TLS: variables $tls_(in,out)_tlsver
[exim.git] / src / src / spool_in.c
CommitLineData
059ec3d9
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
059ec3d9
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8/* Functions for reading spool files. When compiling for a utility (eximon),
9not all are needed, and some functionality can be cut out. */
10
11
12#include "exim.h"
13
14
15
16#ifndef COMPILE_UTILITY
17/*************************************************
18* Open and lock data file *
19*************************************************/
20
21/* The data file is the one that is used for locking, because the header file
22can get replaced during delivery because of header rewriting. The file has
23to opened with write access so that we can get an exclusive lock, but in
24fact it won't be written to. Just in case there's a major disaster (e.g.
25overwriting some other file descriptor with the value of this one), open it
26with append.
27
92b0827a
JH
28As called by deliver_message() (at least) we are operating as root.
29
059ec3d9 30Argument: the id of the message
789f8a4f 31Returns: fd if file successfully opened and locked, else -1
059ec3d9 32
789f8a4f 33Side effect: message_subdir is set for the (possibly split) spool directory
059ec3d9
PH
34*/
35
789f8a4f 36int
059ec3d9
PH
37spool_open_datafile(uschar *id)
38{
059ec3d9
PH
39struct stat statbuf;
40flock_t lock_data;
789f8a4f 41int fd;
059ec3d9
PH
42
43/* If split_spool_directory is set, first look for the file in the appropriate
44sub-directory of the input directory. If it is not found there, try the input
45directory itself, to pick up leftovers from before the splitting. If split_
46spool_directory is not set, first look in the main input directory. If it is
47not found there, try the split sub-directory, in case it is left over from a
48splitting state. */
49
d7978c0f 50for (int i = 0; i < 2; i++)
059ec3d9 51 {
41313d92 52 uschar * fname;
059ec3d9 53 int save_errno;
9befa1ca 54
59a93276 55 set_subdir_str(message_subdir, id, i);
41313d92
JH
56 fname = spool_fname(US"input", message_subdir, id, US"-D");
57 DEBUG(D_deliver) debug_printf("Trying spool file %s\n", fname);
a2da3176 58
85defcf0
PP
59 /* We protect against symlink attacks both in not propagating the
60 * file-descriptor to other processes as we exec, and also ensuring that we
61 * don't even open symlinks.
62 * No -D file inside the spool area should be a symlink.
63 */
92b0827a
JH
64 if ((fd = Uopen(fname,
65#ifdef O_CLOEXEC
66 O_CLOEXEC |
67#endif
85defcf0
PP
68#ifdef O_NOFOLLOW
69 O_NOFOLLOW |
70#endif
92b0827a 71 O_RDWR | O_APPEND, 0)) >= 0)
789f8a4f 72 break;
059ec3d9
PH
73 save_errno = errno;
74 if (errno == ENOENT)
75 {
76 if (i == 0) continue;
8768d548 77 if (!f.queue_running)
9befa1ca 78 log_write(0, LOG_MAIN, "Spool%s%s file %s-D not found",
12cf7615
JH
79 *queue_name ? US" Q=" : US"",
80 *queue_name ? queue_name : US"",
9befa1ca 81 id);
059ec3d9 82 }
9befa1ca
JH
83 else
84 log_write(0, LOG_MAIN, "Spool error for %s: %s", fname, strerror(errno));
059ec3d9 85 errno = save_errno;
789f8a4f 86 return -1;
059ec3d9
PH
87 }
88
89/* File is open and message_subdir is set. Set the close-on-exec flag, and lock
90the file. We lock only the first line of the file (containing the message ID)
91because this apparently is needed for running Exim under Cygwin. If the entire
92file is locked in one process, a sub-process cannot access it, even when passed
93an open file descriptor (at least, I think that's the Cygwin story). On real
94Unix systems it doesn't make any difference as long as Exim is consistent in
95what it locks. */
96
92b0827a
JH
97#ifndef O_CLOEXEC
98(void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
99#endif
059ec3d9
PH
100
101lock_data.l_type = F_WRLCK;
102lock_data.l_whence = SEEK_SET;
103lock_data.l_start = 0;
104lock_data.l_len = SPOOL_DATA_START_OFFSET;
105
789f8a4f 106if (fcntl(fd, F_SETLK, &lock_data) < 0)
059ec3d9
PH
107 {
108 log_write(L_skip_delivery,
109 LOG_MAIN,
110 "Spool file is locked (another process is handling this message)");
789f8a4f 111 (void)close(fd);
059ec3d9 112 errno = 0;
789f8a4f 113 return -1;
059ec3d9
PH
114 }
115
116/* Get the size of the data; don't include the leading filename line
117in the count, but add one for the newline before the data. */
118
789f8a4f 119if (fstat(fd, &statbuf) == 0)
059ec3d9
PH
120 {
121 message_body_size = statbuf.st_size - SPOOL_DATA_START_OFFSET;
122 message_size = message_body_size + 1;
123 }
124
789f8a4f 125return fd;
059ec3d9
PH
126}
127#endif /* COMPILE_UTILITY */
128
129
130
131/*************************************************
132* Read non-recipients tree from spool file *
133*************************************************/
134
135/* The tree of non-recipients is written to the spool file in a form that
136makes it easy to read back into a tree. The format is as follows:
137
138 . Each node is preceded by two letter(Y/N) indicating whether it has left
139 or right children. There's one space after the two flags, before the name.
140
141 . The left subtree (if any) then follows, then the right subtree (if any).
142
143This function is entered with the next input line in the buffer. Note we must
144save the right flag before recursing with the same buffer.
