Events: avoid evaluating intermediates for unneeded events

[user/henk/code/exim.git] / src / src / expand.c

diff --git a/src/src/expand.c b/src/src/expand.c
index 14d7ce451471a8d734311c565360c16ac437e3bb..31059c432af1176fd0da00119c548230bfba0e12 100644 (file)
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -235,6 +235,7 @@ static uschar *op_table_main[] = {
   US"rxquote",
   US"s",
   US"sha1",
   US"rxquote",
   US"s",
   US"sha1",

+  US"sha2",

   US"sha256",
   US"sha3",
   US"stat",
   US"sha256",
   US"sha3",
   US"stat",


@@ -281,6 +282,7 @@ enum {
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,
   EOP_RXQUOTE,
   EOP_S,
   EOP_SHA1,

+  EOP_SHA2,

   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,
   EOP_SHA256,
   EOP_SHA3,
   EOP_STAT,


@@ -668,9 +670,6 @@ static var_entry var_table[] = {
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },
   { "regex_match_string",  vtype_stringptr,   &regex_match_string },
 #endif
   { "reply_address",       vtype_reply,       NULL },

-#if defined(SUPPORT_TLS) && defined(EXPERIMENTAL_REQUIRETLS)
-  { "requiretls",          vtype_bool,        &tls_requiretls },
-#endif

   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },
   { "return_path",         vtype_stringptr,   &return_path },
   { "return_size_limit",   vtype_int,         &bounce_return_size_limit },
   { "router_name",         vtype_stringptr,   &router_name },


@@ -754,7 +753,10 @@ static var_entry var_table[] = {
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },
   { "tls_in_ourcert",      vtype_cert,        &tls_in.ourcert },
   { "tls_in_peercert",     vtype_cert,        &tls_in.peercert },
   { "tls_in_peerdn",       vtype_stringptr,   &tls_in.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_in_resumption",   vtype_int,         &tls_in.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_out_bits",        vtype_int,         &tls_out.bits },
   { "tls_in_sni",          vtype_stringptr,   &tls_in.sni },
 #endif
   { "tls_out_bits",        vtype_int,         &tls_out.bits },


@@ -768,7 +770,10 @@ static var_entry var_table[] = {
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },
   { "tls_out_ourcert",     vtype_cert,        &tls_out.ourcert },
   { "tls_out_peercert",    vtype_cert,        &tls_out.peercert },
   { "tls_out_peerdn",      vtype_stringptr,   &tls_out.peerdn },

-#if defined(SUPPORT_TLS)
+#ifdef EXPERIMENTAL_TLS_RESUME
+  { "tls_out_resumption",  vtype_int,         &tls_out.resumption },
+#endif
+#ifndef DISABLE_TLS

   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE
   { "tls_out_sni",         vtype_stringptr,   &tls_out.sni },
 #endif
 #ifdef SUPPORT_DANE


@@ -776,7 +781,7 @@ static var_entry var_table[] = {
 #endif
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */
 #endif
 
   { "tls_peerdn",          vtype_stringptr,   &tls_in.peerdn },        /* mind the alphabetical order! */

-#if defined(SUPPORT_TLS)
+#ifndef DISABLE_TLS

   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 
   { "tls_sni",             vtype_stringptr,   &tls_in.sni },   /* mind the alphabetical order! */
 #endif
 


@@ -962,7 +967,7 @@ weirdness they'll twist this into.  The result should ideally handle fork().
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 
 However, if we're stuck unable to provide this, then we'll fall back to
 appallingly bad randomness.
 

-If SUPPORT_TLS is defined then this will not be used except as an emergency
+If DISABLE_TLS is not defined then this will not be used except as an emergency

 fallback.
 
 Arguments:
 fallback.
 
 Arguments:


@@ -970,56 +975,55 @@ Arguments:
 Returns     a random number in range [0, max-1]
 */
 
 Returns     a random number in range [0, max-1]
 */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {
 # define vaguely_random_number vaguely_random_number_fallback
 #endif
 int
 vaguely_random_number(int max)
 {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 # undef vaguely_random_number
 #endif
 # undef vaguely_random_number
 #endif

-  static pid_t pid = 0;
-  pid_t p2;
-#if defined(HAVE_SRANDOM) && !defined(HAVE_SRANDOMDEV)
-  struct timeval tv;
-#endif
+static pid_t pid = 0;
+pid_t p2;

 
 

-  p2 = getpid();
-  if (p2 != pid)
+if ((p2 = getpid()) != pid)
+  {
+  if (pid != 0)

     {
     {

-    if (pid != 0)
-      {

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-      /* cryptographically strong randomness, common on *BSD platforms, not
-      so much elsewhere.  Alas. */
-#ifndef NOT_HAVE_ARC4RANDOM_STIR
-      arc4random_stir();
-#endif
+    /* cryptographically strong randomness, common on *BSD platforms, not
+    so much elsewhere.  Alas. */
+# ifndef NOT_HAVE_ARC4RANDOM_STIR
+    arc4random_stir();
+# endif

