Documentation ownership tweaks
[exim.git] / src / src / transports / pipe.c
CommitLineData
184e8823 1/* $Cambridge: exim/src/src/transports/pipe.c,v 1.12 2007/01/08 10:50:20 ph10 Exp $ */
0756eb3c
PH
2
3/*************************************************
4* Exim - an Internet mail transport agent *
5*************************************************/
6
184e8823 7/* Copyright (c) University of Cambridge 1995 - 2007 */
0756eb3c
PH
8/* See the file NOTICE for conditions of use and distribution. */
9
10
11#include "../exim.h"
12#include "pipe.h"
13
79378e0f 14#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
15#include <login_cap.h>
16#endif
17
0756eb3c
PH
18
19
20/* Options specific to the pipe transport. They must be in alphabetic
21order (note that "_" comes before the lower case letters). Those starting
22with "*" are not settable by the user but are used by the option-reading
23software for alternative value types. Some options are stored in the transport
24instance block so as to be publicly visible; these are flagged with opt_public.
25*/
26
27optionlist pipe_transport_options[] = {
28 { "allow_commands", opt_stringptr,
29 (void *)offsetof(pipe_transport_options_block, allow_commands) },
30 { "batch_id", opt_stringptr | opt_public,
31 (void *)offsetof(transport_instance, batch_id) },
32 { "batch_max", opt_int | opt_public,
33 (void *)offsetof(transport_instance, batch_max) },
34 { "check_string", opt_stringptr,
35 (void *)offsetof(pipe_transport_options_block, check_string) },
36 { "command", opt_stringptr,
37 (void *)offsetof(pipe_transport_options_block, cmd) },
38 { "environment", opt_stringptr,
39 (void *)offsetof(pipe_transport_options_block, environment) },
40 { "escape_string", opt_stringptr,
41 (void *)offsetof(pipe_transport_options_block, escape_string) },
42 { "freeze_exec_fail", opt_bool,
43 (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
44 { "ignore_status", opt_bool,
45 (void *)offsetof(pipe_transport_options_block, ignore_status) },
46 { "log_defer_output", opt_bool | opt_public,
47 (void *)offsetof(transport_instance, log_defer_output) },
48 { "log_fail_output", opt_bool | opt_public,
49 (void *)offsetof(transport_instance, log_fail_output) },
50 { "log_output", opt_bool | opt_public,
51 (void *)offsetof(transport_instance, log_output) },
52 { "max_output", opt_mkint,
53 (void *)offsetof(pipe_transport_options_block, max_output) },
54 { "message_prefix", opt_stringptr,
55 (void *)offsetof(pipe_transport_options_block, message_prefix) },
56 { "message_suffix", opt_stringptr,
57 (void *)offsetof(pipe_transport_options_block, message_suffix) },
58 { "path", opt_stringptr,
59 (void *)offsetof(pipe_transport_options_block, path) },
60 { "pipe_as_creator", opt_bool | opt_public,
61 (void *)offsetof(transport_instance, deliver_as_creator) },
62 { "restrict_to_path", opt_bool,
63 (void *)offsetof(pipe_transport_options_block, restrict_to_path) },
64 { "return_fail_output",opt_bool | opt_public,
65 (void *)offsetof(transport_instance, return_fail_output) },
66 { "return_output", opt_bool | opt_public,
67 (void *)offsetof(transport_instance, return_output) },
68 { "temp_errors", opt_stringptr,
69 (void *)offsetof(pipe_transport_options_block, temp_errors) },
70 { "timeout", opt_time,
71 (void *)offsetof(pipe_transport_options_block, timeout) },
2e2a30b4
PH
72 { "timeout_defer", opt_bool,
73 (void *)offsetof(pipe_transport_options_block, timeout_defer) },
0756eb3c
PH
74 { "umask", opt_octint,
75 (void *)offsetof(pipe_transport_options_block, umask) },
76 { "use_bsmtp", opt_bool,
77 (void *)offsetof(pipe_transport_options_block, use_bsmtp) },
79378e0f 78 #ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
79 { "use_classresources", opt_bool,
80 (void *)offsetof(pipe_transport_options_block, use_classresources) },
81 #endif
0756eb3c
PH
82 { "use_crlf", opt_bool,
83 (void *)offsetof(pipe_transport_options_block, use_crlf) },
84 { "use_shell", opt_bool,
85 (void *)offsetof(pipe_transport_options_block, use_shell) },
86};
87
88/* Size of the options list. An extern variable has to be used so that its
89address can appear in the tables drtables.c. */
90
91int pipe_transport_options_count =
92 sizeof(pipe_transport_options)/sizeof(optionlist);
93
94/* Default private options block for the pipe transport. */
95
96pipe_transport_options_block pipe_transport_option_defaults = {
97 NULL, /* cmd */
98 NULL, /* allow_commands */
99 NULL, /* environment */
cb741023 100 US"/bin:/usr/bin", /* path */
0756eb3c
PH
101 NULL, /* message_prefix (reset in init if not bsmtp) */
102 NULL, /* message_suffix (ditto) */
103 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
104 mac_expanded_string(EX_CANTCREAT),
105 NULL, /* check_string */
106 NULL, /* escape_string */
107 022, /* umask */
108 20480, /* max_output */
109 60*60, /* timeout */
110 0, /* options */
111 FALSE, /* freeze_exec_fail */
112 FALSE, /* ignore_status */
113 FALSE, /* restrict_to_path */
2e2a30b4 114 FALSE, /* timeout_defer */
0756eb3c
PH
115 FALSE, /* use_shell */
116 FALSE, /* use_bsmtp */
929ba01c 117 FALSE, /* use_classresources */
0756eb3c
PH
118 FALSE /* use_crlf */
119};
120
121
122
123/*************************************************
929ba01c
PH
124* Setup entry point *
125*************************************************/
126
127/* Called for each delivery in the privileged state, just before the uid/gid