145
146Once the tree is read, we re-construct the balance fields by scanning the tree.
147I forgot to write them out originally, and the compatible fix is to do it this
148way. This initial local recursing function does the necessary.
149
150Arguments:
151 node tree node
152
153Returns: maximum depth below the node, including the node itself
154*/
155
156static int
157count_below(tree_node *node)
158{
159int nleft, nright;
160if (node == NULL) return 0;
161nleft = count_below(node->left);
162nright = count_below(node->right);
163node->balance = (nleft > nright)? 1 : ((nright > nleft)? 2 : 0);
164return 1 + ((nleft > nright)? nleft : nright);
165}
166
167/* This is the real function...
168
169Arguments:
170 connect pointer to the root of the tree
171 f FILE to read data from
172 buffer contains next input line; further lines read into it
173 buffer_size size of the buffer
174
175Returns: FALSE on format error
176*/
177
178static BOOL
179read_nonrecipients_tree(tree_node **connect, FILE *f, uschar *buffer,
180 int buffer_size)
181{
182tree_node *node;
183int n = Ustrlen(buffer);
184BOOL right = buffer[1] == 'Y';
185
186if (n < 5) return FALSE; /* malformed line */
187buffer[n-1] = 0; /* Remove \n */
d81d33cf 188node = store_get(sizeof(tree_node) + n - 3, TRUE); /* rcpt names tainted */
059ec3d9
PH
189*connect = node;
190Ustrcpy(node->name, buffer + 3);
191node->data.ptr = NULL;
192
193if (buffer[0] == 'Y')
194 {
195 if (Ufgets(buffer, buffer_size, f) == NULL ||
196 !read_nonrecipients_tree(&node->left, f, buffer, buffer_size))
197 return FALSE;
198 }
199else node->left = NULL;
200
201if (right)
202 {
203 if (Ufgets(buffer, buffer_size, f) == NULL ||
204 !read_nonrecipients_tree(&node->right, f, buffer, buffer_size))
205 return FALSE;
206 }
207else node->right = NULL;
208
209(void) count_below(*connect);
210return TRUE;
211}
212
213
214
215
059ec3d9
PH
216/* Reset all the global variables to their default values. However, there is
217one exception. DO NOT change the default value of dont_deliver, because it may
218be forced by an external setting. */
219
4b4856ff
JH
220void
221spool_clear_header_globals(void)
222{
38a0a95f 223acl_var_c = acl_var_m = NULL;
059ec3d9
PH
224authenticated_id = NULL;
225authenticated_sender = NULL;
8768d548
JH
226f.allow_unqualified_recipient = FALSE;
227f.allow_unqualified_sender = FALSE;
059ec3d9
PH
228body_linecount = 0;
229body_zerocount = 0;
8768d548
JH
230f.deliver_firsttime = FALSE;
231f.deliver_freeze = FALSE;
059ec3d9 232deliver_frozen_at = 0;
8768d548
JH
233f.deliver_manual_thaw = FALSE;
234/* f.dont_deliver must NOT be reset */
059ec3d9 235header_list = header_last = NULL;
b08b24c8 236host_lookup_deferred = FALSE;
059ec3d9
PH
237host_lookup_failed = FALSE;
238interface_address = NULL;
239interface_port = 0;
8768d548 240f.local_error_message = FALSE;
9723f966 241#ifdef HAVE_LOCAL_SCAN
059ec3d9 242local_scan_data = NULL;
9723f966 243#endif
d677b2f2 244max_received_linelength = 0;
059ec3d9
PH
245message_linecount = 0;
246received_protocol = NULL;
247received_count = 0;
248recipients_list = NULL;
249sender_address = NULL;
250sender_fullhost = NULL;
251sender_helo_name = NULL;
252sender_host_address = NULL;
253sender_host_name = NULL;
254sender_host_port = 0;
255sender_host_authenticated = NULL;
256sender_ident = NULL;
8768d548
JH
257f.sender_local = FALSE;
258f.sender_set_untrusted = FALSE;
1f5b4c3d 259smtp_active_hostname = primary_hostname;
328c5688 260#ifndef COMPILE_UTILITY
8768d548 261f.spool_file_wireformat = FALSE;
328c5688 262#endif
059ec3d9
PH
263tree_nonrecipients = NULL;
264
8523533c
TK
265#ifdef EXPERIMENTAL_BRIGHTMAIL
266bmi_run = 0;
267bmi_verdicts = NULL;
268#endif
269
80a47a2c 270#ifndef DISABLE_DKIM
9e5d6b55 271dkim_signers = NULL;
8768d548 272f.dkim_disable_verify = FALSE;
64b67b65 273dkim_collect_input = 0;
f7572e5a
TK
274#endif
275
01603eec 276#ifndef DISABLE_TLS
817d9f57 277tls_in.certificate_verified = FALSE;
c0635b6d 278# ifdef SUPPORT_DANE
53a7196b
JH
279tls_in.dane_verified = FALSE;
280# endif
5b195d6b 281tls_in.ver = tls_in.cipher = NULL;
790fbb71
JH
282# ifndef COMPILE_UTILITY /* tls support fns not built in */
283tls_free_cert(&tls_in.ourcert);
284tls_free_cert(&tls_in.peercert);
285# endif
817d9f57
JH
286tls_in.peerdn = NULL;
287tls_in.sni = NULL;
44662487 288tls_in.ocsp = OCSP_NOT_REQ;
7be682ca 289#endif
059ec3d9 290
8523533c 291#ifdef WITH_CONTENT_SCAN
3481c572
JH
292spam_bar = NULL;
293spam_score = NULL;
8523533c
TK
294spam_score_int = NULL;
295#endif
296
8c5d388a 297#if defined(SUPPORT_I18N) && !defined(COMPILE_UTILITY)
7ade712c 298message_smtputf8 = FALSE;
3c8b3577 299message_utf8_downconvert = 0;
7ade712c
JH
300#endif
301
6c1c3d1d
WB
302dsn_ret = 0;
303dsn_envid = NULL;
4b4856ff
JH
304}
305
306
307/*************************************************
308* Read spool header file *
309*************************************************/
310
311/* This function reads a spool header file and places the data into the
312appropriate global variables. The header portion is always read, but header
313structures are built only if read_headers is set true. It isn't, for example,
314while generating -bp output.
