Routers: make retry_use_local_part default true when any non-domain condition is...
[exim.git] / src / src / deliver.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* The main code for delivering a message. */
9
10
11#include "exim.h"
e39fdc85 12#include "transports/smtp.h"
c29da374 13#include <sys/uio.h>
dadff1d4 14#include <assert.h>
059ec3d9
PH
15
16
17/* Data block for keeping track of subprocesses for parallel remote
18delivery. */
19
20typedef struct pardata {
21 address_item *addrlist; /* chain of addresses */
22 address_item *addr; /* next address data expected for */
23 pid_t pid; /* subprocess pid */
24 int fd; /* pipe fd for getting result from subprocess */
25 int transport_count; /* returned transport count value */
26 BOOL done; /* no more data needed */
27 uschar *msg; /* error message */
28 uschar *return_path; /* return_path for these addresses */
29} pardata;
30
31/* Values for the process_recipients variable */
32
33enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
34 RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
35 RECIP_FAIL_LOOP};
36
37/* Mutually recursive functions for marking addresses done. */
38
39static void child_done(address_item *, uschar *);
40static void address_done(address_item *, uschar *);
41
42/* Table for turning base-62 numbers into binary */
43
44static uschar tab62[] =
45 {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
46 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
47 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
48 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
49 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
50 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
51 59,60,61}; /* x-z */
52
53
54/*************************************************
55* Local static variables *
56*************************************************/
57
58/* addr_duplicate is global because it needs to be seen from the Envelope-To
59writing code. */
60
61static address_item *addr_defer = NULL;
62static address_item *addr_failed = NULL;
63static address_item *addr_fallback = NULL;
64static address_item *addr_local = NULL;
65static address_item *addr_new = NULL;
66static address_item *addr_remote = NULL;
67static address_item *addr_route = NULL;
68static address_item *addr_succeed = NULL;
6c1c3d1d 69static address_item *addr_senddsn = NULL;
059ec3d9
PH
70
71static FILE *message_log = NULL;
72static BOOL update_spool;
73static BOOL remove_journal;
74static int parcount = 0;
75static pardata *parlist = NULL;
76static int return_count;
77static uschar *frozen_info = US"";
78static uschar *used_return_path = NULL;
79
059ec3d9
PH
80
81
82/*************************************************
ee250936
JH
83* read as much as requested *
84*************************************************/
85
86/* The syscall read(2) doesn't always returns as much as we want. For
87several reasons it might get less. (Not talking about signals, as syscalls
88are restartable). When reading from a network or pipe connection the sender
89might send in smaller chunks, with delays between these chunks. The read(2)
90may return such a chunk.
91
92The more the writer writes and the smaller the pipe between write and read is,
93the more we get the chance of reading leass than requested. (See bug 2130)
94
95This function read(2)s until we got all the data we *requested*.
96
97Note: This function may block. Use it only if you're sure about the
98amount of data you will get.
99
100Argument:
101 fd the file descriptor to read from
102 buffer pointer to a buffer of size len
103 len the requested(!) amount of bytes
104
105Returns: the amount of bytes read
106*/
107static ssize_t
108readn(int fd, void * buffer, size_t len)
109{
6d95688d
JH
110uschar * next = buffer;
111uschar * end = next + len;
ee250936 112
6d95688d
JH
113while (next < end)
114 {
115 ssize_t got = read(fd, next, end - next);
ee250936 116
6d95688d
JH
117 /* I'm not sure if there are signals that can interrupt us,
118 for now I assume the worst */
119 if (got == -1 && errno == EINTR) continue;
120 if (got <= 0) return next - US buffer;
121 next += got;
122 }
ee250936 123
6d95688d 124return len;
ee250936
JH
125}
126
127
128/*************************************************
059ec3d9
PH
129* Make a new address item *
130*************************************************/
131
132/* This function gets the store and initializes with default values. The
133transport_return value defaults to DEFER, so that any unexpected failure to
134deliver does not wipe out the message. The default unique string is set to a
135copy of the address, so that its domain can be lowercased.
136
137Argument:
138 address the RFC822 address string
139 copy force a copy of the address
140
141Returns: a pointer to an initialized address_item
142*/
143
144address_item *
145deliver_make_addr(uschar *address, BOOL copy)
146{
f3ebb786 147address_item *addr = store_get(sizeof(address_item), FALSE);
059ec3d9
PH
148*addr = address_defaults;
149if (copy) address = string_copy(address);
150addr->address = address;
151addr->unique = string_copy(address);
152return addr;
153}
154
155
156
157
158/*************************************************
159* Set expansion values for an address *
160*************************************************/
161
162/* Certain expansion variables are valid only when handling an address or
163address list. This function sets them up or clears the values, according to its
164argument.
165
166Arguments:
167 addr the address in question, or NULL to clear values
168Returns: nothing
169*/
170
171void
172deliver_set_expansions(address_item *addr)
173{
d6c82d7b 174if (!addr)
059ec3d9 175 {
55414b25 176 const uschar ***p = address_expansions;
d6c82d7b 177 while (*p) **p++ = NULL;
059ec3d9
PH
178 return;
179 }
180
181/* Exactly what gets set depends on whether there is one or more addresses, and
182what they contain. These first ones are always set, taking their values from
183the first address. */
184
d6c82d7b 185if (!addr->host_list)
059ec3d9
PH
186 {
187 deliver_host = deliver_host_address = US"";
a7538db1 188 deliver_host_port = 0;
059ec3d9
PH
189 }
190else
191 {
192 deliver_host = addr->host_list->name;
193 deliver_host_address = addr->host_list->address;
a7538db1 194 deliver_host_port = addr->host_list->port;
059ec3d9
PH
195 }
196
197deliver_recipients = addr;
d43cbe25
JH
198deliver_address_data = addr->prop.address_data;
199deliver_domain_data = addr->prop.domain_data;
200deliver_localpart_data = addr->prop.localpart_data;
b4f579d1 201router_var = addr->prop.variables;
059ec3d9
PH
202
203/* These may be unset for multiple addresses */
204
205deliver_domain = addr->domain;
206self_hostname = addr->self_hostname;
207
8523533c
TK
208#ifdef EXPERIMENTAL_BRIGHTMAIL
209bmi_deliver = 1; /* deliver by default */
210bmi_alt_location = NULL;
211bmi_base64_verdict = NULL;
212bmi_base64_tracker_verdict = NULL;
213#endif
214
059ec3d9
PH
215/* If there's only one address we can set everything. */
216
d6c82d7b 217if (!addr->next)
059ec3d9
PH
218 {
219 address_item *addr_orig;
220
221 deliver_localpart = addr->local_part;
222 deliver_localpart_prefix = addr->prefix;
223 deliver_localpart_suffix = addr->suffix;
224
d6c82d7b 225 for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
059ec3d9
PH
226 deliver_domain_orig = addr_orig->domain;
227
228 /* Re-instate any prefix and suffix in the original local part. In all
229 normal cases, the address will have a router associated with it, and we can
230 choose the caseful or caseless version accordingly. However, when a system
231 filter sets up a pipe, file, or autoreply delivery, no router is involved.
232 In this case, though, there won't be any prefix or suffix to worry about. */
233
d6c82d7b
JH
234 deliver_localpart_orig = !addr_orig->router
235 ? addr_orig->local_part
236 : addr_orig->router->caseful_local_part
237 ? addr_orig->cc_local_part
238 : addr_orig->lc_local_part;
059ec3d9
PH
239
240 /* If there's a parent, make its domain and local part available, and if
241 delivering to a pipe or file, or sending an autoreply, get the local
242 part from the parent. For pipes and files, put the pipe or file string
243 into address_pipe and address_file. */
244
d6c82d7b 245 if (addr->parent)
059ec3d9
PH
246 {
247 deliver_domain_parent = addr->parent->domain;
d6c82d7b
JH
248 deliver_localpart_parent = !addr->parent->router
249 ? addr->parent->local_part
250 : addr->parent->router->caseful_local_part
251 ? addr->parent->cc_local_part
252 : addr->parent->lc_local_part;
059ec3d9
PH
253
254 /* File deliveries have their own flag because they need to be picked out
255 as special more often. */
256
257 if (testflag(addr, af_pfr))
258 {
d6c82d7b
JH
259 if (testflag(addr, af_file)) address_file = addr->local_part;
260 else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
059ec3d9
PH
261 deliver_localpart = addr->parent->local_part;
262 deliver_localpart_prefix = addr->parent->prefix;
263 deliver_localpart_suffix = addr->parent->suffix;
264 }
265 }
8523533c
TK
266
267#ifdef EXPERIMENTAL_BRIGHTMAIL
268 /* Set expansion variables related to Brightmail AntiSpam */
269 bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
270 bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
271 /* get message delivery status (0 - don't deliver | 1 - deliver) */
272 bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
273 /* if message is to be delivered, get eventual alternate location */
d6c82d7b 274 if (bmi_deliver == 1)
8523533c 275 bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
8523533c
TK
276#endif
277
059ec3d9
PH
278 }
279
280/* For multiple addresses, don't set local part, and leave the domain and
f7fd3850
PH
281self_hostname set only if it is the same for all of them. It is possible to
282have multiple pipe and file addresses, but only when all addresses have routed
283to the same pipe or file. */
059ec3d9
PH
284
285else
286 {
f7fd3850
PH
287 if (testflag(addr, af_pfr))
288 {
d6c82d7b
JH
289 if (testflag(addr, af_file)) address_file = addr->local_part;
290 else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
f7fd3850 291 }
d7978c0f 292 for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 293 {
d6c82d7b 294 if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
059ec3d9 295 deliver_domain = NULL;
d6c82d7b
JH
296 if ( self_hostname
297 && ( !addr2->self_hostname
298 || Ustrcmp(self_hostname, addr2->self_hostname) != 0
299 ) )
059ec3d9 300 self_hostname = NULL;
d6c82d7b 301 if (!deliver_domain && !self_hostname) break;
059ec3d9
PH
302 }
303 }
304}
305
306
307
308
309/*************************************************
310* Open a msglog file *
311*************************************************/
312
313/* This function is used both for normal message logs, and for files in the
314msglog directory that are used to catch output from pipes. Try to create the
315directory if it does not exist. From release 4.21, normal message logs should
316be created when the message is received.
317
92b0827a
JH
318Called from deliver_message(), can be operating as root.
319
059ec3d9
PH
320Argument:
321 filename the file name
322 mode the mode required
323 error used for saying what failed
324
325Returns: a file descriptor, or -1 (with errno set)
326*/
327
328static int
329open_msglog_file(uschar *filename, int mode, uschar **error)
330{
d7978c0f 331for (int i = 2; i > 0; i--)
059ec3d9 332 {
d7978c0f 333 int fd = Uopen(filename,
92b0827a
JH
334#ifdef O_CLOEXEC
335 O_CLOEXEC |
336#endif
337#ifdef O_NOFOLLOW
338 O_NOFOLLOW |
339#endif
340 O_WRONLY|O_APPEND|O_CREAT, mode);
341 if (fd >= 0)
342 {
343 /* Set the close-on-exec flag and change the owner to the exim uid/gid (this
344 function is called as root). Double check the mode, because the group setting
345 doesn't always get set automatically. */
346
347#ifndef O_CLOEXEC
348 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
349#endif
b66fecb4 350 if (exim_fchown(fd, exim_uid, exim_gid, filename) < 0)
92b0827a
JH
351 {
352 *error = US"chown";
353 return -1;
354 }
355 if (fchmod(fd, mode) < 0)
356 {
357 *error = US"chmod";
358 return -1;
359 }
360 return fd;
361 }
362 if (errno != ENOENT)
363 break;
364
41313d92
JH
365 (void)directory_make(spool_directory,
366 spool_sname(US"msglog", message_subdir),
367 MSGLOG_DIRECTORY_MODE, TRUE);
059ec3d9 368 }
059ec3d9 369
b66fecb4 370*error = US"create or open";
92b0827a 371return -1;
059ec3d9
PH
372}
373
374
375
376
377/*************************************************
378* Write to msglog if required *
379*************************************************/
380
381/* Write to the message log, if configured. This function may also be called
382from transports.
383
384Arguments:
385 format a string format
386
387Returns: nothing
388*/
389
390void
391deliver_msglog(const char *format, ...)
392{
393va_list ap;
394if (!message_logs) return;
395va_start(ap, format);
396vfprintf(message_log, format, ap);
397fflush(message_log);
398va_end(ap);
399}
400
401
402
403
404/*************************************************
405* Replicate status for batch *
406*************************************************/
407
408/* When a transport handles a batch of addresses, it may treat them
409individually, or it may just put the status in the first one, and return FALSE,
410requesting that the status be copied to all the others externally. This is the
411replication function. As well as the status, it copies the transport pointer,
412which may have changed if appendfile passed the addresses on to a different
413transport.
414
415Argument: pointer to the first address in a chain
416Returns: nothing
417*/
418
419static void
420replicate_status(address_item *addr)
421{
d7978c0f 422for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 423 {
d6c82d7b 424 addr2->transport = addr->transport;
059ec3d9 425 addr2->transport_return = addr->transport_return;
d6c82d7b
JH
426 addr2->basic_errno = addr->basic_errno;
427 addr2->more_errno = addr->more_errno;
32dfdf8b 428 addr2->delivery_usec = addr->delivery_usec;
d6c82d7b
JH
429 addr2->special_action = addr->special_action;
430 addr2->message = addr->message;
431 addr2->user_message = addr->user_message;
059ec3d9
PH
432 }
433}
434
435
436
437/*************************************************
438* Compare lists of hosts *
439*************************************************/
440
441/* This function is given two pointers to chains of host items, and it yields
442TRUE if the lists refer to the same hosts in the same order, except that
443
444(1) Multiple hosts with the same non-negative MX values are permitted to appear
445 in different orders. Round-robinning nameservers can cause this to happen.
446
447(2) Multiple hosts with the same negative MX values less than MX_NONE are also
448 permitted to appear in different orders. This is caused by randomizing
449 hosts lists.
450
451This enables Exim to use a single SMTP transaction for sending to two entirely
452different domains that happen to end up pointing at the same hosts.
453
454Arguments:
455 one points to the first host list
456 two points to the second host list
457
458Returns: TRUE if the lists refer to the same host set
459*/
460
461static BOOL
462same_hosts(host_item *one, host_item *two)
463{
d6c82d7b 464while (one && two)
059ec3d9
PH
465 {
466 if (Ustrcmp(one->name, two->name) != 0)
467 {
468 int mx = one->mx;
469 host_item *end_one = one;
470 host_item *end_two = two;
471
472 /* Batch up only if there was no MX and the list was not randomized */
473
474 if (mx == MX_NONE) return FALSE;
475
476 /* Find the ends of the shortest sequence of identical MX values */
477
d6c82d7b
JH
478 while ( end_one->next && end_one->next->mx == mx
479 && end_two->next && end_two->next->mx == mx)
059ec3d9
PH
480 {
481 end_one = end_one->next;
482 end_two = end_two->next;
483 }
484
485 /* If there aren't any duplicates, there's no match. */
486
487 if (end_one == one) return FALSE;
488
489 /* For each host in the 'one' sequence, check that it appears in the 'two'
490 sequence, returning FALSE if not. */
491
492 for (;;)
493 {
494 host_item *hi;
495 for (hi = two; hi != end_two->next; hi = hi->next)
496 if (Ustrcmp(one->name, hi->name) == 0) break;
497 if (hi == end_two->next) return FALSE;
498 if (one == end_one) break;
499 one = one->next;
500 }
501
502 /* All the hosts in the 'one' sequence were found in the 'two' sequence.
503 Ensure both are pointing at the last host, and carry on as for equality. */
504
505 two = end_two;
506 }
507
1c788856
JH
508 /* if the names matched but ports do not, mismatch */
509 else if (one->port != two->port)
510 return FALSE;
511
059ec3d9
PH
512 /* Hosts matched */
513
514 one = one->next;
515 two = two->next;
516 }
517
518/* True if both are NULL */
519
520return (one == two);
521}
522
523
524
525/*************************************************
526* Compare header lines *
527*************************************************/
528
529/* This function is given two pointers to chains of header items, and it yields
530TRUE if they are the same header texts in the same order.
