[exim-cvs] Acl expansions: tests and documentation

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Exim Git Commits Mailing List
Datum:  
To: exim-cvs
Betreff: [exim-cvs] Acl expansions: tests and documentation
Gitweb: http://git.exim.org/exim.git/commitdiff/bef3ea7f5de507f4eda7f32ac767ec6ac0441d57
Commit:     bef3ea7f5de507f4eda7f32ac767ec6ac0441d57
Parent:     f60d98e8a1d3f9ca2805fdeee7c8062b44c5362d
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Wed Jun 27 20:55:23 2012 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Wed Jun 27 20:55:23 2012 +0100


    Acl expansions: tests and documentation
---
 doc/doc-docbook/spec.xfpt    |   29 +++++++++++++++++++++++++----
 doc/doc-txt/ChangeLog        |    4 +++-
 doc/doc-txt/NewStuff         |   13 +++++++++----
 src/src/acl.c                |   11 ++++++++---
 src/src/expand.c             |   15 +++++++++------
 test/confs/0002              |    7 +++++++
 test/scripts/0000-Basic/0002 |   10 +++++++++-
 test/stdout/0002             |   14 +++++++++++---
 8 files changed, 81 insertions(+), 22 deletions(-)


diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 29aacf6..eb5bd4c 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8764,14 +8764,15 @@ expansion item below.
.cindex "&%acl%&" "call from expansion"
The name and zero to nine argument strings are first expanded separately. The expanded
arguments are assigned to the variables &$acl_arg1$& to &$acl_arg9$& in order.
-Any used are made empty. The variable &$acl_narg$& is set to the number of
+Any unused are made empty. The variable &$acl_narg$& is set to the number of
arguments. The named ACL (see chapter &<<CHAPACL>>&) is called
and may use the variables; if another acl expansion is used the values
are overwritten. If the ACL sets
-a value using a "message =" modifier and returns accept, the value becomes
+a value using a "message =" modifier and returns accept or deny, the value becomes
the result of the expansion.
-If no message was set but the ACL returned accept, or if the ACL returned defer,
-the value is an empty string. Otherwise the expansion fails.
+If no message was set and the ACL returned accept or deny
+the value is an empty string.
+If the ACL returned defer the result is a forced-fail. Otherwise the expansion fails.


.vitem "&*${dlfunc{*&<&'file'&>&*}{*&<&'function'&>&*}{*&<&'arg'&>&*}&&&
@@ -10059,6 +10060,21 @@ In all cases, a relative comparator OP is testing if <&'string1'&> OP
10M, not if 10M is larger than &$message_size$&.


+.vitem &*acl&~{{*&<&'name'&>&*}{*&<&'arg1'&>&*}&&&
+    {*&<&'arg2'&>&*}...}*&
+.cindex "expansion" "calling an acl"
+.cindex "&%acl%&" "expansion condition"
+The name and zero to nine argument strings are first expanded separately.  The expanded
+arguments are assigned to the variables &$acl_arg1$& to &$acl_arg9$& in order.
+Any unused are made empty.  The variable &$acl_narg$& is set to the number of
+arguments.  The named ACL (see chapter &<<CHAPACL>>&) is called
+and may use the variables; if another acl expansion is used the values
+are overwritten.  If the ACL sets
+a value using a "message =" modifier the variable $value becomes
+the result of the expansion, otherwise it is empty.
+If the ACL returns accept the condition is true; if deny, false.
+If the ACL returns defer the result is a forced-fail.
+
 .vitem &*bool&~{*&<&'string'&>&*}*&
 .cindex "expansion" "boolean parsing"
 .cindex "&%bool%& expansion condition"
@@ -27301,6 +27317,7 @@ The conditions are as follows:
 .vitem &*acl&~=&~*&<&'name&~of&~acl&~or&~ACL&~string&~or&~file&~name&~'&>
 .cindex "&ACL;" "nested"
 .cindex "&ACL;" "indirect"
+.cindex "&ACL;" "arguments"
 .cindex "&%acl%& ACL condition"
 The possible values of the argument are the same as for the
 &%acl_smtp_%&&'xxx'& options. The named or inline ACL is run. If it returns
@@ -27310,6 +27327,10 @@ condition is on a &%warn%& verb. In that case, a &"defer"& return makes the
 condition false. This means that further processing of the &%warn%& verb
 ceases, but processing of the ACL continues.


