Logging: dnssec status on accept & delivery lines
[exim.git] / src / src / deliver.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
80fea873 5/* Copyright (c) University of Cambridge 1995 - 2016 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* The main code for delivering a message. */
9
10
11#include "exim.h"
dadff1d4 12#include <assert.h>
059ec3d9
PH
13
14
15/* Data block for keeping track of subprocesses for parallel remote
16delivery. */
17
18typedef struct pardata {
19 address_item *addrlist; /* chain of addresses */
20 address_item *addr; /* next address data expected for */
21 pid_t pid; /* subprocess pid */
22 int fd; /* pipe fd for getting result from subprocess */
23 int transport_count; /* returned transport count value */
24 BOOL done; /* no more data needed */
25 uschar *msg; /* error message */
26 uschar *return_path; /* return_path for these addresses */
27} pardata;
28
29/* Values for the process_recipients variable */
30
31enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
32 RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
33 RECIP_FAIL_LOOP};
34
35/* Mutually recursive functions for marking addresses done. */
36
37static void child_done(address_item *, uschar *);
38static void address_done(address_item *, uschar *);
39
40/* Table for turning base-62 numbers into binary */
41
42static uschar tab62[] =
43 {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
44 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
45 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
46 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
47 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
48 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
49 59,60,61}; /* x-z */
50
51
52/*************************************************
53* Local static variables *
54*************************************************/
55
56/* addr_duplicate is global because it needs to be seen from the Envelope-To
57writing code. */
58
59static address_item *addr_defer = NULL;
60static address_item *addr_failed = NULL;
61static address_item *addr_fallback = NULL;
62static address_item *addr_local = NULL;
63static address_item *addr_new = NULL;
64static address_item *addr_remote = NULL;
65static address_item *addr_route = NULL;
66static address_item *addr_succeed = NULL;
6c1c3d1d
WB
67static address_item *addr_dsntmp = NULL;
68static address_item *addr_senddsn = NULL;
059ec3d9
PH
69
70static FILE *message_log = NULL;
71static BOOL update_spool;
72static BOOL remove_journal;
73static int parcount = 0;
74static pardata *parlist = NULL;
75static int return_count;
76static uschar *frozen_info = US"";
77static uschar *used_return_path = NULL;
78
79static uschar spoolname[PATH_MAX];
80
81
82
83/*************************************************
84* Make a new address item *
85*************************************************/
86
87/* This function gets the store and initializes with default values. The
88transport_return value defaults to DEFER, so that any unexpected failure to
89deliver does not wipe out the message. The default unique string is set to a
90copy of the address, so that its domain can be lowercased.
91
92Argument:
93 address the RFC822 address string
94 copy force a copy of the address
95
96Returns: a pointer to an initialized address_item
97*/
98
99address_item *
100deliver_make_addr(uschar *address, BOOL copy)
101{
102address_item *addr = store_get(sizeof(address_item));
103*addr = address_defaults;
104if (copy) address = string_copy(address);
105addr->address = address;
106addr->unique = string_copy(address);
107return addr;
108}
109
110
111
112
113/*************************************************
114* Set expansion values for an address *
115*************************************************/
116
117/* Certain expansion variables are valid only when handling an address or
118address list. This function sets them up or clears the values, according to its
119argument.
120
121Arguments:
122 addr the address in question, or NULL to clear values
123Returns: nothing
124*/
125
126void
127deliver_set_expansions(address_item *addr)
128{
d6c82d7b 129if (!addr)
059ec3d9 130 {
55414b25 131 const uschar ***p = address_expansions;
d6c82d7b 132 while (*p) **p++ = NULL;
059ec3d9
PH
133 return;
134 }
135
136/* Exactly what gets set depends on whether there is one or more addresses, and
137what they contain. These first ones are always set, taking their values from
138the first address. */
139
d6c82d7b 140if (!addr->host_list)
059ec3d9
PH
141 {
142 deliver_host = deliver_host_address = US"";
a7538db1 143 deliver_host_port = 0;
059ec3d9
PH
144 }
145else
146 {
147 deliver_host = addr->host_list->name;
148 deliver_host_address = addr->host_list->address;
a7538db1 149 deliver_host_port = addr->host_list->port;
059ec3d9
PH
150 }
151
152deliver_recipients = addr;
d43cbe25
JH
153deliver_address_data = addr->prop.address_data;
154deliver_domain_data = addr->prop.domain_data;
155deliver_localpart_data = addr->prop.localpart_data;
059ec3d9
PH
156
157/* These may be unset for multiple addresses */
158
159deliver_domain = addr->domain;
160self_hostname = addr->self_hostname;
161
8523533c
TK
162#ifdef EXPERIMENTAL_BRIGHTMAIL
163bmi_deliver = 1; /* deliver by default */
164bmi_alt_location = NULL;
165bmi_base64_verdict = NULL;
166bmi_base64_tracker_verdict = NULL;
167#endif
168
059ec3d9
PH
169/* If there's only one address we can set everything. */
170
d6c82d7b 171if (!addr->next)
059ec3d9
PH
172 {
173 address_item *addr_orig;
174
175 deliver_localpart = addr->local_part;
176 deliver_localpart_prefix = addr->prefix;
177 deliver_localpart_suffix = addr->suffix;
178
d6c82d7b 179 for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
059ec3d9
PH
180 deliver_domain_orig = addr_orig->domain;
181
182 /* Re-instate any prefix and suffix in the original local part. In all
183 normal cases, the address will have a router associated with it, and we can
184 choose the caseful or caseless version accordingly. However, when a system
185 filter sets up a pipe, file, or autoreply delivery, no router is involved.
186 In this case, though, there won't be any prefix or suffix to worry about. */
187
d6c82d7b
JH
188 deliver_localpart_orig = !addr_orig->router
189 ? addr_orig->local_part
190 : addr_orig->router->caseful_local_part
191 ? addr_orig->cc_local_part
192 : addr_orig->lc_local_part;
059ec3d9
PH
193
194 /* If there's a parent, make its domain and local part available, and if
195 delivering to a pipe or file, or sending an autoreply, get the local
196 part from the parent. For pipes and files, put the pipe or file string
197 into address_pipe and address_file. */
198
d6c82d7b 199 if (addr->parent)
059ec3d9
PH
200 {
201 deliver_domain_parent = addr->parent->domain;
d6c82d7b
JH
202 deliver_localpart_parent = !addr->parent->router
203 ? addr->parent->local_part
204 : addr->parent->router->caseful_local_part
205 ? addr->parent->cc_local_part
206 : addr->parent->lc_local_part;
059ec3d9
PH
207
208 /* File deliveries have their own flag because they need to be picked out
209 as special more often. */
210
211 if (testflag(addr, af_pfr))
212 {
d6c82d7b
JH
213 if (testflag(addr, af_file)) address_file = addr->local_part;
214 else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
059ec3d9
PH
215 deliver_localpart = addr->parent->local_part;
216 deliver_localpart_prefix = addr->parent->prefix;
217 deliver_localpart_suffix = addr->parent->suffix;
218 }
219 }
8523533c
TK
220
221#ifdef EXPERIMENTAL_BRIGHTMAIL
222 /* Set expansion variables related to Brightmail AntiSpam */
223 bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
224 bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
225 /* get message delivery status (0 - don't deliver | 1 - deliver) */
226 bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
227 /* if message is to be delivered, get eventual alternate location */
d6c82d7b 228 if (bmi_deliver == 1)
8523533c 229 bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
8523533c
TK
230#endif
231
059ec3d9
PH
232 }
233
234/* For multiple addresses, don't set local part, and leave the domain and
f7fd3850
PH
235self_hostname set only if it is the same for all of them. It is possible to
236have multiple pipe and file addresses, but only when all addresses have routed
237to the same pipe or file. */
059ec3d9
PH
238
239else
240 {
241 address_item *addr2;
f7fd3850
PH
242 if (testflag(addr, af_pfr))
243 {
d6c82d7b
JH
244 if (testflag(addr, af_file)) address_file = addr->local_part;
245 else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
f7fd3850 246 }
d6c82d7b 247 for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 248 {
d6c82d7b 249 if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
059ec3d9 250 deliver_domain = NULL;
d6c82d7b
JH
251 if ( self_hostname
252 && ( !addr2->self_hostname
253 || Ustrcmp(self_hostname, addr2->self_hostname) != 0
254 ) )
059ec3d9 255 self_hostname = NULL;
d6c82d7b 256 if (!deliver_domain && !self_hostname) break;
059ec3d9
PH
257 }
258 }
259}
260
261
262
263
264/*************************************************
265* Open a msglog file *
266*************************************************/
267
268/* This function is used both for normal message logs, and for files in the
269msglog directory that are used to catch output from pipes. Try to create the
270directory if it does not exist. From release 4.21, normal message logs should
271be created when the message is received.
272
273Argument:
274 filename the file name
275 mode the mode required
276 error used for saying what failed
277
278Returns: a file descriptor, or -1 (with errno set)
279*/
280
281static int
282open_msglog_file(uschar *filename, int mode, uschar **error)
283{
284int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
285
286if (fd < 0 && errno == ENOENT)
287 {
288 uschar temp[16];
289 sprintf(CS temp, "msglog/%s", message_subdir);
290 if (message_subdir[0] == 0) temp[6] = 0;
291 (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
292 fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
293 }
294
295/* Set the close-on-exec flag and change the owner to the exim uid/gid (this
296function is called as root). Double check the mode, because the group setting
297doesn't always get set automatically. */
298
299if (fd >= 0)
300 {
ff790e47 301 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
059ec3d9
PH
302 if (fchown(fd, exim_uid, exim_gid) < 0)
303 {
304 *error = US"chown";
305 return -1;
306 }
307 if (fchmod(fd, mode) < 0)
308 {
309 *error = US"chmod";
310 return -1;
311 }
312 }
313else *error = US"create";
314
315return fd;
316}
317
318
319
320
321/*************************************************
322* Write to msglog if required *
323*************************************************/
324
325/* Write to the message log, if configured. This function may also be called
326from transports.
327
328Arguments:
329 format a string format
330
331Returns: nothing
332*/
333
334void
335deliver_msglog(const char *format, ...)
336{
337va_list ap;
338if (!message_logs) return;
339va_start(ap, format);
340vfprintf(message_log, format, ap);
341fflush(message_log);
342va_end(ap);
343}
344
345
346
347
348/*************************************************
349* Replicate status for batch *
350*************************************************/
351
352/* When a transport handles a batch of addresses, it may treat them
353individually, or it may just put the status in the first one, and return FALSE,
354requesting that the status be copied to all the others externally. This is the
355replication function. As well as the status, it copies the transport pointer,
356which may have changed if appendfile passed the addresses on to a different
357transport.
358
359Argument: pointer to the first address in a chain
360Returns: nothing
361*/
362
363static void
364replicate_status(address_item *addr)
365{
366address_item *addr2;
d6c82d7b 367for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9 368 {
d6c82d7b 369 addr2->transport = addr->transport;
059ec3d9 370 addr2->transport_return = addr->transport_return;
d6c82d7b
JH
371 addr2->basic_errno = addr->basic_errno;
372 addr2->more_errno = addr->more_errno;
373 addr2->special_action = addr->special_action;
374 addr2->message = addr->message;
375 addr2->user_message = addr->user_message;
059ec3d9
PH
376 }
377}
378
379
380
381/*************************************************
382* Compare lists of hosts *
383*************************************************/
384
385/* This function is given two pointers to chains of host items, and it yields
386TRUE if the lists refer to the same hosts in the same order, except that
387
388(1) Multiple hosts with the same non-negative MX values are permitted to appear
389 in different orders. Round-robinning nameservers can cause this to happen.
390
391(2) Multiple hosts with the same negative MX values less than MX_NONE are also
392 permitted to appear in different orders. This is caused by randomizing
393 hosts lists.
394
395This enables Exim to use a single SMTP transaction for sending to two entirely
396different domains that happen to end up pointing at the same hosts.
397
398Arguments:
399 one points to the first host list
400 two points to the second host list
401
402Returns: TRUE if the lists refer to the same host set
403*/
404
405static BOOL
406same_hosts(host_item *one, host_item *two)
407{
d6c82d7b 408while (one && two)
059ec3d9
PH
409 {
410 if (Ustrcmp(one->name, two->name) != 0)
411 {
412 int mx = one->mx;
413 host_item *end_one = one;
414 host_item *end_two = two;
415
416 /* Batch up only if there was no MX and the list was not randomized */
417
418 if (mx == MX_NONE) return FALSE;
419
420 /* Find the ends of the shortest sequence of identical MX values */
421
d6c82d7b
JH
422 while ( end_one->next && end_one->next->mx == mx
423 && end_two->next && end_two->next->mx == mx)
059ec3d9
PH
424 {
425 end_one = end_one->next;
426 end_two = end_two->next;
427 }
428
429 /* If there aren't any duplicates, there's no match. */
430
431 if (end_one == one) return FALSE;
432
433 /* For each host in the 'one' sequence, check that it appears in the 'two'
434 sequence, returning FALSE if not. */
435
436 for (;;)
437 {
438 host_item *hi;
439 for (hi = two; hi != end_two->next; hi = hi->next)
440 if (Ustrcmp(one->name, hi->name) == 0) break;
441 if (hi == end_two->next) return FALSE;
442 if (one == end_one) break;
443 one = one->next;
444 }
445
446 /* All the hosts in the 'one' sequence were found in the 'two' sequence.
447 Ensure both are pointing at the last host, and carry on as for equality. */
448
449 two = end_two;
450 }
451
452 /* Hosts matched */
453
454 one = one->next;
455 two = two->next;
456 }
457
458/* True if both are NULL */
459
460return (one == two);
461}
462
463
464
465/*************************************************
466* Compare header lines *
467*************************************************/
468
469/* This function is given two pointers to chains of header items, and it yields
470TRUE if they are the same header texts in the same order.
471
472Arguments:
473 one points to the first header list
474 two points to the second header list
475
476Returns: TRUE if the lists refer to the same header set
477*/
478
479static BOOL
480same_headers(header_line *one, header_line *two)
481{
d6c82d7b 482for (;; one = one->next, two = two->next)
059ec3d9
PH
483 {
484 if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 485 if (!one || !two) return FALSE;
059ec3d9 486 if (Ustrcmp(one->text, two->text) != 0) return FALSE;
059ec3d9
PH
487 }
488}
489
490
491
492/*************************************************
493* Compare string settings *
494*************************************************/
495
496/* This function is given two pointers to strings, and it returns
497TRUE if they are the same pointer, or if the two strings are the same.
498
499Arguments:
500 one points to the first string
501 two points to the second string
502
503Returns: TRUE or FALSE
504*/
505
506static BOOL
507same_strings(uschar *one, uschar *two)
508{
509if (one == two) return TRUE; /* Includes the case where both NULL */
d6c82d7b 510if (!one || !two) return FALSE;
059ec3d9
PH
511return (Ustrcmp(one, two) == 0);
512}
513
514
515
516/*************************************************
517* Compare uid/gid for addresses *
518*************************************************/
519
520/* This function is given a transport and two addresses. It yields TRUE if the
521uid/gid/initgroups settings for the two addresses are going to be the same when
522they are delivered.
523
524Arguments:
525 tp the transort
526 addr1 the first address
527 addr2 the second address
528
529Returns: TRUE or FALSE
530*/
531
532static BOOL
533same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
534{
d6c82d7b
JH
535if ( !tp->uid_set && !tp->expand_uid
536 && !tp->deliver_as_creator
537 && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
538 || ( testflag(addr1, af_uid_set)
539 && ( addr1->uid != addr2->uid
540 || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
541 ) ) ) )
542 return FALSE;
059ec3d9 543
d6c82d7b
JH
544if ( !tp->gid_set && !tp->expand_gid
545 && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
546 || ( testflag(addr1, af_gid_set)
547 && addr1->gid != addr2->gid
548 ) ) )
549 return FALSE;
059ec3d9
PH
550
551return TRUE;
552}
553
554
555
556
557/*************************************************
558* Record that an address is complete *
559*************************************************/
560
561/* This function records that an address is complete. This is straightforward
562for most addresses, where the unique address is just the full address with the
563domain lower cased. For homonyms (addresses that are the same as one of their
564ancestors) their are complications. Their unique addresses have \x\ prepended
565(where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
566cousins.