531
532Arguments:
533 one points to the first header list
534 two points to the second header list
535
536Returns: TRUE if the lists refer to the same header set
537*/
538
539static BOOL
540same_headers(header_line *one, header_line *two)
541{
d6c82d7b 542for (;; one = one->next, two = two->next)
059ec3d9
PH
543 {
544 if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 545 if (!one || !two) return FALSE;
059ec3d9 546 if (Ustrcmp(one->text, two->text) != 0) return FALSE;
059ec3d9
PH
547 }
548}
549
550
551
552/*************************************************
553* Compare string settings *
554*************************************************/
555
556/* This function is given two pointers to strings, and it returns
557TRUE if they are the same pointer, or if the two strings are the same.
558
559Arguments:
560 one points to the first string
561 two points to the second string
562
563Returns: TRUE or FALSE
564*/
565
566static BOOL
567same_strings(uschar *one, uschar *two)
568{
569if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 570if (!one || !two) return FALSE;
059ec3d9
PH
571return (Ustrcmp(one, two) == 0);
572}
573
574
575
576/*************************************************
577* Compare uid/gid for addresses *
578*************************************************/
579
580/* This function is given a transport and two addresses. It yields TRUE if the
581uid/gid/initgroups settings for the two addresses are going to be the same when
582they are delivered.
583
584Arguments:
585 tp the transort
586 addr1 the first address
587 addr2 the second address
588
589Returns: TRUE or FALSE
590*/
591
592static BOOL
593same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
594{
d6c82d7b
JH
595if ( !tp->uid_set && !tp->expand_uid
596 && !tp->deliver_as_creator
597 && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
598 || ( testflag(addr1, af_uid_set)
599 && ( addr1->uid != addr2->uid
600 || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
601 ) ) ) )
602 return FALSE;
059ec3d9 603
d6c82d7b
JH
604if ( !tp->gid_set && !tp->expand_gid
605 && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
606 || ( testflag(addr1, af_gid_set)
607 && addr1->gid != addr2->gid
608 ) ) )
609 return FALSE;
059ec3d9
PH
610
611return TRUE;
612}
613
614
615
616
617/*************************************************
618* Record that an address is complete *
619*************************************************/
620
621/* This function records that an address is complete. This is straightforward
622for most addresses, where the unique address is just the full address with the
623domain lower cased. For homonyms (addresses that are the same as one of their
624ancestors) their are complications. Their unique addresses have \x\ prepended
625(where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
626cousins.
627
628Exim used to record the unique addresses of homonyms as "complete". This,
629however, fails when the pattern of redirection varies over time (e.g. if taking
630unseen copies at only some times of day) because the prepended numbers may vary
631from one delivery run to the next. This problem is solved by never recording
632prepended unique addresses as complete. Instead, when a homonymic address has
633actually been delivered via a transport, we record its basic unique address
634followed by the name of the transport. This is checked in subsequent delivery
635runs whenever an address is routed to a transport.
636
637If the completed address is a top-level one (has no parent, which means it
638cannot be homonymic) we also add the original address to the non-recipients
639tree, so that it gets recorded in the spool file and therefore appears as
640"done" in any spool listings. The original address may differ from the unique
641address in the case of the domain.
642
643Finally, this function scans the list of duplicates, marks as done any that
644match this address, and calls child_done() for their ancestors.
645
646Arguments:
647 addr address item that has been completed
648 now current time as a string
649
650Returns: nothing
651*/
652
653static void
654address_done(address_item *addr, uschar *now)
655{
059ec3d9
PH
656update_spool = TRUE; /* Ensure spool gets updated */
657
658/* Top-level address */
659
d6c82d7b 660if (!addr->parent)
059ec3d9
PH
661 {
662 tree_add_nonrecipient(addr->unique);
663 tree_add_nonrecipient(addr->address);
664 }
665
666/* Homonymous child address */
667
668else if (testflag(addr, af_homonym))
669 {
d6c82d7b 670 if (addr->transport)
059ec3d9
PH
671 tree_add_nonrecipient(
672 string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
059ec3d9
PH
673 }
674
675/* Non-homonymous child address */
676
677else tree_add_nonrecipient(addr->unique);
678
679/* Check the list of duplicate addresses and ensure they are now marked
680done as well. */
681
d7978c0f 682for (address_item * dup = addr_duplicate; dup; dup = dup->next)
059ec3d9
PH
683 if (Ustrcmp(addr->unique, dup->unique) == 0)
684 {
57730b52 685 tree_add_nonrecipient(dup->unique);
059ec3d9
PH
686 child_done(dup, now);
687 }
059ec3d9
PH
688}
689
690
691
692
693/*************************************************
694* Decrease counts in parents and mark done *
695*************************************************/
696
697/* This function is called when an address is complete. If there is a parent
698address, its count of children is decremented. If there are still other
699children outstanding, the function exits. Otherwise, if the count has become
700zero, address_done() is called to mark the parent and its duplicates complete.
701Then loop for any earlier ancestors.
702
703Arguments:
704 addr points to the completed address item
705 now the current time as a string, for writing to the message log
706
707Returns: nothing
708*/
709
710static void
711child_done(address_item *addr, uschar *now)
712{
d6c82d7b 713while (addr->parent)
059ec3d9 714 {
d7978c0f
JH
715 address_item *aa;
716
059ec3d9 717 addr = addr->parent;
82f90600 718 if (--addr->child_count > 0) return; /* Incomplete parent */
059ec3d9
PH
719 address_done(addr, now);
720
721 /* Log the completion of all descendents only when there is no ancestor with
722 the same original address. */
723
d6c82d7b 724 for (aa = addr->parent; aa; aa = aa->parent)
059ec3d9 725 if (Ustrcmp(aa->address, addr->address) == 0) break;
d6c82d7b 726 if (aa) continue;
059ec3d9
PH
727
728 deliver_msglog("%s %s: children all complete\n", now, addr->address);
729 DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
730 }
731}
732
733
734
ac881e27
TF
735/*************************************************
736* Delivery logging support functions *
737*************************************************/
738
739/* The LOGGING() checks in d_log_interface() are complicated for backwards
740compatibility. When outgoing interface logging was originally added, it was
741conditional on just incoming_interface (which is off by default). The
742outgoing_interface option is on by default to preserve this behaviour, but
743you can enable incoming_interface and disable outgoing_interface to get I=
744fields on incoming lines only.
745
746Arguments:
acec9514 747 g The log line
ac881e27
TF
748 addr The address to be logged
749
750Returns: New value for s
751*/
059ec3d9 752
acec9514
JH
753static gstring *
754d_log_interface(gstring * g)
67d81c10 755{
ac881e27 756if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
d6c82d7b 757 && sending_ip_address)
ac881e27 758 {
d12746bc
JH
759 g = string_fmt_append(g, " I=[%s]", sending_ip_address);
760 if (LOGGING(outgoing_port))
2d5bf097 761 g = string_fmt_append(g, ":%d", sending_port);
ac881e27 762 }
acec9514 763return g;
67d81c10
JH
764}
765
ac881e27
TF
766
767
acec9514
JH
768static gstring *
769d_hostlog(gstring * g, address_item * addr)
ac881e27 770{
fc16abb4
JH
771host_item * h = addr->host_used;
772
acec9514 773g = string_append(g, 2, US" H=", h->name);
fc16abb4
JH
774
775if (LOGGING(dnssec) && h->dnssec == DS_YES)
acec9514 776 g = string_catn(g, US" DS", 3);
fc16abb4 777
acec9514 778g = string_append(g, 3, US" [", h->address, US"]");
fc16abb4 779
ac881e27 780if (LOGGING(outgoing_port))
d12746bc 781 g = string_fmt_append(g, ":%d", h->port);
e6d2a989
JH
782
783#ifdef SUPPORT_SOCKS
784if (LOGGING(proxy) && proxy_local_address)
785 {
acec9514 786 g = string_append(g, 3, US" PRX=[", proxy_local_address, US"]");
e6d2a989 787 if (LOGGING(outgoing_port))
d12746bc 788 g = string_fmt_append(g, ":%d", proxy_local_port);
e6d2a989
JH
789 }
790#endif
791
acec9514 792g = d_log_interface(g);
a2673768
JH
793
794if (testflag(addr, af_tcp_fastopen))
ee8b8090 795 g = string_catn(g, US" TFO*", testflag(addr, af_tcp_fastopen_data) ? 5 : 4);
a2673768 796
acec9514 797return g;
ac881e27
TF
798}
799
800
801
e6d2a989
JH
802
803
01603eec 804#ifndef DISABLE_TLS
acec9514 805static gstring *
b10c87b3 806d_tlslog(gstring * g, address_item * addr)
67d81c10 807{
d6c82d7b 808if (LOGGING(tls_cipher) && addr->cipher)
b10c87b3
JH
809 {
810 g = string_append(g, 2, US" X=", addr->cipher);
811#ifdef EXPERIMENTAL_TLS_RESUME
812 if (LOGGING(tls_resumption) && testflag(addr, af_tls_resume))
813 g = string_catn(g, US"*", 1);
814#endif
815 }
d6c82d7b 816if (LOGGING(tls_certificate_verified) && addr->cipher)
b10c87b3 817 g = string_append(g, 2, US" CV=",
ac881e27
TF
818 testflag(addr, af_cert_verified)
819 ?
c0635b6d 820#ifdef SUPPORT_DANE
ac881e27
TF
821 testflag(addr, af_dane_verified)
822 ? "dane"
823 :
53a7196b 824#endif
ac881e27
TF
825 "yes"
826 : "no");
d6c82d7b 827if (LOGGING(tls_peerdn) && addr->peerdn)
b10c87b3
JH
828 g = string_append(g, 3, US" DN=\"", string_printing(addr->peerdn), US"\"");
829return g;
67d81c10
JH
830}
831#endif
832
a7538db1 833
14a465c3
JH
834
835
0cbf2b82 836#ifndef DISABLE_EVENT
b30275b8 837uschar *
55414b25 838event_raise(uschar * action, const uschar * event, uschar * ev_data)
a7538db1
JH
839{
840uschar * s;
841if (action)
842 {
843 DEBUG(D_deliver)
774ef2d7 844 debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
a7538db1
JH
845 event,
846 action, deliver_host_address);
847
774ef2d7
JH
848 event_name = event;
849 event_data = ev_data;
a7538db1
JH
850
851 if (!(s = expand_string(action)) && *expand_string_message)
852 log_write(0, LOG_MAIN|LOG_PANIC,
774ef2d7 853 "failed to expand event_action %s in %s: %s\n",
7ea1237c 854 event, transport_name ? transport_name : US"main", expand_string_message);
a7538db1 855
774ef2d7 856 event_name = event_data = NULL;
a7538db1
JH
857
858 /* If the expansion returns anything but an empty string, flag for
859 the caller to modify his normal processing
860 */
861 if (s && *s)
862 {
863 DEBUG(D_deliver)
774ef2d7 864 debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
95938464 865 errno = ERRNO_EVENT;
b30275b8 866 return s;
a7538db1
JH
867 }
868 }
b30275b8 869return NULL;
a7538db1 870}
14a465c3 871
5ef5dd52 872void
55414b25 873msg_event_raise(const uschar * event, const address_item * addr)
14a465c3 874{
55414b25 875const uschar * save_domain = deliver_domain;
14a465c3 876uschar * save_local = deliver_localpart;
55414b25 877const uschar * save_host = deliver_host;
5ef5dd52
JB
878const uschar * save_address = deliver_host_address;
879const int save_port = deliver_host_port;
14a465c3 880
14a465c3 881router_name = addr->router ? addr->router->name : NULL;
14a465c3
JH
882deliver_domain = addr->domain;
883deliver_localpart = addr->local_part;
c562fd30 884deliver_host = addr->host_used ? addr->host_used->name : NULL;
14a465c3 885
4e928780
MK
886if (!addr->transport)
887 {
888 if (Ustrcmp(event, "msg:fail:delivery") == 0)
889 {
890 /* An address failed with no transport involved. This happens when
891 a filter was used which triggered a fail command (in such a case
892 a transport isn't needed). Convert it to an internal fail event. */
893
894 (void) event_raise(event_action, US"msg:fail:internal", addr->message);
895 }
896 }
897else
898 {
899 transport_name = addr->transport->name;
900
901 (void) event_raise(addr->transport->event_action, event,
902 addr->host_used
903 || Ustrcmp(addr->transport->driver_name, "smtp") == 0
904 || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
905 || Ustrcmp(addr->transport->driver_name, "autoreply") == 0
906 ? addr->message : NULL);
907 }
14a465c3 908
5ef5dd52
JB
909deliver_host_port = save_port;
910deliver_host_address = save_address;
c562fd30 911deliver_host = save_host;
14a465c3
JH
912deliver_localpart = save_local;
913deliver_domain = save_domain;
914router_name = transport_name = NULL;
915}
0cbf2b82 916#endif /*DISABLE_EVENT*/
14a465c3
JH
917
918
a7538db1 919
5dac72a7
JH
920/******************************************************************************/
921
922
923/*************************************************
924* Generate local prt for logging *
925*************************************************/
926
927/* This function is a subroutine for use in string_log_address() below.
928
929Arguments:
930 addr the address being logged
931 yield the current dynamic buffer pointer
5dac72a7
JH
932
933Returns: the new value of the buffer pointer
934*/
935
acec9514
JH
936static gstring *
937string_get_localpart(address_item * addr, gstring * yield)
5dac72a7
JH
938{
939uschar * s;
940
941s = addr->prefix;
942if (testflag(addr, af_include_affixes) && s)
943 {
944#ifdef SUPPORT_I18N
945 if (testflag(addr, af_utf8_downcvt))
946 s = string_localpart_utf8_to_alabel(s, NULL);
947#endif
acec9514 948 yield = string_cat(yield, s);
5dac72a7
JH
949 }
950
951s = addr->local_part;
952#ifdef SUPPORT_I18N
953if (testflag(addr, af_utf8_downcvt))
954 s = string_localpart_utf8_to_alabel(s, NULL);
955#endif
acec9514 956yield = string_cat(yield, s);
5dac72a7
JH
957
958s = addr->suffix;
959if (testflag(addr, af_include_affixes) && s)
960 {
961#ifdef SUPPORT_I18N
962 if (testflag(addr, af_utf8_downcvt))
963 s = string_localpart_utf8_to_alabel(s, NULL);
964#endif
acec9514 965 yield = string_cat(yield, s);
5dac72a7
JH
966 }
967
968return yield;
969}
970
971
972/*************************************************
973* Generate log address list *
974*************************************************/
975
976/* This function generates a list consisting of an address and its parents, for
977use in logging lines. For saved onetime aliased addresses, the onetime parent
978field is used. If the address was delivered by a transport with rcpt_include_
979affixes set, the af_include_affixes bit will be set in the address. In that
980case, we include the affixes here too.