128are changed and the main entry point is called. In a system that supports the
129login_cap facilities, this function is used to set the class resource limits
130for the user.
131
132Arguments:
133 tblock points to the transport instance
134 addrlist addresses about to be delivered (not used)
135 dummy not used (doesn't pass back data)
136 uid the uid that will be set (not used)
137 gid the gid that will be set (not used)
138 errmsg where to put an error message
139
140Returns: OK, FAIL, or DEFER
141*/
142
143static int
144pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
145 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
146{
147pipe_transport_options_block *ob =
148 (pipe_transport_options_block *)(tblock->options_block);
149
150addrlist = addrlist; /* Keep compiler happy */
151dummy = dummy;
152uid = uid;
153gid = gid;
154errmsg = errmsg;
155ob = ob;
156
79378e0f 157#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
158if (ob->use_classresources)
159 {
160 struct passwd *pw = getpwuid(uid);
161 if (pw != NULL)
162 {
163 login_cap_t *lc = login_getpwclass(pw);
164 if (lc != NULL)
165 {
166 setclassresources(lc);
167 login_close(lc);
168 }
169 }
170 }
171#endif
172
173return OK;
174}
175
176
177
178/*************************************************
0756eb3c
PH
179* Initialization entry point *
180*************************************************/
181
182/* Called for each instance, after its options have been read, to
183enable consistency checks to be done, or anything else that needs
184to be set up. */
185
186void
187pipe_transport_init(transport_instance *tblock)
188{
189pipe_transport_options_block *ob =
190 (pipe_transport_options_block *)(tblock->options_block);
191
929ba01c
PH
192/* Set up the setup entry point, to be called in the privileged state */
193
194tblock->setup = pipe_transport_setup;
195
0756eb3c
PH
196/* If pipe_as_creator is set, then uid/gid should not be set. */
197
198if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
199 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
200 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
201 "both pipe_as_creator and an explicit uid/gid are set for the %s "
202 "transport", tblock->name);
203
204/* If a fixed uid field is set, then a gid field must also be set. */
205
206if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
207 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
208 "user set without group for the %s transport", tblock->name);
209
210/* Temp_errors must consist only of digits and colons, but there can be
211spaces round the colons, so allow them too. */
212
213if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
214 {
215 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
216 if (ob->temp_errors[p] != 0)
217 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
218 "temp_errors must be a list of numbers or an asterisk for the %s "
219 "transport", tblock->name);
220 }
221
222/* Only one of return_output/return_fail_output or log_output/log_fail_output
223should be set. */
224
225if (tblock->return_output && tblock->return_fail_output)
226 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
227 "both return_output and return_fail_output set for %s transport",
228 tblock->name);
229
230if (tblock->log_output && tblock->log_fail_output)
231 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
232 "both log_output and log_fail_output set for the %s transport",
233 tblock->name);
234
235/* If batch SMTP is set, force the check and escape strings, and arrange that
236headers are also escaped. */
237
238if (ob->use_bsmtp)
239 {
240 ob->check_string = US".";
241 ob->escape_string = US"..";
242 ob->options |= topt_escape_headers;
243 }
244
245/* If not batch SMTP, and message_prefix or message_suffix are unset, insert
246default values for them. */
247
248else
249 {
250 if (ob->message_prefix == NULL) ob->message_prefix =
251 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
252 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
253 }
254
255/* The restrict_to_path and use_shell options are incompatible */
256
257if (ob->restrict_to_path && ob->use_shell)
258 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
259 "both restrict_to_path and use_shell set for %s transport",
260 tblock->name);
261
262/* The allow_commands and use_shell options are incompatible */
263
264if (ob->allow_commands && ob->use_shell)
265 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
266 "both allow_commands and use_shell set for %s transport",
267 tblock->name);
268
269/* Set up the bitwise options for transport_write_message from the various
270driver options. Only one of body_only and headers_only can be set. */
271
272ob->options |=
273 (tblock->body_only? topt_no_headers : 0) |
274 (tblock->headers_only? topt_no_body : 0) |
275 (tblock->return_path_add? topt_add_return_path : 0) |
276 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
277 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
278 (ob->use_crlf? topt_use_crlf : 0);
279}
280
281
282
283/*************************************************
284* Set up direct (non-shell) command *
285*************************************************/
286
287/* This function is called when a command line is to be parsed by the transport
288and executed directly, without the use of /bin/sh.