567
568Exim used to record the unique addresses of homonyms as "complete". This,
569however, fails when the pattern of redirection varies over time (e.g. if taking
570unseen copies at only some times of day) because the prepended numbers may vary
571from one delivery run to the next. This problem is solved by never recording
572prepended unique addresses as complete. Instead, when a homonymic address has
573actually been delivered via a transport, we record its basic unique address
574followed by the name of the transport. This is checked in subsequent delivery
575runs whenever an address is routed to a transport.
576
577If the completed address is a top-level one (has no parent, which means it
578cannot be homonymic) we also add the original address to the non-recipients
579tree, so that it gets recorded in the spool file and therefore appears as
580"done" in any spool listings. The original address may differ from the unique
581address in the case of the domain.
582
583Finally, this function scans the list of duplicates, marks as done any that
584match this address, and calls child_done() for their ancestors.
585
586Arguments:
587 addr address item that has been completed
588 now current time as a string
589
590Returns: nothing
591*/
592
593static void
594address_done(address_item *addr, uschar *now)
595{
596address_item *dup;
597
598update_spool = TRUE; /* Ensure spool gets updated */
599
600/* Top-level address */
601
d6c82d7b 602if (!addr->parent)
059ec3d9
PH
603 {
604 tree_add_nonrecipient(addr->unique);
605 tree_add_nonrecipient(addr->address);
606 }
607
608/* Homonymous child address */
609
610else if (testflag(addr, af_homonym))
611 {
d6c82d7b 612 if (addr->transport)
059ec3d9
PH
613 tree_add_nonrecipient(
614 string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
059ec3d9
PH
615 }
616
617/* Non-homonymous child address */
618
619else tree_add_nonrecipient(addr->unique);
620
621/* Check the list of duplicate addresses and ensure they are now marked
622done as well. */
623
d6c82d7b 624for (dup = addr_duplicate; dup; dup = dup->next)
059ec3d9
PH
625 if (Ustrcmp(addr->unique, dup->unique) == 0)
626 {
57730b52 627 tree_add_nonrecipient(dup->unique);
059ec3d9
PH
628 child_done(dup, now);
629 }
059ec3d9
PH
630}
631
632
633
634
635/*************************************************
636* Decrease counts in parents and mark done *
637*************************************************/
638
639/* This function is called when an address is complete. If there is a parent
640address, its count of children is decremented. If there are still other
641children outstanding, the function exits. Otherwise, if the count has become
642zero, address_done() is called to mark the parent and its duplicates complete.
643Then loop for any earlier ancestors.
644
645Arguments:
646 addr points to the completed address item
647 now the current time as a string, for writing to the message log
648
649Returns: nothing
650*/
651
652static void
653child_done(address_item *addr, uschar *now)
654{
655address_item *aa;
d6c82d7b 656while (addr->parent)
059ec3d9
PH
657 {
658 addr = addr->parent;
659 if ((addr->child_count -= 1) > 0) return; /* Incomplete parent */
660 address_done(addr, now);
661
662 /* Log the completion of all descendents only when there is no ancestor with
663 the same original address. */
664
d6c82d7b 665 for (aa = addr->parent; aa; aa = aa->parent)
059ec3d9 666 if (Ustrcmp(aa->address, addr->address) == 0) break;
d6c82d7b 667 if (aa) continue;
059ec3d9
PH
668
669 deliver_msglog("%s %s: children all complete\n", now, addr->address);
670 DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
671 }
672}
673
674
675
ac881e27
TF
676/*************************************************
677* Delivery logging support functions *
678*************************************************/
679
680/* The LOGGING() checks in d_log_interface() are complicated for backwards
681compatibility. When outgoing interface logging was originally added, it was
682conditional on just incoming_interface (which is off by default). The
683outgoing_interface option is on by default to preserve this behaviour, but
684you can enable incoming_interface and disable outgoing_interface to get I=
685fields on incoming lines only.
686
687Arguments:
688 s The log line buffer
689 sizep Pointer to the buffer size
690 ptrp Pointer to current index into buffer
691 addr The address to be logged
692
693Returns: New value for s
694*/
059ec3d9 695
67d81c10 696static uschar *
ac881e27 697d_log_interface(uschar *s, int *sizep, int *ptrp)
67d81c10 698{
ac881e27 699if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
d6c82d7b 700 && sending_ip_address)
ac881e27
TF
701 {
702 s = string_append(s, sizep, ptrp, 2, US" I=[", sending_ip_address);
d6c82d7b
JH
703 s = LOGGING(outgoing_port)
704 ? string_append(s, sizep, ptrp, 2, US"]:",
705 string_sprintf("%d", sending_port))
c2f669a4 706 : string_catn(s, sizep, ptrp, US"]", 1);
ac881e27
TF
707 }
708return s;
67d81c10
JH
709}
710
ac881e27
TF
711
712
713static uschar *
fc16abb4 714d_hostlog(uschar * s, int * sp, int * pp, address_item * addr)
ac881e27 715{
fc16abb4
JH
716host_item * h = addr->host_used;
717
718s = string_append(s, sp, pp, 2, US" H=", h->name);
719
720if (LOGGING(dnssec) && h->dnssec == DS_YES)
721 s = string_cat(s, sp, pp, US" DS");
722
723s = string_append(s, sp, pp, 3, US" [", h->address, US"]");
724
ac881e27 725if (LOGGING(outgoing_port))
fc16abb4 726 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d", h->port));
e6d2a989
JH
727
728#ifdef SUPPORT_SOCKS
729if (LOGGING(proxy) && proxy_local_address)
730 {
fc16abb4 731 s = string_append(s, sp, pp, 3, US" PRX=[", proxy_local_address, US"]");
e6d2a989 732 if (LOGGING(outgoing_port))
fc16abb4 733 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d",
e6d2a989
JH
734 proxy_local_port));
735 }
736#endif
737
fc16abb4 738return d_log_interface(s, sp, pp);
ac881e27
TF
739}
740
741
742
e6d2a989
JH
743
744
67d81c10
JH
745#ifdef SUPPORT_TLS
746static uschar *
747d_tlslog(uschar * s, int * sizep, int * ptrp, address_item * addr)
748{
d6c82d7b 749if (LOGGING(tls_cipher) && addr->cipher)
ac881e27 750 s = string_append(s, sizep, ptrp, 2, US" X=", addr->cipher);
d6c82d7b 751if (LOGGING(tls_certificate_verified) && addr->cipher)
ac881e27
TF
752 s = string_append(s, sizep, ptrp, 2, US" CV=",
753 testflag(addr, af_cert_verified)
754 ?
53a7196b 755#ifdef EXPERIMENTAL_DANE
ac881e27
TF
756 testflag(addr, af_dane_verified)
757 ? "dane"
758 :
53a7196b 759#endif
ac881e27
TF
760 "yes"
761 : "no");
d6c82d7b 762if (LOGGING(tls_peerdn) && addr->peerdn)
ac881e27
TF
763 s = string_append(s, sizep, ptrp, 3, US" DN=\"",
764 string_printing(addr->peerdn), US"\"");
765return s;
67d81c10
JH
766}
767#endif
768
a7538db1 769
14a465c3
JH
770
771
0cbf2b82 772#ifndef DISABLE_EVENT
b30275b8 773uschar *
55414b25 774event_raise(uschar * action, const uschar * event, uschar * ev_data)
a7538db1
JH
775{
776uschar * s;
777if (action)
778 {
779 DEBUG(D_deliver)
774ef2d7 780 debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
a7538db1
JH
781 event,
782 action, deliver_host_address);
783
774ef2d7
JH
784 event_name = event;
785 event_data = ev_data;
a7538db1
JH
786
787 if (!(s = expand_string(action)) && *expand_string_message)
788 log_write(0, LOG_MAIN|LOG_PANIC,
774ef2d7 789 "failed to expand event_action %s in %s: %s\n",
a7538db1
JH
790 event, transport_name, expand_string_message);
791
774ef2d7 792 event_name = event_data = NULL;
a7538db1
JH
793
794 /* If the expansion returns anything but an empty string, flag for
795 the caller to modify his normal processing
796 */
797 if (s && *s)
798 {
799 DEBUG(D_deliver)
774ef2d7 800 debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
b30275b8 801 return s;
a7538db1
JH
802 }
803 }
b30275b8 804return NULL;
a7538db1 805}
14a465c3 806
5ef5dd52 807void
55414b25 808msg_event_raise(const uschar * event, const address_item * addr)
14a465c3 809{
55414b25 810const uschar * save_domain = deliver_domain;
14a465c3 811uschar * save_local = deliver_localpart;
55414b25 812const uschar * save_host = deliver_host;
5ef5dd52
JB
813const uschar * save_address = deliver_host_address;
814const int save_port = deliver_host_port;
14a465c3
JH
815
816if (!addr->transport)
817 return;
818
819router_name = addr->router ? addr->router->name : NULL;
820transport_name = addr->transport->name;
821deliver_domain = addr->domain;
822deliver_localpart = addr->local_part;
c562fd30 823deliver_host = addr->host_used ? addr->host_used->name : NULL;
14a465c3 824
774ef2d7 825(void) event_raise(addr->transport->event_action, event,
5ef5dd52
JB
826 addr->host_used
827 || Ustrcmp(addr->transport->driver_name, "smtp") == 0
828 || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
829 ? addr->message : NULL);
14a465c3 830
5ef5dd52
JB
831deliver_host_port = save_port;
832deliver_host_address = save_address;
c562fd30 833deliver_host = save_host;
14a465c3
JH
834deliver_localpart = save_local;
835deliver_domain = save_domain;
836router_name = transport_name = NULL;
837}
0cbf2b82 838#endif /*DISABLE_EVENT*/
14a465c3
JH
839
840
a7538db1 841
817d9f57 842/* If msg is NULL this is a delivery log and logchar is used. Otherwise
67d81c10 843this is a nonstandard call; no two-character delivery flag is written
817d9f57
JH
844but sender-host and sender are prefixed and "msg" is inserted in the log line.
845
846Arguments:
847 flags passed to log_write()
848*/
e4bdf652 849void
817d9f57 850delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
e4bdf652
JH
851{
852uschar *log_address;
853int size = 256; /* Used for a temporary, */
854int ptr = 0; /* expanding buffer, for */
855uschar *s; /* building log lines; */
856void *reset_point; /* released afterwards. */
857
e4bdf652
JH
858/* Log the delivery on the main log. We use an extensible string to build up
859the log line, and reset the store afterwards. Remote deliveries should always
860have a pointer to the host item that succeeded; local deliveries can have a
861pointer to a single host item in their host list, for use by the transport. */
862
0cbf2b82 863#ifndef DISABLE_EVENT
a7538db1 864 /* presume no successful remote delivery */
783b385f 865 lookup_dnssec_authenticated = NULL;
d68218c7
JH
866#endif
867
e4bdf652 868s = reset_point = store_get(size);
e4bdf652 869
6c6d6e48 870log_address = string_log_address(addr, LOGGING(all_parents), TRUE);
817d9f57
JH
871if (msg)
872 s = string_append(s, &size, &ptr, 3, host_and_ident(TRUE), US" ", log_address);
873else
874 {
875 s[ptr++] = logchar;
876 s = string_append(s, &size, &ptr, 2, US"> ", log_address);
877 }
e4bdf652 878
6c6d6e48 879if (LOGGING(sender_on_delivery) || msg)
3c8b3577 880 s = string_append(s, &size, &ptr, 3, US" F=<",
8c5d388a 881#ifdef SUPPORT_I18N
3c8b3577
JH
882 testflag(addr, af_utf8_downcvt)
883 ? string_address_utf8_to_alabel(sender_address, NULL)
884 :
885#endif
886 sender_address,
887 US">");
e4bdf652
JH
888
889#ifdef EXPERIMENTAL_SRS
d43cbe25
JH
890if(addr->prop.srs_sender)
891 s = string_append(s, &size, &ptr, 3, US" SRS=<", addr->prop.srs_sender, US">");
e4bdf652
JH
892#endif
893
894/* You might think that the return path must always be set for a successful
895delivery; indeed, I did for some time, until this statement crashed. The case
896when it is not set is for a delivery to /dev/null which is optimised by not
897being run at all. */
898
d6c82d7b 899if (used_return_path && LOGGING(return_path_on_delivery))
e4bdf652
JH
900 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
901
817d9f57
JH
902if (msg)
903 s = string_append(s, &size, &ptr, 2, US" ", msg);
e4bdf652 904
817d9f57 905/* For a delivery from a system filter, there may not be a router */
d6c82d7b 906if (addr->router)
e4bdf652
JH
907 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
908
909s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
910
6c6d6e48 911if (LOGGING(delivery_size))
e4bdf652
JH
912 s = string_append(s, &size, &ptr, 2, US" S=",
913 string_sprintf("%d", transport_count));
914
915/* Local delivery */
916
917if (addr->transport->info->local)
918 {
a7538db1 919 if (addr->host_list)
e4bdf652 920 s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
ac881e27 921 s = d_log_interface(s, &size, &ptr);
d6c82d7b 922 if (addr->shadow_message)
c2f669a4 923 s = string_cat(s, &size, &ptr, addr->shadow_message);
e4bdf652
JH
924 }
925
926/* Remote delivery */
927
928else
929 {
783b385f 930 if (addr->host_used)
e4bdf652 931 {
67d81c10 932 s = d_hostlog(s, &size, &ptr, addr);
e4bdf652 933 if (continue_sequence > 1)
c2f669a4 934 s = string_catn(s, &size, &ptr, US"*", 1);
d68218c7 935
0cbf2b82 936#ifndef DISABLE_EVENT
a7538db1
JH
937 deliver_host_address = addr->host_used->address;
938 deliver_host_port = addr->host_used->port;
029f4192 939 deliver_host = addr->host_used->name;
783b385f
JH
940
941 /* DNS lookup status */
942 lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
943 : addr->host_used->dnssec==DS_NO ? US"no"
944 : NULL;
a7538db1 945#endif
e4bdf652
JH
946 }
947
a7538db1 948#ifdef SUPPORT_TLS
67d81c10 949 s = d_tlslog(s, &size, &ptr, addr);
a7538db1 950#endif
e4bdf652 951
018c60d7 952 if (addr->authenticator)
6f123593 953 {
018c60d7
JH
954 s = string_append(s, &size, &ptr, 2, US" A=", addr->authenticator);
955 if (addr->auth_id)
c8e2fc1e 956 {
018c60d7 957 s = string_append(s, &size, &ptr, 2, US":", addr->auth_id);
6c6d6e48 958 if (LOGGING(smtp_mailauth) && addr->auth_sndr)
018c60d7 959 s = string_append(s, &size, &ptr, 2, US":", addr->auth_sndr);
c8e2fc1e 960 }
6f123593
JH
961 }
962
a7538db1 963#ifndef DISABLE_PRDR
fd98a5c6
JH
964 if (addr->flags & af_prdr_used)
965 s = string_append(s, &size, &ptr, 1, US" PRDR");
a7538db1 966#endif
76f44207
WB
967 }
968
969/* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
fd98a5c6 970
d6c82d7b
JH
971if ( LOGGING(smtp_confirmation)
972 && addr->message
973 && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
974 )
76f44207 975 {
b980ed83 976 unsigned i;
1c5b1499 977 unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
76f44207
WB
978 uschar *p = big_buffer;
979 uschar *ss = addr->message;
980 *p++ = '\"';
b980ed83 981 for (i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
e4bdf652 982 {
27520a68 983 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
76f44207 984 *p++ = ss[i];
e4bdf652 985 }
76f44207
WB
986 *p++ = '\"';
987 *p = 0;
988 s = string_append(s, &size, &ptr, 2, US" C=", big_buffer);
e4bdf652
JH
989 }
990
991/* Time on queue and actual time taken to deliver */
992
6c6d6e48 993if (LOGGING(queue_time))
e4bdf652 994 s = string_append(s, &size, &ptr, 2, US" QT=",
19050083 995 readconf_printtime( (int) ((long)time(NULL) - (long)received_time)) );
e4bdf652 996
6c6d6e48 997if (LOGGING(deliver_time))
e4bdf652
JH
998 s = string_append(s, &size, &ptr, 2, US" DT=",
999 readconf_printtime(addr->more_errno));
e4bdf652
JH
1000
1001/* string_cat() always leaves room for the terminator. Release the
1002store we used to build the line after writing it. */
1003
1004s[ptr] = 0;
817d9f57 1005log_write(0, flags, "%s", s);
d68218c7 1006
0cbf2b82 1007#ifndef DISABLE_EVENT
774ef2d7 1008if (!msg) msg_event_raise(US"msg:delivery", addr);
d68218c7 1009#endif
14a465c3 1010
e4bdf652
JH
1011store_reset(reset_point);
1012return;
1013}
1014
1015
1016
059ec3d9
PH
1017/*************************************************
1018* Actions at the end of handling an address *
1019*************************************************/
1020
1021/* This is a function for processing a single address when all that can be done
1022with it has been done.