981
982Arguments:
acec9514 983 g points to growing-string struct
5dac72a7
JH
984 addr bottom (ultimate) address
985 all_parents if TRUE, include all parents
986 success TRUE for successful delivery
987
988Returns: a growable string in dynamic store
989*/
990
acec9514
JH
991static gstring *
992string_log_address(gstring * g,
5dac72a7
JH
993 address_item *addr, BOOL all_parents, BOOL success)
994{
995BOOL add_topaddr = TRUE;
996address_item *topaddr;
997
998/* Find the ultimate parent */
999
1000for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
1001
1002/* We start with just the local part for pipe, file, and reply deliveries, and
1003for successful local deliveries from routers that have the log_as_local flag
1004set. File deliveries from filters can be specified as non-absolute paths in
4c04137d 1005cases where the transport is going to complete the path. If there is an error
5dac72a7
JH
1006before this happens (expansion failure) the local part will not be updated, and
1007so won't necessarily look like a path. Add extra text for this case. */
1008
1009if ( testflag(addr, af_pfr)
1010 || ( success
1011 && addr->router && addr->router->log_as_local
1012 && addr->transport && addr->transport->info->local
1013 ) )
1014 {
1015 if (testflag(addr, af_file) && addr->local_part[0] != '/')
acec9514
JH
1016 g = string_catn(g, CUS"save ", 5);
1017 g = string_get_localpart(addr, g);
5dac72a7
JH
1018 }
1019
1020/* Other deliveries start with the full address. It we have split it into local
1021part and domain, use those fields. Some early failures can happen before the
1022splitting is done; in those cases use the original field. */
1023
1024else
1025 {
f3ebb786
JH
1026 uschar * cmp;
1027 int off = g->ptr; /* start of the "full address" */
5dac72a7
JH
1028
1029 if (addr->local_part)
1030 {
1031 const uschar * s;
acec9514
JH
1032 g = string_get_localpart(addr, g);
1033 g = string_catn(g, US"@", 1);
5dac72a7
JH
1034 s = addr->domain;
1035#ifdef SUPPORT_I18N
1036 if (testflag(addr, af_utf8_downcvt))
1037 s = string_localpart_utf8_to_alabel(s, NULL);
1038#endif
acec9514 1039 g = string_cat(g, s);
5dac72a7
JH
1040 }
1041 else
acec9514 1042 g = string_cat(g, addr->address);
5dac72a7
JH
1043
1044 /* If the address we are going to print is the same as the top address,
1045 and all parents are not being included, don't add on the top address. First
1046 of all, do a caseless comparison; if this succeeds, do a caseful comparison
1047 on the local parts. */
1048
f3ebb786 1049 cmp = g->s + off; /* only now, as rebuffer likely done */
306c6c77 1050 string_from_gstring(g); /* ensure nul-terminated */
5dac72a7
JH
1051 if ( strcmpic(cmp, topaddr->address) == 0
1052 && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
1053 && !addr->onetime_parent
1054 && (!all_parents || !addr->parent || addr->parent == topaddr)
1055 )
1056 add_topaddr = FALSE;
1057 }
1058
1059/* If all parents are requested, or this is a local pipe/file/reply, and
1060there is at least one intermediate parent, show it in brackets, and continue
1061with all of them if all are wanted. */
1062
1063if ( (all_parents || testflag(addr, af_pfr))
1064 && addr->parent
1065 && addr->parent != topaddr)
1066 {
1067 uschar *s = US" (";
d7978c0f 1068 for (address_item * addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
5dac72a7 1069 {
acec9514
JH
1070 g = string_catn(g, s, 2);
1071 g = string_cat (g, addr2->address);
5dac72a7
JH
1072 if (!all_parents) break;
1073 s = US", ";
1074 }
acec9514 1075 g = string_catn(g, US")", 1);
5dac72a7
JH
1076 }
1077
1078/* Add the top address if it is required */
1079
1080if (add_topaddr)
acec9514 1081 g = string_append(g, 3,
5dac72a7
JH
1082 US" <",
1083 addr->onetime_parent ? addr->onetime_parent : topaddr->address,
1084 US">");
1085
acec9514 1086return g;
5dac72a7
JH
1087}
1088
1089
32dfdf8b
JH
1090
1091void
1092timesince(struct timeval * diff, struct timeval * then)
1093{
1094gettimeofday(diff, NULL);
1095diff->tv_sec -= then->tv_sec;
1096if ((diff->tv_usec -= then->tv_usec) < 0)
1097 {
1098 diff->tv_sec--;
1099 diff->tv_usec += 1000*1000;
1100 }
1101}
1102
1103
1104
306c6c77 1105uschar *
32dfdf8b
JH
1106string_timediff(struct timeval * diff)
1107{
1108static uschar buf[sizeof("0.000s")];
1109
1110if (diff->tv_sec >= 5 || !LOGGING(millisec))
1111 return readconf_printtime((int)diff->tv_sec);
1112
13c7874e 1113sprintf(CS buf, "%u.%03us", (uint)diff->tv_sec, (uint)diff->tv_usec/1000);
32dfdf8b
JH
1114return buf;
1115}
1116
1117
0f1a8658 1118uschar *
32dfdf8b
JH
1119string_timesince(struct timeval * then)
1120{
1121struct timeval diff;
1122
1123timesince(&diff, then);
1124return string_timediff(&diff);
1125}
1126
5dac72a7
JH
1127/******************************************************************************/
1128
1129
1130
817d9f57 1131/* If msg is NULL this is a delivery log and logchar is used. Otherwise
67d81c10 1132this is a nonstandard call; no two-character delivery flag is written
817d9f57
JH
1133but sender-host and sender are prefixed and "msg" is inserted in the log line.
1134
1135Arguments:
1136 flags passed to log_write()
1137*/
e4bdf652 1138void
817d9f57 1139delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
e4bdf652 1140{
acec9514 1141gstring * g; /* Used for a temporary, expanding buffer, for building log lines */
f3ebb786 1142rmark reset_point;
e4bdf652 1143
e4bdf652
JH
1144/* Log the delivery on the main log. We use an extensible string to build up
1145the log line, and reset the store afterwards. Remote deliveries should always
1146have a pointer to the host item that succeeded; local deliveries can have a
1147pointer to a single host item in their host list, for use by the transport. */
1148
0cbf2b82 1149#ifndef DISABLE_EVENT
a7538db1 1150 /* presume no successful remote delivery */
783b385f 1151 lookup_dnssec_authenticated = NULL;
d68218c7
JH
1152#endif
1153
f3ebb786
JH
1154reset_point = store_mark();
1155g = string_get_tainted(256, TRUE); /* addrs will be tainted, so avoid copy */
e4bdf652 1156
817d9f57 1157if (msg)
acec9514 1158 g = string_append(g, 2, host_and_ident(TRUE), US" ");
817d9f57
JH
1159else
1160 {
acec9514
JH
1161 g->s[0] = logchar; g->ptr = 1;
1162 g = string_catn(g, US"> ", 2);
817d9f57 1163 }
acec9514 1164g = string_log_address(g, addr, LOGGING(all_parents), TRUE);
e4bdf652 1165
6c6d6e48 1166if (LOGGING(sender_on_delivery) || msg)
acec9514 1167 g = string_append(g, 3, US" F=<",
8c5d388a 1168#ifdef SUPPORT_I18N
3c8b3577
JH
1169 testflag(addr, af_utf8_downcvt)
1170 ? string_address_utf8_to_alabel(sender_address, NULL)
1171 :
1172#endif
1173 sender_address,
1174 US">");
e4bdf652 1175
afa6d3ad 1176if (*queue_name)
acec9514 1177 g = string_append(g, 2, US" Q=", queue_name);
afa6d3ad 1178
e4bdf652 1179#ifdef EXPERIMENTAL_SRS
d43cbe25 1180if(addr->prop.srs_sender)
acec9514 1181 g = string_append(g, 3, US" SRS=<", addr->prop.srs_sender, US">");
e4bdf652
JH
1182#endif
1183
1184/* You might think that the return path must always be set for a successful
1185delivery; indeed, I did for some time, until this statement crashed. The case
1186when it is not set is for a delivery to /dev/null which is optimised by not
1187being run at all. */
1188
d6c82d7b 1189if (used_return_path && LOGGING(return_path_on_delivery))
acec9514 1190 g = string_append(g, 3, US" P=<", used_return_path, US">");
e4bdf652 1191
817d9f57 1192if (msg)
acec9514 1193 g = string_append(g, 2, US" ", msg);
e4bdf652 1194
817d9f57 1195/* For a delivery from a system filter, there may not be a router */
d6c82d7b 1196if (addr->router)
acec9514 1197 g = string_append(g, 2, US" R=", addr->router->name);
e4bdf652 1198
acec9514 1199g = string_append(g, 2, US" T=", addr->transport->name);
e4bdf652 1200
6c6d6e48 1201if (LOGGING(delivery_size))
d12746bc 1202 g = string_fmt_append(g, " S=%d", transport_count);
e4bdf652
JH
1203
1204/* Local delivery */
1205
1206if (addr->transport->info->local)
1207 {
a7538db1 1208 if (addr->host_list)
acec9514
JH
1209 g = string_append(g, 2, US" H=", addr->host_list->name);
1210 g = d_log_interface(g);
d6c82d7b 1211 if (addr->shadow_message)
acec9514 1212 g = string_cat(g, addr->shadow_message);
e4bdf652
JH
1213 }
1214
1215/* Remote delivery */
1216
1217else
1218 {
783b385f 1219 if (addr->host_used)
e4bdf652 1220 {
acec9514 1221 g = d_hostlog(g, addr);
e4bdf652 1222 if (continue_sequence > 1)
acec9514 1223 g = string_catn(g, US"*", 1);
d68218c7 1224
0cbf2b82 1225#ifndef DISABLE_EVENT
a7538db1
JH
1226 deliver_host_address = addr->host_used->address;
1227 deliver_host_port = addr->host_used->port;
029f4192 1228 deliver_host = addr->host_used->name;
783b385f
JH
1229
1230 /* DNS lookup status */
1231 lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
1232 : addr->host_used->dnssec==DS_NO ? US"no"
1233 : NULL;
a7538db1 1234#endif
e4bdf652
JH
1235 }
1236
01603eec 1237#ifndef DISABLE_TLS
acec9514 1238 g = d_tlslog(g, addr);
a7538db1 1239#endif
e4bdf652 1240
018c60d7 1241 if (addr->authenticator)
6f123593 1242 {
acec9514 1243 g = string_append(g, 2, US" A=", addr->authenticator);
018c60d7 1244 if (addr->auth_id)
c8e2fc1e 1245 {
acec9514 1246 g = string_append(g, 2, US":", addr->auth_id);
6c6d6e48 1247 if (LOGGING(smtp_mailauth) && addr->auth_sndr)
acec9514 1248 g = string_append(g, 2, US":", addr->auth_sndr);
c8e2fc1e 1249 }
6f123593
JH
1250 }
1251
ee8b8090
JH
1252 if (LOGGING(pipelining))
1253 {
1254 if (testflag(addr, af_pipelining))
1255 g = string_catn(g, US" L", 2);
4e48d56c 1256#ifdef SUPPORT_PIPE_CONNECT
ee8b8090
JH
1257 if (testflag(addr, af_early_pipe))
1258 g = string_catn(g, US"*", 1);
1259#endif
1260 }
7c576fca 1261
a7538db1 1262#ifndef DISABLE_PRDR
7eb0e5d2 1263 if (testflag(addr, af_prdr_used))
acec9514 1264 g = string_catn(g, US" PRDR", 5);
a7538db1 1265#endif
e0cc6cda 1266
7eb0e5d2 1267 if (testflag(addr, af_chunking_used))
acec9514 1268 g = string_catn(g, US" K", 2);
76f44207
WB
1269 }
1270
1271/* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
fd98a5c6 1272
d6c82d7b
JH
1273if ( LOGGING(smtp_confirmation)
1274 && addr->message
1275 && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
1276 )
76f44207 1277 {
1c5b1499 1278 unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
76f44207
WB
1279 uschar *p = big_buffer;
1280 uschar *ss = addr->message;
1281 *p++ = '\"';
d7978c0f 1282 for (int i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
e4bdf652 1283 {
27520a68 1284 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
76f44207 1285 *p++ = ss[i];
e4bdf652 1286 }
76f44207
WB
1287 *p++ = '\"';
1288 *p = 0;
acec9514 1289 g = string_append(g, 2, US" C=", big_buffer);
e4bdf652
JH
1290 }
1291
1292/* Time on queue and actual time taken to deliver */
1293
6c6d6e48 1294if (LOGGING(queue_time))
acec9514 1295 g = string_append(g, 2, US" QT=",
32dfdf8b 1296 string_timesince(&received_time));
e4bdf652 1297
6c6d6e48 1298if (LOGGING(deliver_time))
32dfdf8b 1299 {
f2ed27cf 1300 struct timeval diff = {.tv_sec = addr->more_errno, .tv_usec = addr->delivery_usec};
acec9514 1301 g = string_append(g, 2, US" DT=", string_timediff(&diff));
32dfdf8b 1302 }
e4bdf652
JH
1303
1304/* string_cat() always leaves room for the terminator. Release the
1305store we used to build the line after writing it. */
1306
acec9514 1307log_write(0, flags, "%s", string_from_gstring(g));
d68218c7 1308
0cbf2b82 1309#ifndef DISABLE_EVENT
774ef2d7 1310if (!msg) msg_event_raise(US"msg:delivery", addr);
d68218c7 1311#endif
14a465c3 1312
e4bdf652
JH
1313store_reset(reset_point);
1314return;
1315}
1316
1317
1318
5dac72a7
JH
1319static void
1320deferral_log(address_item * addr, uschar * now,
1321 int logflags, uschar * driver_name, uschar * driver_kind)
1322{
f3ebb786
JH
1323rmark reset_point = store_mark();
1324gstring * g = string_get(256);
5dac72a7
JH
1325
1326/* Build up the line that is used for both the message log and the main
1327log. */
1328
5dac72a7
JH
1329/* Create the address string for logging. Must not do this earlier, because
1330an OK result may be changed to FAIL when a pipe returns text. */
1331
acec9514 1332g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
5dac72a7
JH
1333
1334if (*queue_name)
acec9514 1335 g = string_append(g, 2, US" Q=", queue_name);
5dac72a7
JH
1336
1337/* Either driver_name contains something and driver_kind contains
1338" router" or " transport" (note the leading space), or driver_name is
1339a null string and driver_kind contains "routing" without the leading
1340space, if all routing has been deferred. When a domain has been held,
1341so nothing has been done at all, both variables contain null strings. */
1342
1343if (driver_name)
1344 {
1345 if (driver_kind[1] == 't' && addr->router)
acec9514 1346 g = string_append(g, 2, US" R=", addr->router->name);
d12746bc 1347 g = string_fmt_append(g, " %c=%s", toupper(driver_kind[1]), driver_name);
5dac72a7
JH
1348 }
1349else if (driver_kind)
acec9514 1350 g = string_append(g, 2, US" ", driver_kind);
5dac72a7 1351
d12746bc 1352g = string_fmt_append(g, " defer (%d)", addr->basic_errno);
5dac72a7
JH
1353
1354if (addr->basic_errno > 0)
acec9514 1355 g = string_append(g, 2, US": ",
5dac72a7
JH
1356 US strerror(addr->basic_errno));
1357
1358if (addr->host_used)
1359 {
acec9514 1360 g = string_append(g, 5,
5dac72a7
JH
1361 US" H=", addr->host_used->name,
1362 US" [", addr->host_used->address, US"]");
1363 if (LOGGING(outgoing_port))
1364 {
1365 int port = addr->host_used->port;
d12746bc 1366 g = string_fmt_append(g, ":%d", port == PORT_NONE ? 25 : port);
5dac72a7
JH
1367 }
1368 }
1369
1370if (addr->message)
acec9514 1371 g = string_append(g, 2, US": ", addr->message);
5dac72a7 1372
acec9514 1373(void) string_from_gstring(g);
5dac72a7
JH
1374
1375/* Log the deferment in the message log, but don't clutter it
1376up with retry-time defers after the first delivery attempt. */
1377
8768d548 1378if (f.deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
acec9514 1379 deliver_msglog("%s %s\n", now, g->s);
5dac72a7
JH
1380
1381/* Write the main log and reset the store.
