Fix mariadb/mysql macro confusion
[exim.git] / src / src / transports / pipe.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8
9#include "../exim.h"
10#include "pipe.h"
11
79378e0f 12#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
13#include <login_cap.h>
14#endif
15
0756eb3c
PH
16
17
18/* Options specific to the pipe transport. They must be in alphabetic
19order (note that "_" comes before the lower case letters). Those starting
20with "*" are not settable by the user but are used by the option-reading
21software for alternative value types. Some options are stored in the transport
22instance block so as to be publicly visible; these are flagged with opt_public.
23*/
24
25optionlist pipe_transport_options[] = {
26 { "allow_commands", opt_stringptr,
27 (void *)offsetof(pipe_transport_options_block, allow_commands) },
28 { "batch_id", opt_stringptr | opt_public,
29 (void *)offsetof(transport_instance, batch_id) },
30 { "batch_max", opt_int | opt_public,
31 (void *)offsetof(transport_instance, batch_max) },
32 { "check_string", opt_stringptr,
33 (void *)offsetof(pipe_transport_options_block, check_string) },
34 { "command", opt_stringptr,
35 (void *)offsetof(pipe_transport_options_block, cmd) },
36 { "environment", opt_stringptr,
37 (void *)offsetof(pipe_transport_options_block, environment) },
38 { "escape_string", opt_stringptr,
39 (void *)offsetof(pipe_transport_options_block, escape_string) },
09792322
NK
40 { "force_command", opt_bool,
41 (void *)offsetof(pipe_transport_options_block, force_command) },
0756eb3c
PH
42 { "freeze_exec_fail", opt_bool,
43 (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
2fe76745
PP
44 { "freeze_signal", opt_bool,
45 (void *)offsetof(pipe_transport_options_block, freeze_signal) },
0756eb3c
PH
46 { "ignore_status", opt_bool,
47 (void *)offsetof(pipe_transport_options_block, ignore_status) },
48 { "log_defer_output", opt_bool | opt_public,
49 (void *)offsetof(transport_instance, log_defer_output) },
50 { "log_fail_output", opt_bool | opt_public,
51 (void *)offsetof(transport_instance, log_fail_output) },
52 { "log_output", opt_bool | opt_public,
53 (void *)offsetof(transport_instance, log_output) },
54 { "max_output", opt_mkint,
55 (void *)offsetof(pipe_transport_options_block, max_output) },
56 { "message_prefix", opt_stringptr,
57 (void *)offsetof(pipe_transport_options_block, message_prefix) },
58 { "message_suffix", opt_stringptr,
59 (void *)offsetof(pipe_transport_options_block, message_suffix) },
60 { "path", opt_stringptr,
61 (void *)offsetof(pipe_transport_options_block, path) },
a29e5231
PP
62 { "permit_coredump", opt_bool,
63 (void *)offsetof(pipe_transport_options_block, permit_coredump) },
0756eb3c
PH
64 { "pipe_as_creator", opt_bool | opt_public,
65 (void *)offsetof(transport_instance, deliver_as_creator) },
66 { "restrict_to_path", opt_bool,
67 (void *)offsetof(pipe_transport_options_block, restrict_to_path) },
68 { "return_fail_output",opt_bool | opt_public,
69 (void *)offsetof(transport_instance, return_fail_output) },
70 { "return_output", opt_bool | opt_public,
71 (void *)offsetof(transport_instance, return_output) },
72 { "temp_errors", opt_stringptr,
73 (void *)offsetof(pipe_transport_options_block, temp_errors) },
74 { "timeout", opt_time,
75 (void *)offsetof(pipe_transport_options_block, timeout) },
2e2a30b4
PH
76 { "timeout_defer", opt_bool,
77 (void *)offsetof(pipe_transport_options_block, timeout_defer) },
0756eb3c
PH
78 { "umask", opt_octint,
79 (void *)offsetof(pipe_transport_options_block, umask) },
80 { "use_bsmtp", opt_bool,
81 (void *)offsetof(pipe_transport_options_block, use_bsmtp) },
79378e0f 82 #ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
83 { "use_classresources", opt_bool,
84 (void *)offsetof(pipe_transport_options_block, use_classresources) },
85 #endif
0756eb3c
PH
86 { "use_crlf", opt_bool,
87 (void *)offsetof(pipe_transport_options_block, use_crlf) },
88 { "use_shell", opt_bool,
89 (void *)offsetof(pipe_transport_options_block, use_shell) },
90};
91
92/* Size of the options list. An extern variable has to be used so that its
93address can appear in the tables drtables.c. */
94
95int pipe_transport_options_count =
96 sizeof(pipe_transport_options)/sizeof(optionlist);
97
d185889f
JH
98
99#ifdef MACRO_PREDEF
100
101/* Dummy values */
102pipe_transport_options_block pipe_transport_option_defaults = {0};
103void pipe_transport_init(transport_instance *tblock) {}
104BOOL pipe_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
105
106#else /*!MACRO_PREDEF*/
107
108
0756eb3c
PH
109/* Default private options block for the pipe transport. */
110
111pipe_transport_options_block pipe_transport_option_defaults = {
112 NULL, /* cmd */
113 NULL, /* allow_commands */
114 NULL, /* environment */
cb741023 115 US"/bin:/usr/bin", /* path */
0756eb3c
PH
116 NULL, /* message_prefix (reset in init if not bsmtp) */
117 NULL, /* message_suffix (ditto) */
118 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
119 mac_expanded_string(EX_CANTCREAT),
120 NULL, /* check_string */
121 NULL, /* escape_string */
122 022, /* umask */
123 20480, /* max_output */
124 60*60, /* timeout */
125 0, /* options */