1023
1024Arguments:
1025 addr points to the address block
1026 result the result of the delivery attempt
1027 logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
1028 driver_type indicates which type of driver (transport, or router) was last
1029 to process the address
1030 logchar '=' or '-' for use when logging deliveries with => or ->
1031
1032Returns: nothing
1033*/
1034
1035static void
1036post_process_one(address_item *addr, int result, int logflags, int driver_type,
1037 int logchar)
1038{
1039uschar *now = tod_stamp(tod_log);
1040uschar *driver_kind = NULL;
1041uschar *driver_name = NULL;
1042uschar *log_address;
1043
1044int size = 256; /* Used for a temporary, */
1045int ptr = 0; /* expanding buffer, for */
1046uschar *s; /* building log lines; */
1047void *reset_point; /* released afterwards. */
1048
059ec3d9
PH
1049DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
1050
1051/* Set up driver kind and name for logging. Disable logging if the router or
1052transport has disabled it. */
1053
1054if (driver_type == DTYPE_TRANSPORT)
1055 {
d6c82d7b 1056 if (addr->transport)
059ec3d9
PH
1057 {
1058 driver_name = addr->transport->name;
1059 driver_kind = US" transport";
1060 disable_logging = addr->transport->disable_logging;
1061 }
1062 else driver_kind = US"transporting";
1063 }
1064else if (driver_type == DTYPE_ROUTER)
1065 {
d6c82d7b 1066 if (addr->router)
059ec3d9
PH
1067 {
1068 driver_name = addr->router->name;
1069 driver_kind = US" router";
1070 disable_logging = addr->router->disable_logging;
1071 }
1072 else driver_kind = US"routing";
1073 }
1074
1075/* If there's an error message set, ensure that it contains only printing
1076characters - it should, but occasionally things slip in and this at least
49c2d5ea
PH
1077stops the log format from getting wrecked. We also scan the message for an LDAP
1078expansion item that has a password setting, and flatten the password. This is a
1079fudge, but I don't know a cleaner way of doing this. (If the item is badly
1080malformed, it won't ever have gone near LDAP.) */
059ec3d9 1081
d6c82d7b 1082if (addr->message)
49c2d5ea 1083 {
55414b25 1084 const uschar * s = string_printing(addr->message);
f42deca9
JH
1085
1086 /* deconst cast ok as string_printing known to have alloc'n'copied */
1087 addr->message = expand_hide_passwords(US s);
49c2d5ea 1088 }
059ec3d9
PH
1089
1090/* If we used a transport that has one of the "return_output" options set, and
1091if it did in fact generate some output, then for return_output we treat the
1092message as failed if it was not already set that way, so that the output gets
1093returned to the sender, provided there is a sender to send it to. For
1094return_fail_output, do this only if the delivery failed. Otherwise we just
1095unlink the file, and remove the name so that if the delivery failed, we don't
1096try to send back an empty or unwanted file. The log_output options operate only
1097on a non-empty file.
1098
1099In any case, we close the message file, because we cannot afford to leave a
1100file-descriptor for one address while processing (maybe very many) others. */
1101
d6c82d7b 1102if (addr->return_file >= 0 && addr->return_filename)
059ec3d9
PH
1103 {
1104 BOOL return_output = FALSE;
1105 struct stat statbuf;
54fc8428 1106 (void)EXIMfsync(addr->return_file);
059ec3d9
PH
1107
1108 /* If there is no output, do nothing. */
1109
1110 if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
1111 {
1112 transport_instance *tb = addr->transport;
1113
1114 /* Handle logging options */
1115
d6c82d7b
JH
1116 if ( tb->log_output
1117 || result == FAIL && tb->log_fail_output
1118 || result == DEFER && tb->log_defer_output
1119 )
059ec3d9
PH
1120 {
1121 uschar *s;
1122 FILE *f = Ufopen(addr->return_filename, "rb");
d6c82d7b 1123 if (!f)
059ec3d9
PH
1124 log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
1125 "from %s transport: %s", addr->return_filename, tb->name,
1126 strerror(errno));
1127 else
d6c82d7b 1128 if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
059ec3d9
PH
1129 {
1130 uschar *p = big_buffer + Ustrlen(big_buffer);
55414b25 1131 const uschar * sp;
059ec3d9
PH
1132 while (p > big_buffer && isspace(p[-1])) p--;
1133 *p = 0;
55414b25 1134 sp = string_printing(big_buffer);
059ec3d9 1135 log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
55414b25 1136 addr->address, tb->name, sp);
059ec3d9 1137 }
f1e894f3 1138 (void)fclose(f);
059ec3d9
PH
1139 }
1140
1141 /* Handle returning options, but only if there is an address to return
1142 the text to. */
1143
d6c82d7b 1144 if (sender_address[0] != 0 || addr->prop.errors_address)
059ec3d9
PH
1145 if (tb->return_output)
1146 {
1147 addr->transport_return = result = FAIL;
d6c82d7b 1148 if (addr->basic_errno == 0 && !addr->message)
059ec3d9
PH
1149 addr->message = US"return message generated";
1150 return_output = TRUE;
1151 }
1152 else
1153 if (tb->return_fail_output && result == FAIL) return_output = TRUE;
059ec3d9
PH
1154 }
1155
1156 /* Get rid of the file unless it might be returned, but close it in
1157 all cases. */
1158
1159 if (!return_output)
1160 {
1161 Uunlink(addr->return_filename);
1162 addr->return_filename = NULL;
1163 addr->return_file = -1;
1164 }
1165
f1e894f3 1166 (void)close(addr->return_file);
059ec3d9
PH
1167 }
1168
9d1c15ef 1169/* The success case happens only after delivery by a transport. */
059ec3d9
PH
1170
1171if (result == OK)
1172 {
1173 addr->next = addr_succeed;
1174 addr_succeed = addr;
1175
1176 /* Call address_done() to ensure that we don't deliver to this address again,
1177 and write appropriate things to the message log. If it is a child address, we
1178 call child_done() to scan the ancestors and mark them complete if this is the
1179 last child to complete. */
1180
1181 address_done(addr, now);
1182 DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
1183
d6c82d7b 1184 if (!addr->parent)
059ec3d9
PH
1185 deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
1186 driver_name, driver_kind);
059ec3d9
PH
1187 else
1188 {
1189 deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
1190 addr->parent->address, driver_name, driver_kind);
1191 child_done(addr, now);
1192 }
1193
774ef2d7 1194 /* Certificates for logging (via events) */
a7538db1 1195#ifdef SUPPORT_TLS
9d1c15ef
JH
1196 tls_out.ourcert = addr->ourcert;
1197 addr->ourcert = NULL;
1198 tls_out.peercert = addr->peercert;
1199 addr->peercert = NULL;
018058b2 1200
018058b2
JH
1201 tls_out.cipher = addr->cipher;
1202 tls_out.peerdn = addr->peerdn;
1203 tls_out.ocsp = addr->ocsp;
83b27293
JH
1204# ifdef EXPERIMENTAL_DANE
1205 tls_out.dane_verified = testflag(addr, af_dane_verified);
1206# endif
a7538db1 1207#endif
9d1c15ef 1208
817d9f57 1209 delivery_log(LOG_MAIN, addr, logchar, NULL);
9d1c15ef 1210
a7538db1 1211#ifdef SUPPORT_TLS
790fbb71
JH
1212 tls_free_cert(&tls_out.ourcert);
1213 tls_free_cert(&tls_out.peercert);
018058b2
JH
1214 tls_out.cipher = NULL;
1215 tls_out.peerdn = NULL;
1216 tls_out.ocsp = OCSP_NOT_REQ;
83b27293
JH
1217# ifdef EXPERIMENTAL_DANE
1218 tls_out.dane_verified = FALSE;
1219# endif
a7538db1 1220#endif
059ec3d9
PH
1221 }
1222
1223
1224/* Soft failure, or local delivery process failed; freezing may be
1225requested. */
1226
1227else if (result == DEFER || result == PANIC)
1228 {
1229 if (result == PANIC) logflags |= LOG_PANIC;
1230
1231 /* This puts them on the chain in reverse order. Do not change this, because
1232 the code for handling retries assumes that the one with the retry
1233 information is last. */
1234
1235 addr->next = addr_defer;
1236 addr_defer = addr;
1237
1238 /* The only currently implemented special action is to freeze the
1239 message. Logging of this is done later, just before the -H file is
1240 updated. */
1241
1242 if (addr->special_action == SPECIAL_FREEZE)
1243 {
1244 deliver_freeze = TRUE;
1245 deliver_frozen_at = time(NULL);
1246 update_spool = TRUE;
1247 }
1248
1249 /* If doing a 2-stage queue run, we skip writing to either the message
1250 log or the main log for SMTP defers. */
1251
1252 if (!queue_2stage || addr->basic_errno != 0)
1253 {
1254 uschar ss[32];
1255
1256 /* For errors of the type "retry time not reached" (also remotes skipped
1257 on queue run), logging is controlled by L_retry_defer. Note that this kind
1258 of error number is negative, and all the retry ones are less than any
1259 others. */
1260
d6c82d7b
JH
1261 unsigned int use_log_selector = addr->basic_errno <= ERRNO_RETRY_BASE
1262 ? L_retry_defer : 0;
059ec3d9
PH
1263
1264 /* Build up the line that is used for both the message log and the main
1265 log. */
1266
1267 s = reset_point = store_get(size);
e4bdf652
JH
1268
1269 /* Create the address string for logging. Must not do this earlier, because
1270 an OK result may be changed to FAIL when a pipe returns text. */
1271
6c6d6e48 1272 log_address = string_log_address(addr, LOGGING(all_parents), result == OK);
e4bdf652 1273
c2f669a4 1274 s = string_cat(s, &size, &ptr, log_address);
059ec3d9
PH
1275
1276 /* Either driver_name contains something and driver_kind contains
1277 " router" or " transport" (note the leading space), or driver_name is
1278 a null string and driver_kind contains "routing" without the leading
1279 space, if all routing has been deferred. When a domain has been held,
1280 so nothing has been done at all, both variables contain null strings. */
1281
d6c82d7b 1282 if (driver_name)
059ec3d9 1283 {
d6c82d7b 1284 if (driver_kind[1] == 't' && addr->router)
059ec3d9
PH
1285 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1286 Ustrcpy(ss, " ?=");
1287 ss[1] = toupper(driver_kind[1]);
1288 s = string_append(s, &size, &ptr, 2, ss, driver_name);
1289 }
d6c82d7b
JH
1290 else if (driver_kind)
1291 s = string_append(s, &size, &ptr, 2, US" ", driver_kind);
059ec3d9
PH
1292
1293 sprintf(CS ss, " defer (%d)", addr->basic_errno);
c2f669a4 1294 s = string_cat(s, &size, &ptr, ss);
059ec3d9
PH
1295
1296 if (addr->basic_errno > 0)
1297 s = string_append(s, &size, &ptr, 2, US": ",
1298 US strerror(addr->basic_errno));
1299
c562fd30 1300 if (addr->host_used)
1a47b633 1301 {
c562fd30
JH
1302 s = string_append(s, &size, &ptr, 5,
1303 US" H=", addr->host_used->name,
1304 US" [", addr->host_used->address, US"]");
1a47b633
JH
1305 if (LOGGING(outgoing_port))
1306 {
1307 int port = addr->host_used->port;
1308 s = string_append(s, &size, &ptr, 2,
1309 US":", port == PORT_NONE ? US"25" : string_sprintf("%d", port));
1310 }
1311 }
c562fd30 1312
d6c82d7b 1313 if (addr->message)
059ec3d9
PH
1314 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1315
1316 s[ptr] = 0;
1317
1318 /* Log the deferment in the message log, but don't clutter it
1319 up with retry-time defers after the first delivery attempt. */
1320
1321 if (deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
1322 deliver_msglog("%s %s\n", now, s);
1323
1324 /* Write the main log and reset the store */
1325
1326 log_write(use_log_selector, logflags, "== %s", s);
1327 store_reset(reset_point);
1328 }
1329 }
1330
1331
1332/* Hard failure. If there is an address to which an error message can be sent,
1333put this address on the failed list. If not, put it on the deferred list and
1334freeze the mail message for human attention. The latter action can also be
1335explicitly requested by a router or transport. */
1336
1337else
1338 {
1339 /* If this is a delivery error, or a message for which no replies are
1340 wanted, and the message's age is greater than ignore_bounce_errors_after,
1341 force the af_ignore_error flag. This will cause the address to be discarded
1342 later (with a log entry). */
1343
1344 if (sender_address[0] == 0 && message_age >= ignore_bounce_errors_after)
1345 setflag(addr, af_ignore_error);
1346
1347 /* Freeze the message if requested, or if this is a bounce message (or other
652e1b65
PH
1348 message with null sender) and this address does not have its own errors
1349 address. However, don't freeze if errors are being ignored. The actual code
1350 to ignore occurs later, instead of sending a message. Logging of freezing
1351 occurs later, just before writing the -H file. */
059ec3d9 1352
d6c82d7b
JH
1353 if ( !testflag(addr, af_ignore_error)
1354 && ( addr->special_action == SPECIAL_FREEZE
1355 || (sender_address[0] == 0 && !addr->prop.errors_address)
1356 ) )
059ec3d9 1357 {
d6c82d7b
JH
1358 frozen_info = addr->special_action == SPECIAL_FREEZE
1359 ? US""
1360 : sender_local && !local_error_message
1361 ? US" (message created with -f <>)"
1362 : US" (delivery error message)";
059ec3d9
PH
1363 deliver_freeze = TRUE;
1364 deliver_frozen_at = time(NULL);
1365 update_spool = TRUE;
1366
1367 /* The address is put on the defer rather than the failed queue, because
1368 the message is being retained. */
1369
1370 addr->next = addr_defer;
1371 addr_defer = addr;
1372 }
1373
1374 /* Don't put the address on the nonrecipients tree yet; wait until an
1375 error message has been successfully sent. */
1376
1377 else
1378 {
1379 addr->next = addr_failed;
1380 addr_failed = addr;
1381 }
1382
1383 /* Build up the log line for the message and main logs */
1384
1385 s = reset_point = store_get(size);
e4bdf652
JH
1386
1387 /* Create the address string for logging. Must not do this earlier, because
1388 an OK result may be changed to FAIL when a pipe returns text. */
1389
6c6d6e48 1390 log_address = string_log_address(addr, LOGGING(all_parents), result == OK);
e4bdf652 1391
c2f669a4 1392 s = string_cat(s, &size, &ptr, log_address);
059ec3d9 1393
6c6d6e48 1394 if (LOGGING(sender_on_delivery))
059ec3d9
PH
1395 s = string_append(s, &size, &ptr, 3, US" F=<", sender_address, US">");
1396
1397 /* Return path may not be set if no delivery actually happened */
1398
d6c82d7b 1399 if (used_return_path && LOGGING(return_path_on_delivery))
059ec3d9 1400 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
059ec3d9 1401
d6c82d7b 1402 if (addr->router)
059ec3d9 1403 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
d6c82d7b 1404 if (addr->transport)
059ec3d9
PH
1405 s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
1406
d6c82d7b 1407 if (addr->host_used)
67d81c10
JH
1408 s = d_hostlog(s, &size, &ptr, addr);
1409
a7538db1 1410#ifdef SUPPORT_TLS
67d81c10 1411 s = d_tlslog(s, &size, &ptr, addr);
a7538db1 1412#endif
059ec3d9
PH
1413
1414 if (addr->basic_errno > 0)
1415 s = string_append(s, &size, &ptr, 2, US": ",
1416 US strerror(addr->basic_errno));
1417
d6c82d7b 1418 if (addr->message)
059ec3d9
PH
1419 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1420
1421 s[ptr] = 0;
1422
1423 /* Do the logging. For the message log, "routing failed" for those cases,
1424 just to make it clearer. */
1425
d6c82d7b 1426 if (driver_name)
059ec3d9 1427 deliver_msglog("%s %s\n", now, s);
d6c82d7b
JH
1428 else
1429 deliver_msglog("%s %s failed for %s\n", now, driver_kind, s);
059ec3d9
PH
1430
1431 log_write(0, LOG_MAIN, "** %s", s);
14a465c3 1432
0cbf2b82 1433#ifndef DISABLE_EVENT
774ef2d7 1434 msg_event_raise(US"msg:fail:delivery", addr);
14a465c3
JH
1435#endif
1436
059ec3d9
PH
1437 store_reset(reset_point);
1438 }
1439
1440/* Ensure logging is turned on again in all cases */
1441
1442disable_logging = FALSE;
1443}
1444
1445
1446
1447
1448/*************************************************
1449* Address-independent error *
1450*************************************************/
1451
1452/* This function is called when there's an error that is not dependent on a
1453particular address, such as an expansion string failure. It puts the error into
1454all the addresses in a batch, logs the incident on the main and panic logs, and
1455clears the expansions. It is mostly called from local_deliver(), but can be
1456called for a remote delivery via findugid().
