SOCKS: fix function prototype
[exim.git] / src / src / route.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions concerned with routing, and the list of generic router options. */
9
10
11#include "exim.h"
12
13
14
15/* Generic options for routers, all of which live inside router_instance
16data blocks and which therefore have the opt_public flag set. */
17
18optionlist optionlist_routers[] = {
19 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
20 (void *)(offsetof(router_instance, expand_gid)) },
21 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
22 (void *)(offsetof(router_instance, expand_more)) },
23 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
24 (void *)(offsetof(router_instance, expand_unseen)) },
25 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
26 (void *)(offsetof(router_instance, expand_uid)) },
27 { "*set_group", opt_bool | opt_hidden | opt_public,
28 (void *)(offsetof(router_instance, gid_set)) },
29 { "*set_user", opt_bool | opt_hidden | opt_public,
30 (void *)(offsetof(router_instance, uid_set)) },
31 { "address_data", opt_stringptr|opt_public,
32 (void *)(offsetof(router_instance, address_data)) },
33 { "address_test", opt_bool|opt_public,
34 (void *)(offsetof(router_instance, address_test)) },
8523533c
TK
35#ifdef EXPERIMENTAL_BRIGHTMAIL
36 { "bmi_deliver_alternate", opt_bool | opt_public,
37 (void *)(offsetof(router_instance, bmi_deliver_alternate)) },
38 { "bmi_deliver_default", opt_bool | opt_public,
39 (void *)(offsetof(router_instance, bmi_deliver_default)) },
40 { "bmi_dont_deliver", opt_bool | opt_public,
41 (void *)(offsetof(router_instance, bmi_dont_deliver)) },
42 { "bmi_rule", opt_stringptr|opt_public,
43 (void *)(offsetof(router_instance, bmi_rule)) },
44#endif
059ec3d9
PH
45 { "cannot_route_message", opt_stringptr | opt_public,
46 (void *)(offsetof(router_instance, cannot_route_message)) },
47 { "caseful_local_part", opt_bool | opt_public,
48 (void *)(offsetof(router_instance, caseful_local_part)) },
49 { "check_local_user", opt_bool | opt_public,
50 (void *)(offsetof(router_instance, check_local_user)) },
846726c5 51 { "condition", opt_stringptr|opt_public|opt_rep_con,
059ec3d9
PH
52 (void *)offsetof(router_instance, condition) },
53 { "debug_print", opt_stringptr | opt_public,
54 (void *)offsetof(router_instance, debug_string) },
55 { "disable_logging", opt_bool | opt_public,
56 (void *)offsetof(router_instance, disable_logging) },
99c1bb4e 57 { "dnssec_request_domains", opt_stringptr|opt_public,
7cd171b7 58 (void *)offsetof(router_instance, dnssec.request) },
99c1bb4e 59 { "dnssec_require_domains", opt_stringptr|opt_public,
7cd171b7 60 (void *)offsetof(router_instance, dnssec.require) },
059ec3d9
PH
61 { "domains", opt_stringptr|opt_public,
62 (void *)offsetof(router_instance, domains) },
63 { "driver", opt_stringptr|opt_public,
64 (void *)offsetof(router_instance, driver_name) },
6c1c3d1d
WB
65 { "dsn_lasthop", opt_bool|opt_public,
66 (void *)offsetof(router_instance, dsn_lasthop) },
059ec3d9
PH
67 { "errors_to", opt_stringptr|opt_public,
68 (void *)(offsetof(router_instance, errors_to)) },
69 { "expn", opt_bool|opt_public,
70 (void *)offsetof(router_instance, expn) },
71 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
72 (void *)offsetof(router_instance, fail_verify_sender) },
73 { "fail_verify_recipient", opt_bool|opt_public,
74 (void *)offsetof(router_instance, fail_verify_recipient) },
75 { "fail_verify_sender", opt_bool|opt_public,
76 (void *)offsetof(router_instance, fail_verify_sender) },
77 { "fallback_hosts", opt_stringptr|opt_public,
78 (void *)offsetof(router_instance, fallback_hosts) },
79 { "group", opt_expand_gid | opt_public,
80 (void *)(offsetof(router_instance, gid)) },
846726c5 81 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
059ec3d9 82 (void *)offsetof(router_instance, extra_headers) },
846726c5 83 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
059ec3d9
PH
84 (void *)offsetof(router_instance, remove_headers) },
85 { "ignore_target_hosts",opt_stringptr|opt_public,
86 (void *)offsetof(router_instance, ignore_target_hosts) },
87 { "initgroups", opt_bool | opt_public,
88 (void *)(offsetof(router_instance, initgroups)) },
89 { "local_part_prefix", opt_stringptr|opt_public,
90 (void *)offsetof(router_instance, prefix) },
91 { "local_part_prefix_optional",opt_bool|opt_public,
92 (void *)offsetof(router_instance, prefix_optional) },
93 { "local_part_suffix", opt_stringptr|opt_public,
94 (void *)offsetof(router_instance, suffix) },
95 { "local_part_suffix_optional",opt_bool|opt_public,
96 (void *)offsetof(router_instance, suffix_optional) },
97 { "local_parts", opt_stringptr|opt_public,
98 (void *)offsetof(router_instance, local_parts) },
99 { "log_as_local", opt_bool|opt_public,
100 (void *)offsetof(router_instance, log_as_local) },
101 { "more", opt_expand_bool|opt_public,
102 (void *)offsetof(router_instance, more) },
103 { "pass_on_timeout", opt_bool|opt_public,
104 (void *)offsetof(router_instance, pass_on_timeout) },
105 { "pass_router", opt_stringptr|opt_public,
106 (void *)offsetof(router_instance, pass_router_name) },
107 { "redirect_router", opt_stringptr|opt_public,
108 (void *)offsetof(router_instance, redirect_router_name) },
109 { "require_files", opt_stringptr|opt_public,
110 (void *)offsetof(router_instance, require_files) },
111 { "retry_use_local_part", opt_bool|opt_public,
112 (void *)offsetof(router_instance, retry_use_local_part) },
113 { "router_home_directory", opt_stringptr|opt_public,
114 (void *)offsetof(router_instance, router_home_directory) },
115 { "self", opt_stringptr|opt_public,
116 (void *)(offsetof(router_instance, self)) },
117 { "senders", opt_stringptr|opt_public,
118 (void *)offsetof(router_instance, senders) },
119 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
120 { "translate_ip_address", opt_stringptr|opt_public,
121 (void *)offsetof(router_instance, translate_ip_address) },
122 #endif
123 { "transport", opt_stringptr|opt_public,
124 (void *)offsetof(router_instance, transport_name) },
125 { "transport_current_directory", opt_stringptr|opt_public,
126 (void *)offsetof(router_instance, current_directory) },
127 { "transport_home_directory", opt_stringptr|opt_public,
128 (void *)offsetof(router_instance, home_directory) },
129 { "unseen", opt_expand_bool|opt_public,
130 (void *)offsetof(router_instance, unseen) },
131 { "user", opt_expand_uid | opt_public,
132 (void *)(offsetof(router_instance, uid)) },
133 { "verify", opt_bool_verify|opt_hidden|opt_public,
134 (void *)offsetof(router_instance, verify_sender) },
135 { "verify_only", opt_bool|opt_public,
136 (void *)offsetof(router_instance, verify_only) },
137 { "verify_recipient", opt_bool|opt_public,
138 (void *)offsetof(router_instance, verify_recipient) },
139 { "verify_sender", opt_bool|opt_public,
140 (void *)offsetof(router_instance, verify_sender) }
141};
142
143int optionlist_routers_size = sizeof(optionlist_routers)/sizeof(optionlist);
144
145
146
147/*************************************************
148* Set router pointer from name *
149*************************************************/
150
151/* This function is used for the redirect_router and pass_router options and
152called from route_init() below.
