIL access is denied
2106 FAIL_DROP access is denied; drop the connection
2107 DEFER can't tell at the moment
2111 eval_acl(uschar ** sub, int nsub, uschar ** user_msgp)
2114 int sav_narg = acl_narg;
2116 uschar * dummy_logmsg;
2117 extern int acl_where;
2119 if(--nsub > nelem(acl_arg)) nsub = nelem(acl_arg);
2120 for (i = 0; i < nsub && sub[i+1]; i++)
2122 uschar * tmp = acl_arg[i];
2123 acl_arg[i] = sub[i+1]; /* place callers args in the globals */
2124 sub[i+1] = tmp; /* stash the old args using our caller's storage */
2129 sub[i+1] = acl_arg[i];
2130 acl_arg[i++] = NULL;
2134 debug_printf_indent("expanding: acl: %s arg: %s%s\n",
2136 acl_narg>0 ? acl_arg[0] : US"<none>",
2137 acl_narg>1 ? " +more" : "");
2139 ret = acl_eval(acl_where, sub[0], user_msgp, &dummy_logmsg);
2141 for (i = 0; i < nsub; i++)
2142 acl_arg[i] = sub[i+1]; /* restore old args */
2143 acl_narg = sav_narg;
2151 /*************************************************
2152 * Read and evaluate a condition *
2153 *************************************************/
2157 s points to the start of the condition text
2158 resetok points to a BOOL which is written false if it is unsafe to
2159 free memory. Certain condition types (acl) may have side-effect
2160 allocation which must be preserved.
2161 yield points to a BOOL to hold the result of the condition test;
2162 if NULL, we are just reading through a condition that is
2163 part of an "or" combination to check syntax, or in a state
2164 where the answer isn't required
2166 Returns: a pointer to the first character after the condition, or
2170 static const uschar *
2171 eval_condition(const uschar *s, BOOL *resetok, BOOL *yield)
2173 BOOL testfor = TRUE;
2174 BOOL tempcond, combined_cond;
2176 BOOL sub2_honour_dollar = TRUE;
2177 int i, rc, cond_type, roffset;
2178 int_eximarith_t num[2];
2179 struct stat statbuf;
2181 const uschar *sub[10];
2184 const uschar *rerror;
2188 while (isspace(*s)) s++;
2189 if (*s == '!') { testfor = !testfor; s++; } else break;
2192 /* Numeric comparisons are symbolic */
2194 if (*s == '=' || *s == '>' || *s == '<')
2206 /* All other conditions are named */
2208 else s = read_name(name, 256, s, US"_");
2210 /* If we haven't read a name, it means some non-alpha character is first. */
2214 expand_string_message = string_sprintf("condition name expected, "
2215 "but found \"%.16s\"", s);
2219 /* Find which condition we are dealing with, and switch on it */
2221 cond_type = chop_match(name, cond_table, nelem(cond_table));
2224 /* def: tests for a non-empty variable, or for the existence of a header. If
2225 yield == NULL we are in a skipping state, and don't care about the answer. */
2230 expand_string_message = US"\":\" expected after \"def\"";
2234 s = read_name(name, 256, s+1, US"_");
2236 /* Test for a header's existence. If the name contains a closing brace
2237 character, this may be a user error where the terminating colon has been
2238 omitted. Set a flag to adjust a subsequent error message in this case. */
2240 if (Ustrncmp(name, "h_", 2) == 0 ||
2241 Ustrncmp(name, "rh_", 3) == 0 ||
2242 Ustrncmp(name, "bh_", 3) == 0 ||
2243 Ustrncmp(name, "header_", 7) == 0 ||
2244 Ustrncmp(name, "rheader_", 8) == 0 ||
2245 Ustrncmp(name, "bheader_", 8) == 0)
2247 s = read_header_name(name, 256, s);
2248 /* {-for-text-editors */
2249 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
2250 if (yield != NULL) *yield =
2251 (find_header(name, TRUE, NULL, FALSE, NULL) != NULL) == testfor;
2254 /* Test for a variable's having a non-empty value. A non-existent variable
2255 causes an expansion failure. */
2259 uschar *value = find_variable(name, TRUE, yield == NULL, NULL);
2262 expand_string_message = (name[0] == 0)?
2263 string_sprintf("variable name omitted after \"def:\"") :
2264 string_sprintf("unknown variable \"%s\" after \"def:\"", name);
2265 check_variable_error_message(name);
2268 if (yield != NULL) *yield = (value[0] != 0) == testfor;
2274 /* first_delivery tests for first delivery attempt */
2276 case ECOND_FIRST_DELIVERY:
2277 if (yield != NULL) *yield = deliver_firsttime == testfor;
2281 /* queue_running tests for any process started by a queue runner */
2283 case ECOND_QUEUE_RUNNING:
2284 if (yield != NULL) *yield = (queue_run_pid != (pid_t)0) == testfor;
2288 /* exists: tests for file existence
2289 isip: tests for any IP address
2290 isip4: tests for an IPv4 address
2291 isip6: tests for an IPv6 address
2292 pam: does PAM authentication
2293 radius: does RADIUS authentication
2294 ldapauth: does LDAP authentication
2295 pwcheck: does Cyrus SASL pwcheck authentication
2304 case ECOND_LDAPAUTH:
2307 while (isspace(*s)) s++;
2308 if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2310 sub[0] = expand_string_internal(s+1, TRUE, &s, yield == NULL, TRUE, resetok);
2311 if (sub[0] == NULL) return NULL;
2312 /* {-for-text-editors */
2313 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2315 if (yield == NULL) return s; /* No need to run the test if skipping */
2320 if ((expand_forbid & RDO_EXISTS) != 0)
2322 expand_string_message = US"File existence tests are not permitted";
2325 *yield = (Ustat(sub[0], &statbuf) == 0) == testfor;
2331 rc = string_is_ip_address(sub[0], NULL);
2332 *yield = ((cond_type == ECOND_ISIP)? (rc != 0) :
2333 (cond_type == ECOND_ISIP4)? (rc == 4) : (rc == 6)) == testfor;
2336 /* Various authentication tests - all optionally compiled */
2340 rc = auth_call_pam(sub[0], &expand_string_message);
2343 goto COND_FAILED_NOT_COMPILED;
2344 #endif /* SUPPORT_PAM */
2347 #ifdef RADIUS_CONFIG_FILE
2348 rc = auth_call_radius(sub[0], &expand_string_message);
2351 goto COND_FAILED_NOT_COMPILED;
2352 #endif /* RADIUS_CONFIG_FILE */
2354 case ECOND_LDAPAUTH:
2357 /* Just to keep the interface the same */
2359 int old_pool = store_pool;
2360 store_pool = POOL_SEARCH;
2361 rc = eldapauth_find((void *)(-1), NULL, sub[0], Ustrlen(sub[0]), NULL,
2362 &expand_string_message, &do_cache);
2363 store_pool = old_pool;
2367 goto COND_FAILED_NOT_COMPILED;
2368 #endif /* LOOKUP_LDAP */
2371 #ifdef CYRUS_PWCHECK_SOCKET
2372 rc = auth_call_pwcheck(sub[0], &expand_string_message);
2375 goto COND_FAILED_NOT_COMPILED;
2376 #endif /* CYRUS_PWCHECK_SOCKET */
2378 #if defined(SUPPORT_PAM) || defined(RADIUS_CONFIG_FILE) || \
2379 defined(LOOKUP_LDAP) || defined(CYRUS_PWCHECK_SOCKET)
2381 if (rc == ERROR || rc == DEFER) return NULL;
2382 *yield = (rc == OK) == testfor;
2388 /* call ACL (in a conditional context). Accept true, deny false.
2389 Defer is a forced-fail. Anything set by message= goes to $value.
2390 Up to ten parameters are used; we use the braces round the name+args
2391 like the saslauthd condition does, to permit a variable number of args.
2392 See also the expansion-item version EITEM_ACL and the traditional
2393 acl modifier ACLC_ACL.
2394 Since the ACL may allocate new global variables, tell our caller to not
2399 /* ${if acl {{name}{arg1}{arg2}...} {yes}{no}} */
2405 while (isspace(*s)) s++;
2406 if (*s++ != '{') goto COND_FAILED_CURLY_START; /*}*/
2408 switch(read_subs(sub, nelem(sub), 1,
2409 &s, yield == NULL, TRUE, US"acl", resetok))
2411 case 1: expand_string_message = US"too few arguments or bracketing "
2414 case 3: return NULL;
2419 *resetok = FALSE; /* eval_acl() might allocate; do not reclaim */
2420 switch(eval_acl(sub, nelem(sub), &user_msg))
2425 lookup_value = NULL;
2427 lookup_value = string_copy(user_msg);
2428 *yield = cond == testfor;
2432 expand_string_forcedfail = TRUE;
2435 expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
2443 /* saslauthd: does Cyrus saslauthd authentication. Four parameters are used:
2445 ${if saslauthd {{username}{password}{service}{realm}} {yes}{no}}
2447 However, the last two are optional. That is why the whole set is enclosed
2448 in their own set of braces. */
2450 case ECOND_SASLAUTHD:
2451 #ifndef CYRUS_SASLAUTHD_SOCKET
2452 goto COND_FAILED_NOT_COMPILED;
2456 while (isspace(*s)) s++;
2457 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2458 switch(read_subs(sub, nelem(sub), 2, &s, yield == NULL, TRUE, US"saslauthd",
2461 case 1: expand_string_message = US"too few arguments or bracketing "
2462 "error for saslauthd";
2464 case 3: return NULL;
2466 if (sub[2] == NULL) sub[3] = NULL; /* realm if no service */
2469 int rc = auth_call_saslauthd(sub[0], sub[1], sub[2], sub[3],
2470 &expand_string_message);
2471 if (rc == ERROR || rc == DEFER) return NULL;
2472 *yield = (rc == OK) == testfor;
2476 #endif /* CYRUS_SASLAUTHD_SOCKET */
2479 /* symbolic operators for numeric and string comparison, and a number of
2480 other operators, all requiring two arguments.
2482 crypteq: encrypts plaintext and compares against an encrypted text,
2483 using crypt(), crypt16(), MD5 or SHA-1
2484 inlist/inlisti: checks if first argument is in the list of the second
2485 match: does a regular expression match and sets up the numerical
2486 variables if it succeeds
2487 match_address: matches in an address list
2488 match_domain: matches in a domain list
2489 match_ip: matches a host list that is restricted to IP addresses
2490 match_local_part: matches in a local part list
2493 case ECOND_MATCH_ADDRESS:
2494 case ECOND_MATCH_DOMAIN:
2495 case ECOND_MATCH_IP:
2496 case ECOND_MATCH_LOCAL_PART:
2497 #ifndef EXPAND_LISTMATCH_RHS
2498 sub2_honour_dollar = FALSE;
2507 case ECOND_NUM_L: /* Numerical comparisons */
2514 case ECOND_STR_LT: /* String comparisons */
2525 for (i = 0; i < 2; i++)
2527 /* Sometimes, we don't expand substrings; too many insecure configurations
2528 created using match_address{}{} and friends, where the second param
2529 includes information from untrustworthy sources. */
2530 BOOL honour_dollar = TRUE;
2531 if ((i > 0) && !sub2_honour_dollar)
2532 honour_dollar = FALSE;
2534 while (isspace(*s)) s++;
2537 if (i == 0) goto COND_FAILED_CURLY_START;
2538 expand_string_message = string_sprintf("missing 2nd string in {} "
2539 "after \"%s\"", name);
2542 if (!(sub[i] = expand_string_internal(s+1, TRUE, &s, yield == NULL,
2543 honour_dollar, resetok)))
2545 DEBUG(D_expand) if (i == 1 && !sub2_honour_dollar && Ustrchr(sub[1], '$'))
2546 debug_printf_indent("WARNING: the second arg is NOT expanded,"
2547 " for security reasons\n");
2548 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2550 /* Convert to numerical if required; we know that the names of all the
2551 conditions that compare numbers do not start with a letter. This just saves
2552 checking for them individually. */
2554 if (!isalpha(name[0]) && yield != NULL)
2559 debug_printf_indent("empty string cast to zero for numerical comparison\n");
2563 num[i] = expanded_string_integer(sub[i], FALSE);
2564 if (expand_string_message != NULL) return NULL;
2568 /* Result not required */
2570 if (yield == NULL) return s;
2572 /* Do an appropriate comparison */
2578 tempcond = (num[0] == num[1]);
2582 tempcond = (num[0] > num[1]);
2586 tempcond = (num[0] >= num[1]);
2590 tempcond = (num[0] < num[1]);
2594 tempcond = (num[0] <= num[1]);
2598 tempcond = (Ustrcmp(sub[0], sub[1]) < 0);
2602 tempcond = (strcmpic(sub[0], sub[1]) < 0);
2606 tempcond = (Ustrcmp(sub[0], sub[1]) <= 0);
2610 tempcond = (strcmpic(sub[0], sub[1]) <= 0);
2614 tempcond = (Ustrcmp(sub[0], sub[1]) == 0);
2618 tempcond = (strcmpic(sub[0], sub[1]) == 0);
2622 tempcond = (Ustrcmp(sub[0], sub[1]) > 0);
2626 tempcond = (strcmpic(sub[0], sub[1]) > 0);
2630 tempcond = (Ustrcmp(sub[0], sub[1]) >= 0);
2634 tempcond = (strcmpic(sub[0], sub[1]) >= 0);
2637 case ECOND_MATCH: /* Regular expression match */
2638 re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
2642 expand_string_message = string_sprintf("regular expression error in "
2643 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
2646 tempcond = regex_match_and_setup(re, sub[0], 0, -1);
2649 case ECOND_MATCH_ADDRESS: /* Match in an address list */
2650 rc = match_address_list(sub[0], TRUE, FALSE, &(sub[1]), NULL, -1, 0, NULL);
2651 goto MATCHED_SOMETHING;
2653 case ECOND_MATCH_DOMAIN: /* Match in a domain list */
2654 rc = match_isinlist(sub[0], &(sub[1]), 0, &domainlist_anchor, NULL,
2655 MCL_DOMAIN + MCL_NOEXPAND, TRUE, NULL);
2656 goto MATCHED_SOMETHING;
2658 case ECOND_MATCH_IP: /* Match IP address in a host list */
2659 if (sub[0][0] != 0 && string_is_ip_address(sub[0], NULL) == 0)
2661 expand_string_message = string_sprintf("\"%s\" is not an IP address",
2667 unsigned int *nullcache = NULL;
2668 check_host_block cb;
2670 cb.host_name = US"";
2671 cb.host_address = sub[0];
2673 /* If the host address starts off ::ffff: it is an IPv6 address in
2674 IPv4-compatible mode. Find the IPv4 part for checking against IPv4
2677 cb.host_ipv4 = (Ustrncmp(cb.host_address, "::ffff:", 7) == 0)?