1382For errors of the type "retry time not reached" (also remotes skipped
1383on queue run), logging is controlled by L_retry_defer. Note that this kind
1384of error number is negative, and all the retry ones are less than any
1385others. */
1386
1387
1388log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
acec9514 1389 "== %s", g->s);
5dac72a7
JH
1390
1391store_reset(reset_point);
1392return;
1393}
1394
1395
1396
1397static void
1398failure_log(address_item * addr, uschar * driver_kind, uschar * now)
1399{
f3ebb786
JH
1400rmark reset_point = store_mark();
1401gstring * g = string_get(256);
5dac72a7 1402
ffbc20ed
MK
1403#ifndef DISABLE_EVENT
1404/* Message failures for which we will send a DSN get their event raised
1405later so avoid doing it here. */
1406
1407if ( !addr->prop.ignore_error
1408 && !(addr->dsn_flags & (rf_dsnflags & ~rf_notify_failure))
1409 )
1410 msg_event_raise(US"msg:fail:delivery", addr);
1411#endif
1412
5dac72a7
JH
1413/* Build up the log line for the message and main logs */
1414
5dac72a7
JH
1415/* Create the address string for logging. Must not do this earlier, because
1416an OK result may be changed to FAIL when a pipe returns text. */
1417
acec9514 1418g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
5dac72a7
JH
1419
1420if (LOGGING(sender_on_delivery))
acec9514 1421 g = string_append(g, 3, US" F=<", sender_address, US">");
5dac72a7
JH
1422
1423if (*queue_name)
acec9514 1424 g = string_append(g, 2, US" Q=", queue_name);
5dac72a7
JH
1425
1426/* Return path may not be set if no delivery actually happened */
1427
1428if (used_return_path && LOGGING(return_path_on_delivery))
acec9514 1429 g = string_append(g, 3, US" P=<", used_return_path, US">");
5dac72a7
JH
1430
1431if (addr->router)
acec9514 1432 g = string_append(g, 2, US" R=", addr->router->name);
5dac72a7 1433if (addr->transport)
acec9514 1434 g = string_append(g, 2, US" T=", addr->transport->name);
5dac72a7
JH
1435
1436if (addr->host_used)
acec9514 1437 g = d_hostlog(g, addr);
5dac72a7 1438
01603eec 1439#ifndef DISABLE_TLS
acec9514 1440g = d_tlslog(g, addr);
5dac72a7
JH
1441#endif
1442
1443if (addr->basic_errno > 0)
acec9514 1444 g = string_append(g, 2, US": ", US strerror(addr->basic_errno));
5dac72a7
JH
1445
1446if (addr->message)
acec9514 1447 g = string_append(g, 2, US": ", addr->message);
5dac72a7 1448
acec9514 1449(void) string_from_gstring(g);
5dac72a7
JH
1450
1451/* Do the logging. For the message log, "routing failed" for those cases,
1452just to make it clearer. */
1453
1454if (driver_kind)
acec9514 1455 deliver_msglog("%s %s failed for %s\n", now, driver_kind, g->s);
5dac72a7 1456else
acec9514 1457 deliver_msglog("%s %s\n", now, g->s);
5dac72a7 1458
acec9514 1459log_write(0, LOG_MAIN, "** %s", g->s);
5dac72a7 1460
5dac72a7
JH
1461store_reset(reset_point);
1462return;
1463}
1464
1465
1466
059ec3d9
PH
1467/*************************************************
1468* Actions at the end of handling an address *
1469*************************************************/
1470
1471/* This is a function for processing a single address when all that can be done
1472with it has been done.
1473
1474Arguments:
1475 addr points to the address block
1476 result the result of the delivery attempt
1477 logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
1478 driver_type indicates which type of driver (transport, or router) was last
1479 to process the address
1480 logchar '=' or '-' for use when logging deliveries with => or ->
1481
1482Returns: nothing
1483*/
1484
1485static void
1486post_process_one(address_item *addr, int result, int logflags, int driver_type,
1487 int logchar)
1488{
1489uschar *now = tod_stamp(tod_log);
1490uschar *driver_kind = NULL;
1491uschar *driver_name = NULL;
059ec3d9 1492
059ec3d9
PH
1493DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
1494
1495/* Set up driver kind and name for logging. Disable logging if the router or
1496transport has disabled it. */
1497
ba936fb8 1498if (driver_type == EXIM_DTYPE_TRANSPORT)
059ec3d9 1499 {
d6c82d7b 1500 if (addr->transport)
059ec3d9
PH
1501 {
1502 driver_name = addr->transport->name;
1503 driver_kind = US" transport";
8768d548 1504 f.disable_logging = addr->transport->disable_logging;
059ec3d9
PH
1505 }
1506 else driver_kind = US"transporting";
1507 }
ba936fb8 1508else if (driver_type == EXIM_DTYPE_ROUTER)
059ec3d9 1509 {
d6c82d7b 1510 if (addr->router)
059ec3d9
PH
1511 {
1512 driver_name = addr->router->name;
1513 driver_kind = US" router";
8768d548 1514 f.disable_logging = addr->router->disable_logging;
059ec3d9
PH
1515 }
1516 else driver_kind = US"routing";
1517 }
1518
1519/* If there's an error message set, ensure that it contains only printing
1520characters - it should, but occasionally things slip in and this at least
49c2d5ea
PH
1521stops the log format from getting wrecked. We also scan the message for an LDAP
1522expansion item that has a password setting, and flatten the password. This is a
1523fudge, but I don't know a cleaner way of doing this. (If the item is badly
1524malformed, it won't ever have gone near LDAP.) */
059ec3d9 1525
d6c82d7b 1526if (addr->message)
49c2d5ea 1527 {
55414b25 1528 const uschar * s = string_printing(addr->message);
f42deca9
JH
1529
1530 /* deconst cast ok as string_printing known to have alloc'n'copied */
1531 addr->message = expand_hide_passwords(US s);
49c2d5ea 1532 }
059ec3d9
PH
1533
1534/* If we used a transport that has one of the "return_output" options set, and
1535if it did in fact generate some output, then for return_output we treat the
1536message as failed if it was not already set that way, so that the output gets
1537returned to the sender, provided there is a sender to send it to. For
1538return_fail_output, do this only if the delivery failed. Otherwise we just
1539unlink the file, and remove the name so that if the delivery failed, we don't
1540try to send back an empty or unwanted file. The log_output options operate only
1541on a non-empty file.
1542
1543In any case, we close the message file, because we cannot afford to leave a
1544file-descriptor for one address while processing (maybe very many) others. */
1545
d6c82d7b 1546if (addr->return_file >= 0 && addr->return_filename)
059ec3d9
PH
1547 {
1548 BOOL return_output = FALSE;
1549 struct stat statbuf;
54fc8428 1550 (void)EXIMfsync(addr->return_file);
059ec3d9
PH
1551
1552 /* If there is no output, do nothing. */
1553
1554 if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
1555 {
1556 transport_instance *tb = addr->transport;
1557
1558 /* Handle logging options */
1559
d6c82d7b
JH
1560 if ( tb->log_output
1561 || result == FAIL && tb->log_fail_output
1562 || result == DEFER && tb->log_defer_output
1563 )
059ec3d9
PH
1564 {
1565 uschar *s;
1566 FILE *f = Ufopen(addr->return_filename, "rb");
d6c82d7b 1567 if (!f)
059ec3d9
PH
1568 log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
1569 "from %s transport: %s", addr->return_filename, tb->name,
1570 strerror(errno));
1571 else
d6c82d7b 1572 if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
059ec3d9
PH
1573 {
1574 uschar *p = big_buffer + Ustrlen(big_buffer);
55414b25 1575 const uschar * sp;
059ec3d9
PH
1576 while (p > big_buffer && isspace(p[-1])) p--;
1577 *p = 0;
55414b25 1578 sp = string_printing(big_buffer);
059ec3d9 1579 log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
55414b25 1580 addr->address, tb->name, sp);
059ec3d9 1581 }
0e8aed8a 1582 (void)fclose(f);
059ec3d9
PH
1583 }
1584
1585 /* Handle returning options, but only if there is an address to return
1586 the text to. */
1587
d6c82d7b 1588 if (sender_address[0] != 0 || addr->prop.errors_address)
059ec3d9
PH
1589 if (tb->return_output)
1590 {
1591 addr->transport_return = result = FAIL;
d6c82d7b 1592 if (addr->basic_errno == 0 && !addr->message)
059ec3d9
PH
1593 addr->message = US"return message generated";
1594 return_output = TRUE;
1595 }
1596 else
1597 if (tb->return_fail_output && result == FAIL) return_output = TRUE;
059ec3d9
PH
1598 }
1599
1600 /* Get rid of the file unless it might be returned, but close it in
1601 all cases. */
1602
1603 if (!return_output)
1604 {
1605 Uunlink(addr->return_filename);
1606 addr->return_filename = NULL;
1607 addr->return_file = -1;
1608 }
1609
f1e894f3 1610 (void)close(addr->return_file);
059ec3d9
PH
1611 }
1612
9d1c15ef 1613/* The success case happens only after delivery by a transport. */
059ec3d9
PH
1614
1615if (result == OK)
1616 {
1617 addr->next = addr_succeed;
1618 addr_succeed = addr;
1619
1620 /* Call address_done() to ensure that we don't deliver to this address again,
1621 and write appropriate things to the message log. If it is a child address, we
1622 call child_done() to scan the ancestors and mark them complete if this is the
1623 last child to complete. */
1624
1625 address_done(addr, now);
1626 DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
1627
d6c82d7b 1628 if (!addr->parent)
059ec3d9
PH
1629 deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
1630 driver_name, driver_kind);
059ec3d9
PH
1631 else
1632 {
1633 deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
1634 addr->parent->address, driver_name, driver_kind);
1635 child_done(addr, now);
1636 }
1637
774ef2d7 1638 /* Certificates for logging (via events) */
01603eec 1639#ifndef DISABLE_TLS
9d1c15ef
JH
1640 tls_out.ourcert = addr->ourcert;
1641 addr->ourcert = NULL;
1642 tls_out.peercert = addr->peercert;
1643 addr->peercert = NULL;
018058b2 1644
018058b2
JH
1645 tls_out.cipher = addr->cipher;
1646 tls_out.peerdn = addr->peerdn;
1647 tls_out.ocsp = addr->ocsp;
c0635b6d 1648# ifdef SUPPORT_DANE
83b27293
JH
1649 tls_out.dane_verified = testflag(addr, af_dane_verified);
1650# endif
a7538db1 1651#endif
9d1c15ef 1652
817d9f57 1653 delivery_log(LOG_MAIN, addr, logchar, NULL);
9d1c15ef 1654
01603eec 1655#ifndef DISABLE_TLS
790fbb71
JH
1656 tls_free_cert(&tls_out.ourcert);
1657 tls_free_cert(&tls_out.peercert);
018058b2
JH
1658 tls_out.cipher = NULL;
1659 tls_out.peerdn = NULL;
1660 tls_out.ocsp = OCSP_NOT_REQ;
c0635b6d 1661# ifdef SUPPORT_DANE
83b27293
JH
1662 tls_out.dane_verified = FALSE;
1663# endif
a7538db1 1664#endif
059ec3d9
PH
1665 }
1666
1667
1668/* Soft failure, or local delivery process failed; freezing may be
1669requested. */
1670
1671else if (result == DEFER || result == PANIC)
1672 {
1673 if (result == PANIC) logflags |= LOG_PANIC;
1674
1675 /* This puts them on the chain in reverse order. Do not change this, because
1676 the code for handling retries assumes that the one with the retry
1677 information is last. */
1678
1679 addr->next = addr_defer;
1680 addr_defer = addr;
1681
1682 /* The only currently implemented special action is to freeze the
1683 message. Logging of this is done later, just before the -H file is
1684 updated. */
1685
1686 if (addr->special_action == SPECIAL_FREEZE)
1687 {
8768d548 1688 f.deliver_freeze = TRUE;
059ec3d9
PH
1689 deliver_frozen_at = time(NULL);
1690 update_spool = TRUE;
1691 }
1692
1693 /* If doing a 2-stage queue run, we skip writing to either the message
1694 log or the main log for SMTP defers. */
1695
8768d548 1696 if (!f.queue_2stage || addr->basic_errno != 0)
5dac72a7 1697 deferral_log(addr, now, logflags, driver_name, driver_kind);
059ec3d9
PH
1698 }
1699
1700
1701/* Hard failure. If there is an address to which an error message can be sent,
1702put this address on the failed list. If not, put it on the deferred list and
1703freeze the mail message for human attention. The latter action can also be
1704explicitly requested by a router or transport. */
1705
1706else
1707 {
1708 /* If this is a delivery error, or a message for which no replies are
1709 wanted, and the message's age is greater than ignore_bounce_errors_after,
1710 force the af_ignore_error flag. This will cause the address to be discarded
1711 later (with a log entry). */
1712
10c50704 1713 if (!*sender_address && message_age >= ignore_bounce_errors_after)
7eb0e5d2 1714 addr->prop.ignore_error = TRUE;
059ec3d9
PH
1715
1716 /* Freeze the message if requested, or if this is a bounce message (or other
652e1b65
PH
1717 message with null sender) and this address does not have its own errors
1718 address. However, don't freeze if errors are being ignored. The actual code
1719 to ignore occurs later, instead of sending a message. Logging of freezing
1720 occurs later, just before writing the -H file. */
059ec3d9 1721
7eb0e5d2 1722 if ( !addr->prop.ignore_error
d6c82d7b
JH
1723 && ( addr->special_action == SPECIAL_FREEZE
1724 || (sender_address[0] == 0 && !addr->prop.errors_address)
1725 ) )
059ec3d9 1726 {
d6c82d7b
JH
1727 frozen_info = addr->special_action == SPECIAL_FREEZE
1728 ? US""
8768d548 1729 : f.sender_local && !f.local_error_message
d6c82d7b
JH
1730 ? US" (message created with -f <>)"
1731 : US" (delivery error message)";
8768d548 1732 f.deliver_freeze = TRUE;
059ec3d9
PH
1733 deliver_frozen_at = time(NULL);
1734 update_spool = TRUE;
1735
1736 /* The address is put on the defer rather than the failed queue, because
1737 the message is being retained. */
1738
1739 addr->next = addr_defer;
1740 addr_defer = addr;
1741 }
1742
1743 /* Don't put the address on the nonrecipients tree yet; wait until an
1744 error message has been successfully sent. */
1745
1746 else
1747 {
1748 addr->next = addr_failed;
1749 addr_failed = addr;
1750 }
1751
5dac72a7 1752 failure_log(addr, driver_name ? NULL : driver_kind, now);
059ec3d9
PH
1753 }
1754
1755/* Ensure logging is turned on again in all cases */
1756
8768d548 1757f.disable_logging = FALSE;
059ec3d9
PH
1758}
1759
1760
1761
1762
1763/*************************************************
1764* Address-independent error *
1765*************************************************/
1766
1767/* This function is called when there's an error that is not dependent on a
1768particular address, such as an expansion string failure. It puts the error into
1769all the addresses in a batch, logs the incident on the main and panic logs, and
1770clears the expansions. It is mostly called from local_deliver(), but can be
1771called for a remote delivery via findugid().
1772
1773Arguments:
1774 logit TRUE if (MAIN+PANIC) logging required
1775 addr the first of the chain of addresses
1776 code the error code
1777 format format string for error message, or NULL if already set in addr
1778 ... arguments for the format
1779
1780Returns: nothing
1781*/
1782
1783static void
1784common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
1785{
059ec3d9
PH
1786addr->basic_errno = code;
1787
d6c82d7b 1788if (format)
059ec3d9
PH
1789 {
1790 va_list ap;
d12746bc
JH
1791 gstring * g;
1792
059ec3d9 1793 va_start(ap, format);
f3ebb786 1794 g = string_vformat(NULL, SVFMT_EXTEND|SVFMT_REBUFFER, CS format, ap);
059ec3d9 1795 va_end(ap);
d12746bc 1796 addr->message = string_from_gstring(g);
059ec3d9
PH
1797 }
1798
d7978c0f 1799for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9
PH
1800 {
1801 addr2->basic_errno = code;
1802 addr2->message = addr->message;
1803 }
1804
1805if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
1806deliver_set_expansions(NULL);
1807}
1808
1809
1810
1811
1812/*************************************************
1813* Check a "never users" list *
1814*************************************************/
1815
1816/* This function is called to check whether a uid is on one of the two "never
1817users" lists.