153
154Arguments:
155 r the current router
156 name new router name
157 ptr where to put the pointer
158 after TRUE if router must follow this one
159
160Returns: nothing.
161*/
162
163static void
164set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
165{
166BOOL afterthis = FALSE;
167router_instance *rr;
168
169for (rr = routers; rr != NULL; rr = rr->next)
170 {
171 if (Ustrcmp(name, rr->name) == 0)
172 {
173 *ptr = rr;
174 break;
175 }
176 if (rr == r) afterthis = TRUE;
177 }
178
179if (rr == NULL)
180 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
181 "new_router \"%s\" not found for \"%s\" router", name, r->name);
182
183if (after && !afterthis)
184 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
185 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
186}
187
188
189
190/*************************************************
191* Initialize router list *
192*************************************************/
193
194/* Read the routers section of the configuration file, and set up a chain of
195router instances according to its contents. Each router has generic options and
196may also have its own private options. This function is only ever called when
197routers == NULL. We use generic code in readconf to do the work. It will set
198values from the configuration file, and then call the driver's initialization
199function. */
200
201void
202route_init(void)
203{
204router_instance *r;
205
206readconf_driver_init(US"router",
207 (driver_instance **)(&routers), /* chain anchor */
208 (driver_info *)routers_available, /* available drivers */
209 sizeof(router_info), /* size of info blocks */
210 &router_defaults, /* default values for generic options */
211 sizeof(router_instance), /* size of instance block */
212 optionlist_routers, /* generic options */
213 optionlist_routers_size);
214
215for (r = routers; r != NULL; r = r->next)
216 {
217 uschar *s = r->self;
218
219 /* If log_as_local is unset, its overall default is FALSE. (The accept
220 router defaults it to TRUE.) */
221
222 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
223
224 /* Check for transport or no transport on certain routers */
225
226 if ((r->info->ri_flags & ri_yestransport) != 0 &&
227 r->transport_name == NULL &&
228 !r->verify_only)
229 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
230 "a transport is required for this router", r->name);
231
232 if ((r->info->ri_flags & ri_notransport) != 0 &&
233 r->transport_name != NULL)
234 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
235 "a transport must not be defined for this router", r->name);
236
237 /* The "self" option needs to be decoded into a code value and possibly a
238 new domain string and a rewrite boolean. */
239
240 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
241 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
242 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
243 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
244 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
245 else if (Ustrncmp(s, "reroute:", 8) == 0)
246 {
247 s += 8;
248 while (isspace(*s)) s++;
249 if (Ustrncmp(s, "rewrite:", 8) == 0)
250 {
251 r->self_rewrite = TRUE;
252 s += 8;
253 while (isspace(*s)) s++;
254 }
255 r->self = s;
256 r->self_code = self_reroute;
257 }
258
259 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
260 "%s is not valid for the self option", r->name, s);
261
262 /* If any router has check_local_user set, default retry_use_local_part
263 TRUE; otherwise its default is FALSE. */
264
265 if (r->retry_use_local_part == TRUE_UNSET)
266 r->retry_use_local_part = r->check_local_user;
267
268 /* Build a host list if fallback hosts is set. */
269
270 host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE);
271
272 /* Check redirect_router and pass_router are valid */
273
274 if (r->redirect_router_name != NULL)
275 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
276
277 if (r->pass_router_name != NULL)
278 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
6c1c3d1d 279
50dc7409 280 DEBUG(D_route) {
6c1c3d1d
WB
281 if (r->dsn_lasthop == FALSE)
282 debug_printf("DSN: %s propagating DSN\n", r->name);
283 else
284 debug_printf("DSN: %s lasthop set\n", r->name);
285 }
059ec3d9
PH
286 }
287}
288
289
290
291/*************************************************
292* Tidy up after routing *
293*************************************************/
294
295/* Routers are entitled to keep hold of certain resources in their instance
296blocks so as to save setting them up each time. An example is an open file.
297Such routers must provide a tidyup entry point which is called when all routing
298is finished, via this function. */
299
300void
301route_tidyup(void)
302{
303router_instance *r;
304for (r = routers; r != NULL; r = r->next)
305 if (r->info->tidyup != NULL) (r->info->tidyup)(r);
306}
307
308
309
310/*************************************************
311* Check local part for prefix *
312*************************************************/
313
314/* This function is handed a local part and a list of possible prefixes; if any
315one matches, return the prefix length. A prefix beginning with '*' is a
316wildcard.
317
318Arguments:
319 local_part the local part to check
320 prefixes the list of prefixes
321
322Returns: length of matching prefix or zero
323*/
324
325int
55414b25 326route_check_prefix(const uschar *local_part, const uschar *prefixes)
059ec3d9
PH
327{
328int sep = 0;
329uschar *prefix;
55414b25 330const uschar *listptr = prefixes;
059ec3d9
PH
331uschar prebuf[64];
332
333while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf)))
334 != NULL)
335 {
336 int plen = Ustrlen(prefix);
337 if (prefix[0] == '*')
338 {
55414b25 339 const uschar *p;
059ec3d9
PH
340 prefix++;
341 for (p = local_part + Ustrlen(local_part) - (--plen);
342 p >= local_part; p--)
343 if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part;
344 }
345 else
346 if (strncmpic(prefix, local_part, plen) == 0) return plen;
347 }
348
349return 0;
350}
351
352
353
354/*************************************************
355* Check local part for suffix *
356*************************************************/
357
358/* This function is handed a local part and a list of possible suffixes;
359if any one matches, return the suffix length. A suffix ending with '*'
360is a wildcard.
361
362Arguments:
363 local_part the local part to check
364 suffixes the list of suffixes
365
366Returns: length of matching suffix or zero
367*/
368
369int
55414b25 370route_check_suffix(const uschar *local_part, const uschar *suffixes)
059ec3d9
PH
371{
372int sep = 0;
373int alen = Ustrlen(local_part);
374uschar *suffix;
55414b25 375const uschar *listptr = suffixes;
059ec3d9
PH
376uschar sufbuf[64];
377
378while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf)))
379 != NULL)
380 {
381 int slen = Ustrlen(suffix);
382 if (suffix[slen-1] == '*')
383 {
55414b25 384 const uschar *p, *pend;
059ec3d9
PH
385 pend = local_part + alen - (--slen) + 1;
386 for (p = local_part; p < pend; p++)
387 if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part);
388 }
389 else
390 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
391 return slen;
392 }
393
394return 0;
395}
396
397
398
399
400/*************************************************
401* Check local part, domain, or sender *
402*************************************************/
403
404/* The checks in check_router_conditions() require similar code, so we use
405this function to save repetition.
406
407Arguments:
408 rname router name for error messages
409 type type of check, for error message
410 list domains, local_parts, or senders list
411 anchorptr -> tree for possibly cached items (domains)
412 cache_bits cached bits pointer
413 listtype MCL_DOMAIN for domain check
414 MCL_LOCALPART for local part check
415 MCL_ADDRESS for sender check
416 domloc current domain, current local part, or NULL for sender check
417 ldata where to put lookup data
418 caseless passed on to match_isinlist()
419 perror where to put an error message
420
421Returns: OK item is in list
422 SKIP item is not in list, router is to be skipped
423 DEFER lookup or other defer
424*/
425
426static int
55414b25
JH
427route_check_dls(uschar *rname, uschar *type, const uschar *list,
428 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
429 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
059ec3d9
PH
430{
431int rc;
432
433if (list == NULL) return OK; /* Empty list always succeeds */
434
435DEBUG(D_route) debug_printf("checking %s\n", type);
436
437/* The domain and local part use the same matching function, whereas sender
438has its own code. */
439
440if (domloc != NULL)
441 {
442 rc = match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
443 caseless, ldata);
444 }
445else
446 {
447 uschar *address = (sender_address == NULL)? US"" : sender_address;
448 rc = match_address_list(address, TRUE, TRUE, &list, cache_bits, -1, 0,
55414b25 449 CUSS &sender_data);
059ec3d9
PH
450 }
451
452switch(rc)
453 {
454 case OK:
455 return OK;
456
457 case FAIL:
458 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
459 DEBUG(D_route) debug_printf("%s\n", *perror);
460 return SKIP;
461
462 default: /* Paranoia, and keeps compilers happy */
463 case DEFER:
464 *perror = string_sprintf("%s check lookup or other defer", type);
465 DEBUG(D_route) debug_printf("%s\n", *perror);
466 return DEFER;
467 }
468}
469
470
471
472/*************************************************
473* Check access by a given uid/gid *
474*************************************************/
475
476/* This function checks whether a given uid/gid has access to a given file or
477directory. It is called only from check_files() below. This is hopefully a
478cheapish check that does the job most of the time. Exim does *not* rely on this
479test when actually accessing any file. The test is used when routing to make it
480possible to take actions such as "if user x can access file y then run this
481router".