2678 cb.host_address + 7 : cb.host_address;
2680 rc = match_check_list(
2681 &sub[1], /* the list */
2682 0, /* separator character */
2683 &hostlist_anchor, /* anchor pointer */
2684 &nullcache, /* cache pointer */
2685 check_host, /* function for testing */
2686 &cb, /* argument for function */
2687 MCL_HOST, /* type of check */
2688 sub[0], /* text for debugging */
2689 NULL); /* where to pass back data */
2691 goto MATCHED_SOMETHING;
2693 case ECOND_MATCH_LOCAL_PART:
2694 rc = match_isinlist(sub[0], &(sub[1]), 0, &localpartlist_anchor, NULL,
2695 MCL_LOCALPART + MCL_NOEXPAND, TRUE, NULL);
2710 expand_string_message = string_sprintf("unable to complete match "
2711 "against \"%s\": %s", sub[1], search_error_message);
2717 /* Various "encrypted" comparisons. If the second string starts with
2718 "{" then an encryption type is given. Default to crypt() or crypt16()
2719 (build-time choice). */
2720 /* }-for-text-editors */
2723 #ifndef SUPPORT_CRYPTEQ
2724 goto COND_FAILED_NOT_COMPILED;
2726 if (strncmpic(sub[1], US"{md5}", 5) == 0)
2728 int sublen = Ustrlen(sub[1]+5);
2733 md5_end(&base, sub[0], Ustrlen(sub[0]), digest);
2735 /* If the length that we are comparing against is 24, the MD5 digest
2736 is expressed as a base64 string. This is the way LDAP does it. However,
2737 some other software uses a straightforward hex representation. We assume
2738 this if the length is 32. Other lengths fail. */
2742 uschar *coded = b64encode(digest, 16);
2743 DEBUG(D_auth) debug_printf("crypteq: using MD5+B64 hashing\n"
2744 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
2745 tempcond = (Ustrcmp(coded, sub[1]+5) == 0);
2747 else if (sublen == 32)
2751 for (i = 0; i < 16; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2753 DEBUG(D_auth) debug_printf("crypteq: using MD5+hex hashing\n"
2754 " subject=%s\n crypted=%s\n", coded, sub[1]+5);
2755 tempcond = (strcmpic(coded, sub[1]+5) == 0);
2759 DEBUG(D_auth) debug_printf("crypteq: length for MD5 not 24 or 32: "
2760 "fail\n crypted=%s\n", sub[1]+5);
2765 else if (strncmpic(sub[1], US"{sha1}", 6) == 0)
2767 int sublen = Ustrlen(sub[1]+6);
2772 sha1_end(&h, sub[0], Ustrlen(sub[0]), digest);
2774 /* If the length that we are comparing against is 28, assume the SHA1
2775 digest is expressed as a base64 string. If the length is 40, assume a
2776 straightforward hex representation. Other lengths fail. */
2780 uschar *coded = b64encode(digest, 20);
2781 DEBUG(D_auth) debug_printf("crypteq: using SHA1+B64 hashing\n"
2782 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
2783 tempcond = (Ustrcmp(coded, sub[1]+6) == 0);
2785 else if (sublen == 40)
2789 for (i = 0; i < 20; i++) sprintf(CS (coded+2*i), "%02X", digest[i]);
2791 DEBUG(D_auth) debug_printf("crypteq: using SHA1+hex hashing\n"
2792 " subject=%s\n crypted=%s\n", coded, sub[1]+6);
2793 tempcond = (strcmpic(coded, sub[1]+6) == 0);
2797 DEBUG(D_auth) debug_printf("crypteq: length for SHA-1 not 28 or 40: "
2798 "fail\n crypted=%s\n", sub[1]+6);
2803 else /* {crypt} or {crypt16} and non-{ at start */
2804 /* }-for-text-editors */
2809 if (strncmpic(sub[1], US"{crypt}", 7) == 0)
2814 else if (strncmpic(sub[1], US"{crypt16}", 9) == 0)
2819 else if (sub[1][0] == '{') /* }-for-text-editors */
2821 expand_string_message = string_sprintf("unknown encryption mechanism "
2822 "in \"%s\"", sub[1]);
2828 case 0: coded = US DEFAULT_CRYPT(CS sub[0], CS sub[1]); break;
2829 case 1: coded = US crypt(CS sub[0], CS sub[1]); break;
2830 default: coded = US crypt16(CS sub[0], CS sub[1]); break;
2834 #define XSTR(s) STR(s)
2835 DEBUG(D_auth) debug_printf("crypteq: using %s()\n"
2836 " subject=%s\n crypted=%s\n",
2837 which == 0 ? XSTR(DEFAULT_CRYPT) : which == 1 ? "crypt" : "crypt16",
2842 /* If the encrypted string contains fewer than two characters (for the
2843 salt), force failure. Otherwise we get false positives: with an empty
2844 string the yield of crypt() is an empty string! */
2847 tempcond = Ustrlen(sub[1]) < 2 ? FALSE : Ustrcmp(coded, sub[1]) == 0;
2848 else if (errno == EINVAL)
2852 expand_string_message = string_sprintf("crypt error: %s\n",
2853 US strerror(errno));
2858 #endif /* SUPPORT_CRYPTEQ */
2863 const uschar * list = sub[1];
2865 uschar *save_iterate_item = iterate_item;
2866 int (*compare)(const uschar *, const uschar *);
2868 DEBUG(D_expand) debug_printf_indent("condition: %s item: %s\n", name, sub[0]);
2871 compare = cond_type == ECOND_INLISTI
2872 ? strcmpic : (int (*)(const uschar *, const uschar *)) strcmp;
2874 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
2876 DEBUG(D_expand) debug_printf_indent(" compare %s\n", iterate_item);
2877 if (compare(sub[0], iterate_item) == 0)
2883 iterate_item = save_iterate_item;
2886 } /* Switch for comparison conditions */
2888 *yield = tempcond == testfor;
2889 return s; /* End of comparison conditions */
2892 /* and/or: computes logical and/or of several conditions */
2896 subcondptr = (yield == NULL)? NULL : &tempcond;
2897 combined_cond = (cond_type == ECOND_AND);
2899 while (isspace(*s)) s++;
2900 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2904 while (isspace(*s)) s++;
2905 /* {-for-text-editors */
2906 if (*s == '}') break;
2907 if (*s != '{') /* }-for-text-editors */
2909 expand_string_message = string_sprintf("each subcondition "
2910 "inside an \"%s{...}\" condition must be in its own {}", name);
2914 if (!(s = eval_condition(s+1, resetok, subcondptr)))
2916 expand_string_message = string_sprintf("%s inside \"%s{...}\" condition",
2917 expand_string_message, name);
2920 while (isspace(*s)) s++;
2922 /* {-for-text-editors */
2925 /* {-for-text-editors */
2926 expand_string_message = string_sprintf("missing } at end of condition "
2927 "inside \"%s\" group", name);
2933 if (cond_type == ECOND_AND)
2935 combined_cond &= tempcond;
2936 if (!combined_cond) subcondptr = NULL; /* once false, don't */
2937 } /* evaluate any more */
2940 combined_cond |= tempcond;
2941 if (combined_cond) subcondptr = NULL; /* once true, don't */
2942 } /* evaluate any more */
2946 if (yield != NULL) *yield = (combined_cond == testfor);
2950 /* forall/forany: iterates a condition with different values */
2955 const uschar * list;
2957 uschar *save_iterate_item = iterate_item;
2959 DEBUG(D_expand) debug_printf_indent("condition: %s\n", name);
2961 while (isspace(*s)) s++;
2962 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2963 sub[0] = expand_string_internal(s, TRUE, &s, (yield == NULL), TRUE, resetok);
2964 if (sub[0] == NULL) return NULL;
2965 /* {-for-text-editors */
2966 if (*s++ != '}') goto COND_FAILED_CURLY_END;
2968 while (isspace(*s)) s++;
2969 if (*s++ != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
2973 /* Call eval_condition once, with result discarded (as if scanning a
2974 "false" part). This allows us to find the end of the condition, because if
2975 the list it empty, we won't actually evaluate the condition for real. */
2977 if (!(s = eval_condition(sub[1], resetok, NULL)))
2979 expand_string_message = string_sprintf("%s inside \"%s\" condition",
2980 expand_string_message, name);
2983 while (isspace(*s)) s++;
2985 /* {-for-text-editors */
2988 /* {-for-text-editors */
2989 expand_string_message = string_sprintf("missing } at end of condition "
2990 "inside \"%s\"", name);
2994 if (yield != NULL) *yield = !testfor;
2996 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)) != NULL)
2998 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, iterate_item);
2999 if (!eval_condition(sub[1], resetok, &tempcond))
3001 expand_string_message = string_sprintf("%s inside \"%s\" condition",
3002 expand_string_message, name);
3003 iterate_item = save_iterate_item;
3006 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", name,
3007 tempcond? "true":"false");
3009 if (yield != NULL) *yield = (tempcond == testfor);
3010 if (tempcond == (cond_type == ECOND_FORANY)) break;
3013 iterate_item = save_iterate_item;
3018 /* The bool{} expansion condition maps a string to boolean.
3019 The values supported should match those supported by the ACL condition
3020 (acl.c, ACLC_CONDITION) so that we keep to a minimum the different ideas
3021 of true/false. Note that Router "condition" rules have a different
3022 interpretation, where general data can be used and only a few values
3024 Note that readconf.c boolean matching, for boolean configuration options,
3025 only matches true/yes/false/no.
3026 The bool_lax{} condition matches the Router logic, which is much more
3029 case ECOND_BOOL_LAX:
3035 BOOL boolvalue = FALSE;
3036 while (isspace(*s)) s++;
3037 if (*s != '{') goto COND_FAILED_CURLY_START; /* }-for-text-editors */
3038 ourname = cond_type == ECOND_BOOL_LAX ? US"bool_lax" : US"bool";
3039 switch(read_subs(sub_arg, 1, 1, &s, yield == NULL, FALSE, ourname, resetok))
3041 case 1: expand_string_message = string_sprintf(
3042 "too few arguments or bracketing error for %s",
3046 case 3: return NULL;
3049 while (isspace(*t)) t++;
3053 /* trailing whitespace: seems like a good idea to ignore it too */
3055 while (isspace(*t2)) t2--;
3056 if (t2 != (t + len))
3063 debug_printf_indent("considering %s: %s\n", ourname, len ? t : US"<empty>");
3064 /* logic for the lax case from expand_check_condition(), which also does
3065 expands, and the logic is both short and stable enough that there should
3066 be no maintenance burden from replicating it. */
3070 ? Ustrspn(t+1, "0123456789") == len-1
3071 : Ustrspn(t, "0123456789") == len)
3073 boolvalue = (Uatoi(t) == 0) ? FALSE : TRUE;
3074 /* expand_check_condition only does a literal string "0" check */
3075 if ((cond_type == ECOND_BOOL_LAX) && (len > 1))
3078 else if (strcmpic(t, US"true") == 0 || strcmpic(t, US"yes") == 0)
3080 else if (strcmpic(t, US"false") == 0 || strcmpic(t, US"no") == 0)
3082 else if (cond_type == ECOND_BOOL_LAX)
3086 expand_string_message = string_sprintf("unrecognised boolean "
3090 DEBUG(D_expand) debug_printf_indent("%s: condition evaluated to %s\n", ourname,
3091 boolvalue? "true":"false");
3092 if (yield != NULL) *yield = (boolvalue == testfor);
3096 /* Unknown condition */
3099 expand_string_message = string_sprintf("unknown condition \"%s\"", name);
3101 } /* End switch on condition type */
3103 /* Missing braces at start and end of data */
3105 COND_FAILED_CURLY_START:
3106 expand_string_message = string_sprintf("missing { after \"%s\"", name);
3109 COND_FAILED_CURLY_END:
3110 expand_string_message = string_sprintf("missing } at end of \"%s\" condition",
3114 /* A condition requires code that is not compiled */
3116 #if !defined(SUPPORT_PAM) || !defined(RADIUS_CONFIG_FILE) || \
3117 !defined(LOOKUP_LDAP) || !defined(CYRUS_PWCHECK_SOCKET) || \
3118 !defined(SUPPORT_CRYPTEQ) || !defined(CYRUS_SASLAUTHD_SOCKET)
3119 COND_FAILED_NOT_COMPILED:
3120 expand_string_message = string_sprintf("support for \"%s\" not compiled",
3129 /*************************************************
3130 * Save numerical variables *
3131 *************************************************/
3133 /* This function is called from items such as "if" that want to preserve and
3134 restore the numbered variables.
3137 save_expand_string points to an array of pointers to set
3138 save_expand_nlength points to an array of ints for the lengths
3140 Returns: the value of expand max to save
3144 save_expand_strings(uschar **save_expand_nstring, int *save_expand_nlength)
3147 for (i = 0; i <= expand_nmax; i++)
3149 save_expand_nstring[i] = expand_nstring[i];
3150 save_expand_nlength[i] = expand_nlength[i];
3157 /*************************************************
3158 * Restore numerical variables *
3159 *************************************************/
3161 /* This function restored saved values of numerical strings.
3164 save_expand_nmax the number of strings to restore
3165 save_expand_string points to an array of pointers
3166 save_expand_nlength points to an array of ints
3172 restore_expand_strings(int save_expand_nmax, uschar **save_expand_nstring,
3173 int *save_expand_nlength)
3176 expand_nmax = save_expand_nmax;
3177 for (i = 0; i <= expand_nmax; i++)
3179 expand_nstring[i] = save_expand_nstring[i];
3180 expand_nlength[i] = save_expand_nlength[i];
3188 /*************************************************
3189 * Handle yes/no substrings *
3190 *************************************************/
3192 /* This function is used by ${if}, ${lookup} and ${extract} to handle the
3193 alternative substrings that depend on whether or not the condition was true,
3194 or the lookup or extraction succeeded. The substrings always have to be
3195 expanded, to check their syntax, but "skipping" is set when the result is not
3196 needed - this avoids unnecessary nested lookups.
3199 skipping TRUE if we were skipping when this item was reached
3200 yes TRUE if the first string is to be used, else use the second
3201 save_lookup a value to put back into lookup_value before the 2nd expansion
3202 sptr points to the input string pointer
3203 yieldptr points to the output growable-string pointer
3204 type "lookup", "if", "extract", "run", "env", "listextract" or
3205 "certextract" for error message
3206 resetok if not NULL, pointer to flag - write FALSE if unsafe to reset
3209 Returns: 0 OK; lookup_value has been reset to save_lookup
3211 2 expansion failed because of bracketing error
3215 process_yesno(BOOL skipping, BOOL yes, uschar *save_lookup, const uschar **sptr,
3216 gstring ** yieldptr, uschar *type, BOOL *resetok)
3219 const uschar *s = *sptr; /* Local value */
3220 uschar *sub1, *sub2;
3221 const uschar * errwhere;
3223 /* If there are no following strings, we substitute the contents of $value for
3224 lookups and for extractions in the success case. For the ${if item, the string
3225 "true" is substituted. In the fail case, nothing is substituted for all three
3228 while (isspace(*s)) s++;
3233 if (yes && !skipping)
3234 *yieldptr = string_catn(*yieldptr, US"true", 4);
3238 if (yes && lookup_value && !skipping)
3239 *yieldptr = string_cat(*yieldptr, lookup_value);
3240 lookup_value = save_lookup;
3246 /* The first following string must be braced. */
3250 errwhere = US"'yes' part did not start with '{'";
3254 /* Expand the first substring. Forced failures are noticed only if we actually
3255 want this string. Set skipping in the call in the fail case (this will always
3256 be the case if we were already skipping). */
3258 sub1 = expand_string_internal(s, TRUE, &s, !yes, TRUE, resetok);
3259 if (sub1 == NULL && (yes || !expand_string_forcedfail)) goto FAILED;
3260 expand_string_forcedfail = FALSE;
3263 errwhere = US"'yes' part did not end with '}'";
3267 /* If we want the first string, add it to the output */
3270 *yieldptr = string_cat(*yieldptr, sub1);
3272 /* If this is called from a lookup/env or a (cert)extract, we want to restore
3273 $value to what it was at the start of the item, so that it has this value
3274 during the second string expansion. For the call from "if" or "run" to this
3275 function, save_lookup is set to lookup_value, so that this statement does
3278 lookup_value = save_lookup;
3280 /* There now follows either another substring, or "fail", or nothing. This
3281 time, forced failures are noticed only if we want the second string. We must
3282 set skipping in the nested call if we don't want this string, or if we were
3283 already skipping. */
3285 while (isspace(*s)) s++;
3288 sub2 = expand_string_internal(s+1, TRUE, &s, yes || skipping, TRUE, resetok);
3289 if (sub2 == NULL && (!yes || !expand_string_forcedfail)) goto FAILED;
3290 expand_string_forcedfail = FALSE;
3293 errwhere = US"'no' part did not start with '{'";
3297 /* If we want the second string, add it to the output */
3300 *yieldptr = string_cat(*yieldptr, sub2);
3303 /* If there is no second string, but the word "fail" is present when the use of
3304 the second string is wanted, set a flag indicating it was a forced failure
3305 rather than a syntactic error. Swallow the terminating } in case this is nested
3306 inside another lookup or if or extract. */
3311 /* deconst cast ok here as source is s anyway */
3312 s = US read_name(name, sizeof(name), s, US"_");
3313 if (Ustrcmp(name, "fail") == 0)
3315 if (!yes && !skipping)
3317 while (isspace(*s)) s++;
3320 errwhere = US"did not close with '}' after forcedfail";
3323 expand_string_message =
3324 string_sprintf("\"%s\" failed and \"fail\" requested", type);
3325 expand_string_forcedfail = TRUE;
3331 expand_string_message =
3332 string_sprintf("syntax error in \"%s\" item - \"fail\" expected", type);
3337 /* All we have to do now is to check on the final closing brace. */
3339 while (isspace(*s)) s++;
3342 errwhere = US"did not close with '}'";
3348 /* Update the input pointer value before returning */
3353 /* Get here if there is a bracketing failure */
3354 expand_string_message = string_sprintf(
3355 "curly-bracket problem in conditional yes/no parsing: %s\n"
3356 " remaining string is '%s'", errwhere, --s);
3361 /* Get here for other failures */
3369 /*************************************************
3370 * Handle MD5 or SHA-1 computation for HMAC *
3371 *************************************************/
3373 /* These are some wrapping functions that enable the HMAC code to be a bit
3374 cleaner. A good compiler will spot the tail recursion.
3377 type HMAC_MD5 or HMAC_SHA1
3378 remaining are as for the cryptographic hash functions
3384 chash_start(int type, void *base)
3386 if (type == HMAC_MD5)
3387 md5_start((md5 *)base);
3389 sha1_start((hctx *)base);
3393 chash_mid(int type, void *base, uschar *string)
3395 if (type == HMAC_MD5)
3396 md5_mid((md5 *)base, string);
3398 sha1_mid((hctx *)base, string);
3402 chash_end(int type, void *base, uschar *string, int length, uschar *digest)
3404 if (type == HMAC_MD5)
3405 md5_end((md5 *)base, string, length, digest);
3407 sha1_end((hctx *)base, string, length, digest);
3414 /********************************************************
3415 * prvs: Get last three digits of days since Jan 1, 1970 *
3416 ********************************************************/
3418 /* This is needed to implement the "prvs" BATV reverse
3421 Argument: integer "days" offset to add or substract to
3422 or from the current number of days.
3424 Returns: pointer to string containing the last three
3425 digits of the number of days since Jan 1, 1970,
3426 modified by the offset argument, NULL if there
3427 was an error in the conversion.
3432 prvs_daystamp(int day_offset)
3434 uschar *days = store_get(32); /* Need at least 24 for cases */
3435 (void)string_format(days, 32, TIME_T_FMT, /* where TIME_T_FMT is %lld */
3436 (time(NULL) + day_offset*86400)/86400);
3437 return (Ustrlen(days) >= 3) ? &days[Ustrlen(days)-3] : US"100";
3442 /********************************************************
3443 * prvs: perform HMAC-SHA1 computation of prvs bits *
3444 ********************************************************/
3446 /* This is needed to implement the "prvs" BATV reverse
3450 address RFC2821 Address to use
3451 key The key to use (must be less than 64 characters
3453 key_num Single-digit key number to use. Defaults to
3456 Returns: pointer to string containing the first three
3457 bytes of the final hash in hex format, NULL if
3458 there was an error in the process.
3462 prvs_hmac_sha1(uschar *address, uschar *key, uschar *key_num, uschar *daystamp)
3464 gstring * hash_source;
3468 uschar innerhash[20];
3469 uschar finalhash[20];
3470 uschar innerkey[64];
3471 uschar outerkey[64];
3472 uschar *finalhash_hex = store_get(40);
3474 if (key_num == NULL)
3477 if (Ustrlen(key) > 64)
3480 hash_source = string_catn(NULL, key_num, 1);
3481 hash_source = string_catn(hash_source, daystamp, 3);
3482 hash_source = string_cat(hash_source, address);
3483 (void) string_from_gstring(hash_source);
3486 debug_printf_indent("prvs: hash source is '%s'\n", hash_source->s);
3488 memset(innerkey, 0x36, 64);
3489 memset(outerkey, 0x5c, 64);
3491 for (i = 0; i < Ustrlen(key); i++)
3493 innerkey[i] ^= key[i];
3494 outerkey[i] ^= key[i];
3497 chash_start(HMAC_SHA1, &h);
3498 chash_mid(HMAC_SHA1, &h, innerkey);
3499 chash_end(HMAC_SHA1, &h, hash_source->s, hash_source->ptr, innerhash);
3501 chash_start(HMAC_SHA1, &h);
3502 chash_mid(HMAC_SHA1, &h, outerkey);
3503 chash_end(HMAC_SHA1, &h, innerhash, 20, finalhash);
3506 for (i = 0; i < 3; i++)
3508 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
3509 *p++ = hex_digits[finalhash[i] & 0x0f];
3513 return finalhash_hex;
3519 /*************************************************
3520 * Join a file onto the output string *
3521 *************************************************/
3523 /* This is used for readfile/readsock and after a run expansion.
3524 It joins the contents of a file onto the output string, globally replacing
3525 newlines with a given string (optionally).