1818
1819Arguments:
1820 uid the uid to be checked
1821 nusers the list to be scanned; the first item in the list is the count
1822
1823Returns: TRUE if the uid is on the list
1824*/
1825
1826static BOOL
1827check_never_users(uid_t uid, uid_t *nusers)
1828{
d6c82d7b 1829if (!nusers) return FALSE;
d7978c0f 1830for (int i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
059ec3d9
PH
1831return FALSE;
1832}
1833
1834
1835
1836/*************************************************
1837* Find uid and gid for a transport *
1838*************************************************/
1839
1840/* This function is called for both local and remote deliveries, to find the
1841uid/gid under which to run the delivery. The values are taken preferentially
1842from the transport (either explicit or deliver_as_creator), then from the
1843address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
1844the resulting uid is on the "never_users" or the "fixed_never_users" list, a
1845panic error is logged, and the function fails (which normally leads to delivery
1846deferral).
1847
1848Arguments:
1849 addr the address (possibly a chain)
1850 tp the transport
1851 uidp pointer to uid field
1852 gidp pointer to gid field
1853 igfp pointer to the use_initgroups field
1854
1855Returns: FALSE if failed - error has been set in address(es)
1856*/
1857
1858static BOOL
1859findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
1860 BOOL *igfp)
1861{
d6c82d7b 1862uschar *nuname;
059ec3d9
PH
1863BOOL gid_set = FALSE;
1864
1865/* Default initgroups flag comes from the transport */
1866
1867*igfp = tp->initgroups;
1868
1869/* First see if there's a gid on the transport, either fixed or expandable.
1870The expanding function always logs failure itself. */
1871
1872if (tp->gid_set)
1873 {
1874 *gidp = tp->gid;
1875 gid_set = TRUE;
1876 }
d6c82d7b 1877else if (tp->expand_gid)
059ec3d9 1878 {
d6c82d7b
JH
1879 if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
1880 &(addr->message)))
059ec3d9
PH
1881 {
1882 common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
1883 return FALSE;
1884 }
d6c82d7b 1885 gid_set = TRUE;
059ec3d9
PH
1886 }
1887
911f6fde
PH
1888/* If the transport did not set a group, see if the router did. */
1889
1890if (!gid_set && testflag(addr, af_gid_set))
1891 {
1892 *gidp = addr->gid;
1893 gid_set = TRUE;
1894 }
1895
059ec3d9
PH
1896/* Pick up a uid from the transport if one is set. */
1897
1898if (tp->uid_set) *uidp = tp->uid;
1899
1900/* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
1901it does not provide a passwd value from which a gid can be taken. */
1902
d6c82d7b 1903else if (tp->expand_uid)
059ec3d9
PH
1904 {
1905 struct passwd *pw;
1906 if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
1907 uidp, &(addr->message)))
1908 {
1909 common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
1910 return FALSE;
1911 }
d6c82d7b 1912 if (!gid_set && pw)
059ec3d9
PH
1913 {
1914 *gidp = pw->pw_gid;
1915 gid_set = TRUE;
1916 }
1917 }
1918
1919/* If the transport doesn't set the uid, test the deliver_as_creator flag. */
1920
1921else if (tp->deliver_as_creator)
1922 {
1923 *uidp = originator_uid;
1924 if (!gid_set)
1925 {
1926 *gidp = originator_gid;
1927 gid_set = TRUE;
1928 }
1929 }
1930
911f6fde
PH
1931/* Otherwise see if the address specifies the uid and if so, take it and its
1932initgroups flag. */
059ec3d9
PH
1933
1934else if (testflag(addr, af_uid_set))
1935 {
1936 *uidp = addr->uid;
1937 *igfp = testflag(addr, af_initgroups);
059ec3d9
PH
1938 }
1939
1940/* Nothing has specified the uid - default to the Exim user, and group if the
1941gid is not set. */
1942
1943else
1944 {
1945 *uidp = exim_uid;
1946 if (!gid_set)
1947 {
1948 *gidp = exim_gid;
1949 gid_set = TRUE;
1950 }
1951 }
1952
911f6fde
PH
1953/* If no gid is set, it is a disaster. We default to the Exim gid only if
1954defaulting to the Exim uid. In other words, if the configuration has specified
1955a uid, it must also provide a gid. */
059ec3d9
PH
1956
1957if (!gid_set)
1958 {
1959 common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
1960 "%s transport", tp->name);
1961 return FALSE;
1962 }
1963
1964/* Check that the uid is not on the lists of banned uids that may not be used
1965for delivery processes. */
1966
d6c82d7b
JH
1967nuname = check_never_users(*uidp, never_users)
1968 ? US"never_users"
1969 : check_never_users(*uidp, fixed_never_users)
1970 ? US"fixed_never_users"
1971 : NULL;
1972if (nuname)
059ec3d9
PH
1973 {
1974 common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
1975 "is on the %s list", (long int)(*uidp), tp->name, nuname);
1976 return FALSE;
1977 }
1978
1979/* All is well */
1980
1981return TRUE;
1982}
1983
1984
1985
1986
1987/*************************************************
1988* Check the size of a message for a transport *
1989*************************************************/
1990
1991/* Checks that the message isn't too big for the selected transport.
1992This is called only when it is known that the limit is set.
1993
1994Arguments:
1995 tp the transport
1996 addr the (first) address being delivered
1997
1998Returns: OK
1999 DEFER expansion failed or did not yield an integer
2000 FAIL message too big
2001*/
2002
2003int
2004check_message_size(transport_instance *tp, address_item *addr)
2005{
2006int rc = OK;
2007int size_limit;
2008
2009deliver_set_expansions(addr);
d45b1de8 2010size_limit = expand_string_integer(tp->message_size_limit, TRUE);
059ec3d9
PH
2011deliver_set_expansions(NULL);
2012
d6c82d7b 2013if (expand_string_message)
059ec3d9
PH
2014 {
2015 rc = DEFER;
d6c82d7b
JH
2016 addr->message = size_limit == -1
2017 ? string_sprintf("failed to expand message_size_limit "
2018 "in %s transport: %s", tp->name, expand_string_message)
2019 : string_sprintf("invalid message_size_limit "
059ec3d9
PH
2020 "in %s transport: %s", tp->name, expand_string_message);
2021 }
2022else if (size_limit > 0 && message_size > size_limit)
2023 {
2024 rc = FAIL;
2025 addr->message =
2026 string_sprintf("message is too big (transport limit = %d)",
2027 size_limit);
2028 }
2029
2030return rc;
2031}
2032
2033
2034
2035/*************************************************
2036* Transport-time check for a previous delivery *
2037*************************************************/
2038
2039/* Check that this base address hasn't previously been delivered to its routed
c2c19e9d
PH
2040transport. If it has been delivered, mark it done. The check is necessary at
2041delivery time in order to handle homonymic addresses correctly in cases where
2042the pattern of redirection changes between delivery attempts (so the unique
2043fields change). Non-homonymic previous delivery is detected earlier, at routing
2044time (which saves unnecessary routing).
2045
2046Arguments:
2047 addr the address item
2048 testing TRUE if testing wanted only, without side effects
059ec3d9 2049
059ec3d9
PH
2050Returns: TRUE if previously delivered by the transport
2051*/
2052
2053static BOOL
c2c19e9d 2054previously_transported(address_item *addr, BOOL testing)
059ec3d9 2055{
f3ebb786 2056uschar * s = string_sprintf("%s/%s",
059ec3d9
PH
2057 addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
2058
f3ebb786 2059if (tree_search(tree_nonrecipients, s) != 0)
059ec3d9
PH
2060 {
2061 DEBUG(D_deliver|D_route|D_transport)
2062 debug_printf("%s was previously delivered (%s transport): discarded\n",
2063 addr->address, addr->transport->name);
c2c19e9d 2064 if (!testing) child_done(addr, tod_stamp(tod_log));
059ec3d9
PH
2065 return TRUE;
2066 }
2067
2068return FALSE;
2069}
2070
2071
2072
064a94c9
PH
2073/******************************************************
2074* Check for a given header in a header string *
2075******************************************************/
2076
2077/* This function is used when generating quota warnings. The configuration may
2078specify any header lines it likes in quota_warn_message. If certain of them are
2079missing, defaults are inserted, so we need to be able to test for the presence
2080of a given header.
2081
2082Arguments:
2083 hdr the required header name
2084 hstring the header string
2085
2086Returns: TRUE the header is in the string
2087 FALSE the header is not in the string
2088*/
2089
2090static BOOL
2091contains_header(uschar *hdr, uschar *hstring)
2092{
2093int len = Ustrlen(hdr);
2094uschar *p = hstring;
2095while (*p != 0)
2096 {
2097 if (strncmpic(p, hdr, len) == 0)
2098 {
2099 p += len;
2100 while (*p == ' ' || *p == '\t') p++;
2101 if (*p == ':') return TRUE;
2102 }
2103 while (*p != 0 && *p != '\n') p++;
2104 if (*p == '\n') p++;
2105 }
2106return FALSE;
2107}
2108
2109
2110
059ec3d9
PH
2111
2112/*************************************************
2113* Perform a local delivery *
2114*************************************************/
2115
2116/* Each local delivery is performed in a separate process which sets its
2117uid and gid as specified. This is a safer way than simply changing and
2118restoring using seteuid(); there is a body of opinion that seteuid() cannot be
2119used safely. From release 4, Exim no longer makes any use of it. Besides, not
2120all systems have seteuid().
2121
2122If the uid/gid are specified in the transport_instance, they are used; the
2123transport initialization must ensure that either both or neither are set.
2124Otherwise, the values associated with the address are used. If neither are set,
2125it is a configuration error.
2126
2127The transport or the address may specify a home directory (transport over-
2128rides), and if they do, this is set as $home. If neither have set a working
2129directory, this value is used for that as well. Otherwise $home is left unset
2130and the cwd is set to "/" - a directory that should be accessible to all users.
2131
2132Using a separate process makes it more complicated to get error information
2133back. We use a pipe to pass the return code and also an error code and error
2134text string back to the parent process.
2135
2136Arguments:
2137 addr points to an address block for this delivery; for "normal" local
2138 deliveries this is the only address to be delivered, but for
2139 pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
2140 a number of addresses can be handled simultaneously, and in this
2141 case addr will point to a chain of addresses with the same
2142 characteristics.
2143
2144 shadowing TRUE if running a shadow transport; this causes output from pipes
2145 to be ignored.
2146
2147Returns: nothing
2148*/
2149
2150static void
2151deliver_local(address_item *addr, BOOL shadowing)
2152{
2153BOOL use_initgroups;
2154uid_t uid;
2155gid_t gid;
2156int status, len, rc;
2157int pfd[2];
2158pid_t pid;
2159uschar *working_directory;
2160address_item *addr2;
2161transport_instance *tp = addr->transport;
2162
2163/* Set up the return path from the errors or sender address. If the transport
2164has its own return path setting, expand it and replace the existing value. */
2165
d6c82d7b 2166if(addr->prop.errors_address)
d43cbe25 2167 return_path = addr->prop.errors_address;
384152a6 2168#ifdef EXPERIMENTAL_SRS
d6c82d7b 2169else if (addr->prop.srs_sender)
d43cbe25 2170 return_path = addr->prop.srs_sender;
384152a6
TK
2171#endif
2172else
2173 return_path = sender_address;
059ec3d9 2174
d6c82d7b 2175if (tp->return_path)
059ec3d9
PH
2176 {
2177 uschar *new_return_path = expand_string(tp->return_path);
d6c82d7b 2178 if (!new_return_path)
059ec3d9 2179 {
8768d548 2180 if (!f.expand_string_forcedfail)
059ec3d9
PH
2181 {
2182 common_error(TRUE, addr, ERRNO_EXPANDFAIL,
2183 US"Failed to expand return path \"%s\" in %s transport: %s",
2184 tp->return_path, tp->name, expand_string_message);
2185 return;
2186 }
2187 }
2188 else return_path = new_return_path;
2189 }
2190
2191/* For local deliveries, one at a time, the value used for logging can just be
2192set directly, once and for all. */
2193
2194used_return_path = return_path;
2195
2196/* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
2197gets put into the address(es), and the expansions are unset, so we can just
2198return. */
2199
2200if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
2201
5418e93b
PH
2202/* See if either the transport or the address specifies a home directory. A
2203home directory set in the address may already be expanded; a flag is set to
2204indicate that. In other cases we must expand it. */
059ec3d9 2205
d6c82d7b
JH
2206if ( (deliver_home = tp->home_dir) /* Set in transport, or */
2207 || ( (deliver_home = addr->home_dir) /* Set in address and */
2208 && !testflag(addr, af_home_expanded) /* not expanded */
2209 ) )
059ec3d9
PH
2210 {
2211 uschar *rawhome = deliver_home;
2212 deliver_home = NULL; /* in case it contains $home */
d6c82d7b 2213 if (!(deliver_home = expand_string(rawhome)))
059ec3d9
PH
2214 {
2215 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
2216 "to expand for %s transport: %s", rawhome, tp->name,
2217 expand_string_message);
2218 return;
2219 }
2220 if (*deliver_home != '/')
2221 {
2222 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
2223 "is not absolute for %s transport", deliver_home, tp->name);
2224 return;
2225 }
2226 }
2227
5418e93b
PH
2228/* See if either the transport or the address specifies a current directory,
2229and if so, expand it. If nothing is set, use the home directory, unless it is
2230also unset in which case use "/", which is assumed to be a directory to which
2231all users have access. It is necessary to be in a visible directory for some
2232operating systems when running pipes, as some commands (e.g. "rm" under Solaris
22332.5) require this. */
2234
d6c82d7b
JH
2235working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
2236if (working_directory)
059ec3d9
PH
2237 {
2238 uschar *raw = working_directory;
d6c82d7b 2239 if (!(working_directory = expand_string(raw)))
059ec3d9
PH
2240 {
2241 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
2242 "failed to expand for %s transport: %s", raw, tp->name,
2243 expand_string_message);
2244 return;
2245 }
2246 if (*working_directory != '/')
2247 {
2248 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
2249 "\"%s\" is not absolute for %s transport", working_directory, tp->name);
2250 return;
2251 }
2252 }
d6c82d7b 2253else working_directory = deliver_home ? deliver_home : US"/";
059ec3d9
PH
2254
2255/* If one of the return_output flags is set on the transport, create and open a
2256file in the message log directory for the transport to write its output onto.
2257This is mainly used by pipe transports. The file needs to be unique to the
2258address. This feature is not available for shadow transports. */
2259
d6c82d7b
JH
2260if ( !shadowing
2261 && ( tp->return_output || tp->return_fail_output
ec0eb1a3 2262 || tp->log_output || tp->log_fail_output || tp->log_defer_output
d6c82d7b 2263 ) )
059ec3d9 2264 {
41313d92
JH
2265 uschar * error;
2266
059ec3d9 2267 addr->return_filename =
41313d92
JH
2268 spool_fname(US"msglog", message_subdir, message_id,
2269 string_sprintf("-%d-%d", getpid(), return_count++));
4c0a7a9c 2270
41313d92 2271 if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
059ec3d9
PH
2272 {
2273 common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
2274 "to return message: %s", error, tp->name, strerror(errno));
2275 return;
2276 }
2277 }
2278
2279/* Create the pipe for inter-process communication. */
2280
2281if (pipe(pfd) != 0)
2282 {
2283 common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
2284 strerror(errno));
2285 return;
2286 }
2287
2288/* Now fork the process to do the real work in the subprocess, but first
2289ensure that all cached resources are freed so that the subprocess starts with
2290a clean slate and doesn't interfere with the parent process. */
2291
2292search_tidyup();
2293
2294if ((pid = fork()) == 0)
2295 {
2296 BOOL replicate = TRUE;
2297
2298 /* Prevent core dumps, as we don't want them in users' home directories.
2299 HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
2300 system. Some experimental/developing systems (e.g. GNU/Hurd) may define
2301 RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
a29e5231
PP
2302 complain if the error is "not supported".
2303
2304 There are two scenarios where changing the max limit has an effect. In one,
2305 the user is using a .forward and invoking a command of their choice via pipe;
2306 for these, we do need the max limit to be 0 unless the admin chooses to
2307 permit an increased limit. In the other, the command is invoked directly by
2308 the transport and is under administrator control, thus being able to raise
2309 the limit aids in debugging. So there's no general always-right answer.
