Start
[exim.git] / src / src / rda.c
CommitLineData
059ec3d9
PH
1/* $Cambridge: exim/src/src/rda.c,v 1.1 2004/10/07 10:39:01 ph10 Exp $ */
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
7/* Copyright (c) University of Cambridge 1995 - 2004 */
8/* See the file NOTICE for conditions of use and distribution. */
9
10/* This module contains code for extracting addresses from a forwarding list
11(from an alias or forward file) or by running the filter interpreter. It may do
12this in a sub-process if a uid/gid are supplied. */
13
14
15#include "exim.h"
16
17enum { FILE_EXIST, FILE_NOT_EXIST, FILE_EXIST_UNCLEAR };
18
19#define REPLY_EXISTS 0x01
20#define REPLY_EXPAND 0x02
21#define REPLY_RETURN 0x04
22
23
24/*************************************************
25* Check string for filter program *
26*************************************************/
27
28/* This function checks whether a string is actually a filter program. The rule
29is that it must start with "# Exim filter ..." (any capitalization, spaces
30optional). It is envisaged that in future, other kinds of filter may be
31implemented. That's why it is implemented the way it is. The function is global
32because it is also called from filter.c when checking filters.
33
34Argument: the string
35
36Returns: FILTER_EXIM if it starts with "# Exim filter"
37 FILTER_SIEVE if it starts with "# Sieve filter"
38 FILTER_FORWARD otherwise
39*/
40
41/* This is an auxiliary function for matching a tag. */
42
43static BOOL
44match_tag(const uschar *s, const uschar *tag)
45{
46for (; *tag != 0; s++, tag++)
47 {
48 if (*tag == ' ')
49 {
50 while (*s == ' ' || *s == '\t') s++;
51 s--;
52 }
53 else if (tolower(*s) != tolower(*tag)) break;
54 }
55return (*tag == 0);
56}
57
58/* This is the real function. It should be easy to add checking different
59tags for other types of filter. */
60
61int
62rda_is_filter(const uschar *s)
63{
64while (isspace(*s)) s++; /* Skips initial blank lines */
65if (match_tag(s, CUS"# exim filter")) return FILTER_EXIM;
66 else if (match_tag(s, CUS"# sieve filter")) return FILTER_SIEVE;
67 else return FILTER_FORWARD;
68}
69
70
71
72
73/*************************************************
74* Check for existence of file *
75*************************************************/
76
77/* First of all, we stat the file. If this fails, we try to stat the enclosing
78directory, because a file in an unmounted NFS directory will look the same as a
79non-existent file. It seems that in Solaris 2.6, statting an entry in an
80indirect map that is currently unmounted does not cause the mount to happen.
81Instead, dummy data is returned, which defeats the whole point of this test.
82However, if a stat() is done on some object inside the directory, such as the
83"." back reference to itself, then the mount does occur. If an NFS host is
84taken offline, it is possible for the stat() to get stuck until it comes back.
85To guard against this, stick a timer round it. If we can't access the "."
86inside the directory, try the plain directory, just in case that helps.
87
88Argument:
89 filename the file name
90 error for message on error
91
92Returns: FILE_EXIST the file exists
93 FILE_NOT_EXIST the file does not exist
94 FILE_EXIST_UNCLEAR cannot determine existence
95*/
96
97static int
98rda_exists(uschar *filename, uschar **error)
99{
100int rc, saved_errno;
101uschar *slash;
102struct stat statbuf;
103
104if ((rc = Ustat(filename, &statbuf)) >= 0) return FILE_EXIST;
105saved_errno = errno;
106
107Ustrncpy(big_buffer, filename, big_buffer_size - 3);
108sigalrm_seen = FALSE;
109
110if (saved_errno == ENOENT)
111 {
112 slash = Ustrrchr(big_buffer, '/');
113 Ustrcpy(slash+1, ".");
114
115 alarm(30);
116 rc = Ustat(big_buffer, &statbuf);
117 if (rc != 0 && errno == EACCES && !sigalrm_seen)
118 {
119 *slash = 0;
120 rc = Ustat(big_buffer, &statbuf);
121 }
122 saved_errno = errno;
123 alarm(0);
124
125 DEBUG(D_route) debug_printf("stat(%s)=%d\n", big_buffer, rc);
126 }
127
128if (sigalrm_seen || rc != 0)
129 {
130 *error = string_sprintf("failed to stat %s (%s)", big_buffer,
131 sigalrm_seen? "timeout" : strerror(saved_errno));
132 return FILE_EXIST_UNCLEAR;
133 }
134
135*error = string_sprintf("%s does not exist", filename);
136DEBUG(D_route) debug_printf("%s\n", *error);
137return FILE_NOT_EXIST;
138}
139
140
141
142/*************************************************
143* Get forwarding list from a file *
144*************************************************/
145
146/* Open a file and read its entire contents into a block of memory. Certain
147opening errors are optionally treated the same as "file does not exist".