315
316It may be possible for blocks of nulls (binary zeroes) to get written on the
317end of a file if there is a system crash during writing. It was observed on an
318earlier version of Exim that omitted to fsync() the files - this is thought to
319have been the cause of that incident, but in any case, this code must be robust
320against such an event, and if such a file is encountered, it must be treated as
321malformed.
322
323As called from deliver_message() (at least) we are running as root.
324
325Arguments:
326 name name of the header file, including the -H
327 read_headers TRUE if in-store header structures are to be built
328 subdir_set TRUE is message_subdir is already set
329
330Returns: spool_read_OK success
331 spool_read_notopen open failed
332 spool_read_enverror error in the envelope portion
333 spool_read_hdrerror error in the header portion
334*/
335
336int
337spool_read_header(uschar *name, BOOL read_headers, BOOL subdir_set)
338{
8768d548 339FILE * fp = NULL;
4b4856ff
JH
340int n;
341int rcount = 0;
342long int uid, gid;
343BOOL inheader = FALSE;
4b4856ff
JH
344
345/* Reset all the global variables to their default values. However, there is
346one exception. DO NOT change the default value of dont_deliver, because it may
347be forced by an external setting. */
348
349spool_clear_header_globals();
6c1c3d1d 350
059ec3d9
PH
351/* Generate the full name and open the file. If message_subdir is already
352set, just look in the given directory. Otherwise, look in both the split
353and unsplit directories, as for the data file above. */
354
d7978c0f 355for (int n = 0; n < 2; n++)
059ec3d9
PH
356 {
357 if (!subdir_set)
59a93276 358 set_subdir_str(message_subdir, name, n);
41313d92 359
8768d548 360 if ((fp = Ufopen(spool_fname(US"input", message_subdir, name, US""), "rb")))
41313d92
JH
361 break;
362 if (n != 0 || subdir_set || errno != ENOENT)
363 return spool_read_notopen;
059ec3d9
PH
364 }
365
366errno = 0;
367
368#ifndef COMPILE_UTILITY
369DEBUG(D_deliver) debug_printf("reading spool file %s\n", name);
370#endif /* COMPILE_UTILITY */
371
372/* The first line of a spool file contains the message id followed by -H (i.e.
373the file name), in order to make the file self-identifying. */
374
8768d548 375if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9
PH
376if (Ustrlen(big_buffer) != MESSAGE_ID_LENGTH + 3 ||
377 Ustrncmp(big_buffer, name, MESSAGE_ID_LENGTH + 2) != 0)
378 goto SPOOL_FORMAT_ERROR;
379
380/* The next three lines in the header file are in a fixed format. The first
381contains the login, uid, and gid of the user who caused the file to be written.
ebb6e6d5
PH
382There are known cases where a negative gid is used, so we allow for both
383negative uids and gids. The second contains the mail address of the message's
384sender, enclosed in <>. The third contains the time the message was received,
385and the number of warning messages for delivery delays that have been sent. */
059ec3d9 386
8768d548 387if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9 388
fc55624d
HSHR
389{
390uschar *p = big_buffer + Ustrlen(big_buffer);
1e70f85b
PH
391while (p > big_buffer && isspace(p[-1])) p--;
392*p = 0;
393if (!isdigit(p[-1])) goto SPOOL_FORMAT_ERROR;
ebb6e6d5 394while (p > big_buffer && (isdigit(p[-1]) || '-' == p[-1])) p--;
1e70f85b
PH
395gid = Uatoi(p);
396if (p <= big_buffer || *(--p) != ' ') goto SPOOL_FORMAT_ERROR;
397*p = 0;
398if (!isdigit(p[-1])) goto SPOOL_FORMAT_ERROR;
ebb6e6d5 399while (p > big_buffer && (isdigit(p[-1]) || '-' == p[-1])) p--;
1e70f85b
PH
400uid = Uatoi(p);
401if (p <= big_buffer || *(--p) != ' ') goto SPOOL_FORMAT_ERROR;
402*p = 0;
fc55624d 403}
8e669ac1 404
1e70f85b 405originator_login = string_copy(big_buffer);
059ec3d9
PH
406originator_uid = (uid_t)uid;
407originator_gid = (gid_t)gid;
408
e91ad4a7 409/* envelope from */
8768d548 410if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9
PH
411n = Ustrlen(big_buffer);
412if (n < 3 || big_buffer[0] != '<' || big_buffer[n-2] != '>')
413 goto SPOOL_FORMAT_ERROR;
414
f3ebb786 415sender_address = store_get(n-2, TRUE); /* tainted */
059ec3d9
PH
416Ustrncpy(sender_address, big_buffer+1, n-3);
417sender_address[n-3] = 0;
418
e91ad4a7 419/* time */
8768d548 420if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
32dfdf8b 421if (sscanf(CS big_buffer, TIME_T_FMT " %d", &received_time.tv_sec, &warning_count) != 2)
059ec3d9 422 goto SPOOL_FORMAT_ERROR;
32dfdf8b 423received_time.tv_usec = 0;
059ec3d9 424
32dfdf8b 425message_age = time(NULL) - received_time.tv_sec;
059ec3d9
PH
426
427#ifndef COMPILE_UTILITY
428DEBUG(D_deliver) debug_printf("user=%s uid=%ld gid=%ld sender=%s\n",
429 originator_login, (long int)originator_uid, (long int)originator_gid,
430 sender_address);
431#endif /* COMPILE_UTILITY */
432
08955dd3
PH
433/* Now there may be a number of optional lines, each starting with "-". If you
434add a new setting here, make sure you set the default above.