3529 yield pointer to the expandable string struct
3530 eol newline replacement string, or NULL
3532 Returns: new pointer for expandable string, terminated if non-null
3536 cat_file(FILE *f, gstring *yield, uschar *eol)
3538 uschar buffer[1024];
3540 while (Ufgets(buffer, sizeof(buffer), f))
3542 int len = Ustrlen(buffer);
3543 if (eol && buffer[len-1] == '\n') len--;
3544 yield = string_catn(yield, buffer, len);
3545 if (eol && buffer[len])
3546 yield = string_cat(yield, eol);
3549 (void) string_from_gstring(yield);
3556 /*************************************************
3557 * Evaluate numeric expression *
3558 *************************************************/
3560 /* This is a set of mutually recursive functions that evaluate an arithmetic
3561 expression involving + - * / % & | ^ ~ << >> and parentheses. The only one of
3562 these functions that is called from elsewhere is eval_expr, whose interface is:
3565 sptr pointer to the pointer to the string - gets updated
3566 decimal TRUE if numbers are to be assumed decimal
3567 error pointer to where to put an error message - must be NULL on input
3568 endket TRUE if ')' must terminate - FALSE for external call
3570 Returns: on success: the value of the expression, with *error still NULL
3571 on failure: an undefined value, with *error = a message
3574 static int_eximarith_t eval_op_or(uschar **, BOOL, uschar **);
3577 static int_eximarith_t
3578 eval_expr(uschar **sptr, BOOL decimal, uschar **error, BOOL endket)
3581 int_eximarith_t x = eval_op_or(&s, decimal, error);
3587 *error = US"expecting closing parenthesis";
3589 while (isspace(*(++s)));
3591 else if (*s != 0) *error = US"expecting operator";
3598 static int_eximarith_t
3599 eval_number(uschar **sptr, BOOL decimal, uschar **error)
3604 while (isspace(*s)) s++;
3609 (void)sscanf(CS s, (decimal? SC_EXIM_DEC "%n" : SC_EXIM_ARITH "%n"), &n, &count);
3611 switch (tolower(*s))
3614 case 'k': n *= 1024; s++; break;
3615 case 'm': n *= 1024*1024; s++; break;
3616 case 'g': n *= 1024*1024*1024; s++; break;
3618 while (isspace (*s)) s++;
3623 n = eval_expr(&s, decimal, error, 1);
3627 *error = US"expecting number or opening parenthesis";
3635 static int_eximarith_t
3636 eval_op_unary(uschar **sptr, BOOL decimal, uschar **error)
3640 while (isspace(*s)) s++;
3641 if (*s == '+' || *s == '-' || *s == '~')
3644 x = eval_op_unary(&s, decimal, error);
3645 if (op == '-') x = -x;
3646 else if (op == '~') x = ~x;
3650 x = eval_number(&s, decimal, error);
3657 static int_eximarith_t
3658 eval_op_mult(uschar **sptr, BOOL decimal, uschar **error)
3661 int_eximarith_t x = eval_op_unary(&s, decimal, error);
3664 while (*s == '*' || *s == '/' || *s == '%')
3667 int_eximarith_t y = eval_op_unary(&s, decimal, error);
3668 if (*error != NULL) break;
3669 /* SIGFPE both on div/mod by zero and on INT_MIN / -1, which would give
3670 * a value of INT_MAX+1. Note that INT_MIN * -1 gives INT_MIN for me, which
3671 * is a bug somewhere in [gcc 4.2.1, FreeBSD, amd64]. In fact, -N*-M where
3672 * -N*M is INT_MIN will yield INT_MIN.
3673 * Since we don't support floating point, this is somewhat simpler.
3674 * Ideally, we'd return an error, but since we overflow for all other
3675 * arithmetic, consistency suggests otherwise, but what's the correct value
3676 * to use? There is none.
3677 * The C standard guarantees overflow for unsigned arithmetic but signed
3678 * overflow invokes undefined behaviour; in practice, this is overflow
3679 * except for converting INT_MIN to INT_MAX+1. We also can't guarantee
3680 * that long/longlong larger than int are available, or we could just work
3681 * with larger types. We should consider whether to guarantee 32bit eval
3682 * and 64-bit working variables, with errors returned. For now ...
3683 * So, the only SIGFPEs occur with a non-shrinking div/mod, thus -1; we
3684 * can just let the other invalid results occur otherwise, as they have
3685 * until now. For this one case, we can coerce.
3687 if (y == -1 && x == EXIM_ARITH_MIN && op != '*')
3690 debug_printf("Integer exception dodging: " PR_EXIM_ARITH "%c-1 coerced to " PR_EXIM_ARITH "\n",
3691 EXIM_ARITH_MIN, op, EXIM_ARITH_MAX);
3701 *error = (op == '/') ? US"divide by zero" : US"modulo by zero";
3717 static int_eximarith_t
3718 eval_op_sum(uschar **sptr, BOOL decimal, uschar **error)
3721 int_eximarith_t x = eval_op_mult(&s, decimal, error);
3724 while (*s == '+' || *s == '-')
3727 int_eximarith_t y = eval_op_mult(&s, decimal, error);
3729 if ( (x >= EXIM_ARITH_MAX/2 && x >= EXIM_ARITH_MAX/2)
3730 || (x <= -(EXIM_ARITH_MAX/2) && y <= -(EXIM_ARITH_MAX/2)))
3731 { /* over-conservative check */
3733 ? US"overflow in sum" : US"overflow in difference";
3736 if (op == '+') x += y; else x -= y;
3744 static int_eximarith_t
3745 eval_op_shift(uschar **sptr, BOOL decimal, uschar **error)
3748 int_eximarith_t x = eval_op_sum(&s, decimal, error);
3751 while ((*s == '<' || *s == '>') && s[1] == s[0])
3756 y = eval_op_sum(&s, decimal, error);
3757 if (*error != NULL) break;
3758 if (op == '<') x <<= y; else x >>= y;
3766 static int_eximarith_t
3767 eval_op_and(uschar **sptr, BOOL decimal, uschar **error)
3770 int_eximarith_t x = eval_op_shift(&s, decimal, error);
3777 y = eval_op_shift(&s, decimal, error);
3778 if (*error != NULL) break;
3787 static int_eximarith_t
3788 eval_op_xor(uschar **sptr, BOOL decimal, uschar **error)
3791 int_eximarith_t x = eval_op_and(&s, decimal, error);
3798 y = eval_op_and(&s, decimal, error);
3799 if (*error != NULL) break;
3808 static int_eximarith_t
3809 eval_op_or(uschar **sptr, BOOL decimal, uschar **error)
3812 int_eximarith_t x = eval_op_xor(&s, decimal, error);
3819 y = eval_op_xor(&s, decimal, error);
3820 if (*error != NULL) break;
3830 /*************************************************
3832 *************************************************/
3834 /* Returns either an unchanged string, or the expanded string in stacking pool
3835 store. Interpreted sequences are:
3837 \... normal escaping rules
3838 $name substitutes the variable
3840 ${op:string} operates on the expanded string value
3841 ${item{arg1}{arg2}...} expands the args and then does the business
3842 some literal args are not enclosed in {}
3844 There are now far too many operators and item types to make it worth listing
3845 them here in detail any more.
3847 We use an internal routine recursively to handle embedded substrings. The
3848 external function follows. The yield is NULL if the expansion failed, and there
3849 are two cases: if something collapsed syntactically, or if "fail" was given
3850 as the action on a lookup failure. These can be distinguished by looking at the
3851 variable expand_string_forcedfail, which is TRUE in the latter case.
3853 The skipping flag is set true when expanding a substring that isn't actually
3854 going to be used (after "if" or "lookup") and it prevents lookups from
3855 happening lower down.
3857 Store usage: At start, a store block of the length of the input plus 64
3858 is obtained. This is expanded as necessary by string_cat(), which might have to
3859 get a new block, or might be able to expand the original. At the end of the
3860 function we can release any store above that portion of the yield block that
3861 was actually used. In many cases this will be optimal.
3863 However: if the first item in the expansion is a variable name or header name,
3864 we reset the store before processing it; if the result is in fresh store, we
3865 use that without copying. This is helpful for expanding strings like
3866 $message_headers which can get very long.
3868 There's a problem if a ${dlfunc item has side-effects that cause allocation,
3869 since resetting the store at the end of the expansion will free store that was
3870 allocated by the plugin code as well as the slop after the expanded string. So
3871 we skip any resets if ${dlfunc } has been used. The same applies for ${acl }
3872 and, given the acl condition, ${if }. This is an unfortunate consequence of
3873 string expansion becoming too powerful.
3876 string the string to be expanded
3877 ket_ends true if expansion is to stop at }
3878 left if not NULL, a pointer to the first character after the
3879 expansion is placed here (typically used with ket_ends)
3880 skipping TRUE for recursive calls when the value isn't actually going
3881 to be used (to allow for optimisation)
3882 honour_dollar TRUE if $ is to be expanded,
3883 FALSE if it's just another character
3884 resetok_p if not NULL, pointer to flag - write FALSE if unsafe to reset
3887 Returns: NULL if expansion fails:
3888 expand_string_forcedfail is set TRUE if failure was forced
3889 expand_string_message contains a textual error message
3890 a pointer to the expanded string on success
3894 expand_string_internal(const uschar *string, BOOL ket_ends, const uschar **left,
3895 BOOL skipping, BOOL honour_dollar, BOOL *resetok_p)
3897 gstring * yield = string_get(Ustrlen(string) + 64);
3899 const uschar *s = string;
3900 uschar *save_expand_nstring[EXPAND_MAXN+1];
3901 int save_expand_nlength[EXPAND_MAXN+1];
3902 BOOL resetok = TRUE;
3906 debug_printf_indent(UTF8_DOWN_RIGHT "%s: %s\n",
3908 ? UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ "scanning"
3912 expand_string_forcedfail = FALSE;
3913 expand_string_message = US"";
3920 /* \ escapes the next character, which must exist, or else
3921 the expansion fails. There's a special escape, \N, which causes
3922 copying of the subject verbatim up to the next \N. Otherwise,
3923 the escapes are the standard set. */
3929 expand_string_message = US"\\ at end of string";
3935 const uschar * t = s + 2;
3936 for (s = t; *s != 0; s++) if (*s == '\\' && s[1] == 'N') break;
3937 yield = string_catn(yield, t, s - t);
3938 if (*s != 0) s += 2;
3944 ch[0] = string_interpret_escape(&s);
3946 yield = string_catn(yield, ch, 1);
3953 /* Anything other than $ is just copied verbatim, unless we are
3954 looking for a terminating } character. */
3957 if (ket_ends && *s == '}') break;
3959 if (*s != '$' || !honour_dollar)
3961 yield = string_catn(yield, s++, 1);
3965 /* No { after the $ - must be a plain name or a number for string
3966 match variable. There has to be a fudge for variables that are the
3967 names of header fields preceded by "$header_" because header field
3968 names can contain any printing characters except space and colon.
3969 For those that don't like typing this much, "$h_" is a synonym for
3970 "$header_". A non-existent header yields a NULL value; nothing is
3973 if (isalpha((*(++s))))
3979 s = read_name(name, sizeof(name), s, US"_");
3981 /* If this is the first thing to be expanded, release the pre-allocated
3985 g = store_get(sizeof(gstring));
3986 else if (yield->ptr == 0)
3988 if (resetok) store_reset(yield);
3990 g = store_get(sizeof(gstring)); /* alloc _before_ calling find_variable() */
3995 if (Ustrncmp(name, "h_", 2) == 0 ||
3996 Ustrncmp(name, "rh_", 3) == 0 ||
3997 Ustrncmp(name, "bh_", 3) == 0 ||
3998 Ustrncmp(name, "header_", 7) == 0 ||
3999 Ustrncmp(name, "rheader_", 8) == 0 ||
4000 Ustrncmp(name, "bheader_", 8) == 0)
4002 BOOL want_raw = (name[0] == 'r')? TRUE : FALSE;
4003 uschar *charset = (name[0] == 'b')? NULL : headers_charset;
4004 s = read_header_name(name, sizeof(name), s);
4005 value = find_header(name, FALSE, &newsize, want_raw, charset);
4007 /* If we didn't find the header, and the header contains a closing brace
4008 character, this may be a user error where the terminating colon
4009 has been omitted. Set a flag to adjust the error message in this case.
4010 But there is no error here - nothing gets inserted. */
4014 if (Ustrchr(name, '}') != NULL) malformed_header = TRUE;
4021 else if (!(value = find_variable(name, FALSE, skipping, &newsize)))
4023 expand_string_message =
4024 string_sprintf("unknown variable name \"%s\"", name);
4025 check_variable_error_message(name);
4029 /* If the data is known to be in a new buffer, newsize will be set to the
4030 size of that buffer. If this is the first thing in an expansion string,
4031 yield will be NULL; just point it at the new store instead of copying. Many
4032 expansion strings contain just one reference, so this is a useful
4033 optimization, especially for humungous headers. We need to use a gstring
4034 structure that is not allocated after that new-buffer, else a later store
4035 reset in the middle of the buffer will make it inaccessible. */
4037 len = Ustrlen(value);
4038 if (!yield && newsize != 0)
4041 yield->size = newsize;
4046 yield = string_catn(yield, value, len);
4054 s = read_cnumber(&n, s);
4055 if (n >= 0 && n <= expand_nmax)
4056 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4060 /* Otherwise, if there's no '{' after $ it's an error. */ /*}*/
4062 if (*s != '{') /*}*/
4064 expand_string_message = US"$ not followed by letter, digit, or {"; /*}*/
4068 /* After { there can be various things, but they all start with
4069 an initial word, except for a number for a string match variable. */
4071 if (isdigit((*(++s))))
4074 s = read_cnumber(&n, s); /*{*/
4077 expand_string_message = US"} expected after number";
4080 if (n >= 0 && n <= expand_nmax)
4081 yield = string_catn(yield, expand_nstring[n], expand_nlength[n]);
4087 expand_string_message = US"letter or digit expected after ${"; /*}*/
4091 /* Allow "-" in names to cater for substrings with negative
4092 arguments. Since we are checking for known names after { this is
4095 s = read_name(name, sizeof(name), s, US"_-");
4096 item_type = chop_match(name, item_table, nelem(item_table));
4100 /* Call an ACL from an expansion. We feed data in via $acl_arg1 - $acl_arg9.
4101 If the ACL returns accept or reject we return content set by "message ="
4102 There is currently no limit on recursion; this would have us call
4103 acl_check_internal() directly and get a current level from somewhere.
4104 See also the acl expansion condition ECOND_ACL and the traditional
4105 acl modifier ACLC_ACL.
4106 Assume that the function has side-effects on the store that must be preserved.
4110 /* ${acl {name} {arg1}{arg2}...} */
4112 uschar *sub[10]; /* name + arg1-arg9 (which must match number of acl_arg[]) */
4115 switch(read_subs(sub, nelem(sub), 1, &s, skipping, TRUE, US"acl",
4118 case 1: goto EXPAND_FAILED_CURLY;
4120 case 3: goto EXPAND_FAILED;
4122 if (skipping) continue;
4125 switch(eval_acl(sub, nelem(sub), &user_msg))
4130 debug_printf_indent("acl expansion yield: %s\n", user_msg);
4132 yield = string_cat(yield, user_msg);
4136 expand_string_forcedfail = TRUE;
4139 expand_string_message = string_sprintf("error from acl \"%s\"", sub[0]);
4144 case EITEM_AUTHRESULTS:
4145 /* ${authresults {mysystemname}} */
4149 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, skipping, TRUE, name,
4152 case 1: goto EXPAND_FAILED_CURLY;
4154 case 3: goto EXPAND_FAILED;
4157 yield = string_append(yield, 3,
4158 US"Authentication-Results: ", sub_arg[0], US"; none");
4161 yield = authres_local(yield, sub_arg[0]);
4162 yield = authres_iprev(yield);
4163 yield = authres_smtpauth(yield);
4165 yield = authres_spf(yield);
4167 #ifndef DISABLE_DKIM
4168 yield = authres_dkim(yield);
4170 #ifdef EXPERIMENTAL_DMARC
4171 yield = authres_dmarc(yield);
4173 #ifdef EXPERIMENTAL_ARC
4174 yield = authres_arc(yield);
4179 /* Handle conditionals - preserve the values of the numerical expansion
4180 variables in case they get changed by a regular expression match in the
4181 condition. If not, they retain their external settings. At the end
4182 of this "if" section, they get restored to their previous values. */
4187 const uschar *next_s;
4188 int save_expand_nmax =
4189 save_expand_strings(save_expand_nstring, save_expand_nlength);
4191 while (isspace(*s)) s++;
4192 next_s = eval_condition(s, &resetok, skipping ? NULL : &cond);
4193 if (next_s == NULL) goto EXPAND_FAILED; /* message already set */
4197 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
4198 "condition: %.*s\n",
4199 (int)(next_s - s), s);
4200 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
4201 UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
4203 cond ? "true" : "false");
4208 /* The handling of "yes" and "no" result strings is now in a separate
4209 function that is also used by ${lookup} and ${extract} and ${run}. */
4211 switch(process_yesno(
4212 skipping, /* were previously skipping */
4213 cond, /* success/failure indicator */
4214 lookup_value, /* value to reset for string2 */
4215 &s, /* input pointer */
4216 &yield, /* output pointer */
4217 US"if", /* condition type */
4220 case 1: goto EXPAND_FAILED; /* when all is well, the */
4221 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4224 /* Restore external setting of expansion variables for continuation
4227 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4228 save_expand_nlength);
4233 case EITEM_IMAPFOLDER:
4234 { /* ${imapfolder {name}{sep]{specials}} */
4238 switch(read_subs(sub_arg, nelem(sub_arg), 1, &s, skipping, TRUE, name,
4241 case 1: goto EXPAND_FAILED_CURLY;
4243 case 3: goto EXPAND_FAILED;
4246 if (sub_arg[1] == NULL) /* One argument */
4248 sub_arg[1] = US"/"; /* default separator */
4251 else if (Ustrlen(sub_arg[1]) != 1)
4253 expand_string_message =
4255 "IMAP folder separator must be one character, found \"%s\"",
4262 if (!(encoded = imap_utf7_encode(sub_arg[0], headers_charset,
4263 sub_arg[1][0], sub_arg[2], &expand_string_message)))
4265 yield = string_cat(yield, encoded);
4271 /* Handle database lookups unless locked out. If "skipping" is TRUE, we are
4272 expanding an internal string that isn't actually going to be used. All we
4273 need to do is check the syntax, so don't do a lookup at all. Preserve the
4274 values of the numerical expansion variables in case they get changed by a
4275 partial lookup. If not, they retain their external settings. At the end
4276 of this "lookup" section, they get restored to their previous values. */
4280 int stype, partial, affixlen, starflags;
4281 int expand_setup = 0;
4283 uschar *key, *filename;
4284 const uschar *affix;
4285 uschar *save_lookup_value = lookup_value;
4286 int save_expand_nmax =
4287 save_expand_strings(save_expand_nstring, save_expand_nlength);
4289 if ((expand_forbid & RDO_LOOKUP) != 0)
4291 expand_string_message = US"lookup expansions are not permitted";
4295 /* Get the key we are to look up for single-key+file style lookups.