289
290Arguments:
291 argvptr pointer to anchor for argv vector
292 cmd points to the command string
293 expand_arguments true if expansion is to occur
294 expand_fail error if expansion fails
295 addr chain of addresses
296 tname the transport name
297 ob the transport options block
298
299Returns: TRUE if all went well; otherwise an error will be
300 set in the first address and FALSE returned
301*/
302
303static BOOL
304set_up_direct_command(uschar ***argvptr, uschar *cmd, BOOL expand_arguments,
305 int expand_fail, address_item *addr, uschar *tname,
306 pipe_transport_options_block *ob)
307{
308BOOL permitted = FALSE;
309uschar **argv;
310uschar buffer[64];
311
312/* Set up "transport <name>" to be put in any error messages, and then
313call the common function for creating an argument list and expanding
314the items if necessary. If it fails, this function fails (error information
315is in the addresses). */
316
317sprintf(CS buffer, "%.50s transport", tname);
318if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
319 addr, buffer, NULL))
320 return FALSE;
321
322/* Point to the set-up arguments. */
323
324argv = *argvptr;
325
326/* If allow_commands is set, see if the command is in the permitted list. */
327
328if (ob->allow_commands != NULL)
329 {
330 int sep = 0;
331 uschar *s, *p;
332 uschar buffer[256];
333
334 s = expand_string(ob->allow_commands);
335 if (s == NULL)
336 {
337 addr->transport_return = DEFER;
338 addr->message = string_sprintf("failed to expand string \"%s\" "
339 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
340 return FALSE;
341 }
342
343 while ((p = string_nextinlist(&s, &sep, buffer, sizeof(buffer))) != NULL)
344 {
345 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
346 }
347 }
348
349/* If permitted is TRUE it means the command was found in the allowed list, and
350no further checks are done. If permitted = FALSE, it either means
351allow_commands wasn't set, or that the command didn't match anything in the
352list. In both cases, if restrict_to_path is set, we fail if the command
353contains any slashes, but if restrict_to_path is not set, we must fail the
354command only if allow_commands is set. */
355
356if (!permitted)
357 {
358 if (ob->restrict_to_path)
359 {
360 if (Ustrchr(argv[0], '/') != NULL)
361 {
362 addr->transport_return = FAIL;
363 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
364 "transport) - failed for security reasons", cmd, tname);
365 return FALSE;
366 }
367 }
368
369 else if (ob->allow_commands != NULL)
370 {
371 addr->transport_return = FAIL;
372 addr->message = string_sprintf("\"%s\" command not permitted by %s "
373 "transport", argv[0], tname);
374 return FALSE;
375 }
376 }
377
378/* If the command is not an absolute path, search the PATH directories
379for it. */
380
381if (argv[0][0] != '/')
382 {
383 int sep = 0;
384 uschar *p;
385 uschar *listptr = ob->path;
386 uschar buffer[1024];
387
388 while ((p = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))) != NULL)
389 {
390 struct stat statbuf;
391 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
392 if (Ustat(big_buffer, &statbuf) == 0)
393 {
394 argv[0] = string_copy(big_buffer);
395 break;
396 }
397 }
398 if (p == NULL)
399 {
400 addr->transport_return = FAIL;
401 addr->message = string_sprintf("\"%s\" command not found for %s transport",
402 argv[0], tname);
403 return FALSE;
404 }
405 }
406
407return TRUE;
408}
409
410
411/*************************************************
412* Set up shell command *
413*************************************************/
414
415/* This function is called when a command line is to be passed to /bin/sh
416without parsing inside the transport.