148
149ENOTDIR means that something along the line is not a directory: there are
150installations that set home directories to be /dev/null for non-login accounts
151but in normal circumstances this indicates some kind of configuration error.
152
153EACCES means there's a permissions failure. Some users turn off read permission
154on a .forward file to suspend forwarding, but this is probably an error in any
155kind of mailing list processing.
156
157The redirect block that contains the file name also contains constraints such
158as who may own the file, and mode bits that must not be set. This function is
159
160Arguments:
161 rdata rdirect block, containing file name and constraints
162 options for the RDO_ENOTDIR and RDO_EACCES options
163 error where to put an error message
164 yield what to return from rda_interpret on error
165
166Returns: pointer to string in store; NULL on error
167*/
168
169static uschar *
170rda_get_file_contents(redirect_block *rdata, int options, uschar **error,
171 int *yield)
172{
173FILE *fwd;
174uschar *filebuf;
175uschar *filename = rdata->string;
176BOOL uid_ok = !rdata->check_owner;
177BOOL gid_ok = !rdata->check_group;
178struct stat statbuf;
179
180/* Attempt to open the file. If it appears not to exist, check up on the
181containing directory by statting it. If the directory does not exist, we treat
182this situation as an error (which will cause delivery to defer); otherwise we
183pass back FF_NONEXIST, which causes the redirect router to decline.
184
185However, if the ignore_enotdir option is set (to ignore "something on the
186path is not a directory" errors), the right behaviour seems to be not to do the
187directory test. */
188
189fwd = Ufopen(filename, "rb");
190if (fwd == NULL)
191 {
192 switch(errno)
193 {
194 case ENOENT: /* File does not exist */
195 DEBUG(D_route) debug_printf("%s does not exist\n%schecking parent directory\n",
196 filename,
197 ((options & RDO_ENOTDIR) != 0)? "ignore_enotdir set => skip " : "");
198 *yield = (((options & RDO_ENOTDIR) != 0) ||
199 rda_exists(filename, error) == FILE_NOT_EXIST)?
200 FF_NONEXIST : FF_ERROR;
201 return NULL;
202
203 case ENOTDIR: /* Something on the path isn't a directory */
204 if ((options & RDO_ENOTDIR) == 0) goto DEFAULT_ERROR;
205 DEBUG(D_route) debug_printf("non-directory on path %s: file assumed not to "
206 "exist\n", filename);
207 *yield = FF_NONEXIST;
208 return NULL;
209
210 case EACCES: /* Permission denied */
211 if ((options & RDO_EACCES) == 0) goto DEFAULT_ERROR;
212 DEBUG(D_route) debug_printf("permission denied for %s: file assumed not to "
213 "exist\n", filename);
214 *yield = FF_NONEXIST;
215 return NULL;
216
217 DEFAULT_ERROR:
218 default:
219 *error = string_open_failed(errno, "%s", filename);
220 *yield = FF_ERROR;
221 return NULL;
222 }
223 }
224
225/* Check that we have a regular file. */
226
227if (fstat(fileno(fwd), &statbuf) != 0)
228 {
229 *error = string_sprintf("failed to stat %s: %s", filename, strerror(errno));
230 goto ERROR_RETURN;
231 }
232
233if ((statbuf.st_mode & S_IFMT) != S_IFREG)
234 {
235 *error = string_sprintf("%s is not a regular file", filename);
236 goto ERROR_RETURN;
237 }
238
239/* Check for unwanted mode bits */
240
241if ((statbuf.st_mode & rdata->modemask) != 0)
242 {
243 *error = string_sprintf("bad mode (0%o) for %s: 0%o bit(s) unexpected",
244 statbuf.st_mode, filename, statbuf.st_mode & rdata->modemask);
245 goto ERROR_RETURN;
246 }
247
248/* Check the file owner and file group if required to do so. */
249
250if (!uid_ok)
251 {
252 if (rdata->pw != NULL && statbuf.st_uid == rdata->pw->pw_uid)
253 uid_ok = TRUE;
254 else if (rdata->owners != NULL)
255 {
256 int i;
257 for (i = 1; i <= (int)(rdata->owners[0]); i++)
258 if (rdata->owners[i] == statbuf.st_uid) { uid_ok = TRUE; break; }
259 }
260 }
261
262if (!gid_ok)
263 {