1457
1458Arguments:
1459 logit TRUE if (MAIN+PANIC) logging required
1460 addr the first of the chain of addresses
1461 code the error code
1462 format format string for error message, or NULL if already set in addr
1463 ... arguments for the format
1464
1465Returns: nothing
1466*/
1467
1468static void
1469common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
1470{
1471address_item *addr2;
1472addr->basic_errno = code;
1473
d6c82d7b 1474if (format)
059ec3d9
PH
1475 {
1476 va_list ap;
1477 uschar buffer[512];
1478 va_start(ap, format);
1479 if (!string_vformat(buffer, sizeof(buffer), CS format, ap))
1480 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
81f91683 1481 "common_error expansion was longer than " SIZE_T_FMT, sizeof(buffer));
059ec3d9
PH
1482 va_end(ap);
1483 addr->message = string_copy(buffer);
1484 }
1485
d6c82d7b 1486for (addr2 = addr->next; addr2; addr2 = addr2->next)
059ec3d9
PH
1487 {
1488 addr2->basic_errno = code;
1489 addr2->message = addr->message;
1490 }
1491
1492if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
1493deliver_set_expansions(NULL);
1494}
1495
1496
1497
1498
1499/*************************************************
1500* Check a "never users" list *
1501*************************************************/
1502
1503/* This function is called to check whether a uid is on one of the two "never
1504users" lists.
1505
1506Arguments:
1507 uid the uid to be checked
1508 nusers the list to be scanned; the first item in the list is the count
1509
1510Returns: TRUE if the uid is on the list
1511*/
1512
1513static BOOL
1514check_never_users(uid_t uid, uid_t *nusers)
1515{
1516int i;
d6c82d7b 1517if (!nusers) return FALSE;
059ec3d9
PH
1518for (i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
1519return FALSE;
1520}
1521
1522
1523
1524/*************************************************
1525* Find uid and gid for a transport *
1526*************************************************/
1527
1528/* This function is called for both local and remote deliveries, to find the
1529uid/gid under which to run the delivery. The values are taken preferentially
1530from the transport (either explicit or deliver_as_creator), then from the
1531address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
1532the resulting uid is on the "never_users" or the "fixed_never_users" list, a
1533panic error is logged, and the function fails (which normally leads to delivery
1534deferral).
1535
1536Arguments:
1537 addr the address (possibly a chain)
1538 tp the transport
1539 uidp pointer to uid field
1540 gidp pointer to gid field
1541 igfp pointer to the use_initgroups field
1542
1543Returns: FALSE if failed - error has been set in address(es)
1544*/
1545
1546static BOOL
1547findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
1548 BOOL *igfp)
1549{
d6c82d7b 1550uschar *nuname;
059ec3d9
PH
1551BOOL gid_set = FALSE;
1552
1553/* Default initgroups flag comes from the transport */
1554
1555*igfp = tp->initgroups;
1556
1557/* First see if there's a gid on the transport, either fixed or expandable.
1558The expanding function always logs failure itself. */
1559
1560if (tp->gid_set)
1561 {
1562 *gidp = tp->gid;
1563 gid_set = TRUE;
1564 }
d6c82d7b 1565else if (tp->expand_gid)
059ec3d9 1566 {
d6c82d7b
JH
1567 if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
1568 &(addr->message)))
059ec3d9
PH
1569 {
1570 common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
1571 return FALSE;
1572 }
d6c82d7b 1573 gid_set = TRUE;
059ec3d9
PH
1574 }
1575
911f6fde
PH
1576/* If the transport did not set a group, see if the router did. */
1577
1578if (!gid_set && testflag(addr, af_gid_set))
1579 {
1580 *gidp = addr->gid;
1581 gid_set = TRUE;
1582 }
1583
059ec3d9
PH
1584/* Pick up a uid from the transport if one is set. */
1585
1586if (tp->uid_set) *uidp = tp->uid;
1587
1588/* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
1589it does not provide a passwd value from which a gid can be taken. */
1590
d6c82d7b 1591else if (tp->expand_uid)
059ec3d9
PH
1592 {
1593 struct passwd *pw;
1594 if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
1595 uidp, &(addr->message)))
1596 {
1597 common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
1598 return FALSE;
1599 }
d6c82d7b 1600 if (!gid_set && pw)
059ec3d9
PH
1601 {
1602 *gidp = pw->pw_gid;
1603 gid_set = TRUE;
1604 }
1605 }
1606
1607/* If the transport doesn't set the uid, test the deliver_as_creator flag. */
1608
1609else if (tp->deliver_as_creator)
1610 {
1611 *uidp = originator_uid;
1612 if (!gid_set)
1613 {
1614 *gidp = originator_gid;
1615 gid_set = TRUE;
1616 }
1617 }
1618
911f6fde
PH
1619/* Otherwise see if the address specifies the uid and if so, take it and its
1620initgroups flag. */
059ec3d9
PH
1621
1622else if (testflag(addr, af_uid_set))
1623 {
1624 *uidp = addr->uid;
1625 *igfp = testflag(addr, af_initgroups);
059ec3d9
PH
1626 }
1627
1628/* Nothing has specified the uid - default to the Exim user, and group if the
1629gid is not set. */
1630
1631else
1632 {
1633 *uidp = exim_uid;
1634 if (!gid_set)
1635 {
1636 *gidp = exim_gid;
1637 gid_set = TRUE;
1638 }
1639 }
1640
911f6fde
PH
1641/* If no gid is set, it is a disaster. We default to the Exim gid only if
1642defaulting to the Exim uid. In other words, if the configuration has specified
1643a uid, it must also provide a gid. */
059ec3d9
PH
1644
1645if (!gid_set)
1646 {
1647 common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
1648 "%s transport", tp->name);
1649 return FALSE;
1650 }
1651
1652/* Check that the uid is not on the lists of banned uids that may not be used
1653for delivery processes. */
1654
d6c82d7b
JH
1655nuname = check_never_users(*uidp, never_users)
1656 ? US"never_users"
1657 : check_never_users(*uidp, fixed_never_users)
1658 ? US"fixed_never_users"
1659 : NULL;
1660if (nuname)
059ec3d9
PH
1661 {
1662 common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
1663 "is on the %s list", (long int)(*uidp), tp->name, nuname);
1664 return FALSE;
1665 }
1666
1667/* All is well */
1668
1669return TRUE;
1670}
1671
1672
1673
1674
1675/*************************************************
1676* Check the size of a message for a transport *
1677*************************************************/
1678
1679/* Checks that the message isn't too big for the selected transport.
1680This is called only when it is known that the limit is set.
1681
1682Arguments:
1683 tp the transport
1684 addr the (first) address being delivered
1685
1686Returns: OK
1687 DEFER expansion failed or did not yield an integer
1688 FAIL message too big
1689*/
1690
1691int
1692check_message_size(transport_instance *tp, address_item *addr)
1693{
1694int rc = OK;
1695int size_limit;
1696
1697deliver_set_expansions(addr);
d45b1de8 1698size_limit = expand_string_integer(tp->message_size_limit, TRUE);
059ec3d9
PH
1699deliver_set_expansions(NULL);
1700
d6c82d7b 1701if (expand_string_message)
059ec3d9
PH
1702 {
1703 rc = DEFER;
d6c82d7b
JH
1704 addr->message = size_limit == -1
1705 ? string_sprintf("failed to expand message_size_limit "
1706 "in %s transport: %s", tp->name, expand_string_message)
1707 : string_sprintf("invalid message_size_limit "
059ec3d9
PH
1708 "in %s transport: %s", tp->name, expand_string_message);
1709 }
1710else if (size_limit > 0 && message_size > size_limit)
1711 {
1712 rc = FAIL;
1713 addr->message =
1714 string_sprintf("message is too big (transport limit = %d)",
1715 size_limit);
1716 }
1717
1718return rc;
1719}
1720
1721
1722
1723/*************************************************
1724* Transport-time check for a previous delivery *
1725*************************************************/
1726
1727/* Check that this base address hasn't previously been delivered to its routed
c2c19e9d
PH
1728transport. If it has been delivered, mark it done. The check is necessary at
1729delivery time in order to handle homonymic addresses correctly in cases where
1730the pattern of redirection changes between delivery attempts (so the unique
1731fields change). Non-homonymic previous delivery is detected earlier, at routing
1732time (which saves unnecessary routing).
1733
1734Arguments:
1735 addr the address item
1736 testing TRUE if testing wanted only, without side effects
059ec3d9 1737
059ec3d9
PH
1738Returns: TRUE if previously delivered by the transport
1739*/
1740
1741static BOOL
c2c19e9d 1742previously_transported(address_item *addr, BOOL testing)
059ec3d9
PH
1743{
1744(void)string_format(big_buffer, big_buffer_size, "%s/%s",
1745 addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
1746
1747if (tree_search(tree_nonrecipients, big_buffer) != 0)
1748 {
1749 DEBUG(D_deliver|D_route|D_transport)
1750 debug_printf("%s was previously delivered (%s transport): discarded\n",
1751 addr->address, addr->transport->name);
c2c19e9d 1752 if (!testing) child_done(addr, tod_stamp(tod_log));
059ec3d9
PH
1753 return TRUE;
1754 }
1755
1756return FALSE;
1757}
1758
1759
1760
064a94c9
PH
1761/******************************************************
1762* Check for a given header in a header string *
1763******************************************************/
1764
1765/* This function is used when generating quota warnings. The configuration may
1766specify any header lines it likes in quota_warn_message. If certain of them are
1767missing, defaults are inserted, so we need to be able to test for the presence
1768of a given header.
1769
1770Arguments:
1771 hdr the required header name
1772 hstring the header string
1773
1774Returns: TRUE the header is in the string
1775 FALSE the header is not in the string
1776*/
1777
1778static BOOL
1779contains_header(uschar *hdr, uschar *hstring)
1780{
1781int len = Ustrlen(hdr);
1782uschar *p = hstring;
1783while (*p != 0)
1784 {
1785 if (strncmpic(p, hdr, len) == 0)
1786 {
1787 p += len;
1788 while (*p == ' ' || *p == '\t') p++;
1789 if (*p == ':') return TRUE;
1790 }
1791 while (*p != 0 && *p != '\n') p++;
1792 if (*p == '\n') p++;
1793 }
1794return FALSE;
1795}
1796
1797
1798
059ec3d9
PH
1799
1800/*************************************************
1801* Perform a local delivery *
1802*************************************************/
1803
1804/* Each local delivery is performed in a separate process which sets its
1805uid and gid as specified. This is a safer way than simply changing and
1806restoring using seteuid(); there is a body of opinion that seteuid() cannot be
1807used safely. From release 4, Exim no longer makes any use of it. Besides, not
1808all systems have seteuid().
1809
1810If the uid/gid are specified in the transport_instance, they are used; the
1811transport initialization must ensure that either both or neither are set.
1812Otherwise, the values associated with the address are used. If neither are set,
1813it is a configuration error.
1814
1815The transport or the address may specify a home directory (transport over-
1816rides), and if they do, this is set as $home. If neither have set a working
1817directory, this value is used for that as well. Otherwise $home is left unset
1818and the cwd is set to "/" - a directory that should be accessible to all users.
1819
1820Using a separate process makes it more complicated to get error information
1821back. We use a pipe to pass the return code and also an error code and error
1822text string back to the parent process.
1823
1824Arguments:
1825 addr points to an address block for this delivery; for "normal" local
1826 deliveries this is the only address to be delivered, but for
1827 pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
1828 a number of addresses can be handled simultaneously, and in this
1829 case addr will point to a chain of addresses with the same
1830 characteristics.
1831
1832 shadowing TRUE if running a shadow transport; this causes output from pipes
1833 to be ignored.
1834
1835Returns: nothing
1836*/
1837
1838static void
1839deliver_local(address_item *addr, BOOL shadowing)
1840{
1841BOOL use_initgroups;
1842uid_t uid;
1843gid_t gid;
1844int status, len, rc;
1845int pfd[2];
1846pid_t pid;
1847uschar *working_directory;
1848address_item *addr2;
1849transport_instance *tp = addr->transport;
1850
1851/* Set up the return path from the errors or sender address. If the transport
1852has its own return path setting, expand it and replace the existing value. */
1853
d6c82d7b 1854if(addr->prop.errors_address)
d43cbe25 1855 return_path = addr->prop.errors_address;
384152a6 1856#ifdef EXPERIMENTAL_SRS
d6c82d7b 1857else if (addr->prop.srs_sender)
d43cbe25 1858 return_path = addr->prop.srs_sender;
384152a6
TK
1859#endif
1860else
1861 return_path = sender_address;
059ec3d9 1862
d6c82d7b 1863if (tp->return_path)
059ec3d9
PH
1864 {
1865 uschar *new_return_path = expand_string(tp->return_path);
d6c82d7b 1866 if (!new_return_path)
059ec3d9
PH
1867 {
1868 if (!expand_string_forcedfail)
1869 {
1870 common_error(TRUE, addr, ERRNO_EXPANDFAIL,
1871 US"Failed to expand return path \"%s\" in %s transport: %s",
1872 tp->return_path, tp->name, expand_string_message);
1873 return;
1874 }
1875 }
1876 else return_path = new_return_path;
1877 }
1878
1879/* For local deliveries, one at a time, the value used for logging can just be
1880set directly, once and for all. */
1881
1882used_return_path = return_path;
1883
1884/* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
1885gets put into the address(es), and the expansions are unset, so we can just
1886return. */
1887
1888if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
1889
5418e93b
PH
1890/* See if either the transport or the address specifies a home directory. A
1891home directory set in the address may already be expanded; a flag is set to
1892indicate that. In other cases we must expand it. */
059ec3d9 1893
d6c82d7b
JH
1894if ( (deliver_home = tp->home_dir) /* Set in transport, or */
1895 || ( (deliver_home = addr->home_dir) /* Set in address and */
1896 && !testflag(addr, af_home_expanded) /* not expanded */
1897 ) )
059ec3d9
PH
1898 {
1899 uschar *rawhome = deliver_home;
1900 deliver_home = NULL; /* in case it contains $home */
d6c82d7b 1901 if (!(deliver_home = expand_string(rawhome)))
059ec3d9
PH
1902 {
1903 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
1904 "to expand for %s transport: %s", rawhome, tp->name,
1905 expand_string_message);
1906 return;
1907 }
1908 if (*deliver_home != '/')
1909 {
1910 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
1911 "is not absolute for %s transport", deliver_home, tp->name);
1912 return;
1913 }
1914 }
1915
5418e93b
PH
1916/* See if either the transport or the address specifies a current directory,
1917and if so, expand it. If nothing is set, use the home directory, unless it is
1918also unset in which case use "/", which is assumed to be a directory to which
1919all users have access. It is necessary to be in a visible directory for some
1920operating systems when running pipes, as some commands (e.g. "rm" under Solaris
19212.5) require this. */
1922
d6c82d7b
JH
1923working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
1924if (working_directory)
059ec3d9
PH
1925 {
1926 uschar *raw = working_directory;
d6c82d7b 1927 if (!(working_directory = expand_string(raw)))
059ec3d9
PH
1928 {
1929 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
1930 "failed to expand for %s transport: %s", raw, tp->name,
1931 expand_string_message);
1932 return;
1933 }
1934 if (*working_directory != '/')
1935 {
1936 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
1937 "\"%s\" is not absolute for %s transport", working_directory, tp->name);
1938 return;
1939 }
1940 }
d6c82d7b 1941else working_directory = deliver_home ? deliver_home : US"/";
059ec3d9
PH
1942
1943/* If one of the return_output flags is set on the transport, create and open a
1944file in the message log directory for the transport to write its output onto.