09792322 126 FALSE, /* force_command */
0756eb3c 127 FALSE, /* freeze_exec_fail */
2fe76745 128 FALSE, /* freeze_signal */
0756eb3c 129 FALSE, /* ignore_status */
a29e5231 130 FALSE, /* permit_coredump */
0756eb3c 131 FALSE, /* restrict_to_path */
2e2a30b4 132 FALSE, /* timeout_defer */
0756eb3c
PH
133 FALSE, /* use_shell */
134 FALSE, /* use_bsmtp */
929ba01c 135 FALSE, /* use_classresources */
0756eb3c
PH
136 FALSE /* use_crlf */
137};
138
139
140
141/*************************************************
929ba01c
PH
142* Setup entry point *
143*************************************************/
144
145/* Called for each delivery in the privileged state, just before the uid/gid
146are changed and the main entry point is called. In a system that supports the
147login_cap facilities, this function is used to set the class resource limits
a29e5231 148for the user. It may also re-enable coredumps.
929ba01c
PH
149
150Arguments:
151 tblock points to the transport instance
152 addrlist addresses about to be delivered (not used)
153 dummy not used (doesn't pass back data)
154 uid the uid that will be set (not used)
155 gid the gid that will be set (not used)
156 errmsg where to put an error message
157
158Returns: OK, FAIL, or DEFER
159*/
160
161static int
162pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
163 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
164{
165pipe_transport_options_block *ob =
166 (pipe_transport_options_block *)(tblock->options_block);
167
168addrlist = addrlist; /* Keep compiler happy */
169dummy = dummy;
170uid = uid;
171gid = gid;
172errmsg = errmsg;
173ob = ob;
174
79378e0f 175#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
176if (ob->use_classresources)
177 {
178 struct passwd *pw = getpwuid(uid);
179 if (pw != NULL)
180 {
181 login_cap_t *lc = login_getpwclass(pw);
182 if (lc != NULL)
183 {
184 setclassresources(lc);
185 login_close(lc);
186 }
187 }
188 }
189#endif
190
a29e5231
PP
191#ifdef RLIMIT_CORE
192if (ob->permit_coredump)
193 {
194 struct rlimit rl;
195 rl.rlim_cur = RLIM_INFINITY;
196 rl.rlim_max = RLIM_INFINITY;
197 if (setrlimit(RLIMIT_CORE, &rl) < 0)
198 {
199#ifdef SETRLIMIT_NOT_SUPPORTED
200 if (errno != ENOSYS && errno != ENOTSUP)
201#endif
202 log_write(0, LOG_MAIN,
762ca6f3 203 "delivery setrlimit(RLIMIT_CORE, RLIM_INFINITY) failed: %s",
a29e5231
PP
204 strerror(errno));
205 }
206 }
207#endif
208
929ba01c
PH
209return OK;
210}
211
212
213
214/*************************************************
0756eb3c
PH
215* Initialization entry point *
216*************************************************/
217
218/* Called for each instance, after its options have been read, to
219enable consistency checks to be done, or anything else that needs
220to be set up. */
221
222void
223pipe_transport_init(transport_instance *tblock)
224{
225pipe_transport_options_block *ob =
226 (pipe_transport_options_block *)(tblock->options_block);
227
929ba01c
PH
228/* Set up the setup entry point, to be called in the privileged state */
229
230tblock->setup = pipe_transport_setup;
231
0756eb3c
PH
232/* If pipe_as_creator is set, then uid/gid should not be set. */
233
234if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
235 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
236 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
237 "both pipe_as_creator and an explicit uid/gid are set for the %s "
238 "transport", tblock->name);
239
240/* If a fixed uid field is set, then a gid field must also be set. */
241
242if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
243 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
244 "user set without group for the %s transport", tblock->name);
245
246/* Temp_errors must consist only of digits and colons, but there can be
247spaces round the colons, so allow them too. */
248
249if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
250 {
251 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
252 if (ob->temp_errors[p] != 0)
253 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
254 "temp_errors must be a list of numbers or an asterisk for the %s "
255 "transport", tblock->name);
256 }
257
258/* Only one of return_output/return_fail_output or log_output/log_fail_output
259should be set. */
260
261if (tblock->return_output && tblock->return_fail_output)
262 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
263 "both return_output and return_fail_output set for %s transport",
264 tblock->name);
265
266if (tblock->log_output && tblock->log_fail_output)
267 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
268 "both log_output and log_fail_output set for the %s transport",
269 tblock->name);
270
271/* If batch SMTP is set, force the check and escape strings, and arrange that
272headers are also escaped. */
273
274if (ob->use_bsmtp)
275 {
276 ob->check_string = US".";
277 ob->escape_string = US"..";
278 ob->options |= topt_escape_headers;
279 }
280
281/* If not batch SMTP, and message_prefix or message_suffix are unset, insert
282default values for them. */
283
284else
285 {
286 if (ob->message_prefix == NULL) ob->message_prefix =
287 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