264 if (rdata->pw != NULL && statbuf.st_gid == rdata->pw->pw_gid)
265 gid_ok = TRUE;
266 else if (rdata->owngroups != NULL)
267 {
268 int i;
269 for (i = 1; i <= (int)(rdata->owngroups[0]); i++)
270 if (rdata->owngroups[i] == statbuf.st_gid) { gid_ok = TRUE; break; }
271 }
272 }
273
274if (!uid_ok || !gid_ok)
275 {
276 *error = string_sprintf("bad %s for %s", uid_ok? "group" : "owner", filename);
277 goto ERROR_RETURN;
278 }
279
280/* Put an upper limit on the size of the file, just to stop silly people
281feeding in ridiculously large files, which can easily be created by making
282files that have holes in them. */
283
284if (statbuf.st_size > MAX_FILTER_SIZE)
285 {
286 *error = string_sprintf("%s is too big (max %d)", filename, MAX_FILTER_SIZE);
287 goto ERROR_RETURN;
288 }
289
290/* Read the file in one go in order to minimize the time we have it open. */
291
292filebuf = store_get(statbuf.st_size + 1);
293
294if (fread(filebuf, 1, statbuf.st_size, fwd) != statbuf.st_size)
295 {
296 *error = string_sprintf("error while reading %s: %s",
297 filename, strerror(errno));
298 goto ERROR_RETURN;
299 }
300filebuf[statbuf.st_size] = 0;
301
302/* Don't pass statbuf.st_size directly to debug_printf. On some systems it
303is a long, which may not be the same as an int. */
304
305DEBUG(D_route)
306 {
307 int size = (int)statbuf.st_size;
308 debug_printf("%d bytes read from %s\n", size, filename);
309 }
310
311fclose(fwd);
312return filebuf;
313
314/* Return an error: the string is already set up. */
315
316ERROR_RETURN:
317*yield = FF_ERROR;
318fclose(fwd);
319return NULL;
320}
321
322
323
324/*************************************************
325* Extract info from list or filter *
326*************************************************/
327
328/* This function calls the appropriate function to extract addresses from a
329forwarding list, or to run a filter file and get addresses from there.
330
331Arguments:
332 rdata the redirection block
333 options the options bits
334 include_directory restrain to this directory
335 sieve_vacation_directory passed to sieve_interpret
336 generated where to hang generated addresses
337 error for error messages
338 eblockp for details of skipped syntax errors
339 (NULL => no skip)
340 filtertype set to the filter type:
341 FILTER_FORWARD => a traditional .forward file
342 FILTER_EXIM => an Exim filter file
343 FILTER_SIEVE => a Sieve filter file
344 a system filter is always forced to be FILTER_EXIM
345
346Returns: a suitable return for rda_interpret()
347*/
348
349static int
350rda_extract(redirect_block *rdata, int options, uschar *include_directory,
351 uschar *sieve_vacation_directory, address_item **generated, uschar **error,
352 error_block **eblockp, int *filtertype)
353{
354uschar *data;
355
356if (rdata->isfile)
357 {
358 int yield;
359 data = rda_get_file_contents(rdata, options, error, &yield);
360 if (data == NULL) return yield;
361 }
362else data = rdata->string;
363
364*filtertype = system_filtering? FILTER_EXIM : rda_is_filter(data);
365
366/* Filter interpretation is done by a general function that is also called from
367the filter testing option (-bf). There are two versions: one for Exim filtering
368and one for Sieve filtering. Several features of string expansion may be locked
369out at sites that don't trust users. This is done by setting flags in
370expand_forbid that the expander inspects. */
371
372if (*filtertype != FILTER_FORWARD)
373 {
374 int frc;
375 int old_expand_forbid = expand_forbid;
376
377 if ((options & RDO_FILTER) == 0)
378 {
379 *error = US"filtering not enabled";
380 return FF_ERROR;
381 }
382
383 DEBUG(D_route) debug_printf("data is %s filter program\n",
384 (*filtertype == FILTER_EXIM)? "an Exim" : "a Sieve");
385
386 expand_forbid =
387 (expand_forbid & ~RDO_FILTER_EXPANSIONS) |
388 (options & RDO_FILTER_EXPANSIONS);
389
390 frc = (*filtertype == FILTER_EXIM)?