059ec3d9 435
08955dd3
PH
436Because there are now quite a number of different possibilities, we use a
437switch on the first character to avoid too many failing tests. Thanks to Nico
438Erfurth for the patch that implemented this. I have made it even more efficient
439by not re-scanning the first two characters.
440
441To allow new versions of Exim that add additional flags to interwork with older
442versions that do not understand them, just ignore any lines starting with "-"
443that we don't recognize. Otherwise it wouldn't be possible to back off a new
f3ebb786
JH
444version that left new-style flags written on the spool.
445
446If the line starts with "--" the content of the variable is tainted. */
08955dd3 447
059ec3d9
PH
448for (;;)
449 {
e91ad4a7 450 int len;
f3ebb786
JH
451 BOOL tainted;
452 uschar * var;
fc55624d 453 const uschar * p;
f3ebb786 454
8768d548 455 if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9 456 if (big_buffer[0] != '-') break;
e91ad4a7
JH
457 while ( (len = Ustrlen(big_buffer)) == big_buffer_size-1
458 && big_buffer[len-1] != '\n'
459 )
460 { /* buffer not big enough for line; certs make this possible */
461 uschar * buf;
462 if (big_buffer_size >= BIG_BUFFER_SIZE*4) goto SPOOL_READ_ERROR;
f3ebb786 463 buf = store_get_perm(big_buffer_size *= 2, FALSE);
e91ad4a7
JH
464 memcpy(buf, big_buffer, --len);
465 big_buffer = buf;
8768d548 466 if (Ufgets(big_buffer+len, big_buffer_size-len, fp) == NULL)
e91ad4a7
JH
467 goto SPOOL_READ_ERROR;
468 }
469 big_buffer[len-1] = 0;
47ca6d6c 470
f3ebb786
JH
471 tainted = big_buffer[1] == '-';
472 var = big_buffer + (tainted ? 2 : 1);
473 p = var + 1;
474
475 switch(*var)
059ec3d9 476 {
08955dd3
PH
477 case 'a':
478
479 /* Nowadays we use "-aclc" and "-aclm" for the different types of ACL
480 variable, because Exim allows any number of them, with arbitrary names.
481 The line in the spool file is "-acl[cm] <name> <length>". The name excludes
482 the c or m. */
483
484 if (Ustrncmp(p, "clc ", 4) == 0 ||
485 Ustrncmp(p, "clm ", 4) == 0)
486 {
487 uschar *name, *endptr;
488 int count;
489 tree_node *node;
f3ebb786 490 endptr = Ustrchr(var + 5, ' ');
08955dd3 491 if (endptr == NULL) goto SPOOL_FORMAT_ERROR;
f3ebb786
JH
492 name = string_sprintf("%c%.*s", var[3],
493 (int)(endptr - var - 5), var + 5);
08955dd3
PH
494 if (sscanf(CS endptr, " %d", &count) != 1) goto SPOOL_FORMAT_ERROR;
495 node = acl_var_create(name);
f3ebb786 496 node->data.ptr = store_get(count + 1, tainted);
8768d548 497 if (fread(node->data.ptr, 1, count+1, fp) < count) goto SPOOL_READ_ERROR;
08955dd3
PH
498 ((uschar*)node->data.ptr)[count] = 0;
499 }
500
501 else if (Ustrcmp(p, "llow_unqualified_recipient") == 0)
8768d548 502 f.allow_unqualified_recipient = TRUE;
08955dd3 503 else if (Ustrcmp(p, "llow_unqualified_sender") == 0)
8768d548 504 f.allow_unqualified_sender = TRUE;
08955dd3
PH
505
506 else if (Ustrncmp(p, "uth_id", 6) == 0)
f3ebb786 507 authenticated_id = string_copy_taint(var + 8, tainted);
08955dd3 508 else if (Ustrncmp(p, "uth_sender", 10) == 0)
f3ebb786 509 authenticated_sender = string_copy_taint(var + 12, tainted);
08955dd3 510 else if (Ustrncmp(p, "ctive_hostname", 14) == 0)
f3ebb786 511 smtp_active_hostname = string_copy_taint(var + 16, tainted);
08955dd3
PH
512
513 /* For long-term backward compatibility, we recognize "-acl", which was
514 used before the number of ACL variables changed from 10 to 20. This was
515 before the subsequent change to an arbitrary number of named variables.