4296 Otherwise set the key NULL pro-tem. */
4298 while (isspace(*s)) s++;
4299 if (*s == '{') /*}*/
4301 key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4302 if (!key) goto EXPAND_FAILED; /*{{*/
4305 expand_string_message = US"missing '}' after lookup key";
4306 goto EXPAND_FAILED_CURLY;
4308 while (isspace(*s)) s++;
4312 /* Find out the type of database */
4316 expand_string_message = US"missing lookup type";
4320 /* The type is a string that may contain special characters of various
4321 kinds. Allow everything except space or { to appear; the actual content
4322 is checked by search_findtype_partial. */ /*}*/
4324 while (*s != 0 && *s != '{' && !isspace(*s)) /*}*/
4326 if (nameptr < sizeof(name) - 1) name[nameptr++] = *s;
4330 while (isspace(*s)) s++;
4332 /* Now check for the individual search type and any partial or default
4333 options. Only those types that are actually in the binary are valid. */
4335 stype = search_findtype_partial(name, &partial, &affix, &affixlen,
4339 expand_string_message = search_error_message;
4343 /* Check that a key was provided for those lookup types that need it,
4344 and was not supplied for those that use the query style. */
4346 if (!mac_islookup(stype, lookup_querystyle|lookup_absfilequery))
4350 expand_string_message = string_sprintf("missing {key} for single-"
4351 "key \"%s\" lookup", name);
4359 expand_string_message = string_sprintf("a single key was given for "
4360 "lookup type \"%s\", which is not a single-key lookup type", name);
4365 /* Get the next string in brackets and expand it. It is the file name for
4366 single-key+file lookups, and the whole query otherwise. In the case of
4367 queries that also require a file name (e.g. sqlite), the file name comes
4372 expand_string_message = US"missing '{' for lookup file-or-query arg";
4373 goto EXPAND_FAILED_CURLY;
4375 filename = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
4376 if (filename == NULL) goto EXPAND_FAILED;
4379 expand_string_message = US"missing '}' closing lookup file-or-query arg";
4380 goto EXPAND_FAILED_CURLY;
4382 while (isspace(*s)) s++;
4384 /* If this isn't a single-key+file lookup, re-arrange the variables
4385 to be appropriate for the search_ functions. For query-style lookups,
4386 there is just a "key", and no file name. For the special query-style +
4387 file types, the query (i.e. "key") starts with a file name. */
4391 while (isspace(*filename)) filename++;
4394 if (mac_islookup(stype, lookup_querystyle))
4398 if (*filename != '/')
4400 expand_string_message = string_sprintf(
4401 "absolute file name expected for \"%s\" lookup", name);
4404 while (*key != 0 && !isspace(*key)) key++;
4405 if (*key != 0) *key++ = 0;
4409 /* If skipping, don't do the next bit - just lookup_value == NULL, as if
4410 the entry was not found. Note that there is no search_close() function.
4411 Files are left open in case of re-use. At suitable places in higher logic,
4412 search_tidyup() is called to tidy all open files. This can save opening
4413 the same file several times. However, files may also get closed when
4414 others are opened, if too many are open at once. The rule is that a
4415 handle should not be used after a second search_open().
4417 Request that a partial search sets up $1 and maybe $2 by passing
4418 expand_setup containing zero. If its value changes, reset expand_nmax,
4419 since new variables will have been set. Note that at the end of this
4420 "lookup" section, the old numeric variables are restored. */
4423 lookup_value = NULL;
4426 void *handle = search_open(filename, stype, 0, NULL, NULL);
4429 expand_string_message = search_error_message;
4432 lookup_value = search_find(handle, filename, key, partial, affix,
4433 affixlen, starflags, &expand_setup);
4434 if (search_find_defer)
4436 expand_string_message =
4437 string_sprintf("lookup of \"%s\" gave DEFER: %s",
4438 string_printing2(key, FALSE), search_error_message);
4441 if (expand_setup > 0) expand_nmax = expand_setup;
4444 /* The handling of "yes" and "no" result strings is now in a separate
4445 function that is also used by ${if} and ${extract}. */
4447 switch(process_yesno(
4448 skipping, /* were previously skipping */
4449 lookup_value != NULL, /* success/failure indicator */
4450 save_lookup_value, /* value to reset for string2 */
4451 &s, /* input pointer */
4452 &yield, /* output pointer */
4453 US"lookup", /* condition type */
4456 case 1: goto EXPAND_FAILED; /* when all is well, the */
4457 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
4460 /* Restore external setting of expansion variables for carrying on
4461 at this level, and continue. */
4463 restore_expand_strings(save_expand_nmax, save_expand_nstring,
4464 save_expand_nlength);
4468 /* If Perl support is configured, handle calling embedded perl subroutines,
4469 unless locked out at this time. Syntax is ${perl{sub}} or ${perl{sub}{arg}}
4470 or ${perl{sub}{arg1}{arg2}} or up to a maximum of EXIM_PERL_MAX_ARGS
4471 arguments (defined below). */
4473 #define EXIM_PERL_MAX_ARGS 8
4477 expand_string_message = US"\"${perl\" encountered, but this facility " /*}*/
4478 "is not included in this binary";
4481 #else /* EXIM_PERL */
4483 uschar *sub_arg[EXIM_PERL_MAX_ARGS + 2];
4486 if ((expand_forbid & RDO_PERL) != 0)
4488 expand_string_message = US"Perl calls are not permitted";
4492 switch(read_subs(sub_arg, EXIM_PERL_MAX_ARGS + 1, 1, &s, skipping, TRUE,
4493 US"perl", &resetok))
4495 case 1: goto EXPAND_FAILED_CURLY;
4497 case 3: goto EXPAND_FAILED;
4500 /* If skipping, we don't actually do anything */
4502 if (skipping) continue;
4504 /* Start the interpreter if necessary */
4506 if (!opt_perl_started)
4509 if (opt_perl_startup == NULL)
4511 expand_string_message = US"A setting of perl_startup is needed when "
4512 "using the Perl interpreter";
4515 DEBUG(D_any) debug_printf("Starting Perl interpreter\n");
4516 initerror = init_perl(opt_perl_startup);
4517 if (initerror != NULL)
4519 expand_string_message =
4520 string_sprintf("error in perl_startup code: %s\n", initerror);
4523 opt_perl_started = TRUE;
4526 /* Call the function */
4528 sub_arg[EXIM_PERL_MAX_ARGS + 1] = NULL;
4529 new_yield = call_perl_cat(yield, &expand_string_message,
4530 sub_arg[0], sub_arg + 1);
4532 /* NULL yield indicates failure; if the message pointer has been set to
4533 NULL, the yield was undef, indicating a forced failure. Otherwise the
4534 message will indicate some kind of Perl error. */
4536 if (new_yield == NULL)
4538 if (expand_string_message == NULL)
4540 expand_string_message =
4541 string_sprintf("Perl subroutine \"%s\" returned undef to force "
4542 "failure", sub_arg[0]);
4543 expand_string_forcedfail = TRUE;
4548 /* Yield succeeded. Ensure forcedfail is unset, just in case it got
4549 set during a callback from Perl. */
4551 expand_string_forcedfail = FALSE;
4555 #endif /* EXIM_PERL */
4557 /* Transform email address to "prvs" scheme to use
4558 as BATV-signed return path */
4565 switch(read_subs(sub_arg, 3, 2, &s, skipping, TRUE, US"prvs", &resetok))
4567 case 1: goto EXPAND_FAILED_CURLY;
4569 case 3: goto EXPAND_FAILED;
4572 /* If skipping, we don't actually do anything */
4573 if (skipping) continue;
4575 /* sub_arg[0] is the address */
4576 if ( !(domain = Ustrrchr(sub_arg[0],'@'))
4577 || domain == sub_arg[0] || Ustrlen(domain) == 1)
4579 expand_string_message = US"prvs first argument must be a qualified email address";
4583 /* Calculate the hash. The third argument must be a single-digit
4584 key number, or unset. */
4587 && (!isdigit(sub_arg[2][0]) || sub_arg[2][1] != 0))
4589 expand_string_message = US"prvs third argument must be a single digit";
4593 p = prvs_hmac_sha1(sub_arg[0], sub_arg[1], sub_arg[2], prvs_daystamp(7));
4596 expand_string_message = US"prvs hmac-sha1 conversion failed";
4600 /* Now separate the domain from the local part */
4603 yield = string_catn(yield, US"prvs=", 5);
4604 yield = string_catn(yield, sub_arg[2] ? sub_arg[2] : US"0", 1);
4605 yield = string_catn(yield, prvs_daystamp(7), 3);
4606 yield = string_catn(yield, p, 6);
4607 yield = string_catn(yield, US"=", 1);
4608 yield = string_cat (yield, sub_arg[0]);
4609 yield = string_catn(yield, US"@", 1);
4610 yield = string_cat (yield, domain);
4615 /* Check a prvs-encoded address for validity */
4617 case EITEM_PRVSCHECK:
4624 /* TF: Ugliness: We want to expand parameter 1 first, then set
4625 up expansion variables that are used in the expansion of
4626 parameter 2. So we clone the string for the first
4627 expansion, where we only expand parameter 1.
4629 PH: Actually, that isn't necessary. The read_subs() function is
4630 designed to work this way for the ${if and ${lookup expansions. I've
4634 /* Reset expansion variables */
4635 prvscheck_result = NULL;
4636 prvscheck_address = NULL;
4637 prvscheck_keynum = NULL;
4639 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4641 case 1: goto EXPAND_FAILED_CURLY;
4643 case 3: goto EXPAND_FAILED;
4646 re = regex_must_compile(US"^prvs\\=([0-9])([0-9]{3})([A-F0-9]{6})\\=(.+)\\@(.+)$",
4649 if (regex_match_and_setup(re,sub_arg[0],0,-1))
4651 uschar *local_part = string_copyn(expand_nstring[4],expand_nlength[4]);
4652 uschar *key_num = string_copyn(expand_nstring[1],expand_nlength[1]);
4653 uschar *daystamp = string_copyn(expand_nstring[2],expand_nlength[2]);
4654 uschar *hash = string_copyn(expand_nstring[3],expand_nlength[3]);
4655 uschar *domain = string_copyn(expand_nstring[5],expand_nlength[5]);
4657 DEBUG(D_expand) debug_printf_indent("prvscheck localpart: %s\n", local_part);
4658 DEBUG(D_expand) debug_printf_indent("prvscheck key number: %s\n", key_num);
4659 DEBUG(D_expand) debug_printf_indent("prvscheck daystamp: %s\n", daystamp);
4660 DEBUG(D_expand) debug_printf_indent("prvscheck hash: %s\n", hash);
4661 DEBUG(D_expand) debug_printf_indent("prvscheck domain: %s\n", domain);
4663 /* Set up expansion variables */
4664 g = string_cat (NULL, local_part);
4665 g = string_catn(g, US"@", 1);
4666 g = string_cat (g, domain);
4667 prvscheck_address = string_from_gstring(g);
4668 prvscheck_keynum = string_copy(key_num);
4670 /* Now expand the second argument */
4671 switch(read_subs(sub_arg, 1, 1, &s, skipping, FALSE, US"prvs", &resetok))
4673 case 1: goto EXPAND_FAILED_CURLY;
4675 case 3: goto EXPAND_FAILED;
4678 /* Now we have the key and can check the address. */
4680 p = prvs_hmac_sha1(prvscheck_address, sub_arg[0], prvscheck_keynum,
4685 expand_string_message = US"hmac-sha1 conversion failed";
4689 DEBUG(D_expand) debug_printf_indent("prvscheck: received hash is %s\n", hash);
4690 DEBUG(D_expand) debug_printf_indent("prvscheck: own hash is %s\n", p);
4692 if (Ustrcmp(p,hash) == 0)
4694 /* Success, valid BATV address. Now check the expiry date. */
4695 uschar *now = prvs_daystamp(0);
4696 unsigned int inow = 0,iexpire = 1;
4698 (void)sscanf(CS now,"%u",&inow);
4699 (void)sscanf(CS daystamp,"%u",&iexpire);
4701 /* When "iexpire" is < 7, a "flip" has occured.
4702 Adjust "inow" accordingly. */
4703 if ( (iexpire < 7) && (inow >= 993) ) inow = 0;
4705 if (iexpire >= inow)
4707 prvscheck_result = US"1";
4708 DEBUG(D_expand) debug_printf_indent("prvscheck: success, $pvrs_result set to 1\n");
4712 prvscheck_result = NULL;
4713 DEBUG(D_expand) debug_printf_indent("prvscheck: signature expired, $pvrs_result unset\n");
4718 prvscheck_result = NULL;
4719 DEBUG(D_expand) debug_printf_indent("prvscheck: hash failure, $pvrs_result unset\n");
4722 /* Now expand the final argument. We leave this till now so that
4723 it can include $prvscheck_result. */
4725 switch(read_subs(sub_arg, 1, 0, &s, skipping, TRUE, US"prvs", &resetok))
4727 case 1: goto EXPAND_FAILED_CURLY;
4729 case 3: goto EXPAND_FAILED;
4732 yield = string_cat(yield,
4733 !sub_arg[0] || !*sub_arg[0] ? prvscheck_address : sub_arg[0]);
4735 /* Reset the "internal" variables afterwards, because they are in
4736 dynamic store that will be reclaimed if the expansion succeeded. */
4738 prvscheck_address = NULL;
4739 prvscheck_keynum = NULL;
4742 /* Does not look like a prvs encoded address, return the empty string.
4743 We need to make sure all subs are expanded first, so as to skip over
4746 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"prvs", &resetok))
4748 case 1: goto EXPAND_FAILED_CURLY;
4750 case 3: goto EXPAND_FAILED;
4756 /* Handle "readfile" to insert an entire file */
4758 case EITEM_READFILE:
4763 if ((expand_forbid & RDO_READFILE) != 0)
4765 expand_string_message = US"file insertions are not permitted";
4769 switch(read_subs(sub_arg, 2, 1, &s, skipping, TRUE, US"readfile", &resetok))
4771 case 1: goto EXPAND_FAILED_CURLY;
4773 case 3: goto EXPAND_FAILED;
4776 /* If skipping, we don't actually do anything */
4778 if (skipping) continue;
4780 /* Open the file and read it */
4782 if (!(f = Ufopen(sub_arg[0], "rb")))
4784 expand_string_message = string_open_failed(errno, "%s", sub_arg[0]);
4788 yield = cat_file(f, yield, sub_arg[1]);
4793 /* Handle "readsocket" to insert data from a socket, either
4794 Inet or Unix domain */
4796 case EITEM_READSOCK:
4800 int save_ptr = yield->ptr;
4804 BOOL do_shutdown = TRUE;
4807 if (expand_forbid & RDO_READSOCK)
4809 expand_string_message = US"socket insertions are not permitted";
4813 /* Read up to 4 arguments, but don't do the end of item check afterwards,
4814 because there may be a string for expansion on failure. */
4816 switch(read_subs(sub_arg, 4, 2, &s, skipping, FALSE, US"readsocket", &resetok))
4818 case 1: goto EXPAND_FAILED_CURLY;
4819 case 2: /* Won't occur: no end check */
4820 case 3: goto EXPAND_FAILED;
4823 /* Grab the request string, if any */
4825 reqstr.data = sub_arg[1];
4826 reqstr.len = Ustrlen(sub_arg[1]);
4828 /* Sort out timeout, if given. The second arg is a list with the first element
4829 being a time value. Any more are options of form "name=value". Currently the
4830 only option recognised is "shutdown". */
4834 const uschar * list = sub_arg[2];
4838 item = string_nextinlist(&list, &sep, NULL, 0);
4839 if ((timeout = readconf_readtime(item, 0, FALSE)) < 0)
4841 expand_string_message = string_sprintf("bad time value %s", item);
4845 while ((item = string_nextinlist(&list, &sep, NULL, 0)))
4846 if (Ustrncmp(item, US"shutdown=", 9) == 0)
4847 if (Ustrcmp(item + 9, US"no") == 0)
4848 do_shutdown = FALSE;
4850 else sub_arg[3] = NULL; /* No eol if no timeout */
4852 /* If skipping, we don't actually do anything. Otherwise, arrange to
4853 connect to either an IP or a Unix socket. */
4857 /* Handle an IP (internet) domain */
4859 if (Ustrncmp(sub_arg[0], "inet:", 5) == 0)
4862 uschar * server_name = sub_arg[0] + 5;
4863 uschar * port_name = Ustrrchr(server_name, ':');
4865 /* Sort out the port */
4869 expand_string_message =
4870 string_sprintf("missing port for readsocket %s", sub_arg[0]);
4873 *port_name++ = 0; /* Terminate server name */
4875 if (isdigit(*port_name))
4878 port = Ustrtol(port_name, &end, 0);
4879 if (end != port_name + Ustrlen(port_name))
4881 expand_string_message =
4882 string_sprintf("invalid port number %s", port_name);
4888 struct servent *service_info = getservbyname(CS port_name, "tcp");
4891 expand_string_message = string_sprintf("unknown port \"%s\"",
4895 port = ntohs(service_info->s_port);
4898 fd = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
4899 timeout, NULL, &expand_string_message, &reqstr);
4900 callout_address = NULL;
4906 /* Handle a Unix domain socket */
4910 struct sockaddr_un sockun; /* don't call this "sun" ! */
4913 if ((fd = socket(PF_UNIX, SOCK_STREAM, 0)) == -1)
4915 expand_string_message = string_sprintf("failed to create socket: %s",
4920 sockun.sun_family = AF_UNIX;
4921 sprintf(sockun.sun_path, "%.*s", (int)(sizeof(sockun.sun_path)-1),
4924 sigalrm_seen = FALSE;
4926 rc = connect(fd, (struct sockaddr *)(&sockun), sizeof(sockun));
4930 expand_string_message = US "socket connect timed out";
4935 expand_string_message = string_sprintf("failed to connect to socket "
4936 "%s: %s", sub_arg[0], strerror(errno));
4941 DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
4943 /* Allow sequencing of test actions */
4944 if (running_in_test_harness) millisleep(100);
4946 /* Write the request string, if not empty or already done */
4950 DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
4952 if (write(fd, reqstr.data, reqstr.len) != reqstr.len)
4954 expand_string_message = string_sprintf("request write to socket "
4955 "failed: %s", strerror(errno));
4960 /* Shut down the sending side of the socket. This helps some servers to
4961 recognise that it is their turn to do some work. Just in case some
4962 system doesn't have this function, make it conditional. */
4965 if (do_shutdown) shutdown(fd, SHUT_WR);
4968 if (running_in_test_harness) millisleep(100);
4970 /* Now we need to read from the socket, under a timeout. The function
4971 that reads a file can be used. */
4973 f = fdopen(fd, "rb");
4974 sigalrm_seen = FALSE;
4976 yield = cat_file(f, yield, sub_arg[3]);
4980 /* After a timeout, we restore the pointer in the result, that is,
4981 make sure we add nothing from the socket. */
4985 yield->ptr = save_ptr;
4986 expand_string_message = US "socket read timed out";
4991 /* The whole thing has worked (or we were skipping). If there is a
4992 failure string following, we need to skip it. */
4996 if (expand_string_internal(s+1, TRUE, &s, TRUE, TRUE, &resetok) == NULL)
5000 expand_string_message = US"missing '}' closing failstring for readsocket";
5001 goto EXPAND_FAILED_CURLY;
5003 while (isspace(*s)) s++;
5009 expand_string_message = US"missing '}' closing readsocket";
5010 goto EXPAND_FAILED_CURLY;
5014 /* Come here on failure to create socket, connect socket, write to the
5015 socket, or timeout on reading. If another substring follows, expand and
5016 use it. Otherwise, those conditions give expand errors. */
5019 if (*s != '{') goto EXPAND_FAILED;
5020 DEBUG(D_any) debug_printf("%s\n", expand_string_message);
5021 if (!(arg = expand_string_internal(s+1, TRUE, &s, FALSE, TRUE, &resetok)))
5023 yield = string_cat(yield, arg);
5026 expand_string_message = US"missing '}' closing failstring for readsocket";
5027 goto EXPAND_FAILED_CURLY;
5029 while (isspace(*s)) s++;
5033 /* Handle "run" to execute a program. */
5039 const uschar **argv;
5043 if ((expand_forbid & RDO_RUN) != 0)
5045 expand_string_message = US"running a command is not permitted";
5049 while (isspace(*s)) s++;
5052 expand_string_message = US"missing '{' for command arg of run";
5053 goto EXPAND_FAILED_CURLY;
5055 arg = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5056 if (arg == NULL) goto EXPAND_FAILED;
5057 while (isspace(*s)) s++;
5060 expand_string_message = US"missing '}' closing command arg of run";
5061 goto EXPAND_FAILED_CURLY;
5064 if (skipping) /* Just pretend it worked when we're skipping */
5067 lookup_value = NULL;
5071 if (!transport_set_up_command(&argv, /* anchor for arg list */
5072 arg, /* raw command */
5073 FALSE, /* don't expand the arguments */
5074 0, /* not relevant when... */
5075 NULL, /* no transporting address */
5076 US"${run} expansion", /* for error messages */
5077 &expand_string_message)) /* where to put error message */
5080 /* Create the child process, making it a group leader. */
5082 if ((pid = child_open(USS argv, NULL, 0077, &fd_in, &fd_out, TRUE)) < 0)
5084 expand_string_message =
5085 string_sprintf("couldn't create child process: %s", strerror(errno));
5089 /* Nothing is written to the standard input. */
5093 /* Read the pipe to get the command's output into $value (which is kept
5094 in lookup_value). Read during execution, so that if the output exceeds
5095 the OS pipe buffer limit, we don't block forever. Remember to not release
5096 memory just allocated for $value. */
5099 f = fdopen(fd_out, "rb");
5100 sigalrm_seen = FALSE;
5102 lookup_value = string_from_gstring(cat_file(f, NULL, NULL));
5106 /* Wait for the process to finish, applying the timeout, and inspect its
5107 return code for serious disasters. Simple non-zero returns are passed on.