391 filter_interpret(data, options, generated, error)
392 :
393 sieve_interpret(data, options, sieve_vacation_directory, generated, error);
394
395 expand_forbid = old_expand_forbid;
396 return frc;
397 }
398
399/* Not a filter script */
400
401DEBUG(D_route) debug_printf("file is not a filter file\n");
402
403return parse_forward_list(data,
404 options, /* specials that are allowed */
405 generated, /* where to hang them */
406 error, /* for errors */
407 deliver_domain, /* to qualify \name */
408 include_directory, /* restrain to directory */
409 eblockp); /* for skipped syntax errors */
410}
411
412
413
414
415/*************************************************
416* Write string down pipe *
417*************************************************/
418
419/* This function is used for tranferring a string down a pipe between
420processes. If the pointer is NULL, a length of zero is written.
421
422Arguments:
423 fd the pipe
424 s the string
425
426Returns: nothing
427*/
428
429static void
430rda_write_string(int fd, uschar *s)
431{
432int len = (s == NULL)? 0 : Ustrlen(s) + 1;
433write(fd, &len, sizeof(int));
434if (s != NULL) write(fd, s, len);
435}
436
437
438
439/*************************************************
440* Read string from pipe *
441*************************************************/
442
443/* This function is used for receiving a string from a pipe.
444
445Arguments:
446 fd the pipe
447 sp where to put the string
448
449Returns: FALSE if data missing
450*/
451
452static BOOL
453rda_read_string(int fd, uschar **sp)
454{
455int len;
456
457if (read(fd, &len, sizeof(int)) != sizeof(int)) return FALSE;
458if (len == 0) *sp = NULL; else
459 {
460 *sp = store_get(len);
461 if (read(fd, *sp, len) != len) return FALSE;
462 }
463return TRUE;
464}
465
466
467
468/*************************************************
469* Interpret forward list or filter *
470*************************************************/
471
472/* This function is passed a forward list string (unexpanded) or the name of a
473file (unexpanded) whose contents are the forwarding list. The list may in fact
474be a filter program if it starts with "#Exim filter" or "#Sieve filter". Other
475types of filter, with different inital tag strings, may be introduced in due
476course.
477
478The job of the function is to process the forwarding list or filter. It is
479pulled out into this separate function, because it is used for system filter
480files as well as from the redirect router.
481
482If the function is given a uid/gid, it runs a subprocess that passes the
483results back via a pipe. This provides security for things like :include:s in
484users' .forward files, and "logwrite" calls in users' filter files. A
485sub-process is NOT used when:
486
487 . No uid/gid is provided
488 . The input is a string which is not a filter string, and does not contain
489 :include:
490 . The input is a file whose non-existence can be detected in the main
491 process (which is usually running as root).