516 This code is retained so that upgrades from very old versions can still
517 handle old-format spool files. The value given after "-acl" is a number
518 that is 0-9 for connection variables, and 10-19 for message variables. */
519
520 else if (Ustrncmp(p, "cl ", 3) == 0)
521 {
4dc2379a
JH
522 unsigned index, count;
523 uschar name[20]; /* Need plenty of space for %u format */
524 tree_node * node;
f3ebb786 525 if ( sscanf(CS var + 4, "%u %u", &index, &count) != 2
806c3df9 526 || index >= 20
f267271d 527 || count > 16384 /* arbitrary limit on variable size */
806c3df9 528 )
08955dd3 529 goto SPOOL_FORMAT_ERROR;
8dce1a6f 530 if (index < 10)
4dc2379a 531 (void) string_format(name, sizeof(name), "%c%u", 'c', index);
806c3df9 532 else
4dc2379a 533 (void) string_format(name, sizeof(name), "%c%u", 'm', index - 10);
08955dd3 534 node = acl_var_create(name);
f3ebb786 535 node->data.ptr = store_get(count + 1, tainted);
f267271d
JH
536 /* We sanity-checked the count, so disable the Coverity error */
537 /* coverity[tainted_data] */
8768d548 538 if (fread(node->data.ptr, 1, count+1, fp) < count) goto SPOOL_READ_ERROR;
4dc2379a 539 (US node->data.ptr)[count] = '\0';
08955dd3
PH
540 }
541 break;
542
543 case 'b':
544 if (Ustrncmp(p, "ody_linecount", 13) == 0)
f3ebb786 545 body_linecount = Uatoi(var + 14);
08955dd3 546 else if (Ustrncmp(p, "ody_zerocount", 13) == 0)
f3ebb786 547 body_zerocount = Uatoi(var + 14);
e91ad4a7 548#ifdef EXPERIMENTAL_BRIGHTMAIL
08955dd3 549 else if (Ustrncmp(p, "mi_verdicts ", 12) == 0)
f3ebb786 550 bmi_verdicts = string_copy_taint(var + 13, tainted);
e91ad4a7 551#endif
08955dd3
PH
552 break;
553
554 case 'd':
555 if (Ustrcmp(p, "eliver_firsttime") == 0)
8768d548 556 f.deliver_firsttime = TRUE;
6c1c3d1d
WB
557 /* Check if the dsn flags have been set in the header file */
558 else if (Ustrncmp(p, "sn_ret", 6) == 0)
f3ebb786 559 dsn_ret= atoi(CS var + 7);
6c1c3d1d 560 else if (Ustrncmp(p, "sn_envid", 8) == 0)
f3ebb786 561 dsn_envid = string_copy_taint(var + 10, tainted);
08955dd3
PH
562 break;
563
564 case 'f':
565 if (Ustrncmp(p, "rozen", 5) == 0)
566 {
8768d548 567 f.deliver_freeze = TRUE;
f3ebb786 568 if (sscanf(CS var+6, TIME_T_FMT, &deliver_frozen_at) != 1)
dc8091e7 569 goto SPOOL_READ_ERROR;
08955dd3
PH
570 }
571 break;
572
573 case 'h':
574 if (Ustrcmp(p, "ost_lookup_deferred") == 0)
575 host_lookup_deferred = TRUE;
576 else if (Ustrcmp(p, "ost_lookup_failed") == 0)
577 host_lookup_failed = TRUE;
578 else if (Ustrncmp(p, "ost_auth", 8) == 0)
f3ebb786 579 sender_host_authenticated = string_copy_taint(var + 10, tainted);
08955dd3 580 else if (Ustrncmp(p, "ost_name", 8) == 0)
f3ebb786 581 sender_host_name = string_copy_taint(var + 10, tainted);
08955dd3 582 else if (Ustrncmp(p, "elo_name", 8) == 0)
f3ebb786 583 sender_helo_name = string_copy_taint(var + 10, tainted);
08955dd3
PH
584
585 /* We now record the port number after the address, separated by a
586 dot. For compatibility during upgrading, do nothing if there
587 isn't a value (it gets left at zero). */
588
589 else if (Ustrncmp(p, "ost_address", 11) == 0)
590 {
f3ebb786
JH
591 sender_host_port = host_address_extract_port(var + 13);
592 sender_host_address = string_copy_taint(var + 13, tainted);
08955dd3
PH
593 }
594 break;
595
596 case 'i':
597 if (Ustrncmp(p, "nterface_address", 16) == 0)
598 {
f3ebb786
JH
599 interface_port = host_address_extract_port(var + 18);
600 interface_address = string_copy_taint(var + 18, tainted);
08955dd3
PH
601 }
602 else if (Ustrncmp(p, "dent", 4) == 0)
f3ebb786 603 sender_ident = string_copy_taint(var + 6, tainted);
08955dd3
PH
604 break;
605
606 case 'l':
32dfdf8b 607 if (Ustrcmp(p, "ocal") == 0)
8768d548 608 f.sender_local = TRUE;
f3ebb786 609 else if (Ustrcmp(var, "localerror") == 0)
8768d548 610 f.local_error_message = TRUE;
9723f966 611#ifdef HAVE_LOCAL_SCAN
08955dd3 612 else if (Ustrncmp(p, "ocal_scan ", 10) == 0)
f3ebb786 613 local_scan_data = string_copy_taint(var + 11, tainted);
9723f966 614#endif
08955dd3
PH
615 break;
616
617 case 'm':
f3ebb786
JH
618 if (Ustrcmp(p, "anual_thaw") == 0)
619 f.deliver_manual_thaw = TRUE;
d677b2f2 620 else if (Ustrncmp(p, "ax_received_linelength", 22) == 0)
f3ebb786 621 max_received_linelength = Uatoi(var + 23);