288 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
289 }
290
291/* The restrict_to_path and use_shell options are incompatible */
292
293if (ob->restrict_to_path && ob->use_shell)
294 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
295 "both restrict_to_path and use_shell set for %s transport",
296 tblock->name);
297
298/* The allow_commands and use_shell options are incompatible */
299
300if (ob->allow_commands && ob->use_shell)
301 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
302 "both allow_commands and use_shell set for %s transport",
303 tblock->name);
304
305/* Set up the bitwise options for transport_write_message from the various
306driver options. Only one of body_only and headers_only can be set. */
307
308ob->options |=
309 (tblock->body_only? topt_no_headers : 0) |
310 (tblock->headers_only? topt_no_body : 0) |
311 (tblock->return_path_add? topt_add_return_path : 0) |
312 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
313 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
314 (ob->use_crlf? topt_use_crlf : 0);
315}
316
317
318
319/*************************************************
320* Set up direct (non-shell) command *
321*************************************************/
322
323/* This function is called when a command line is to be parsed by the transport
324and executed directly, without the use of /bin/sh.
325
326Arguments:
327 argvptr pointer to anchor for argv vector
328 cmd points to the command string
329 expand_arguments true if expansion is to occur
330 expand_fail error if expansion fails
331 addr chain of addresses
332 tname the transport name
333 ob the transport options block
334
335Returns: TRUE if all went well; otherwise an error will be
336 set in the first address and FALSE returned
337*/
338
339static BOOL
55414b25
JH
340set_up_direct_command(const uschar ***argvptr, uschar *cmd,
341 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname,
0756eb3c
PH
342 pipe_transport_options_block *ob)
343{
344BOOL permitted = FALSE;
55414b25 345const uschar **argv;
0756eb3c
PH
346
347/* Set up "transport <name>" to be put in any error messages, and then
348call the common function for creating an argument list and expanding
349the items if necessary. If it fails, this function fails (error information
350is in the addresses). */
351
0756eb3c 352if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
7b283890 353 addr, string_sprintf("%.50s transport", tname), NULL))
0756eb3c
PH
354 return FALSE;
355
356/* Point to the set-up arguments. */
357
358argv = *argvptr;
359
360/* If allow_commands is set, see if the command is in the permitted list. */
361
7b283890 362if (ob->allow_commands)
0756eb3c
PH
363 {
364 int sep = 0;
55414b25
JH
365 const uschar *s;
366 uschar *p;
0756eb3c 367
55414b25 368 if (!(s = expand_string(ob->allow_commands)))
0756eb3c
PH
369 {
370 addr->transport_return = DEFER;
371 addr->message = string_sprintf("failed to expand string \"%s\" "
372 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
373 return FALSE;
374 }
375
7b283890 376 while ((p = string_nextinlist(&s, &sep, NULL, 0)))
0756eb3c 377 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
0756eb3c
PH
378 }
379
380/* If permitted is TRUE it means the command was found in the allowed list, and
381no further checks are done. If permitted = FALSE, it either means
382allow_commands wasn't set, or that the command didn't match anything in the
383list. In both cases, if restrict_to_path is set, we fail if the command
384contains any slashes, but if restrict_to_path is not set, we must fail the
385command only if allow_commands is set. */
386
387if (!permitted)
388 {
389 if (ob->restrict_to_path)
390 {
391 if (Ustrchr(argv[0], '/') != NULL)
392 {
393 addr->transport_return = FAIL;
394 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
395 "transport) - failed for security reasons", cmd, tname);
396 return FALSE;
397 }
398 }
399
7b283890 400 else if (ob->allow_commands)
0756eb3c
PH
401 {
402 addr->transport_return = FAIL;
403 addr->message = string_sprintf("\"%s\" command not permitted by %s "
404 "transport", argv[0], tname);
405 return FALSE;
406 }
407 }
408
409/* If the command is not an absolute path, search the PATH directories
410for it. */
411
412if (argv[0][0] != '/')
413 {
414 int sep = 0;
415 uschar *p;
7b283890 416 const uschar *listptr = expand_string(ob->path);
0756eb3c 417
7b283890 418 while ((p = string_nextinlist(&listptr, &sep, NULL, 0)))
0756eb3c
PH
419 {
420 struct stat statbuf;
421 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
422 if (Ustat(big_buffer, &statbuf) == 0)
423 {
424 argv[0] = string_copy(big_buffer);
425 break;
426 }
427 }
7b283890 428 if (!p)
0756eb3c
PH
429 {
430 addr->transport_return = FAIL;
431 addr->message = string_sprintf("\"%s\" command not found for %s transport",
432 argv[0], tname);
433 return FALSE;
434 }
435 }
436
437return TRUE;
438}
439
440
441/*************************************************
442* Set up shell command *
443*************************************************/
444
445/* This function is called when a command line is to be passed to /bin/sh
446without parsing inside the transport.