492
493Arguments:
494 rdata redirect data (file + constraints, or data string)
495 options options to pass to the extraction functions,
496 plus ENOTDIR and EACCES handling bits
497 include_directory restrain :include: to this directory
498 sieve_vacation_directory directory passed to sieve_interpret()
499 ugid uid/gid to run under - if NULL, no change
500 generated where to hang generated addresses, initially NULL
501 error pointer for error message
502 eblockp for skipped syntax errors; NULL if no skipping
503 filtertype set to the type of file:
504 FILTER_FORWARD => traditional .forward file
505 FILTER_EXIM => an Exim filter file
506 FILTER_SIEVE => a Sieve filter file
507 a system filter is always forced to be FILTER_EXIM
508 rname router name for error messages in the format
509 "xxx router" or "system filter"
510
511Returns: values from extraction function, or FF_NONEXIST:
512 FF_DELIVERED success, a significant action was taken
513 FF_NOTDELIVERED success, no significant action
514 FF_BLACKHOLE :blackhole:
515 FF_DEFER defer requested
516 FF_FAIL fail requested
517 FF_INCLUDEFAIL some problem with :include:
518 FF_FREEZE freeze requested
519 FF_ERROR there was a problem
520 FF_NONEXIST the file does not exist
521*/
522
523int
524rda_interpret(redirect_block *rdata, int options, uschar *include_directory,
525 uschar *sieve_vacation_directory, ugid_block *ugid, address_item **generated,
526 uschar **error, error_block **eblockp, int *filtertype, uschar *rname)
527{
528int fd, rc, pfd[2];
529int yield, status;
530BOOL had_disaster = FALSE;
531pid_t pid;
532uschar *data;
533uschar *readerror = US"";
534void (*oldsignal)(int);
535
536DEBUG(D_route) debug_printf("rda_interpret (%s): %s\n",
537 (rdata->isfile)? "file" : "string", rdata->string);
538
539/* Do the expansions of the file name or data first, while still privileged. */
540
541data = expand_string(rdata->string);
542if (data == NULL)
543 {
544 if (expand_string_forcedfail) return FF_NOTDELIVERED;
545 *error = string_sprintf("failed to expand \"%s\": %s", rdata->string,
546 expand_string_message);
547 return FF_ERROR;
548 }
549rdata->string = data;
550
551DEBUG(D_route) debug_printf("expanded: %s\n", data);
552
553if (rdata->isfile && data[0] != '/')
554 {
555 *error = string_sprintf("\"%s\" is not an absolute path", data);
556 return FF_ERROR;
557 }
558
559/* If no uid/gid are supplied, or if we have a data string which does not start
560with #Exim filter or #Sieve filter, and does not contain :include:, do all the
561work in this process. Note that for a system filter, we always have a file, so
562the work is done in this process only if no user is supplied. */
563
564if (!ugid->uid_set || /* Either there's no uid, or */
565 (!rdata->isfile && /* We've got the data, and */
566 rda_is_filter(data) == FILTER_FORWARD && /* It's not a filter script, */
567 Ustrstr(data, ":include:") == NULL)) /* and there's no :include: */
568 {
569 return rda_extract(rdata, options, include_directory,
570 sieve_vacation_directory, generated, error, eblockp, filtertype);
571 }
572
573/* We need to run the processing code in a sub-process. However, if we can
574determine the non-existence of a file first, we can decline without having to
575create the sub-process. */
576
577if (rdata->isfile && rda_exists(data, error) == FILE_NOT_EXIST)
578 return FF_NONEXIST;
579
580/* If the file does exist, or we can't tell (non-root mounted NFS directory)
581we have to create the subprocess to do everything as the given user. The
582results of processing are passed back via a pipe. */
583
584if (pipe(pfd) != 0)
585 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "creation of pipe for filter or "
586 ":include: failed for %s: %s", rname, strerror(errno));