482
483During routing, Exim is normally running as root, and so the test will work
484except for NFS non-root mounts. When verifying during message reception, Exim
485is running as "exim", so the test may not work. This is a limitation of the
486Exim design.
487
488Code in check_files() below detects the case when it cannot stat() the file (as
489root), and in that situation it uses a setuid subprocess in which to run this
490test.
491
492Arguments:
493 path the path to check
494 uid the user
495 gid the group
496 bits the bits required in the final component
497
498Returns: TRUE
499 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
500*/
501
502static BOOL
503route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
504{
505struct stat statbuf;
506uschar *slash;
507uschar *rp = US realpath(CS path, CS big_buffer);
508uschar *sp = rp + 1;
509
510DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
511 (int)uid, (int)gid, bits);
512
513if (rp == NULL) return FALSE;
514
515while ((slash = Ustrchr(sp, '/')) != NULL)
516 {
517 *slash = 0;
518 DEBUG(D_route) debug_printf("stat %s\n", rp);
519 if (Ustat(rp, &statbuf) < 0) return FALSE;
520 if ((statbuf.st_mode &
521 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
522 ) == 0)
523 {
524 errno = EACCES;
525 return FALSE;
526 }
527 *slash = '/';
528 sp = slash + 1;
529 }
530
531/* Down to the final component */
532
533DEBUG(D_route) debug_printf("stat %s\n", rp);
534
535if (Ustat(rp, &statbuf) < 0) return FALSE;
536
537if (statbuf.st_uid == uid) bits = bits << 6;
538 else if (statbuf.st_gid == gid) bits = bits << 3;
539if ((statbuf.st_mode & bits) != bits)
540 {
541 errno = EACCES;
542 return FALSE;
543 }
544
545DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
546return TRUE;
547}
548
549
550
551/*************************************************
552* Do file existence tests *
553*************************************************/
554
555/* This function is given a colon-separated list of file tests, each of which
556is expanded before use. A test consists of a file name, optionally preceded by
557! (require non-existence) and/or + for handling permission denied (+ means
558treat as non-existing).
559
560An item that contains no slashes is interpreted as a username or id, with an
561optional group id, for checking access to the file. This cannot be done
562"perfectly", but it is good enough for a number of applications.
563
564Arguments:
565 s a colon-separated list of file tests or NULL
566 perror a pointer to an anchor for an error text in the case of a DEFER
567
568Returns: OK if s == NULL or all tests are as required
569 DEFER if the existence of at least one of the files is
570 unclear (an error other than non-existence occurred);
571 DEFER if an expansion failed
572 DEFER if a name is not absolute
573 DEFER if problems with user/group
574 SKIP otherwise
575*/
576
55414b25
JH
577static int
578check_files(const uschar *s, uschar **perror)
059ec3d9
PH
579{
580int sep = 0; /* List has default separators */
581uid_t uid = 0; /* For picky compilers */
582gid_t gid = 0; /* For picky compilers */
583BOOL ugid_set = FALSE;
55414b25
JH
584const uschar *listptr;
585uschar *check;
059ec3d9
PH
586uschar buffer[1024];
587
588if (s == NULL) return OK;
589
590DEBUG(D_route) debug_printf("checking require_files\n");
591
592listptr = s;
55414b25 593while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))))
059ec3d9
PH
594 {
595 int rc;
596 int eacces_code = 0;
597 BOOL invert = FALSE;
598 struct stat statbuf;
599 uschar *ss = expand_string(check);
600
601 if (ss == NULL)
602 {
603 if (expand_string_forcedfail) continue;
604 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
605 check, expand_string_message);
606 goto RETURN_DEFER;
607 }
608
609 /* Empty items are just skipped */
610
611 if (*ss == 0) continue;
612
613 /* If there are no slashes in the string, we have a user name or uid, with
614 optional group/gid. */
615
616 if (Ustrchr(ss, '/') == NULL)
617 {
618 BOOL ok;
619 struct passwd *pw;
620 uschar *comma = Ustrchr(ss, ',');
621
622 /* If there's a comma, temporarily terminate the user name/number
623 at that point. Then set the uid. */
624
625 if (comma != NULL) *comma = 0;
626 ok = route_finduser(ss, &pw, &uid);
627 if (comma != NULL) *comma = ',';
628
629 if (!ok)
630 {
631 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
632 goto RETURN_DEFER;
633 }
634
635 /* If there was no comma, the gid is that associated with the user. */
636
637 if (comma == NULL)
638 {
639 if (pw != NULL) gid = pw->pw_gid; else
640 {
641 *perror = string_sprintf("group missing after numerical uid %d for "
642 "require_files", (int)uid);
643 goto RETURN_DEFER;
644 }
645 }
646 else
647 {
648 if (!route_findgroup(comma + 1, &gid))
649 {
650 *perror = string_sprintf("group \"%s\" for require_files not found\n",
651 comma + 1);
652 goto RETURN_DEFER;
653 }
654 }
655
656 /* Note that we have values set, and proceed to next item */
657
658 DEBUG(D_route)
659 debug_printf("check subsequent files for access by %s\n", ss);
660 ugid_set = TRUE;
661 continue;
662 }
663
664 /* Path, possibly preceded by + and ! */
665
666 if (*ss == '+')
667 {
668 eacces_code = 1;
669 while (isspace((*(++ss))));
670 }
671
672 if (*ss == '!')
673 {
674 invert = TRUE;
675 while (isspace((*(++ss))));
676 }
677
678 if (*ss != '/')
679 {
680 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
681 goto RETURN_DEFER;
682 }
683
684 /* Stat the file, either as root (while routing) or as exim (while verifying
685 during message reception). */
686
687 rc = Ustat(ss, &statbuf);
688
689 DEBUG(D_route)
690 {
691 debug_printf("file check: %s\n", check);
692 if (ss != check) debug_printf("expanded file: %s\n", ss);
693 debug_printf("stat() yielded %d\n", rc);
694 }
695
696 /* If permission is denied, and we are running as root (i.e. routing for
697 delivery rather than verifying), and the requirement is to test for access by
698 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
699 system. In this case, we have to use a subprocess that runs as the relevant
700 uid in order to do the test. */
701
702 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
703 {
704 int status;
705 pid_t pid;
706 void (*oldsignal)(int);
707
708 DEBUG(D_route) debug_printf("root is denied access: forking to check "
709 "in subprocess\n");
710
711 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
712 that the child process can be waited for, just in case get here with it set
713 otherwise. Save the old state for resetting on the wait. */
714
715 oldsignal = signal(SIGCHLD, SIG_DFL);
716 pid = fork();
717
718 /* If fork() fails, reinstate the original error and behave as if
719 this block of code were not present. This is the same behavious as happens
720 when Exim is not running as root at this point. */
721
722 if (pid < 0)
723 {
724 DEBUG(D_route)
725 debug_printf("require_files: fork failed: %s\n", strerror(errno));
726 errno = EACCES;
727 goto HANDLE_ERROR;
728 }
729
730 /* In the child process, change uid and gid, and then do the check using
731 the route_check_access() function. This does more than just stat the file;
732 it tests permissions as well. Return 0 for OK and 1 for failure. */
733
734 if (pid == 0)
735 {
736 exim_setugid(uid, gid, TRUE,
737 string_sprintf("require_files check, file=%s", ss));
738 if (route_check_access(ss, uid, gid, 4)) _exit(0);
739 DEBUG(D_route) debug_printf("route_check_access() failed\n");
740 _exit(1);
741 }
742
743 /* In the parent, wait for the child to finish */
744
745 while (waitpid(pid, &status, 0) < 0)
746 {
747 if (errno != EINTR) /* unexpected error, interpret as failure */
748 {
749 status = 1;
750 break;
751 }
752 }
753
754 signal(SIGCHLD, oldsignal); /* restore */
755 if ((status == 0) == invert) return SKIP;
756 continue; /* to test the next file */
757 }
758
759 /* Control reaches here if the initial stat() succeeds, or fails with an
760 error other than EACCES, or no uid/gid is set, or we are not running as root.