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-#ifdef HAVE_SRANDOMDEV
-      /* uses random(4) for seeding */
-      srandomdev();
-#else
-      gettimeofday(&tv, NULL);
-      srandom(tv.tv_sec | tv.tv_usec | getpid());
-#endif
+# ifdef HAVE_SRANDOMDEV
+    /* uses random(4) for seeding */
+    srandomdev();
+# else
+    {
+    struct timeval tv;
+    gettimeofday(&tv, NULL);
+    srandom(tv.tv_sec | tv.tv_usec | getpid());
+    }
+# endif

 #else
 #else

-      /* Poor randomness and no seeding here */
+    /* Poor randomness and no seeding here */

 #endif
 
 #endif
 

-      }
-    pid = p2;

     }
     }

+  pid = p2;
+  }

 
 #ifdef HAVE_ARC4RANDOM
 
 #ifdef HAVE_ARC4RANDOM

-  return arc4random() % max;
+return arc4random() % max;

 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)
 #elif defined(HAVE_SRANDOM) || defined(HAVE_SRANDOMDEV)

-  return random() % max;
+return random() % max;

 #else
 #else

-  /* This one returns a 16-bit number, definitely not crypto-strong */
-  return random_number(max);
+/* This one returns a 16-bit number, definitely not crypto-strong */
+return random_number(max);

 #endif
 }
 
 #endif
 }
 


@@ -1285,7 +1289,7 @@ return string_nextinlist(&list, &sep, NULL, 0);
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 
 /* Certificate fields, by name.  Worry about by-OID later */
 /* Names are chosen to not have common prefixes */
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 typedef struct
 {
 uschar * name;
 typedef struct
 {
 uschar * name;


@@ -1346,7 +1350,7 @@ expand_string_message =
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }
   string_sprintf("bad field selector \"%s\" for certextract", field);
 return NULL;
 }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
 /*************************************************
 *        Extract a substring from a string       *
 
 /*************************************************
 *        Extract a substring from a string       *


@@ -3656,7 +3660,7 @@ return yield;
 }
 
 
 }
 
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {
 static gstring *
 cat_file_tls(void * tls_ctx, gstring * yield, uschar * eol)
 {


@@ -4937,13 +4941,13 @@ while (*s != 0)
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;
       client_conn_ctx cctx;
       int timeout = 5;
       int save_ptr = yield->ptr;

-      FILE * fp;
+      FILE * fp = NULL;

       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;
       uschar * arg;
       uschar * sub_arg[4];
       uschar * server_name = NULL;
       host_item host;
       BOOL do_shutdown = TRUE;

-      BOOL do_tls = FALSE;     /* Only set under SUPPORT_TLS */
+      BOOL do_tls = FALSE;     /* Only set under ! DISABLE_TLS */

       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)
       blob reqstr;
 
       if (expand_forbid & RDO_READSOCK)


@@ -4987,7 +4991,7 @@ while (*s != 0)
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }
        while ((item = string_nextinlist(&list, &sep, NULL, 0)))
          if (Ustrncmp(item, US"shutdown=", 9) == 0)
            { if (Ustrcmp(item + 9, US"no") == 0) do_shutdown = FALSE; }

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif
          else if (Ustrncmp(item, US"tls=", 4) == 0)
            { if (Ustrcmp(item + 9, US"no") != 0) do_tls = TRUE; }
 #endif


@@ -5043,7 +5047,7 @@ while (*s != 0)
             port = ntohs(service_info->s_port);
             }
 
             port = ntohs(service_info->s_port);
             }
 

-         /*XXX we trust that the request is idempotent.  Hmm. */
+         /*XXX we trust that the request is idempotent for TFO.  Hmm. */

          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);
          cctx.sock = ip_connectedsocket(SOCK_STREAM, server_name, port, port,
                  timeout, &host, &expand_string_message,
                  do_tls ? NULL : &reqstr);


@@ -5094,7 +5098,7 @@ while (*s != 0)
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 
 
         DEBUG(D_expand) debug_printf_indent("connected to socket %s\n", sub_arg[0]);
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };
        if (do_tls)
          {
          smtp_connect_args conn_args = {.host = &host };


@@ -5119,8 +5123,8 @@ while (*s != 0)
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (
           DEBUG(D_expand) debug_printf_indent("writing \"%s\" to socket\n",
             reqstr.data);
           if ( (

-#ifdef SUPPORT_TLS
-             cctx.tls_ctx ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :
+#ifndef DISABLE_TLS
+             do_tls ? tls_write(cctx.tls_ctx, reqstr.data, reqstr.len, FALSE) :

 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {
 #endif
                        write(cctx.sock, reqstr.data, reqstr.len)) != reqstr.len)
             {


@@ -5135,7 +5139,7 @@ while (*s != 0)
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR
         system doesn't have this function, make it conditional. */
 