447
448Arguments:
449 argvptr pointer to anchor for argv vector
450 cmd points to the command string
451 expand_arguments true if expansion is to occur
452 expand_fail error if expansion fails
453 addr chain of addresses
454 tname the transport name
455
456Returns: TRUE if all went well; otherwise an error will be
457 set in the first address and FALSE returned
458*/
459
460static BOOL
55414b25
JH
461set_up_shell_command(const uschar ***argvptr, uschar *cmd,
462 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname)
0756eb3c 463{
55414b25 464const uschar **argv;
0756eb3c
PH
465
466*argvptr = argv = store_get((4)*sizeof(uschar *));
467
468argv[0] = US"/bin/sh";
469argv[1] = US"-c";
470
471/* We have to take special action to handle the special "variable" called
472$pipe_addresses, which is not recognized by the normal expansion function. */
473
474DEBUG(D_transport)
475 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
476
477if (expand_arguments)
478 {
479 uschar *s = cmd;
480 uschar *p = Ustrstr(cmd, "pipe_addresses");
481
482 if (p != NULL && (
483 (p > cmd && p[-1] == '$') ||
484 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
485 {
486 address_item *ad;
487 uschar *q = p + 14;
488 int size = Ustrlen(cmd) + 64;
489 int offset;
490
491 if (p[-1] == '{') { q++; p--; }
492
493 s = store_get(size);
494 offset = p - cmd - 1;
495 Ustrncpy(s, cmd, offset);
496
497 for (ad = addr; ad != NULL; ad = ad->next)
498 {
a5bdc7ee
JH
499 /*XXX string_append_listele() ? */
500 if (ad != addr) s = string_catn(s, &size, &offset, US" ", 1);
501 s = string_cat(s, &size, &offset, ad->address);
0756eb3c
PH
502 }
503
a5bdc7ee 504 s = string_cat(s, &size, &offset, q);
0756eb3c
PH
505 s[offset] = 0;
506 }
507
508 /* Allow $recipients in the expansion iff it comes from a system filter */
509
510 enable_dollar_recipients = addr != NULL &&
511 addr->parent != NULL &&
512 Ustrcmp(addr->parent->address, "system-filter") == 0;
513 argv[2] = expand_string(s);
514 enable_dollar_recipients = FALSE;
515
516 if (argv[2] == NULL)
517 {
518 addr->transport_return = search_find_defer? DEFER : expand_fail;
519 addr->message = string_sprintf("Expansion of command \"%s\" "
520 "in %s transport failed: %s",
521 cmd, tname, expand_string_message);
522 return FALSE;
523 }
524
525 DEBUG(D_transport)
526 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
527 }
528else argv[2] = cmd;
529
5903c6ff 530argv[3] = US 0;
0756eb3c
PH
531return TRUE;
532}
533
534
535
536
537/*************************************************
538* Main entry point *
539*************************************************/
540
541/* See local README for interface details. This transport always returns FALSE,
542indicating that the status in the first address is the status for all addresses
543in a batch. */
544
545BOOL
546pipe_transport_entry(
547 transport_instance *tblock, /* data for this instantiation */
548 address_item *addr) /* address(es) we are working on */
549{
550pid_t pid, outpid;
551int fd_in, fd_out, rc;
552int envcount = 0;
553int envsep = 0;
554int expand_fail;
555pipe_transport_options_block *ob =
556 (pipe_transport_options_block *)(tblock->options_block);
557int timeout = ob->timeout;
558BOOL written_ok = FALSE;
559BOOL expand_arguments;
55414b25 560const uschar **argv;
0756eb3c 561uschar *envp[50];
55414b25 562const uschar *envlist = ob->environment;
0756eb3c 563uschar *cmd, *ss;
6d5c916c 564uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
65de12cc 565transport_ctx tctx = {
cab0c277 566 {0},
65de12cc
JH
567 tblock,
568 addr,
569 ob->check_string,
570 ob->escape_string,
571 ob->options /* set at initialization time */
572};
0756eb3c
PH
573
574DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
575
576/* Set up for the good case */
577
578addr->transport_return = OK;
579addr->basic_errno = 0;
580
581/* Pipes are not accepted as general addresses, but they can be generated from
582.forward files or alias files. In those cases, the pfr flag is set, and the
583command to be obeyed is pointed to by addr->local_part; it starts with the pipe
584symbol. In other cases, the command is supplied as one of the pipe transport's
585options. */
586
587if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
588 {
700d22f3
PP
589 if (ob->force_command)
590 {
4c04137d 591 /* Enables expansion of $address_pipe into separate arguments */
700d22f3
PP
592 setflag(addr, af_force_command);
593 cmd = ob->cmd;
594 expand_arguments = TRUE;
595 expand_fail = PANIC;
596 }
597 else
598 {
599 cmd = addr->local_part + 1;
600 while (isspace(*cmd)) cmd++;
601 expand_arguments = testflag(addr, af_expand_pipe);
602 expand_fail = FAIL;
09792322 603 }
0756eb3c
PH
604 }
605else
606 {
607 cmd = ob->cmd;
608 expand_arguments = TRUE;
609 expand_fail = PANIC;
610 }
611
09792322
NK
612/* If no command has been supplied, we are in trouble.