2310
2311 Thus we inhibit core-dumps completely but let individual transports, while
2312 still root, re-raise the limits back up to aid debugging. We make the
2313 default be no core-dumps -- few enough people can use core dumps in
2314 diagnosis that it's reasonable to make them something that has to be explicitly requested.
2315 */
059ec3d9 2316
a7538db1 2317#ifdef RLIMIT_CORE
059ec3d9
PH
2318 struct rlimit rl;
2319 rl.rlim_cur = 0;
2320 rl.rlim_max = 0;
2321 if (setrlimit(RLIMIT_CORE, &rl) < 0)
2322 {
a7538db1 2323# ifdef SETRLIMIT_NOT_SUPPORTED
059ec3d9 2324 if (errno != ENOSYS && errno != ENOTSUP)
a7538db1 2325# endif
059ec3d9
PH
2326 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
2327 strerror(errno));
2328 }
a7538db1 2329#endif
059ec3d9
PH
2330
2331 /* Reset the random number generator, so different processes don't all
2332 have the same sequence. */
2333
2334 random_seed = 0;
2335
2336 /* If the transport has a setup entry, call this first, while still
2337 privileged. (Appendfile uses this to expand quota, for example, while
2338 able to read private files.) */
2339
d6c82d7b 2340 if (addr->transport->setup)
929ba01c 2341 switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
059ec3d9
PH
2342 &(addr->message)))
2343 {
2344 case DEFER:
d6c82d7b
JH
2345 addr->transport_return = DEFER;
2346 goto PASS_BACK;
059ec3d9
PH
2347
2348 case FAIL:
d6c82d7b
JH
2349 addr->transport_return = PANIC;
2350 goto PASS_BACK;
059ec3d9 2351 }
059ec3d9
PH
2352
2353 /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
2354 when the process becomes unprivileged, it won't be able to write to the
2355 process log. SIGHUP is ignored throughout exim, except when it is being
2356 run as a daemon. */
2357
2358 signal(SIGINT, SIG_IGN);
2359 signal(SIGTERM, SIG_IGN);
2360 signal(SIGUSR1, SIG_IGN);
2361
2362 /* Close the unwanted half of the pipe, and set close-on-exec for the other
2363 half - for transports that exec things (e.g. pipe). Then set the required
2364 gid/uid. */
2365
f1e894f3 2366 (void)close(pfd[pipe_read]);
ff790e47 2367 (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
059ec3d9
PH
2368 FD_CLOEXEC);
2369 exim_setugid(uid, gid, use_initgroups,
2370 string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
2371 addr->address, addr->transport->name));
2372
2373 DEBUG(D_deliver)
2374 {
059ec3d9 2375 debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
d7978c0f 2376 for (address_item * batched = addr->next; batched; batched = batched->next)
059ec3d9
PH
2377 debug_printf("additional batched address: %s\n", batched->address);
2378 }
2379
2380 /* Set an appropriate working directory. */
2381
2382 if (Uchdir(working_directory) < 0)
2383 {
2384 addr->transport_return = DEFER;
2385 addr->basic_errno = errno;
2386 addr->message = string_sprintf("failed to chdir to %s", working_directory);
2387 }
2388
2389 /* If successful, call the transport */
2390
2391 else
2392 {
2393 BOOL ok = TRUE;
2394 set_process_info("delivering %s to %s using %s", message_id,
2395 addr->local_part, addr->transport->name);
2396
2a47f028
JH
2397 /* Setting this global in the subprocess means we need never clear it */
2398 transport_name = addr->transport->name;
2399
059ec3d9
PH
2400 /* If a transport filter has been specified, set up its argument list.
2401 Any errors will get put into the address, and FALSE yielded. */
2402
d6c82d7b 2403 if (addr->transport->filter_command)
059ec3d9
PH
2404 {
2405 ok = transport_set_up_command(&transport_filter_argv,
2406 addr->transport->filter_command,
2407 TRUE, PANIC, addr, US"transport filter", NULL);
2408 transport_filter_timeout = addr->transport->filter_timeout;
2409 }
2410 else transport_filter_argv = NULL;
2411
2412 if (ok)
2413 {
2414 debug_print_string(addr->transport->debug_string);
2415 replicate = !(addr->transport->info->code)(addr->transport, addr);
2416 }
2417 }
2418
2419 /* Pass the results back down the pipe. If necessary, first replicate the
2420 status in the top address to the others in the batch. The label is the
2421 subject of a goto when a call to the transport's setup function fails. We
2422 pass the pointer to the transport back in case it got changed as a result of
2423 file_format in appendfile. */
2424
2425 PASS_BACK:
2426
2427 if (replicate) replicate_status(addr);
d6c82d7b 2428 for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9
PH
2429 {
2430 int i;
2431 int local_part_length = Ustrlen(addr2->local_part);
2432 uschar *s;
1ac6b2e7 2433 int ret;
059ec3d9 2434
d6c82d7b
JH
2435 if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
2436 || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
2437 || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
2438 || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
2439 || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
32dfdf8b 2440 || (ret = write(pfd[pipe_write], &addr2->delivery_usec, sizeof(int))) != sizeof(int)
d6c82d7b
JH
2441 || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
2442 || (ret = write(pfd[pipe_write], &addr2->transport,
1ac6b2e7 2443 sizeof(transport_instance *))) != sizeof(transport_instance *)
059ec3d9
PH
2444
2445 /* For a file delivery, pass back the local part, in case the original
2446 was only part of the final delivery path. This gives more complete
2447 logging. */
2448
1ac6b2e7 2449 || (testflag(addr2, af_file)
d6c82d7b 2450 && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
1ac6b2e7
JH
2451 || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
2452 )
2453 )
2454 )
a23ff3b4 2455 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
1ac6b2e7 2456 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2457
2458 /* Now any messages */
2459
2460 for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
2461 {
d6c82d7b
JH
2462 int message_length = s ? Ustrlen(s) + 1 : 0;
2463 if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
2464 || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
1ac6b2e7 2465 )
a23ff3b4 2466 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
1ac6b2e7 2467 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2468 }
2469 }
2470
2471 /* OK, this process is now done. Free any cached resources that it opened,
2472 and close the pipe we were writing down before exiting. */
2473
f1e894f3 2474 (void)close(pfd[pipe_write]);
059ec3d9
PH
2475 search_tidyup();
2476 exit(EXIT_SUCCESS);
2477 }
2478
2479/* Back in the main process: panic if the fork did not succeed. This seems
2480better than returning an error - if forking is failing it is probably best
2481not to try other deliveries for this message. */
2482
2483if (pid < 0)
2484 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
2485 addr->address);
2486
2487/* Read the pipe to get the delivery status codes and error messages. Our copy
2488of the writing end must be closed first, as otherwise read() won't return zero
2489on an empty pipe. We check that a status exists for each address before
2490overwriting the address structure. If data is missing, the default DEFER status
2491will remain. Afterwards, close the reading end. */
2492
f1e894f3 2493(void)close(pfd[pipe_write]);
059ec3d9 2494
d6c82d7b 2495for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9 2496 {
d88f0784 2497 if ((len = read(pfd[pipe_read], &status, sizeof(int))) > 0)
059ec3d9
PH
2498 {
2499 int i;
2500 uschar **sptr;
2501
2502 addr2->transport_return = status;
d6c82d7b 2503 len = read(pfd[pipe_read], &transport_count,
059ec3d9 2504 sizeof(transport_count));
d6c82d7b
JH
2505 len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
2506 len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
2507 len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
32dfdf8b 2508 len = read(pfd[pipe_read], &addr2->delivery_usec, sizeof(int));
d6c82d7b
JH
2509 len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
2510 len = read(pfd[pipe_read], &addr2->transport,
059ec3d9
PH
2511 sizeof(transport_instance *));
2512
2513 if (testflag(addr2, af_file))
2514 {
d88f0784
JH
2515 int llen;
2516 if ( read(pfd[pipe_read], &llen, sizeof(int)) != sizeof(int)
2517 || llen > 64*4 /* limit from rfc 5821, times I18N factor */
2518 )
2519 {
2520 log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part length read"
2521 " from delivery subprocess");
2522 break;
2523 }
2524 /* sanity-checked llen so disable the Coverity error */
2525 /* coverity[tainted_data] */
2526 if (read(pfd[pipe_read], big_buffer, llen) != llen)
2527 {
2528 log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part read"
2529 " from delivery subprocess");
2530 break;
2531 }
2532 big_buffer[llen] = 0;
059ec3d9
PH
2533 addr2->local_part = string_copy(big_buffer);
2534 }
2535
d6c82d7b 2536 for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
059ec3d9
PH
2537 {
2538 int message_length;
d6c82d7b 2539 len = read(pfd[pipe_read], &message_length, sizeof(int));
059ec3d9
PH
2540 if (message_length > 0)
2541 {
d6c82d7b 2542 len = read(pfd[pipe_read], big_buffer, message_length);
dc8091e7 2543 big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
059ec3d9
PH
2544 if (len > 0) *sptr = string_copy(big_buffer);
2545 }
2546 }
2547 }
2548
2549 else
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
2552 "from delivery subprocess", addr2->unique);
2553 break;
2554 }
2555 }
2556
f1e894f3 2557(void)close(pfd[pipe_read]);
059ec3d9
PH
2558
2559/* Unless shadowing, write all successful addresses immediately to the journal
2560file, to ensure they are recorded asap. For homonymic addresses, use the base
2561address plus the transport name. Failure to write the journal is panic-worthy,
2562but don't stop, as it may prove possible subsequently to update the spool file
2563in order to record the delivery. */
2564
2565if (!shadowing)
2566 {
d6c82d7b
JH
2567 for (addr2 = addr; addr2; addr2 = addr2->next)
2568 if (addr2->transport_return == OK)
2569 {
2570 if (testflag(addr2, af_homonym))
2571 sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
2572 else
2573 sprintf(CS big_buffer, "%.500s\n", addr2->unique);
059ec3d9 2574
d6c82d7b
JH
2575 /* In the test harness, wait just a bit to let the subprocess finish off
2576 any debug output etc first. */
059ec3d9 2577
8768d548 2578 if (f.running_in_test_harness) millisleep(300);
059ec3d9 2579
d6c82d7b
JH
2580 DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
2581 len = Ustrlen(big_buffer);
2582 if (write(journal_fd, big_buffer, len) != len)
2583 log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
2584 big_buffer, strerror(errno));
2585 }
059ec3d9
PH
2586
2587 /* Ensure the journal file is pushed out to disk. */
2588
54fc8428 2589 if (EXIMfsync(journal_fd) < 0)
059ec3d9
PH
2590 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2591 strerror(errno));
2592 }
2593
2594/* Wait for the process to finish. If it terminates with a non-zero code,
2595freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
2596status values of all the addresses as they are. Take care to handle the case
2597when the subprocess doesn't seem to exist. This has been seen on one system
2598when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
2599happens, wait() doesn't recognize the termination of child processes. Exim now
2600resets SIGCHLD to SIG_DFL, but this code should still be robust. */
2601
2602while ((rc = wait(&status)) != pid)
059ec3d9
PH
2603 if (rc < 0 && errno == ECHILD) /* Process has vanished */
2604 {
2605 log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
2606 addr->transport->driver_name);
2607 status = 0;
2608 break;
2609 }
059ec3d9
PH
2610
2611if ((status & 0xffff) != 0)
2612 {
2613 int msb = (status >> 8) & 255;
2614 int lsb = status & 255;
2615 int code = (msb == 0)? (lsb & 0x7f) : msb;
2616 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
2617 addr->special_action = SPECIAL_FREEZE;
2618 log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
2619 "status 0x%04x: %s %d",
2620 addr->transport->driver_name,
2621 status,
d6c82d7b 2622 msb == 0 ? "terminated by signal" : "exit code",
059ec3d9
PH
2623 code);
2624 }
2625
2626/* If SPECIAL_WARN is set in the top address, send a warning message. */
2627
d6c82d7b 2628if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
059ec3d9
PH
2629 {
2630 int fd;
2631 uschar *warn_message;
d6c82d7b 2632 pid_t pid;
059ec3d9
PH
2633
2634 DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
2635
d6c82d7b 2636 if (!(warn_message = expand_string(addr->transport->warn_message)))
059ec3d9
PH
2637 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
2638 "message for %s transport): %s", addr->transport->warn_message,
2639 addr->transport->name, expand_string_message);
d6c82d7b
JH
2640
2641 else if ((pid = child_open_exim(&fd)) > 0)
059ec3d9 2642 {
d6c82d7b
JH
2643 FILE *f = fdopen(fd, "wb");
2644 if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
2645 fprintf(f, "Reply-To: %s\n", errors_reply_to);
2646 fprintf(f, "Auto-Submitted: auto-replied\n");
2647 if (!contains_header(US"From", warn_message))
2648 moan_write_from(f);
2649 fprintf(f, "%s", CS warn_message);
059ec3d9 2650
d6c82d7b 2651 /* Close and wait for child process to complete, without a timeout. */
059ec3d9 2652
d6c82d7b
JH
2653 (void)fclose(f);
2654 (void)child_close(pid, 0);
059ec3d9
PH
2655 }
2656
2657 addr->special_action = SPECIAL_NONE;
2658 }
2659}
2660
2661
2662
fa41615d 2663
3070ceee
JH
2664/* Check transport for the given concurrency limit. Return TRUE if over
2665the limit (or an expansion failure), else FALSE and if there was a limit,
2666the key for the hints database used for the concurrency count. */
fa41615d 2667
3070ceee
JH
2668static BOOL
2669tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
fa41615d 2670{
3070ceee
JH
2671unsigned max_parallel;
2672
2673if (!tp->max_parallel) return FALSE;
2674
2675max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
2676if (expand_string_message)
2677 {
2678 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
2679 "in %s transport (%s): %s", tp->name, addr->address,
2680 expand_string_message);
2681 return TRUE;
2682 }
2683
2684if (max_parallel > 0)
2685 {
2686 uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
2687 if (!enq_start(serialize_key, max_parallel))
2688 {
2689 address_item * next;
2690 DEBUG(D_transport)
2691 debug_printf("skipping tpt %s because concurrency limit %u reached\n",
2692 tp->name, max_parallel);
2693 do
2694 {
2695 next = addr->next;
2696 addr->message = US"concurrency limit reached for transport";
2697 addr->basic_errno = ERRNO_TRETRY;
ba936fb8 2698 post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0);
3070ceee
JH
2699 } while ((addr = next));
2700 return TRUE;
2701 }
2702 *key = serialize_key;
2703 }
2704return FALSE;
fa41615d
JH
2705}
2706
2707
2708
059ec3d9
PH
2709/*************************************************
2710* Do local deliveries *
2711*************************************************/
2712
2713/* This function processes the list of addresses in addr_local. True local
2714deliveries are always done one address at a time. However, local deliveries can
2715be batched up in some cases. Typically this is when writing batched SMTP output
2716files for use by some external transport mechanism, or when running local
2717deliveries over LMTP.