 #ifdef SHUT_WR

-       if (!cctx.tls_ctx && do_shutdown) shutdown(cctx.sock, SHUT_WR);
+       if (!do_tls && do_shutdown) shutdown(cctx.sock, SHUT_WR);

 #endif
 
        if (f.running_in_test_harness) millisleep(100);
 #endif
 
        if (f.running_in_test_harness) millisleep(100);


@@ -5143,19 +5147,19 @@ while (*s != 0)
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 
         /* Now we need to read from the socket, under a timeout. The function
         that reads a file can be used. */
 

-       if (!cctx.tls_ctx)
+       if (!do_tls)

          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =
          fp = fdopen(cctx.sock, "rb");
         sigalrm_seen = FALSE;
         ALARM(timeout);
         yield =

-#ifdef SUPPORT_TLS
-         cctx.tls_ctx ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :
+#ifndef DISABLE_TLS
+         do_tls ? cat_file_tls(cctx.tls_ctx, yield, sub_arg[3]) :

 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 
 #endif
                    cat_file(fp, yield, sub_arg[3]);
         ALARM_CLR(0);
 

-#ifdef SUPPORT_TLS
-       if (cctx.tls_ctx)
+#ifndef DISABLE_TLS
+       if (do_tls)

          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);
          {
          tls_close(cctx.tls_ctx, TRUE);
          close(cctx.sock);


@@ -5988,7 +5992,7 @@ while (*s != 0)
       continue;
       }
 
       continue;
       }
 

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;
     case EITEM_CERTEXTRACT:
       {
       uschar *save_lookup_value = lookup_value;


@@ -6068,7 +6072,7 @@ while (*s != 0)
         save_expand_nlength);
       continue;
       }
         save_expand_nlength);
       continue;
       }

-#endif /*SUPPORT_TLS*/
+#endif /*DISABLE_TLS*/

 
     /* Handle list operations */
 
 
     /* Handle list operations */
 


@@ -6580,7 +6584,7 @@ while (*s != 0)
     int c;
     uschar *arg = NULL;
     uschar *sub;
     int c;
     uschar *arg = NULL;
     uschar *sub;

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

     var_entry *vp = NULL;
 #endif
 
     var_entry *vp = NULL;
 #endif
 


@@ -6603,7 +6607,7 @@ while (*s != 0)
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {
     as we do not want to do the usual expansion. For most, expand the string.*/
     switch(c)
       {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:
       case EOP_MD5:
       case EOP_SHA1:
       case EOP_SHA256:


@@ -6758,7 +6762,7 @@ while (*s != 0)
         }
 
       case EOP_MD5:
         }
 
       case EOP_MD5:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_md5(*(void **)vp->value);


@@ -6777,7 +6781,7 @@ while (*s != 0)
         continue;
 
       case EOP_SHA1:
         continue;
 
       case EOP_SHA1:

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);
        if (vp && *(void **)vp->value)
          {
          uschar * cp = tls_cert_fprt_sha1(*(void **)vp->value);


@@ -6795,23 +6799,35 @@ while (*s != 0)
          }
         continue;
 
          }
         continue;
 

+      case EOP_SHA2:

       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)
          {
       case EOP_SHA256:
 #ifdef EXIM_HAVE_SHA2
        if (vp && *(void **)vp->value)
          {

-         uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
-         yield = string_cat(yield, cp);
+         if (c == EOP_SHA256)
+           {
+           uschar * cp = tls_cert_fprt_sha256(*(void **)vp->value);
+           yield = string_cat(yield, cp);
+           }
+         else
+           expand_string_message = US"sha2_N not supported with certificates";

          }
        else
          {
          hctx h;
          blob b;
          }
        else
          {
          hctx h;
          blob b;

+         hashmethod m = !arg ? HASH_SHA2_256
+           : Ustrcmp(arg, "256") == 0 ? HASH_SHA2_256
+           : Ustrcmp(arg, "384") == 0 ? HASH_SHA2_384
+           : Ustrcmp(arg, "512") == 0 ? HASH_SHA2_512
+           : HASH_BADTYPE;

 
 

-         if (!exim_sha_init(&h, HASH_SHA2_256))
+         if (m == HASH_BADTYPE || !exim_sha_init(&h, m))

            {
            {

-           expand_string_message = US"unrecognised sha256 variant";
+           expand_string_message = US"unrecognised sha2 variant";

            goto EXPAND_FAILED;
            }
            goto EXPAND_FAILED;
            }

+

          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)
          exim_sha_update(&h, sub, Ustrlen(sub));
          exim_sha_finish(&h, &b);
          while (b.len-- > 0)


@@ -7548,7 +7564,7 @@ while (*s != 0)
       case EOP_STR2B64:
       case EOP_BASE64:
        {
       case EOP_STR2B64:
       case EOP_BASE64:
        {

-#ifdef SUPPORT_TLS
+#ifndef DISABLE_TLS

        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));
        uschar * s = vp && *(void **)vp->value
          ? tls_cert_der_b64(*(void **)vp->value)
          : b64encode(CUS sub, Ustrlen(sub));