Routing: avoid doing the one_time replacement operation when a redirect leaves the...
[exim.git] / src / src / deliver.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* The main code for delivering a message. */
9
10
11#include "exim.h"
dadff1d4 12#include <assert.h>
059ec3d9
PH
13
14
15/* Data block for keeping track of subprocesses for parallel remote
16delivery. */
17
18typedef struct pardata {
19 address_item *addrlist; /* chain of addresses */
20 address_item *addr; /* next address data expected for */
21 pid_t pid; /* subprocess pid */
22 int fd; /* pipe fd for getting result from subprocess */
23 int transport_count; /* returned transport count value */
24 BOOL done; /* no more data needed */
25 uschar *msg; /* error message */
26 uschar *return_path; /* return_path for these addresses */
27} pardata;
28
29/* Values for the process_recipients variable */
30
31enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
32 RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
33 RECIP_FAIL_LOOP};
34
35/* Mutually recursive functions for marking addresses done. */
36
37static void child_done(address_item *, uschar *);
38static void address_done(address_item *, uschar *);
39
40/* Table for turning base-62 numbers into binary */
41
42static uschar tab62[] =
43 {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
44 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
45 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
46 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
47 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
48 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
49 59,60,61}; /* x-z */
50
51
52/*************************************************
53* Local static variables *
54*************************************************/
55
56/* addr_duplicate is global because it needs to be seen from the Envelope-To
57writing code. */
58
59static address_item *addr_defer = NULL;
60static address_item *addr_failed = NULL;
61static address_item *addr_fallback = NULL;
62static address_item *addr_local = NULL;
63static address_item *addr_new = NULL;
64static address_item *addr_remote = NULL;
65static address_item *addr_route = NULL;
66static address_item *addr_succeed = NULL;
6c1c3d1d
WB
67static address_item *addr_dsntmp = NULL;
68static address_item *addr_senddsn = NULL;
059ec3d9
PH
69
70static FILE *message_log = NULL;
71static BOOL update_spool;
72static BOOL remove_journal;
73static int parcount = 0;
74static pardata *parlist = NULL;
75static int return_count;
76static uschar *frozen_info = US"";
77static uschar *used_return_path = NULL;
78
059ec3d9
PH
79
80
81/*************************************************
82* Make a new address item *
83*************************************************/
84
85/* This function gets the store and initializes with default values. The
86transport_return value defaults to DEFER, so that any unexpected failure to
87deliver does not wipe out the message. The default unique string is set to a
88copy of the address, so that its domain can be lowercased.
89
90Argument:
91 address the RFC822 address string
92 copy force a copy of the address
93
94Returns: a pointer to an initialized address_item
95*/
96
97address_item *
98deliver_make_addr(uschar *address, BOOL copy)
99{
100address_item *addr = store_get(sizeof(address_item));
101*addr = address_defaults;
102if (copy) address = string_copy(address);
103addr->address = address;
104addr->unique = string_copy(address);
105return addr;
106}
107
108
109
110
111/*************************************************
112* Set expansion values for an address *
113*************************************************/
114
115/* Certain expansion variables are valid only when handling an address or
116address list. This function sets them up or clears the values, according to its
117argument.
118
119Arguments:
120 addr the address in question, or NULL to clear values
121Returns: nothing
122*/
123
124void
125deliver_set_expansions(address_item *addr)
126{
d6c82d7b 127if (!addr)
059ec3d9 128 {
55414b25 129 const uschar ***p = address_expansions;
d6c82d7b 130 while (*p) **p++ = NULL;
059ec3d9
PH
131 return;
132 }
133
134/* Exactly what gets set depends on whether there is one or more addresses, and
135what they contain. These first ones are always set, taking their values from
136the first address. */
137
d6c82d7b 138if (!addr->host_list)
059ec3d9
PH
139 {
140 deliver_host = deliver_host_address = US"";
a7538db1 141 deliver_host_port = 0;
059ec3d9
PH
142 }
143else
144 {
145 deliver_host = addr->host_list->name;
146 deliver_host_address = addr->host_list->address;
a7538db1 147 deliver_host_port = addr->host_list->port;
059ec3d9
PH
148 }
149
150deliver_recipients = addr;
d43cbe25
JH
151deliver_address_data = addr->prop.address_data;
152deliver_domain_data = addr->prop.domain_data;
153deliver_localpart_data = addr->prop.localpart_data;
059ec3d9
PH
154
155/* These may be unset for multiple addresses */
156
157deliver_domain = addr->domain;
158self_hostname = addr->self_hostname;
159
8523533c
TK
160#ifdef EXPERIMENTAL_BRIGHTMAIL
161bmi_deliver = 1; /* deliver by default */
162bmi_alt_location = NULL;
163bmi_base64_verdict = NULL;
164bmi_base64_tracker_verdict = NULL;
165#endif
166
059ec3d9
PH
167/* If there's only one address we can set everything. */
168
d6c82d7b 169if (!addr->next)
059ec3d9
PH
170 {
171 address_item *addr_orig;
172
173 deliver_localpart = addr->local_part;
174 deliver_localpart_prefix = addr->prefix;
175 deliver_localpart_suffix = addr->suffix;
176
d6c82d7b 177 for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
059ec3d9
PH
178 deliver_domain_orig = addr_orig->domain;
179
180 /* Re-instate any prefix and suffix in the original local part. In all
181 normal cases, the address will have a router associated with it, and we can
182 choose the caseful or caseless version accordingly. However, when a system
183 filter sets up a pipe, file, or autoreply delivery, no router is involved.
184 In this case, though, there won't be any prefix or suffix to worry about. */
185
d6c82d7b
JH
186 deliver_localpart_orig = !addr_orig->router
187 ? addr_orig->local_part
188 : addr_orig->router->caseful_local_part
189 ? addr_orig->cc_local_part
190 : addr_orig->lc_local_part;
059ec3d9
PH
191
192 /* If there's a parent, make its domain and local part available, and if
193 delivering to a pipe or file, or sending an autoreply, get the local
194 part from the parent. For pipes and files, put the pipe or file string
195 into address_pipe and address_file. */
196
d6c82d7b 197 if (addr->parent)
059ec3d9
PH
198 {
199 deliver_domain_parent = addr->parent->domain;
d6c82d7b
JH
200 deliver_localpart_parent = !addr->parent->router
201 ? addr->parent->local_part
202 : addr->parent->router->caseful_local_part
203 ? addr->parent->cc_local_part
204 : addr->parent->lc_local_part;
059ec3d9
PH
205
206 /* File deliveries have their own flag because they need to be picked out
207 as special more often. */
208
209 if (testflag(addr, af_pfr))
210 {
d6c82d7b
JH
211 if (testflag(addr, af_file)) address_file = addr->local_part;
212 else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
059ec3d9
PH
213 deliver_localpart = addr->parent->local_part;
214 deliver_localpart_prefix = addr->parent->prefix;
215 deliver_localpart_suffix = addr->parent->suffix;
216 }
217 }
8523533c
TK
218
219#ifdef EXPERIMENTAL_BRIGHTMAIL
220 /* Set expansion variables related to Brightmail AntiSpam */
221 bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
222 bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
223 /* get message delivery status (0 - don't deliver | 1 - deliver) */
224 bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
225 /* if message is to be delivered, get eventual alternate location */
d6c82d7b 226 if (bmi_deliver == 1)
8523533c 227 bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
8523533c
TK
228#endif
229
059ec3d9
PH
230 }
231
232/* For multiple addresses, don't set local part, and leave the domain and
f7fd3850
PH
233self_hostname set only if it is the same for all of them. It is possible to
234have multiple pipe and file addresses, but only when all addresses have routed
235to the same pipe or file. */
059ec3d9
PH
236
237else
238 {
239 address_item *addr2;
f7fd3850
PH
240 if (testflag(addr, af_pfr))
241 {
d6c82d7b
JH
242 if (testflag(addr, af_file)) address_file = addr->local_part;
243 else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
f7fd3850 244 }
d6c82d7b 245 for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 246 {
d6c82d7b 247 if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
059ec3d9 248 deliver_domain = NULL;
d6c82d7b
JH
249 if ( self_hostname
250 && ( !addr2->self_hostname
251 || Ustrcmp(self_hostname, addr2->self_hostname) != 0
252 ) )
059ec3d9 253 self_hostname = NULL;
d6c82d7b 254 if (!deliver_domain && !self_hostname) break;
059ec3d9
PH
255 }
256 }
257}
258
259
260
261
262/*************************************************
263* Open a msglog file *
264*************************************************/
265
266/* This function is used both for normal message logs, and for files in the
267msglog directory that are used to catch output from pipes. Try to create the
268directory if it does not exist. From release 4.21, normal message logs should
269be created when the message is received.
270
271Argument:
272 filename the file name
273 mode the mode required
274 error used for saying what failed
275
276Returns: a file descriptor, or -1 (with errno set)
277*/
278
279static int
280open_msglog_file(uschar *filename, int mode, uschar **error)
281{
282int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
283
284if (fd < 0 && errno == ENOENT)
285 {
41313d92
JH
286 (void)directory_make(spool_directory,
287 spool_sname(US"msglog", message_subdir),
288 MSGLOG_DIRECTORY_MODE, TRUE);
059ec3d9
PH
289 fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
290 }
291
292/* Set the close-on-exec flag and change the owner to the exim uid/gid (this
293function is called as root). Double check the mode, because the group setting
294doesn't always get set automatically. */
295
296if (fd >= 0)
297 {
ff790e47 298 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
059ec3d9
PH
299 if (fchown(fd, exim_uid, exim_gid) < 0)
300 {
301 *error = US"chown";
302 return -1;
303 }
304 if (fchmod(fd, mode) < 0)
305 {
306 *error = US"chmod";
307 return -1;
308 }
309 }
310else *error = US"create";
311
312return fd;
313}
314
315
316
317
318/*************************************************
319* Write to msglog if required *
320*************************************************/
321
322/* Write to the message log, if configured. This function may also be called
323from transports.
324
325Arguments:
326 format a string format
327
328Returns: nothing
329*/
330
331void
332deliver_msglog(const char *format, ...)
333{
334va_list ap;
335if (!message_logs) return;
336va_start(ap, format);
337vfprintf(message_log, format, ap);
338fflush(message_log);
339va_end(ap);
340}
341
342
343
344
345/*************************************************
346* Replicate status for batch *
347*************************************************/
348
349/* When a transport handles a batch of addresses, it may treat them
350individually, or it may just put the status in the first one, and return FALSE,
351requesting that the status be copied to all the others externally. This is the
352replication function. As well as the status, it copies the transport pointer,
353which may have changed if appendfile passed the addresses on to a different
354transport.
355
356Argument: pointer to the first address in a chain
357Returns: nothing
358*/
359
360static void
361replicate_status(address_item *addr)
362{
363address_item *addr2;
d6c82d7b 364for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 365 {
d6c82d7b 366 addr2->transport = addr->transport;
059ec3d9 367 addr2->transport_return = addr->transport_return;
d6c82d7b
JH
368 addr2->basic_errno = addr->basic_errno;
369 addr2->more_errno = addr->more_errno;
370 addr2->special_action = addr->special_action;
371 addr2->message = addr->message;
372 addr2->user_message = addr->user_message;
059ec3d9
PH
373 }
374}
375
376
377
378/*************************************************
379* Compare lists of hosts *
380*************************************************/
381
382/* This function is given two pointers to chains of host items, and it yields
383TRUE if the lists refer to the same hosts in the same order, except that
384
385(1) Multiple hosts with the same non-negative MX values are permitted to appear
386 in different orders. Round-robinning nameservers can cause this to happen.
387
388(2) Multiple hosts with the same negative MX values less than MX_NONE are also
389 permitted to appear in different orders. This is caused by randomizing
390 hosts lists.
391
392This enables Exim to use a single SMTP transaction for sending to two entirely
393different domains that happen to end up pointing at the same hosts.
394
395Arguments:
396 one points to the first host list
397 two points to the second host list
398
399Returns: TRUE if the lists refer to the same host set
400*/
401
402static BOOL
403same_hosts(host_item *one, host_item *two)
404{
d6c82d7b 405while (one && two)
059ec3d9
PH
406 {
407 if (Ustrcmp(one->name, two->name) != 0)
408 {
409 int mx = one->mx;
410 host_item *end_one = one;
411 host_item *end_two = two;
412
413 /* Batch up only if there was no MX and the list was not randomized */
414
415 if (mx == MX_NONE) return FALSE;
416
417 /* Find the ends of the shortest sequence of identical MX values */
418
d6c82d7b
JH
419 while ( end_one->next && end_one->next->mx == mx
420 && end_two->next && end_two->next->mx == mx)
059ec3d9
PH
421 {
422 end_one = end_one->next;
423 end_two = end_two->next;
424 }
425
426 /* If there aren't any duplicates, there's no match. */
427
428 if (end_one == one) return FALSE;
429
430 /* For each host in the 'one' sequence, check that it appears in the 'two'
431 sequence, returning FALSE if not. */
432
433 for (;;)
434 {
435 host_item *hi;
436 for (hi = two; hi != end_two->next; hi = hi->next)
437 if (Ustrcmp(one->name, hi->name) == 0) break;
438 if (hi == end_two->next) return FALSE;
439 if (one == end_one) break;
440 one = one->next;
441 }
442
443 /* All the hosts in the 'one' sequence were found in the 'two' sequence.
444 Ensure both are pointing at the last host, and carry on as for equality. */
445
446 two = end_two;
447 }
448
1c788856
JH
449 /* if the names matched but ports do not, mismatch */
450 else if (one->port != two->port)
451 return FALSE;
452
059ec3d9
PH
453 /* Hosts matched */
454
455 one = one->next;
456 two = two->next;
457 }
458
459/* True if both are NULL */
460
461return (one == two);
462}
463
464
465
466/*************************************************
467* Compare header lines *
468*************************************************/
469
470/* This function is given two pointers to chains of header items, and it yields
471TRUE if they are the same header texts in the same order.
472
473Arguments:
474 one points to the first header list
475 two points to the second header list
476
477Returns: TRUE if the lists refer to the same header set
478*/
479
480static BOOL
481same_headers(header_line *one, header_line *two)
482{
d6c82d7b 483for (;; one = one->next, two = two->next)
059ec3d9
PH
484 {
485 if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 486 if (!one || !two) return FALSE;
059ec3d9 487 if (Ustrcmp(one->text, two->text) != 0) return FALSE;
059ec3d9
PH
488 }
489}
490
491
492
493/*************************************************
494* Compare string settings *
495*************************************************/
496
497/* This function is given two pointers to strings, and it returns
498TRUE if they are the same pointer, or if the two strings are the same.
499
500Arguments:
501 one points to the first string
502 two points to the second string
503
504Returns: TRUE or FALSE
505*/
506
507static BOOL
508same_strings(uschar *one, uschar *two)
509{
510if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 511if (!one || !two) return FALSE;
059ec3d9
PH
512return (Ustrcmp(one, two) == 0);
513}
514
515
516
517/*************************************************
518* Compare uid/gid for addresses *
519*************************************************/
520
521/* This function is given a transport and two addresses. It yields TRUE if the
522uid/gid/initgroups settings for the two addresses are going to be the same when
523they are delivered.
524
525Arguments:
526 tp the transort
527 addr1 the first address
528 addr2 the second address
529
530Returns: TRUE or FALSE
531*/
532
533static BOOL
534same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
535{
d6c82d7b
JH
536if ( !tp->uid_set && !tp->expand_uid
537 && !tp->deliver_as_creator
538 && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
539 || ( testflag(addr1, af_uid_set)
540 && ( addr1->uid != addr2->uid
541 || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
542 ) ) ) )
543 return FALSE;
059ec3d9 544
d6c82d7b
JH
545if ( !tp->gid_set && !tp->expand_gid
546 && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
547 || ( testflag(addr1, af_gid_set)
548 && addr1->gid != addr2->gid
549 ) ) )
550 return FALSE;
059ec3d9
PH
551
552return TRUE;
553}
554
555
556
557
558/*************************************************
559* Record that an address is complete *
560*************************************************/
561
562/* This function records that an address is complete. This is straightforward
563for most addresses, where the unique address is just the full address with the
564domain lower cased. For homonyms (addresses that are the same as one of their
565ancestors) their are complications. Their unique addresses have \x\ prepended
566(where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
567cousins.