1945This is mainly used by pipe transports. The file needs to be unique to the
1946address. This feature is not available for shadow transports. */
1947
d6c82d7b
JH
1948if ( !shadowing
1949 && ( tp->return_output || tp->return_fail_output
ec0eb1a3 1950 || tp->log_output || tp->log_fail_output || tp->log_defer_output
d6c82d7b 1951 ) )
059ec3d9
PH
1952 {
1953 uschar *error;
1954 addr->return_filename =
1955 string_sprintf("%s/msglog/%s/%s-%d-%d", spool_directory, message_subdir,
1956 message_id, getpid(), return_count++);
1957 addr->return_file = open_msglog_file(addr->return_filename, 0400, &error);
1958 if (addr->return_file < 0)
1959 {
1960 common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
1961 "to return message: %s", error, tp->name, strerror(errno));
1962 return;
1963 }
1964 }
1965
1966/* Create the pipe for inter-process communication. */
1967
1968if (pipe(pfd) != 0)
1969 {
1970 common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
1971 strerror(errno));
1972 return;
1973 }
1974
1975/* Now fork the process to do the real work in the subprocess, but first
1976ensure that all cached resources are freed so that the subprocess starts with
1977a clean slate and doesn't interfere with the parent process. */
1978
1979search_tidyup();
1980
1981if ((pid = fork()) == 0)
1982 {
1983 BOOL replicate = TRUE;
1984
1985 /* Prevent core dumps, as we don't want them in users' home directories.
1986 HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
1987 system. Some experimental/developing systems (e.g. GNU/Hurd) may define
1988 RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
a29e5231
PP
1989 complain if the error is "not supported".
1990
1991 There are two scenarios where changing the max limit has an effect. In one,
1992 the user is using a .forward and invoking a command of their choice via pipe;
1993 for these, we do need the max limit to be 0 unless the admin chooses to
1994 permit an increased limit. In the other, the command is invoked directly by
1995 the transport and is under administrator control, thus being able to raise
1996 the limit aids in debugging. So there's no general always-right answer.
1997
1998 Thus we inhibit core-dumps completely but let individual transports, while
1999 still root, re-raise the limits back up to aid debugging. We make the
2000 default be no core-dumps -- few enough people can use core dumps in
2001 diagnosis that it's reasonable to make them something that has to be explicitly requested.
2002 */
059ec3d9 2003
a7538db1 2004#ifdef RLIMIT_CORE
059ec3d9
PH
2005 struct rlimit rl;
2006 rl.rlim_cur = 0;
2007 rl.rlim_max = 0;
2008 if (setrlimit(RLIMIT_CORE, &rl) < 0)
2009 {
a7538db1 2010# ifdef SETRLIMIT_NOT_SUPPORTED
059ec3d9 2011 if (errno != ENOSYS && errno != ENOTSUP)
a7538db1 2012# endif
059ec3d9
PH
2013 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
2014 strerror(errno));
2015 }
a7538db1 2016#endif
059ec3d9
PH
2017
2018 /* Reset the random number generator, so different processes don't all
2019 have the same sequence. */
2020
2021 random_seed = 0;
2022
2023 /* If the transport has a setup entry, call this first, while still
2024 privileged. (Appendfile uses this to expand quota, for example, while
2025 able to read private files.) */
2026
d6c82d7b 2027 if (addr->transport->setup)
929ba01c 2028 switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
059ec3d9
PH
2029 &(addr->message)))
2030 {
2031 case DEFER:
d6c82d7b
JH
2032 addr->transport_return = DEFER;
2033 goto PASS_BACK;
059ec3d9
PH
2034
2035 case FAIL:
d6c82d7b
JH
2036 addr->transport_return = PANIC;
2037 goto PASS_BACK;
059ec3d9 2038 }
059ec3d9
PH
2039
2040 /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
2041 when the process becomes unprivileged, it won't be able to write to the
2042 process log. SIGHUP is ignored throughout exim, except when it is being
2043 run as a daemon. */
2044
2045 signal(SIGINT, SIG_IGN);
2046 signal(SIGTERM, SIG_IGN);
2047 signal(SIGUSR1, SIG_IGN);
2048
2049 /* Close the unwanted half of the pipe, and set close-on-exec for the other
2050 half - for transports that exec things (e.g. pipe). Then set the required
2051 gid/uid. */
2052
f1e894f3 2053 (void)close(pfd[pipe_read]);
ff790e47 2054 (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
059ec3d9
PH
2055 FD_CLOEXEC);
2056 exim_setugid(uid, gid, use_initgroups,
2057 string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
2058 addr->address, addr->transport->name));
2059
2060 DEBUG(D_deliver)
2061 {
2062 address_item *batched;
2063 debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
d6c82d7b 2064 for (batched = addr->next; batched; batched = batched->next)
059ec3d9
PH
2065 debug_printf("additional batched address: %s\n", batched->address);
2066 }
2067
2068 /* Set an appropriate working directory. */
2069
2070 if (Uchdir(working_directory) < 0)
2071 {
2072 addr->transport_return = DEFER;
2073 addr->basic_errno = errno;
2074 addr->message = string_sprintf("failed to chdir to %s", working_directory);
2075 }
2076
2077 /* If successful, call the transport */
2078
2079 else
2080 {
2081 BOOL ok = TRUE;
2082 set_process_info("delivering %s to %s using %s", message_id,
2083 addr->local_part, addr->transport->name);
2084
2a47f028
JH
2085 /* Setting this global in the subprocess means we need never clear it */
2086 transport_name = addr->transport->name;
2087
059ec3d9
PH
2088 /* If a transport filter has been specified, set up its argument list.
2089 Any errors will get put into the address, and FALSE yielded. */
2090
d6c82d7b 2091 if (addr->transport->filter_command)
059ec3d9
PH
2092 {
2093 ok = transport_set_up_command(&transport_filter_argv,
2094 addr->transport->filter_command,
2095 TRUE, PANIC, addr, US"transport filter", NULL);
2096 transport_filter_timeout = addr->transport->filter_timeout;
2097 }
2098 else transport_filter_argv = NULL;
2099
2100 if (ok)
2101 {
2102 debug_print_string(addr->transport->debug_string);
2103 replicate = !(addr->transport->info->code)(addr->transport, addr);
2104 }
2105 }
2106
2107 /* Pass the results back down the pipe. If necessary, first replicate the
2108 status in the top address to the others in the batch. The label is the
2109 subject of a goto when a call to the transport's setup function fails. We
2110 pass the pointer to the transport back in case it got changed as a result of
2111 file_format in appendfile. */
2112
2113 PASS_BACK:
2114
2115 if (replicate) replicate_status(addr);
d6c82d7b 2116 for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9
PH
2117 {
2118 int i;
2119 int local_part_length = Ustrlen(addr2->local_part);
2120 uschar *s;
1ac6b2e7 2121 int ret;
059ec3d9 2122
d6c82d7b
JH
2123 if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
2124 || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
2125 || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
2126 || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
2127 || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
2128 || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
2129 || (ret = write(pfd[pipe_write], &addr2->transport,
1ac6b2e7 2130 sizeof(transport_instance *))) != sizeof(transport_instance *)
059ec3d9
PH
2131
2132 /* For a file delivery, pass back the local part, in case the original
2133 was only part of the final delivery path. This gives more complete
2134 logging. */
2135
1ac6b2e7 2136 || (testflag(addr2, af_file)
d6c82d7b 2137 && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
1ac6b2e7
JH
2138 || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
2139 )
2140 )
2141 )
2142 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2143 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2144
2145 /* Now any messages */
2146
2147 for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
2148 {
d6c82d7b
JH
2149 int message_length = s ? Ustrlen(s) + 1 : 0;
2150 if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
2151 || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
1ac6b2e7
JH
2152 )
2153 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2154 ret == -1 ? strerror(errno) : "short write");
059ec3d9
PH
2155 }
2156 }
2157
2158 /* OK, this process is now done. Free any cached resources that it opened,
2159 and close the pipe we were writing down before exiting. */
2160
f1e894f3 2161 (void)close(pfd[pipe_write]);
059ec3d9
PH
2162 search_tidyup();
2163 exit(EXIT_SUCCESS);
2164 }
2165
2166/* Back in the main process: panic if the fork did not succeed. This seems
2167better than returning an error - if forking is failing it is probably best
2168not to try other deliveries for this message. */
2169
2170if (pid < 0)
2171 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
2172 addr->address);
2173
2174/* Read the pipe to get the delivery status codes and error messages. Our copy
2175of the writing end must be closed first, as otherwise read() won't return zero
2176on an empty pipe. We check that a status exists for each address before
2177overwriting the address structure. If data is missing, the default DEFER status
2178will remain. Afterwards, close the reading end. */
2179
f1e894f3 2180(void)close(pfd[pipe_write]);
059ec3d9 2181
d6c82d7b 2182for (addr2 = addr; addr2; addr2 = addr2->next)
059ec3d9 2183 {
d6c82d7b 2184 len = read(pfd[pipe_read], &status, sizeof(int));
059ec3d9
PH
2185 if (len > 0)
2186 {
2187 int i;
2188 uschar **sptr;
2189
2190 addr2->transport_return = status;
d6c82d7b 2191 len = read(pfd[pipe_read], &transport_count,
059ec3d9 2192 sizeof(transport_count));
d6c82d7b
JH
2193 len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
2194 len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
2195 len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
2196 len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
2197 len = read(pfd[pipe_read], &addr2->transport,
059ec3d9
PH
2198 sizeof(transport_instance *));
2199
2200 if (testflag(addr2, af_file))
2201 {
2202 int local_part_length;
d6c82d7b
JH
2203 len = read(pfd[pipe_read], &local_part_length, sizeof(int));
2204 len = read(pfd[pipe_read], big_buffer, local_part_length);
059ec3d9
PH
2205 big_buffer[local_part_length] = 0;
2206 addr2->local_part = string_copy(big_buffer);
2207 }
2208
d6c82d7b 2209 for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
059ec3d9
PH
2210 {
2211 int message_length;
d6c82d7b 2212 len = read(pfd[pipe_read], &message_length, sizeof(int));
059ec3d9
PH
2213 if (message_length > 0)
2214 {
d6c82d7b 2215 len = read(pfd[pipe_read], big_buffer, message_length);
dc8091e7 2216 big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
059ec3d9
PH
2217 if (len > 0) *sptr = string_copy(big_buffer);
2218 }
2219 }
2220 }
2221
2222 else
2223 {
2224 log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
2225 "from delivery subprocess", addr2->unique);
2226 break;
2227 }
2228 }
2229
f1e894f3 2230(void)close(pfd[pipe_read]);
059ec3d9
PH
2231
2232/* Unless shadowing, write all successful addresses immediately to the journal
2233file, to ensure they are recorded asap. For homonymic addresses, use the base
2234address plus the transport name. Failure to write the journal is panic-worthy,
2235but don't stop, as it may prove possible subsequently to update the spool file
2236in order to record the delivery. */
2237
2238if (!shadowing)
2239 {
d6c82d7b
JH
2240 for (addr2 = addr; addr2; addr2 = addr2->next)
2241 if (addr2->transport_return == OK)
2242 {
2243 if (testflag(addr2, af_homonym))
2244 sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
2245 else
2246 sprintf(CS big_buffer, "%.500s\n", addr2->unique);
059ec3d9 2247
d6c82d7b
JH
2248 /* In the test harness, wait just a bit to let the subprocess finish off
2249 any debug output etc first. */
059ec3d9 2250
d6c82d7b 2251 if (running_in_test_harness) millisleep(300);
059ec3d9 2252
d6c82d7b
JH
2253 DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
2254 len = Ustrlen(big_buffer);
2255 if (write(journal_fd, big_buffer, len) != len)
2256 log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
2257 big_buffer, strerror(errno));
2258 }
059ec3d9
PH
2259
2260 /* Ensure the journal file is pushed out to disk. */
2261
54fc8428 2262 if (EXIMfsync(journal_fd) < 0)
059ec3d9
PH
2263 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2264 strerror(errno));
2265 }
2266
2267/* Wait for the process to finish. If it terminates with a non-zero code,
2268freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
2269status values of all the addresses as they are. Take care to handle the case
2270when the subprocess doesn't seem to exist. This has been seen on one system
2271when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
2272happens, wait() doesn't recognize the termination of child processes. Exim now
2273resets SIGCHLD to SIG_DFL, but this code should still be robust. */
2274
2275while ((rc = wait(&status)) != pid)
059ec3d9
PH
2276 if (rc < 0 && errno == ECHILD) /* Process has vanished */
2277 {
2278 log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
2279 addr->transport->driver_name);
2280 status = 0;
2281 break;
2282 }
059ec3d9
PH
2283
2284if ((status & 0xffff) != 0)
2285 {
2286 int msb = (status >> 8) & 255;
2287 int lsb = status & 255;
2288 int code = (msb == 0)? (lsb & 0x7f) : msb;
2289 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
2290 addr->special_action = SPECIAL_FREEZE;
2291 log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
2292 "status 0x%04x: %s %d",
2293 addr->transport->driver_name,
2294 status,
d6c82d7b 2295 msb == 0 ? "terminated by signal" : "exit code",
059ec3d9
PH
2296 code);
2297 }
2298
2299/* If SPECIAL_WARN is set in the top address, send a warning message. */
2300
d6c82d7b 2301if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
059ec3d9
PH
2302 {
2303 int fd;
2304 uschar *warn_message;
d6c82d7b 2305 pid_t pid;
059ec3d9
PH
2306
2307 DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
2308
d6c82d7b 2309 if (!(warn_message = expand_string(addr->transport->warn_message)))
059ec3d9
PH
2310 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
2311 "message for %s transport): %s", addr->transport->warn_message,
2312 addr->transport->name, expand_string_message);
d6c82d7b
JH
2313
2314 else if ((pid = child_open_exim(&fd)) > 0)
059ec3d9 2315 {
d6c82d7b
JH
2316 FILE *f = fdopen(fd, "wb");
2317 if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
2318 fprintf(f, "Reply-To: %s\n", errors_reply_to);
2319 fprintf(f, "Auto-Submitted: auto-replied\n");
2320 if (!contains_header(US"From", warn_message))
2321 moan_write_from(f);
2322 fprintf(f, "%s", CS warn_message);
059ec3d9 2323
d6c82d7b 2324 /* Close and wait for child process to complete, without a timeout. */
059ec3d9 2325
d6c82d7b
JH
2326 (void)fclose(f);
2327 (void)child_close(pid, 0);
059ec3d9
PH
2328 }
2329
2330 addr->special_action = SPECIAL_NONE;
2331 }
2332}
2333
2334
2335
fa41615d 2336
3070ceee
JH
2337/* Check transport for the given concurrency limit. Return TRUE if over
2338the limit (or an expansion failure), else FALSE and if there was a limit,
2339the key for the hints database used for the concurrency count. */
fa41615d 2340
3070ceee
JH
2341static BOOL
2342tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
fa41615d 2343{
3070ceee
JH
2344unsigned max_parallel;
2345
2346if (!tp->max_parallel) return FALSE;
2347
2348max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
2349if (expand_string_message)
2350 {
2351 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
2352 "in %s transport (%s): %s", tp->name, addr->address,
2353 expand_string_message);
2354 return TRUE;
2355 }
2356
2357if (max_parallel > 0)
2358 {
2359 uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
2360 if (!enq_start(serialize_key, max_parallel))
2361 {
2362 address_item * next;
2363 DEBUG(D_transport)
2364 debug_printf("skipping tpt %s because concurrency limit %u reached\n",
2365 tp->name, max_parallel);
2366 do
2367 {
2368 next = addr->next;
2369 addr->message = US"concurrency limit reached for transport";
2370 addr->basic_errno = ERRNO_TRETRY;
2371 post_process_one(addr, DEFER, LOG_MAIN, DTYPE_TRANSPORT, 0);
2372 } while ((addr = next));
2373 return TRUE;
2374 }
2375 *key = serialize_key;
2376 }
2377return FALSE;
fa41615d
JH
2378}
2379
2380
2381
059ec3d9
PH
2382/*************************************************
2383* Do local deliveries *
2384*************************************************/
2385
2386/* This function processes the list of addresses in addr_local. True local
2387deliveries are always done one address at a time. However, local deliveries can
2388be batched up in some cases. Typically this is when writing batched SMTP output
2389files for use by some external transport mechanism, or when running local
2390deliveries over LMTP.