08955dd3
PH
622 break;
623
624 case 'N':
8768d548 625 if (*p == 0) f.dont_deliver = TRUE; /* -N */
08955dd3
PH
626 break;
627
628 case 'r':
629 if (Ustrncmp(p, "eceived_protocol", 16) == 0)
f3ebb786 630 received_protocol = string_copy_taint(var + 18, tainted);
32dfdf8b
JH
631 else if (Ustrncmp(p, "eceived_time_usec", 17) == 0)
632 {
633 unsigned usec;
f3ebb786 634 if (sscanf(CS var + 20, "%u", &usec) == 1)
32dfdf8b
JH
635 received_time.tv_usec = usec;
636 }
08955dd3
PH
637 break;
638
639 case 's':
640 if (Ustrncmp(p, "ender_set_untrusted", 19) == 0)
8768d548 641 f.sender_set_untrusted = TRUE;
e91ad4a7 642#ifdef WITH_CONTENT_SCAN
3481c572 643 else if (Ustrncmp(p, "pam_bar ", 8) == 0)
f3ebb786 644 spam_bar = string_copy_taint(var + 9, tainted);
3481c572 645 else if (Ustrncmp(p, "pam_score ", 10) == 0)
f3ebb786 646 spam_score = string_copy_taint(var + 11, tainted);
08955dd3 647 else if (Ustrncmp(p, "pam_score_int ", 14) == 0)
f3ebb786 648 spam_score_int = string_copy_taint(var + 15, tainted);
e91ad4a7 649#endif
328c5688
JH
650#ifndef COMPILE_UTILITY
651 else if (Ustrncmp(p, "pool_file_wireformat", 20) == 0)
8768d548 652 f.spool_file_wireformat = TRUE;
328c5688 653#endif
8c5d388a 654#if defined(SUPPORT_I18N) && !defined(COMPILE_UTILITY)
7ade712c
JH
655 else if (Ustrncmp(p, "mtputf8", 7) == 0)
656 message_smtputf8 = TRUE;
657#endif
08955dd3
PH
658 break;
659
01603eec 660#ifndef DISABLE_TLS
08955dd3 661 case 't':
8ac90765
JH
662 if (Ustrncmp(p, "ls_", 3) == 0)
663 {
fc55624d 664 const uschar * q = p + 3;
8ac90765
JH
665 if (Ustrncmp(q, "certificate_verified", 20) == 0)
666 tls_in.certificate_verified = TRUE;
667 else if (Ustrncmp(q, "cipher", 6) == 0)
5b195d6b 668 tls_in.cipher = string_copy_taint(q+7, tainted);
e91ad4a7 669# ifndef COMPILE_UTILITY /* tls support fns not built in */
8ac90765 670 else if (Ustrncmp(q, "ourcert", 7) == 0)
5b195d6b 671 (void) tls_import_cert(q+8, &tls_in.ourcert);
8ac90765 672 else if (Ustrncmp(q, "peercert", 8) == 0)
5b195d6b 673 (void) tls_import_cert(q+9, &tls_in.peercert);
e91ad4a7 674# endif
8ac90765 675 else if (Ustrncmp(q, "peerdn", 6) == 0)
5b195d6b 676 tls_in.peerdn = string_unprinting(string_copy_taint(q+7, tainted));
8ac90765 677 else if (Ustrncmp(q, "sni", 3) == 0)
5b195d6b 678 tls_in.sni = string_unprinting(string_copy_taint(q+4, tainted));
8ac90765 679 else if (Ustrncmp(q, "ocsp", 4) == 0)
5b195d6b 680 tls_in.ocsp = q[5] - '0';
b10c87b3
JH
681# ifdef EXPERIMENTAL_TLS_RESUME
682 else if (Ustrncmp(q, "resumption", 10) == 0)
5b195d6b 683 tls_in.resumption = q[11] - 'A';
b10c87b3 684# endif
5b195d6b
JH
685 else if (Ustrncmp(q, "ver", 3) == 0)
686 tls_in.ver = string_copy_taint(q+4, tainted);
8ac90765 687 }
08955dd3 688 break;
e91ad4a7 689#endif
08955dd3 690
8c5d388a 691#if defined(SUPPORT_I18N) && !defined(COMPILE_UTILITY)
3c8b3577
JH
692 case 'u':
693 if (Ustrncmp(p, "tf8_downcvt", 11) == 0)
694 message_utf8_downconvert = 1;
0ec7e948 695 else if (Ustrncmp(p, "tf8_optdowncvt", 15) == 0)
3c8b3577
JH
696 message_utf8_downconvert = -1;
697 break;
698#endif
699
08955dd3
PH
700 default: /* Present because some compilers complain if all */
701 break; /* possibilities are not covered. */
059ec3d9 702 }
059ec3d9
PH
703 }
704
705/* Build sender_fullhost if required */
706
707#ifndef COMPILE_UTILITY
708host_build_sender_fullhost();
709#endif /* COMPILE_UTILITY */
710
711#ifndef COMPILE_UTILITY
712DEBUG(D_deliver)
8768d548 713 debug_printf("sender_local=%d ident=%s\n", f.sender_local,
d81d33cf 714 sender_ident ? sender_ident : US"unset");
059ec3d9
PH
715#endif /* COMPILE_UTILITY */
716
717/* We now have the tree of addresses NOT to deliver to, or a line
718containing "XX", indicating no tree. */
719
720if (Ustrncmp(big_buffer, "XX\n", 3) != 0 &&
8768d548 721 !read_nonrecipients_tree(&tree_nonrecipients, fp, big_buffer, big_buffer_size))
059ec3d9
PH
722 goto SPOOL_FORMAT_ERROR;
723
724#ifndef COMPILE_UTILITY
725DEBUG(D_deliver)
726 {
727 debug_printf("Non-recipients:\n");
728 debug_print_tree(tree_nonrecipients);
729 }
730#endif /* COMPILE_UTILITY */
731
732/* After reading the tree, the next line has not yet been read into the
d88f0784
JH
733buffer. It contains the count of recipients which follow on separate lines.