417
418Arguments:
419 argvptr pointer to anchor for argv vector
420 cmd points to the command string
421 expand_arguments true if expansion is to occur
422 expand_fail error if expansion fails
423 addr chain of addresses
424 tname the transport name
425
426Returns: TRUE if all went well; otherwise an error will be
427 set in the first address and FALSE returned
428*/
429
430static BOOL
431set_up_shell_command(uschar ***argvptr, uschar *cmd, BOOL expand_arguments,
432 int expand_fail, address_item *addr, uschar *tname)
433{
434uschar **argv;
435
436*argvptr = argv = store_get((4)*sizeof(uschar *));
437
438argv[0] = US"/bin/sh";
439argv[1] = US"-c";
440
441/* We have to take special action to handle the special "variable" called
442$pipe_addresses, which is not recognized by the normal expansion function. */
443
444DEBUG(D_transport)
445 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
446
447if (expand_arguments)
448 {
449 uschar *s = cmd;
450 uschar *p = Ustrstr(cmd, "pipe_addresses");
451
452 if (p != NULL && (
453 (p > cmd && p[-1] == '$') ||
454 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
455 {
456 address_item *ad;
457 uschar *q = p + 14;
458 int size = Ustrlen(cmd) + 64;
459 int offset;
460
461 if (p[-1] == '{') { q++; p--; }
462
463 s = store_get(size);
464 offset = p - cmd - 1;
465 Ustrncpy(s, cmd, offset);
466
467 for (ad = addr; ad != NULL; ad = ad->next)
468 {
469 if (ad != addr) string_cat(s, &size, &offset, US" ", 1);
470 string_cat(s, &size, &offset, ad->address, Ustrlen(ad->address));
471 }
472
473 string_cat(s, &size, &offset, q, Ustrlen(q));
474 s[offset] = 0;
475 }
476
477 /* Allow $recipients in the expansion iff it comes from a system filter */
478
479 enable_dollar_recipients = addr != NULL &&
480 addr->parent != NULL &&
481 Ustrcmp(addr->parent->address, "system-filter") == 0;
482 argv[2] = expand_string(s);
483 enable_dollar_recipients = FALSE;
484
485 if (argv[2] == NULL)
486 {
487 addr->transport_return = search_find_defer? DEFER : expand_fail;
488 addr->message = string_sprintf("Expansion of command \"%s\" "
489 "in %s transport failed: %s",
490 cmd, tname, expand_string_message);
491 return FALSE;
492 }
493
494 DEBUG(D_transport)
495 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
496 }
497else argv[2] = cmd;
498
499argv[3] = (uschar *)0;
500return TRUE;
501}
502
503
504
505
506/*************************************************
507* Main entry point *
508*************************************************/
509
510/* See local README for interface details. This transport always returns FALSE,
511indicating that the status in the first address is the status for all addresses
512in a batch. */
513
514BOOL
515pipe_transport_entry(
516 transport_instance *tblock, /* data for this instantiation */
517 address_item *addr) /* address(es) we are working on */
518{
519pid_t pid, outpid;
520int fd_in, fd_out, rc;
521int envcount = 0;
522int envsep = 0;
523int expand_fail;
524pipe_transport_options_block *ob =
525 (pipe_transport_options_block *)(tblock->options_block);
526int timeout = ob->timeout;
527BOOL written_ok = FALSE;
528BOOL expand_arguments;
529uschar **argv;
530uschar *envp[50];
531uschar *envlist = ob->environment;
532uschar *cmd, *ss;
533uschar *eol = (ob->use_crlf)? US"\r\n" : US"\n";
534
535DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
536
537/* Set up for the good case */
538
539addr->transport_return = OK;
540addr->basic_errno = 0;
541
542/* Pipes are not accepted as general addresses, but they can be generated from
543.forward files or alias files. In those cases, the pfr flag is set, and the
544command to be obeyed is pointed to by addr->local_part; it starts with the pipe
545symbol. In other cases, the command is supplied as one of the pipe transport's
546options. */
547
548if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
549 {
550 cmd = addr->local_part + 1;
551 while (isspace(*cmd)) cmd++;
552 expand_arguments = testflag(addr, af_expand_pipe);
553 expand_fail = FAIL;
554 }
555else
556 {
557 cmd = ob->cmd;
558 expand_arguments = TRUE;
559 expand_fail = PANIC;