2391
2392Arguments: None
2393Returns: Nothing
2394*/
2395
2396static void
2397do_local_deliveries(void)
2398{
2399open_db dbblock;
2400open_db *dbm_file = NULL;
2401time_t now = time(NULL);
2402
2403/* Loop until we have exhausted the supply of local deliveries */
2404
d6c82d7b 2405while (addr_local)
059ec3d9
PH
2406 {
2407 time_t delivery_start;
2408 int deliver_time;
2409 address_item *addr2, *addr3, *nextaddr;
2410 int logflags = LOG_MAIN;
2411 int logchar = dont_deliver? '*' : '=';
2412 transport_instance *tp;
fa41615d 2413 uschar * serialize_key = NULL;
059ec3d9
PH
2414
2415 /* Pick the first undelivered address off the chain */
2416
2417 address_item *addr = addr_local;
2418 addr_local = addr->next;
2419 addr->next = NULL;
2420
2421 DEBUG(D_deliver|D_transport)
2422 debug_printf("--------> %s <--------\n", addr->address);
2423
2424 /* An internal disaster if there is no transport. Should not occur! */
2425
d6c82d7b 2426 if (!(tp = addr->transport))
059ec3d9
PH
2427 {
2428 logflags |= LOG_PANIC;
2429 disable_logging = FALSE; /* Jic */
d6c82d7b
JH
2430 addr->message = addr->router
2431 ? string_sprintf("No transport set by %s router", addr->router->name)
2432 : string_sprintf("No transport set by system filter");
059ec3d9
PH
2433 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
2434 continue;
2435 }
2436
2437 /* Check that this base address hasn't previously been delivered to this
2438 transport. The check is necessary at this point to handle homonymic addresses
2439 correctly in cases where the pattern of redirection changes between delivery
2440 attempts. Non-homonymic previous delivery is detected earlier, at routing
2441 time. */
2442
c2c19e9d 2443 if (previously_transported(addr, FALSE)) continue;
059ec3d9
PH
2444
2445 /* There are weird cases where logging is disabled */
2446
2447 disable_logging = tp->disable_logging;
2448
f7fd3850
PH
2449 /* Check for batched addresses and possible amalgamation. Skip all the work
2450 if either batch_max <= 1 or there aren't any other addresses for local
2451 delivery. */
059ec3d9 2452
d6c82d7b 2453 if (tp->batch_max > 1 && addr_local)
059ec3d9
PH
2454 {
2455 int batch_count = 1;
2456 BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
d6c82d7b
JH
2457 BOOL uses_lp = ( testflag(addr, af_pfr)
2458 && (testflag(addr, af_file) || addr->local_part[0] == '|')
2459 )
2460 || readconf_depends((driver_instance *)tp, US"local_part");
059ec3d9
PH
2461 uschar *batch_id = NULL;
2462 address_item **anchor = &addr_local;
2463 address_item *last = addr;
2464 address_item *next;
2465
2466 /* Expand the batch_id string for comparison with other addresses.
2467 Expansion failure suppresses batching. */
2468
d6c82d7b 2469 if (tp->batch_id)
059ec3d9
PH
2470 {
2471 deliver_set_expansions(addr);
2472 batch_id = expand_string(tp->batch_id);
2473 deliver_set_expansions(NULL);
d6c82d7b 2474 if (!batch_id)
059ec3d9
PH
2475 {
2476 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2477 "in %s transport (%s): %s", tp->name, addr->address,
2478 expand_string_message);
2479 batch_count = tp->batch_max;
2480 }
2481 }
2482
2483 /* Until we reach the batch_max limit, pick off addresses which have the
2484 same characteristics. These are:
2485
2486 same transport
7816e254 2487 not previously delivered (see comment about 50 lines above)
059ec3d9 2488 same local part if the transport's configuration contains $local_part
f7fd3850 2489 or if this is a file or pipe delivery from a redirection
059ec3d9
PH
2490 same domain if the transport's configuration contains $domain
2491 same errors address
2492 same additional headers
2493 same headers to be removed
2494 same uid/gid for running the transport
2495 same first host if a host list is set
2496 */
2497
d6c82d7b 2498 while ((next = *anchor) && batch_count < tp->batch_max)
059ec3d9
PH
2499 {
2500 BOOL ok =
d6c82d7b
JH
2501 tp == next->transport
2502 && !previously_transported(next, TRUE)
2503 && (addr->flags & (af_pfr|af_file)) == (next->flags & (af_pfr|af_file))
2504 && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
2505 && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
2506 && same_strings(next->prop.errors_address, addr->prop.errors_address)
2507 && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
2508 && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
2509 && same_ugid(tp, addr, next)
2510 && ( !addr->host_list && !next->host_list
2511 || addr->host_list
2512 && next->host_list
2513 && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
2514 );
059ec3d9
PH
2515
2516 /* If the transport has a batch_id setting, batch_id will be non-NULL
2517 from the expansion outside the loop. Expand for this address and compare.
2518 Expansion failure makes this address ineligible for batching. */
2519
d6c82d7b 2520 if (ok && batch_id)
059ec3d9
PH
2521 {
2522 uschar *bid;
2523 address_item *save_nextnext = next->next;
2524 next->next = NULL; /* Expansion for a single address */
2525 deliver_set_expansions(next);
2526 next->next = save_nextnext;
2527 bid = expand_string(tp->batch_id);
2528 deliver_set_expansions(NULL);
d6c82d7b 2529 if (!bid)
059ec3d9
PH
2530 {
2531 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2532 "in %s transport (%s): %s", tp->name, next->address,
2533 expand_string_message);
2534 ok = FALSE;
2535 }
2536 else ok = (Ustrcmp(batch_id, bid) == 0);
2537 }
2538
2539 /* Take address into batch if OK. */
2540
2541 if (ok)
2542 {
2543 *anchor = next->next; /* Include the address */
2544 next->next = NULL;
2545 last->next = next;
2546 last = next;
2547 batch_count++;
2548 }
fa41615d 2549 else anchor = &next->next; /* Skip the address */
059ec3d9
PH
2550 }
2551 }
2552
2553 /* We now have one or more addresses that can be delivered in a batch. Check
2554 whether the transport is prepared to accept a message of this size. If not,
2555 fail them all forthwith. If the expansion fails, or does not yield an
2556 integer, defer delivery. */
2557
d6c82d7b 2558 if (tp->message_size_limit)
059ec3d9
PH
2559 {
2560 int rc = check_message_size(tp, addr);
2561 if (rc != OK)
2562 {
2563 replicate_status(addr);
d6c82d7b 2564 while (addr)
059ec3d9
PH
2565 {
2566 addr2 = addr->next;
2567 post_process_one(addr, rc, logflags, DTYPE_TRANSPORT, 0);
2568 addr = addr2;
2569 }
2570 continue; /* With next batch of addresses */
2571 }
2572 }
2573
2574 /* If we are not running the queue, or if forcing, all deliveries will be
2575 attempted. Otherwise, we must respect the retry times for each address. Even
2576 when not doing this, we need to set up the retry key string, and determine
2577 whether a retry record exists, because after a successful delivery, a delete
2578 retry item must be set up. Keep the retry database open only for the duration
2579 of these checks, rather than for all local deliveries, because some local
2580 deliveries (e.g. to pipes) can take a substantial time. */
2581
d6c82d7b 2582 if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE)))
059ec3d9
PH
2583 {
2584 DEBUG(D_deliver|D_retry|D_hints_lookup)
2585 debug_printf("no retry data available\n");
2586 }
2587
2588 addr2 = addr;
2589 addr3 = NULL;
d6c82d7b 2590 while (addr2)
059ec3d9
PH
2591 {
2592 BOOL ok = TRUE; /* to deliver this address */
2593 uschar *retry_key;
2594
2595 /* Set up the retry key to include the domain or not, and change its
2596 leading character from "R" to "T". Must make a copy before doing this,
2597 because the old key may be pointed to from a "delete" retry item after
2598 a routing delay. */
2599
2600 retry_key = string_copy(
d6c82d7b 2601 tp->retry_use_local_part ? addr2->address_retry_key :
059ec3d9
PH
2602 addr2->domain_retry_key);
2603 *retry_key = 'T';
2604
2605 /* Inspect the retry data. If there is no hints file, delivery happens. */
2606
d6c82d7b 2607 if (dbm_file)
059ec3d9
PH
2608 {
2609 dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
2610
2611 /* If there is no retry record, delivery happens. If there is,
2612 remember it exists so it can be deleted after a successful delivery. */
2613
d6c82d7b 2614 if (retry_record)
059ec3d9
PH
2615 {
2616 setflag(addr2, af_lt_retry_exists);
2617
2618 /* A retry record exists for this address. If queue running and not
2619 forcing, inspect its contents. If the record is too old, or if its
2620 retry time has come, or if it has passed its cutoff time, delivery
2621 will go ahead. */
2622
2623 DEBUG(D_retry)
2624 {
ea49d0e1
PH
2625 debug_printf("retry record exists: age=%s ",
2626 readconf_printtime(now - retry_record->time_stamp));
2627 debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
2628 debug_printf(" time to retry = %s expired = %d\n",
2629 readconf_printtime(retry_record->next_try - now),
2630 retry_record->expired);
059ec3d9
PH
2631 }
2632
2633 if (queue_running && !deliver_force)
2634 {
d6c82d7b
JH
2635 ok = (now - retry_record->time_stamp > retry_data_expire)
2636 || (now >= retry_record->next_try)
2637 || retry_record->expired;
059ec3d9
PH
2638
2639 /* If we haven't reached the retry time, there is one more check
1ddeb334 2640 to do, which is for the ultimate address timeout. */
059ec3d9
PH
2641
2642 if (!ok)
ba9af0af
TF
2643 ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
2644 retry_record, now);
059ec3d9
PH
2645 }
2646 }
2647 else DEBUG(D_retry) debug_printf("no retry record exists\n");
2648 }
2649
2650 /* This address is to be delivered. Leave it on the chain. */
2651
2652 if (ok)
2653 {
2654 addr3 = addr2;
2655 addr2 = addr2->next;
2656 }
2657
2658 /* This address is to be deferred. Take it out of the chain, and
2659 post-process it as complete. Must take it out of the chain first,
2660 because post processing puts it on another chain. */
2661
2662 else
2663 {
2664 address_item *this = addr2;
2665 this->message = US"Retry time not yet reached";
2666 this->basic_errno = ERRNO_LRETRY;
d6c82d7b
JH
2667 addr2 = addr3 ? (addr3->next = addr2->next)
2668 : (addr = addr2->next);
059ec3d9
PH
2669 post_process_one(this, DEFER, logflags, DTYPE_TRANSPORT, 0);
2670 }
2671 }
2672
d6c82d7b 2673 if (dbm_file) dbfn_close(dbm_file);
059ec3d9
PH
2674
2675 /* If there are no addresses left on the chain, they all deferred. Loop
2676 for the next set of addresses. */
2677
d6c82d7b 2678 if (!addr) continue;
059ec3d9 2679
fa41615d
JH
2680 /* If the transport is limited for parallellism, enforce that here.
2681 We use a hints DB entry, incremented here and decremented after
2682 the transport (and any shadow transport) completes. */
2683
3070ceee 2684 if (tpt_parallel_check(tp, addr, &serialize_key))
fa41615d 2685 {
fa41615d
JH
2686 if (expand_string_message)
2687 {
2688 logflags |= LOG_PANIC;
3070ceee
JH
2689 do
2690 {
2691 addr = addr->next;
fa41615d 2692 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
3070ceee 2693 } while ((addr = addr2));
fa41615d 2694 }
3070ceee 2695 continue; /* Loop for the next set of addresses. */
fa41615d
JH
2696 }
2697
2698
059ec3d9
PH
2699 /* So, finally, we do have some addresses that can be passed to the
2700 transport. Before doing so, set up variables that are relevant to a
2701 single delivery. */
2702
2703 deliver_set_expansions(addr);
2704 delivery_start = time(NULL);
2705 deliver_local(addr, FALSE);
2706 deliver_time = (int)(time(NULL) - delivery_start);
2707
2708 /* If a shadow transport (which must perforce be another local transport), is
2709 defined, and its condition is met, we must pass the message to the shadow
2710 too, but only those addresses that succeeded. We do this by making a new
2711 chain of addresses - also to keep the original chain uncontaminated. We must
2712 use a chain rather than doing it one by one, because the shadow transport may
2713 batch.
2714
2715 NOTE: if the condition fails because of a lookup defer, there is nothing we
2716 can do! */
2717
d6c82d7b
JH
2718 if ( tp->shadow
2719 && ( !tp->shadow_condition
2720 || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
2721 ) )
059ec3d9
PH
2722 {
2723 transport_instance *stp;
2724 address_item *shadow_addr = NULL;
2725 address_item **last = &shadow_addr;
2726
d6c82d7b 2727 for (stp = transports; stp; stp = stp->next)
059ec3d9
PH
2728 if (Ustrcmp(stp->name, tp->shadow) == 0) break;
2729
d6c82d7b 2730 if (!stp)
059ec3d9
PH
2731 log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
2732 tp->shadow);
2733
2734 /* Pick off the addresses that have succeeded, and make clones. Put into
2735 the shadow_message field a pointer to the shadow_message field of the real
2736 address. */
2737
d6c82d7b
JH
2738 else for (addr2 = addr; addr2; addr2 = addr2->next)
2739 if (addr2->transport_return == OK)
2740 {
2741 addr3 = store_get(sizeof(address_item));
2742 *addr3 = *addr2;
2743 addr3->next = NULL;
2744 addr3->shadow_message = (uschar *) &(addr2->shadow_message);
2745 addr3->transport = stp;
2746 addr3->transport_return = DEFER;
2747 addr3->return_filename = NULL;
2748 addr3->return_file = -1;
2749 *last = addr3;
2750 last = &(addr3->next);
2751 }
059ec3d9
PH
2752
2753 /* If we found any addresses to shadow, run the delivery, and stick any
2754 message back into the shadow_message field in the original. */
2755
d6c82d7b 2756 if (shadow_addr)
059ec3d9
PH
2757 {
2758 int save_count = transport_count;
2759
2760 DEBUG(D_deliver|D_transport)
2761 debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
2762 deliver_local(shadow_addr, TRUE);
2763
d6c82d7b 2764 for(; shadow_addr; shadow_addr = shadow_addr->next)
059ec3d9
PH
2765 {
2766 int sresult = shadow_addr->transport_return;
d6c82d7b
JH
2767 *(uschar **)shadow_addr->shadow_message =
2768 sresult == OK
2769 ? string_sprintf(" ST=%s", stp->name)
2770 : string_sprintf(" ST=%s (%s%s%s)", stp->name,
2771 shadow_addr->basic_errno <= 0
2772 ? US""
2773 : US strerror(shadow_addr->basic_errno),
2774 shadow_addr->basic_errno <= 0 || !shadow_addr->message
2775 ? US""
2776 : US": ",
2777 shadow_addr->message
2778 ? shadow_addr->message
2779 : shadow_addr->basic_errno <= 0
2780 ? US"unknown error"
2781 : US"");
059ec3d9
PH
2782
2783 DEBUG(D_deliver|D_transport)
2784 debug_printf("%s shadow transport returned %s for %s\n",
2785 stp->name,
d6c82d7b
JH
2786 sresult == OK ? "OK" :
2787 sresult == DEFER ? "DEFER" :
2788 sresult == FAIL ? "FAIL" :
2789 sresult == PANIC ? "PANIC" : "?",
059ec3d9
PH
2790 shadow_addr->address);
2791 }
2792
2793 DEBUG(D_deliver|D_transport)
2794 debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
2795
2796 transport_count = save_count; /* Restore original transport count */
2797 }
2798 }
2799
2800 /* Cancel the expansions that were set up for the delivery. */
2801
2802 deliver_set_expansions(NULL);
2803
fa41615d
JH
2804 /* If the transport was parallelism-limited, decrement the hints DB record. */
2805
2806 if (serialize_key) enq_end(serialize_key);
2807
059ec3d9
PH
2808 /* Now we can process the results of the real transport. We must take each
2809 address off the chain first, because post_process_one() puts it on another
2810 chain. */
2811
d6c82d7b 2812 for (addr2 = addr; addr2; addr2 = nextaddr)
059ec3d9
PH
2813 {
2814 int result = addr2->transport_return;
2815 nextaddr = addr2->next;
2816
2817 DEBUG(D_deliver|D_transport)
2818 debug_printf("%s transport returned %s for %s\n",
2819 tp->name,
d6c82d7b
JH
2820 result == OK ? "OK" :
2821 result == DEFER ? "DEFER" :
2822 result == FAIL ? "FAIL" :
2823 result == PANIC ? "PANIC" : "?",
059ec3d9
PH
2824 addr2->address);
2825
2826 /* If there is a retry_record, or if delivery is deferred, build a retry
2827 item for setting a new retry time or deleting the old retry record from
2828 the database. These items are handled all together after all addresses
2829 have been handled (so the database is open just for a short time for
2830 updating). */
2831
2832 if (result == DEFER || testflag(addr2, af_lt_retry_exists))
2833 {
d6c82d7b
JH
2834 int flags = result == DEFER ? 0 : rf_delete;
2835 uschar *retry_key = string_copy(tp->retry_use_local_part
2836 ? addr2->address_retry_key : addr2->domain_retry_key);
059ec3d9
PH
2837 *retry_key = 'T';
2838 retry_add_item(addr2, retry_key, flags);
2839 }
2840
2841 /* Done with this address */
2842
2843 if (result == OK) addr2->more_errno = deliver_time;
2844 post_process_one(addr2, result, logflags, DTYPE_TRANSPORT, logchar);
2845
2846 /* If a pipe delivery generated text to be sent back, the result may be
2847 changed to FAIL, and we must copy this for subsequent addresses in the
2848 batch. */
2849
2850 if (addr2->transport_return != result)
2851 {
d6c82d7b 2852 for (addr3 = nextaddr; addr3; addr3 = addr3->next)
059ec3d9
PH
2853 {
2854 addr3->transport_return = addr2->transport_return;
2855 addr3->basic_errno = addr2->basic_errno;
2856 addr3->message = addr2->message;
2857 }
2858 result = addr2->transport_return;
2859 }
2860
2861 /* Whether or not the result was changed to FAIL, we need to copy the
2862 return_file value from the first address into all the addresses of the
2863 batch, so they are all listed in the error message. */
2864
2865 addr2->return_file = addr->return_file;
2866
2867 /* Change log character for recording successful deliveries. */
2868
2869 if (result == OK) logchar = '-';
2870 }
2871 } /* Loop back for next batch of addresses */
2872}
2873
2874
2875
2876
2877/*************************************************
2878* Sort remote deliveries *
2879*************************************************/
2880
2881/* This function is called if remote_sort_domains is set. It arranges that the
2882chain of addresses for remote deliveries is ordered according to the strings
2883specified. Try to make this shuffling reasonably efficient by handling
2884sequences of addresses rather than just single ones.