568
569Exim used to record the unique addresses of homonyms as "complete". This,
570however, fails when the pattern of redirection varies over time (e.g. if taking
571unseen copies at only some times of day) because the prepended numbers may vary
572from one delivery run to the next. This problem is solved by never recording
573prepended unique addresses as complete. Instead, when a homonymic address has
574actually been delivered via a transport, we record its basic unique address
575followed by the name of the transport. This is checked in subsequent delivery
576runs whenever an address is routed to a transport.
577
578If the completed address is a top-level one (has no parent, which means it
579cannot be homonymic) we also add the original address to the non-recipients
580tree, so that it gets recorded in the spool file and therefore appears as
581"done" in any spool listings. The original address may differ from the unique
582address in the case of the domain.
583
584Finally, this function scans the list of duplicates, marks as done any that
585match this address, and calls child_done() for their ancestors.
586
587Arguments:
588 addr address item that has been completed
589 now current time as a string
590
591Returns: nothing
592*/
593
594static void
595address_done(address_item *addr, uschar *now)
596{
597address_item *dup;
598
599update_spool = TRUE; /* Ensure spool gets updated */
600
601/* Top-level address */
602
d6c82d7b 603if (!addr->parent)
059ec3d9
PH
604 {
605 tree_add_nonrecipient(addr->unique);
606 tree_add_nonrecipient(addr->address);
607 }
608
609/* Homonymous child address */
610
611else if (testflag(addr, af_homonym))
612 {
d6c82d7b 613 if (addr->transport)
059ec3d9
PH
614 tree_add_nonrecipient(
615 string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
059ec3d9
PH
616 }
617
618/* Non-homonymous child address */
619
620else tree_add_nonrecipient(addr->unique);
621
622/* Check the list of duplicate addresses and ensure they are now marked
623done as well. */
624
d6c82d7b 625for (dup = addr_duplicate; dup; dup = dup->next)
059ec3d9
PH
626 if (Ustrcmp(addr->unique, dup->unique) == 0)
627 {
57730b52 628 tree_add_nonrecipient(dup->unique);
059ec3d9
PH
629 child_done(dup, now);
630 }
059ec3d9
PH
631}
632
633
634
635
636/*************************************************
637* Decrease counts in parents and mark done *
638*************************************************/
639
640/* This function is called when an address is complete. If there is a parent
641address, its count of children is decremented. If there are still other
642children outstanding, the function exits. Otherwise, if the count has become
643zero, address_done() is called to mark the parent and its duplicates complete.
644Then loop for any earlier ancestors.
645
646Arguments:
647 addr points to the completed address item
648 now the current time as a string, for writing to the message log
649
650Returns: nothing
651*/
652
653static void
654child_done(address_item *addr, uschar *now)
655{
656address_item *aa;
d6c82d7b 657while (addr->parent)
059ec3d9
PH
658 {
659 addr = addr->parent;
660 if ((addr->child_count -= 1) > 0) return; /* Incomplete parent */
661 address_done(addr, now);
662
663 /* Log the completion of all descendents only when there is no ancestor with
664 the same original address. */
665
d6c82d7b 666 for (aa = addr->parent; aa; aa = aa->parent)
059ec3d9 667 if (Ustrcmp(aa->address, addr->address) == 0) break;
d6c82d7b 668 if (aa) continue;
059ec3d9
PH
669
670 deliver_msglog("%s %s: children all complete\n", now, addr->address);
671 DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
672 }
673}
674
675
676
ac881e27
TF
677/*************************************************
678* Delivery logging support functions *
679*************************************************/
680
681/* The LOGGING() checks in d_log_interface() are complicated for backwards
682compatibility. When outgoing interface logging was originally added, it was
683conditional on just incoming_interface (which is off by default). The
684outgoing_interface option is on by default to preserve this behaviour, but
685you can enable incoming_interface and disable outgoing_interface to get I=
686fields on incoming lines only.
687
688Arguments:
689 s The log line buffer
690 sizep Pointer to the buffer size
691 ptrp Pointer to current index into buffer
692 addr The address to be logged
693
694Returns: New value for s
695*/
059ec3d9 696
67d81c10 697static uschar *
ac881e27 698d_log_interface(uschar *s, int *sizep, int *ptrp)
67d81c10 699{
ac881e27 700if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
d6c82d7b 701 && sending_ip_address)
ac881e27
TF
702 {
703 s = string_append(s, sizep, ptrp, 2, US" I=[", sending_ip_address);
d6c82d7b
JH
704 s = LOGGING(outgoing_port)
705 ? string_append(s, sizep, ptrp, 2, US"]:",
706 string_sprintf("%d", sending_port))
c2f669a4 707 : string_catn(s, sizep, ptrp, US"]", 1);
ac881e27
TF
708 }
709return s;
67d81c10
JH
710}
711
ac881e27
TF
712
713
714static uschar *
fc16abb4 715d_hostlog(uschar * s, int * sp, int * pp, address_item * addr)
ac881e27 716{
fc16abb4
JH
717host_item * h = addr->host_used;
718
719s = string_append(s, sp, pp, 2, US" H=", h->name);
720
721if (LOGGING(dnssec) && h->dnssec == DS_YES)
e0cc6cda 722 s = string_catn(s, sp, pp, US" DS", 3);
fc16abb4
JH
723
724s = string_append(s, sp, pp, 3, US" [", h->address, US"]");
725
ac881e27 726if (LOGGING(outgoing_port))
fc16abb4 727 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d", h->port));
e6d2a989
JH
728
729#ifdef SUPPORT_SOCKS
730if (LOGGING(proxy) && proxy_local_address)
731 {
fc16abb4 732 s = string_append(s, sp, pp, 3, US" PRX=[", proxy_local_address, US"]");
e6d2a989 733 if (LOGGING(outgoing_port))
fc16abb4 734 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d",
e6d2a989
JH
735 proxy_local_port));
736 }
737#endif
738
fc16abb4 739return d_log_interface(s, sp, pp);
ac881e27
TF
740}
741
742
743
e6d2a989
JH
744
745
67d81c10
JH
746#ifdef SUPPORT_TLS
747static uschar *
748d_tlslog(uschar * s, int * sizep, int * ptrp, address_item * addr)
749{
d6c82d7b 750if (LOGGING(tls_cipher) && addr->cipher)
ac881e27 751 s = string_append(s, sizep, ptrp, 2, US" X=", addr->cipher);
d6c82d7b 752if (LOGGING(tls_certificate_verified) && addr->cipher)
ac881e27
TF
753 s = string_append(s, sizep, ptrp, 2, US" CV=",
754 testflag(addr, af_cert_verified)
755 ?
53a7196b 756#ifdef EXPERIMENTAL_DANE
ac881e27
TF
757 testflag(addr, af_dane_verified)
758 ? "dane"
759 :
53a7196b 760#endif
ac881e27
TF
761 "yes"
762 : "no");
d6c82d7b 763if (LOGGING(tls_peerdn) && addr->peerdn)
ac881e27
TF
764 s = string_append(s, sizep, ptrp, 3, US" DN=\"",
765 string_printing(addr->peerdn), US"\"");
766return s;
67d81c10
JH
767}
768#endif
769
a7538db1 770
14a465c3
JH
771
772
0cbf2b82 773#ifndef DISABLE_EVENT
b30275b8 774uschar *
55414b25 775event_raise(uschar * action, const uschar * event, uschar * ev_data)
a7538db1
JH
776{
777uschar * s;
778if (action)
779 {
780 DEBUG(D_deliver)
774ef2d7 781 debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
a7538db1
JH
782 event,
783 action, deliver_host_address);
784
774ef2d7
JH
785 event_name = event;
786 event_data = ev_data;
a7538db1
JH
787
788 if (!(s = expand_string(action)) && *expand_string_message)
789 log_write(0, LOG_MAIN|LOG_PANIC,
774ef2d7 790 "failed to expand event_action %s in %s: %s\n",
a7538db1
JH
791 event, transport_name, expand_string_message);
792
774ef2d7 793 event_name = event_data = NULL;
a7538db1
JH
794
795 /* If the expansion returns anything but an empty string, flag for
796 the caller to modify his normal processing
797 */
798 if (s && *s)
799 {
800 DEBUG(D_deliver)
774ef2d7 801 debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
b30275b8 802 return s;
a7538db1
JH
803 }
804 }
b30275b8 805return NULL;
a7538db1 806}
14a465c3 807
5ef5dd52 808void
55414b25 809msg_event_raise(const uschar * event, const address_item * addr)
14a465c3 810{
55414b25 811const uschar * save_domain = deliver_domain;
14a465c3 812uschar * save_local = deliver_localpart;
55414b25 813const uschar * save_host = deliver_host;
5ef5dd52
JB
814const uschar * save_address = deliver_host_address;
815const int save_port = deliver_host_port;
14a465c3
JH
816
817if (!addr->transport)
818 return;
819
820router_name = addr->router ? addr->router->name : NULL;
821transport_name = addr->transport->name;
822deliver_domain = addr->domain;
823deliver_localpart = addr->local_part;
c562fd30 824deliver_host = addr->host_used ? addr->host_used->name : NULL;
14a465c3 825
774ef2d7 826(void) event_raise(addr->transport->event_action, event,
5ef5dd52
JB
827 addr->host_used
828 || Ustrcmp(addr->transport->driver_name, "smtp") == 0
829 || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
830 ? addr->message : NULL);
14a465c3 831
5ef5dd52
JB
832deliver_host_port = save_port;
833deliver_host_address = save_address;
c562fd30 834deliver_host = save_host;
14a465c3
JH
835deliver_localpart = save_local;
836deliver_domain = save_domain;
837router_name = transport_name = NULL;
838}
0cbf2b82 839#endif /*DISABLE_EVENT*/
14a465c3
JH
840
841
a7538db1 842
5dac72a7
JH
843/******************************************************************************/
844
845
846/*************************************************
847* Generate local prt for logging *
848*************************************************/
849
850/* This function is a subroutine for use in string_log_address() below.
851
852Arguments:
853 addr the address being logged
854 yield the current dynamic buffer pointer
855 sizeptr points to current size
856 ptrptr points to current insert pointer
857
858Returns: the new value of the buffer pointer
859*/
860
861static uschar *
862string_get_localpart(address_item *addr, uschar *yield, int *sizeptr,
863 int *ptrptr)
864{
865uschar * s;
866
867s = addr->prefix;
868if (testflag(addr, af_include_affixes) && s)
869 {
870#ifdef SUPPORT_I18N
871 if (testflag(addr, af_utf8_downcvt))
872 s = string_localpart_utf8_to_alabel(s, NULL);
873#endif
874 yield = string_cat(yield, sizeptr, ptrptr, s);
875 }
876
877s = addr->local_part;
878#ifdef SUPPORT_I18N
879if (testflag(addr, af_utf8_downcvt))
880 s = string_localpart_utf8_to_alabel(s, NULL);
881#endif
882yield = string_cat(yield, sizeptr, ptrptr, s);
883
884s = addr->suffix;
885if (testflag(addr, af_include_affixes) && s)
886 {
887#ifdef SUPPORT_I18N
888 if (testflag(addr, af_utf8_downcvt))
889 s = string_localpart_utf8_to_alabel(s, NULL);
890#endif
891 yield = string_cat(yield, sizeptr, ptrptr, s);
892 }
893
894return yield;
895}
896
897
898/*************************************************
899* Generate log address list *
900*************************************************/
901
902/* This function generates a list consisting of an address and its parents, for
903use in logging lines. For saved onetime aliased addresses, the onetime parent
904field is used. If the address was delivered by a transport with rcpt_include_
905affixes set, the af_include_affixes bit will be set in the address. In that
906case, we include the affixes here too.
907
908Arguments:
909 str points to start of growing string, or NULL
910 size points to current allocation for string
911 ptr points to offset for append point; updated on exit
912 addr bottom (ultimate) address
913 all_parents if TRUE, include all parents
914 success TRUE for successful delivery
915
916Returns: a growable string in dynamic store
917*/
918
919static uschar *
920string_log_address(uschar * str, int * size, int * ptr,
921 address_item *addr, BOOL all_parents, BOOL success)
922{
923BOOL add_topaddr = TRUE;
924address_item *topaddr;
925
926/* Find the ultimate parent */
927
928for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
929
930/* We start with just the local part for pipe, file, and reply deliveries, and
931for successful local deliveries from routers that have the log_as_local flag
932set. File deliveries from filters can be specified as non-absolute paths in
933cases where the transport is goin to complete the path. If there is an error
934before this happens (expansion failure) the local part will not be updated, and
935so won't necessarily look like a path. Add extra text for this case. */
936
937if ( testflag(addr, af_pfr)
938 || ( success
939 && addr->router && addr->router->log_as_local
940 && addr->transport && addr->transport->info->local
941 ) )
942 {
943 if (testflag(addr, af_file) && addr->local_part[0] != '/')
944 str = string_catn(str, size, ptr, CUS"save ", 5);
945 str = string_get_localpart(addr, str, size, ptr);
946 }
947
948/* Other deliveries start with the full address. It we have split it into local
949part and domain, use those fields. Some early failures can happen before the
950splitting is done; in those cases use the original field. */
951
952else
953 {
954 uschar * cmp = str + *ptr;
955
956 if (addr->local_part)
957 {
958 const uschar * s;
959 str = string_get_localpart(addr, str, size, ptr);
960 str = string_catn(str, size, ptr, US"@", 1);
961 s = addr->domain;
962#ifdef SUPPORT_I18N
963 if (testflag(addr, af_utf8_downcvt))
964 s = string_localpart_utf8_to_alabel(s, NULL);
965#endif
966 str = string_cat(str, size, ptr, s);
967 }
968 else
969 str = string_cat(str, size, ptr, addr->address);
970
971 /* If the address we are going to print is the same as the top address,
972 and all parents are not being included, don't add on the top address. First
973 of all, do a caseless comparison; if this succeeds, do a caseful comparison
974 on the local parts. */
975
976 str[*ptr] = 0;
977 if ( strcmpic(cmp, topaddr->address) == 0
978 && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
979 && !addr->onetime_parent
980 && (!all_parents || !addr->parent || addr->parent == topaddr)
981 )
982 add_topaddr = FALSE;
983 }
984
985/* If all parents are requested, or this is a local pipe/file/reply, and
986there is at least one intermediate parent, show it in brackets, and continue
987with all of them if all are wanted. */
988
989if ( (all_parents || testflag(addr, af_pfr))
990 && addr->parent
991 && addr->parent != topaddr)
992 {
993 uschar *s = US" (";
994 address_item *addr2;
995 for (addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
996 {
997 str = string_catn(str, size, ptr, s, 2);
998 str = string_cat (str, size, ptr, addr2->address);
999 if (!all_parents) break;
1000 s = US", ";
1001 }
1002 str = string_catn(str, size, ptr, US")", 1);
1003 }
1004
1005/* Add the top address if it is required */
1006
1007if (add_topaddr)
1008 str = string_append(str, size, ptr, 3,
1009 US" <",
1010 addr->onetime_parent ? addr->onetime_parent : topaddr->address,
1011 US">");
1012
1013return str;
1014}
1015
1016
1017/******************************************************************************/
1018
1019
1020
817d9f57 1021/* If msg is NULL this is a delivery log and logchar is used. Otherwise
67d81c10 1022this is a nonstandard call; no two-character delivery flag is written
817d9f57
JH
1023but sender-host and sender are prefixed and "msg" is inserted in the log line.