613 * We also check for an empty string since it may be
614 * coming from addr->local_part[0] == '|'
615 */
0756eb3c 616
09792322 617if (cmd == NULL || *cmd == '\0')
0756eb3c
PH
618 {
619 addr->transport_return = DEFER;
620 addr->message = string_sprintf("no command specified for %s transport",
621 tblock->name);
622 return FALSE;
623 }
624
625/* When a pipe is set up by a filter file, there may be values for $thisaddress
626and numerical the variables in existence. These are passed in
627addr->pipe_expandn for use here. */
628
7b283890 629if (expand_arguments && addr->pipe_expandn)
0756eb3c
PH
630 {
631 uschar **ss = addr->pipe_expandn;
632 expand_nmax = -1;
633 if (*ss != NULL) filter_thisaddress = *ss++;
634 while (*ss != NULL)
635 {
636 expand_nstring[++expand_nmax] = *ss;
637 expand_nlength[expand_nmax] = Ustrlen(*ss++);
638 }
639 }
640
641/* The default way of processing the command is to split it up into arguments
642here, and run it directly. This offers some security advantages. However, there
643are installations that want by default to run commands under /bin/sh always, so
644there is an option to do that. */
645
646if (ob->use_shell)
647 {
648 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
649 tblock->name)) return FALSE;
650 }
651else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
652 tblock->name, ob)) return FALSE;
653
654expand_nmax = -1; /* Reset */
655filter_thisaddress = NULL;
656
657/* Set up the environment for the command. */
658
659envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
660envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
661envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
662envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
663 deliver_localpart_prefix);
664envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
665 deliver_localpart_suffix);
666envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
667envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
668envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
7b283890 669envp[envcount++] = string_sprintf("PATH=%s", expand_string(ob->path));
0756eb3c
PH
670envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
671 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
672 deliver_domain);
673envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
674envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
675envp[envcount++] = US"SHELL=/bin/sh";
676
677if (addr->host_list != NULL)
678 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
679
680if (timestamps_utc) envp[envcount++] = US"TZ=UTC";
681else if (timezone_string != NULL && timezone_string[0] != 0)
682 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
683
684/* Add any requested items */
685
55414b25 686if (envlist)
0756eb3c 687 {
55414b25 688 envlist = expand_cstring(envlist);
0756eb3c
PH
689 if (envlist == NULL)
690 {
691 addr->transport_return = DEFER;
692 addr->message = string_sprintf("failed to expand string \"%s\" "
693 "for %s transport: %s", ob->environment, tblock->name,
694 expand_string_message);
695 return FALSE;
696 }
697 }
698
5903c6ff 699while ((ss = string_nextinlist(&envlist, &envsep, big_buffer, big_buffer_size)))
0756eb3c 700 {
5903c6ff 701 if (envcount > nelem(envp) - 2)
0756eb3c
PH
702 {
703 addr->transport_return = DEFER;
704 addr->message = string_sprintf("too many environment settings for "
705 "%s transport", tblock->name);
706 return FALSE;
707 }
708 envp[envcount++] = string_copy(ss);
709 }
710
711envp[envcount] = NULL;
712
713/* If the -N option is set, can't do any more. */
714
715if (dont_deliver)
716 {
717 DEBUG(D_transport)
718 debug_printf("*** delivery by %s transport bypassed by -N option",
719 tblock->name);
720 return FALSE;
721 }
722
723
724/* Handling the output from the pipe is tricky. If a file for catching this
725output is provided, we could in theory just hand that fd over to the process,
726but this isn't very safe because it might loop and carry on writing for
727ever (which is exactly what happened in early versions of Exim). Therefore we
728use the standard child_open() function, which creates pipes. We can then read
729our end of the output pipe and count the number of bytes that come through,
730chopping the sub-process if it exceeds some limit.