2885
2886Arguments: None
2887Returns: Nothing
2888*/
2889
2890static void
2891sort_remote_deliveries(void)
2892{
2893int sep = 0;
2894address_item **aptr = &addr_remote;
55414b25 2895const uschar *listptr = remote_sort_domains;
059ec3d9
PH
2896uschar *pattern;
2897uschar patbuf[256];
2898
d6c82d7b
JH
2899while ( *aptr
2900 && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
2901 )
059ec3d9
PH
2902 {
2903 address_item *moved = NULL;
2904 address_item **bptr = &moved;
2905
d6c82d7b 2906 while (*aptr)
059ec3d9
PH
2907 {
2908 address_item **next;
2909 deliver_domain = (*aptr)->domain; /* set $domain */
55414b25 2910 if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
059ec3d9
PH
2911 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
2912 {
d6c82d7b 2913 aptr = &(*aptr)->next;
059ec3d9
PH
2914 continue;
2915 }
2916
d6c82d7b
JH
2917 next = &(*aptr)->next;
2918 while ( *next
2919 && (deliver_domain = (*next)->domain, /* Set $domain */
55414b25 2920 match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
d6c82d7b
JH
2921 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
2922 )
2923 next = &(*next)->next;
059ec3d9
PH
2924
2925 /* If the batch of non-matchers is at the end, add on any that were
2926 extracted further up the chain, and end this iteration. Otherwise,
2927 extract them from the chain and hang on the moved chain. */
2928
d6c82d7b 2929 if (!*next)
059ec3d9
PH
2930 {
2931 *next = moved;
2932 break;
2933 }
2934
2935 *bptr = *aptr;
2936 *aptr = *next;
2937 *next = NULL;
2938 bptr = next;
d6c82d7b 2939 aptr = &(*aptr)->next;
059ec3d9
PH
2940 }
2941
2942 /* If the loop ended because the final address matched, *aptr will
2943 be NULL. Add on to the end any extracted non-matching addresses. If
2944 *aptr is not NULL, the loop ended via "break" when *next is null, that
2945 is, there was a string of non-matching addresses at the end. In this
2946 case the extracted addresses have already been added on the end. */
2947
d6c82d7b 2948 if (!*aptr) *aptr = moved;
059ec3d9
PH
2949 }
2950
2951DEBUG(D_deliver)
2952 {
2953 address_item *addr;
2954 debug_printf("remote addresses after sorting:\n");
d6c82d7b 2955 for (addr = addr_remote; addr; addr = addr->next)
059ec3d9
PH
2956 debug_printf(" %s\n", addr->address);
2957 }
2958}
2959
2960
2961
2962/*************************************************
2963* Read from pipe for remote delivery subprocess *
2964*************************************************/
2965
2966/* This function is called when the subprocess is complete, but can also be
2967called before it is complete, in order to empty a pipe that is full (to prevent
2968deadlock). It must therefore keep track of its progress in the parlist data
2969block.
2970
2971We read the pipe to get the delivery status codes and a possible error message
2972for each address, optionally preceded by unusability data for the hosts and
2973also by optional retry data.
2974
2975Read in large chunks into the big buffer and then scan through, interpreting
2976the data therein. In most cases, only a single read will be necessary. No
1c5466b9
PH
2977individual item will ever be anywhere near 2500 bytes in length, so by ensuring
2978that we read the next chunk when there is less than 2500 bytes left in the
2979non-final chunk, we can assume each item is complete in the buffer before
2980handling it. Each item is written using a single write(), which is atomic for
2981small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
2982often bigger) so even if we are reading while the subprocess is still going, we
2983should never have only a partial item in the buffer.
059ec3d9
PH
2984
2985Argument:
2986 poffset the offset of the parlist item
2987 eop TRUE if the process has completed
2988
2989Returns: TRUE if the terminating 'Z' item has been read,
2990 or there has been a disaster (i.e. no more data needed);
2991 FALSE otherwise
2992*/
2993
2994static BOOL
2995par_read_pipe(int poffset, BOOL eop)
2996{
2997host_item *h;
2998pardata *p = parlist + poffset;
2999address_item *addrlist = p->addrlist;
3000address_item *addr = p->addr;
3001pid_t pid = p->pid;
3002int fd = p->fd;
3003uschar *endptr = big_buffer;
3004uschar *ptr = endptr;
3005uschar *msg = p->msg;
3006BOOL done = p->done;
3007BOOL unfinished = TRUE;
bd21a787
WB
3008/* minimum size to read is header size including id, subid and length */
3009int required = PIPE_HEADER_SIZE;
059ec3d9
PH
3010
3011/* Loop through all items, reading from the pipe when necessary. The pipe
3012is set up to be non-blocking, but there are two different Unix mechanisms in
3013use. Exim uses O_NONBLOCK if it is defined. This returns 0 for end of file,
3014and EAGAIN for no more data. If O_NONBLOCK is not defined, Exim uses O_NDELAY,
3015which returns 0 for both end of file and no more data. We distinguish the
3016two cases by taking 0 as end of file only when we know the process has
3017completed.
3018
3019Each separate item is written to the pipe in a single write(), and as they are
3020all short items, the writes will all be atomic and we should never find
8e669ac1
PH
3021ourselves in the position of having read an incomplete item. "Short" in this
3022case can mean up to about 1K in the case when there is a long error message
1c5466b9 3023associated with an address. */
059ec3d9
PH
3024
3025DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
3026 (int)p->pid, eop? "ended" : "not ended");
3027
3028while (!done)
3029 {
3030 retry_item *r, **rp;
3031 int remaining = endptr - ptr;
bd21a787
WB
3032 uschar header[PIPE_HEADER_SIZE + 1];
3033 uschar id, subid;
3034 uschar *endc;
059ec3d9
PH
3035
3036 /* Read (first time) or top up the chars in the buffer if necessary.
3037 There will be only one read if we get all the available data (i.e. don't
3038 fill the buffer completely). */
3039
bd21a787 3040 if (remaining < required && unfinished)
059ec3d9
PH
3041 {
3042 int len;
3043 int available = big_buffer_size - remaining;
3044
3045 if (remaining > 0) memmove(big_buffer, ptr, remaining);
3046
3047 ptr = big_buffer;
3048 endptr = big_buffer + remaining;
3049 len = read(fd, endptr, available);
3050
3051 DEBUG(D_deliver) debug_printf("read() yielded %d\n", len);
3052
3053 /* If the result is EAGAIN and the process is not complete, just
3054 stop reading any more and process what we have already. */
3055
3056 if (len < 0)
3057 {
3058 if (!eop && errno == EAGAIN) len = 0; else
3059 {
3060 msg = string_sprintf("failed to read pipe from transport process "
3061 "%d for transport %s: %s", pid, addr->transport->driver_name,
3062 strerror(errno));
3063 break;
3064 }
3065 }
3066
3067 /* If the length is zero (eof or no-more-data), just process what we
3068 already have. Note that if the process is still running and we have
3069 read all the data in the pipe (but less that "available") then we
3070 won't read any more, as "unfinished" will get set FALSE. */
3071
3072 endptr += len;
bd21a787 3073 remaining += len;
059ec3d9
PH
3074 unfinished = len == available;
3075 }
3076
3077 /* If we are at the end of the available data, exit the loop. */
059ec3d9
PH
3078 if (ptr >= endptr) break;
3079
bd21a787
WB
3080 /* copy and read header */
3081 memcpy(header, ptr, PIPE_HEADER_SIZE);
94431adb 3082 header[PIPE_HEADER_SIZE] = '\0';
bd21a787
WB
3083 id = header[0];
3084 subid = header[1];
3085 required = Ustrtol(header + 2, &endc, 10) + PIPE_HEADER_SIZE; /* header + data */
3086 if (*endc)
3087 {
3088 msg = string_sprintf("failed to read pipe from transport process "
3089 "%d for transport %s: error reading size from header", pid, addr->transport->driver_name);
3090 done = TRUE;
3091 break;
3092 }
3093
3094 DEBUG(D_deliver)
94431adb 3095 debug_printf("header read id:%c,subid:%c,size:%s,required:%d,remaining:%d,unfinished:%d\n",
bd21a787
WB
3096 id, subid, header+2, required, remaining, unfinished);
3097
3098 /* is there room for the dataset we want to read ? */
3099 if (required > big_buffer_size - PIPE_HEADER_SIZE)
3100 {
3101 msg = string_sprintf("failed to read pipe from transport process "
3102 "%d for transport %s: big_buffer too small! required size=%d buffer size=%d", pid, addr->transport->driver_name,
3103 required, big_buffer_size - PIPE_HEADER_SIZE);
3104 done = TRUE;
3105 break;
3106 }
3107
94431adb 3108 /* we wrote all datasets with atomic write() calls
bd21a787 3109 remaining < required only happens if big_buffer was too small
94431adb 3110 to get all available data from pipe. unfinished has to be true
bd21a787
WB
3111 as well. */
3112 if (remaining < required)
8fa0a4d4 3113 {
bd21a787
WB
3114 if (unfinished)
3115 continue;
8fa0a4d4 3116 msg = string_sprintf("failed to read pipe from transport process "
94431adb 3117 "%d for transport %s: required size=%d > remaining size=%d and unfinished=false",
8fa0a4d4
JH
3118 pid, addr->transport->driver_name, required, remaining);
3119 done = TRUE;
3120 break;
3121 }
bd21a787
WB
3122
3123 /* step behind the header */
3124 ptr += PIPE_HEADER_SIZE;
94431adb 3125
059ec3d9
PH
3126 /* Handle each possible type of item, assuming the complete item is
3127 available in store. */
3128
bd21a787 3129 switch (id)
059ec3d9
PH
3130 {
3131 /* Host items exist only if any hosts were marked unusable. Match
3132 up by checking the IP address. */
3133
3134 case 'H':
d6c82d7b 3135 for (h = addrlist->host_list; h; h = h->next)
059ec3d9 3136 {
d6c82d7b 3137 if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
059ec3d9
PH
3138 h->status = ptr[0];
3139 h->why = ptr[1];
3140 }
3141 ptr += 2;
3142 while (*ptr++);
3143 break;
3144
3145 /* Retry items are sent in a preceding R item for each address. This is
3146 kept separate to keep each message short enough to guarantee it won't
3147 be split in the pipe. Hopefully, in the majority of cases, there won't in
3148 fact be any retry items at all.
3149
3150 The complete set of retry items might include an item to delete a
3151 routing retry if there was a previous routing delay. However, routing
3152 retries are also used when a remote transport identifies an address error.