560 }
561
562/* If no command has been supplied, we are in trouble. */
563
564if (cmd == NULL)
565 {
566 addr->transport_return = DEFER;
567 addr->message = string_sprintf("no command specified for %s transport",
568 tblock->name);
569 return FALSE;
570 }
571
572/* When a pipe is set up by a filter file, there may be values for $thisaddress
573and numerical the variables in existence. These are passed in
574addr->pipe_expandn for use here. */
575
576if (expand_arguments && addr->pipe_expandn != NULL)
577 {
578 uschar **ss = addr->pipe_expandn;
579 expand_nmax = -1;
580 if (*ss != NULL) filter_thisaddress = *ss++;
581 while (*ss != NULL)
582 {
583 expand_nstring[++expand_nmax] = *ss;
584 expand_nlength[expand_nmax] = Ustrlen(*ss++);
585 }
586 }
587
588/* The default way of processing the command is to split it up into arguments
589here, and run it directly. This offers some security advantages. However, there
590are installations that want by default to run commands under /bin/sh always, so
591there is an option to do that. */
592
593if (ob->use_shell)
594 {
595 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
596 tblock->name)) return FALSE;
597 }
598else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
599 tblock->name, ob)) return FALSE;
600
601expand_nmax = -1; /* Reset */
602filter_thisaddress = NULL;
603
604/* Set up the environment for the command. */
605
606envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
607envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
608envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
609envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
610 deliver_localpart_prefix);
611envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
612 deliver_localpart_suffix);
613envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
614envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
615envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
616envp[envcount++] = string_sprintf("PATH=%s", ob->path);
617envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
618 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
619 deliver_domain);
620envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
621envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
622envp[envcount++] = US"SHELL=/bin/sh";
623
624if (addr->host_list != NULL)
625 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
626
627if (timestamps_utc) envp[envcount++] = US"TZ=UTC";
628else if (timezone_string != NULL && timezone_string[0] != 0)
629 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
630
631/* Add any requested items */
632
633if (envlist != NULL)
634 {
635 envlist = expand_string(envlist);
636 if (envlist == NULL)
637 {
638 addr->transport_return = DEFER;
639 addr->message = string_sprintf("failed to expand string \"%s\" "
640 "for %s transport: %s", ob->environment, tblock->name,
641 expand_string_message);
642 return FALSE;
643 }
644 }
645
646while ((ss = string_nextinlist(&envlist, &envsep, big_buffer, big_buffer_size))
647 != NULL)
648 {
649 if (envcount > sizeof(envp)/sizeof(uschar *) - 2)
650 {
651 addr->transport_return = DEFER;
652 addr->message = string_sprintf("too many environment settings for "
653 "%s transport", tblock->name);
654 return FALSE;
655 }
656 envp[envcount++] = string_copy(ss);
657 }
658
659envp[envcount] = NULL;
660
661/* If the -N option is set, can't do any more. */
662
663if (dont_deliver)
664 {
665 DEBUG(D_transport)
666 debug_printf("*** delivery by %s transport bypassed by -N option",
667 tblock->name);
668 return FALSE;
669 }
670
671
672/* Handling the output from the pipe is tricky. If a file for catching this
673output is provided, we could in theory just hand that fd over to the process,
674but this isn't very safe because it might loop and carry on writing for
675ever (which is exactly what happened in early versions of Exim). Therefore we
676use the standard child_open() function, which creates pipes. We can then read
677our end of the output pipe and count the number of bytes that come through,
678chopping the sub-process if it exceeds some limit.