587
588/* Ensure that SIGCHLD is set to SIG_DFL before forking, so that the child
589process can be waited for. We sometimes get here with it set otherwise. Save
590the old state for resetting on the wait. */
591
592oldsignal = signal(SIGCHLD, SIG_DFL);
593if ((pid = fork()) == 0)
594 {
595 header_line *waslast = header_last; /* Save last header */
596
597 fd = pfd[pipe_write];
598 close(pfd[pipe_read]);
599 exim_setugid(ugid->uid, ugid->gid, FALSE, rname);
600
601 /* Addresses can get rewritten in filters; if we are not root or the exim
602 user (and we probably are not), turn off rewrite logging, because we cannot
603 write to the log now. */
604
605 if (ugid->uid != root_uid && ugid->uid != exim_uid)
606 {
607 DEBUG(D_rewrite) debug_printf("turned off address rewrite logging (not "
608 "root or exim in this process)\n");
609 log_write_selector &= ~L_address_rewrite;
610 }
611
612 /* Now do the business */
613
614 yield = rda_extract(rdata, options, include_directory,
615 sieve_vacation_directory, generated, error, eblockp, filtertype);
616
617 /* Pass back whether it was a filter, and the return code and any overall
618 error text via the pipe. */
619
620 write(fd, filtertype, sizeof(int));
621 write(fd, &yield, sizeof(int));
622 rda_write_string(fd, *error);
623
624 /* Pass back the contents of any syntax error blocks if we have a pointer */
625
626 if (eblockp != NULL)
627 {
628 error_block *ep;
629 for (ep = *eblockp; ep != NULL; ep = ep->next)
630 {
631 rda_write_string(fd, ep->text1);
632 rda_write_string(fd, ep->text2);
633 }
634 rda_write_string(fd, NULL); /* Indicates end of eblocks */
635 }
636
637 /* If this is a system filter, we have to pass back the numbers of any
638 original header lines that were removed, and then any header lines that were
639 added but not subsequently removed. */
640
641 if (system_filtering)
642 {
643 int i = 0;
644 header_line *h;
645 for (h = header_list; h != waslast->next; i++, h = h->next)
646 {
647 if (h->type == htype_old) write(fd, &i, sizeof(i));
648 }
649 i = -1;
650 write(fd, &i, sizeof(i));
651
652 while (waslast != header_last)
653 {
654 waslast = waslast->next;
655 if (waslast->type != htype_old)
656 {
657 rda_write_string(fd, waslast->text);
658 write(fd, &(waslast->type), sizeof(waslast->type));
659 }
660 }
661 rda_write_string(fd, NULL); /* Indicates end of added headers */
662 }
663
664 /* Write the contents of the $n variables */
665
666 write(fd, filter_n, sizeof(filter_n));
667
668 /* If the result was DELIVERED or NOTDELIVERED, we pass back the generated
669 addresses, and their associated information, through the pipe. This is
670 just tedious, but it seems to be the only safe way. We do this also for
671 FAIL and FREEZE, because a filter is allowed to set up deliveries that
672 are honoured before freezing or failing. */
673
674 if (yield == FF_DELIVERED || yield == FF_NOTDELIVERED ||
675 yield == FF_FAIL || yield == FF_FREEZE)
676 {
677 address_item *addr;
678 for (addr = *generated; addr != NULL; addr = addr->next)
679 {
680 int reply_options = 0;
681
682 rda_write_string(fd, addr->address);
683 write(fd, &(addr->mode), sizeof(addr->mode));
684 write(fd, &(addr->flags), sizeof(addr->flags));
685 rda_write_string(fd, addr->p.errors_address);
686
687 if (addr->pipe_expandn != NULL)
688 {
689 uschar **pp;
690 for (pp = addr->pipe_expandn; *pp != NULL; pp++)
691 rda_write_string(fd, *pp);
692 }
693 rda_write_string(fd, NULL);
694
695 if (addr->reply == NULL)
696 write(fd, &reply_options, sizeof(int)); /* 0 means no reply */
697 else
698 {
699 reply_options |= REPLY_EXISTS;
700 if (addr->reply->file_expand) reply_options |= REPLY_EXPAND;
701 if (addr->reply->return_message) reply_options |= REPLY_RETURN;