731
732However, this means we want to run a sub-process with both its input and output
733attached to pipes. We can't handle that easily from a single parent process
734using straightforward code such as the transport_write_message() function
735because the subprocess might not be reading its input because it is trying to
736write to a full output pipe. The complication of redesigning the world to
737handle this is too great - simpler just to run another process to do the
738reading of the output pipe. */
739
740
741/* As this is a local transport, we are already running with the required
742uid/gid and current directory. Request that the new process be a process group
743leader, so we can kill it and all its children on a timeout. */
744
55414b25 745if ((pid = child_open(USS argv, envp, ob->umask, &fd_in, &fd_out, TRUE)) < 0)
0756eb3c
PH
746 {
747 addr->transport_return = DEFER;
748 addr->message = string_sprintf(
749 "Failed to create child process for %s transport: %s", tblock->name,
750 strerror(errno));
751 return FALSE;
752 }
42055a33 753tctx.u.fd = fd_in;
0756eb3c
PH
754
755/* Now fork a process to handle the output that comes down the pipe. */
756
757if ((outpid = fork()) < 0)
758 {
759 addr->basic_errno = errno;
760 addr->transport_return = DEFER;
761 addr->message = string_sprintf(
762 "Failed to create process for handling output in %s transport",
763 tblock->name);
f1e894f3
PH
764 (void)close(fd_in);
765 (void)close(fd_out);
0756eb3c
PH
766 return FALSE;
767 }
768
769/* This is the code for the output-handling subprocess. Read from the pipe
770in chunks, and write to the return file if one is provided. Keep track of
771the number of bytes handled. If the limit is exceeded, try to kill the
772subprocess group, and in any case close the pipe and exit, which should cause
773the subprocess to fail. */
774
775if (outpid == 0)
776 {
777 int count = 0;
f1e894f3 778 (void)close(fd_in);
0756eb3c
PH
779 set_process_info("reading output from |%s", cmd);
780 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
781 {
782 if (addr->return_file >= 0)
1ac6b2e7
JH
783 if(write(addr->return_file, big_buffer, rc) != rc)
784 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
0756eb3c
PH
785 count += rc;
786 if (count > ob->max_output)
787 {
0756eb3c
PH
788 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
789 if (addr->return_file >= 0)
1ac6b2e7
JH
790 {
791 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
792 rc = Ustrlen(message);
793 if(write(addr->return_file, message, rc) != rc)
794 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
795 }
0756eb3c
PH
796 killpg(pid, SIGKILL);
797 break;
798 }
799 }
f1e894f3 800 (void)close(fd_out);
0756eb3c
PH
801 _exit(0);
802 }
803
f1e894f3 804(void)close(fd_out); /* Not used in this process */
0756eb3c
PH
805
806
807/* Carrying on now with the main parent process. Attempt to write the message
808to it down the pipe. It is a fallacy to think that you can detect write errors
809when the sub-process fails to read the pipe. The parent process may complete
810writing and close the pipe before the sub-process completes. We could sleep a
811bit here to let the sub-process get going, but it may still not complete. So we
812ignore all writing errors. (When in the test harness, we do do a short sleep so
813any debugging output is likely to be in the same order.) */
814
815if (running_in_test_harness) millisleep(500);
816
817DEBUG(D_transport) debug_printf("Writing message to pipe\n");
818
819/* Arrange to time out writes if there is a timeout set. */
820
821if (timeout > 0)
822 {
823 sigalrm_seen = FALSE;
824 transport_write_timeout = timeout;
825 }
826
827/* Reset the counter of bytes written */
828
829transport_count = 0;
830
831/* First write any configured prefix information */
832
833if (ob->message_prefix != NULL)
834 {
835 uschar *prefix = expand_string(ob->message_prefix);
836 if (prefix == NULL)
837 {
838 addr->transport_return = search_find_defer? DEFER : PANIC;
839 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
840 "transport) failed: %s", ob->message_prefix, tblock->name,
841 expand_string_message);
842 return FALSE;
843 }
42055a33 844 if (!transport_write_block(&tctx, prefix, Ustrlen(prefix), FALSE))
0756eb3c
PH
845 goto END_WRITE;
846 }
847
848/* If the use_bsmtp option is set, we need to write SMTP prefix information.
849The various different values for batching are handled outside; if there is more
850than one address available here, all must be included. Force SMTP dot-handling.
851*/
852
853if (ob->use_bsmtp)
854 {
855 address_item *a;
856
857 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
858 goto END_WRITE;
859
65de12cc 860 for (a = addr; a; a = a->next)
0756eb3c
PH
861 if (!transport_write_string(fd_in,
862 "RCPT TO:<%s>%s",
863 transport_rcpt_address(a, tblock->rcpt_include_affixes),
864 eol))
865 goto END_WRITE;
0756eb3c
PH
866
867 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
868 }
869
65de12cc 870/* Now the actual message */
0756eb3c 871
42055a33 872if (!transport_write_message(&tctx, 0))
0756eb3c
PH
873 goto END_WRITE;
874
875/* Now any configured suffix */
876
7b283890 877if (ob->message_suffix)
0756eb3c
PH
878 {
879 uschar *suffix = expand_string(ob->message_suffix);
7b283890 880 if (!suffix)
0756eb3c
PH
881 {
882 addr->transport_return = search_find_defer? DEFER : PANIC;
883 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
884 "transport) failed: %s", ob->message_suffix, tblock->name,
885 expand_string_message);
886 return FALSE;
887 }
42055a33 888 if (!transport_write_block(&tctx, suffix, Ustrlen(suffix), FALSE))
0756eb3c
PH
889 goto END_WRITE;
890 }
891
892/* If local_smtp, write the terminating dot. */
893
894if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
895 goto END_WRITE;
896
897/* Flag all writing completed successfully. */
898
899written_ok = TRUE;
900
901/* Come here if there are errors during writing. */
902
903END_WRITE:
904
905/* OK, the writing is now all done. Close the pipe. */
906
907(void) close(fd_in);
908
909/* Handle errors during writing. For timeouts, set the timeout for waiting for
910the child process to 1 second. If the process at the far end of the pipe died
911without reading all of it, we expect an EPIPE error, which should be ignored.