761 If we know the file exists and uid/gid are set, try to check read access for
762 that uid/gid as best we can. */
763
764 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
765 {
766 DEBUG(D_route) debug_printf("route_check_access() failed\n");
767 rc = -1;
768 }
769
770 /* Handle error returns from stat() or route_check_access(). The EACESS error
771 is handled specially. At present, we can force it to be treated as
772 non-existence. Write the code so that it will be easy to add forcing for
773 existence if required later. */
774
775 HANDLE_ERROR:
776 if (rc < 0)
777 {
778 DEBUG(D_route) debug_printf("errno = %d\n", errno);
779 if (errno == EACCES)
780 {
781 if (eacces_code == 1)
782 {
783 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
784 errno = ENOENT; /* Treat as non-existent */
785 }
786 }
787 if (errno != ENOENT)
788 {
789 *perror = string_sprintf("require_files: error for %s: %s", ss,
790 strerror(errno));
791 goto RETURN_DEFER;
792 }
793 }
794
795 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
796
797 if ((rc >= 0) == invert) return SKIP;
798 }
799
800return OK;
801
802/* Come here on any of the errors that return DEFER. */
803
804RETURN_DEFER:
805DEBUG(D_route) debug_printf("%s\n", *perror);
806return DEFER;
807}
808
809
810
811
812
813/*************************************************
814* Check for router skipping *
815*************************************************/
816
817/* This function performs various checks to see whether a router should be
818skipped. The order in which they are performed is important.
819
820Arguments:
821 r pointer to router instance block
822 addr address that is being handled
823 verify the verification type
824 pw ptr to ptr to passwd structure for local user
825 perror for lookup errors
826
827Returns: OK if all the tests succeed
828 SKIP if router is to be skipped
829 DEFER for a lookup defer
830 FAIL for address to be failed
831*/
832
833static BOOL
834check_router_conditions(router_instance *r, address_item *addr, int verify,
835 struct passwd **pw, uschar **perror)
836{
837int rc;
838uschar *check_local_part;
06864c44 839unsigned int *localpart_cache;
059ec3d9
PH
840
841/* Reset variables to hold a home directory and data from lookup of a domain or
842local part, and ensure search_find_defer is unset, in case there aren't any
843actual lookups. */
844
845deliver_home = NULL;
846deliver_domain_data = NULL;
847deliver_localpart_data = NULL;
848sender_data = NULL;
849local_user_gid = (gid_t)(-1);
850local_user_uid = (uid_t)(-1);
851search_find_defer = FALSE;
852
853/* Skip this router if not verifying and it has verify_only set */
854
855if ((verify == v_none || verify == v_expn) && r->verify_only)
856 {
857 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
858 return SKIP;
859 }
860
861/* Skip this router if testing an address (-bt) and address_test is not set */
862
863if (address_test_mode && !r->address_test)
864 {
865 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
866 r->name);
867 return SKIP;
868 }
869
870/* Skip this router if verifying and it hasn't got the appropriate verify flag
871set. */
872
873if ((verify == v_sender && !r->verify_sender) ||
874 (verify == v_recipient && !r->verify_recipient))
875 {
876 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
877 r->name, verify, r->verify_sender, r->verify_recipient);
878 return SKIP;
879 }
880
881/* Skip this router if processing EXPN and it doesn't have expn set */
882
883if (verify == v_expn && !r->expn)
884 {
885 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
886 return SKIP;
887 }
888
889/* Skip this router if there's a domain mismatch. */
890
891if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
55414b25
JH
892 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
893 MCL_DOMAIN, perror)) != OK)
059ec3d9
PH
894 return rc;
895
896/* Skip this router if there's a local part mismatch. We want to pass over the
897caseful local part, so that +caseful can restore it, even if this router is
898handling local parts caselessly. However, we can't just pass cc_local_part,
899because that doesn't have the prefix or suffix stripped. A bit of massaging is
06864c44
TF
900required. Also, we only use the match cache for local parts that have not had
901a prefix or suffix stripped. */
059ec3d9
PH
902
903if (addr->prefix == NULL && addr->suffix == NULL)
06864c44
TF
904 {
905 localpart_cache = addr->localpart_cache;
059ec3d9 906 check_local_part = addr->cc_local_part;
06864c44 907 }
059ec3d9
PH
908else
909 {
06864c44 910 localpart_cache = NULL;
059ec3d9
PH
911 check_local_part = string_copy(addr->cc_local_part);
912 if (addr->prefix != NULL)
913 check_local_part += Ustrlen(addr->prefix);
914 if (addr->suffix != NULL)
915 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
916 }
917
918if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
06864c44 919 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
55414b25
JH
920 check_local_part, CUSS &deliver_localpart_data,
921 !r->caseful_local_part, perror)) != OK)
059ec3d9
PH
922 return rc;
923
924/* If the check_local_user option is set, check that the local_part is the
925login of a local user. Note: the third argument to route_finduser() must be
926NULL here, to prevent a numeric string being taken as a numeric uid. If the
927user is found, set deliver_home to the home directory, and also set
928local_user_{uid,gid}. */
929
930if (r->check_local_user)
931 {
932 DEBUG(D_route) debug_printf("checking for local user\n");
933 if (!route_finduser(addr->local_part, pw, NULL))
934 {
935 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
936 r->name, addr->local_part);
937 return SKIP;
938 }
939 deliver_home = string_copy(US (*pw)->pw_dir);
940 local_user_gid = (*pw)->pw_gid;
941 local_user_uid = (*pw)->pw_uid;
942 }
943
944/* Set (or override in the case of check_local_user) the home directory if
945router_home_directory is set. This is done here so that it overrides $home from
946check_local_user before any subsequent expansions are done. Otherwise, $home
947could mean different things for different options, which would be extremely
948confusing. */
949
950if (r->router_home_directory != NULL)
951 {
952 uschar *router_home = expand_string(r->router_home_directory);
953 if (router_home == NULL)
954 {
955 if (!expand_string_forcedfail)
956 {
957 *perror = string_sprintf("failed to expand \"%s\" for "
958 "router_home_directory: %s", r->router_home_directory,
959 expand_string_message);
960 return DEFER;
961 }
962 }
963 else
964 {
965 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
966 deliver_home = router_home;
967 }
968 }
969
970/* Skip if the sender condition is not met. We leave this one till after the
971local user check so that $home is set - enabling the possiblity of letting
972individual recipients specify lists of acceptable/unacceptable senders. */
973
974if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
975 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
976 return rc;
977
978/* This is the point at which we print out the router's debugging string if it
979is set. We wait till here so as to have $home available for local users (and
980anyway, we don't want too much stuff for skipped routers). */
981
982debug_print_string(r->debug_string);
983
984/* Perform file existence tests. */
985
986if ((rc = check_files(r->require_files, perror)) != OK)
987 {
988 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
989 (rc == SKIP)? "skipped" : "deferred");
990 return rc;
991 }
992
993/* Now the general condition test. */
994
995if (r->condition != NULL)
996 {
997 DEBUG(D_route) debug_printf("checking \"condition\"\n");
998 if (!expand_check_condition(r->condition, r->name, US"router"))
999 {
1000 if (search_find_defer)
1001 {
1002 *perror = US"condition check lookup defer";
1003 DEBUG(D_route) debug_printf("%s\n", *perror);