1024
1025Arguments:
1026 flags passed to log_write()
1027*/
e4bdf652 1028void
817d9f57 1029delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
e4bdf652 1030{
e4bdf652
JH
1031int size = 256; /* Used for a temporary, */
1032int ptr = 0; /* expanding buffer, for */
5dac72a7
JH
1033uschar * s; /* building log lines; */
1034void * reset_point; /* released afterwards. */
e4bdf652 1035
e4bdf652
JH
1036/* Log the delivery on the main log. We use an extensible string to build up
1037the log line, and reset the store afterwards. Remote deliveries should always
1038have a pointer to the host item that succeeded; local deliveries can have a
1039pointer to a single host item in their host list, for use by the transport. */
1040
0cbf2b82 1041#ifndef DISABLE_EVENT
a7538db1 1042 /* presume no successful remote delivery */
783b385f 1043 lookup_dnssec_authenticated = NULL;
d68218c7
JH
1044#endif
1045
e4bdf652 1046s = reset_point = store_get(size);
e4bdf652 1047
817d9f57 1048if (msg)
5dac72a7 1049 s = string_append(s, &size, &ptr, 2, host_and_ident(TRUE), US" ");
817d9f57
JH
1050else
1051 {
1052 s[ptr++] = logchar;
5dac72a7 1053 s = string_catn(s, &size, &ptr, US"> ", 2);
817d9f57 1054 }
5dac72a7 1055s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), TRUE);
e4bdf652 1056
6c6d6e48 1057if (LOGGING(sender_on_delivery) || msg)
3c8b3577 1058 s = string_append(s, &size, &ptr, 3, US" F=<",
8c5d388a 1059#ifdef SUPPORT_I18N
3c8b3577
JH
1060 testflag(addr, af_utf8_downcvt)
1061 ? string_address_utf8_to_alabel(sender_address, NULL)
1062 :
1063#endif
1064 sender_address,
1065 US">");
e4bdf652 1066
afa6d3ad
JH
1067if (*queue_name)
1068 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1069
e4bdf652 1070#ifdef EXPERIMENTAL_SRS
d43cbe25
JH
1071if(addr->prop.srs_sender)
1072 s = string_append(s, &size, &ptr, 3, US" SRS=<", addr->prop.srs_sender, US">");
e4bdf652
JH
1073#endif
1074
1075/* You might think that the return path must always be set for a successful
1076delivery; indeed, I did for some time, until this statement crashed. The case
1077when it is not set is for a delivery to /dev/null which is optimised by not
1078being run at all. */
1079
d6c82d7b 1080if (used_return_path && LOGGING(return_path_on_delivery))
e4bdf652
JH
1081 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
1082
817d9f57
JH
1083if (msg)
1084 s = string_append(s, &size, &ptr, 2, US" ", msg);
e4bdf652 1085
817d9f57 1086/* For a delivery from a system filter, there may not be a router */
d6c82d7b 1087if (addr->router)
e4bdf652
JH
1088 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1089
1090s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
1091
6c6d6e48 1092if (LOGGING(delivery_size))
e4bdf652
JH
1093 s = string_append(s, &size, &ptr, 2, US" S=",
1094 string_sprintf("%d", transport_count));
1095
1096/* Local delivery */
1097
1098if (addr->transport->info->local)
1099 {
a7538db1 1100 if (addr->host_list)
e4bdf652 1101 s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
ac881e27 1102 s = d_log_interface(s, &size, &ptr);
d6c82d7b 1103 if (addr->shadow_message)
c2f669a4 1104 s = string_cat(s, &size, &ptr, addr->shadow_message);
e4bdf652
JH
1105 }
1106
1107/* Remote delivery */
1108
1109else
1110 {
783b385f 1111 if (addr->host_used)
e4bdf652 1112 {
67d81c10 1113 s = d_hostlog(s, &size, &ptr, addr);
e4bdf652 1114 if (continue_sequence > 1)
c2f669a4 1115 s = string_catn(s, &size, &ptr, US"*", 1);
d68218c7 1116
0cbf2b82 1117#ifndef DISABLE_EVENT
a7538db1
JH
1118 deliver_host_address = addr->host_used->address;
1119 deliver_host_port = addr->host_used->port;
029f4192 1120 deliver_host = addr->host_used->name;
783b385f
JH
1121
1122 /* DNS lookup status */
1123 lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
1124 : addr->host_used->dnssec==DS_NO ? US"no"
1125 : NULL;
a7538db1 1126#endif
e4bdf652
JH
1127 }
1128
a7538db1 1129#ifdef SUPPORT_TLS
67d81c10 1130 s = d_tlslog(s, &size, &ptr, addr);
a7538db1 1131#endif
e4bdf652 1132
018c60d7 1133 if (addr->authenticator)
6f123593 1134 {
018c60d7
JH
1135 s = string_append(s, &size, &ptr, 2, US" A=", addr->authenticator);
1136 if (addr->auth_id)
c8e2fc1e 1137 {
018c60d7 1138 s = string_append(s, &size, &ptr, 2, US":", addr->auth_id);
6c6d6e48 1139 if (LOGGING(smtp_mailauth) && addr->auth_sndr)
018c60d7 1140 s = string_append(s, &size, &ptr, 2, US":", addr->auth_sndr);
c8e2fc1e 1141 }
6f123593
JH
1142 }
1143
a7538db1 1144#ifndef DISABLE_PRDR
fd98a5c6 1145 if (addr->flags & af_prdr_used)
e0cc6cda 1146 s = string_catn(s, &size, &ptr, US" PRDR", 5);
a7538db1 1147#endif
e0cc6cda
JH
1148
1149 if (addr->flags & af_chunking_used)
1150 s = string_catn(s, &size, &ptr, US" K", 2);
76f44207
WB
1151 }
1152
1153/* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
fd98a5c6 1154
d6c82d7b
JH
1155if ( LOGGING(smtp_confirmation)
1156 && addr->message
1157 && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
1158 )
76f44207 1159 {
b980ed83 1160 unsigned i;
1c5b1499 1161 unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
76f44207
WB
1162 uschar *p = big_buffer;
1163 uschar *ss = addr->message;
1164 *p++ = '\"';
b980ed83 1165 for (i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
e4bdf652 1166 {
27520a68 1167 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
76f44207 1168 *p++ = ss[i];
e4bdf652 1169 }
76f44207
WB
1170 *p++ = '\"';
1171 *p = 0;
1172 s = string_append(s, &size, &ptr, 2, US" C=", big_buffer);
e4bdf652
JH
1173 }
1174
1175/* Time on queue and actual time taken to deliver */
1176
6c6d6e48 1177if (LOGGING(queue_time))
e4bdf652 1178 s = string_append(s, &size, &ptr, 2, US" QT=",
19050083 1179 readconf_printtime( (int) ((long)time(NULL) - (long)received_time)) );
e4bdf652 1180
6c6d6e48 1181if (LOGGING(deliver_time))
e4bdf652
JH
1182 s = string_append(s, &size, &ptr, 2, US" DT=",
1183 readconf_printtime(addr->more_errno));
e4bdf652
JH
1184
1185/* string_cat() always leaves room for the terminator. Release the
1186store we used to build the line after writing it. */
1187
1188s[ptr] = 0;
817d9f57 1189log_write(0, flags, "%s", s);
d68218c7 1190
0cbf2b82 1191#ifndef DISABLE_EVENT
774ef2d7 1192if (!msg) msg_event_raise(US"msg:delivery", addr);
d68218c7 1193#endif
14a465c3 1194
e4bdf652
JH
1195store_reset(reset_point);
1196return;
1197}
1198
1199
1200
5dac72a7
JH
1201static void
1202deferral_log(address_item * addr, uschar * now,
1203 int logflags, uschar * driver_name, uschar * driver_kind)
1204{
1205int size = 256; /* Used for a temporary, */
1206int ptr = 0; /* expanding buffer, for */
1207uschar * s; /* building log lines; */
1208void * reset_point; /* released afterwards. */
1209
1210uschar ss[32];
1211
1212/* Build up the line that is used for both the message log and the main
1213log. */
1214
1215s = reset_point = store_get(size);
1216
1217/* Create the address string for logging. Must not do this earlier, because
1218an OK result may be changed to FAIL when a pipe returns text. */
1219
1220s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
1221
1222if (*queue_name)
1223 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1224
1225/* Either driver_name contains something and driver_kind contains
1226" router" or " transport" (note the leading space), or driver_name is
1227a null string and driver_kind contains "routing" without the leading
1228space, if all routing has been deferred. When a domain has been held,
1229so nothing has been done at all, both variables contain null strings. */
1230
1231if (driver_name)
1232 {
1233 if (driver_kind[1] == 't' && addr->router)
1234 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1235 Ustrcpy(ss, " ?=");
1236 ss[1] = toupper(driver_kind[1]);
1237 s = string_append(s, &size, &ptr, 2, ss, driver_name);
1238 }
1239else if (driver_kind)
1240 s = string_append(s, &size, &ptr, 2, US" ", driver_kind);
1241
1242/*XXX need an s+s+p sprintf */
1243sprintf(CS ss, " defer (%d)", addr->basic_errno);
1244s = string_cat(s, &size, &ptr, ss);
1245
1246if (addr->basic_errno > 0)
1247 s = string_append(s, &size, &ptr, 2, US": ",
1248 US strerror(addr->basic_errno));
1249
1250if (addr->host_used)
1251 {
1252 s = string_append(s, &size, &ptr, 5,
1253 US" H=", addr->host_used->name,
1254 US" [", addr->host_used->address, US"]");
1255 if (LOGGING(outgoing_port))
1256 {
1257 int port = addr->host_used->port;
1258 s = string_append(s, &size, &ptr, 2,
1259 US":", port == PORT_NONE ? US"25" : string_sprintf("%d", port));
1260 }
1261 }
1262
1263if (addr->message)
1264 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1265
1266s[ptr] = 0;
1267
1268/* Log the deferment in the message log, but don't clutter it
1269up with retry-time defers after the first delivery attempt. */
1270
1271if (deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
1272 deliver_msglog("%s %s\n", now, s);
1273
1274/* Write the main log and reset the store.
1275For errors of the type "retry time not reached" (also remotes skipped
1276on queue run), logging is controlled by L_retry_defer. Note that this kind
1277of error number is negative, and all the retry ones are less than any
1278others. */
1279
1280
1281log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
1282 "== %s", s);
1283
1284store_reset(reset_point);
1285return;
1286}
1287
1288
1289
1290static void
1291failure_log(address_item * addr, uschar * driver_kind, uschar * now)
1292{
1293int size = 256; /* Used for a temporary, */
1294int ptr = 0; /* expanding buffer, for */
1295uschar * s; /* building log lines; */
1296void * reset_point; /* released afterwards. */
1297
1298/* Build up the log line for the message and main logs */
1299
1300s = reset_point = store_get(size);
1301
1302/* Create the address string for logging. Must not do this earlier, because
1303an OK result may be changed to FAIL when a pipe returns text. */
1304
1305s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
1306
1307if (LOGGING(sender_on_delivery))
1308 s = string_append(s, &size, &ptr, 3, US" F=<", sender_address, US">");
1309
1310if (*queue_name)
1311 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1312
1313/* Return path may not be set if no delivery actually happened */
1314
1315if (used_return_path && LOGGING(return_path_on_delivery))
1316 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
1317
1318if (addr->router)
1319 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1320if (addr->transport)
1321 s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
1322
1323if (addr->host_used)
1324 s = d_hostlog(s, &size, &ptr, addr);
1325
1326#ifdef SUPPORT_TLS
1327s = d_tlslog(s, &size, &ptr, addr);
1328#endif
1329
1330if (addr->basic_errno > 0)
1331 s = string_append(s, &size, &ptr, 2, US": ", US strerror(addr->basic_errno));
1332
1333if (addr->message)
1334 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1335
1336s[ptr] = 0;
1337
1338/* Do the logging. For the message log, "routing failed" for those cases,
1339just to make it clearer. */
1340
1341if (driver_kind)
1342 deliver_msglog("%s %s failed for %s\n", now, driver_kind, s);
1343else
1344 deliver_msglog("%s %s\n", now, s);
1345
1346log_write(0, LOG_MAIN, "** %s", s);
1347
1348#ifndef DISABLE_EVENT
1349msg_event_raise(US"msg:fail:delivery", addr);
1350#endif
1351
1352store_reset(reset_point);
1353return;
1354}
1355
1356
1357
059ec3d9
PH
1358/*************************************************
1359* Actions at the end of handling an address *
1360*************************************************/
1361
1362/* This is a function for processing a single address when all that can be done
1363with it has been done.
1364
1365Arguments:
1366 addr points to the address block
1367 result the result of the delivery attempt
1368 logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
1369 driver_type indicates which type of driver (transport, or router) was last
1370 to process the address
1371 logchar '=' or '-' for use when logging deliveries with => or ->
1372
1373Returns: nothing
1374*/
1375
1376static void
1377post_process_one(address_item *addr, int result, int logflags, int driver_type,
1378 int logchar)
1379{
1380uschar *now = tod_stamp(tod_log);
1381uschar *driver_kind = NULL;
1382uschar *driver_name = NULL;
059ec3d9 1383
059ec3d9
PH
1384DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
1385
1386/* Set up driver kind and name for logging. Disable logging if the router or
1387transport has disabled it. */
1388
1389if (driver_type == DTYPE_TRANSPORT)
1390 {
d6c82d7b 1391 if (addr->transport)
059ec3d9
PH
1392 {
1393 driver_name = addr->transport->name;
1394 driver_kind = US" transport";
1395 disable_logging = addr->transport->disable_logging;
1396 }
1397 else driver_kind = US"transporting";
1398 }
1399else if (driver_type == DTYPE_ROUTER)
1400 {
d6c82d7b 1401 if (addr->router)
059ec3d9
PH
1402 {
1403 driver_name = addr->router->name;
1404 driver_kind = US" router";
1405 disable_logging = addr->router->disable_logging;
1406 }
1407 else driver_kind = US"routing";
1408 }
1409
1410/* If there's an error message set, ensure that it contains only printing
1411characters - it should, but occasionally things slip in and this at least
49c2d5ea
PH
1412stops the log format from getting wrecked. We also scan the message for an LDAP
1413expansion item that has a password setting, and flatten the password. This is a
1414fudge, but I don't know a cleaner way of doing this. (If the item is badly
1415malformed, it won't ever have gone near LDAP.) */
059ec3d9 1416
d6c82d7b 1417if (addr->message)
49c2d5ea 1418 {
55414b25 1419 const uschar * s = string_printing(addr->message);
f42deca9
JH
1420
1421 /* deconst cast ok as string_printing known to have alloc'n'copied */
1422 addr->message = expand_hide_passwords(US s);
49c2d5ea 1423 }
059ec3d9
PH
1424
1425/* If we used a transport that has one of the "return_output" options set, and
1426if it did in fact generate some output, then for return_output we treat the
1427message as failed if it was not already set that way, so that the output gets
1428returned to the sender, provided there is a sender to send it to. For
1429return_fail_output, do this only if the delivery failed. Otherwise we just
1430unlink the file, and remove the name so that if the delivery failed, we don't
1431try to send back an empty or unwanted file. The log_output options operate only
1432on a non-empty file.