702 write(fd, &reply_options, sizeof(int));
703 write(fd, &(addr->reply->expand_forbid), sizeof(int));
704 write(fd, &(addr->reply->once_repeat), sizeof(time_t));
705 rda_write_string(fd, addr->reply->to);
706 rda_write_string(fd, addr->reply->cc);
707 rda_write_string(fd, addr->reply->bcc);
708 rda_write_string(fd, addr->reply->from);
709 rda_write_string(fd, addr->reply->reply_to);
710 rda_write_string(fd, addr->reply->subject);
711 rda_write_string(fd, addr->reply->headers);
712 rda_write_string(fd, addr->reply->text);
713 rda_write_string(fd, addr->reply->file);
714 rda_write_string(fd, addr->reply->logfile);
715 rda_write_string(fd, addr->reply->oncelog);
716 }
717 }
718
719 rda_write_string(fd, NULL); /* Marks end of addresses */
720 }
721
722 /* OK, this process is now done. Must use _exit() and not exit() !! */
723
724 close(fd);
725 _exit(0);
726 }
727
728/* Back in the main process: panic if the fork did not succeed. */
729
730if (pid < 0)
731 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "fork failed for %s", rname);
732
733/* Read the pipe to get the data from the filter/forward. Our copy of the
734writing end must be closed first, as otherwise read() won't return zero on an
735empty pipe. Afterwards, close the reading end. */
736
737close(pfd[pipe_write]);
738
739/* Read initial data, including yield and contents of *error */
740
741fd = pfd[pipe_read];
742if (read(fd, filtertype, sizeof(int)) != sizeof(int) ||
743 read(fd, &yield, sizeof(int)) != sizeof(int) ||
744 !rda_read_string(fd, error)) goto DISASTER;
745
746DEBUG(D_route)
747 debug_printf("rda_interpret: subprocess yield=%d error=%s\n", yield, *error);
748
749/* Read the contents of any syntax error blocks if we have a pointer */
750
751if (eblockp != NULL)
752 {
753 uschar *s;
754 error_block *e;
755 error_block **p = eblockp;
756 for (;;)
757 {
758 if (!rda_read_string(fd, &s)) goto DISASTER;
759 if (s == NULL) break;
760 e = store_get(sizeof(error_block));
761 e->next = NULL;
762 e->text1 = s;
763 if (!rda_read_string(fd, &s)) goto DISASTER;
764 e->text2 = s;
765 *p = e;
766 p = &(e->next);
767 }
768 }
769
770/* If this is a system filter, read the identify of any original header lines
771that were removed, and then read data for any new ones that were added. */
772
773if (system_filtering)
774 {
775 int hn = 0;
776 header_line *h = header_list;
777
778 for (;;)
779 {
780 int n;
781 if (read(fd, &n, sizeof(int)) != sizeof(int)) goto DISASTER;
782 if (n < 0) break;
783 while (hn < n)
784 {
785 hn++;
786 h = h->next;
787 if (h == NULL) goto DISASTER_NO_HEADER;
788 }
789 h->type = htype_old;
790 }
791
792 for (;;)
793 {
794 uschar *s;
795 int type;
796 if (!rda_read_string(fd, &s)) goto DISASTER;
797 if (s == NULL) break;
798 if (read(fd, &type, sizeof(type)) != sizeof(type)) goto DISASTER;
799 header_add(type, "%s", s);
800 }
801 }
802
803/* Read the values of the $n variables */
804
805if (read(fd, filter_n, sizeof(filter_n)) != sizeof(filter_n)) goto DISASTER;
806
807/* If the yield is DELIVERED, NOTDELIVERED, FAIL, or FREEZE there may follow
808addresses and data to go with them. Keep them in the same order in the
809generated chain. */
810
811if (yield == FF_DELIVERED || yield == FF_NOTDELIVERED ||
812 yield == FF_FAIL || yield == FF_FREEZE)
813 {
814 address_item **nextp = generated;
815
816 for (;;)
817 {
818 int i, reply_options;
819 address_item *addr;
820 uschar *recipient;
821 uschar *expandn[EXPAND_MAXN + 2];
822
823 /* First string is the address; NULL => end of addresses */
824
825 if (!rda_read_string(fd, &recipient)) goto DISASTER;
826 if (recipient == NULL) break;
827
828 /* Hang on the end of the chain */
829
830 addr = deliver_make_addr(recipient, FALSE);
831 *nextp = addr;
832 nextp = &(addr->next);