912We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
913at handling OS where the death of a pipe doesn't give EPIPE immediately. See
2e2a30b4 914comments therein. */
0756eb3c
PH
915
916if (!written_ok)
917 {
918 if (errno == ETIMEDOUT)
2e2a30b4
PH
919 {
920 addr->message = string_sprintf("%stimeout while writing to pipe",
921 transport_filter_timed_out? "transport filter " : "");
922 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
0756eb3c 923 timeout = 1;
2e2a30b4
PH
924 }
925 else if (errno == EPIPE)
0756eb3c 926 {
2e2a30b4 927 debug_printf("transport error EPIPE ignored\n");
0756eb3c
PH
928 }
929 else
930 {
8e669ac1 931 addr->transport_return = PANIC;
0756eb3c
PH
932 addr->basic_errno = errno;
933 if (errno == ERRNO_CHHEADER_FAIL)
934 addr->message =
935 string_sprintf("Failed to expand headers_add or headers_remove: %s",
936 expand_string_message);
937 else if (errno == ERRNO_FILTER_FAIL)
35af9f61
PH
938 addr->message = string_sprintf("Transport filter process failed (%d)%s",
939 addr->more_errno,
940 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
0756eb3c
PH
941 else if (errno == ERRNO_WRITEINCOMPLETE)
942 addr->message = string_sprintf("Failed repeatedly to write data");
943 else
944 addr->message = string_sprintf("Error %d", errno);
945 return FALSE;
946 }
947 }
948
949/* Wait for the child process to complete and take action if the returned
950status is nonzero. The timeout will be just 1 second if any of the writes
951above timed out. */
952
953if ((rc = child_close(pid, timeout)) != 0)
954 {
22c3b60b
PH
955 uschar *tmsg = (addr->message == NULL)? US"" :
956 string_sprintf(" (preceded by %s)", addr->message);
957
0756eb3c
PH
958 /* The process did not complete in time; kill its process group and fail
959 the delivery. It appears to be necessary to kill the output process too, as
960 otherwise it hangs on for some time if the actual pipe process is sleeping.
961 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
962 the delivery, that shouldn't cause any problem. */
963
964 if (rc == -256)
965 {
966 killpg(pid, SIGKILL);
967 kill(outpid, SIGKILL);
2e2a30b4 968 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
22c3b60b 969 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
0756eb3c
PH
970 }
971
972 /* Wait() failed. */
973
974 else if (rc == -257)
975 {
976 addr->transport_return = PANIC;
977 addr->message = string_sprintf("Wait() failed for child process of %s "
22c3b60b 978 "transport: %s%s", tblock->name, strerror(errno), tmsg);
0756eb3c
PH
979 }
980
52383f8f
NM
981 /* Since the transport_filter timed out we assume it has sent the child process
982 a malformed or incomplete data stream. Kill off the child process
983 and prevent checking its exit status as it will has probably exited in error.
984 This prevents the transport_filter timeout message from getting overwritten
985 by the exit error which is not the cause of the problem. */
986
987 else if (transport_filter_timed_out)
988 {
989 killpg(pid, SIGKILL);
990 kill(outpid, SIGKILL);
991 }
992
0756eb3c
PH
993 /* Either the process completed, but yielded a non-zero (necessarily
994 positive) status, or the process was terminated by a signal (rc will contain
995 the negation of the signal number). Treat killing by signal as failure unless
2fe76745
PP
996 status is being ignored. By default, the message is bounced back, unless
997 freeze_signal is set, in which case it is frozen instead. */
0756eb3c
PH
998
999 else if (rc < 0)
1000 {
2fe76745
PP
1001 if (ob->freeze_signal)
1002 {
1003 addr->transport_return = DEFER;
1004 addr->special_action = SPECIAL_FREEZE;
1005 addr->message = string_sprintf("Child process of %s transport (running "
1006 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1007 -rc, os_strsignal(-rc), tmsg);
1008 }
1009 else if (!ob->ignore_status)
0756eb3c
PH
1010 {
1011 addr->transport_return = FAIL;
1012 addr->message = string_sprintf("Child process of %s transport (running "
22c3b60b
PH
1013 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1014 -rc, os_strsignal(-rc), tmsg);
0756eb3c
PH
1015 }
1016 }
1017
1018 /* For positive values (process terminated with non-zero status), we need a
1019 status code to request deferral. A number of systems contain the following
1020 line in sysexits.h:
1021
1022 #define EX_TEMPFAIL 75
1023
1024 with the description
1025
1026 EX_TEMPFAIL -- temporary failure, indicating something that
1027 is not really an error. In sendmail, this means
1028 that a mailer (e.g.) could not create a connection,
1029 and the request should be reattempted later.