1004 return DEFER;
1005 }
1006 DEBUG(D_route)
1007 debug_printf("%s router skipped: condition failure\n", r->name);
1008 return SKIP;
1009 }
1010 }
1011
8523533c
TK
1012#ifdef EXPERIMENTAL_BRIGHTMAIL
1013/* check if a specific Brightmail AntiSpam rule fired on the message */
1014if (r->bmi_rule != NULL) {
1015 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1016 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0) {
1017 /* none of the rules fired */
1018 DEBUG(D_route)
1019 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1020 return SKIP;
1021 };
1022};
1023
1024/* check if message should not be delivered */
1025if (r->bmi_dont_deliver) {
1026 if (bmi_deliver == 1) {
1027 DEBUG(D_route)
1028 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1029 return SKIP;
1030 };
1031};
1032
1033/* check if message should go to an alternate location */
1034if (r->bmi_deliver_alternate) {
1035 if ((bmi_deliver == 0) || (bmi_alt_location == NULL)) {
1036 DEBUG(D_route)
1037 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1038 return SKIP;
1039 };
1040};
1041
1042/* check if message should go to default location */
1043if (r->bmi_deliver_default) {
1044 if ((bmi_deliver == 0) || (bmi_alt_location != NULL)) {
1045 DEBUG(D_route)
1046 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1047 return SKIP;
1048 };
1049};
1050#endif
1051
059ec3d9
PH
1052/* All the checks passed. */
1053
1054return OK;
1055}
1056
1057
1058
1059
1060/*************************************************
1061* Find a local user *
1062*************************************************/
1063
1064/* Try several times (if configured) to find a local user, in case delays in
1065NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1066doesn't have some kind of indication as to why it has failed. If the string
1067given consists entirely of digits, and the third argument is not NULL, assume
1068the string is the numerical value of the uid. Otherwise it is looked up using
1069getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1070pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1071
1072Because this may be called several times in succession for the same user for
1073different routers, cache the result of the previous getpwnam call so that it
1074can be re-used. Note that we can't just copy the structure, as the store it
1075points to can get trashed.
1076
1077Arguments:
1078 s the login name or textual form of the numerical uid of the user
1079 pw if not NULL, return the result of getpwnam here, or set NULL
1080 if no call to getpwnam is made (s numeric, return_uid != NULL)
1081 return_uid if not NULL, return the uid via this address
1082
1083Returns: TRUE if s is numerical or was looked up successfully
1084
1085*/
1086
1087static struct passwd pwcopy;
1088static struct passwd *lastpw = NULL;
1089static uschar lastname[48] = { 0 };
1090static uschar lastdir[128];
1091static uschar lastgecos[128];
1092static uschar lastshell[128];
1093
1094BOOL
55414b25 1095route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
059ec3d9 1096{
d8fe1c03
PH
1097BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1098
1099DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1100 cache_set? "using cached result" : "cache not available");
1101
1102if (!cache_set)
059ec3d9
PH
1103 {
1104 int i = 0;
1105
1106 if (return_uid != NULL && (isdigit(*s) || *s == '-') &&
1107 s[Ustrspn(s+1, "0123456789")+1] == 0)
1108 {
1109 *return_uid = (uid_t)Uatoi(s);
1110 if (pw != NULL) *pw = NULL;
1111 return TRUE;
1112 }
1113
1114 (void)string_format(lastname, sizeof(lastname), "%s", s);
1115
1116 /* Force failure if string length is greater than given maximum */
1117
1118 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1119 {
1120 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1121 "length of %s is greater than %d\n", lastname, max_username_length);
1122 lastpw = NULL;
1123 }
1124
1125 /* Try a few times if so configured; this handles delays in NIS etc. */
1126
1127 else for (;;)
1128 {
73a6bc4b 1129 errno = 0;
059ec3d9
PH
1130 if ((lastpw = getpwnam(CS s)) != NULL) break;
1131 if (++i > finduser_retries) break;
1132 sleep(1);
1133 }
1134
1135 if (lastpw != NULL)
1136 {
1137 pwcopy.pw_uid = lastpw->pw_uid;
1138 pwcopy.pw_gid = lastpw->pw_gid;
1139 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1140 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1141 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1142 pwcopy.pw_name = CS lastname;
1143 pwcopy.pw_dir = CS lastdir;
1144 pwcopy.pw_gecos = CS lastgecos;
1145 pwcopy.pw_shell = CS lastshell;
1146 lastpw = &pwcopy;
1147 }
d8fe1c03
PH
1148
1149 else DEBUG(D_uid)
1150 {
1151 if (errno != 0) debug_printf("getpwnam(%s) failed: %s\n", s,
1152 strerror(errno));
1153 }
1154 }
1155
1156if (lastpw == NULL)
1157 {
1158 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1159 return FALSE;
059ec3d9
PH
1160 }
1161else
1162 {
d8fe1c03
PH
1163 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1164 lastpw->pw_uid, lastpw->pw_gid);
059ec3d9
PH
1165 }
1166
059ec3d9
PH
1167if (return_uid != NULL) *return_uid = lastpw->pw_uid;
1168if (pw != NULL) *pw = lastpw;
1169
1170return TRUE;
1171}
1172
1173
1174
1175
1176/*************************************************
1177* Find a local group *
1178*************************************************/
1179
1180/* Try several times (if configured) to find a local group, in case delays in
1181NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1182doesn't have some kind of indication as to why it has failed.
1183
1184Arguments:
1185 s the group namd or textual form of the numerical gid
1186 return_gid return the gid via this address
1187
1188Returns: TRUE if the group was found; FALSE otherwise
1189
1190*/
1191
1192BOOL
1193route_findgroup(uschar *s, gid_t *return_gid)
1194{
1195int i = 0;
1196struct group *gr;
1197
1198if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1199 {
1200 *return_gid = (gid_t)Uatoi(s);
1201 return TRUE;
1202 }
1203
1204for (;;)
1205 {
1206 if ((gr = getgrnam(CS s)) != NULL)
1207 {
1208 *return_gid = gr->gr_gid;
1209 return TRUE;
1210 }
1211 if (++i > finduser_retries) break;
1212 sleep(1);
1213 }
1214
1215return FALSE;
1216}
1217
1218
1219
1220
1221/*************************************************
1222* Find user by expanding string *
1223*************************************************/
1224
1225/* Expands a string, and then looks up the result in the passwd file.
1226
1227Arguments:
1228 string the string to be expanded, yielding a login name or a numerical
1229 uid value (to be passed to route_finduser())
1230 driver_name caller name for panic error message (only)
1231 driver_type caller type for panic error message (only)
1232 pw return passwd entry via this pointer
1233 uid return uid via this pointer
1234 errmsg where to point a message on failure
1235
1236Returns: TRUE if user found, FALSE otherwise
1237*/
1238
1239BOOL
1240route_find_expanded_user(uschar *string, uschar *driver_name,
1241 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1242{
1243uschar *user = expand_string(string);
1244
1245if (user == NULL)
1246 {
1247 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1248 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1249 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1250 return FALSE;
1251 }
1252
1253if (route_finduser(user, pw, uid)) return TRUE;
1254
1255*errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1256 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1257log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1258return FALSE;
1259}
1260
1261
1262
1263/*************************************************
1264* Find group by expanding string *
1265*************************************************/
1266
1267/* Expands a string and then looks up the result in the group file.