+If the argument is a named ACL, up to nine space-separated optional values
+can be appended; they appear in $acl_arg1 to $acl_arg9, and $acl_narg is set
+to the count of values. The name and values are expanded separately.
+
If the nested &%acl%& returns &"drop"& and the outer condition denies access,
the connection is dropped. If it returns &"discard"&, the verb must be
&%accept%& or &%discard%&, and the action is taken immediately &-- no further
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 504c3f5..9dbc65c 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -44,7 +44,9 @@ NM/01 Bugzilla 1197 - Spec typo

JH/03 Add expansion operators ${listnamed:name} and ${listcount:string}

-JH/04 Add expansion item ${acl {name}{arg}...}
+JH/04 Add expansion item ${acl {name}{arg}...}, expansion condition
+      "acl {{name}{arg}...}", and optional args on acl condition
+      "acl = name arg..."


 Exim version 4.80
 -----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index 3c5c491..df2ede8 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -87,10 +87,15 @@ Version 4.81
  8. New expansion operators ${listnamed:name} to get the content of a named list
     and ${listcount:string} to count the items in a list.


- 9. New expansion item ${acl {name}{arg}...} to call an ACL.  The argument can
-    be accessed by the ACL in $acl_arg1 to $acl_arg9.  $acl_narg will be the
-    number of arguments. The expansion result is set by a "message =" modifier
-    and an "accept" return from the ACL.
+ 9. The "acl = name" condition on an ACL now supports optional arguments.
+    New expansion item "${acl {name}{arg}...}" and expansion condition
+    "acl {{name}{arg}...}" are added.  In all cases up to nine arguments
+    can be used, appearing in $acl_arg1 to $acl_arg9 for the called ACL.
+    Variable $acl_narg contains the number of arguments.  If the ACL sets
+    a "message =" value this becomes the result of the expansion item,
+    or the value of $value for the expansion condition.  If the ACL returns
+    accept the expansion condition is true; if reject, false.  A defer
+    return results in a forced fail.


 Version 4.80
 ------------
diff --git a/src/src/acl.c b/src/src/acl.c
index d0db717..5cd0c35 100644
--- a/src/src/acl.c
+++ b/src/src/acl.c
@@ -3873,23 +3873,28 @@ acl_check_wargs(int where, address_item *addr, uschar *s, int level,
   uschar **user_msgptr, uschar **log_msgptr)
 {
 uschar * tmp;
+uschar * tmp_arg[9];    /* must match acl_arg[] */
 uschar * name;
+int i;


if (!(tmp = string_dequote(&s)) || !(name = expand_string(tmp)))
goto bad;

-for (acl_narg = 0; acl_narg < sizeof(acl_arg)/sizeof(*acl_arg); acl_narg++)
+for (i = 0; i < 9; i++)
   {
   while (*s && isspace(*s)) s++;
   if (!*s) break;
-  if (!(tmp = string_dequote(&s)) || !(acl_arg[acl_narg] = expand_string(tmp)))
+  if (!(tmp = string_dequote(&s)) || !(tmp_arg[i] = expand_string(tmp)))
     {
     tmp = name;
     goto bad;
     }
   }
+acl_narg = i;
+for (i = 0; i < acl_narg; i++) acl_arg[i] = tmp_arg[i];
+while (i < 9) acl_arg[i++] = NULL;


-return acl_check_internal(where, addr, name, level+1, user_msgptr, log_msgptr);
+return acl_check_internal(where, addr, name, level, user_msgptr, log_msgptr);

bad:
if (expand_string_forcedfail) return ERROR;
diff --git a/src/src/expand.c b/src/src/expand.c
index 60552a8..767e477 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -1855,7 +1855,7 @@ uschar *dummy_log_msg;
for (i = 1; i < nsub && sub[i]; i++)
acl_arg[i-1] = sub[i];
acl_narg = i-1;
-while (i < sizeof(sub)/sizeof(*sub))
+while (i < nsub)
acl_arg[i++ - 1] = NULL;

DEBUG(D_expand)
@@ -2111,11 +2111,13 @@ switch(cond_type)
*/

   case ECOND_ACL:
-    /* ${if acl {{name}{arg1}{arg2}...}  {yes}{no}}
+    /* ${if acl {{name}{arg1}{arg2}...}  {yes}{no}} */
     {
     uschar *nameargs;
     uschar *user_msg;
     BOOL cond = FALSE;
+    int size = 0;
+    int ptr = 0;


     while (isspace(*s)) s++;
     if (*s++ != '{') goto COND_FAILED_CURLY_START;
@@ -2129,16 +2131,17 @@ switch(cond_type)
       case 3: return NULL;
       }