679
680However, this means we want to run a sub-process with both its input and output
681attached to pipes. We can't handle that easily from a single parent process
682using straightforward code such as the transport_write_message() function
683because the subprocess might not be reading its input because it is trying to
684write to a full output pipe. The complication of redesigning the world to
685handle this is too great - simpler just to run another process to do the
686reading of the output pipe. */
687
688
689/* As this is a local transport, we are already running with the required
690uid/gid and current directory. Request that the new process be a process group
691leader, so we can kill it and all its children on a timeout. */
692
693if ((pid = child_open(argv, envp, ob->umask, &fd_in, &fd_out, TRUE)) < 0)
694 {
695 addr->transport_return = DEFER;
696 addr->message = string_sprintf(
697 "Failed to create child process for %s transport: %s", tblock->name,
698 strerror(errno));
699 return FALSE;
700 }
701
702/* Now fork a process to handle the output that comes down the pipe. */
703
704if ((outpid = fork()) < 0)
705 {
706 addr->basic_errno = errno;
707 addr->transport_return = DEFER;
708 addr->message = string_sprintf(
709 "Failed to create process for handling output in %s transport",
710 tblock->name);
f1e894f3
PH
711 (void)close(fd_in);
712 (void)close(fd_out);
0756eb3c
PH
713 return FALSE;
714 }
715
716/* This is the code for the output-handling subprocess. Read from the pipe
717in chunks, and write to the return file if one is provided. Keep track of
718the number of bytes handled. If the limit is exceeded, try to kill the
719subprocess group, and in any case close the pipe and exit, which should cause
720the subprocess to fail. */
721
722if (outpid == 0)
723 {
724 int count = 0;
f1e894f3 725 (void)close(fd_in);
0756eb3c
PH
726 set_process_info("reading output from |%s", cmd);
727 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
728 {
729 if (addr->return_file >= 0)
730 write(addr->return_file, big_buffer, rc);
731 count += rc;
732 if (count > ob->max_output)
733 {
734 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
735 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
736 if (addr->return_file >= 0)
737 write(addr->return_file, message, Ustrlen(message));
738 killpg(pid, SIGKILL);
739 break;
740 }
741 }
f1e894f3 742 (void)close(fd_out);
0756eb3c
PH
743 _exit(0);
744 }
745
f1e894f3 746(void)close(fd_out); /* Not used in this process */
0756eb3c
PH
747
748
749/* Carrying on now with the main parent process. Attempt to write the message
750to it down the pipe. It is a fallacy to think that you can detect write errors
751when the sub-process fails to read the pipe. The parent process may complete
752writing and close the pipe before the sub-process completes. We could sleep a
753bit here to let the sub-process get going, but it may still not complete. So we
754ignore all writing errors. (When in the test harness, we do do a short sleep so
755any debugging output is likely to be in the same order.) */
756
757if (running_in_test_harness) millisleep(500);
758
759DEBUG(D_transport) debug_printf("Writing message to pipe\n");
760
761/* Arrange to time out writes if there is a timeout set. */
762
763if (timeout > 0)
764 {
765 sigalrm_seen = FALSE;
766 transport_write_timeout = timeout;
767 }
768
769/* Reset the counter of bytes written */
770
771transport_count = 0;
772
773/* First write any configured prefix information */
774
775if (ob->message_prefix != NULL)
776 {
777 uschar *prefix = expand_string(ob->message_prefix);
778 if (prefix == NULL)
779 {
780 addr->transport_return = search_find_defer? DEFER : PANIC;
781 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
782 "transport) failed: %s", ob->message_prefix, tblock->name,
783 expand_string_message);
784 return FALSE;
785 }
786 if (!transport_write_block(fd_in, prefix, Ustrlen(prefix)))
787 goto END_WRITE;
788 }
789
790/* If the use_bsmtp option is set, we need to write SMTP prefix information.
791The various different values for batching are handled outside; if there is more
792than one address available here, all must be included. Force SMTP dot-handling.
793*/
794
795if (ob->use_bsmtp)
796 {
797 address_item *a;
798
799 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
800 goto END_WRITE;
801
802 for (a = addr; a != NULL; a = a->next)
803 {
804 if (!transport_write_string(fd_in,
805 "RCPT TO:<%s>%s",
806 transport_rcpt_address(a, tblock->rcpt_include_affixes),
807 eol))
808 goto END_WRITE;
809 }
810
811 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
812 }
813
814/* Now the actual message - the options were set at initialization time */
815
816if (!transport_write_message(addr, fd_in, ob->options, 0, tblock->add_headers,
817 tblock->remove_headers, ob->check_string, ob->escape_string,
818 tblock->rewrite_rules, tblock->rewrite_existflags))
819 goto END_WRITE;
820
821/* Now any configured suffix */
822
823if (ob->message_suffix != NULL)
824 {
825 uschar *suffix = expand_string(ob->message_suffix);
826 if (suffix == NULL)
827 {
828 addr->transport_return = search_find_defer? DEFER : PANIC;
829 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
830 "transport) failed: %s", ob->message_suffix, tblock->name,
831 expand_string_message);
832 return FALSE;
833 }
834 if (!transport_write_block(fd_in, suffix, Ustrlen(suffix)))
835 goto END_WRITE;
836 }
837
838/* If local_smtp, write the terminating dot. */
839
840if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
841 goto END_WRITE;
842
843/* Flag all writing completed successfully. */
844
845written_ok = TRUE;
846
847/* Come here if there are errors during writing. */
848
849END_WRITE:
850
851/* OK, the writing is now all done. Close the pipe. */
852
853(void) close(fd_in);
854
855/* Handle errors during writing. For timeouts, set the timeout for waiting for
856the child process to 1 second. If the process at the far end of the pipe died
857without reading all of it, we expect an EPIPE error, which should be ignored.