734Apply an arbitrary sanity check.*/
059ec3d9 735
8768d548 736if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
d88f0784
JH
737if (sscanf(CS big_buffer, "%d", &rcount) != 1 || rcount > 16384)
738 goto SPOOL_FORMAT_ERROR;
059ec3d9
PH
739
740#ifndef COMPILE_UTILITY
741DEBUG(D_deliver) debug_printf("recipients_count=%d\n", rcount);
742#endif /* COMPILE_UTILITY */
743
744recipients_list_max = rcount;
f3ebb786 745recipients_list = store_get(rcount * sizeof(recipient_item), FALSE);
059ec3d9 746
d88f0784
JH
747/* We sanitised the count and know we have enough memory, so disable
748the Coverity error on recipients_count */
749/* coverity[tainted_data] */
750
059ec3d9
PH
751for (recipients_count = 0; recipients_count < rcount; recipients_count++)
752 {
753 int nn;
754 int pno = -1;
6c1c3d1d
WB
755 int dsn_flags = 0;
756 uschar *orcpt = NULL;
059ec3d9
PH
757 uschar *errors_to = NULL;
758 uschar *p;
759
8768d548 760 if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9
PH
761 nn = Ustrlen(big_buffer);
762 if (nn < 2) goto SPOOL_FORMAT_ERROR;
763
764 /* Remove the newline; this terminates the address if there is no additional
765 data on the line. */
766
767 p = big_buffer + nn - 1;
768 *p-- = 0;
769
770 /* Look back from the end of the line for digits and special terminators.
771 Since an address must end with a domain, we can tell that extra data is
772 present by the presence of the terminator, which is always some character
773 that cannot exist in a domain. (If I'd thought of the need for additional
774 data early on, I'd have put it at the start, with the address at the end. As
775 it is, we have to operate backwards. Addresses are permitted to contain
776 spaces, you see.)
777
778 This code has to cope with various versions of this data that have evolved
779 over time. In all cases, the line might just contain an address, with no
780 additional data. Otherwise, the possibilities are as follows:
781
782 Exim 3 type: <address><space><digits>,<digits>,<digits>
783
784 The second set of digits is the parent number for one_time addresses. The
785 other values were remnants of earlier experiments that were abandoned.
786
787 Exim 4 first type: <address><space><digits>
788
789 The digits are the parent number for one_time addresses.
790
791 Exim 4 new type: <address><space><data>#<type bits>
792
793 The type bits indicate what the contents of the data are.
794
795 Bit 01 indicates that, reading from right to left, the data
796 ends with <errors_to address><space><len>,<pno> where pno is
797 the parent number for one_time addresses, and len is the length
798 of the errors_to address (zero meaning none).
6c1c3d1d
WB
799
800 Bit 02 indicates that, again reading from right to left, the data continues
801 with orcpt len(orcpt),dsn_flags
059ec3d9
PH
802 */
803
804 while (isdigit(*p)) p--;
805
806 /* Handle Exim 3 spool files */
807
808 if (*p == ',')
809 {
810 int dummy;
f3ebb786
JH
811#if !defined (COMPILE_UTILITY)
812 DEBUG(D_deliver) debug_printf("**** SPOOL_IN - Exim 3 spool file\n");
813#endif
059ec3d9
PH
814 while (isdigit(*(--p)) || *p == ',');
815 if (*p == ' ')
816 {
817 *p++ = 0;
ff790e47 818 (void)sscanf(CS p, "%d,%d", &dummy, &pno);
059ec3d9
PH
819 }
820 }
821
822 /* Handle early Exim 4 spool files */
823
824 else if (*p == ' ')
825 {
f3ebb786
JH
826#if !defined (COMPILE_UTILITY)
827 DEBUG(D_deliver) debug_printf("**** SPOOL_IN - early Exim 4 spool file\n");
828#endif
059ec3d9 829 *p++ = 0;
ff790e47 830 (void)sscanf(CS p, "%d", &pno);
059ec3d9
PH
831 }
832
833 /* Handle current format Exim 4 spool files */
834
835 else if (*p == '#')
836 {
837 int flags;
6c1c3d1d 838
50dc7409 839#if !defined (COMPILE_UTILITY)
df98a6ff 840 DEBUG(D_deliver) debug_printf("**** SPOOL_IN - Exim standard format spoolfile\n");
e91ad4a7 841#endif
6c1c3d1d 842
ff790e47 843 (void)sscanf(CS p+1, "%d", &flags);
059ec3d9
PH
844
845 if ((flags & 0x01) != 0) /* one_time data exists */
846 {
847 int len;
848 while (isdigit(*(--p)) || *p == ',' || *p == '-');
ff790e47 849 (void)sscanf(CS p+1, "%d,%d", &len, &pno);
059ec3d9
PH
850 *p = 0;
851 if (len > 0)
852 {
853 p -= len;
f3ebb786 854 errors_to = string_copy_taint(p, TRUE);
94431adb 855 }
6c1c3d1d
WB
856 }
857
858 *(--p) = 0; /* Terminate address */
6c1c3d1d
WB
859 if ((flags & 0x02) != 0) /* one_time data exists */
860 {
861 int len;
862 while (isdigit(*(--p)) || *p == ',' || *p == '-');
863 (void)sscanf(CS p+1, "%d,%d", &len, &dsn_flags);
864 *p = 0;