2718
2719Arguments: None
2720Returns: Nothing
2721*/
2722
2723static void
2724do_local_deliveries(void)
2725{
2726open_db dbblock;
2727open_db *dbm_file = NULL;
2728time_t now = time(NULL);
2729
2730/* Loop until we have exhausted the supply of local deliveries */
2731
d6c82d7b 2732while (addr_local)
059ec3d9 2733 {
32dfdf8b
JH
2734 struct timeval delivery_start;
2735 struct timeval deliver_time;
059ec3d9
PH
2736 address_item *addr2, *addr3, *nextaddr;
2737 int logflags = LOG_MAIN;
8768d548 2738 int logchar = f.dont_deliver? '*' : '=';
059ec3d9 2739 transport_instance *tp;
fa41615d 2740 uschar * serialize_key = NULL;
059ec3d9
PH
2741
2742 /* Pick the first undelivered address off the chain */
2743
2744 address_item *addr = addr_local;
2745 addr_local = addr->next;
2746 addr->next = NULL;
2747
2748 DEBUG(D_deliver|D_transport)
2749 debug_printf("--------> %s <--------\n", addr->address);
2750
2751 /* An internal disaster if there is no transport. Should not occur! */
2752
d6c82d7b 2753 if (!(tp = addr->transport))
059ec3d9
PH
2754 {
2755 logflags |= LOG_PANIC;
8768d548 2756 f.disable_logging = FALSE; /* Jic */
d6c82d7b
JH
2757 addr->message = addr->router
2758 ? string_sprintf("No transport set by %s router", addr->router->name)
f3ebb786 2759 : US"No transport set by system filter";
ba936fb8 2760 post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
059ec3d9
PH
2761 continue;
2762 }
2763
2764 /* Check that this base address hasn't previously been delivered to this
2765 transport. The check is necessary at this point to handle homonymic addresses
2766 correctly in cases where the pattern of redirection changes between delivery
2767 attempts. Non-homonymic previous delivery is detected earlier, at routing
2768 time. */
2769
c2c19e9d 2770 if (previously_transported(addr, FALSE)) continue;
059ec3d9
PH
2771
2772 /* There are weird cases where logging is disabled */
2773
8768d548 2774 f.disable_logging = tp->disable_logging;
059ec3d9 2775
f7fd3850
PH
2776 /* Check for batched addresses and possible amalgamation. Skip all the work
2777 if either batch_max <= 1 or there aren't any other addresses for local
2778 delivery. */
059ec3d9 2779
d6c82d7b 2780 if (tp->batch_max > 1 && addr_local)
059ec3d9
PH
2781 {
2782 int batch_count = 1;
2783 BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
d6c82d7b
JH
2784 BOOL uses_lp = ( testflag(addr, af_pfr)
2785 && (testflag(addr, af_file) || addr->local_part[0] == '|')
2786 )
2787 || readconf_depends((driver_instance *)tp, US"local_part");
059ec3d9
PH
2788 uschar *batch_id = NULL;
2789 address_item **anchor = &addr_local;
2790 address_item *last = addr;
2791 address_item *next;
2792
2793 /* Expand the batch_id string for comparison with other addresses.
2794 Expansion failure suppresses batching. */
2795
d6c82d7b 2796 if (tp->batch_id)
059ec3d9
PH
2797 {
2798 deliver_set_expansions(addr);
2799 batch_id = expand_string(tp->batch_id);
2800 deliver_set_expansions(NULL);
d6c82d7b 2801 if (!batch_id)
059ec3d9
PH
2802 {
2803 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2804 "in %s transport (%s): %s", tp->name, addr->address,
2805 expand_string_message);
2806 batch_count = tp->batch_max;
2807 }
2808 }
2809
2810 /* Until we reach the batch_max limit, pick off addresses which have the
2811 same characteristics. These are:
2812
2813 same transport
7816e254 2814 not previously delivered (see comment about 50 lines above)
059ec3d9 2815 same local part if the transport's configuration contains $local_part
f7fd3850 2816 or if this is a file or pipe delivery from a redirection
059ec3d9
PH
2817 same domain if the transport's configuration contains $domain
2818 same errors address
2819 same additional headers
2820 same headers to be removed
2821 same uid/gid for running the transport
2822 same first host if a host list is set
2823 */
2824
d6c82d7b 2825 while ((next = *anchor) && batch_count < tp->batch_max)
059ec3d9
PH
2826 {
2827 BOOL ok =
d6c82d7b
JH
2828 tp == next->transport
2829 && !previously_transported(next, TRUE)
7eb0e5d2
JH
2830 && testflag(addr, af_pfr) == testflag(next, af_pfr)
2831 && testflag(addr, af_file) == testflag(next, af_file)
d6c82d7b
JH
2832 && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
2833 && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
2834 && same_strings(next->prop.errors_address, addr->prop.errors_address)
2835 && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
2836 && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
2837 && same_ugid(tp, addr, next)
2838 && ( !addr->host_list && !next->host_list
2839 || addr->host_list
2840 && next->host_list
2841 && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
2842 );
059ec3d9
PH
2843
2844 /* If the transport has a batch_id setting, batch_id will be non-NULL
2845 from the expansion outside the loop. Expand for this address and compare.
2846 Expansion failure makes this address ineligible for batching. */
2847
d6c82d7b 2848 if (ok && batch_id)
059ec3d9
PH
2849 {
2850 uschar *bid;
2851 address_item *save_nextnext = next->next;
2852 next->next = NULL; /* Expansion for a single address */
2853 deliver_set_expansions(next);
2854 next->next = save_nextnext;
2855 bid = expand_string(tp->batch_id);
2856 deliver_set_expansions(NULL);
d6c82d7b 2857 if (!bid)
059ec3d9
PH
2858 {
2859 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2860 "in %s transport (%s): %s", tp->name, next->address,
2861 expand_string_message);
2862 ok = FALSE;
2863 }
2864 else ok = (Ustrcmp(batch_id, bid) == 0);
2865 }
2866
2867 /* Take address into batch if OK. */
2868
2869 if (ok)
2870 {
2871 *anchor = next->next; /* Include the address */
2872 next->next = NULL;
2873 last->next = next;
2874 last = next;
2875 batch_count++;
2876 }
fa41615d 2877 else anchor = &next->next; /* Skip the address */
059ec3d9
PH
2878 }
2879 }
2880
2881 /* We now have one or more addresses that can be delivered in a batch. Check
2882 whether the transport is prepared to accept a message of this size. If not,
2883 fail them all forthwith. If the expansion fails, or does not yield an
2884 integer, defer delivery. */
2885
d6c82d7b 2886 if (tp->message_size_limit)
059ec3d9
PH
2887 {
2888 int rc = check_message_size(tp, addr);
2889 if (rc != OK)
2890 {
2891 replicate_status(addr);
d6c82d7b 2892 while (addr)
059ec3d9
PH
2893 {
2894 addr2 = addr->next;
ba936fb8 2895 post_process_one(addr, rc, logflags, EXIM_DTYPE_TRANSPORT, 0);
059ec3d9
PH
2896 addr = addr2;
2897 }
2898 continue; /* With next batch of addresses */
2899 }
2900 }
2901
2902 /* If we are not running the queue, or if forcing, all deliveries will be
2903 attempted. Otherwise, we must respect the retry times for each address. Even
2904 when not doing this, we need to set up the retry key string, and determine
2905 whether a retry record exists, because after a successful delivery, a delete
2906 retry item must be set up. Keep the retry database open only for the duration
2907 of these checks, rather than for all local deliveries, because some local
2908 deliveries (e.g. to pipes) can take a substantial time. */
2909
b10c87b3 2910 if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE)))
059ec3d9
PH
2911 {
2912 DEBUG(D_deliver|D_retry|D_hints_lookup)
2913 debug_printf("no retry data available\n");
2914 }
2915
2916 addr2 = addr;
2917 addr3 = NULL;
d6c82d7b 2918 while (addr2)
059ec3d9
PH
2919 {
2920 BOOL ok = TRUE; /* to deliver this address */
2921 uschar *retry_key;
2922
2923 /* Set up the retry key to include the domain or not, and change its
2924 leading character from "R" to "T". Must make a copy before doing this,
2925 because the old key may be pointed to from a "delete" retry item after
2926 a routing delay. */
2927
2928 retry_key = string_copy(
d6c82d7b 2929 tp->retry_use_local_part ? addr2->address_retry_key :
059ec3d9
PH
2930 addr2->domain_retry_key);
2931 *retry_key = 'T';
2932
2933 /* Inspect the retry data. If there is no hints file, delivery happens. */
2934
d6c82d7b 2935 if (dbm_file)
059ec3d9
PH
2936 {
2937 dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
2938
2939 /* If there is no retry record, delivery happens. If there is,
2940 remember it exists so it can be deleted after a successful delivery. */
2941
d6c82d7b 2942 if (retry_record)
059ec3d9
PH
2943 {
2944 setflag(addr2, af_lt_retry_exists);
2945
2946 /* A retry record exists for this address. If queue running and not
2947 forcing, inspect its contents. If the record is too old, or if its
2948 retry time has come, or if it has passed its cutoff time, delivery
2949 will go ahead. */
2950
2951 DEBUG(D_retry)
2952 {
ea49d0e1
PH
2953 debug_printf("retry record exists: age=%s ",
2954 readconf_printtime(now - retry_record->time_stamp));
2955 debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
2956 debug_printf(" time to retry = %s expired = %d\n",
2957 readconf_printtime(retry_record->next_try - now),
2958 retry_record->expired);
059ec3d9
PH
2959 }
2960
8768d548 2961 if (f.queue_running && !f.deliver_force)
059ec3d9 2962 {
d6c82d7b
JH
2963 ok = (now - retry_record->time_stamp > retry_data_expire)
2964 || (now >= retry_record->next_try)
2965 || retry_record->expired;
059ec3d9
PH
2966
2967 /* If we haven't reached the retry time, there is one more check
1ddeb334 2968 to do, which is for the ultimate address timeout. */
059ec3d9
PH
2969
2970 if (!ok)
ba9af0af
TF
2971 ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
2972 retry_record, now);
059ec3d9
PH
2973 }
2974 }
2975 else DEBUG(D_retry) debug_printf("no retry record exists\n");
2976 }
2977
2978 /* This address is to be delivered. Leave it on the chain. */
2979
2980 if (ok)
2981 {
2982 addr3 = addr2;
2983 addr2 = addr2->next;
2984 }
2985
2986 /* This address is to be deferred. Take it out of the chain, and
2987 post-process it as complete. Must take it out of the chain first,
2988 because post processing puts it on another chain. */
2989
2990 else
2991 {
2992 address_item *this = addr2;
2993 this->message = US"Retry time not yet reached";
2994 this->basic_errno = ERRNO_LRETRY;
d6c82d7b
JH
2995 addr2 = addr3 ? (addr3->next = addr2->next)
2996 : (addr = addr2->next);
ba936fb8 2997 post_process_one(this, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
059ec3d9
PH
2998 }
2999 }
3000
d6c82d7b 3001 if (dbm_file) dbfn_close(dbm_file);
059ec3d9
PH
3002
3003 /* If there are no addresses left on the chain, they all deferred. Loop
3004 for the next set of addresses. */
3005
d6c82d7b 3006 if (!addr) continue;
059ec3d9 3007
fa41615d
JH
3008 /* If the transport is limited for parallellism, enforce that here.
3009 We use a hints DB entry, incremented here and decremented after
3010 the transport (and any shadow transport) completes. */
3011
3070ceee 3012 if (tpt_parallel_check(tp, addr, &serialize_key))
fa41615d 3013 {
fa41615d
JH
3014 if (expand_string_message)
3015 {
3016 logflags |= LOG_PANIC;
3070ceee
JH
3017 do
3018 {
3019 addr = addr->next;
ba936fb8 3020 post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
3070ceee 3021 } while ((addr = addr2));
fa41615d 3022 }
3070ceee 3023 continue; /* Loop for the next set of addresses. */
fa41615d
JH
3024 }
3025
3026
059ec3d9
PH
3027 /* So, finally, we do have some addresses that can be passed to the
3028 transport. Before doing so, set up variables that are relevant to a
3029 single delivery. */
3030
3031 deliver_set_expansions(addr);
32dfdf8b
JH
3032
3033 gettimeofday(&delivery_start, NULL);
059ec3d9 3034 deliver_local(addr, FALSE);
32dfdf8b 3035 timesince(&deliver_time, &delivery_start);
059ec3d9
PH
3036
3037 /* If a shadow transport (which must perforce be another local transport), is
3038 defined, and its condition is met, we must pass the message to the shadow
3039 too, but only those addresses that succeeded. We do this by making a new
3040 chain of addresses - also to keep the original chain uncontaminated. We must
3041 use a chain rather than doing it one by one, because the shadow transport may
3042 batch.
3043
3044 NOTE: if the condition fails because of a lookup defer, there is nothing we
3045 can do! */
3046
d6c82d7b
JH
3047 if ( tp->shadow
3048 && ( !tp->shadow_condition
3049 || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
3050 ) )
059ec3d9
PH
3051 {
3052 transport_instance *stp;
3053 address_item *shadow_addr = NULL;
3054 address_item **last = &shadow_addr;
3055
d6c82d7b 3056 for (stp = transports; stp; stp = stp->next)
059ec3d9
PH
3057 if (Ustrcmp(stp->name, tp->shadow) == 0) break;
3058
d6c82d7b 3059 if (!stp)
059ec3d9
PH
3060 log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
3061 tp->shadow);
3062
3063 /* Pick off the addresses that have succeeded, and make clones. Put into
3064 the shadow_message field a pointer to the shadow_message field of the real
3065 address. */
3066
d6c82d7b
JH
3067 else for (addr2 = addr; addr2; addr2 = addr2->next)
3068 if (addr2->transport_return == OK)
3069 {
f3ebb786 3070 addr3 = store_get(sizeof(address_item), FALSE);
d6c82d7b
JH
3071 *addr3 = *addr2;
3072 addr3->next = NULL;
82f90600 3073 addr3->shadow_message = US &addr2->shadow_message;
d6c82d7b
JH
3074 addr3->transport = stp;
3075 addr3->transport_return = DEFER;
3076 addr3->return_filename = NULL;
3077 addr3->return_file = -1;
3078 *last = addr3;
82f90600 3079 last = &addr3->next;
d6c82d7b 3080 }
059ec3d9
PH
3081
3082 /* If we found any addresses to shadow, run the delivery, and stick any
3083 message back into the shadow_message field in the original. */
3084
d6c82d7b 3085 if (shadow_addr)
059ec3d9
PH
3086 {
3087 int save_count = transport_count;
3088
3089 DEBUG(D_deliver|D_transport)
3090 debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
3091 deliver_local(shadow_addr, TRUE);
3092
d6c82d7b 3093 for(; shadow_addr; shadow_addr = shadow_addr->next)
059ec3d9
PH
3094 {
3095 int sresult = shadow_addr->transport_return;
d6c82d7b
JH
3096 *(uschar **)shadow_addr->shadow_message =
3097 sresult == OK
3098 ? string_sprintf(" ST=%s", stp->name)
3099 : string_sprintf(" ST=%s (%s%s%s)", stp->name,
3100 shadow_addr->basic_errno <= 0
3101 ? US""
3102 : US strerror(shadow_addr->basic_errno),
3103 shadow_addr->basic_errno <= 0 || !shadow_addr->message
3104 ? US""
3105 : US": ",
3106 shadow_addr->message
3107 ? shadow_addr->message
3108 : shadow_addr->basic_errno <= 0
3109 ? US"unknown error"
3110 : US"");
059ec3d9
PH
3111
3112 DEBUG(D_deliver|D_transport)
3113 debug_printf("%s shadow transport returned %s for %s\n",
aeb65e91 3114 stp->name, rc_to_string(sresult), shadow_addr->address);
059ec3d9
PH
3115 }
3116
3117 DEBUG(D_deliver|D_transport)
3118 debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
3119
3120 transport_count = save_count; /* Restore original transport count */
3121 }
3122 }
3123
3124 /* Cancel the expansions that were set up for the delivery. */
3125
3126 deliver_set_expansions(NULL);
3127
fa41615d
JH
3128 /* If the transport was parallelism-limited, decrement the hints DB record. */
3129
3130 if (serialize_key) enq_end(serialize_key);
3131
059ec3d9
PH
3132 /* Now we can process the results of the real transport. We must take each
3133 address off the chain first, because post_process_one() puts it on another
3134 chain. */
3135
d6c82d7b 3136 for (addr2 = addr; addr2; addr2 = nextaddr)
059ec3d9
PH
3137 {
3138 int result = addr2->transport_return;
3139 nextaddr = addr2->next;
3140
3141 DEBUG(D_deliver|D_transport)
3142 debug_printf("%s transport returned %s for %s\n",
aeb65e91 3143 tp->name, rc_to_string(result), addr2->address);
059ec3d9
PH
3144
3145 /* If there is a retry_record, or if delivery is deferred, build a retry
3146 item for setting a new retry time or deleting the old retry record from
3147 the database. These items are handled all together after all addresses
3148 have been handled (so the database is open just for a short time for
3149 updating). */
3150
3151 if (result == DEFER || testflag(addr2, af_lt_retry_exists))
3152 {
d6c82d7b
JH
3153 int flags = result == DEFER ? 0 : rf_delete;
3154 uschar *retry_key = string_copy(tp->retry_use_local_part
3155 ? addr2->address_retry_key : addr2->domain_retry_key);
059ec3d9
PH
3156 *retry_key = 'T';
3157 retry_add_item(addr2, retry_key, flags);
3158 }
3159
3160 /* Done with this address */
3161
32dfdf8b
JH
3162 if (result == OK)
3163 {
3164 addr2->more_errno = deliver_time.tv_sec;
3165 addr2->delivery_usec = deliver_time.tv_usec;
3166 }
ba936fb8 3167 post_process_one(addr2, result, logflags, EXIM_DTYPE_TRANSPORT, logchar);
059ec3d9
PH
3168
3169 /* If a pipe delivery generated text to be sent back, the result may be
3170 changed to FAIL, and we must copy this for subsequent addresses in the
3171 batch. */
3172
3173 if (addr2->transport_return != result)
3174 {
d6c82d7b 3175 for (addr3 = nextaddr; addr3; addr3 = addr3->next)
059ec3d9
PH
3176 {
3177 addr3->transport_return = addr2->transport_return;
3178 addr3->basic_errno = addr2->basic_errno;
3179 addr3->message = addr2->message;
3180 }
3181 result = addr2->transport_return;
3182 }
3183
3184 /* Whether or not the result was changed to FAIL, we need to copy the
3185 return_file value from the first address into all the addresses of the
3186 batch, so they are all listed in the error message. */
3187
3188 addr2->return_file = addr->return_file;
3189
3190 /* Change log character for recording successful deliveries. */
3191
3192 if (result == OK) logchar = '-';
3193 }
3194 } /* Loop back for next batch of addresses */
3195}
3196
3197
3198
3199
3200/*************************************************
3201* Sort remote deliveries *
3202*************************************************/
3203
3204/* This function is called if remote_sort_domains is set. It arranges that the
3205chain of addresses for remote deliveries is ordered according to the strings
3206specified. Try to make this shuffling reasonably efficient by handling
3207sequences of addresses rather than just single ones.