1268
1269Arguments:
1270 string the string to be expanded, yielding a group name or a numerical
1271 gid value (to be passed to route_findgroup())
1272 driver_name caller name for panic error message (only)
1273 driver_type caller type for panic error message (only)
1274 gid return gid via this pointer
1275 errmsg return error message via this pointer
1276
1277Returns: TRUE if found group, FALSE otherwise
1278*/
1279
1280BOOL
1281route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1282 gid_t *gid, uschar **errmsg)
1283{
1284BOOL yield = TRUE;
1285uschar *group = expand_string(string);
1286
1287if (group == NULL)
1288 {
1289 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1290 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1291 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1292 return FALSE;
1293 }
1294
1295if (!route_findgroup(group, gid))
1296 {
1297 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1298 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1299 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1300 yield = FALSE;
1301 }
1302
1303return yield;
1304}
1305
1306
1307
1308/*************************************************
059ec3d9
PH
1309* Handle an unseen routing *
1310*************************************************/
1311
1312/* This function is called when an address is routed by a router with "unseen"
1313set. It must make a clone of the address, for handling by subsequent drivers.
1314The clone is set to start routing at the next router.
1315
1316The original address must be replaced by an invented "parent" which has the
1317routed address plus the clone as its children. This is necessary in case the
1318address is at the top level - we don't want to mark it complete until both
1319deliveries have been done.
1320
1321A new unique field must be made, so that the record of the delivery isn't a
1322record of the original address, and checking for already delivered has
1323therefore to be done here. If the delivery has happened, then take the base
1324address off whichever delivery queue it is on - it will always be the top item.
1325
1326Arguments:
1327 name router name
1328 addr address that was routed
1329 paddr_local chain of local-delivery addresses
1330 paddr_remote chain of remote-delivery addresses
1331 addr_new chain for newly created addresses
1332
1333Returns: nothing
1334*/
1335
1336static void
1337route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1338 address_item **paddr_remote, address_item **addr_new)
1339{
1340address_item *parent = deliver_make_addr(addr->address, TRUE);
1341address_item *new = deliver_make_addr(addr->address, TRUE);
1342
1343/* The invented parent is a copy that replaces the original; note that
1344this copies its parent pointer. It has two children, and its errors_address is
1345from the original address' parent, if present, otherwise unset. */
1346
1347*parent = *addr;
1348parent->child_count = 2;
d43cbe25
JH
1349parent->prop.errors_address =
1350 (addr->parent == NULL)? NULL : addr->parent->prop.errors_address;
059ec3d9
PH
1351
1352/* The routed address gets a new parent. */
1353
1354addr->parent = parent;
1355
1356/* The clone has this parent too. Set its errors address from the parent. This
1357was set from the original parent (or to NULL) - see above. We do NOT want to
1358take the errors address from the unseen router. */
1359
1360new->parent = parent;
d43cbe25 1361new->prop.errors_address = parent->prop.errors_address;
059ec3d9
PH
1362
1363/* Copy the propagated flags and address_data from the original. */
1364
1365copyflag(new, addr, af_propagate);
d43cbe25 1366new->prop.address_data = addr->prop.address_data;
6c1c3d1d
WB
1367new->dsn_flags = addr->dsn_flags;
1368new->dsn_orcpt = addr->dsn_orcpt;
059ec3d9
PH
1369
1370
1371/* As it has turned out, we haven't set headers_add or headers_remove for the
1372 * clone. Thinking about it, it isn't entirely clear whether they should be
1373 * copied from the original parent, like errors_address, or taken from the
1374 * unseen router, like address_data and the flags. Until somebody brings this
1375 * up, I propose to leave the code as it is.
1376 */
1377
1378
1379/* Set the cloned address to start at the next router, and put it onto the
1380chain of new addresses. */
1381
1382new->start_router = addr->router->next;
1383new->next = *addr_new;
1384*addr_new = new;
1385
1386DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1387
1388/* Make a new unique field, to distinguish from the normal one. */
1389
1390addr->unique = string_sprintf("%s/%s", addr->unique, name);
1391
1392/* If the address has been routed to a transport, see if it was previously
1393delivered. If so, we take it off the relevant queue so that it isn't delivered
1394again. Otherwise, it was an alias or something, and the addresses it generated
1395are handled in the normal way. */
1396
1397if (addr->transport != NULL &&
1398 tree_search(tree_nonrecipients, addr->unique) != NULL)
1399 {
1400 DEBUG(D_route)
1401 debug_printf("\"unseen\" delivery previously done - discarded\n");
1402 parent->child_count--;
1403 if (*paddr_remote == addr) *paddr_remote = addr->next;
1404 if (*paddr_local == addr) *paddr_local = addr->next;
1405 }
1406}
1407
1408
1409
1410/*************************************************
1411* Route one address *
1412*************************************************/
1413
1414/* This function is passed in one address item, for processing by the routers.
1415The verify flag is set if this is being called for verification rather than
1416delivery. If the router doesn't have its "verify" flag set, it is skipped.
1417
1418Arguments:
1419 addr address to route
1420 paddr_local chain of local-delivery addresses
1421 paddr_remote chain of remote-delivery addresses
1422 addr_new chain for newly created addresses
1423 addr_succeed chain for completed addresses
1424 verify v_none if not verifying
1425 v_sender if verifying a sender address
1426 v_recipient if verifying a recipient address
1427 v_expn if processing an EXPN address
1428
1429Returns: OK => address successfully routed
1430 DISCARD => address was discarded
1431 FAIL => address could not be routed
1432 DEFER => some temporary problem
1433 ERROR => some major internal or configuration failure
1434*/
1435
1436int
1437route_address(address_item *addr, address_item **paddr_local,
1438 address_item **paddr_remote, address_item **addr_new,
1439 address_item **addr_succeed, int verify)
1440{
1441int yield = OK;
1442BOOL unseen;
1443router_instance *r, *nextr;
55414b25 1444const uschar *old_domain = addr->domain;
059ec3d9
PH
1445
1446HDEBUG(D_route)
1447 {
1448 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1449 debug_printf("routing %s\n", addr->address);
1450 }
1451
1452/* Loop through all router instances until a router succeeds, fails, defers, or
1453encounters an error. If the address has start_router set, we begin from there
1454instead of at the first router. */
1455
1456for (r = (addr->start_router == NULL)? routers : addr->start_router;
1457 r != NULL; r = nextr)
1458 {
1459 uschar *error;
1460 struct passwd *pw = NULL;
1461 struct passwd pwcopy;
1462 address_item *parent;
1463 BOOL loop_detected = FALSE;
1464 BOOL more;
1465 int loopcount = 0;
1466 int rc;
1467
1468 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1469
1470 /* Reset any search error message from the previous router. */
1471
1472 search_error_message = NULL;
1473
1474 /* There are some weird cases where logging is disabled */
1475
1476 disable_logging = r->disable_logging;
1477
1478 /* Record the last router to handle the address, and set the default
1479 next router. */
1480
1481 addr->router = r;
1482 nextr = r->next;
1483
1484 /* Loop protection: If this address has an ancestor with the same address,
1485 and that ancestor was routed by this router, we skip this router. This
1486 prevents a variety of looping states when a new address is created by
1487 redirection or by the use of "unseen" on a router.
1488
1489 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1490 by this router, even if it was different to the current address.