5110 if (sigalrm_seen || (runrc = child_close(pid, 30)) < 0)
5112 if (sigalrm_seen || runrc == -256)
5114 expand_string_message = string_sprintf("command timed out");
5115 killpg(pid, SIGKILL); /* Kill the whole process group */
5118 else if (runrc == -257)
5119 expand_string_message = string_sprintf("wait() failed: %s",
5123 expand_string_message = string_sprintf("command killed by signal %d",
5130 /* Process the yes/no strings; $value may be useful in both cases */
5132 switch(process_yesno(
5133 skipping, /* were previously skipping */
5134 runrc == 0, /* success/failure indicator */
5135 lookup_value, /* value to reset for string2 */
5136 &s, /* input pointer */
5137 &yield, /* output pointer */
5138 US"run", /* condition type */
5141 case 1: goto EXPAND_FAILED; /* when all is well, the */
5142 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5148 /* Handle character translation for "tr" */
5152 int oldptr = yield->ptr;
5156 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"tr", &resetok))
5158 case 1: goto EXPAND_FAILED_CURLY;
5160 case 3: goto EXPAND_FAILED;
5163 yield = string_cat(yield, sub[0]);
5164 o2m = Ustrlen(sub[2]) - 1;
5166 if (o2m >= 0) for (; oldptr < yield->ptr; oldptr++)
5168 uschar *m = Ustrrchr(sub[1], yield->s[oldptr]);
5172 yield->s[oldptr] = sub[2][(o < o2m)? o : o2m];
5179 /* Handle "hash", "length", "nhash", and "substr" when they are given with
5180 expanded arguments. */
5190 int val[2] = { 0, -1 };
5193 /* "length" takes only 2 arguments whereas the others take 2 or 3.
5194 Ensure that sub[2] is set in the ${length } case. */
5197 switch(read_subs(sub, (item_type == EITEM_LENGTH)? 2:3, 2, &s, skipping,
5198 TRUE, name, &resetok))
5200 case 1: goto EXPAND_FAILED_CURLY;
5202 case 3: goto EXPAND_FAILED;
5205 /* Juggle the arguments if there are only two of them: always move the
5206 string to the last position and make ${length{n}{str}} equivalent to
5207 ${substr{0}{n}{str}}. See the defaults for val[] above. */
5213 if (item_type == EITEM_LENGTH)
5220 for (i = 0; i < 2; i++)
5222 if (sub[i] == NULL) continue;
5223 val[i] = (int)Ustrtol(sub[i], &ret, 10);
5224 if (*ret != 0 || (i != 0 && val[i] < 0))
5226 expand_string_message = string_sprintf("\"%s\" is not a%s number "
5227 "(in \"%s\" expansion)", sub[i], (i != 0)? " positive" : "", name);
5233 (item_type == EITEM_HASH)?
5234 compute_hash(sub[2], val[0], val[1], &len) :
5235 (item_type == EITEM_NHASH)?
5236 compute_nhash(sub[2], val[0], val[1], &len) :
5237 extract_substr(sub[2], val[0], val[1], &len);
5239 if (ret == NULL) goto EXPAND_FAILED;
5240 yield = string_catn(yield, ret, len);
5244 /* Handle HMAC computation: ${hmac{<algorithm>}{<secret>}{<text>}}
5245 This code originally contributed by Steve Haslam. It currently supports
5246 the use of MD5 and SHA-1 hashes.
5248 We need some workspace that is large enough to handle all the supported
5249 hash types. Use macros to set the sizes rather than be too elaborate. */
5251 #define MAX_HASHLEN 20
5252 #define MAX_HASHBLOCKLEN 64
5261 int hashlen; /* Number of octets for the hash algorithm's output */
5262 int hashblocklen; /* Number of octets the hash algorithm processes */
5264 unsigned int keylen;
5266 uschar keyhash[MAX_HASHLEN];
5267 uschar innerhash[MAX_HASHLEN];
5268 uschar finalhash[MAX_HASHLEN];
5269 uschar finalhash_hex[2*MAX_HASHLEN];
5270 uschar innerkey[MAX_HASHBLOCKLEN];
5271 uschar outerkey[MAX_HASHBLOCKLEN];
5273 switch (read_subs(sub, 3, 3, &s, skipping, TRUE, name, &resetok))
5275 case 1: goto EXPAND_FAILED_CURLY;
5277 case 3: goto EXPAND_FAILED;
5282 if (Ustrcmp(sub[0], "md5") == 0)
5285 use_base = &md5_base;
5289 else if (Ustrcmp(sub[0], "sha1") == 0)
5292 use_base = &sha1_ctx;
5298 expand_string_message =
5299 string_sprintf("hmac algorithm \"%s\" is not recognised", sub[0]);
5304 keylen = Ustrlen(keyptr);
5306 /* If the key is longer than the hash block length, then hash the key
5309 if (keylen > hashblocklen)
5311 chash_start(type, use_base);
5312 chash_end(type, use_base, keyptr, keylen, keyhash);
5317 /* Now make the inner and outer key values */
5319 memset(innerkey, 0x36, hashblocklen);
5320 memset(outerkey, 0x5c, hashblocklen);
5322 for (i = 0; i < keylen; i++)
5324 innerkey[i] ^= keyptr[i];
5325 outerkey[i] ^= keyptr[i];
5328 /* Now do the hashes */
5330 chash_start(type, use_base);
5331 chash_mid(type, use_base, innerkey);
5332 chash_end(type, use_base, sub[2], Ustrlen(sub[2]), innerhash);
5334 chash_start(type, use_base);
5335 chash_mid(type, use_base, outerkey);
5336 chash_end(type, use_base, innerhash, hashlen, finalhash);
5338 /* Encode the final hash as a hex string */
5341 for (i = 0; i < hashlen; i++)
5343 *p++ = hex_digits[(finalhash[i] & 0xf0) >> 4];
5344 *p++ = hex_digits[finalhash[i] & 0x0f];
5347 DEBUG(D_any) debug_printf("HMAC[%s](%.*s,%s)=%.*s\n",
5348 sub[0], (int)keylen, keyptr, sub[2], hashlen*2, finalhash_hex);
5350 yield = string_catn(yield, finalhash_hex, hashlen*2);
5355 /* Handle global substitution for "sg" - like Perl's s/xxx/yyy/g operator.
5356 We have to save the numerical variables and restore them afterwards. */
5361 int moffset, moffsetextra, slen;
5364 const uschar *rerror;
5367 int save_expand_nmax =
5368 save_expand_strings(save_expand_nstring, save_expand_nlength);
5370 switch(read_subs(sub, 3, 3, &s, skipping, TRUE, US"sg", &resetok))
5372 case 1: goto EXPAND_FAILED_CURLY;
5374 case 3: goto EXPAND_FAILED;
5377 /* Compile the regular expression */
5379 re = pcre_compile(CS sub[1], PCRE_COPT, (const char **)&rerror, &roffset,
5384 expand_string_message = string_sprintf("regular expression error in "
5385 "\"%s\": %s at offset %d", sub[1], rerror, roffset);
5389 /* Now run a loop to do the substitutions as often as necessary. It ends
5390 when there are no more matches. Take care over matches of the null string;
5391 do the same thing as Perl does. */
5394 slen = Ustrlen(sub[0]);
5395 moffset = moffsetextra = 0;
5400 int ovector[3*(EXPAND_MAXN+1)];
5401 int n = pcre_exec(re, NULL, CS subject, slen, moffset + moffsetextra,
5402 PCRE_EOPT | emptyopt, ovector, nelem(ovector));
5406 /* No match - if we previously set PCRE_NOTEMPTY after a null match, this
5407 is not necessarily the end. We want to repeat the match from one
5408 character further along, but leaving the basic offset the same (for
5409 copying below). We can't be at the end of the string - that was checked
5410 before setting PCRE_NOTEMPTY. If PCRE_NOTEMPTY is not set, we are
5411 finished; copy the remaining string and end the loop. */
5421 yield = string_catn(yield, subject+moffset, slen-moffset);
5425 /* Match - set up for expanding the replacement. */
5427 if (n == 0) n = EXPAND_MAXN + 1;
5429 for (nn = 0; nn < n*2; nn += 2)
5431 expand_nstring[expand_nmax] = subject + ovector[nn];
5432 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
5436 /* Copy the characters before the match, plus the expanded insertion. */
5438 yield = string_catn(yield, subject + moffset, ovector[0] - moffset);
5439 insert = expand_string(sub[2]);
5440 if (insert == NULL) goto EXPAND_FAILED;
5441 yield = string_cat(yield, insert);
5443 moffset = ovector[1];
5447 /* If we have matched an empty string, first check to see if we are at
5448 the end of the subject. If so, the loop is over. Otherwise, mimic
5449 what Perl's /g options does. This turns out to be rather cunning. First
5450 we set PCRE_NOTEMPTY and PCRE_ANCHORED and try the match a non-empty
5451 string at the same point. If this fails (picked up above) we advance to
5452 the next character. */
5454 if (ovector[0] == ovector[1])
5456 if (ovector[0] == slen) break;
5457 emptyopt = PCRE_NOTEMPTY | PCRE_ANCHORED;
5461 /* All done - restore numerical variables. */
5463 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5464 save_expand_nlength);
5468 /* Handle keyed and numbered substring extraction. If the first argument
5469 consists entirely of digits, then a numerical extraction is assumed. */
5475 int field_number = 1;
5476 BOOL field_number_set = FALSE;
5477 uschar *save_lookup_value = lookup_value;
5479 int save_expand_nmax =
5480 save_expand_strings(save_expand_nstring, save_expand_nlength);
5482 /* While skipping we cannot rely on the data for expansions being
5483 available (eg. $item) hence cannot decide on numeric vs. keyed.
5484 Read a maximum of 5 arguments (including the yes/no) */
5488 while (isspace(*s)) s++;
5489 for (j = 5; j > 0 && *s == '{'; j--)
5491 if (!expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok))
5492 goto EXPAND_FAILED; /*{*/
5495 expand_string_message = US"missing '{' for arg of extract";
5496 goto EXPAND_FAILED_CURLY;
5498 while (isspace(*s)) s++;
5500 if ( Ustrncmp(s, "fail", 4) == 0
5501 && (s[4] == '}' || s[4] == ' ' || s[4] == '\t' || !s[4])
5505 while (isspace(*s)) s++;
5509 expand_string_message = US"missing '}' closing extract";
5510 goto EXPAND_FAILED_CURLY;
5514 else for (i = 0, j = 2; i < j; i++) /* Read the proper number of arguments */
5516 while (isspace(*s)) s++;
5517 if (*s == '{') /*}*/
5519 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5520 if (sub[i] == NULL) goto EXPAND_FAILED; /*{*/
5523 expand_string_message = string_sprintf(
5524 "missing '}' closing arg %d of extract", i+1);
5525 goto EXPAND_FAILED_CURLY;
5528 /* After removal of leading and trailing white space, the first
5529 argument must not be empty; if it consists entirely of digits
5530 (optionally preceded by a minus sign), this is a numerical
5531 extraction, and we expect 3 arguments. */
5539 while (isspace(*p)) p++;
5543 while (len > 0 && isspace(p[len-1])) len--;
5548 expand_string_message = US"first argument of \"extract\" must "
5558 while (*p != 0 && isdigit(*p)) x = x * 10 + *p++ - '0';
5562 j = 3; /* Need 3 args */
5563 field_number_set = TRUE;
5569 expand_string_message = string_sprintf(
5570 "missing '{' for arg %d of extract", i+1);
5571 goto EXPAND_FAILED_CURLY;
5575 /* Extract either the numbered or the keyed substring into $value. If
5576 skipping, just pretend the extraction failed. */
5578 lookup_value = skipping? NULL : field_number_set?