3208
3209Arguments: None
3210Returns: Nothing
3211*/
3212
3213static void
3214sort_remote_deliveries(void)
3215{
3216int sep = 0;
3217address_item **aptr = &addr_remote;
55414b25 3218const uschar *listptr = remote_sort_domains;
059ec3d9
PH
3219uschar *pattern;
3220uschar patbuf[256];
3221
d6c82d7b
JH
3222while ( *aptr
3223 && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
3224 )
059ec3d9
PH
3225 {
3226 address_item *moved = NULL;
3227 address_item **bptr = &moved;
3228
d6c82d7b 3229 while (*aptr)
059ec3d9
PH
3230 {
3231 address_item **next;
3232 deliver_domain = (*aptr)->domain; /* set $domain */
55414b25 3233 if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
059ec3d9
PH
3234 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
3235 {
d6c82d7b 3236 aptr = &(*aptr)->next;
059ec3d9
PH
3237 continue;
3238 }
3239
d6c82d7b
JH
3240 next = &(*aptr)->next;
3241 while ( *next
3242 && (deliver_domain = (*next)->domain, /* Set $domain */
55414b25 3243 match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
d6c82d7b
JH
3244 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
3245 )
3246 next = &(*next)->next;
059ec3d9
PH
3247
3248 /* If the batch of non-matchers is at the end, add on any that were
3249 extracted further up the chain, and end this iteration. Otherwise,
3250 extract them from the chain and hang on the moved chain. */
3251
d6c82d7b 3252 if (!*next)
059ec3d9
PH
3253 {
3254 *next = moved;
3255 break;
3256 }
3257
3258 *bptr = *aptr;
3259 *aptr = *next;
3260 *next = NULL;
3261 bptr = next;
d6c82d7b 3262 aptr = &(*aptr)->next;
059ec3d9
PH
3263 }
3264
3265 /* If the loop ended because the final address matched, *aptr will
3266 be NULL. Add on to the end any extracted non-matching addresses. If
3267 *aptr is not NULL, the loop ended via "break" when *next is null, that
3268 is, there was a string of non-matching addresses at the end. In this
3269 case the extracted addresses have already been added on the end. */
3270
d6c82d7b 3271 if (!*aptr) *aptr = moved;
059ec3d9
PH
3272 }
3273
3274DEBUG(D_deliver)
3275 {
059ec3d9 3276 debug_printf("remote addresses after sorting:\n");
d7978c0f 3277 for (address_item * addr = addr_remote; addr; addr = addr->next)
059ec3d9
PH
3278 debug_printf(" %s\n", addr->address);
3279 }
3280}
3281
3282
3283
3284/*************************************************
3285* Read from pipe for remote delivery subprocess *
3286*************************************************/
3287
3288/* This function is called when the subprocess is complete, but can also be
3289called before it is complete, in order to empty a pipe that is full (to prevent
3290deadlock). It must therefore keep track of its progress in the parlist data
3291block.
3292
3293We read the pipe to get the delivery status codes and a possible error message
3294for each address, optionally preceded by unusability data for the hosts and
3295also by optional retry data.
3296
3297Read in large chunks into the big buffer and then scan through, interpreting
3298the data therein. In most cases, only a single read will be necessary. No
1c5466b9
PH
3299individual item will ever be anywhere near 2500 bytes in length, so by ensuring
3300that we read the next chunk when there is less than 2500 bytes left in the
3301non-final chunk, we can assume each item is complete in the buffer before
3302handling it. Each item is written using a single write(), which is atomic for
3303small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
3304often bigger) so even if we are reading while the subprocess is still going, we
3305should never have only a partial item in the buffer.
059ec3d9 3306
0768462d
JH
3307hs12: This assumption is not true anymore, since we get quite large items (certificate
3308information and such).
2cee425a 3309
059ec3d9
PH
3310Argument:
3311 poffset the offset of the parlist item
3312 eop TRUE if the process has completed
3313
3314Returns: TRUE if the terminating 'Z' item has been read,
3315 or there has been a disaster (i.e. no more data needed);
3316 FALSE otherwise
3317*/
3318
3319static BOOL
3320par_read_pipe(int poffset, BOOL eop)
3321{
3322host_item *h;
3323pardata *p = parlist + poffset;
3324address_item *addrlist = p->addrlist;
3325address_item *addr = p->addr;
3326pid_t pid = p->pid;
3327int fd = p->fd;
2cee425a 3328
059ec3d9
PH
3329uschar *msg = p->msg;
3330BOOL done = p->done;
059ec3d9
PH
3331
3332/* Loop through all items, reading from the pipe when necessary. The pipe
2cee425a
HSHR
3333used to be non-blocking. But I do not see a reason for using non-blocking I/O
3334here, as the preceding select() tells us, if data is available for reading.
3335
3336A read() on a "selected" handle should never block, but(!) it may return
3337less data then we expected. (The buffer size we pass to read() shouldn't be
3338understood as a "request", but as a "limit".)
3339
3340Each separate item is written to the pipe in a timely manner. But, especially for
3341larger items, the read(2) may already return partial data from the write(2).
3342
3343The write is atomic mostly (depending on the amount written), but atomic does
3344not imply "all or noting", it just is "not intermixed" with other writes on the
3345same channel (pipe).
6c454556
HSHR
3346
3347*/
059ec3d9
PH
3348
3349DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
2cee425a 3350 (int)p->pid, eop? "ended" : "not ended yet");
059ec3d9
PH
3351
3352while (!done)
3353 {
3354 retry_item *r, **rp;
2cee425a
HSHR
3355 uschar pipeheader[PIPE_HEADER_SIZE+1];
3356 uschar *id = &pipeheader[0];
3357 uschar *subid = &pipeheader[1];
3358 uschar *ptr = big_buffer;
3359 size_t required = PIPE_HEADER_SIZE; /* first the pipehaeder, later the data */
3360 ssize_t got;
3361
7845dbb3 3362 DEBUG(D_deliver) debug_printf(
0d68983b 3363 "expect %lu bytes (pipeheader) from tpt process %d\n", (u_long)required, pid);
2cee425a
HSHR
3364
3365 /* We require(!) all the PIPE_HEADER_SIZE bytes here, as we know,
3366 they're written in a timely manner, so waiting for the write shouldn't hurt a lot.
3367 If we get less, we can assume the subprocess do be done and do not expect any further
3368 information from it. */
7845dbb3 3369
ee250936 3370 if ((got = readn(fd, pipeheader, required)) != required)
059ec3d9 3371 {
bb07bcd3
JH
3372 msg = string_sprintf("got " SSIZE_T_FMT " of %d bytes (pipeheader) "
3373 "from transport process %d for transport %s",
3374 got, PIPE_HEADER_SIZE, pid, addr->transport->driver_name);
3375 done = TRUE;
3376 break;
059ec3d9
PH
3377 }
3378
2cee425a
HSHR
3379 pipeheader[PIPE_HEADER_SIZE] = '\0';
3380 DEBUG(D_deliver)
7845dbb3
JH
3381 debug_printf("got %ld bytes (pipeheader) from transport process %d\n",
3382 (long) got, pid);
059ec3d9 3383
2cee425a
HSHR
3384 {
3385 /* If we can't decode the pipeheader, the subprocess seems to have a
3386 problem, we do not expect any furher information from it. */
3387 char *endc;
7845dbb3 3388 required = Ustrtol(pipeheader+2, &endc, 10);
bd21a787
WB
3389 if (*endc)
3390 {
2cee425a
HSHR
3391 msg = string_sprintf("failed to read pipe "
3392 "from transport process %d for transport %s: error decoding size from header",
3393 pid, addr->transport->driver_name);
bd21a787
WB
3394 done = TRUE;
3395 break;
3396 }
2cee425a 3397 }
bd21a787
WB
3398
3399 DEBUG(D_deliver)
7845dbb3 3400 debug_printf("expect %lu bytes (pipedata) from transport process %d\n",
0d68983b 3401 (u_long)required, pid);
2c0f3ea1 3402
2cee425a
HSHR
3403 /* Same as above, the transport process will write the bytes announced
3404 in a timely manner, so we can just wait for the bytes, getting less than expected
3405 is considered a problem of the subprocess, we do not expect anything else from it. */
ee250936 3406 if ((got = readn(fd, big_buffer, required)) != required)
8fa0a4d4 3407 {
bb07bcd3
JH
3408 msg = string_sprintf("got only " SSIZE_T_FMT " of " SIZE_T_FMT
3409 " bytes (pipedata) from transport process %d for transport %s",
3410 got, required, pid, addr->transport->driver_name);
3411 done = TRUE;
3412 break;
8fa0a4d4 3413 }
bd21a787 3414
059ec3d9
PH
3415 /* Handle each possible type of item, assuming the complete item is
3416 available in store. */
3417
2cee425a 3418 switch (*id)
059ec3d9
PH
3419 {
3420 /* Host items exist only if any hosts were marked unusable. Match
3421 up by checking the IP address. */
3422
3423 case 'H':
57cc2785
JH
3424 for (h = addrlist->host_list; h; h = h->next)
3425 {
3426 if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
3427 h->status = ptr[0];
3428 h->why = ptr[1];
3429 }
3430 ptr += 2;
3431 while (*ptr++);
3432 break;
059ec3d9
PH
3433
3434 /* Retry items are sent in a preceding R item for each address. This is
3435 kept separate to keep each message short enough to guarantee it won't
3436 be split in the pipe. Hopefully, in the majority of cases, there won't in
3437 fact be any retry items at all.
3438
3439 The complete set of retry items might include an item to delete a
3440 routing retry if there was a previous routing delay. However, routing
3441 retries are also used when a remote transport identifies an address error.
3442 In that case, there may also be an "add" item for the same key. Arrange
3443 that a "delete" item is dropped in favour of an "add" item. */
3444
3445 case 'R':
57cc2785 3446 if (!addr) goto ADDR_MISMATCH;
059ec3d9 3447
57cc2785
JH
3448 DEBUG(D_deliver|D_retry)
3449 debug_printf("reading retry information for %s from subprocess\n",
3450 ptr+1);
059ec3d9 3451
57cc2785 3452 /* Cut out any "delete" items on the list. */
059ec3d9 3453
57cc2785
JH
3454 for (rp = &addr->retries; (r = *rp); rp = &r->next)
3455 if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
3456 {
3457 if (!(r->flags & rf_delete)) break; /* It was not "delete" */
3458 *rp = r->next; /* Excise a delete item */
3459 DEBUG(D_deliver|D_retry)
3460 debug_printf(" existing delete item dropped\n");
3461 }
059ec3d9 3462
57cc2785
JH
3463 /* We want to add a delete item only if there is no non-delete item;
3464 however we still have to step ptr through the data. */
059ec3d9 3465
57cc2785
JH
3466 if (!r || !(*ptr & rf_delete))
3467 {
f3ebb786 3468 r = store_get(sizeof(retry_item), FALSE);
57cc2785
JH
3469 r->next = addr->retries;
3470 addr->retries = r;
3471 r->flags = *ptr++;
3472 r->key = string_copy(ptr);
3473 while (*ptr++);
32dfdf8b 3474 memcpy(&r->basic_errno, ptr, sizeof(r->basic_errno));
57cc2785 3475 ptr += sizeof(r->basic_errno);
32dfdf8b 3476 memcpy(&r->more_errno, ptr, sizeof(r->more_errno));
57cc2785
JH
3477 ptr += sizeof(r->more_errno);
3478 r->message = *ptr ? string_copy(ptr) : NULL;
3479 DEBUG(D_deliver|D_retry) debug_printf(" added %s item\n",
3480 r->flags & rf_delete ? "delete" : "retry");
3481 }
059ec3d9 3482
57cc2785
JH
3483 else
3484 {
3485 DEBUG(D_deliver|D_retry)
3486 debug_printf(" delete item not added: non-delete item exists\n");
3487 ptr++;
3488 while(*ptr++);
3489 ptr += sizeof(r->basic_errno) + sizeof(r->more_errno);
3490 }
059ec3d9 3491
57cc2785
JH
3492 while(*ptr++);
3493 break;
059ec3d9
PH
3494
3495 /* Put the amount of data written into the parlist block */
3496
3497 case 'S':
57cc2785
JH
3498 memcpy(&(p->transport_count), ptr, sizeof(transport_count));
3499 ptr += sizeof(transport_count);
3500 break;
059ec3d9
PH
3501
3502 /* Address items are in the order of items on the address chain. We
3503 remember the current address value in case this function is called
3504 several times to empty the pipe in stages. Information about delivery
3505 over TLS is sent in a preceding X item for each address. We don't put
3506 it in with the other info, in order to keep each message short enough to
3507 guarantee it won't be split in the pipe. */
3508
01603eec 3509#ifndef DISABLE_TLS
059ec3d9 3510 case 'X':
57cc2785 3511 if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */
2cee425a 3512 switch (*subid)
57cc2785
JH
3513 {
3514 case '1':
3515 addr->cipher = NULL;
3516 addr->peerdn = NULL;
9d1c15ef 3517
57cc2785
JH
3518 if (*ptr)
3519 addr->cipher = string_copy(ptr);
3520 while (*ptr++);
3521 if (*ptr)
3522 addr->peerdn = string_copy(ptr);
3523 break;
3524
3525 case '2':
3526 if (*ptr)
3527 (void) tls_import_cert(ptr, &addr->peercert);
3528 else
3529 addr->peercert = NULL;
3530 break;
3531
3532 case '3':
3533 if (*ptr)
3534 (void) tls_import_cert(ptr, &addr->ourcert);
3535 else
3536 addr->ourcert = NULL;
3537 break;
018058b2 3538
a7538db1 3539# ifndef DISABLE_OCSP
57cc2785
JH
3540 case '4':
3541 addr->ocsp = *ptr ? *ptr - '0' : OCSP_NOT_REQ;
3542 break;
a7538db1 3543# endif
57cc2785
JH