833
834 /* Next comes the mode and the flags fields */
835
836 if (read(fd, &(addr->mode), sizeof(addr->mode)) != sizeof(addr->mode) ||
837 read(fd, &(addr->flags), sizeof(addr->flags)) != sizeof(addr->flags) ||
838 !rda_read_string(fd, &(addr->p.errors_address))) goto DISASTER;
839
840 /* Next comes a possible setting for $thisaddress and any numerical
841 variables for pipe expansion, terminated by a NULL string. The maximum
842 number of numericals is EXPAND_MAXN. Note that we put filter_thisaddress
843 into the zeroth item in the vector - this is sorted out inside the pipe
844 transport. */
845
846 for (i = 0; i < EXPAND_MAXN + 1; i++)
847 {
848 uschar *temp;
849 if (!rda_read_string(fd, &temp)) goto DISASTER;
850 if (i == 0) filter_thisaddress = temp; /* Just in case */
851 expandn[i] = temp;
852 if (temp == NULL) break;
853 }
854
855 if (i > 0)
856 {
857 addr->pipe_expandn = store_get((i+1) * sizeof(uschar **));
858 addr->pipe_expandn[i] = NULL;
859 while (--i >= 0) addr->pipe_expandn[i] = expandn[i];
860 }
861
862 /* Then an int containing reply options; zero => no reply data. */
863
864 if (read(fd, &reply_options, sizeof(int)) != sizeof(int)) goto DISASTER;
865 if ((reply_options & REPLY_EXISTS) != 0)
866 {
867 addr->reply = store_get(sizeof(reply_item));
868
869 addr->reply->file_expand = (reply_options & REPLY_EXPAND) != 0;
870 addr->reply->return_message = (reply_options & REPLY_RETURN) != 0;
871
872 if (read(fd,&(addr->reply->expand_forbid),sizeof(int)) !=
873 sizeof(int) ||
874 read(fd,&(addr->reply->once_repeat),sizeof(time_t)) !=
875 sizeof(time_t) ||
876 !rda_read_string(fd, &(addr->reply->to)) ||
877 !rda_read_string(fd, &(addr->reply->cc)) ||
878 !rda_read_string(fd, &(addr->reply->bcc)) ||
879 !rda_read_string(fd, &(addr->reply->from)) ||
880 !rda_read_string(fd, &(addr->reply->reply_to)) ||
881 !rda_read_string(fd, &(addr->reply->subject)) ||
882 !rda_read_string(fd, &(addr->reply->headers)) ||
883 !rda_read_string(fd, &(addr->reply->text)) ||
884 !rda_read_string(fd, &(addr->reply->file)) ||
885 !rda_read_string(fd, &(addr->reply->logfile)) ||
886 !rda_read_string(fd, &(addr->reply->oncelog)))
887 goto DISASTER;
888 }
889 }
890 }
891
892/* All data has been transferred from the sub-process. Reap it, close the
893reading end of the pipe, and we are done. */
894
895WAIT_EXIT:
896while ((rc = wait(&status)) != pid)
897 {
898 if (rc < 0 && errno == ECHILD) /* Process has vanished */
899 {
900 log_write(0, LOG_MAIN, "redirection process %d vanished unexpectedly", pid);
901 goto FINAL_EXIT;
902 }
903 }
904
905if (had_disaster)
906 {
907 *error = string_sprintf("internal problem in %s: failure to transfer "
908 "data from subprocess: status=%04x%s%s%s", rname,
909 status, readerror,
910 (*error == NULL)? US"" : US": error=",
911 (*error == NULL)? US"" : *error);
912 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *error);
913 }
914else if (status != 0)
915 {
916 log_write(0, LOG_MAIN|LOG_PANIC, "internal problem in %s: unexpected status "
917 "%04x from redirect subprocess (but data correctly received)", rname,
918 status);
919 }
920
921FINAL_EXIT:
922close(fd);
923signal(SIGCHLD, oldsignal); /* restore */
924return yield;
925
926
927/* Come here if the data indicates removal of a header that we can't find */
928
929DISASTER_NO_HEADER:
930readerror = US" readerror=bad header identifier";
931had_disaster = TRUE;
932yield = FF_ERROR;
933goto WAIT_EXIT;
934
935/* Come here is there's a shambles in transferring the data over the pipe. The
936value of errno should still be set. */
937
938DISASTER:
939readerror = string_sprintf(" readerror='%s'", strerror(errno));
940had_disaster = TRUE;
941yield = FF_ERROR;
942goto WAIT_EXIT;
943}
944
945/* End of rda.c */