1030
1031 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
1032 not ignoring the returned status. However, there is now an option that
1033 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
1034
1035 Another case that needs special treatment is if execve() failed (typically
1036 the command that was given is a non-existent path). By default this is
1037 treated as just another failure, but if freeze_exec_fail is set, the reaction
1038 is to freeze the message rather than bounce the address. Exim used to signal
4c04137d 1039 this failure with EX_UNAVAILABLE, which is defined in many systems as
0756eb3c
PH
1040
1041 #define EX_UNAVAILABLE 69
1042
1043 with the description
1044
1045 EX_UNAVAILABLE -- A service is unavailable. This can occur
1046 if a support program or file does not exist. This
1047 can also be used as a catchall message when something
1048 you wanted to do doesn't work, but you don't know why.
1049
1050 However, this can be confused with a command that actually returns 69 because
1051 something *it* wanted is unavailable. At release 4.21, Exim was changed to
1052 use return code 127 instead, because this is what the shell returns when it
1053 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
1054 child.c to signal execve() failure and other unexpected failures such as
1055 setuid() not working - though that won't be the case here because we aren't
1056 changing uid. */
1057
1058 else
1059 {
1060 /* Always handle execve() failure specially if requested to */
1061
1062 if (ob->freeze_exec_fail && (rc == EX_EXECFAILED))
1063 {
1064 addr->transport_return = DEFER;
1065 addr->special_action = SPECIAL_FREEZE;
22c3b60b
PH
1066 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
1067 cmd, tmsg);
0756eb3c
PH
1068 }
1069
1070 /* Otherwise take action only if not ignoring status */
1071
1072 else if (!ob->ignore_status)
1073 {
1074 uschar *ss;
1075 int size, ptr, i;
1076
4c04137d 1077 /* If temp_errors is "*" all codes are temporary. Initialization checks
0756eb3c
PH
1078 that it's either "*" or a list of numbers. If not "*", scan the list of
1079 temporary failure codes; if any match, the result is DEFER. */
1080
1081 if (ob->temp_errors[0] == '*')
1082 addr->transport_return = DEFER;
1083
1084 else
1085 {
55414b25 1086 const uschar *s = ob->temp_errors;
0756eb3c 1087 uschar *p;
0756eb3c
PH
1088 int sep = 0;
1089
1090 addr->transport_return = FAIL;
7b283890 1091 while ((p = string_nextinlist(&s,&sep,NULL,0)))
0756eb3c 1092 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
0756eb3c
PH
1093 }
1094
1095 /* Ensure the message contains the expanded command and arguments. This
1096 doesn't have to be brilliantly efficient - it is an error situation. */
1097
1098 addr->message = string_sprintf("Child process of %s transport returned "
1099 "%d", tblock->name, rc);
1100
1101 ptr = Ustrlen(addr->message);
1102 size = ptr + 1;
1103
1104 /* If the return code is > 128, it often means that a shell command
1105 was terminated by a signal. */
1106
1107 ss = (rc > 128)?
1108 string_sprintf("(could mean shell command ended by signal %d (%s))",
1109 rc-128, os_strsignal(rc-128)) :
1110 US os_strexit(rc);
1111
1112 if (*ss != 0)
1113 {
c2f669a4
JH
1114 addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
1115 addr->message = string_cat (addr->message, &size, &ptr, ss);
0756eb3c
PH
1116 }
1117
1118 /* Now add the command and arguments */
1119
c2f669a4 1120 addr->message = string_catn(addr->message, &size, &ptr,
0756eb3c
PH
1121 US" from command:", 14);
1122
1123 for (i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1124 {
1125 BOOL quote = FALSE;
c2f669a4 1126 addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
0756eb3c
PH
1127 if (Ustrpbrk(argv[i], " \t") != NULL)
1128 {
1129 quote = TRUE;
c2f669a4 1130 addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
0756eb3c 1131 }
c2f669a4 1132 addr->message = string_cat(addr->message, &size, &ptr, argv[i]);
0756eb3c 1133 if (quote)
c2f669a4 1134 addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
0756eb3c 1135 }
22c3b60b
PH
1136
1137 /* Add previous filter timeout message, if present. */
1138
c2f669a4
JH
1139 if (*tmsg)
1140 addr->message = string_cat(addr->message, &size, &ptr, tmsg);
22c3b60b 1141
0756eb3c
PH
1142 addr->message[ptr] = 0; /* Ensure concatenated string terminated */
1143 }
1144 }
1145 }
1146
1147/* Ensure all subprocesses (in particular, the output handling process)
1148are complete before we pass this point. */
1149
1150while (wait(&rc) >= 0);
1151
1152DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1153 addr->transport_return);
1154
1155/* If there has been a problem, the message in addr->message contains details
1156of the pipe command. We don't want to expose these to the world, so we set up
1157something bland to return to the sender. */
1158
1159if (addr->transport_return != OK)
1160 addr->user_message = US"local delivery failed";
1161
1162return FALSE;
1163}
1164
d185889f 1165#endif /*!MACRO_PREDEF*/
0756eb3c 1166/* End of transport/pipe.c */