858We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
859at handling OS where the death of a pipe doesn't give EPIPE immediately. See
2e2a30b4 860comments therein. */
0756eb3c
PH
861
862if (!written_ok)
863 {
864 if (errno == ETIMEDOUT)
2e2a30b4
PH
865 {
866 addr->message = string_sprintf("%stimeout while writing to pipe",
867 transport_filter_timed_out? "transport filter " : "");
868 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
0756eb3c 869 timeout = 1;
2e2a30b4
PH
870 }
871 else if (errno == EPIPE)
0756eb3c 872 {
2e2a30b4 873 debug_printf("transport error EPIPE ignored\n");
0756eb3c
PH
874 }
875 else
876 {
8e669ac1 877 addr->transport_return = PANIC;
0756eb3c
PH
878 addr->basic_errno = errno;
879 if (errno == ERRNO_CHHEADER_FAIL)
880 addr->message =
881 string_sprintf("Failed to expand headers_add or headers_remove: %s",
882 expand_string_message);
883 else if (errno == ERRNO_FILTER_FAIL)
35af9f61
PH
884 addr->message = string_sprintf("Transport filter process failed (%d)%s",
885 addr->more_errno,
886 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
0756eb3c
PH
887 else if (errno == ERRNO_WRITEINCOMPLETE)
888 addr->message = string_sprintf("Failed repeatedly to write data");
889 else
890 addr->message = string_sprintf("Error %d", errno);
891 return FALSE;
892 }
893 }
894
895/* Wait for the child process to complete and take action if the returned
896status is nonzero. The timeout will be just 1 second if any of the writes
897above timed out. */
898
899if ((rc = child_close(pid, timeout)) != 0)
900 {
22c3b60b
PH
901 uschar *tmsg = (addr->message == NULL)? US"" :
902 string_sprintf(" (preceded by %s)", addr->message);
903
0756eb3c
PH
904 /* The process did not complete in time; kill its process group and fail
905 the delivery. It appears to be necessary to kill the output process too, as
906 otherwise it hangs on for some time if the actual pipe process is sleeping.
907 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
908 the delivery, that shouldn't cause any problem. */
909
910 if (rc == -256)
911 {
912 killpg(pid, SIGKILL);
913 kill(outpid, SIGKILL);
2e2a30b4 914 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
22c3b60b 915 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
0756eb3c
PH
916 }
917
918 /* Wait() failed. */
919
920 else if (rc == -257)
921 {
922 addr->transport_return = PANIC;
923 addr->message = string_sprintf("Wait() failed for child process of %s "
22c3b60b 924 "transport: %s%s", tblock->name, strerror(errno), tmsg);
0756eb3c
PH
925 }
926
927 /* Either the process completed, but yielded a non-zero (necessarily
928 positive) status, or the process was terminated by a signal (rc will contain
929 the negation of the signal number). Treat killing by signal as failure unless
930 status is being ignored. */
931
932 else if (rc < 0)
933 {
934 if (!ob->ignore_status)
935 {
936 addr->transport_return = FAIL;
937 addr->message = string_sprintf("Child process of %s transport (running "
22c3b60b
PH
938 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
939 -rc, os_strsignal(-rc), tmsg);
0756eb3c
PH
940 }
941 }
942
943 /* For positive values (process terminated with non-zero status), we need a
944 status code to request deferral. A number of systems contain the following
945 line in sysexits.h:
946
947 #define EX_TEMPFAIL 75
948
949 with the description
950
951 EX_TEMPFAIL -- temporary failure, indicating something that
952 is not really an error. In sendmail, this means
953 that a mailer (e.g.) could not create a connection,
954 and the request should be reattempted later.