1491
1492 Just in case someone does put it into a loop (possible with redirection
1493 continally adding to an address, for example), put a long stop counter on
1494 the number of parents. */
1495
1496 for (parent = addr->parent; parent != NULL; parent = parent->parent)
1497 {
1498 if (parent->router == r)
1499 {
1500 BOOL break_loop = !r->repeat_use;
1501
1502 /* When repeat_use is set, first check the active addresses caselessly.
1503 If they match, we have to do a further caseful check of the local parts
1504 when caseful_local_part is set. This is assumed to be rare, which is why
1505 the code is written this way. */
1506
1507 if (!break_loop)
1508 {
1509 break_loop = strcmpic(parent->address, addr->address) == 0;
1510 if (break_loop && r->caseful_local_part)
1511 break_loop = Ustrncmp(parent->address, addr->address,
1512 Ustrrchr(addr->address, '@') - addr->address) == 0;
1513 }
1514
1515 if (break_loop)
1516 {
1517 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1518 r->name, parent->address);
1519 loop_detected = TRUE;
1520 break;
1521 }
1522 }
1523
1524 /* Continue with parents, limiting the size of the dynasty. */
1525
1526 if (loopcount++ > 100)
1527 {
1528 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1529 yield = DEFER;
1530 goto ROUTE_EXIT;
1531 }
1532 }
1533
1534 if (loop_detected) continue;
1535
1536 /* Default no affixes and select whether to use a caseful or caseless local
1537 part in this router. */
1538
1539 addr->prefix = addr->suffix = NULL;
1540 addr->local_part = r->caseful_local_part?
1541 addr->cc_local_part : addr->lc_local_part;
1542
1543 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1544 addr->domain);
1545
1546 /* Handle any configured prefix by replacing the local_part address,
1547 and setting the prefix. Skip the router if the prefix doesn't match,
1548 unless the prefix is optional. */
1549
1550 if (r->prefix != NULL)
1551 {
1552 int plen = route_check_prefix(addr->local_part, r->prefix);
1553 if (plen > 0)
1554 {
1555 addr->prefix = string_copyn(addr->local_part, plen);
1556 addr->local_part += plen;
1557 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1558 }
1559 else if (!r->prefix_optional)
1560 {
1561 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1562 r->name);
1563 continue;
1564 }
1565 }
1566
1567 /* Handle any configured suffix likewise. */
1568
1569 if (r->suffix != NULL)
1570 {
1571 int slen = route_check_suffix(addr->local_part, r->suffix);
1572 if (slen > 0)
1573 {
1574 int lplen = Ustrlen(addr->local_part) - slen;
1575 addr->suffix = addr->local_part + lplen;
1576 addr->local_part = string_copyn(addr->local_part, lplen);
1577 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1578 }
1579 else if (!r->suffix_optional)
1580 {
1581 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1582 r->name);
1583 continue;
1584 }
1585 }
1586
1587 /* Set the expansion variables now that we have the affixes and the case of
1588 the local part sorted. */
1589
2a47f028 1590 router_name = r->name;
059ec3d9
PH
1591 deliver_set_expansions(addr);
1592
1593 /* For convenience, the pre-router checks are in a separate function, which
1594 returns OK, SKIP, FAIL, or DEFER. */
1595
1596 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1597 {
2a47f028 1598 router_name = NULL;
059ec3d9
PH
1599 if (rc == SKIP) continue;
1600 addr->message = error;
1601 yield = rc;
1602 goto ROUTE_EXIT;
1603 }
1604
1605 /* All pre-conditions have been met. Reset any search error message from
1606 pre-condition tests. These can arise in negated tests where the failure of
1607 the lookup leads to a TRUE pre-condition. */
1608
1609 search_error_message = NULL;
1610
1611 /* Finally, expand the address_data field in the router. Forced failure
1612 behaves as if the router declined. Any other failure is more serious. On
1613 success, the string is attached to the address for all subsequent processing.
1614 */
1615
1616 if (r->address_data != NULL)
1617 {
1618 DEBUG(D_route) debug_printf("processing address_data\n");
1619 deliver_address_data = expand_string(r->address_data);
1620 if (deliver_address_data == NULL)
1621 {
1622 if (expand_string_forcedfail)
1623 {
1624 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1625 "(address_data): decline action taken\n", r->address_data);
1626
1627 /* Expand "more" if necessary; DEFER => an expansion failed */
1628
9c695f6d
JH
1629 yield = exp_bool(addr, US"router", r->name, D_route,
1630 US"more", r->more, r->expand_more, &more);
059ec3d9
PH
1631 if (yield != OK) goto ROUTE_EXIT;
1632
1633 if (!more)
1634 {
1635 DEBUG(D_route)
1636 debug_printf("\"more\"=false: skipping remaining routers\n");
2a47f028 1637 router_name = NULL;
059ec3d9
PH
1638 r = NULL;
1639 break;
1640 }
1641 else continue; /* With next router */
1642 }
1643
1644 else
1645 {
1646 addr->message = string_sprintf("expansion of \"%s\" failed "
1647 "in %s router: %s", r->address_data, r->name, expand_string_message);
1648 yield = DEFER;
1649 goto ROUTE_EXIT;
1650 }
1651 }
d43cbe25 1652 addr->prop.address_data = deliver_address_data;
059ec3d9
PH
1653 }
1654
1655 /* We are finally cleared for take-off with this router. Clear the the flag
1656 that records that a local host was removed from a routed host list. Make a
1657 copy of relevant fields in the password information from check_local_user,
1658 because it will be overwritten if check_local_user is invoked again while
1659 verifying an errors_address setting. */
1660
1661 clearflag(addr, af_local_host_removed);
1662
1663 if (pw != NULL)
1664 {
1665 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1666 pwcopy.pw_uid = pw->pw_uid;
1667 pwcopy.pw_gid = pw->pw_gid;
1668 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1669 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1670 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1671 pw = &pwcopy;
1672 }
1673
1674 /* Run the router, and handle the consequences. */
1675
6c1c3d1d
WB
1676/* ... but let us check on DSN before. If this should be the last hop for DSN
1677 set flag
1678*/
1679 if ((r->dsn_lasthop == TRUE) && ((addr->dsn_flags & rf_dsnlasthop) == 0))
1680 {
1681 addr->dsn_flags |= rf_dsnlasthop;
1682 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1683 }
6c1c3d1d 1684
059ec3d9
PH
1685 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1686
fd6de02e
PH
1687 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1688 addr_new, addr_succeed);
059ec3d9 1689
2a47f028
JH
1690 router_name = NULL;
1691
059ec3d9
PH
1692 if (yield == FAIL)
1693 {
1694 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1695 goto ROUTE_EXIT;
1696 }
1697
1698 /* If succeeded while verifying but fail_verify is set, convert into
1699 a failure, and take it off the local or remote delivery list. */
1700
1701 if (((verify == v_sender && r->fail_verify_sender) ||
1702 (verify == v_recipient && r->fail_verify_recipient)) &&
1703 (yield == OK || yield == PASS))
1704 {
1705 addr->message = string_sprintf("%s router forced verify failure", r->name);
1706 if (*paddr_remote == addr) *paddr_remote = addr->next;
1707 if (*paddr_local == addr) *paddr_local = addr->next;
1708 yield = FAIL;
1709 goto ROUTE_EXIT;
1710 }
1711
1712 /* PASS and DECLINE are the only two cases where the loop continues. For all
1713 other returns, we break the loop and handle the result below. */
1714
1715 if (yield != PASS && yield != DECLINE) break;
1716
1717 HDEBUG(D_route)
1718 {
1719 debug_printf("%s router %s for %s\n", r->name,
1720 (yield == PASS)? "passed" : "declined", addr->address);
1721 if (Ustrcmp(old_domain, addr->domain) != 0)
1722 debug_printf("domain %s rewritten\n", old_domain);
1723 }
1724
1725 /* PASS always continues to another router; DECLINE does so if "more"
1726 is true. Initialization insists that pass_router is always a following
1727 router. Otherwise, break the loop as if at the end of the routers. */
1728
1729 if (yield == PASS)
1730 {
1731 if (r->pass_router != NULL) nextr = r->pass_router;
1732 }
1733 else
1734 {
1735 /* Expand "more" if necessary */
1736
9c695f6d
JH
1737 yield = exp_bool(addr, US"router", r->name, D_route,
1738 US"more", r->more, r->expand_more, &more);
059ec3d9
PH
1739 if (yield != OK) goto ROUTE_EXIT;
1740
1741 if (!more)
1742 {
1743 HDEBUG(D_route)
1744 debug_printf("\"more\" is false: skipping remaining routers\n");
1745 r = NULL;
1746 break;
1747 }
1748 }
1749 } /* Loop for all routers */
1750
1751/* On exit from the routers loop, if r == NULL we have run out of routers,
1752either genuinely, or as a result of no_more. Otherwise, the loop ended
1753prematurely, either because a router succeeded, or because of some special
1754router response. Note that FAIL errors and errors detected before actually
1755running a router go direct to ROUTE_EXIT from code above. */
1756
1757if (r == NULL)
1758 {
1759 HDEBUG(D_route) debug_printf("no more routers\n");
1760 if (addr->message == NULL)
1761 {
1762 uschar *message = US"Unrouteable address";
1763 if (addr->router != NULL && addr->router->cannot_route_message != NULL)
1764 {
1765 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1766 if (expmessage == NULL)
1767 {
1768 if (!expand_string_forcedfail)
1769 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1770 "cannot_route_message in %s router: %s", addr->router->name,
1771 expand_string_message);
1772 }
1773 else message = expmessage;
1774 }
1775 addr->user_message = addr->message = message;
1776 }
1777 addr->router = NULL; /* For logging */
1778 yield = FAIL;
1779 goto ROUTE_EXIT;
1780 }
1781
1782if (yield == DEFER)
1783 {
1784 HDEBUG(D_route)
1785 {
1786 debug_printf("%s router: defer for %s\n", r->name, addr->address);
1787 debug_printf(" message: %s\n", (addr->message == NULL)?