1433
1434In any case, we close the message file, because we cannot afford to leave a
1435file-descriptor for one address while processing (maybe very many) others. */
1436
d6c82d7b 1437if (addr->return_file >= 0 && addr->return_filename)
059ec3d9
PH
1438 {
1439 BOOL return_output = FALSE;
1440 struct stat statbuf;
54fc8428 1441 (void)EXIMfsync(addr->return_file);
059ec3d9
PH
1442
1443 /* If there is no output, do nothing. */
1444
1445 if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
1446 {
1447 transport_instance *tb = addr->transport;
1448
1449 /* Handle logging options */
1450
d6c82d7b
JH
1451 if ( tb->log_output
1452 || result == FAIL && tb->log_fail_output
1453 || result == DEFER && tb->log_defer_output
1454 )
059ec3d9
PH
1455 {
1456 uschar *s;
1457 FILE *f = Ufopen(addr->return_filename, "rb");
d6c82d7b 1458 if (!f)
059ec3d9
PH
1459 log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
1460 "from %s transport: %s", addr->return_filename, tb->name,
1461 strerror(errno));
1462 else
d6c82d7b 1463 if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
059ec3d9
PH
1464 {
1465 uschar *p = big_buffer + Ustrlen(big_buffer);
55414b25 1466 const uschar * sp;
059ec3d9
PH
1467 while (p > big_buffer && isspace(p[-1])) p--;
1468 *p = 0;
55414b25 1469 sp = string_printing(big_buffer);
059ec3d9 1470 log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
55414b25 1471 addr->address, tb->name, sp);
059ec3d9 1472 }
f1e894f3 1473 (void)fclose(f);
059ec3d9
PH
1474 }
1475
1476 /* Handle returning options, but only if there is an address to return
1477 the text to. */
1478
d6c82d7b 1479 if (sender_address[0] != 0 || addr->prop.errors_address)
059ec3d9
PH
1480 if (tb->return_output)
1481 {
1482 addr->transport_return = result = FAIL;
d6c82d7b 1483 if (addr->basic_errno == 0 && !addr->message)
059ec3d9
PH
1484 addr->message = US"return message generated";
1485 return_output = TRUE;
1486 }
1487 else
1488 if (tb->return_fail_output && result == FAIL) return_output = TRUE;
059ec3d9
PH
1489 }
1490
1491 /* Get rid of the file unless it might be returned, but close it in
1492 all cases. */
1493
1494 if (!return_output)
1495 {
1496 Uunlink(addr->return_filename);
1497 addr->return_filename = NULL;
1498 addr->return_file = -1;
1499 }
1500
f1e894f3 1501 (void)close(addr->return_file);
059ec3d9
PH
1502 }
1503
9d1c15ef 1504/* The success case happens only after delivery by a transport. */
059ec3d9
PH
1505
1506if (result == OK)
1507 {
1508 addr->next = addr_succeed;
1509 addr_succeed = addr;
1510
1511 /* Call address_done() to ensure that we don't deliver to this address again,
1512 and write appropriate things to the message log. If it is a child address, we
1513 call child_done() to scan the ancestors and mark them complete if this is the
1514 last child to complete. */
1515
1516 address_done(addr, now);
1517 DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
1518
d6c82d7b 1519 if (!addr->parent)
059ec3d9
PH
1520 deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
1521 driver_name, driver_kind);
059ec3d9
PH
1522 else
1523 {
1524 deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
1525 addr->parent->address, driver_name, driver_kind);
1526 child_done(addr, now);
1527 }
1528
774ef2d7 1529 /* Certificates for logging (via events) */
a7538db1 1530#ifdef SUPPORT_TLS
9d1c15ef
JH
1531 tls_out.ourcert = addr->ourcert;
1532 addr->ourcert = NULL;
1533 tls_out.peercert = addr->peercert;
1534 addr->peercert = NULL;
018058b2 1535
018058b2
JH
1536 tls_out.cipher = addr->cipher;
1537 tls_out.peerdn = addr->peerdn;
1538 tls_out.ocsp = addr->ocsp;
83b27293
JH
1539# ifdef EXPERIMENTAL_DANE
1540 tls_out.dane_verified = testflag(addr, af_dane_verified);
1541# endif
a7538db1 1542#endif
9d1c15ef 1543
817d9f57 1544 delivery_log(LOG_MAIN, addr, logchar, NULL);
9d1c15ef 1545
a7538db1 1546#ifdef SUPPORT_TLS
790fbb71
JH
1547 tls_free_cert(&tls_out.ourcert);
1548 tls_free_cert(&tls_out.peercert);
018058b2
JH
1549 tls_out.cipher = NULL;
1550 tls_out.peerdn = NULL;
1551 tls_out.ocsp = OCSP_NOT_REQ;
83b27293
JH
1552# ifdef EXPERIMENTAL_DANE
1553 tls_out.dane_verified = FALSE;
1554# endif
a7538db1 1555#endif
059ec3d9
PH
1556 }
1557
1558
1559/* Soft failure, or local delivery process failed; freezing may be
1560requested. */
1561
1562else if (result == DEFER || result == PANIC)
1563 {
1564 if (result == PANIC) logflags |= LOG_PANIC;
1565
1566 /* This puts them on the chain in reverse order. Do not change this, because
1567 the code for handling retries assumes that the one with the retry
1568 information is last. */
1569
1570 addr->next = addr_defer;
1571 addr_defer = addr;
1572
1573 /* The only currently implemented special action is to freeze the
1574 message. Logging of this is done later, just before the -H file is
1575 updated. */
1576
1577 if (addr->special_action == SPECIAL_FREEZE)
1578 {
1579 deliver_freeze = TRUE;
1580 deliver_frozen_at = time(NULL);
1581 update_spool = TRUE;
1582 }
1583
1584 /* If doing a 2-stage queue run, we skip writing to either the message
1585 log or the main log for SMTP defers. */
1586
1587 if (!queue_2stage || addr->basic_errno != 0)
5dac72a7 1588 deferral_log(addr, now, logflags, driver_name, driver_kind);
059ec3d9
PH
1589 }
1590
1591
1592/* Hard failure. If there is an address to which an error message can be sent,
1593put this address on the failed list. If not, put it on the deferred list and
1594freeze the mail message for human attention. The latter action can also be
1595explicitly requested by a router or transport. */
1596
1597else
1598 {
1599 /* If this is a delivery error, or a message for which no replies are
1600 wanted, and the message's age is greater than ignore_bounce_errors_after,
1601 force the af_ignore_error flag. This will cause the address to be discarded
1602 later (with a log entry). */
1603
10c50704 1604 if (!*sender_address && message_age >= ignore_bounce_errors_after)
059ec3d9
PH
1605 setflag(addr, af_ignore_error);
1606
1607 /* Freeze the message if requested, or if this is a bounce message (or other
652e1b65
PH
1608 message with null sender) and this address does not have its own errors
1609 address. However, don't freeze if errors are being ignored. The actual code
1610 to ignore occurs later, instead of sending a message. Logging of freezing
1611 occurs later, just before writing the -H file. */
059ec3d9 1612
d6c82d7b
JH
1613 if ( !testflag(addr, af_ignore_error)
1614 && ( addr->special_action == SPECIAL_FREEZE
1615 || (sender_address[0] == 0 && !addr->prop.errors_address)
1616 ) )
059ec3d9 1617 {
d6c82d7b
JH
1618 frozen_info = addr->special_action == SPECIAL_FREEZE
1619 ? US""
1620 : sender_local && !local_error_message
1621 ? US" (message created with -f <>)"
1622 : US" (delivery error message)";
059ec3d9
PH
1623 deliver_freeze = TRUE;
1624 deliver_frozen_at = time(NULL);
1625 update_spool = TRUE;
1626
1627 /* The address is put on the defer rather than the failed queue, because
1628 the message is being retained. */
1629
1630 addr->next = addr_defer;
1631 addr_defer = addr;
1632 }
1633
1634 /* Don't put the address on the nonrecipients tree yet; wait until an
1635 error message has been successfully sent. */
1636
1637 else
1638 {
1639 addr->next = addr_failed;
1640 addr_failed = addr;
1641 }
1642
5dac72a7 1643 failure_log(addr, driver_name ? NULL : driver_kind, now);
059ec3d9
PH
1644 }
1645
1646/* Ensure logging is turned on again in all cases */
1647
1648disable_logging = FALSE;
1649}
1650
1651
1652
1653
1654/*************************************************
1655* Address-independent error *
1656*************************************************/
1657
1658/* This function is called when there's an error that is not dependent on a
1659particular address, such as an expansion string failure. It puts the error into
1660all the addresses in a batch, logs the incident on the main and panic logs, and
1661clears the expansions. It is mostly called from local_deliver(), but can be
1662called for a remote delivery via findugid().
1663
1664Arguments:
1665 logit TRUE if (MAIN+PANIC) logging required
1666 addr the first of the chain of addresses
1667 code the error code
1668 format format string for error message, or NULL if already set in addr
1669 ... arguments for the format
1670
1671Returns: nothing
1672*/
1673
1674static void
1675common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
1676{
1677address_item *addr2;
1678addr->basic_errno = code;
1679
d6c82d7b 1680if (format)
059ec3d9
PH
1681 {
1682 va_list ap;
1683 uschar buffer[512];
1684 va_start(ap, format);
1685 if (!string_vformat(buffer, sizeof(buffer), CS format, ap))
1686 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
81f91683 1687 "common_error expansion was longer than " SIZE_T_FMT, sizeof(buffer));
059ec3d9
PH
1688 va_end(ap);
1689 addr->message = string_copy(buffer);
1690 }
1691
d6c82d7b 1692for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9
PH
1693 {
1694 addr2->basic_errno = code;
1695 addr2->message = addr->message;
1696 }
1697
1698if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
1699deliver_set_expansions(NULL);
1700}
1701
1702
1703
1704
1705/*************************************************
1706* Check a "never users" list *
1707*************************************************/
1708
1709/* This function is called to check whether a uid is on one of the two "never
1710users" lists.
1711
1712Arguments:
1713 uid the uid to be checked
1714 nusers the list to be scanned; the first item in the list is the count
1715
1716Returns: TRUE if the uid is on the list
1717*/
1718
1719static BOOL
1720check_never_users(uid_t uid, uid_t *nusers)
1721{
1722int i;
d6c82d7b 1723if (!nusers) return FALSE;
059ec3d9
PH
1724for (i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
1725return FALSE;
1726}
1727
1728
1729
1730/*************************************************
1731* Find uid and gid for a transport *
1732*************************************************/
1733
1734/* This function is called for both local and remote deliveries, to find the
1735uid/gid under which to run the delivery. The values are taken preferentially
1736from the transport (either explicit or deliver_as_creator), then from the
1737address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
1738the resulting uid is on the "never_users" or the "fixed_never_users" list, a
1739panic error is logged, and the function fails (which normally leads to delivery
1740deferral).
1741
1742Arguments:
1743 addr the address (possibly a chain)
1744 tp the transport
1745 uidp pointer to uid field
1746 gidp pointer to gid field
1747 igfp pointer to the use_initgroups field
1748
1749Returns: FALSE if failed - error has been set in address(es)
1750*/
1751
1752static BOOL
1753findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
1754 BOOL *igfp)
1755{
d6c82d7b 1756uschar *nuname;
059ec3d9
PH
1757BOOL gid_set = FALSE;
1758
1759/* Default initgroups flag comes from the transport */
1760
1761*igfp = tp->initgroups;
1762
1763/* First see if there's a gid on the transport, either fixed or expandable.
1764The expanding function always logs failure itself. */
1765
1766if (tp->gid_set)
1767 {
1768 *gidp = tp->gid;
1769 gid_set = TRUE;
1770 }
d6c82d7b 1771else if (tp->expand_gid)
059ec3d9 1772 {
d6c82d7b
JH
1773 if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
1774 &(addr->message)))
059ec3d9
PH
1775 {
1776 common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
1777 return FALSE;
1778 }
d6c82d7b 1779 gid_set = TRUE;
059ec3d9
PH
1780 }
1781
911f6fde
PH
1782/* If the transport did not set a group, see if the router did. */
1783
1784if (!gid_set && testflag(addr, af_gid_set))
1785 {
1786 *gidp = addr->gid;
1787 gid_set = TRUE;
1788 }
1789
059ec3d9
PH
1790/* Pick up a uid from the transport if one is set. */
1791
1792if (tp->uid_set) *uidp = tp->uid;
1793
1794/* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
1795it does not provide a passwd value from which a gid can be taken. */
1796
d6c82d7b 1797else if (tp->expand_uid)
059ec3d9
PH
1798 {
1799 struct passwd *pw;
1800 if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
1801 uidp, &(addr->message)))
1802 {
1803 common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
1804 return FALSE;
1805 }
d6c82d7b 1806 if (!gid_set && pw)
059ec3d9
PH
1807 {
1808 *gidp = pw->pw_gid;
1809 gid_set = TRUE;
1810 }
1811 }
1812
1813/* If the transport doesn't set the uid, test the deliver_as_creator flag. */
1814
1815else if (tp->deliver_as_creator)
1816 {
1817 *uidp = originator_uid;
1818 if (!gid_set)
1819 {
1820 *gidp = originator_gid;
1821 gid_set = TRUE;
1822 }
1823 }
1824
911f6fde
PH
1825/* Otherwise see if the address specifies the uid and if so, take it and its
1826initgroups flag. */
059ec3d9
PH
1827
1828else if (testflag(addr, af_uid_set))
1829 {
1830 *uidp = addr->uid;
1831 *igfp = testflag(addr, af_initgroups);
059ec3d9
PH
1832 }
1833
1834/* Nothing has specified the uid - default to the Exim user, and group if the
1835gid is not set. */
1836
1837else
1838 {
1839 *uidp = exim_uid;
1840 if (!gid_set)
1841 {
1842 *gidp = exim_gid;
1843 gid_set = TRUE;
1844 }
1845 }
1846
911f6fde
PH
1847/* If no gid is set, it is a disaster. We default to the Exim gid only if
1848defaulting to the Exim uid. In other words, if the configuration has specified
1849a uid, it must also provide a gid. */
059ec3d9
PH
1850
1851if (!gid_set)
1852 {
1853 common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
1854 "%s transport", tp->name);
1855 return FALSE;
1856 }
1857
1858/* Check that the uid is not on the lists of banned uids that may not be used
1859for delivery processes. */
1860
d6c82d7b
JH
1861nuname = check_never_users(*uidp, never_users)
1862 ? US"never_users"
1863 : check_never_users(*uidp, fixed_never_users)
1864 ? US"fixed_never_users"
1865 : NULL;
1866if (nuname)
059ec3d9
PH
1867 {
1868 common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
1869 "is on the %s list", (long int)(*uidp), tp->name, nuname);
1870 return FALSE;
1871 }
1872
1873/* All is well */
1874
1875return TRUE;
1876}
1877
1878
1879
1880
1881/*************************************************
1882* Check the size of a message for a transport *
1883*************************************************/
1884
1885/* Checks that the message isn't too big for the selected transport.
1886This is called only when it is known that the limit is set.
1887
1888Arguments:
1889 tp the transport
1890 addr the (first) address being delivered
1891
1892Returns: OK
1893 DEFER expansion failed or did not yield an integer
1894 FAIL message too big
1895*/
1896
1897int
1898check_message_size(transport_instance *tp, address_item *addr)
1899{
1900int rc = OK;
1901int size_limit;
1902
1903deliver_set_expansions(addr);
d45b1de8 1904size_limit = expand_string_integer(tp->message_size_limit, TRUE);
059ec3d9
PH
1905deliver_set_expansions(NULL);
1906
d6c82d7b 1907if (expand_string_message)
059ec3d9
PH
1908 {
1909 rc = DEFER;
d6c82d7b
JH
1910 addr->message = size_limit == -1
1911 ? string_sprintf("failed to expand message_size_limit "
1912 "in %s transport: %s", tp->name, expand_string_message)
1913 : string_sprintf("invalid message_size_limit "
059ec3d9
PH
1914 "in %s transport: %s", tp->name, expand_string_message);
1915 }
1916else if (size_limit > 0 && message_size > size_limit)
1917 {
1918 rc = FAIL;
1919 addr->message =
1920 string_sprintf("message is too big (transport limit = %d)",
1921 size_limit);
1922 }
1923
1924return rc;
1925}
1926
1927
1928
1929/*************************************************
1930* Transport-time check for a previous delivery *
1931*************************************************/
1932
1933/* Check that this base address hasn't previously been delivered to its routed
c2c19e9d
PH
1934transport. If it has been delivered, mark it done. The check is necessary at
1935delivery time in order to handle homonymic addresses correctly in cases where
1936the pattern of redirection changes between delivery attempts (so the unique
1937fields change). Non-homonymic previous delivery is detected earlier, at routing
1938time (which saves unnecessary routing).
1939
1940Arguments:
1941 addr the address item
1942 testing TRUE if testing wanted only, without side effects
059ec3d9 1943
059ec3d9
PH
1944Returns: TRUE if previously delivered by the transport
1945*/
1946
1947static BOOL
c2c19e9d 1948previously_transported(address_item *addr, BOOL testing)
059ec3d9
PH
1949{
1950(void)string_format(big_buffer, big_buffer_size, "%s/%s",
1951 addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
1952
1953if (tree_search(tree_nonrecipients, big_buffer) != 0)
1954 {
1955 DEBUG(D_deliver|D_route|D_transport)
1956 debug_printf("%s was previously delivered (%s transport): discarded\n",
1957 addr->address, addr->transport->name);
c2c19e9d 1958 if (!testing) child_done(addr, tod_stamp(tod_log));
059ec3d9
PH
1959 return TRUE;
1960 }
1961
1962return FALSE;
1963}
1964
1965
1966
064a94c9
PH
1967/******************************************************
1968* Check for a given header in a header string *
1969******************************************************/
1970
1971/* This function is used when generating quota warnings. The configuration may
1972specify any header lines it likes in quota_warn_message. If certain of them are
1973missing, defaults are inserted, so we need to be able to test for the presence
1974of a given header.