-    if (yield != NULL)
-      switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
+    if (yield != NULL) switch(eval_acl(sub, sizeof(sub)/sizeof(*sub), &user_msg))
     {
     case OK:
       cond = TRUE;
     case FAIL:
+          lookup_value = NULL;
       if (user_msg)
+        {
             lookup_value = string_cat(NULL, &size, &ptr, user_msg, Ustrlen(user_msg));
-      else
-        lookup_value = NULL;
+            lookup_value[ptr] = '\0';
+        }
       *yield = cond;
       break;


diff --git a/test/confs/0002 b/test/confs/0002
index df65e2c..eb473e6 100644
--- a/test/confs/0002
+++ b/test/confs/0002
@@ -51,5 +51,12 @@ a_none:
accept

a_deny:
+ deny message = ($acl_narg) [$acl_arg1] [$acl_arg2]
+
+a_defer:
+ defer
+
+a_sub:
+ require acl = a_deny "new arg1" $acl_arg1

# End
diff --git a/test/scripts/0000-Basic/0002 b/test/scripts/0000-Basic/0002
index 62a0a1f..3e2421b 100644
--- a/test/scripts/0000-Basic/0002
+++ b/test/scripts/0000-Basic/0002
@@ -88,7 +88,7 @@ reduce: ${reduce {<\x7f 1\x7f2\177 3}{0}{${eval:$value+$item}}}

acl: ${acl
acl: ${acl}
-acl: ${acl {a_bad}}
+acl: ${acl {a_nosuch}}
acl: ${acl {a_ret}}
acl: ${acl {a_ret}{person@???}}
acl: ${acl {a_ret}{firstarg}{secondarg}}
@@ -97,6 +97,8 @@ acl: ${acl {a_none}}
acl: ${acl {a_none}{person@???}}
acl: ${acl {a_deny}}
acl: ${acl {a_deny}{person@???}}
+acl: ${acl {a_defer}}
+acl: ${acl {a_sub}{top_arg_1}{top_arg_2}{top_arg_3}}
acl: ${reduce {1:2:3:4} {} {$value ${acl {a_ret}{$item}}}}

addrss: ${address:local-part@???}
@@ -421,6 +423,12 @@ first_delivery: ${if first_delivery{y}{n}}
queue_running after or: ${if or{{eq {0}{0}}{queue_running}}{y}{n}}
first_delivery after or: ${if or{{eq {0}{0}}{first_delivery}}{y}{n}}

+# acl expansion condition
+acl if: ${if acl {{a_ret}}               {Y:$value}{N:$value}}
+acl if: ${if acl {{a_ret}{argY}}         {Y:$value}{N:$value}}
+acl if: ${if acl {{a_deny}{argN}{arg2}}  {Y:$value}{N:$value}}
+acl if: ${if acl {{a_defer}{argN}{arg2}} {Y:$value}{N:$value}}
+
 # Default values for both if strings


\${if eq{1}{1}} >${if eq{1}{1}}<
diff --git a/test/stdout/0002 b/test/stdout/0002
index edf18d1..b4b96df 100644
--- a/test/stdout/0002
+++ b/test/stdout/0002
@@ -80,15 +80,17 @@
>
> Failed: missing or misplaced { or }
> Failed: missing or misplaced { or }

-> Failed: acl "a_bad" did not accept
+> Failed: error from acl "a_nosuch"
> acl: (0) [] []
> acl: (1) [person@???] []
> acl: (2) [firstarg] [secondarg]
> acl: (1) [arg with spaces] []
> acl:
> acl:

-> Failed: acl "a_deny" did not accept
-> Failed: acl "a_deny" did not accept
+> acl: (0) [] []
+> acl: (1) [person@???] []
+> Failed: error from acl "a_defer"
+> acl: (2) [new arg1] [top_arg_1]
> acl: (1) [1] [] (1) [2] [] (1) [3] [] (1) [4] []
>
> addrss: local-part@???

@@ -390,6 +392,12 @@
> queue_running after or: y
> first_delivery after or: y
>

+> # acl expansion condition
+> acl if: Y:(0) [] []
+> acl if: Y:(1) [argY] []
+> acl if: N:(2) [argN] [arg2]
+> Failed: error from acl "a_defer"
+>
> # Default values for both if strings
>
> ${if eq{1}{1}} >true<