5579 expand_gettokened(field_number, sub[1], sub[2]) :
5580 expand_getkeyed(sub[0], sub[1]);
5582 /* If no string follows, $value gets substituted; otherwise there can
5583 be yes/no strings, as for lookup or if. */
5585 switch(process_yesno(
5586 skipping, /* were previously skipping */
5587 lookup_value != NULL, /* success/failure indicator */
5588 save_lookup_value, /* value to reset for string2 */
5589 &s, /* input pointer */
5590 &yield, /* output pointer */
5591 US"extract", /* condition type */
5594 case 1: goto EXPAND_FAILED; /* when all is well, the */
5595 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5598 /* All done - restore numerical variables. */
5600 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5601 save_expand_nlength);
5606 /* return the Nth item from a list */
5608 case EITEM_LISTEXTRACT:
5611 int field_number = 1;
5612 uschar *save_lookup_value = lookup_value;
5614 int save_expand_nmax =
5615 save_expand_strings(save_expand_nstring, save_expand_nlength);
5617 /* Read the field & list arguments */
5619 for (i = 0; i < 2; i++)
5621 while (isspace(*s)) s++;
5622 if (*s != '{') /*}*/
5624 expand_string_message = string_sprintf(
5625 "missing '{' for arg %d of listextract", i+1);
5626 goto EXPAND_FAILED_CURLY;
5629 sub[i] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5630 if (!sub[i]) goto EXPAND_FAILED; /*{*/
5633 expand_string_message = string_sprintf(
5634 "missing '}' closing arg %d of listextract", i+1);
5635 goto EXPAND_FAILED_CURLY;
5638 /* After removal of leading and trailing white space, the first
5639 argument must be numeric and nonempty. */
5647 while (isspace(*p)) p++;
5651 while (len > 0 && isspace(p[len-1])) len--;
5654 if (!*p && !skipping)
5656 expand_string_message = US"first argument of \"listextract\" must "
5666 while (*p && isdigit(*p)) x = x * 10 + *p++ - '0';
5669 expand_string_message = US"first argument of \"listextract\" must "
5677 /* Extract the numbered element into $value. If
5678 skipping, just pretend the extraction failed. */
5680 lookup_value = skipping? NULL : expand_getlistele(field_number, sub[1]);
5682 /* If no string follows, $value gets substituted; otherwise there can
5683 be yes/no strings, as for lookup or if. */
5685 switch(process_yesno(
5686 skipping, /* were previously skipping */
5687 lookup_value != NULL, /* success/failure indicator */
5688 save_lookup_value, /* value to reset for string2 */
5689 &s, /* input pointer */
5690 &yield, /* output pointer */
5691 US"listextract", /* condition type */
5694 case 1: goto EXPAND_FAILED; /* when all is well, the */
5695 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5698 /* All done - restore numerical variables. */
5700 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5701 save_expand_nlength);
5707 case EITEM_CERTEXTRACT:
5709 uschar *save_lookup_value = lookup_value;
5711 int save_expand_nmax =
5712 save_expand_strings(save_expand_nstring, save_expand_nlength);
5714 /* Read the field argument */
5715 while (isspace(*s)) s++;
5716 if (*s != '{') /*}*/
5718 expand_string_message = US"missing '{' for field arg of certextract";
5719 goto EXPAND_FAILED_CURLY;
5721 sub[0] = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
5722 if (!sub[0]) goto EXPAND_FAILED; /*{*/
5725 expand_string_message = US"missing '}' closing field arg of certextract";
5726 goto EXPAND_FAILED_CURLY;
5728 /* strip spaces fore & aft */
5733 while (isspace(*p)) p++;
5737 while (len > 0 && isspace(p[len-1])) len--;
5741 /* inspect the cert argument */
5742 while (isspace(*s)) s++;
5743 if (*s != '{') /*}*/
5745 expand_string_message = US"missing '{' for cert variable arg of certextract";
5746 goto EXPAND_FAILED_CURLY;
5750 expand_string_message = US"second argument of \"certextract\" must "
5751 "be a certificate variable";
5754 sub[1] = expand_string_internal(s+1, TRUE, &s, skipping, FALSE, &resetok);
5755 if (!sub[1]) goto EXPAND_FAILED; /*{*/
5758 expand_string_message = US"missing '}' closing cert variable arg of certextract";
5759 goto EXPAND_FAILED_CURLY;
5763 lookup_value = NULL;
5766 lookup_value = expand_getcertele(sub[0], sub[1]);
5767 if (*expand_string_message) goto EXPAND_FAILED;
5769 switch(process_yesno(
5770 skipping, /* were previously skipping */
5771 lookup_value != NULL, /* success/failure indicator */
5772 save_lookup_value, /* value to reset for string2 */
5773 &s, /* input pointer */
5774 &yield, /* output pointer */
5775 US"certextract", /* condition type */
5778 case 1: goto EXPAND_FAILED; /* when all is well, the */
5779 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
5782 restore_expand_strings(save_expand_nmax, save_expand_nstring,
5783 save_expand_nlength);
5786 #endif /*SUPPORT_TLS*/
5788 /* Handle list operations */
5795 int save_ptr = yield->ptr;
5796 uschar outsep[2] = { '\0', '\0' };
5797 const uschar *list, *expr, *temp;
5798 uschar *save_iterate_item = iterate_item;
5799 uschar *save_lookup_value = lookup_value;
5801 while (isspace(*s)) s++;
5804 expand_string_message =
5805 string_sprintf("missing '{' for first arg of %s", name);
5806 goto EXPAND_FAILED_CURLY;
5809 list = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5810 if (list == NULL) goto EXPAND_FAILED;
5813 expand_string_message =
5814 string_sprintf("missing '}' closing first arg of %s", name);
5815 goto EXPAND_FAILED_CURLY;
5818 if (item_type == EITEM_REDUCE)
5821 while (isspace(*s)) s++;
5824 expand_string_message = US"missing '{' for second arg of reduce";
5825 goto EXPAND_FAILED_CURLY;
5827 t = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
5828 if (!t) goto EXPAND_FAILED;
5832 expand_string_message = US"missing '}' closing second arg of reduce";
5833 goto EXPAND_FAILED_CURLY;
5837 while (isspace(*s)) s++;
5840 expand_string_message =
5841 string_sprintf("missing '{' for last arg of %s", name);
5842 goto EXPAND_FAILED_CURLY;
5847 /* For EITEM_FILTER, call eval_condition once, with result discarded (as
5848 if scanning a "false" part). This allows us to find the end of the
5849 condition, because if the list is empty, we won't actually evaluate the
5850 condition for real. For EITEM_MAP and EITEM_REDUCE, do the same, using
5851 the normal internal expansion function. */
5853 if (item_type == EITEM_FILTER)
5855 temp = eval_condition(expr, &resetok, NULL);
5856 if (temp != NULL) s = temp;
5859 temp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
5863 expand_string_message = string_sprintf("%s inside \"%s\" item",
5864 expand_string_message, name);
5868 while (isspace(*s)) s++;
5871 expand_string_message = string_sprintf("missing } at end of condition "
5872 "or expression inside \"%s\"; could be an unquoted } in the content",
5877 while (isspace(*s)) s++; /*{*/
5880 expand_string_message = string_sprintf("missing } at end of \"%s\"",
5885 /* If we are skipping, we can now just move on to the next item. When
5886 processing for real, we perform the iteration. */
5888 if (skipping) continue;
5889 while ((iterate_item = string_nextinlist(&list, &sep, NULL, 0)))
5891 *outsep = (uschar)sep; /* Separator as a string */
5893 DEBUG(D_expand) debug_printf_indent("%s: $item = '%s' $value = '%s'\n",
5894 name, iterate_item, lookup_value);
5896 if (item_type == EITEM_FILTER)
5899 if (eval_condition(expr, &resetok, &condresult) == NULL)
5901 iterate_item = save_iterate_item;
5902 lookup_value = save_lookup_value;
5903 expand_string_message = string_sprintf("%s inside \"%s\" condition",
5904 expand_string_message, name);
5907 DEBUG(D_expand) debug_printf_indent("%s: condition is %s\n", name,
5908 condresult? "true":"false");
5910 temp = iterate_item; /* TRUE => include this item */
5912 continue; /* FALSE => skip this item */
5915 /* EITEM_MAP and EITEM_REDUCE */
5919 uschar * t = expand_string_internal(expr, TRUE, NULL, skipping, TRUE, &resetok);
5923 iterate_item = save_iterate_item;
5924 expand_string_message = string_sprintf("%s inside \"%s\" item",
5925 expand_string_message, name);
5928 if (item_type == EITEM_REDUCE)
5930 lookup_value = t; /* Update the value of $value */
5931 continue; /* and continue the iteration */
5935 /* We reach here for FILTER if the condition is true, always for MAP,
5936 and never for REDUCE. The value in "temp" is to be added to the output
5937 list that is being created, ensuring that any occurrences of the
5938 separator character are doubled. Unless we are dealing with the first
5939 item of the output list, add in a space if the new item begins with the
5940 separator character, or is an empty string. */
5942 if (yield->ptr != save_ptr && (temp[0] == *outsep || temp[0] == 0))
5943 yield = string_catn(yield, US" ", 1);
5945 /* Add the string in "temp" to the output list that we are building,
5946 This is done in chunks by searching for the separator character. */
5950 size_t seglen = Ustrcspn(temp, outsep);
5952 yield = string_catn(yield, temp, seglen + 1);
5954 /* If we got to the end of the string we output one character
5955 too many; backup and end the loop. Otherwise arrange to double the
5958 if (temp[seglen] == '\0') { yield->ptr--; break; }
5959 yield = string_catn(yield, outsep, 1);
5963 /* Output a separator after the string: we will remove the redundant
5964 final one at the end. */
5966 yield = string_catn(yield, outsep, 1);
5967 } /* End of iteration over the list loop */
5969 /* REDUCE has generated no output above: output the final value of
5972 if (item_type == EITEM_REDUCE)
5974 yield = string_cat(yield, lookup_value);
5975 lookup_value = save_lookup_value; /* Restore $value */
5978 /* FILTER and MAP generate lists: if they have generated anything, remove
5979 the redundant final separator. Even though an empty item at the end of a
5980 list does not count, this is tidier. */
5982 else if (yield->ptr != save_ptr) yield->ptr--;
5984 /* Restore preserved $item */
5986 iterate_item = save_iterate_item;
5993 const uschar *srclist, *cmp, *xtract;
5995 const uschar *dstlist = NULL, *dstkeylist = NULL;
5997 uschar *save_iterate_item = iterate_item;
5999 while (isspace(*s)) s++;
6002 expand_string_message = US"missing '{' for list arg of sort";
6003 goto EXPAND_FAILED_CURLY;
6006 srclist = expand_string_internal(s, TRUE, &s, skipping, TRUE, &resetok);
6007 if (!srclist) goto EXPAND_FAILED;
6010 expand_string_message = US"missing '}' closing list arg of sort";
6011 goto EXPAND_FAILED_CURLY;
6014 while (isspace(*s)) s++;
6017 expand_string_message = US"missing '{' for comparator arg of sort";
6018 goto EXPAND_FAILED_CURLY;
6021 cmp = expand_string_internal(s, TRUE, &s, skipping, FALSE, &resetok);
6022 if (!cmp) goto EXPAND_FAILED;
6025 expand_string_message = US"missing '}' closing comparator arg of sort";
6026 goto EXPAND_FAILED_CURLY;
6029 while (isspace(*s)) s++;
6032 expand_string_message = US"missing '{' for extractor arg of sort";
6033 goto EXPAND_FAILED_CURLY;
6037 tmp = expand_string_internal(s, TRUE, &s, TRUE, TRUE, &resetok);
6038 if (!tmp) goto EXPAND_FAILED;
6039 xtract = string_copyn(xtract, s - xtract);
6043 expand_string_message = US"missing '}' closing extractor arg of sort";
6044 goto EXPAND_FAILED_CURLY;
6049 expand_string_message = US"missing } at end of \"sort\"";
6053 if (skipping) continue;
6055 while ((srcitem = string_nextinlist(&srclist, &sep, NULL, 0)))
6058 gstring * newlist = NULL;
6059 gstring * newkeylist = NULL;
6062 DEBUG(D_expand) debug_printf_indent("%s: $item = \"%s\"\n", name, srcitem);
6064 /* extract field for comparisons */
6065 iterate_item = srcitem;
6066 if ( !(srcfield = expand_string_internal(xtract, FALSE, NULL, FALSE,
6070 expand_string_message = string_sprintf(
6071 "field-extract in sort: \"%s\"", xtract);
6075 /* Insertion sort */
6077 /* copy output list until new-item < list-item */
6078 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6084 /* field for comparison */
6085 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6088 /* build and run condition string */
6089 expr = string_sprintf("%s{%s}{%s}", cmp, srcfield, dstfield);
6091 DEBUG(D_expand) debug_printf_indent("%s: cond = \"%s\"\n", name, expr);
6092 if (!eval_condition(expr, &resetok, &before))
6094 expand_string_message = string_sprintf("comparison in sort: %s",
6101 /* New-item sorts before this dst-item. Append new-item,
6102 then dst-item, then remainder of dst list. */
6104 newlist = string_append_listele(newlist, sep, srcitem);
6105 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6108 newlist = string_append_listele(newlist, sep, dstitem);
6109 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6111 while ((dstitem = string_nextinlist(&dstlist, &sep, NULL, 0)))
6113 if (!(dstfield = string_nextinlist(&dstkeylist, &sep, NULL, 0)))
6115 newlist = string_append_listele(newlist, sep, dstitem);
6116 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6122 newlist = string_append_listele(newlist, sep, dstitem);
6123 newkeylist = string_append_listele(newkeylist, sep, dstfield);
6126 /* If we ran out of dstlist without consuming srcitem, append it */
6129 newlist = string_append_listele(newlist, sep, srcitem);
6130 newkeylist = string_append_listele(newkeylist, sep, srcfield);
6133 dstlist = newlist->s;
6134 dstkeylist = newkeylist->s;
6136 DEBUG(D_expand) debug_printf_indent("%s: dstlist = \"%s\"\n", name, dstlist);
6137 DEBUG(D_expand) debug_printf_indent("%s: dstkeylist = \"%s\"\n", name, dstkeylist);
6141 yield = string_cat(yield, dstlist);
6143 /* Restore preserved $item */
6144 iterate_item = save_iterate_item;
6148 expand_string_message = US"Internal error in sort (list mismatch)";
6153 /* If ${dlfunc } support is configured, handle calling dynamically-loaded
6154 functions, unless locked out at this time. Syntax is ${dlfunc{file}{func}}
6155 or ${dlfunc{file}{func}{arg}} or ${dlfunc{file}{func}{arg1}{arg2}} or up to
6156 a maximum of EXPAND_DLFUNC_MAX_ARGS arguments (defined below). */
6158 #define EXPAND_DLFUNC_MAX_ARGS 8
6161 #ifndef EXPAND_DLFUNC
6162 expand_string_message = US"\"${dlfunc\" encountered, but this facility " /*}*/
6163 "is not included in this binary";
6166 #else /* EXPAND_DLFUNC */
6169 exim_dlfunc_t *func;
6172 uschar *argv[EXPAND_DLFUNC_MAX_ARGS + 3];
6174 if ((expand_forbid & RDO_DLFUNC) != 0)
6176 expand_string_message =
6177 US"dynamically-loaded functions are not permitted";
6181 switch(read_subs(argv, EXPAND_DLFUNC_MAX_ARGS + 2, 2, &s, skipping,
6182 TRUE, US"dlfunc", &resetok))
6184 case 1: goto EXPAND_FAILED_CURLY;
6186 case 3: goto EXPAND_FAILED;
6189 /* If skipping, we don't actually do anything */
6191 if (skipping) continue;
6193 /* Look up the dynamically loaded object handle in the tree. If it isn't
6194 found, dlopen() the file and put the handle in the tree for next time. */
6196 t = tree_search(dlobj_anchor, argv[0]);
6199 void *handle = dlopen(CS argv[0], RTLD_LAZY);
6202 expand_string_message = string_sprintf("dlopen \"%s\" failed: %s",
6203 argv[0], dlerror());
6204 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6207 t = store_get_perm(sizeof(tree_node) + Ustrlen(argv[0]));
6208 Ustrcpy(t->name, argv[0]);
6209 t->data.ptr = handle;
6210 (void)tree_insertnode(&dlobj_anchor, t);
6213 /* Having obtained the dynamically loaded object handle, look up the
6214 function pointer. */
6216 func = (exim_dlfunc_t *)dlsym(t->data.ptr, CS argv[1]);
6219 expand_string_message = string_sprintf("dlsym \"%s\" in \"%s\" failed: "
6220 "%s", argv[1], argv[0], dlerror());
6221 log_write(0, LOG_MAIN|LOG_PANIC, "%s", expand_string_message);
6225 /* Call the function and work out what to do with the result. If it
6226 returns OK, we have a replacement string; if it returns DEFER then
6227 expansion has failed in a non-forced manner; if it returns FAIL then
6228 failure was forced; if it returns ERROR or any other value there's a
6229 problem, so panic slightly. In any case, assume that the function has
6230 side-effects on the store that must be preserved. */
6234 for (argc = 0; argv[argc] != NULL; argc++);
6235 status = func(&result, argc - 2, &argv[2]);
6238 if (result == NULL) result = US"";
6239 yield = string_cat(yield, result);
6244 expand_string_message = result == NULL ? US"(no message)" : result;
6245 if(status == FAIL_FORCED) expand_string_forcedfail = TRUE;
6246 else if(status != FAIL)
6247 log_write(0, LOG_MAIN|LOG_PANIC, "dlfunc{%s}{%s} failed (%d): %s",
6248 argv[0], argv[1], status, expand_string_message);
6252 #endif /* EXPAND_DLFUNC */
6254 case EITEM_ENV: /* ${env {name} {val_if_found} {val_if_unfound}} */
6257 uschar *save_lookup_value = lookup_value;
6259 while (isspace(*s)) s++;
6260 if (*s != '{') /*}*/
6263 key = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6264 if (!key) goto EXPAND_FAILED; /*{*/
6267 expand_string_message = US"missing '{' for name arg of env";
6268 goto EXPAND_FAILED_CURLY;
6271 lookup_value = US getenv(CS key);
6273 switch(process_yesno(
6274 skipping, /* were previously skipping */
6275 lookup_value != NULL, /* success/failure indicator */
6276 save_lookup_value, /* value to reset for string2 */
6277 &s, /* input pointer */
6278 &yield, /* output pointer */
6279 US"env", /* condition type */
6282 case 1: goto EXPAND_FAILED; /* when all is well, the */
6283 case 2: goto EXPAND_FAILED_CURLY; /* returned value is 0 */
6287 } /* EITEM_* switch */
6289 /* Control reaches here if the name is not recognized as one of the more
6290 complicated expansion items. Check for the "operator" syntax (name terminated
6291 by a colon). Some of the operators have arguments, separated by _ from the
6299 var_entry *vp = NULL;
6301 /* Owing to an historical mis-design, an underscore may be part of the
6302 operator name, or it may introduce arguments. We therefore first scan the
6303 table of names that contain underscores. If there is no match, we cut off
6304 the arguments and then scan the main table. */
6306 if ((c = chop_match(name, op_table_underscore,
6307 nelem(op_table_underscore))) < 0)
6309 arg = Ustrchr(name, '_');
6310 if (arg != NULL) *arg = 0;
6311 c = chop_match(name, op_table_main, nelem(op_table_main));
6312 if (c >= 0) c += nelem(op_table_underscore);
6313 if (arg != NULL) *arg++ = '_'; /* Put back for error messages */
6316 /* Deal specially with operators that might take a certificate variable
6317 as we do not want to do the usual expansion. For most, expand the string.*/
6327 const uschar * s1 = s;
6328 sub = expand_string_internal(s+2, TRUE, &s1, skipping,
6330 if (!sub) goto EXPAND_FAILED; /*{*/
6333 expand_string_message =
6334 string_sprintf("missing '}' closing cert arg of %s", name);
6335 goto EXPAND_FAILED_CURLY;
6337 if ((vp = find_var_ent(sub)) && vp->type == vtype_cert)
6347 sub = expand_string_internal(s+1, TRUE, &s, skipping, TRUE, &resetok);
6348 if (!sub) goto EXPAND_FAILED;
6353 /* If we are skipping, we don't need to perform the operation at all.