1975
1976Arguments:
1977 hdr the required header name
1978 hstring the header string
1979
1980Returns: TRUE the header is in the string
1981 FALSE the header is not in the string
1982*/
1983
1984static BOOL
1985contains_header(uschar *hdr, uschar *hstring)
1986{
1987int len = Ustrlen(hdr);
1988uschar *p = hstring;
1989while (*p != 0)
1990 {
1991 if (strncmpic(p, hdr, len) == 0)
1992 {
1993 p += len;
1994 while (*p == ' ' || *p == '\t') p++;
1995 if (*p == ':') return TRUE;
1996 }
1997 while (*p != 0 && *p != '\n') p++;
1998 if (*p == '\n') p++;
1999 }
2000return FALSE;
2001}
2002
2003
2004
059ec3d9
PH
2005
2006/*************************************************
2007* Perform a local delivery *
2008*************************************************/
2009
2010/* Each local delivery is performed in a separate process which sets its
2011uid and gid as specified. This is a safer way than simply changing and
2012restoring using seteuid(); there is a body of opinion that seteuid() cannot be
2013used safely. From release 4, Exim no longer makes any use of it. Besides, not
2014all systems have seteuid().
2015
2016If the uid/gid are specified in the transport_instance, they are used; the
2017transport initialization must ensure that either both or neither are set.
2018Otherwise, the values associated with the address are used. If neither are set,
2019it is a configuration error.
2020
2021The transport or the address may specify a home directory (transport over-
2022rides), and if they do, this is set as $home. If neither have set a working
2023directory, this value is used for that as well. Otherwise $home is left unset
2024and the cwd is set to "/" - a directory that should be accessible to all users.
2025
2026Using a separate process makes it more complicated to get error information
2027back. We use a pipe to pass the return code and also an error code and error
2028text string back to the parent process.
2029
2030Arguments:
2031 addr points to an address block for this delivery; for "normal" local
2032 deliveries this is the only address to be delivered, but for
2033 pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
2034 a number of addresses can be handled simultaneously, and in this
2035 case addr will point to a chain of addresses with the same
2036 characteristics.
2037
2038 shadowing TRUE if running a shadow transport; this causes output from pipes
2039 to be ignored.
2040
2041Returns: nothing
2042*/
2043
2044static void
2045deliver_local(address_item *addr, BOOL shadowing)
2046{
2047BOOL use_initgroups;
2048uid_t uid;
2049gid_t gid;
2050int status, len, rc;
2051int pfd[2];
2052pid_t pid;
2053uschar *working_directory;
2054address_item *addr2;
2055transport_instance *tp = addr->transport;
2056
2057/* Set up the return path from the errors or sender address. If the transport
2058has its own return path setting, expand it and replace the existing value. */
2059
d6c82d7b 2060if(addr->prop.errors_address)
d43cbe25 2061 return_path = addr->prop.errors_address;
384152a6 2062#ifdef EXPERIMENTAL_SRS
d6c82d7b 2063else if (addr->prop.srs_sender)
d43cbe25 2064 return_path = addr->prop.srs_sender;
384152a6
TK
2065#endif
2066else
2067 return_path = sender_address;
059ec3d9 2068
d6c82d7b 2069if (tp->return_path)
059ec3d9
PH
2070 {
2071 uschar *new_return_path = expand_string(tp->return_path);
d6c82d7b 2072 if (!new_return_path)
059ec3d9
PH
2073 {
2074 if (!expand_string_forcedfail)
2075 {
2076 common_error(TRUE, addr, ERRNO_EXPANDFAIL,
2077 US"Failed to expand return path \"%s\" in %s transport: %s",
2078 tp->return_path, tp->name, expand_string_message);
2079 return;
2080 }
2081 }
2082 else return_path = new_return_path;
2083 }
2084
2085/* For local deliveries, one at a time, the value used for logging can just be
2086set directly, once and for all. */
2087
2088used_return_path = return_path;
2089
2090/* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
2091gets put into the address(es), and the expansions are unset, so we can just
2092return. */
2093
2094if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
2095
5418e93b
PH
2096/* See if either the transport or the address specifies a home directory. A
2097home directory set in the address may already be expanded; a flag is set to
2098indicate that. In other cases we must expand it. */
059ec3d9 2099
d6c82d7b
JH
2100if ( (deliver_home = tp->home_dir) /* Set in transport, or */
2101 || ( (deliver_home = addr->home_dir) /* Set in address and */
2102 && !testflag(addr, af_home_expanded) /* not expanded */
2103 ) )
059ec3d9
PH
2104 {
2105 uschar *rawhome = deliver_home;
2106 deliver_home = NULL; /* in case it contains $home */
d6c82d7b 2107 if (!(deliver_home = expand_string(rawhome)))
059ec3d9
PH
2108 {
2109 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
2110 "to expand for %s transport: %s", rawhome, tp->name,
2111 expand_string_message);
2112 return;
2113 }
2114 if (*deliver_home != '/')
2115 {
2116 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
2117 "is not absolute for %s transport", deliver_home, tp->name);
2118 return;
2119 }
2120 }
2121
5418e93b
PH
2122/* See if either the transport or the address specifies a current directory,
2123and if so, expand it. If nothing is set, use the home directory, unless it is
2124also unset in which case use "/", which is assumed to be a directory to which
2125all users have access. It is necessary to be in a visible directory for some
2126operating systems when running pipes, as some commands (e.g. "rm" under Solaris
21272.5) require this. */
2128
d6c82d7b
JH
2129working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
2130if (working_directory)
059ec3d9
PH
2131 {
2132 uschar *raw = working_directory;
d6c82d7b 2133 if (!(working_directory = expand_string(raw)))
059ec3d9
PH
2134 {
2135 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
2136 "failed to expand for %s transport: %s", raw, tp->name,
2137 expand_string_message);
2138 return;
2139 }
2140 if (*working_directory != '/')
2141 {
2142 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
2143 "\"%s\" is not absolute for %s transport", working_directory, tp->name);
2144 return;
2145 }
2146 }
d6c82d7b 2147else working_directory = deliver_home ? deliver_home : US"/";
059ec3d9
PH
2148
2149/* If one of the return_output flags is set on the transport, create and open a
2150file in the message log directory for the transport to write its output onto.
2151This is mainly used by pipe transports. The file needs to be unique to the
2152address. This feature is not available for shadow transports. */
2153
d6c82d7b
JH
2154if ( !shadowing
2155 && ( tp->return_output || tp->return_fail_output
ec0eb1a3 2156 || tp->log_output || tp->log_fail_output || tp->log_defer_output
d6c82d7b 2157 ) )
059ec3d9 2158 {
41313d92
JH
2159 uschar * error;
2160
059ec3d9 2161 addr->return_filename =
41313d92
JH
2162 spool_fname(US"msglog", message_subdir, message_id,
2163 string_sprintf("-%d-%d", getpid(), return_count++));
2164
2165 if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
059ec3d9
PH
2166 {
2167 common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
2168 "to return message: %s", error, tp->name, strerror(errno));
2169 return;
2170 }
2171 }
2172
2173/* Create the pipe for inter-process communication. */
2174
2175if (pipe(pfd) != 0)
2176 {
2177 common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
2178 strerror(errno));
2179 return;
2180 }
2181
2182/* Now fork the process to do the real work in the subprocess, but first
2183ensure that all cached resources are freed so that the subprocess starts with
2184a clean slate and doesn't interfere with the parent process. */
2185
2186search_tidyup();
2187
2188if ((pid = fork()) == 0)
2189 {
2190 BOOL replicate = TRUE;
2191
2192 /* Prevent core dumps, as we don't want them in users' home directories.
2193 HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
2194 system. Some experimental/developing systems (e.g. GNU/Hurd) may define
2195 RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
a29e5231
PP
2196 complain if the error is "not supported".
2197
2198 There are two scenarios where changing the max limit has an effect. In one,
2199 the user is using a .forward and invoking a command of their choice via pipe;
2200 for these, we do need the max limit to be 0 unless the admin chooses to
2201 permit an increased limit. In the other, the command is invoked directly by
2202 the transport and is under administrator control, thus being able to raise
2203 the limit aids in debugging. So there's no general always-right answer.
2204
2205 Thus we inhibit core-dumps completely but let individual transports, while
2206 still root, re-raise the limits back up to aid debugging. We make the
2207 default be no core-dumps -- few enough people can use core dumps in
2208 diagnosis that it's reasonable to make them something that has to be explicitly requested.
2209 */
059ec3d9 2210
a7538db1 2211#ifdef RLIMIT_CORE
059ec3d9
PH
2212 struct rlimit rl;
2213 rl.rlim_cur = 0;
2214 rl.rlim_max = 0;
2215 if (setrlimit(RLIMIT_CORE, &rl) < 0)
2216 {
a7538db1 2217# ifdef SETRLIMIT_NOT_SUPPORTED
059ec3d9 2218 if (errno != ENOSYS && errno != ENOTSUP)
a7538db1 2219# endif
059ec3d9
PH
2220 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
2221 strerror(errno));
2222 }
a7538db1 2223#endif
059ec3d9
PH
2224
2225 /* Reset the random number generator, so different processes don't all
2226 have the same sequence. */
2227
2228 random_seed = 0;
2229
2230 /* If the transport has a setup entry, call this first, while still
2231 privileged. (Appendfile uses this to expand quota, for example, while
2232 able to read private files.) */
2233
d6c82d7b 2234 if (addr->transport->setup)
929ba01c 2235 switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
059ec3d9
PH
2236 &(addr->message)))
2237 {
2238 case DEFER:
d6c82d7b
JH
2239 addr->transport_return = DEFER;
2240 goto PASS_BACK;
059ec3d9
PH
2241
2242 case FAIL:
d6c82d7b
JH
2243 addr->transport_return = PANIC;
2244 goto PASS_BACK;
059ec3d9 2245 }
059ec3d9
PH
2246
2247 /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
2248 when the process becomes unprivileged, it won't be able to write to the
2249 process log. SIGHUP is ignored throughout exim, except when it is being
2250 run as a daemon. */
2251
2252 signal(SIGINT, SIG_IGN);
2253 signal(SIGTERM, SIG_IGN);
2254 signal(SIGUSR1, SIG_IGN);
2255
2256 /* Close the unwanted half of the pipe, and set close-on-exec for the other
2257 half - for transports that exec things (e.g. pipe). Then set the required
2258 gid/uid. */
2259
f1e894f3 2260 (void)close(pfd[pipe_read]);
ff790e47 2261 (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
059ec3d9
PH
2262 FD_CLOEXEC);
2263 exim_setugid(uid, gid, use_initgroups,
2264 string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
2265 addr->address, addr->transport->name));
2266
2267 DEBUG(D_deliver)
2268 {
2269 address_item *batched;
2270 debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
d6c82d7b 2271 for (batched = addr->next; batched; batched = batched->next)
059ec3d9
PH
2272 debug_printf("additional batched address: %s\n", batched->address);
2273 }
2274
2275 /* Set an appropriate working directory. */
2276
2277 if (Uchdir(working_directory) < 0)
2278 {
2279 addr->transport_return = DEFER;
2280 addr->basic_errno = errno;
2281 addr->message = string_sprintf("failed to chdir to %s", working_directory);
2282 }
2283
2284 /* If successful, call the transport */
2285
2286 else
2287 {
2288 BOOL ok = TRUE;
2289 set_process_info("delivering %s to %s using %s", message_id,
2290 addr->local_part, addr->transport->name);
2291
2a47f028
JH
2292 /* Setting this global in the subprocess means we need never clear it */
2293 transport_name = addr->transport->name;
2294
059ec3d9
PH
2295 /* If a transport filter has been specified, set up its argument list.