955
956 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
957 not ignoring the returned status. However, there is now an option that
958 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
959
960 Another case that needs special treatment is if execve() failed (typically
961 the command that was given is a non-existent path). By default this is
962 treated as just another failure, but if freeze_exec_fail is set, the reaction
963 is to freeze the message rather than bounce the address. Exim used to signal
964 this failure with EX_UNAVAILABLE, which is definined in many systems as
965
966 #define EX_UNAVAILABLE 69
967
968 with the description
969
970 EX_UNAVAILABLE -- A service is unavailable. This can occur
971 if a support program or file does not exist. This
972 can also be used as a catchall message when something
973 you wanted to do doesn't work, but you don't know why.
974
975 However, this can be confused with a command that actually returns 69 because
976 something *it* wanted is unavailable. At release 4.21, Exim was changed to
977 use return code 127 instead, because this is what the shell returns when it
978 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
979 child.c to signal execve() failure and other unexpected failures such as
980 setuid() not working - though that won't be the case here because we aren't
981 changing uid. */
982
983 else
984 {
985 /* Always handle execve() failure specially if requested to */
986
987 if (ob->freeze_exec_fail && (rc == EX_EXECFAILED))
988 {
989 addr->transport_return = DEFER;
990 addr->special_action = SPECIAL_FREEZE;
22c3b60b
PH
991 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
992 cmd, tmsg);
0756eb3c
PH
993 }
994
995 /* Otherwise take action only if not ignoring status */
996
997 else if (!ob->ignore_status)
998 {
999 uschar *ss;
1000 int size, ptr, i;
1001
1002 /* If temp_errors is "*" all codes are temporary. Initializion checks
1003 that it's either "*" or a list of numbers. If not "*", scan the list of
1004 temporary failure codes; if any match, the result is DEFER. */
1005
1006 if (ob->temp_errors[0] == '*')
1007 addr->transport_return = DEFER;
1008
1009 else
1010 {
1011 uschar *s = ob->temp_errors;
1012 uschar *p;
1013 uschar buffer[64];
1014 int sep = 0;
1015
1016 addr->transport_return = FAIL;
1017 while ((p = string_nextinlist(&s,&sep,buffer,sizeof(buffer))) != NULL)
1018 {
1019 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
1020 }
1021 }
1022
1023 /* Ensure the message contains the expanded command and arguments. This
1024 doesn't have to be brilliantly efficient - it is an error situation. */
1025
1026 addr->message = string_sprintf("Child process of %s transport returned "
1027 "%d", tblock->name, rc);
1028
1029 ptr = Ustrlen(addr->message);
1030 size = ptr + 1;
1031
1032 /* If the return code is > 128, it often means that a shell command
1033 was terminated by a signal. */
1034
1035 ss = (rc > 128)?
1036 string_sprintf("(could mean shell command ended by signal %d (%s))",
1037 rc-128, os_strsignal(rc-128)) :
1038 US os_strexit(rc);
1039
1040 if (*ss != 0)
1041 {
1042 addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
1043 addr->message = string_cat(addr->message, &size, &ptr,
1044 ss, Ustrlen(ss));
1045 }
1046
1047 /* Now add the command and arguments */
1048
1049 addr->message = string_cat(addr->message, &size, &ptr,
1050 US" from command:", 14);
1051
1052 for (i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1053 {
1054 BOOL quote = FALSE;
1055 addr->message = string_cat(addr->message, &size, &ptr, US" ", 1);
1056 if (Ustrpbrk(argv[i], " \t") != NULL)
1057 {
1058 quote = TRUE;
1059 addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
1060 }
1061 addr->message = string_cat(addr->message, &size, &ptr, argv[i],
1062 Ustrlen(argv[i]));
1063 if (quote)
1064 addr->message = string_cat(addr->message, &size, &ptr, US"\"", 1);
1065 }
22c3b60b
PH
1066
1067 /* Add previous filter timeout message, if present. */
1068
1069 if (*tmsg != 0)
1070 addr->message = string_cat(addr->message, &size, &ptr, tmsg,
1071 Ustrlen(tmsg));
1072
0756eb3c
PH
1073 addr->message[ptr] = 0; /* Ensure concatenated string terminated */
1074 }
1075 }
1076 }
1077
1078/* Ensure all subprocesses (in particular, the output handling process)
1079are complete before we pass this point. */
1080
1081while (wait(&rc) >= 0);
1082
1083DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1084 addr->transport_return);
1085
1086/* If there has been a problem, the message in addr->message contains details
1087of the pipe command. We don't want to expose these to the world, so we set up
1088something bland to return to the sender. */
1089
1090if (addr->transport_return != OK)
1091 addr->user_message = US"local delivery failed";
1092
1093return FALSE;
1094}
1095
1096/* End of transport/pipe.c */