1788 US"<none>" : addr->message);
1789 }
1790 goto ROUTE_EXIT;
1791 }
1792
1793if (yield == DISCARD) goto ROUTE_EXIT;
1794
1795/* The yield must be either OK or REROUTED. */
1796
1797if (yield != OK && yield != REROUTED)
1798 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1799 r->name, yield);
1800
1801/* If the yield was REROUTED, the router put a child address on the new chain
1802as a result of a domain change of some sort (widening, typically). */
1803
1804if (yield == REROUTED)
1805 {
1806 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1807 yield = OK;
1808 goto ROUTE_EXIT;
1809 }
1810
1811/* The only remaining possibility is that the router succeeded. If the
1812translate_ip_address options is set and host addresses were associated with the
1813address, run them through the translation. This feature is for weird and
1814wonderful situations (the amateur packet radio people need it) or very broken
1815networking, so it is included in the binary only if requested. */
1816
1817#ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1818
1819if (r->translate_ip_address != NULL)
1820 {
1821 int rc;
1822 int old_pool = store_pool;
1823 host_item *h;
1824 for (h = addr->host_list; h != NULL; h = h->next)
1825 {
1826 uschar *newaddress;
1827 uschar *oldaddress, *oldname;
1828
1829 if (h->address == NULL) continue;
1830
1831 deliver_host_address = h->address;
1832 newaddress = expand_string(r->translate_ip_address);
1833 deliver_host_address = NULL;
1834
1835 if (newaddress == NULL)
1836 {
1837 if (expand_string_forcedfail) continue;
1838 addr->basic_errno = ERRNO_EXPANDFAIL;
1839 addr->message = string_sprintf("translate_ip_address expansion "
1840 "failed: %s", expand_string_message);
1841 yield = DEFER;
1842 goto ROUTE_EXIT;
1843 }
1844
1845 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1846 h->name, h->address, newaddress);
7e66e54d 1847 if (string_is_ip_address(newaddress, NULL) != 0)
059ec3d9
PH
1848 {
1849 h->address = newaddress;
1850 continue;
1851 }
1852
1853 oldname = h->name;
1854 oldaddress = h->address;
1855 h->name = newaddress;
1856 h->address = NULL;
1857 h->mx = MX_NONE;
1858
1859 store_pool = POOL_PERM;
322050c2 1860 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
059ec3d9
PH
1861 store_pool = old_pool;
1862
1863 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1864 {
1865 addr->basic_errno = ERRNO_UNKNOWNHOST;
1866 addr->message = string_sprintf("host %s not found when "
1867 "translating %s [%s]", h->name, oldname, oldaddress);
1868 yield = DEFER;
1869 goto ROUTE_EXIT;
1870 }
1871 }
1872 }
1873#endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
1874
1875/* See if this is an unseen routing; first expand the option if necessary.
1876DEFER can be given if the expansion fails */
1877
9c695f6d
JH
1878yield = exp_bool(addr, US"router", r->name, D_route,
1879 US"unseen", r->unseen, r->expand_unseen, &unseen);
059ec3d9
PH
1880if (yield != OK) goto ROUTE_EXIT;
1881
059ec3d9
PH
1882/* Debugging output recording a successful routing */
1883
1884HDEBUG(D_route)
1885 {
1886 debug_printf("routed by %s router%s\n", r->name,
1887 unseen? " (unseen)" : "");
1888 }
1889
1890DEBUG(D_route)
1891 {
1892 host_item *h;
1893
1894 debug_printf(" envelope to: %s\n", addr->address);
1895 debug_printf(" transport: %s\n", (addr->transport == NULL)?
1896 US"<none>" : addr->transport->name);
1897
d43cbe25
JH
1898 if (addr->prop.errors_address != NULL)
1899 debug_printf(" errors to %s\n", addr->prop.errors_address);
059ec3d9
PH
1900
1901 for (h = addr->host_list; h != NULL; h = h->next)
1902 {
1903 debug_printf(" host %s", h->name);
1904 if (h->address != NULL) debug_printf(" [%s]", h->address);
1905 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
1906 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
1907 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
805c9d53 1908 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
059ec3d9
PH
1909 debug_printf("\n");
1910 }
1911 }
1912
1913/* Clear any temporary error message set by a router that declined, and handle
1914the "unseen" option (ignore if there are no further routers). */
1915
1916addr->message = NULL;
1917if (unseen && r->next != NULL)
1918 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
1919
1920/* Unset the address expansions, and return the final result. */
1921
1922ROUTE_EXIT:
a818f679
JH
1923if ( yield == DEFER
1924 && addr->message
1925 && ( Ustrstr(addr->message, "failed to expand") != NULL
1926 || Ustrstr(addr->message, "expansion of ") != NULL
1927 )
1928 && ( Ustrstr(addr->message, "mysql") != NULL
1929 || Ustrstr(addr->message, "pgsql") != NULL
9bdd29ad 1930#ifdef EXPERIMENTAL_REDIS
a818f679 1931 || Ustrstr(addr->message, "redis") != NULL
9bdd29ad 1932#endif
a818f679
JH
1933 || Ustrstr(addr->message, "sqlite") != NULL
1934 || Ustrstr(addr->message, "ldap:") != NULL
1935 || Ustrstr(addr->message, "ldapdn:") != NULL
1936 || Ustrstr(addr->message, "ldapm:") != NULL
1937 )
1938 )
1939 addr->message = string_sprintf("Temporary internal error");
76aa570c 1940
059ec3d9 1941deliver_set_expansions(NULL);
2a47f028 1942router_name = NULL;
059ec3d9
PH
1943disable_logging = FALSE;
1944return yield;
1945}
1946
1947/* End of route.c */