3153 In that case, there may also be an "add" item for the same key. Arrange
3154 that a "delete" item is dropped in favour of an "add" item. */
3155
3156 case 'R':
d6c82d7b 3157 if (!addr) goto ADDR_MISMATCH;
059ec3d9
PH
3158
3159 DEBUG(D_deliver|D_retry)
3160 debug_printf("reading retry information for %s from subprocess\n",
3161 ptr+1);
3162
3163 /* Cut out any "delete" items on the list. */
3164
d6c82d7b 3165 for (rp = &(addr->retries); (r = *rp); rp = &r->next)
059ec3d9
PH
3166 if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
3167 {
3168 if ((r->flags & rf_delete) == 0) break; /* It was not "delete" */
3169 *rp = r->next; /* Excise a delete item */
3170 DEBUG(D_deliver|D_retry)
3171 debug_printf(" existing delete item dropped\n");
3172 }
059ec3d9
PH
3173
3174 /* We want to add a delete item only if there is no non-delete item;
3175 however we still have to step ptr through the data. */
3176
d6c82d7b 3177 if (!r || (*ptr & rf_delete) == 0)
059ec3d9
PH
3178 {
3179 r = store_get(sizeof(retry_item));
3180 r->next = addr->retries;
3181 addr->retries = r;
3182 r->flags = *ptr++;
3183 r->key = string_copy(ptr);
3184 while (*ptr++);
3185 memcpy(&(r->basic_errno), ptr, sizeof(r->basic_errno));
3186 ptr += sizeof(r->basic_errno);
3187 memcpy(&(r->more_errno), ptr, sizeof(r->more_errno));
3188 ptr += sizeof(r->more_errno);
3189 r->message = (*ptr)? string_copy(ptr) : NULL;
3190 DEBUG(D_deliver|D_retry)
3191 debug_printf(" added %s item\n",
3192 ((r->flags & rf_delete) == 0)? "retry" : "delete");
3193 }
3194
3195 else
3196 {
3197 DEBUG(D_deliver|D_retry)
3198 debug_printf(" delete item not added: non-delete item exists\n");
3199 ptr++;
3200 while(*ptr++);
3201 ptr += sizeof(r->basic_errno) + sizeof(r->more_errno);
3202 }
3203
3204 while(*ptr++);
3205 break;
3206
3207 /* Put the amount of data written into the parlist block */
3208
3209 case 'S':
3210 memcpy(&(p->transport_count), ptr, sizeof(transport_count));
3211 ptr += sizeof(transport_count);
3212 break;
3213
3214 /* Address items are in the order of items on the address chain. We
3215 remember the current address value in case this function is called
3216 several times to empty the pipe in stages. Information about delivery
3217 over TLS is sent in a preceding X item for each address. We don't put
3218 it in with the other info, in order to keep each message short enough to
3219 guarantee it won't be split in the pipe. */
3220
a7538db1 3221#ifdef SUPPORT_TLS
059ec3d9 3222 case 'X':
d6c82d7b 3223 if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */
bd21a787 3224 switch (subid)
9d1c15ef
JH
3225 {
3226 case '1':
3227 addr->cipher = NULL;
3228 addr->peerdn = NULL;
3229
3230 if (*ptr)
3231 addr->cipher = string_copy(ptr);
3232 while (*ptr++);
3233 if (*ptr)
9d1c15ef 3234 addr->peerdn = string_copy(ptr);
9d1c15ef
JH
3235 break;
3236
3237 case '2':
9d1c15ef
JH
3238 if (*ptr)
3239 (void) tls_import_cert(ptr, &addr->peercert);
152e7604
JH
3240 else
3241 addr->peercert = NULL;
9d1c15ef
JH
3242 break;
3243
3244 case '3':
9d1c15ef
JH
3245 if (*ptr)
3246 (void) tls_import_cert(ptr, &addr->ourcert);
152e7604
JH
3247 else
3248 addr->ourcert = NULL;
9d1c15ef 3249 break;
018058b2 3250
a7538db1 3251# ifndef DISABLE_OCSP
018058b2
JH
3252 case '4':
3253 addr->ocsp = OCSP_NOT_REQ;
3254 if (*ptr)
3255 addr->ocsp = *ptr - '0';
3256 break;
a7538db1 3257# endif
9d1c15ef 3258 }
059ec3d9
PH
3259 while (*ptr++);
3260 break;
a7538db1 3261#endif /*SUPPORT_TLS*/
059ec3d9 3262
6f123593 3263 case 'C': /* client authenticator information */
bd21a787 3264 switch (subid)
9d1c15ef
JH
3265 {
3266 case '1':
3267 addr->authenticator = (*ptr)? string_copy(ptr) : NULL;
3268 break;
3269 case '2':
3270 addr->auth_id = (*ptr)? string_copy(ptr) : NULL;
3271 break;
3272 case '3':
3273 addr->auth_sndr = (*ptr)? string_copy(ptr) : NULL;
3274 break;
3275 }
6f123593
JH
3276 while (*ptr++);
3277 break;
3278
8ccd00b1 3279#ifndef DISABLE_PRDR
fd98a5c6 3280 case 'P':
8ccd00b1
JH
3281 addr->flags |= af_prdr_used;
3282 break;
fd98a5c6
JH
3283#endif
3284
6c1c3d1d 3285 case 'D':
d6c82d7b 3286 if (!addr) goto ADDR_MISMATCH;
6c1c3d1d
WB
3287 memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
3288 ptr += sizeof(addr->dsn_aware);
3289 DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
3290 break;
6c1c3d1d 3291
059ec3d9 3292 case 'A':
d6c82d7b 3293 if (!addr)
059ec3d9
PH
3294 {
3295 ADDR_MISMATCH:
3296 msg = string_sprintf("address count mismatch for data read from pipe "
3297 "for transport process %d for transport %s", pid,
3298 addrlist->transport->driver_name);
3299 done = TRUE;
3300 break;
3301 }
3302
895fbaf2 3303 switch (subid)
059ec3d9 3304 {
e6d2a989
JH
3305#ifdef SUPPORT_SOCKS
3306 case '2': /* proxy information; must arrive before A0 and applies to that addr XXX oops*/
3307 proxy_session = TRUE; /*XXX shouod this be cleared somewhere? */
3308 if (*ptr == 0)
3309 ptr++;
3310 else
3311 {
3312 proxy_local_address = string_copy(ptr);
3313 while(*ptr++);
3314 memcpy(&proxy_local_port, ptr, sizeof(proxy_local_port));
3315 ptr += sizeof(proxy_local_port);
3316 }
3317 break;
3318#endif
3319
895fbaf2
JH
3320#ifdef EXPERIMENTAL_DSN_INFO
3321 case '1': /* must arrive before A0, and applies to that addr */
3322 /* Two strings: smtp_greeting and helo_response */
3323 addr->smtp_greeting = string_copy(ptr);
3324 while(*ptr++);
3325 addr->helo_response = string_copy(ptr);
3326 while(*ptr++);
3327 break;
3328#endif
059ec3d9 3329
895fbaf2
JH
3330 case '0':
3331 addr->transport_return = *ptr++;
3332 addr->special_action = *ptr++;
3333 memcpy(&(addr->basic_errno), ptr, sizeof(addr->basic_errno));
3334 ptr += sizeof(addr->basic_errno);
3335 memcpy(&(addr->more_errno), ptr, sizeof(addr->more_errno));
3336 ptr += sizeof(addr->more_errno);
3337 memcpy(&(addr->flags), ptr, sizeof(addr->flags));
3338 ptr += sizeof(addr->flags);
3339 addr->message = (*ptr)? string_copy(ptr) : NULL;
3340 while(*ptr++);
3341 addr->user_message = (*ptr)? string_copy(ptr) : NULL;
3342 while(*ptr++);
059ec3d9 3343
895fbaf2
JH
3344 /* Always two strings for host information, followed by the port number and DNSSEC mark */
3345
3346 if (*ptr != 0)
3347 {
3348 h = store_get(sizeof(host_item));
3349 h->name = string_copy(ptr);
3350 while (*ptr++);
3351 h->address = string_copy(ptr);
3352 while(*ptr++);
3353 memcpy(&(h->port), ptr, sizeof(h->port));
3354 ptr += sizeof(h->port);
3355 h->dnssec = *ptr == '2' ? DS_YES
3356 : *ptr == '1' ? DS_NO
3357 : DS_UNK;
3358 ptr++;
3359 addr->host_used = h;
3360 }
3361 else ptr++;
3362
3363 /* Finished with this address */
3364
3365 addr = addr->next;
3366 break;
3367 }
059ec3d9
PH
3368 break;
3369
aeaf5db3
JH
3370 /* Local interface address/port */
3371 case 'I':
3372 if (*ptr) sending_ip_address = string_copy(ptr);
3373 while (*ptr++) ;
93a6fce2 3374 if (*ptr) sending_port = atoi(CS ptr);
aeaf5db3
JH
3375 while (*ptr++) ;
3376 break;
3377
059ec3d9
PH
3378 /* Z marks the logical end of the data. It is followed by '0' if
3379 continue_transport was NULL at the end of transporting, otherwise '1'.
3380 We need to know when it becomes NULL during a delivery down a passed SMTP
3381 channel so that we don't try to pass anything more down it. Of course, for
3382 most normal messages it will remain NULL all the time. */
3383
3384 case 'Z':
3385 if (*ptr == '0')
3386 {
3387 continue_transport = NULL;
3388 continue_hostname = NULL;
3389 }
3390 done = TRUE;
bd21a787 3391 DEBUG(D_deliver) debug_printf("Z0%c item read\n", *ptr);
059ec3d9
PH
3392 break;
3393
3394 /* Anything else is a disaster. */
3395
3396 default:
3397 msg = string_sprintf("malformed data (%d) read from pipe for transport "
3398 "process %d for transport %s", ptr[-1], pid,
3399 addr->transport->driver_name);
3400 done = TRUE;
3401 break;
3402 }
3403 }
3404
3405/* The done flag is inspected externally, to determine whether or not to
3406call the function again when the process finishes. */
3407
3408p->done = done;
3409
3410/* If the process hadn't finished, and we haven't seen the end of the data
3411or suffered a disaster, update the rest of the state, and return FALSE to
3412indicate "not finished". */
3413
3414if (!eop && !done)
3415 {
3416 p->addr = addr;
3417 p->msg = msg;
3418 return FALSE;
3419 }
3420
3421/* Close our end of the pipe, to prevent deadlock if the far end is still
3422pushing stuff into it. */
3423
f1e894f3 3424(void)close(fd);
059ec3d9
PH
3425p->fd = -1;
3426
3427/* If we have finished without error, but haven't had data for every address,
3428something is wrong. */
3429
d6c82d7b 3430if (!msg && addr)
059ec3d9
PH
3431 msg = string_sprintf("insufficient address data read from pipe "
3432 "for transport process %d for transport %s", pid,
3433 addr->transport->driver_name);
3434
3435/* If an error message is set, something has gone wrong in getting back
3436the delivery data. Put the message into each address and freeze it. */
3437
d6c82d7b
JH
3438if (msg)
3439 for (addr = addrlist; addr; addr = addr->next)
059ec3d9
PH
3440 {
3441 addr->transport_return = DEFER;
3442 addr->special_action = SPECIAL_FREEZE;
3443 addr->message = msg;
3444 }
059ec3d9
PH
3445
3446/* Return TRUE to indicate we have got all we need from this process, even
3447if it hasn't actually finished yet. */
3448
3449return TRUE;
3450}
3451
3452
3453
3454/*************************************************
3455* Post-process a set of remote addresses *
3456*************************************************/
3457
3458/* Do what has to be done immediately after a remote delivery for each set of
3459addresses, then re-write the spool if necessary. Note that post_process_one
3460puts the address on an appropriate queue; hence we must fish off the next
3461one first. This function is also called if there is a problem with setting
3462up a subprocess to do a remote delivery in parallel. In this case, the final
3463argument contains a message, and the action must be forced to DEFER.
3464
3465Argument:
3466 addr pointer to chain of address items
3467 logflags flags for logging
3468 msg NULL for normal cases; -> error message for unexpected problems
3469 fallback TRUE if processing fallback hosts
3470
3471Returns: nothing
3472*/
3473
3474static void
3475remote_post_process(address_item *addr, int logflags, uschar *msg,
3476 BOOL fallback)
3477{
3478host_item *h;
3479
3480/* If any host addresses were found to be unusable, add them to the unusable
3481tree so that subsequent deliveries don't try them. */
3482
d6c82d7b
JH
3483for (h = addr->host_list; h; h = h->next)
3484 if (h->address)
3485 if (h->status >= hstatus_unusable) tree_add_unusable(h);
059ec3d9
PH
3486
3487/* Now handle each address on the chain. The transport has placed '=' or '-'
3488into the special_action field for each successful delivery. */
3489
d6c82d7b 3490while (addr)
059ec3d9
PH
3491 {
3492 address_item *next = addr->next;
3493
3494 /* If msg == NULL (normal processing) and the result is DEFER and we are
3495 processing the main hosts and there are fallback hosts available, put the
3496 address on the list for fallback delivery. */
3497
d6c82d7b
JH
3498 if ( addr->transport_return == DEFER
3499 && addr->fallback_hosts
3500 && !fallback
3501 && !msg
3502 )
059ec3d9
PH
3503 {
3504 addr->host_list = addr->fallback_hosts;
3505 addr->next = addr_fallback;
3506 addr_fallback = addr;
3507 DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", addr->address);
3508 }
3509
3510 /* If msg is set (=> unexpected problem), set it in the address before
3511 doing the ordinary post processing. */
3512
3513 else
3514 {
d6c82d7b 3515 if (msg)
059ec3d9
PH
3516 {
3517 addr->message = msg;
3518 addr->transport_return = DEFER;
3519 }
3520 (void)post_process_one(addr, addr->transport_return, logflags,
3521 DTYPE_TRANSPORT, addr->special_action);
3522 }
3523
3524 /* Next address */
3525
3526 addr = next;
3527 }
3528
3529/* If we have just delivered down a passed SMTP channel, and that was
3530the last address, the channel will have been closed down. Now that
3531we have logged that delivery, set continue_sequence to 1 so that
3532any subsequent deliveries don't get "*" incorrectly logged. */
3533
d6c82d7b 3534if (!continue_transport) continue_sequence = 1;
059ec3d9
PH
3535}
3536
3537
3538
3539/*************************************************
3540* Wait for one remote delivery subprocess *
3541*************************************************/
3542
3543/* This function is called while doing remote deliveries when either the
3544maximum number of processes exist and we need one to complete so that another
3545can be created, or when waiting for the last ones to complete. It must wait for
3546the completion of one subprocess, empty the control block slot, and return a
3547pointer to the address chain.
3548
3549Arguments: none
3550Returns: pointer to the chain of addresses handled by the process;
3551 NULL if no subprocess found - this is an unexpected error
3552*/
3553
3554static address_item *
3555par_wait(void)
3556{
3557int poffset, status;
3558address_item *addr, *addrlist;
3559pid_t pid;
3560
3561set_process_info("delivering %s: waiting for a remote delivery subprocess "
3562 "to finish", message_id);
3563
3564/* Loop until either a subprocess completes, or there are no subprocesses in
3565existence - in which case give an error return. We cannot proceed just by
3566waiting for a completion, because a subprocess may have filled up its pipe, and
3567be waiting for it to be emptied. Therefore, if no processes have finished, we
3568wait for one of the pipes to acquire some data by calling select(), with a
3569timeout just in case.
3570
3571The simple approach is just to iterate after reading data from a ready pipe.
3572This leads to non-ideal behaviour when the subprocess has written its final Z
3573item, closed the pipe, and is in the process of exiting (the common case). A
3574call to waitpid() yields nothing completed, but select() shows the pipe ready -
3575reading it yields EOF, so you end up with busy-waiting until the subprocess has
3576actually finished.
3577
3578To avoid this, if all the data that is needed has been read from a subprocess
3579after select(), an explicit wait() for it is done. We know that all it is doing
3580is writing to the pipe and then exiting, so the wait should not be long.
3581
3582The non-blocking waitpid() is to some extent just insurance; if we could
3583reliably detect end-of-file on the pipe, we could always know when to do a
3584blocking wait() for a completed process. However, because some systems use
3585NDELAY, which doesn't distinguish between EOF and pipe empty, it is easier to
3586use code that functions without the need to recognize EOF.
3587
3588There's a double loop here just in case we end up with a process that is not in
3589the list of remote delivery processes. Something has obviously gone wrong if
3590this is the case. (For example, a process that is incorrectly left over from
3591routing or local deliveries might be found.) The damage can be minimized by
3592looping back and looking for another process. If there aren't any, the error
3593return will happen. */
3594
3595for (;;) /* Normally we do not repeat this loop */
3596 {
3597 while ((pid = waitpid(-1, &status, WNOHANG)) <= 0)
3598 {
3599 struct timeval tv;
3600 fd_set select_pipes;
3601 int maxpipe, readycount;
3602
3603 /* A return value of -1 can mean several things. If errno != ECHILD, it
3604 either means invalid options (which we discount), or that this process was
3605 interrupted by a signal. Just loop to try the waitpid() again.
3606
3607 If errno == ECHILD, waitpid() is telling us that there are no subprocesses
3608 in existence. This should never happen, and is an unexpected error.
3609 However, there is a nasty complication when running under Linux. If "strace
3610 -f" is being used under Linux to trace this process and its children,
3611 subprocesses are "stolen" from their parents and become the children of the
3612 tracing process. A general wait such as the one we've just obeyed returns
3613 as if there are no children while subprocesses are running. Once a
3614 subprocess completes, it is restored to the parent, and waitpid(-1) finds
3615 it. Thanks to Joachim Wieland for finding all this out and suggesting a
3616 palliative.
3617
3618 This does not happen using "truss" on Solaris, nor (I think) with other
3619 tracing facilities on other OS. It seems to be specific to Linux.
3620
3621 What we do to get round this is to use kill() to see if any of our
3622 subprocesses are still in existence. If kill() gives an OK return, we know
3623 it must be for one of our processes - it can't be for a re-use of the pid,
3624 because if our process had finished, waitpid() would have found it. If any
3625 of our subprocesses are in existence, we proceed to use select() as if
3626 waitpid() had returned zero. I think this is safe. */
3627
3628 if (pid < 0)
3629 {
3630 if (errno != ECHILD) continue; /* Repeats the waitpid() */
3631
3632 DEBUG(D_deliver)
3633 debug_printf("waitpid() returned -1/ECHILD: checking explicitly "
3634 "for process existence\n");
3635
3636 for (poffset = 0; poffset < remote_max_parallel; poffset++)
3637 {
3638 if ((pid = parlist[poffset].pid) != 0 && kill(pid, 0) == 0)
3639 {
3640 DEBUG(D_deliver) debug_printf("process %d still exists: assume "
3641 "stolen by strace\n", (int)pid);
3642 break; /* With poffset set */
3643 }
3644 }
3645
3646 if (poffset >= remote_max_parallel)
3647 {
3648 DEBUG(D_deliver) debug_printf("*** no delivery children found\n");
3649 return NULL; /* This is the error return */
3650 }
3651 }
3652
3653 /* A pid value greater than 0 breaks the "while" loop. A negative value has
3654 been handled above. A return value of zero means that there is at least one
3655 subprocess, but there are no completed subprocesses. See if any pipes are
3656 ready with any data for reading. */
3657
3658 DEBUG(D_deliver) debug_printf("sel