2296 Any errors will get put into the address, and FALSE yielded. */
2297
d6c82d7b 2298 if (addr->transport->filter_command)
059ec3d9
PH
2299 {
2300 ok = transport_set_up_command(&transport_filter_argv,
2301 addr->transport->filter_command,
2302 TRUE, PANIC, addr, US"transport filter", NULL);
2303 transport_filter_timeout = addr->transport->filter_timeout;
2304 }
2305 else transport_filter_argv = NULL;
2306
2307 if (ok)
2308 {
2309 debug_print_string(addr->transport->debug_string);
2310 replicate = !(addr->transport->info->code)(addr->transport, addr);
2311 }
2312 }
2313
2314 /* Pass the results back down the pipe. If necessary, first replicate the
2315 status in the top address to the others in the batch. The label is the
2316 subject of a goto when a call to the transport's setup function fails. We
2317 pass the pointer to the transport back in case it got changed as a result of
2318 file_format in appendfile. */
2319
2320 PASS_BACK:
2321
2322 if (replicate) replicate_status(addr);
d6c82d7b 2323 for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9
PH
2324 {
2325 int i;
2326 int local_part_length = Ustrlen(addr2->local_part);
2327 uschar *s;
1ac6b2e7 2328 int ret;
059ec3d9 2329
d6c82d7b
JH
2330 if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
2331 || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
2332 || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
2333 || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
2334 || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
2335 || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
2336 || (ret = write(pfd[pipe_write], &addr2->transport,
1ac6b2e7 2337 sizeof(transport_instance *))) != sizeof(transport_instance *)
059ec3d9
PH
2338
2339 /* For a file delivery, pass back the local part, in case the original
2340 was only part of the final delivery path. This gives more complete
2341 logging. */
2342
1ac6b2e7 2343 || (testflag(addr2, af_file)
d6c82d7b 2344 && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
1ac6b2e7
JH
2345 || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
2346 )
2347 )
2348 )
2349 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2350 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2351
2352 /* Now any messages */
2353
2354 for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
2355 {
d6c82d7b
JH
2356 int message_length = s ? Ustrlen(s) + 1 : 0;
2357 if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
2358 || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
1ac6b2e7
JH
2359 )
2360 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2361 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2362 }
2363 }
2364
2365 /* OK, this process is now done. Free any cached resources that it opened,
2366 and close the pipe we were writing down before exiting. */
2367
f1e894f3 2368 (void)close(pfd[pipe_write]);
059ec3d9
PH
2369 search_tidyup();
2370 exit(EXIT_SUCCESS);
2371 }
2372
2373/* Back in the main process: panic if the fork did not succeed. This seems
2374better than returning an error - if forking is failing it is probably best
2375not to try other deliveries for this message. */
2376
2377if (pid < 0)
2378 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
2379 addr->address);
2380
2381/* Read the pipe to get the delivery status codes and error messages. Our copy
2382of the writing end must be closed first, as otherwise read() won't return zero
2383on an empty pipe. We check that a status exists for each address before
2384overwriting the address structure. If data is missing, the default DEFER status
2385will remain. Afterwards, close the reading end. */
2386
f1e894f3 2387(void)close(pfd[pipe_write]);
059ec3d9 2388
d6c82d7b 2389for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9 2390 {
d6c82d7b 2391 len = read(pfd[pipe_read], &status, sizeof(int));
059ec3d9
PH
2392 if (len > 0)
2393 {
2394 int i;
2395 uschar **sptr;
2396
2397 addr2->transport_return = status;
d6c82d7b 2398 len = read(pfd[pipe_read], &transport_count,
059ec3d9 2399 sizeof(transport_count));
d6c82d7b
JH
2400 len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
2401 len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
2402 len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
2403 len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
2404 len = read(pfd[pipe_read], &addr2->transport,
059ec3d9
PH
2405 sizeof(transport_instance *));
2406
2407 if (testflag(addr2, af_file))
2408 {
2409 int local_part_length;
d6c82d7b
JH
2410 len = read(pfd[pipe_read], &local_part_length, sizeof(int));
2411 len = read(pfd[pipe_read], big_buffer, local_part_length);
059ec3d9
PH
2412 big_buffer[local_part_length] = 0;
2413 addr2->local_part = string_copy(big_buffer);
2414 }
2415
d6c82d7b 2416 for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
059ec3d9
PH
2417 {
2418 int message_length;
d6c82d7b 2419 len = read(pfd[pipe_read], &message_length, sizeof(int));
059ec3d9
PH
2420 if (message_length > 0)
2421 {
d6c82d7b 2422 len = read(pfd[pipe_read], big_buffer, message_length);
dc8091e7 2423 big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
059ec3d9
PH
2424 if (len > 0) *sptr = string_copy(big_buffer);
2425 }
2426 }
2427 }
2428
2429 else
2430 {
2431 log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
2432 "from delivery subprocess", addr2->unique);
2433 break;
2434 }
2435 }
2436
f1e894f3 2437(void)close(pfd[pipe_read]);
059ec3d9
PH
2438
2439/* Unless shadowing, write all successful addresses immediately to the journal
2440file, to ensure they are recorded asap. For homonymic addresses, use the base
2441address plus the transport name. Failure to write the journal is panic-worthy,
2442but don't stop, as it may prove possible subsequently to update the spool file
2443in order to record the delivery. */
2444
2445if (!shadowing)
2446 {
d6c82d7b
JH
2447 for (addr2 = addr; addr2; addr2 = addr2->next)
2448 if (addr2->transport_return == OK)
2449 {
2450 if (testflag(addr2, af_homonym))
2451 sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
2452 else
2453 sprintf(CS big_buffer, "%.500s\n", addr2->unique);
059ec3d9 2454
d6c82d7b
JH
2455 /* In the test harness, wait just a bit to let the subprocess finish off
2456 any debug output etc first. */
059ec3d9 2457
d6c82d7b 2458 if (running_in_test_harness) millisleep(300);
059ec3d9 2459
d6c82d7b
JH
2460 DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
2461 len = Ustrlen(big_buffer);
2462 if (write(journal_fd, big_buffer, len) != len)
2463 log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
2464 big_buffer, strerror(errno));
2465 }
059ec3d9
PH
2466
2467 /* Ensure the journal file is pushed out to disk. */
2468
54fc8428 2469 if (EXIMfsync(journal_fd) < 0)
059ec3d9
PH
2470 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2471 strerror(errno));
2472 }
2473
2474/* Wait for the process to finish. If it terminates with a non-zero code,
2475freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
2476status values of all the addresses as they are. Take care to handle the case
2477when the subprocess doesn't seem to exist. This has been seen on one system
2478when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
2479happens, wait() doesn't recognize the termination of child processes. Exim now
2480resets SIGCHLD to SIG_DFL, but this code should still be robust. */
2481
2482while ((rc = wait(&status)) != pid)
059ec3d9
PH
2483 if (rc < 0 && errno == ECHILD) /* Process has vanished */
2484 {
2485 log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
2486 addr->transport->driver_name);
2487 status = 0;
2488 break;
2489 }
059ec3d9
PH
2490
2491if ((status & 0xffff) != 0)
2492 {
2493 int msb = (status >> 8) & 255;
2494 int lsb = status & 255;
2495 int code = (msb == 0)? (lsb & 0x7f) : msb;
2496 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
2497 addr->special_action = SPECIAL_FREEZE;
2498 log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
2499 "status 0x%04x: %s %d",
2500 addr->transport->driver_name,
2501 status,
d6c82d7b 2502 msb == 0 ? "terminated by signal" : "exit code",
059ec3d9
PH
2503 code);
2504 }
2505
2506/* If SPECIAL_WARN is set in the top address, send a warning message. */
2507
d6c82d7b 2508if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
059ec3d9
PH
2509 {
2510 int fd;
2511 uschar *warn_message;
d6c82d7b 2512 pid_t pid;
059ec3d9
PH
2513
2514 DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
2515
d6c82d7b 2516 if (!(warn_message = expand_string(addr->transport->warn_message)))
059ec3d9
PH
2517 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
2518 "message for %s transport): %s", addr->transport->warn_message,
2519 addr->transport->name, expand_string_message);
d6c82d7b
JH
2520
2521 else if ((pid = child_open_exim(&fd)) > 0)
059ec3d9 2522 {
d6c82d7b
JH
2523 FILE *f = fdopen(fd, "wb");
2524 if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
2525 fprintf(f, "Reply-To: %s\n", errors_reply_to);
2526 fprintf(f, "Auto-Submitted: auto-replied\n");
2527 if (!contains_header(US"From", warn_message))
2528 moan_write_from(f);
2529 fprintf(f, "%s", CS warn_message);
059ec3d9 2530
d6c82d7b 2531 /* Close and wait for child process to complete, without a timeout. */
059ec3d9 2532
d6c82d7b
JH
2533 (void)fclose(f);
2534 (void)child_close(pid, 0);
059ec3d9
PH
2535 }
2536
2537 addr->special_action = SPECIAL_NONE;
2538 }
2539}
2540
2541
2542
fa41615d 2543
3070ceee
JH
2544/* Check transport for the given concurrency limit. Return TRUE if over
2545the limit (or an expansion failure), else FALSE and if there was a limit,
2546the key for the hints database used for the concurrency count. */
fa41615d 2547
3070ceee
JH
2548static BOOL
2549tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
fa41615d 2550{
3070ceee
JH
2551unsigned max_parallel;
2552
2553if (!tp->max_parallel) return FALSE;
2554
2555max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
2556if (expand_string_message)
2557 {
2558 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
2559 "in %s transport (%s): %s", tp->name, addr->address,
2560 expand_string_message);
2561 return TRUE;
2562 }
2563
2564if (max_parallel > 0)
2565 {
2566 uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
2567 if (!enq_start(serialize_key, max_parallel))
2568 {
2569 address_item * next;
2570 DEBUG(D_transport)
2571 debug_printf("skipping tpt %s because concurrency limit %u reached\n",
2572 tp->name, max_parallel);
2573 do
2574 {
2575 next = addr->next;
2576 addr->message = US"concurrency limit reached for transport";
2577 addr->basic_errno = ERRNO_TRETRY;
2578 post_process_one(addr, DEFER, LOG_MAIN, DTYPE_TRANSPORT, 0);
2579 } while ((addr = next));
2580 return TRUE;
2581 }
2582 *key = serialize_key;
2583 }
2584return FALSE;
fa41615d
JH
2585}
2586
2587
2588
059ec3d9
PH
2589/*************************************************
2590* Do local deliveries *
2591*************************************************/
2592
2593/* This function processes the list of addresses in addr_local. True local
2594deliveries are always done one address at a time. However, local deliveries can
2595be batched up in some cases. Typically this is when writing batched SMTP output
2596files for use by some external transport mechanism, or when running local
2597deliveries over LMTP.
2598
2599Arguments: None
2600Returns: Nothing
2601*/
2602
2603static void
2604do_local_deliveries(void)
2605{
2606open_db dbblock;
2607open_db *dbm_file = NULL;
2608time_t now = time(NULL);
2609
2610/* Loop until we have exhausted the supply of local deliveries */
2611
d6c82d7b 2612while (addr_local)
059ec3d9
PH
2613 {
2614 time_t delivery_start;
2615 int deliver_time;
2616 address_item *addr2, *addr3, *nextaddr;
2617 int logflags = LOG_MAIN;
2618 int logchar = dont_deliver? '*' : '=';
2619 transport_instance *tp;
fa41615d 2620 uschar * serialize_key = NULL;
059ec3d9
PH
2621
2622 /* Pick the first undelivered address off the chain */
2623
2624 address_item *addr = addr_local;
2625 addr_local = addr->next;
2626 addr->next = NULL;
2627
2628 DEBUG(D_deliver|D_transport)
2629 debug_printf("--------> %s <--------\n", addr->address);
2630
2631 /* An internal disaster if there is no transport. Should not occur! */
2632
d6c82d7b 2633 if (!(tp = addr->transport))
059ec3d9
PH
2634 {
2635 logflags |= LOG_PANIC;
2636 disable_logging = FALSE; /* Jic */
d6c82d7b
JH
2637 addr->message = addr->router
2638 ? string_sprintf("No transport set by %s router", addr->router->name)
2639 : string_sprintf("No transport set by system filter");
059ec3d9
PH
2640 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
2641 continue;
2642 }
2643
2644 /* Check that this base address hasn't previously been delivered to this
2645 transport. The check is necessary at this point to handle homonymic addresses
2646 correctly in cases where the pattern of redirection changes between delivery
2647 attempts. Non-homonymic previous delivery is detected earlier, at routing
2648 time. */
2649
c2c19e9d 2650 if (previously_transported(addr, FALSE)) continue;
059ec3d9
PH
2651
2652 /* There are weird cases where logging is disabled */
2653
2654 disable_logging = tp->disable_logging;
2655
f7fd3850
PH
2656 /* Check for batched addresses and possible amalgamation. Skip all the work
2657 if either batch_max <= 1 or there aren't any other addresses for local
2658 delivery. */
059ec3d9 2659
d6c82d7b 2660 if (tp->batch_max > 1 && addr_local)
059ec3d9
PH
2661 {
2662 int batch_count = 1;
2663 BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
d6c82d7b
JH
2664 BOOL uses_lp = ( testflag(addr, af_pfr)
2665 && (testflag(addr, af_file) || addr->local_part[0] == '|')
2666 )
2667 || readconf_depends((driver_instance *)tp, US"local_part");
059ec3d9
PH
2668 uschar *batch_id = NULL;
2669 address_item **anchor = &addr_local;
2670 address_item *last = addr;
2671 address_item *next;
2672
2673 /* Expand the batch_id string for comparison with other addresses.
2674 Expansion failure suppresses batching. */
2675
d6c82d7b 2676 if (tp->batch_id)
059ec3d9
PH
2677 {
2678 deliver_set_expansions(addr);
2679 batch_id = expand_string(tp->batch_id);
2680 deliver_set_expansions(NULL);
d6c82d7b 2681 if (!batch_id)
059ec3d9
PH
2682 {
2683 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2684 "in %s transport (%s): %s", tp->name, addr->address,
2685 expand_string_message);
2686 batch_count = tp->batch_max;
2687 }
2688 }
2689
2690 /* Until we reach the batch_max limit, pick off addresses which have the
2691 same characteristics. These are:
2692
2693 same transport
7816e254 2694 not previously delivered (see comment about 50 lines above)
059ec3d9 2695 same local part if the transport's configuration contains $local_part
f7fd3850 2696 or if this is a file or pipe delivery from a redirection
059ec3d9
PH
2697 same domain if the transport's configuration contains $domain
2698 same errors address
2699 same additional headers
2700 same headers to be removed
2701 same uid/gid for running the transport
2702 same first host if a host list is set
2703 */
2704
d6c82d7b 2705 while ((next = *anchor) && batch_count < tp->batch_max)
059ec3d9
PH
2706 {
2707 BOOL ok =
d6c82d7b
JH
2708 tp == next->transport
2709 && !previously_transported(next, TRUE)
2710 && (addr->flags & (af_pfr|af_file)) == (next->flags & (af_pfr|af_file))
2711 && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
2712 && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
2713 && same_strings(next->prop.errors_address, addr->prop.errors_address)
2714 && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
2715 && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
2716 && same_ugid(tp, addr, next)
2717 && ( !addr->host_list && !next->host_list
2718 || addr->host_list
2719 && next->host_list
2720 && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
2721 );
059ec3d9
PH
2722
2723 /* If the transport has a batch_id setting, batch_id will be non-NULL
2724 from the expansion outside the loop. Expand for this address and compare.
2725 Expansion failure makes this address ineligible for batching. */
2726
d6c82d7b 2727 if (ok && batch_id)
059ec3d9
PH
2728 {
2729 uschar *bid;
2730 address_item *save_nextnext = next->next;
2731 next->next = NULL; /* Expansion for a single address */
2732 deliver_set_expansions(next);
2733 next->next = save_nextnext;
2734 bid = expand_string(tp->batch_id);
2735 deliver_set_expansions(NULL);
d6c82d7b 2736 if (!bid)
059ec3d9
PH
2737 {
2738 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2739 "in %s transport (%s): %s", tp->name, next->address,
2740 expand_string_message);
2741 ok = FALSE;
2742 }
2743 else ok = (Ustrcmp(batch_id, bid) == 0);
2744 }
2745
2746 /* Take address into batch if OK. */
2747
2748 if (ok)
2749 {
2750 *anchor = next->next; /* Include the address */
2751 next->next = NULL;
2752 last->next = next;
2753 last = next;
2754 batch_count++;
2755 }
fa41615d 2756 else anchor = &next->next; /* Skip the address */
059ec3d9
PH
2757 }
2758 }
2759
2760 /* We now have one or more addresses that can be delivered in a batch. Check
2761 whether the transport is prepared to accept a message of this size. If not,
2762 fail them all forthwith. If the expansion fails, or does not yield an
2763 integer, defer delivery. */
2764
d6c82d7b 2765 if (tp->message_size_limit)
059ec3d9
PH
2766 {
2767 int rc = check_message_size(tp, addr);
2768 if (rc != OK)
2769 {
2770 replicate_status(addr);
d6c82d7b 2771 while (addr)
059ec3d9
PH
2772 {
2773 addr2 = addr->next;
2774 post_process_one(addr, rc, logflags, DTYPE_TRANSPORT, 0);
2775 addr = addr2;
2776 }
2777 continue; /* With next batch of addresses */
2778 }
2779 }
2780
2781 /* If we are not running the queue, or if forcing, all deliveries will be
2782 attempted. Otherwise, we must respect the retry times for each address. Even
2783 when not doing this, we need to set up the retry key string, and determine
2784 whether a retry record exists, because after a successful delivery, a delete
2785 retry item must be set up. Keep the retry database open only for the duration
2786 of these checks, rather than for all local deliveries, because some local
2787 deliveries (e.g. to pipes) can take a substantial time. */
2788
d6c82d7b 2789 if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE)))
059ec3d9
PH
2790 {
2791 DEBUG(D_deliver|D_retry|D_hints_lookup)
2792 debug_printf("no retry data available\n");
2793 }
2794
2795 addr2 = addr;
2796 addr3 = NULL;
d6c82d7b 2797 while (addr2)
059ec3d9
PH
2798 {
2799 BOOL ok = TRUE; /* to deliver this address */
2800 uschar *retry_key;
2801
2802 /* Set up the retry key to include the domain or not, and change its
2803 leading character from "R" to "T". Must make a copy before doing this,
2804 because the old key may be pointed to from a "delete" retry item after
2805 a routing delay. */
2806
2807 retry_key = string_copy(
d6c82d7b 2808 tp->retry_use_local_part ? addr2->address_retry_key :
059ec3d9
PH
2809 addr2->domain_retry_key);
2810 *retry_key = 'T';
2811
2812 /* Inspect the retry data. If there is no hints file, delivery happens. */
2813
d6c82d7b 2814 if (dbm_file)
059ec3d9
PH
2815 {
2816 dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
2817
2818 /* If there is no retry record, delivery happens. If there is,
2819 remember it exists so it can be deleted after a successful delivery. */
2820
d6c82d7b 2821 if (retry_record)
059ec3d9
PH
2822 {
2823 setflag(addr2, af_lt_retry_exists);
2824
2825 /* A retry record exists for this address. If queue running and not
2826 forcing, inspect its contents. If the record is too old, or if its
2827 retry time has come, or if it has passed its cutoff time, delivery
2828 will go ahead. */
2829
2830 DEBUG(D_retry)
2831 {
ea49d0e1
PH
2832 debug_printf("retry record exists: age=%s ",
2833 readconf_printtime(now - retry_record->time_stamp));
2834 debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
2835 debug_printf(" time to retry = %s expired = %d\n",
2836 readconf_printtime(retry_record->next_try - now),
2837 retry_record->expired);
059ec3d9
PH
2838 }
2839
2840 if (queue_running && !deliver_force)
2841 {
d6c82d7b
JH
2842 ok = (now - retry_record->time_stamp > retry_data_expire)
2843 || (now >= retry_record->next_try)
2844 || retry_record->expired;
059ec3d9
PH
2845
2846 /* If we haven't reached the retry time, there is one more check
1ddeb334 2847 to do, which is for the ultimate address timeout. */
059ec3d9
PH
2848
2849 if (!ok)
ba9af0af
TF
2850 ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
2851 retry_record, now);
059ec3d9
PH
2852 }
2853 }
2854 else DEBUG(D_retry) debug_printf("no retry record exists\n");
2855 }
2856
2857 /* This address is to be delivered. Leave it on the chain. */
2858
2859 if (ok)
2860 {
2861 addr3 = addr2;
2862 addr2 = addr2->next;
2863 }
2864
2865 /* This address is to be deferred. Take it out of the chain, and
2866 post-process it as complete. Must take it out of the chain first,
2867 because post processing puts it on another chain. */
2868
2869 else
2870 {
2871 address_item *this = addr2;
2872 this->message = US"Retry time not yet reached";
2873 this->basic_errno = ERRNO_LRETRY;
d6c82d7b
JH
2874 addr2 = addr3 ? (addr3->next = addr2->next)
2875 : (addr = addr2->next);
059ec3d9
PH
2876 post_process_one(this, DEFER, logflags, DTYPE_TRANSPORT, 0);
2877 }
2878 }
2879
d6c82d7b 2880 if (dbm_file) dbfn_close(dbm_file);
059ec3d9
PH
2881
2882 /* If there are no addresses left on the chain, they all deferred. Loop
2883 for the next set of addresses. */
2884
d6c82d7b 2885 if (!addr) continue;
059ec3d9 2886
fa41615d
JH
2887 /* If the transport is limited for parallellism, enforce that here.