6354 This matters for operations like "mask", because the data may not be
6355 in the correct format when skipping. For example, the expression may test
6356 for the existence of $sender_host_address before trying to mask it. For
6357 other operations, doing them may not fail, but it is a waste of time. */
6359 if (skipping && c >= 0) continue;
6361 /* Otherwise, switch on the operator type */
6368 unsigned long int n = Ustrtoul(sub, &t, 10);
6373 expand_string_message = string_sprintf("argument for base32 "
6374 "operator is \"%s\", which is not a decimal number", sub);
6378 g = string_catn(g, &base32_chars[n & 0x1f], 1);
6380 if (g) while (g->ptr > 0) yield = string_catn(yield, &g->s[--g->ptr], 1);
6387 unsigned long int n = 0;
6391 uschar * t = Ustrchr(base32_chars, *tt++);
6394 expand_string_message = string_sprintf("argument for base32d "
6395 "operator is \"%s\", which is not a base 32 number", sub);
6398 n = n * 32 + (t - base32_chars);
6400 s = string_sprintf("%ld", n);
6401 yield = string_cat(yield, s);
6408 unsigned long int n = Ustrtoul(sub, &t, 10);
6411 expand_string_message = string_sprintf("argument for base62 "
6412 "operator is \"%s\", which is not a decimal number", sub);
6415 t = string_base62(n);
6416 yield = string_cat(yield, t);
6420 /* Note that for Darwin and Cygwin, BASE_62 actually has the value 36 */
6426 unsigned long int n = 0;
6429 uschar *t = Ustrchr(base62_chars, *tt++);
6432 expand_string_message = string_sprintf("argument for base62d "
6433 "operator is \"%s\", which is not a base %d number", sub,
6437 n = n * BASE_62 + (t - base62_chars);
6439 (void)sprintf(CS buf, "%ld", n);
6440 yield = string_cat(yield, buf);
6446 uschar *expanded = expand_string_internal(sub, FALSE, NULL, skipping, TRUE, &resetok);
6447 if (expanded == NULL)
6449 expand_string_message =
6450 string_sprintf("internal expansion of \"%s\" failed: %s", sub,
6451 expand_string_message);
6454 yield = string_cat(yield, expanded);
6461 uschar *t = sub - 1;
6462 while (*(++t) != 0) { *t = tolower(*t); count++; }
6463 yield = string_catn(yield, sub, count);
6470 uschar *t = sub - 1;
6471 while (*(++t) != 0) { *t = toupper(*t); count++; }
6472 yield = string_catn(yield, sub, count);
6478 if (vp && *(void **)vp->value)
6480 uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
6481 yield = string_cat(yield, cp);
6491 md5_end(&base, sub, Ustrlen(sub), digest);
6492 for(j = 0; j < 16; j++) sprintf(st+2*j, "%02x", digest[j]);
6493 yield = string_cat(yield, US st);
6499 if (vp && *(void **)vp->value)
6501 uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
6502 yield = string_cat(yield, cp);
6512 sha1_end(&h, sub, Ustrlen(sub), digest);
6513 for(j = 0; j < 20; j++) sprintf(st+2*j, "%02X", digest[j]);
6514 yield = string_catn(yield, US st, 40);
6519 #ifdef EXIM_HAVE_SHA2
6520 if (vp && *(void **)vp->value)
6522 uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
6523 yield = string_cat(yield, cp);
6531 if (!exim_sha_init(&h, HASH_SHA2_256))
6533 expand_string_message = US"unrecognised sha256 variant";
6536 exim_sha_update(&h, sub, Ustrlen(sub));
6537 exim_sha_finish(&h, &b);
6540 sprintf(st, "%02X", *b.data++);
6541 yield = string_catn(yield, US st, 2);
6545 expand_string_message = US"sha256 only supported with TLS";
6550 #ifdef EXIM_HAVE_SHA3
6555 hashmethod m = !arg ? HASH_SHA3_256
6556 : Ustrcmp(arg, "224") == 0 ? HASH_SHA3_224
6557 : Ustrcmp(arg, "256") == 0 ? HASH_SHA3_256
6558 : Ustrcmp(arg, "384") == 0 ? HASH_SHA3_384
6559 : Ustrcmp(arg, "512") == 0 ? HASH_SHA3_512
6562 if (m == HASH_BADTYPE || !exim_sha_init(&h, m))
6564 expand_string_message = US"unrecognised sha3 variant";
6568 exim_sha_update(&h, sub, Ustrlen(sub));
6569 exim_sha_finish(&h, &b);
6572 sprintf(st, "%02X", *b.data++);
6573 yield = string_catn(yield, US st, 2);
6578 expand_string_message = US"sha3 only supported with GnuTLS 3.5.0 + or OpenSSL 1.1.1 +";
6582 /* Convert hex encoding to base64 encoding */
6592 for (enc = sub; *enc != 0; enc++)
6594 if (!isxdigit(*enc))
6596 expand_string_message = string_sprintf("\"%s\" is not a hex "
6605 expand_string_message = string_sprintf("\"%s\" contains an odd "
6606 "number of characters", sub);
6610 while ((c = *in++) != 0)
6612 if (isdigit(c)) c -= '0';
6613 else c = toupper(c) - 'A' + 10;
6625 enc = b64encode(sub, out - sub);
6626 yield = string_cat(yield, enc);
6630 /* Convert octets outside 0x21..0x7E to \xXX form */
6634 uschar *t = sub - 1;
6637 if (*t < 0x21 || 0x7E < *t)
6638 yield = string_catn(yield, string_sprintf("\\x%02x", *t), 4);
6640 yield = string_catn(yield, t, 1);
6645 /* count the number of list elements */
6654 while (string_nextinlist(CUSS &sub, &sep, buffer, sizeof(buffer)) != NULL) cnt++;
6655 cp = string_sprintf("%d", cnt);
6656 yield = string_cat(yield, cp);
6660 /* expand a named list given the name */
6661 /* handles nested named lists; requotes as colon-sep list */
6665 tree_node *t = NULL;
6666 const uschar * list;
6669 uschar * suffix = US"";
6670 BOOL needsep = FALSE;
6673 if (*sub == '+') sub++;
6674 if (arg == NULL) /* no-argument version */
6676 if (!(t = tree_search(addresslist_anchor, sub)) &&
6677 !(t = tree_search(domainlist_anchor, sub)) &&
6678 !(t = tree_search(hostlist_anchor, sub)))
6679 t = tree_search(localpartlist_anchor, sub);
6681 else switch(*arg) /* specific list-type version */
6683 case 'a': t = tree_search(addresslist_anchor, sub); suffix = US"_a"; break;
6684 case 'd': t = tree_search(domainlist_anchor, sub); suffix = US"_d"; break;
6685 case 'h': t = tree_search(hostlist_anchor, sub); suffix = US"_h"; break;
6686 case 'l': t = tree_search(localpartlist_anchor, sub); suffix = US"_l"; break;
6688 expand_string_message = string_sprintf("bad suffix on \"list\" operator");
6694 expand_string_message = string_sprintf("\"%s\" is not a %snamed list",
6696 : *arg=='a'?"address "
6697 : *arg=='d'?"domain "
6699 : *arg=='l'?"localpart "
6704 list = ((namedlist_block *)(t->data.ptr))->string;
6706 while ((item = string_nextinlist(&list, &sep, buffer, sizeof(buffer))))
6708 uschar * buf = US" : ";
6710 yield = string_catn(yield, buf, 3);
6714 if (*item == '+') /* list item is itself a named list */
6716 uschar * sub = string_sprintf("${listnamed%s:%s}", suffix, item);
6717 item = expand_string_internal(sub, FALSE, NULL, FALSE, TRUE, &resetok);
6719 else if (sep != ':') /* item from non-colon-sep list, re-quote for colon list-separator */
6723 tok[0] = sep; tok[1] = ':'; tok[2] = 0;
6724 while ((cp= strpbrk(CCS item, tok)))
6726 yield = string_catn(yield, item, cp - CS item);
6727 if (*cp++ == ':') /* colon in a non-colon-sep list item, needs doubling */
6729 yield = string_catn(yield, US"::", 2);
6732 else /* sep in item; should already be doubled; emit once */
6734 yield = string_catn(yield, US tok, 1);
6735 if (*cp == sep) cp++;
6740 yield = string_cat(yield, item);
6745 /* mask applies a mask to an IP address; for example the result of
6746 ${mask:131.111.10.206/28} is 131.111.10.192/28. */
6753 int mask, maskoffset;
6754 int type = string_is_ip_address(sub, &maskoffset);
6759 expand_string_message = string_sprintf("\"%s\" is not an IP address",
6764 if (maskoffset == 0)
6766 expand_string_message = string_sprintf("missing mask value in \"%s\"",
6771 mask = Ustrtol(sub + maskoffset + 1, &endptr, 10);
6773 if (*endptr != 0 || mask < 0 || mask > ((type == 4)? 32 : 128))
6775 expand_string_message = string_sprintf("mask value too big in \"%s\"",
6780 /* Convert the address to binary integer(s) and apply the mask */
6782 sub[maskoffset] = 0;
6783 count = host_aton(sub, binary);
6784 host_mask(count, binary, mask);
6786 /* Convert to masked textual format and add to output. */
6788 yield = string_catn(yield, buffer,
6789 host_nmtoa(count, binary, mask, buffer, '.'));
6794 case EOP_IPV6DENORM:
6796 int type = string_is_ip_address(sub, NULL);
6803 (void) host_aton(sub, binary);
6806 case 4: /* convert to IPv4-mapped IPv6 */
6807 binary[0] = binary[1] = 0;
6808 binary[2] = 0x0000ffff;
6809 (void) host_aton(sub, binary+3);
6813 expand_string_message =
6814 string_sprintf("\"%s\" is not an IP address", sub);
6818 yield = string_catn(yield, buffer, c == EOP_IPV6NORM
6819 ? ipv6_nmtoa(binary, buffer)
6820 : host_nmtoa(4, binary, -1, buffer, ':')
6826 case EOP_LOCAL_PART:
6830 int start, end, domain;
6831 uschar * t = parse_extract_address(sub, &error, &start, &end, &domain,
6834 if (c != EOP_DOMAIN)
6836 if (c == EOP_LOCAL_PART && domain != 0) end = start + domain - 1;
6837 yield = string_catn(yield, sub+start, end-start);
6839 else if (domain != 0)
6842 yield = string_catn(yield, sub+domain, end-domain);
6849 uschar outsep[2] = { ':', '\0' };
6850 uschar *address, *error;
6851 int save_ptr = yield->ptr;
6852 int start, end, domain; /* Not really used */
6854 while (isspace(*sub)) sub++;
6856 if (*outsep = *++sub) ++sub;
6859 expand_string_message = string_sprintf("output separator "
6860 "missing in expanding ${addresses:%s}", --sub);
6863 parse_allow_group = TRUE;
6867 uschar *p = parse_find_address_end(sub, FALSE);
6868 uschar saveend = *p;
6870 address = parse_extract_address(sub, &error, &start, &end, &domain,
6874 /* Add the address to the output list that we are building. This is
6875 done in chunks by searching for the separator character. At the
6876 start, unless we are dealing with the first address of the output
6877 list, add in a space if the new address begins with the separator
6878 character, or is an empty string. */
6880 if (address != NULL)
6882 if (yield->ptr != save_ptr && address[0] == *outsep)
6883 yield = string_catn(yield, US" ", 1);
6887 size_t seglen = Ustrcspn(address, outsep);
6888 yield = string_catn(yield, address, seglen + 1);
6890 /* If we got to the end of the string we output one character
6893 if (address[seglen] == '\0') { yield->ptr--; break; }
6894 yield = string_catn(yield, outsep, 1);
6895 address += seglen + 1;
6898 /* Output a separator after the string: we will remove the
6899 redundant final one at the end. */
6901 yield = string_catn(yield, outsep, 1);
6904 if (saveend == '\0') break;
6908 /* If we have generated anything, remove the redundant final
6911 if (yield->ptr != save_ptr) yield->ptr--;
6912 parse_allow_group = FALSE;
6917 /* quote puts a string in quotes if it is empty or contains anything
6918 other than alphamerics, underscore, dot, or hyphen.
6920 quote_local_part puts a string in quotes if RFC 2821/2822 requires it to
6921 be quoted in order to be a valid local part.
6923 In both cases, newlines and carriage returns are converted into \n and \r
6927 case EOP_QUOTE_LOCAL_PART:
6930 BOOL needs_quote = (*sub == 0); /* TRUE for empty string */
6931 uschar *t = sub - 1;
6935 while (!needs_quote && *(++t) != 0)
6936 needs_quote = !isalnum(*t) && !strchr("_-.", *t);
6938 else /* EOP_QUOTE_LOCAL_PART */
6940 while (!needs_quote && *(++t) != 0)
6941 needs_quote = !isalnum(*t) &&
6942 strchr("!#$%&'*+-/=?^_`{|}~", *t) == NULL &&
6943 (*t != '.' || t == sub || t[1] == 0);
6948 yield = string_catn(yield, US"\"", 1);
6953 yield = string_catn(yield, US"\\n", 2);
6954 else if (*t == '\r')
6955 yield = string_catn(yield, US"\\r", 2);
6958 if (*t == '\\' || *t == '"')
6959 yield = string_catn(yield, US"\\", 1);
6960 yield = string_catn(yield, t, 1);
6963 yield = string_catn(yield, US"\"", 1);
6965 else yield = string_cat(yield, sub);
6969 /* quote_lookuptype does lookup-specific quoting */
6974 uschar *opt = Ustrchr(arg, '_');
6976 if (opt != NULL) *opt++ = 0;
6978 n = search_findtype(arg, Ustrlen(arg));
6981 expand_string_message = search_error_message;
6985 if (lookup_list[n]->quote != NULL)
6986 sub = (lookup_list[n]->quote)(sub, opt);
6987 else if (opt != NULL) sub = NULL;
6991 expand_string_message = string_sprintf(
6992 "\"%s\" unrecognized after \"${quote_%s\"",
6997 yield = string_cat(yield, sub);
7001 /* rx quote sticks in \ before any non-alphameric character so that
7002 the insertion works in a regular expression. */
7006 uschar *t = sub - 1;
7010 yield = string_catn(yield, US"\\", 1);
7011 yield = string_catn(yield, t, 1);
7016 /* RFC 2047 encodes, assuming headers_charset (default ISO 8859-1) as
7017 prescribed by the RFC, if there are characters that need to be encoded */
7021 uschar buffer[2048];
7022 const uschar *string = parse_quote_2047(sub, Ustrlen(sub), headers_charset,
7023 buffer, sizeof(buffer), FALSE);
7024 yield = string_cat(yield, string);
7028 /* RFC 2047 decode */
7034 uschar *decoded = rfc2047_decode(sub, check_rfc2047_length,
7035 headers_charset, '?', &len, &error);
7038 expand_string_message = error;
7041 yield = string_catn(yield, decoded, len);
7045 /* from_utf8 converts UTF-8 to 8859-1, turning non-existent chars into
7055 if (c > 255) c = '_';
7057 yield = string_catn(yield, buff, 1);
7062 /* replace illegal UTF-8 sequences by replacement character */
7064 #define UTF8_REPLACEMENT_CHAR US"?"
7068 int seq_len = 0, index = 0;
7070 long codepoint = -1;
7071 uschar seq_buff[4]; /* accumulate utf-8 here */
7080 if ((c & 0xc0) != 0x80)
7081 /* wrong continuation byte; invalidate all bytes */
7082 complete = 1; /* error */
7085 codepoint = (codepoint << 6) | (c & 0x3f);
7086 seq_buff[index++] = c;
7087 if (--bytes_left == 0) /* codepoint complete */
7088 if(codepoint > 0x10FFFF) /* is it too large? */
7089 complete = -1; /* error (RFC3629 limit) */
7091 { /* finished; output utf-8 sequence */
7092 yield = string_catn(yield, seq_buff, seq_len);
7097 else /* no bytes left: new sequence */
7099 if((c & 0x80) == 0) /* 1-byte sequence, US-ASCII, keep it */
7101 yield = string_catn(yield, &c, 1);
7104 if((c & 0xe0) == 0xc0) /* 2-byte sequence */
7106 if(c == 0xc0 || c == 0xc1) /* 0xc0 and 0xc1 are illegal */
7111 codepoint = c & 0x1f;
7114 else if((c & 0xf0) == 0xe0) /* 3-byte sequence */
7117 codepoint = c & 0x0f;
7119 else if((c & 0xf8) == 0xf0) /* 4-byte sequence */
7122 codepoint = c & 0x07;
7124 else /* invalid or too long (RFC3629 allows only 4 bytes) */
7127 seq_buff[index++] = c;
7128 seq_len = bytes_left + 1;
7129 } /* if(bytes_left) */
7133 bytes_left = index = 0;
7134 yield = string_catn(yield, UTF8_REPLACEMENT_CHAR, 1);
7136 if ((complete == 1) && ((c & 0x80) == 0))
7137 /* ASCII character follows incomplete sequence */
7138 yield = string_catn(yield, &c, 1);
7144 case EOP_UTF8_DOMAIN_TO_ALABEL:
7146 uschar * error = NULL;
7147 uschar * s = string_domain_utf8_to_alabel(sub, &error);
7150 expand_string_message = string_sprintf(
7151 "error converting utf8 (%s) to alabel: %s",
7152 string_printing(sub), error);
7155 yield = string_cat(yield, s);
7159 case EOP_UTF8_DOMAIN_FROM_ALABEL:
7161 uschar * error = NULL;
7162 uschar * s = string_domain_alabel_to_utf8(sub, &error);
7165 expand_string_message = string_sprintf(
7166 "error converting alabel (%s) to utf8: %s",
7167 string_printing(sub), error);
7170 yield = string_cat(yield, s);
7174 case EOP_UTF8_LOCALPART_TO_ALABEL:
7176 uschar * error = NULL;
7177 uschar * s = string_localpart_utf8_to_alabel(sub, &error);
7180 expand_string_message = string_sprintf(
7181 "error converting utf8 (%s) to alabel: %s",
7182 string_printing(sub), error);
7185 yield = string_cat(yield, s);
7186 DEBUG(D_expand) debug_printf_indent("yield: '%s'\n", yield->s);
7190 case EOP_UTF8_LOCALPART_FROM_ALABEL:
7192 uschar * error = NULL;
7193 uschar * s = string_localpart_alabel_to_utf8(sub, &error);
7196 expand_string_message = string_sprintf(
7197 "error converting alabel (%s) to utf8: %s",
7198 string_printing(sub), error);
7201 yield = string_cat(yield, s);
7204 #endif /* EXPERIMENTAL_INTERNATIONAL */
7206 /* escape turns all non-printing characters into escape sequences. */
7210 const uschar * t = string_printing(sub);
7211 yield = string_cat(yield, t);
7215 case EOP_ESCAPE8BIT:
7217 const uschar * s = sub;
7220 for (s = sub; (c = *s); s++)
7221 yield = c < 127 && c != '\\'
7222 ? string_catn(yield, s, 1)
7223 : string_catn(yield, string_sprintf("\\%03o", c), 4);
7227 /* Handle numeric expression evaluation */
7232 uschar *save_sub = sub;
7233 uschar *error = NULL;
7234 int_eximarith_t n = eval_expr(&sub, (c == EOP_EVAL10), &error, FALSE);
7237 expand_string_message = string_sprintf("error in expression "
7238 "evaluation: %s (after processing \"%.*s\")", error,
7239 (int)(sub-save_sub), save_sub);
7242 sprintf(CS var_buffer, PR_EXIM_ARITH, n);
7243 yield = string_cat(yield, var_buffer);
7247 /* Handle time period formating */
7251 int n = readconf_readtime(sub, 0, FALSE);
7254 expand_string_message = string_sprintf("string \"%s\" is not an "
7255 "Exim time interval in \"%s\" operator", sub, name);
7258 sprintf(CS var_buffer, "%d", n);
7259 yield = string_cat(yield, var_buffer);
7263 case EOP_TIME_INTERVAL:
7266 uschar *t = read_number(&n, sub);
7267 if (*t != 0) /* Not A Number*/
7269 expand_string_message = string_sprintf("string \"%s\" is not a "
7270 "positive number in \"%s\" operator", sub, name);
7273 t = readconf_printtime(n);
7274 yield = string_cat(yield, t);
7278 /* Convert string to base64 encoding */
7284 uschar * s = vp && *(void **)vp->value
7285 ? tls_cert_der_b64(*(void **)vp->value)
7286 : b64encode(sub, Ustrlen(sub));
7288 uschar * s = b64encode(sub, Ustrlen(sub));
7290 yield = string_cat(yield, s);
7297 int len = b64decode(sub, &s);
7300 expand_string_message = string_sprintf("string \"%s\" is not "
7301 "well-formed for \"%s\" operator", sub, name);
7304 yield = string_cat(yield, s);
7308 /* strlen returns the length of the string */
7313 (void)sprintf(CS buff, "%d", Ustrlen(sub));
7314 yield = string_cat(yield, buff);
7318 /* length_n or l_n takes just the first n characters or the whole string,
7319 whichever is the shorter;
7321 substr_m_n, and s_m_n take n characters from offset m; negative m take
7322 from the end; l_n is synonymous with s_0_n. If n is omitted in substr it
7323 takes the rest, either to the right or to the left.
7325 hash_n or h_n makes a hash of length n from the string, yielding n
7326 characters from the set a-z; hash_n_m makes a hash of length n, but
7327 uses m characters from the set a-zA-Z0-9.