865 if (len > 0)
866 {
867 p -= len;
f3ebb786 868 orcpt = string_copy_taint(p, TRUE);
94431adb 869 }
059ec3d9
PH
870 }
871
872 *(--p) = 0; /* Terminate address */
6c1c3d1d 873 }
50dc7409 874#if !defined(COMPILE_UTILITY)
6c1c3d1d 875 else
e91ad4a7 876 { DEBUG(D_deliver) debug_printf("**** SPOOL_IN - No additional fields\n"); }
6c1c3d1d 877
df98a6ff
JH
878 if (orcpt || dsn_flags)
879 DEBUG(D_deliver) debug_printf("**** SPOOL_IN - address: <%s> orcpt: <%s> dsn_flags: 0x%x\n",
6c1c3d1d 880 big_buffer, orcpt, dsn_flags);
df98a6ff
JH
881 if (errors_to)
882 DEBUG(D_deliver) debug_printf("**** SPOOL_IN - address: <%s> errorsto: <%s>\n",
6c1c3d1d 883 big_buffer, errors_to);
50dc7409 884#endif
059ec3d9 885
f3ebb786 886 recipients_list[recipients_count].address = string_copy_taint(big_buffer, TRUE);
059ec3d9
PH
887 recipients_list[recipients_count].pno = pno;
888 recipients_list[recipients_count].errors_to = errors_to;
6c1c3d1d
WB
889 recipients_list[recipients_count].orcpt = orcpt;
890 recipients_list[recipients_count].dsn_flags = dsn_flags;
059ec3d9
PH
891 }
892
893/* The remainder of the spool header file contains the headers for the message,
894separated off from the previous data by a blank line. Each header is preceded
895by a count of its length and either a certain letter (for various identified
896headers), space (for a miscellaneous live header) or an asterisk (for a header
897that has been rewritten). Count the Received: headers. We read the headers
898always, in order to check on the format of the file, but only create a header
899list if requested to do so. */
900
901inheader = TRUE;
8768d548 902if (Ufgets(big_buffer, big_buffer_size, fp) == NULL) goto SPOOL_READ_ERROR;
059ec3d9
PH
903if (big_buffer[0] != '\n') goto SPOOL_FORMAT_ERROR;
904
8768d548 905while ((n = fgetc(fp)) != EOF)
059ec3d9
PH
906 {
907 header_line *h;
908 uschar flag[4];
909 int i;
910
911 if (!isdigit(n)) goto SPOOL_FORMAT_ERROR;
8768d548 912 if(ungetc(n, fp) == EOF || fscanf(fp, "%d%c ", &n, flag) == EOF)
1ac6b2e7 913 goto SPOOL_READ_ERROR;
059ec3d9
PH
914 if (flag[0] != '*') message_size += n; /* Omit non-transmitted headers */
915
916 if (read_headers)
917 {
f3ebb786 918 h = store_get(sizeof(header_line), FALSE);
059ec3d9
PH
919 h->next = NULL;
920 h->type = flag[0];
921 h->slen = n;
f3ebb786 922 h->text = store_get(n+1, TRUE); /* tainted */
059ec3d9
PH
923
924 if (h->type == htype_received) received_count++;
925
d81d33cf
JH
926 if (header_list) header_last->next = h;
927 else header_list = h;
059ec3d9
PH
928 header_last = h;
929
930 for (i = 0; i < n; i++)
931 {
8768d548 932 int c = fgetc(fp);
059ec3d9
PH
933 if (c == 0 || c == EOF) goto SPOOL_FORMAT_ERROR;
934 if (c == '\n' && h->type != htype_old) message_linecount++;
935 h->text[i] = c;
936 }
937 h->text[i] = 0;
938 }
939
940 /* Not requiring header data, just skip through the bytes */
941
942 else for (i = 0; i < n; i++)
943 {
8768d548 944 int c = fgetc(fp);
059ec3d9
PH
945 if (c == 0 || c == EOF) goto SPOOL_FORMAT_ERROR;
946 }
947 }
948
949/* We have successfully read the data in the header file. Update the message
950line count by adding the body linecount to the header linecount. Close the file
951and give a positive response. */
952
953#ifndef COMPILE_UTILITY
954DEBUG(D_deliver) debug_printf("body_linecount=%d message_linecount=%d\n",
955 body_linecount, message_linecount);
956#endif /* COMPILE_UTILITY */
957
958message_linecount += body_linecount;
959
8768d548 960fclose(fp);
059ec3d9
PH
961return spool_read_OK;
962
963
964/* There was an error reading the spool or there was missing data,
965or there was a format error. A "read error" with no errno means an
966unexpected EOF, which we treat as a format error. */
967
968SPOOL_READ_ERROR:
969if (errno != 0)
970 {
971 n = errno;
972
e91ad4a7 973#ifndef COMPILE_UTILITY
059ec3d9 974 DEBUG(D_any) debug_printf("Error while reading spool file %s\n", name);
e91ad4a7 975#endif /* COMPILE_UTILITY */
059ec3d9 976
8768d548 977 fclose(fp);
059ec3d9 978 errno = n;
d81d33cf 979 return inheader ? spool_read_hdrerror : spool_read_enverror;
059ec3d9
PH
980 }
981
982SPOOL_FORMAT_ERROR:
983
984#ifndef COMPILE_UTILITY
985DEBUG(D_any) debug_printf("Format error in spool file %s\n", name);
986#endif /* COMPILE_UTILITY */
987
8768d548 988fclose(fp);
059ec3d9
PH
989errno = ERRNO_SPOOLFORMAT;
990return inheader? spool_read_hdrerror : spool_read_enverror;
991}
992
9d1c15ef
JH
993/* vi: aw ai sw=2
994*/
059ec3d9 995/* End of spool_in.c */