2888 We use a hints DB entry, incremented here and decremented after
2889 the transport (and any shadow transport) completes. */
2890
3070ceee 2891 if (tpt_parallel_check(tp, addr, &serialize_key))
fa41615d 2892 {
fa41615d
JH
2893 if (expand_string_message)
2894 {
2895 logflags |= LOG_PANIC;
3070ceee
JH
2896 do
2897 {
2898 addr = addr->next;
fa41615d 2899 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
3070ceee 2900 } while ((addr = addr2));
fa41615d 2901 }
3070ceee 2902 continue; /* Loop for the next set of addresses. */
fa41615d
JH
2903 }
2904
2905
059ec3d9
PH
2906 /* So, finally, we do have some addresses that can be passed to the
2907 transport. Before doing so, set up variables that are relevant to a
2908 single delivery. */
2909
2910 deliver_set_expansions(addr);
2911 delivery_start = time(NULL);
2912 deliver_local(addr, FALSE);
2913 deliver_time = (int)(time(NULL) - delivery_start);
2914
2915 /* If a shadow transport (which must perforce be another local transport), is
2916 defined, and its condition is met, we must pass the message to the shadow
2917 too, but only those addresses that succeeded. We do this by making a new
2918 chain of addresses - also to keep the original chain uncontaminated. We must
2919 use a chain rather than doing it one by one, because the shadow transport may
2920 batch.
2921
2922 NOTE: if the condition fails because of a lookup defer, there is nothing we
2923 can do! */
2924
d6c82d7b
JH
2925 if ( tp->shadow
2926 && ( !tp->shadow_condition
2927 || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
2928 ) )
059ec3d9
PH
2929 {
2930 transport_instance *stp;
2931 address_item *shadow_addr = NULL;
2932 address_item **last = &shadow_addr;
2933
d6c82d7b 2934 for (stp = transports; stp; stp = stp->next)
059ec3d9
PH
2935 if (Ustrcmp(stp->name, tp->shadow) == 0) break;
2936
d6c82d7b 2937 if (!stp)
059ec3d9
PH
2938 log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
2939 tp->shadow);
2940
2941 /* Pick off the addresses that have succeeded, and make clones. Put into
2942 the shadow_message field a pointer to the shadow_message field of the real
2943 address. */
2944
d6c82d7b
JH
2945 else for (addr2 = addr; addr2; addr2 = addr2->next)
2946 if (addr2->transport_return == OK)
2947 {
2948 addr3 = store_get(sizeof(address_item));
2949 *addr3 = *addr2;
2950 addr3->next = NULL;
2951 addr3->shadow_message = (uschar *) &(addr2->shadow_message);
2952 addr3->transport = stp;
2953 addr3->transport_return = DEFER;
2954 addr3->return_filename = NULL;
2955 addr3->return_file = -1;
2956 *last = addr3;
2957 last = &(addr3->next);
2958 }
059ec3d9
PH
2959
2960 /* If we found any addresses to shadow, run the delivery, and stick any
2961 message back into the shadow_message field in the original. */
2962
d6c82d7b 2963 if (shadow_addr)
059ec3d9
PH
2964 {
2965 int save_count = transport_count;
2966
2967 DEBUG(D_deliver|D_transport)
2968 debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
2969 deliver_local(shadow_addr, TRUE);
2970
d6c82d7b 2971 for(; shadow_addr; shadow_addr = shadow_addr->next)
059ec3d9
PH
2972 {
2973 int sresult = shadow_addr->transport_return;
d6c82d7b
JH
2974 *(uschar **)shadow_addr->shadow_message =
2975 sresult == OK
2976 ? string_sprintf(" ST=%s", stp->name)
2977 : string_sprintf(" ST=%s (%s%s%s)", stp->name,
2978 shadow_addr->basic_errno <= 0
2979 ? US""
2980 : US strerror(shadow_addr->basic_errno),
2981 shadow_addr->basic_errno <= 0 || !shadow_addr->message
2982 ? US""
2983 : US": ",
2984 shadow_addr->message
2985 ? shadow_addr->message
2986 : shadow_addr->basic_errno <= 0
2987 ? US"unknown error"
2988 : US"");
059ec3d9
PH
2989
2990 DEBUG(D_deliver|D_transport)
2991 debug_printf("%s shadow transport returned %s for %s\n",
2992 stp->name,
d6c82d7b
JH
2993 sresult == OK ? "OK" :
2994 sresult == DEFER ? "DEFER" :
2995 sresult == FAIL ? "FAIL" :
2996 sresult == PANIC ? "PANIC" : "?",
059ec3d9
PH
2997 shadow_addr->address);
2998 }
2999
3000 DEBUG(D_deliver|D_transport)
3001 debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
3002
3003 transport_count = save_count; /* Restore original transport count */
3004 }
3005 }
3006
3007 /* Cancel the expansions that were set up for the delivery. */
3008
3009 deliver_set_expansions(NULL);
3010
fa41615d
JH
3011 /* If the transport was parallelism-limited, decrement the hints DB record. */
3012
3013 if (serialize_key) enq_end(serialize_key);
3014
059ec3d9
PH
3015 /* Now we can process the results of the real transport. We must take each
3016 address off the chain first, because post_process_one() puts it on another
3017 chain. */
3018
d6c82d7b 3019 for (addr2 = addr; addr2; addr2 = nextaddr)
059ec3d9
PH
3020 {
3021 int result = addr2->transport_return;
3022 nextaddr = addr2->next;
3023
3024 DEBUG(D_deliver|D_transport)
3025 debug_printf("%s transport returned %s for %s\n",
3026 tp->name,
d6c82d7b
JH
3027 result == OK ? "OK" :
3028 result == DEFER ? "DEFER" :
3029 result == FAIL ? "FAIL" :
3030 result == PANIC ? "PANIC" : "?",
059ec3d9
PH
3031 addr2->address);
3032
3033 /* If there is a retry_record, or if delivery is deferred, build a retry
3034 item for setting a new retry time or deleting the old retry record from
3035 the database. These items are handled all together after all addresses
3036 have been handled (so the database is open just for a short time for
3037 updating). */
3038
3039 if (result == DEFER || testflag(addr2, af_lt_retry_exists))
3040 {
d6c82d7b
JH
3041 int flags = result == DEFER ? 0 : rf_delete;
3042 uschar *retry_key = string_copy(tp->retry_use_local_part
3043 ? addr2->address_retry_key : addr2->domain_retry_key);
059ec3d9
PH
3044 *retry_key = 'T';
3045 retry_add_item(addr2, retry_key, flags);
3046 }
3047
3048 /* Done with this address */
3049
3050 if (result == OK) addr2->more_errno = deliver_time;
3051 post_process_one(addr2, result, logflags, DTYPE_TRANSPORT, logchar);
3052
3053 /* If a pipe delivery generated text to be sent back, the result may be
3054 changed to FAIL, and we must copy this for subsequent addresses in the
3055 batch. */
3056
3057 if (addr2->transport_return != result)
3058 {
d6c82d7b 3059 for (addr3 = nextaddr; addr3; addr3 = addr3->next)
059ec3d9
PH
3060 {
3061 addr3->transport_return = addr2->transport_return;
3062 addr3->basic_errno = addr2->basic_errno;
3063 addr3->message = addr2->message;
3064 }
3065 result = addr2->transport_return;
3066 }
3067
3068 /* Whether or not the result was changed to FAIL, we need to copy the
3069 return_file value from the first address into all the addresses of the
3070 batch, so they are all listed in the error message. */
3071
3072 addr2->return_file = addr->return_file;
3073
3074 /* Change log character for recording successful deliveries. */
3075
3076 if (result == OK) logchar = '-';
3077 }
3078 } /* Loop back for next batch of addresses */
3079}
3080
3081
3082
3083
3084/*************************************************
3085* Sort remote deliveries *
3086*************************************************/
3087
3088/* This function is called if remote_sort_domains is set. It arranges that the
3089chain of addresses for remote deliveries is ordered according to the strings
3090specified. Try to make this shuffling reasonably efficient by handling
3091sequences of addresses rather than just single ones.
3092
3093Arguments: None
3094Returns: Nothing
3095*/
3096
3097static void
3098sort_remote_deliveries(void)
3099{
3100int sep = 0;
3101address_item **aptr = &addr_remote;
55414b25 3102const uschar *listptr = remote_sort_domains;
059ec3d9
PH
3103uschar *pattern;
3104uschar patbuf[256];
3105
d6c82d7b
JH
3106while ( *aptr
3107 && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
3108 )
059ec3d9
PH
3109 {
3110 address_item *moved = NULL;
3111 address_item **bptr = &moved;
3112
d6c82d7b 3113 while (*aptr)
059ec3d9
PH
3114 {
3115 address_item **next;
3116 deliver_domain = (*aptr)->domain; /* set $domain */
55414b25 3117 if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
059ec3d9
PH
3118 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
3119 {
d6c82d7b 3120 aptr = &(*aptr)->next;
059ec3d9
PH
3121 continue;
3122 }
3123
d6c82d7b
JH
3124 next = &(*aptr)->next;
3125 while ( *next
3126 && (deliver_domain = (*next)->domain, /* Set $domain */
55414b25 3127 match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
d6c82d7b
JH
3128 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
3129 )
3130 next = &(*next)->next;
059ec3d9
PH
3131
3132 /* If the batch of non-matchers is at the end, add on any that were
3133 extracted further up the chain, and end this iteration. Otherwise,
3134 extract them from the chain and hang on the moved chain. */
3135
d6c82d7b 3136 if (!*next)
059ec3d9
PH
3137 {
3138 *next = moved;
3139 break;
3140 }
3141
3142 *bptr = *aptr;
3143 *aptr = *next;
3144 *next = NULL;
3145 bptr = next;
d6c82d7b 3146 aptr = &(*aptr)->next;
059ec3d9
PH
3147 }
3148
3149 /* If the loop ended because the final address matched, *aptr will
3150 be NULL. Add on to the end any extracted non-matching addresses. If
3151 *aptr is not NULL, the loop ended via "break" when *next is null, that
3152 is, there was a string of non-matching addresses at the end. In this
3153 case the extracted addresses have already been added on the end. */
3154
d6c82d7b 3155 if (!*aptr) *aptr = moved;
059ec3d9
PH
3156 }
3157
3158DEBUG(D_deliver)
3159 {
3160 address_item *addr;
3161 debug_printf("remote addresses after sorting:\n");
d6c82d7b 3162 for (addr = addr_remote; addr; addr = addr->next)
059ec3d9
PH
3163 debug_printf(" %s\n", addr->address);
3164 }
3165}
3166
3167
3168
3169/*************************************************
3170* Read from pipe for remote delivery subprocess *
3171*************************************************/
3172
3173/* This function is called when the subprocess is complete, but can also be
3174called before it is complete, in order to empty a pipe that is full (to prevent
3175deadlock). It must therefore keep track of its progress in the parlist data
3176block.
3177
3178We read the pipe to get the delivery status codes and a possible error message
3179for each address, optionally preceded by unusability data for the hosts and
3180also by optional retry data.
3181
3182Read in large chunks into the big buffer and then scan through, interpreting
3183the data therein. In most cases, only a single read will be necessary. No
1c5466b9
PH
3184individual item will ever be anywhere near 2500 bytes in length, so by ensuring
3185that we read the next chunk when there is less than 2500 bytes left in the
3186non-final chunk, we can assume each item is complete in the buffer before
3187handling it. Each item is written using a single write(), which is atomic for
3188small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
3189often bigger) so even if we are reading while the subprocess is still going, we
3190should never have only a partial item in the buffer.
059ec3d9
PH
3191
3192Argument:
3193 poffset the offset of the parlist item
3194 eop TRUE if the process has completed
3195
3196Returns: TRUE if the terminating 'Z' item has been read,
3197 or there has been a disaster (i.e. no more data needed);
3198 FALSE otherwise
3199*/
3200
3201static BOOL
3202par_read_pipe(int poffset, BOOL eop)
3203{
3204host_item *h;
3205pardata *p = parlist + poffset;
3206address_item *addrlist = p->addrlist;
3207address_item *addr = p->addr;
3208pid_t pid = p->pid;
3209int fd = p->fd;
3210uschar *endptr = big_buffer;
3211uschar *ptr = endptr;
3212uschar *msg = p->msg;
3213BOOL done = p->done;
3214BOOL unfinished = TRUE;
bd21a787
WB
3215/* minimum size to read is header size including id, subid and length */
3216int required = PIPE_HEADER_SIZE;
059ec3d9
PH
3217
3218/* Loop through all items, reading from the pipe when necessary. The pipe
3219is set up to be non-blocking, but there are two different Unix mechanisms in
3220use. Exim uses O_NONBLOCK if it is defined. This returns 0 for end of file,
3221and EAGAIN for no more data. If O_NONBLOCK is not defined, Exim uses O_NDELAY,
3222which returns 0 for both end of file and no more data. We distinguish the
3223two cases by taking 0 as end of file only when we know the process has
3224completed.
3225
3226Each separate item is written to the pipe in a single write(), and as they are
3227all short items, the writes will all be atomic and we should never find
8e669ac1
PH
3228ourselves in the position of having read an incomplete item. "Short" in this
3229case can mean up to about 1K in the case when there is a long error message
1c5466b9 3230associated with an address. */
059ec3d9
PH
3231
3232DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
3233 (int)p->pid, eop? "ended" : "not ended");
3234
3235while (!done)
3236 {
3237 retry_item *r, **rp;
3238 int remaining = endptr - ptr;
bd21a787
WB
3239 uschar header[PIPE_HEADER_SIZE + 1];
3240 uschar id, subid;
3241 uschar *endc;
059ec3d9
PH
3242
3243 /* Read (first time) or top up the chars in the buffer if necessary.