7329 nhash_n returns a single number between 0 and n-1 (in text form), while
7330 nhash_n_m returns a div/mod hash as two numbers "a/b". The first lies
7331 between 0 and n-1 and the second between 0 and m-1. */
7351 expand_string_message = string_sprintf("missing values after %s",
7356 /* "length" has only one argument, effectively being synonymous with
7359 if (c == EOP_LENGTH || c == EOP_L)
7365 /* The others have one or two arguments; for "substr" the first may be
7366 negative. The second being negative means "not supplied". */
7371 if (name[0] == 's' && *arg == '-') { sign = -1; arg++; }
7374 /* Read up to two numbers, separated by underscores */
7379 if (arg != ret && *arg == '_' && pn == &value1)
7383 if (arg[1] != 0) arg++;
7385 else if (!isdigit(*arg))
7387 expand_string_message =
7388 string_sprintf("non-digit after underscore in \"%s\"", name);
7391 else *pn = (*pn)*10 + *arg++ - '0';
7395 /* Perform the required operation */
7398 (c == EOP_HASH || c == EOP_H)?
7399 compute_hash(sub, value1, value2, &len) :
7400 (c == EOP_NHASH || c == EOP_NH)?
7401 compute_nhash(sub, value1, value2, &len) :
7402 extract_substr(sub, value1, value2, &len);
7404 if (ret == NULL) goto EXPAND_FAILED;
7405 yield = string_catn(yield, ret, len);
7415 uschar **modetable[3];
7420 if ((expand_forbid & RDO_EXISTS) != 0)
7422 expand_string_message = US"Use of the stat() expansion is not permitted";
7426 if (stat(CS sub, &st) < 0)
7428 expand_string_message = string_sprintf("stat(%s) failed: %s",
7429 sub, strerror(errno));
7433 switch (mode & S_IFMT)
7435 case S_IFIFO: smode[0] = 'p'; break;
7436 case S_IFCHR: smode[0] = 'c'; break;
7437 case S_IFDIR: smode[0] = 'd'; break;
7438 case S_IFBLK: smode[0] = 'b'; break;
7439 case S_IFREG: smode[0] = '-'; break;
7440 default: smode[0] = '?'; break;
7443 modetable[0] = ((mode & 01000) == 0)? mtable_normal : mtable_sticky;
7444 modetable[1] = ((mode & 02000) == 0)? mtable_normal : mtable_setid;
7445 modetable[2] = ((mode & 04000) == 0)? mtable_normal : mtable_setid;
7447 for (i = 0; i < 3; i++)
7449 memcpy(CS(smode + 7 - i*3), CS(modetable[i][mode & 7]), 3);
7454 s = string_sprintf("mode=%04lo smode=%s inode=%ld device=%ld links=%ld "
7455 "uid=%ld gid=%ld size=" OFF_T_FMT " atime=%ld mtime=%ld ctime=%ld",
7456 (long)(st.st_mode & 077777), smode, (long)st.st_ino,
7457 (long)st.st_dev, (long)st.st_nlink, (long)st.st_uid,
7458 (long)st.st_gid, st.st_size, (long)st.st_atime,
7459 (long)st.st_mtime, (long)st.st_ctime);
7460 yield = string_cat(yield, s);
7464 /* vaguely random number less than N */
7468 int_eximarith_t max;
7471 max = expanded_string_integer(sub, TRUE);
7472 if (expand_string_message != NULL)
7474 s = string_sprintf("%d", vaguely_random_number((int)max));
7475 yield = string_cat(yield, s);
7479 /* Reverse IP, including IPv6 to dotted-nibble */
7481 case EOP_REVERSE_IP:
7483 int family, maskptr;
7484 uschar reversed[128];
7486 family = string_is_ip_address(sub, &maskptr);
7489 expand_string_message = string_sprintf(
7490 "reverse_ip() not given an IP address [%s]", sub);
7493 invert_address(reversed, sub);
7494 yield = string_cat(yield, reversed);
7498 /* Unknown operator */
7501 expand_string_message =
7502 string_sprintf("unknown expansion operator \"%s\"", name);
7507 /* Handle a plain name. If this is the first thing in the expansion, release
7508 the pre-allocated buffer. If the result data is known to be in a new buffer,
7509 newsize will be set to the size of that buffer, and we can just point at that
7510 store instead of copying. Many expansion strings contain just one reference,
7511 so this is a useful optimization, especially for humungous headers
7512 ($message_headers). */
7521 g = store_get(sizeof(gstring));
7522 else if (yield->ptr == 0)
7524 if (resetok) store_reset(yield);
7526 g = store_get(sizeof(gstring)); /* alloc _before_ calling find_variable() */
7528 if (!(value = find_variable(name, FALSE, skipping, &newsize)))
7530 expand_string_message =
7531 string_sprintf("unknown variable in \"${%s}\"", name);
7532 check_variable_error_message(name);
7535 len = Ustrlen(value);
7536 if (!yield && newsize)
7539 yield->size = newsize;
7544 yield = string_catn(yield, value, len);
7548 /* Else there's something wrong */
7550 expand_string_message =
7551 string_sprintf("\"${%s\" is not a known operator (or a } is missing "
7552 "in a variable reference)", name);
7556 /* If we hit the end of the string when ket_ends is set, there is a missing
7557 terminating brace. */
7559 if (ket_ends && *s == 0)
7561 expand_string_message = malformed_header
7562 ? US"missing } at end of string - could be header name not terminated by colon"
7563 : US"missing } at end of string";
7567 /* Expansion succeeded; yield may still be NULL here if nothing was actually
7568 added to the string. If so, set up an empty string. Add a terminating zero. If
7569 left != NULL, return a pointer to the terminator. */
7572 yield = string_get(1);
7573 (void) string_from_gstring(yield);
7574 if (left) *left = s;
7576 /* Any stacking store that was used above the final string is no longer needed.
7577 In many cases the final string will be the first one that was got and so there
7578 will be optimal store usage. */
7580 if (resetok) store_reset(yield->s + (yield->size = yield->ptr + 1));
7581 else if (resetok_p) *resetok_p = FALSE;
7585 debug_printf_indent(UTF8_VERT_RIGHT UTF8_HORIZ UTF8_HORIZ
7586 "expanding: %.*s\n",
7587 (int)(s - string), string);
7588 debug_printf_indent("%s"
7589 UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
7591 skipping ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
7594 debug_printf_indent(UTF8_UP_RIGHT UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
7595 "skipping: result is not used\n");
7600 /* This is the failure exit: easiest to program with a goto. We still need
7601 to update the pointer to the terminator, for cases of nested calls with "fail".
7604 EXPAND_FAILED_CURLY:
7605 if (malformed_header)
7606 expand_string_message =
7607 US"missing or misplaced { or } - could be header name not terminated by colon";
7609 else if (!expand_string_message || !*expand_string_message)
7610 expand_string_message = US"missing or misplaced { or }";
7612 /* At one point, Exim reset the store to yield (if yield was not NULL), but
7613 that is a bad idea, because expand_string_message is in dynamic store. */
7616 if (left) *left = s;
7619 debug_printf_indent(UTF8_VERT_RIGHT "failed to expand: %s\n",
7621 debug_printf_indent("%s" UTF8_HORIZ UTF8_HORIZ UTF8_HORIZ
7622 "error message: %s\n",
7623 expand_string_forcedfail ? UTF8_VERT_RIGHT : UTF8_UP_RIGHT,
7624 expand_string_message);
7625 if (expand_string_forcedfail)
7626 debug_printf_indent(UTF8_UP_RIGHT "failure was forced\n");
7628 if (resetok_p && !resetok) *resetok_p = FALSE;
7634 /* This is the external function call. Do a quick check for any expansion
7635 metacharacters, and if there are none, just return the input string.
7637 Argument: the string to be expanded
7638 Returns: the expanded string, or NULL if expansion failed; if failure was
7639 due to a lookup deferring, search_find_defer will be TRUE
7643 expand_cstring(const uschar * string)
7645 if (Ustrpbrk(string, "$\\") != NULL)
7647 int old_pool = store_pool;
7650 search_find_defer = FALSE;
7651 malformed_header = FALSE;
7652 store_pool = POOL_MAIN;
7653 s = expand_string_internal(string, FALSE, NULL, FALSE, TRUE, NULL);
7654 store_pool = old_pool;
7662 expand_string(uschar * string)
7664 return US expand_cstring(CUS string);
7671 /*************************************************
7673 *************************************************/
7675 /* Now and again we want to expand a string and be sure that the result is in a
7676 new bit of store. This function does that.
7677 Since we know it has been copied, the de-const cast is safe.
7679 Argument: the string to be expanded
7680 Returns: the expanded string, always in a new bit of store, or NULL
7684 expand_string_copy(const uschar *string)
7686 const uschar *yield = expand_cstring(string);
7687 if (yield == string) yield = string_copy(string);
7693 /*************************************************
7694 * Expand and interpret as an integer *
7695 *************************************************/
7697 /* Expand a string, and convert the result into an integer.
7700 string the string to be expanded
7701 isplus TRUE if a non-negative number is expected
7703 Returns: the integer value, or
7704 -1 for an expansion error ) in both cases, message in
7705 -2 for an integer interpretation error ) expand_string_message
7706 expand_string_message is set NULL for an OK integer
7710 expand_string_integer(uschar *string, BOOL isplus)
7712 return expanded_string_integer(expand_string(string), isplus);
7716 /*************************************************
7717 * Interpret string as an integer *
7718 *************************************************/
7720 /* Convert a string (that has already been expanded) into an integer.
7722 This function is used inside the expansion code.
7725 s the string to be expanded
7726 isplus TRUE if a non-negative number is expected
7728 Returns: the integer value, or
7729 -1 if string is NULL (which implies an expansion error)
7730 -2 for an integer interpretation error
7731 expand_string_message is set NULL for an OK integer
7734 static int_eximarith_t
7735 expanded_string_integer(const uschar *s, BOOL isplus)
7737 int_eximarith_t value;
7738 uschar *msg = US"invalid integer \"%s\"";
7741 /* If expansion failed, expand_string_message will be set. */
7743 if (s == NULL) return -1;
7745 /* On an overflow, strtol() returns LONG_MAX or LONG_MIN, and sets errno
7746 to ERANGE. When there isn't an overflow, errno is not changed, at least on some
7747 systems, so we set it zero ourselves. */
7750 expand_string_message = NULL; /* Indicates no error */
7752 /* Before Exim 4.64, strings consisting entirely of whitespace compared
7753 equal to 0. Unfortunately, people actually relied upon that, so preserve
7754 the behaviour explicitly. Stripping leading whitespace is a harmless
7755 noop change since strtol skips it anyway (provided that there is a number
7759 while (isspace(*s)) ++s;
7763 debug_printf_indent("treating blank string as number 0\n");
7768 value = strtoll(CS s, CSS &endptr, 10);
7772 msg = US"integer expected but \"%s\" found";
7774 else if (value < 0 && isplus)
7776 msg = US"non-negative integer expected but \"%s\" found";
7780 switch (tolower(*endptr))
7785 if (value > EXIM_ARITH_MAX/1024 || value < EXIM_ARITH_MIN/1024) errno = ERANGE;
7790 if (value > EXIM_ARITH_MAX/(1024*1024) || value < EXIM_ARITH_MIN/(1024*1024)) errno = ERANGE;
7791 else value *= 1024*1024;
7795 if (value > EXIM_ARITH_MAX/(1024*1024*1024) || value < EXIM_ARITH_MIN/(1024*1024*1024)) errno = ERANGE;
7796 else value *= 1024*1024*1024;
7800 if (errno == ERANGE)
7801 msg = US"absolute value of integer \"%s\" is too large (overflow)";
7804 while (isspace(*endptr)) endptr++;
7805 if (*endptr == 0) return value;
7809 expand_string_message = string_sprintf(CS msg, s);
7814 /* These values are usually fixed boolean values, but they are permitted to be
7818 addr address being routed
7819 mtype the module type
7820 mname the module name
7821 dbg_opt debug selectors
7822 oname the option name
7823 bvalue the router's boolean value
7824 svalue the router's string value
7825 rvalue where to put the returned value
7827 Returns: OK value placed in rvalue
7828 DEFER expansion failed
7832 exp_bool(address_item *addr,
7833 uschar *mtype, uschar *mname, unsigned dbg_opt,
7834 uschar *oname, BOOL bvalue,
7835 uschar *svalue, BOOL *rvalue)
7838 if (svalue == NULL) { *rvalue = bvalue; return OK; }
7840 expanded = expand_string(svalue);
7841 if (expanded == NULL)
7843 if (expand_string_forcedfail)
7845 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" forced failure\n", oname);
7849 addr->message = string_sprintf("failed to expand \"%s\" in %s %s: %s",
7850 oname, mname, mtype, expand_string_message);
7851 DEBUG(dbg_opt) debug_printf("%s\n", addr->message);
7855 DEBUG(dbg_opt) debug_printf("expansion of \"%s\" yields \"%s\"\n", oname,
7858 if (strcmpic(expanded, US"true") == 0 || strcmpic(expanded, US"yes") == 0)
7860 else if (strcmpic(expanded, US"false") == 0 || strcmpic(expanded, US"no") == 0)
7864 addr->message = string_sprintf("\"%s\" is not a valid value for the "
7865 "\"%s\" option in the %s %s", expanded, oname, mname, mtype);
7874 /* Avoid potentially exposing a password in a string about to be logged */
7877 expand_hide_passwords(uschar * s)
7879 return ( ( Ustrstr(s, "failed to expand") != NULL
7880 || Ustrstr(s, "expansion of ") != NULL
7882 && ( Ustrstr(s, "mysql") != NULL
7883 || Ustrstr(s, "pgsql") != NULL
7884 || Ustrstr(s, "redis") != NULL
7885 || Ustrstr(s, "sqlite") != NULL
7886 || Ustrstr(s, "ldap:") != NULL
7887 || Ustrstr(s, "ldaps:") != NULL
7888 || Ustrstr(s, "ldapi:") != NULL
7889 || Ustrstr(s, "ldapdn:") != NULL
7890 || Ustrstr(s, "ldapm:") != NULL
7892 ? US"Temporary internal error" : s;
7896 /* Read given named file into big_buffer. Use for keying material etc.
7897 The content will have an ascii NUL appended.
7902 Return: pointer to buffer, or NULL on error.
7906 expand_file_big_buffer(const uschar * filename)
7908 int fd, off = 0, len;
7910 if ((fd = open(CS filename, O_RDONLY)) < 0)
7912 log_write(0, LOG_MAIN | LOG_PANIC, "unable to open file for reading: %s",
7919 if ((len = read(fd, big_buffer + off, big_buffer_size - 2 - off)) < 0)
7922 log_write(0, LOG_MAIN|LOG_PANIC, "unable to read file: %s", filename);
7930 big_buffer[off] = '\0';
7936 /*************************************************
7937 * Error-checking for testsuite *
7938 *************************************************/
7940 uschar * region_start;
7941 uschar * region_end;
7942 const uschar *var_name;
7943 const uschar *var_data;
7947 assert_variable_notin(uschar * var_name, uschar * var_data, void * ctx)
7950 if (var_data >= e->region_start && var_data < e->region_end)
7952 e->var_name = CUS var_name;
7953 e->var_data = CUS var_data;
7958 assert_no_variables(void * ptr, int len, const char * filename, int linenumber)
7960 err_ctx e = { .region_start = ptr, .region_end = US ptr + len,
7961 .var_name = NULL, .var_data = NULL };
7965 /* check acl_ variables */
7966 tree_walk(acl_var_c, assert_variable_notin, &e);
7967 tree_walk(acl_var_m, assert_variable_notin, &e);
7969 /* check auth<n> variables */
7970 for (i = 0; i < AUTH_VARS; i++) if (auth_vars[i])
7971 assert_variable_notin(US"auth<n>", auth_vars[i], &e);
7973 /* check regex<n> variables */
7974 for (i = 0; i < REGEX_VARS; i++) if (regex_vars[i])
7975 assert_variable_notin(US"regex<n>", regex_vars[i], &e);
7977 /* check known-name variables */
7978 for (v = var_table; v < var_table + var_table_size; v++)
7979 if (v->type == vtype_stringptr)
7980 assert_variable_notin(US v->name, *(USS v->value), &e);
7982 /* check dns and address trees */
7983 tree_walk(tree_dns_fails, assert_variable_notin, &e);
7984 tree_walk(tree_duplicates, assert_variable_notin, &e);
7985 tree_walk(tree_nonrecipients, assert_variable_notin, &e);
7986 tree_walk(tree_unusable, assert_variable_notin, &e);
7989 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
7990 "live variable '%s' destroyed by reset_store at %s:%d\n- value '%.64s'",
7991 e.var_name, filename, linenumber, e.var_data);
7996 /*************************************************
7997 **************************************************
7998 * Stand-alone test program *
7999 **************************************************
8000 *************************************************/
8006 regex_match_and_setup(const pcre *re, uschar *subject, int options, int setup)
8008 int ovector[3*(EXPAND_MAXN+1)];
8009 int n = pcre_exec(re, NULL, subject, Ustrlen(subject), 0, PCRE_EOPT|options,
8010 ovector, nelem(ovector));
8011 BOOL yield = n >= 0;
8012 if (n == 0) n = EXPAND_MAXN + 1;
8016 expand_nmax = (setup < 0)? 0 : setup + 1;
8017 for (nn = (setup < 0)? 0 : 2; nn < n*2; nn += 2)
8019 expand_nstring[expand_nmax] = subject + ovector[nn];
8020 expand_nlength[expand_nmax++] = ovector[nn+1] - ovector[nn];
8028 int main(int argc, uschar **argv)
8031 uschar buffer[1024];
8033 debug_selector = D_v;
8034 debug_file = stderr;
8035 debug_fd = fileno(debug_file);
8036 big_buffer = malloc(big_buffer_size);
8038 for (i = 1; i < argc; i++)
8040 if (argv[i][0] == '+')
8042 debug_trace_memory = 2;
8045 if (isdigit(argv[i][0]))
8046 debug_selector = Ustrtol(argv[i], NULL, 0);
8048 if (Ustrspn(argv[i], "abcdefghijklmnopqrtsuvwxyz0123456789-.:/") ==
8052 eldap_default_servers = argv[i];
8055 mysql_servers = argv[i];
8058 pgsql_servers = argv[i];
8061 redis_servers = argv[i];
8065 else opt_perl_startup = argv[i];
8069 printf("Testing string expansion: debug_level = %d\n\n", debug_level);
8071 expand_nstring[1] = US"string 1....";
8072 expand_nlength[1] = 8;
8076 if (opt_perl_startup != NULL)
8079 printf("Starting Perl interpreter\n");
8080 errstr = init_perl(opt_perl_startup);
8083 printf("** error in perl_startup code: %s\n", errstr);
8084 return EXIT_FAILURE;
8087 #endif /* EXIM_PERL */
8089 while (fgets(buffer, sizeof(buffer), stdin) != NULL)
8091 void *reset_point = store_get(0);
8092 uschar *yield = expand_string(buffer);
8095 printf("%s\n", yield);
8096 store_reset(reset_point);
8100 if (search_find_defer) printf("search_find deferred\n");
8101 printf("Failed: %s\n", expand_string_message);
8102 if (expand_string_forcedfail) printf("Forced failure\n");
8116 /* End of expand.c */