3244 There will be only one read if we get all the available data (i.e. don't
3245 fill the buffer completely). */
3246
bd21a787 3247 if (remaining < required && unfinished)
059ec3d9
PH
3248 {
3249 int len;
3250 int available = big_buffer_size - remaining;
3251
3252 if (remaining > 0) memmove(big_buffer, ptr, remaining);
3253
3254 ptr = big_buffer;
3255 endptr = big_buffer + remaining;
3256 len = read(fd, endptr, available);
3257
3258 DEBUG(D_deliver) debug_printf("read() yielded %d\n", len);
3259
3260 /* If the result is EAGAIN and the process is not complete, just
3261 stop reading any more and process what we have already. */
3262
3263 if (len < 0)
3264 {
3265 if (!eop && errno == EAGAIN) len = 0; else
3266 {
3267 msg = string_sprintf("failed to read pipe from transport process "
3268 "%d for transport %s: %s", pid, addr->transport->driver_name,
3269 strerror(errno));
3270 break;
3271 }
3272 }
3273
3274 /* If the length is zero (eof or no-more-data), just process what we
3275 already have. Note that if the process is still running and we have
3276 read all the data in the pipe (but less that "available") then we
3277 won't read any more, as "unfinished" will get set FALSE. */
3278
3279 endptr += len;
bd21a787 3280 remaining += len;
059ec3d9
PH
3281 unfinished = len == available;
3282 }
3283
3284 /* If we are at the end of the available data, exit the loop. */
059ec3d9
PH
3285 if (ptr >= endptr) break;
3286
bd21a787
WB
3287 /* copy and read header */
3288 memcpy(header, ptr, PIPE_HEADER_SIZE);
94431adb 3289 header[PIPE_HEADER_SIZE] = '\0';
bd21a787
WB
3290 id = header[0];
3291 subid = header[1];
3292 required = Ustrtol(header + 2, &endc, 10) + PIPE_HEADER_SIZE; /* header + data */
3293 if (*endc)
3294 {
3295 msg = string_sprintf("failed to read pipe from transport process "
3296 "%d for transport %s: error reading size from header", pid, addr->transport->driver_name);
3297 done = TRUE;
3298 break;
3299 }
3300
3301 DEBUG(D_deliver)
94431adb 3302 debug_printf("header read id:%c,subid:%c,size:%s,required:%d,remaining:%d,unfinished:%d\n",
bd21a787
WB
3303 id, subid, header+2, required, remaining, unfinished);
3304
3305 /* is there room for the dataset we want to read ? */
3306 if (required > big_buffer_size - PIPE_HEADER_SIZE)
3307 {
3308 msg = string_sprintf("failed to read pipe from transport process "
3309 "%d for transport %s: big_buffer too small! required size=%d buffer size=%d", pid, addr->transport->driver_name,
3310 required, big_buffer_size - PIPE_HEADER_SIZE);
3311 done = TRUE;
3312 break;
3313 }
3314
94431adb 3315 /* we wrote all datasets with atomic write() calls
bd21a787 3316 remaining < required only happens if big_buffer was too small
94431adb 3317 to get all available data from pipe. unfinished has to be true
bd21a787
WB
3318 as well. */
3319 if (remaining < required)
8fa0a4d4 3320 {
bd21a787
WB
3321 if (unfinished)
3322 continue;
8fa0a4d4 3323 msg = string_sprintf("failed to read pipe from transport process "
94431adb 3324 "%d for transport %s: required size=%d > remaining size=%d and unfinished=false",
8fa0a4d4
JH
3325 pid, addr->transport->driver_name, required, remaining);
3326 done = TRUE;
3327 break;
3328 }
bd21a787
WB
3329
3330 /* step behind the header */
3331 ptr += PIPE_HEADER_SIZE;
94431adb 3332
059ec3d9
PH
3333 /* Handle each possible type of item, assuming the complete item is
3334 available in store. */
3335
bd21a787 3336 switch (id)
059ec3d9
PH
3337 {
3338 /* Host items exist only if any hosts were marked unusable. Match
3339 up by checking the IP address. */
3340
3341 case 'H':
d6c82d7b 3342 for (h = addrlist->host_list; h; h = h->next)
059ec3d9 3343 {
d6c82d7b 3344 if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
059ec3d9
PH
3345 h->status = ptr[0];
3346 h->why = ptr[1];
3347 }
3348 ptr += 2;
3349 while (*ptr++);
3350 break;
3351
3352 /* Retry items are sent in a preceding R item for each address. This is
3353 kept separate to keep each message short enough to guarantee it won't
3354 be split in the pipe. Hopefully, in the majority of cases, there won't in
3355 fact be any retry items at all.
3356
3357 The complete set of retry items might include an item to delete a
3358 routing retry if there was a previous routing delay. However, routing
3359 retries are also used when a remote transport identifies an address error.
3360 In that case, there may also be an "add" item for the same key. Arrange
3361 that a "delete" item is dropped in favour of an "add" item. */
3362
3363 case 'R':
d6c82d7b 3364 if (!addr) goto ADDR_MISMATCH;
059ec3d9
PH
3365
3366 DEBUG(D_deliver|D_retry)
3367 debug_printf("reading retry information for %s from subprocess\n",
3368 ptr+1);
3369
3370 /* Cut out any "delete" items on the list. */
3371
d6c82d7b 3372 for (rp = &(addr->retries); (r = *rp); rp = &r->next)
059ec3d9
PH
3373 if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
3374 {
3375 if ((r->flags & rf_delete) == 0) break; /* It was not "delete" */
3376 *rp = r->next; /* Excise a delete item */
3377 DEBUG(D_deliver|D_retry)
3378 debug_printf(" existing delete item dropped\n");
3379 }
059ec3d9
PH
3380
3381 /* We want to add a delete item only if there is no non-delete item;
3382 however we still have to step ptr through the data. */
3383
d6c82d7b 3384 if (!r || (*ptr & rf_delete) == 0)
059ec3d9
PH
3385 {
3386 r = store_get(sizeof(retry_item));
3387 r->next = addr->retries;
3388 addr->retries = r;
3389 r->flags = *ptr++;
3390 r->key = string_copy(ptr);
3391 while (*ptr++);
3392 memcpy(&(r->basic_errno), ptr, sizeof(r->basic_errno));
3393 ptr += sizeof(r->basic_errno);
3394 memcpy(&(r->more_errno), ptr, sizeof(r->more_errno));
3395 ptr += sizeof(r->more_errno);
3396 r->message = (*ptr)? string_copy(ptr) : NULL;
3397 DEBUG(D_deliver|D_retry)
3398 debug_printf(" added %s item\n",
3399 ((r->flags & rf_delete) == 0)? "retry" : "delete");
3400 }
3401
3402 else
3403 {
3404 DEBUG(D_deliver|D_retry)
3405 debug_printf(" delete item not added: non-delete item exists\n");
3406 ptr++;
3407 while(*ptr++);
3408 ptr += sizeof(r->basic_errno) + sizeof(r->more_errno);
3409 }
3410
3411 while(*ptr++);
3412 break;
3413
3414 /* Put the amount of data written into the parlist block */
3415
3416 case 'S':
3417 memcpy(&(p->transport_count), ptr, sizeof(transport_count));
3418 ptr += sizeof(transport_count);
3419 break;
3420
3421 /* Address items are in the order of items on the address chain. We
3422 remember the current address value in case this function is called
3423 several times to empty the pipe in stages. Information about delivery
3424 over TLS is sent in a preceding X item for each address. We don't put
3425 it in with the other info, in order to keep each message short enough to
3426 guarantee it won't be split in the pipe. */
3427
a7538db1 3428#ifdef SUPPORT_TLS
059ec3d9 3429 case 'X':
d6c82d7b 3430 if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */
bd21a787 3431 switch (subid)
9d1c15ef
JH
3432 {
3433 case '1':
3434 addr->cipher = NULL;
3435 addr->peerdn = NULL;
3436
3437 if (*ptr)
3438 addr->cipher = string_copy(ptr);
3439 while (*ptr++);
3440 if (*ptr)
9d1c15ef 3441 addr->peerdn = string_copy(ptr);
9d1c15ef
JH
3442 break;
3443
3444 case '2':
9d1c15ef
JH
3445 if (*ptr)
3446 (void) tls_import_cert(ptr, &addr->peercert);
152e7604
JH
3447 else
3448 addr->peercert = NULL;
9d1c15ef
JH
3449 break;
3450
3451 case '3':
9d1c15ef
JH
3452 if (*ptr)
3453 (void) tls_import_cert(ptr, &addr->ourcert);
152e7604
JH
3454 else
3455 addr->ourcert = NULL;
9d1c15ef 3456 break;
018058b2 3457
a7538db1 3458# ifndef DISABLE_OCSP
018058b2
JH
3459 case '4':
3460 addr->ocsp = OCSP_NOT_REQ;
3461 if (*ptr)
3462 addr->ocsp = *ptr - '0';
3463 break;
a7538db1 3464# endif
9d1c15ef 3465 }
059ec3d9
PH
3466 while (*ptr++);
3467 break;
a7538db1 3468#endif /*SUPPORT_TLS*/
059ec3d9 3469
6f123593 3470 case 'C': /* client authenticator information */
bd21a787 3471 switch (subid)
9d1c15ef
JH
3472 {
3473 case '1':
3474 addr->authenticator = (*ptr)? string_copy(ptr) : NULL;
3475 break;
3476 case '2':
3477 addr->auth_id = (*ptr)? string_copy(ptr) : NULL;
3478 break;
3479 case '3':
3480 addr->auth_sndr = (*ptr)? string_copy(ptr) : NULL;
3481 break;
3482 }
6f123593
JH
3483 while (*ptr++);
3484 break;
3485
8ccd00b1 3486#ifndef DISABLE_PRDR
fd98a5c6 3487 case 'P':
8ccd00b1
JH
3488 addr->flags |= af_prdr_used;
3489 break;
fd98a5c6
JH
3490#endif
3491
e0cc6cda
JH
3492 case 'K':
3493 addr->flags |= af_chunking_used;
3494 break;
3495
6c1c3d1d 3496 case 'D':
d6c82d7b 3497 if (!addr) goto ADDR_MISMATCH;
6c1c3d1d
WB
3498 memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
3499 ptr += sizeof(addr->dsn_aware);
3500 DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
3501 break;
6c1c3d1d 3502
059ec3d9 3503 case 'A':
d6c82d7b 3504 if (!addr)
059ec3d9
PH
3505 {
3506 ADDR_MISMATCH:
3507 msg = string_sprintf("address count mismatch for data read from pipe "
3508 "for transport process %d for transport %s", pid,
3509 addrlist->transport->driver_name);
3510 done = TRUE;
3511 break;
3512 }
3513
895fbaf2 3514 switch (subid)
059ec3d9 3515 {
e6d2a989
JH
3516#ifdef SUPPORT_SOCKS
3517 case '2': /* proxy information; must arrive before A0 and applies to that addr XXX oops*/
3518 proxy_session = TRUE; /*XXX shouod this be cleared somewhere? */
3519 if (*ptr == 0)
3520 ptr++;
3521 else
3522 {
3523 proxy_local_address = string_copy(ptr);
3524 while(*ptr++);
3525 memcpy(&proxy_local_port, ptr, sizeof(proxy_local_port));
3526 ptr += sizeof(proxy_local_port);
3527 }
3528 break;
3529#endif
3530
895fbaf2
JH
3531#ifdef EXPERIMENTAL_DSN_INFO
3532 case '1': /* must arrive before A0, and applies to that addr */
3533 /* Two strings: smtp_greeting and helo_response */
3534 addr->smtp_greeting = string_copy(ptr);
3535 while(*ptr++);
3536 addr->helo_response = string_copy(ptr);
3537 while(*ptr++);
3538 break;
3539#endif
059ec3d9 3540
895fbaf2
JH
3541 case '0':
3542 addr->transport_return = *ptr++;
3543 addr->special_action = *ptr++;
3544 memcpy(&(addr->basic_errno), ptr, sizeof(addr->basic_errno));
3545 ptr += sizeof(addr->basic_errno);
3546 memcpy(&(addr->more_errno), ptr, sizeof(addr->more_errno));
3547 ptr += sizeof(addr->more_errno);
3548 memcpy(&(addr->flags), ptr, sizeof(addr->flags));
3549 ptr += sizeof(addr->flags);
3550 addr->message = (*ptr)? string_copy(ptr) : NULL;
3551 while(*ptr++);
3552 addr->user_message = (*ptr)? string_copy(ptr) : NULL;
3553 while(*ptr++);
059ec3d9 3554
895fbaf2
JH
3555 /* Always two strings for host information, followed by the port number and DNSSEC mark */
3556
3557 if (*ptr != 0)
3558 {
3559 h = store_get(sizeof(host_item));
3560 h->name = string_copy(ptr);
3561 while (*ptr++);
3562 h->address = string_copy(ptr);
3563 while(*ptr++);
3564 memcpy(&(h->port), ptr, sizeof(h->port));
3565 ptr += sizeof(h->port);
3566 h->dnssec = *ptr == '2' ? DS_YES
3567 : *ptr == '1' ? DS_NO
3568 : DS_UNK;
3569 ptr++;
3570 addr->host_used = h;
3571 }
3572 else ptr++;
3573
3574 /* Finished with this address */
3575
3576 addr = addr->next;
3577 break;
3578 }
059ec3d9
PH
3579 break;
3580
aeaf5db3
JH
3581 /* Local interface address/port */
3582 case 'I':
3583 if (*ptr) sending_ip_address = string_copy(ptr);
3584 while (*ptr++) ;
93a6fce2 3585 if (*ptr) sending_port = atoi(CS ptr);
aeaf5db3
JH
3586 while (*ptr++) ;
3587 break;
3588
059ec3d9
PH
3589 /* Z marks the logical end of the data. It is followed by '0' if
3590 continue_transport was NULL at the end of transporting, otherwise '1'.
3591 We need to know when it becomes NULL during a delivery down a passed SMTP
3592 channel so that we don't try to pass anything more down it. Of course, for
3593 most normal messages it will remain NULL all the time. */
3594
3595 case 'Z':
3596 if (*ptr == '0')
3597 {
3598 continue_transport = NULL;
3599 continue_hostname = NULL;
3600 }
3601 done = TRUE;
bd21a787 3602 DEBUG(D_deliver) debug_printf("Z0%c item read\n", *ptr);
059ec3d9
PH
3603 break;
3604
3605 /* Anything else is a disaster. */
3606
3607 default:
3608 msg = string_sprintf("malformed data (%d) read from pipe for transport "
3609 "process %d for transport %s", ptr[-1], pid,
3610 addr->transport->driver_name);
3611 done = TRUE;
3612 break;
3613 }
3614 }
3615
3616/* The done flag is inspected externally, to determine whether or not to
3617call the function again when the process finishes. */
3618
3619p->done = done;
3620
3621/* If the process hadn't finished, and we haven't seen the end of the data
3622or suffered a disaster, update the rest of the state, and return FALSE to
3623indicate "not finished". */
3624
3625if (!eop && !done)
3626 {
3627 p->addr = addr;
3628 p->msg = msg;
3629 return FALSE;
3630 }
3631
3632/* Close our end of the pipe, to prevent deadlock if the far end is still
3633pushing stuff into it. */
3634
f1e894f3 3635(void)close(fd);
059ec3d9
PH
3636p->fd = -1;
3637
3638/* If we have finished without error, but haven't had data for every address,
3639something is wrong. */
3640
d6c82d7b 3641if (!msg && addr)
059ec3d9
PH
3642 msg = string_sprintf("insufficient address data read from pipe "
3643 "for transport process %d for transport %s", pid,
3644 addr->transport->driver_name);
3645
3646/* If an error message is set, something has gone wrong in getting back
3647the delivery data. Put the message into each address and freeze it. */
3648
d6c82d7b
JH
3649if (msg)
3650 for (addr = addrlist; addr; addr = addr->next)
059ec3d9
PH
3651 {
3652 addr->transport_return = DEFER;
3653 addr->special_action = SPECIAL_FREEZE;
3654 addr->message = msg;
3655 }
059ec3d9
PH
3656
3657/* Return TRUE to indicate we have got all we need from this process, even
3658if it hasn't actually finished yet. */
3659
3660return TRUE;
3661}
3662
3663
3664
3665/*************************************************
3666* Post-process a set of remote addresses *
3667*************************************************/
3668
3669/* Do what has to be done immediately after a remote delivery for each set of
3670addresses, then re-write the spool if necessary. Note that post_process_one
3671puts the address on an appropriate queue; hence we must fish off the next
3672one first. This function is also called if there is a problem with setting
3673up a subprocess to do a remote delivery in parallel. In this case, the final
3674argument contains a message, and the action must be forced to DEFER.
3675
3676Argument:
3677 addr pointer to chain of address items
3678 logflags flags for logging
3679 msg NULL for normal cases; -> error message for unexpected problems
3680 fallback TRUE if processing fallback hosts
3681
3682Returns: nothing
3683*/
3684
3685static void
3686remote_post_process(address_item *addr, int logflags, uschar *msg,
3687 BOOL fallback)
3688{
3689host_item *h;
3690
3691/* If any host addresses were found to be unusable, add them to the unusable
3692tree so that subsequent deliveries don't try them. */
3693
d6c82d7b
JH
3694for (h = addr->host_list; h; h = h->next)
3695 if (h->address)
3696 if (h->status >= hstatus_unusable) tree_add_unusable(h);
059ec3d9
PH
3697
3698/* Now handle each address on the chain. The transport has placed '=' or '-'
3699into the special_action field for each successful delivery. */
3700
d6c82d7b 3701while (addr)
059ec3d9
PH