Compiler quietening: C fn ptrs are officially not intercastable with object pointers
[exim.git] / src / src / transports / pipe.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
f9ba5e22 5/* Copyright (c) University of Cambridge 1995 - 2018 */
9214d2e4 6/* Copyright (c) The Exim maintainers 2020 */
0756eb3c
PH
7/* See the file NOTICE for conditions of use and distribution. */
8
9
10#include "../exim.h"
11#include "pipe.h"
12
79378e0f 13#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
14#include <login_cap.h>
15#endif
16
0756eb3c
PH
17
18
19/* Options specific to the pipe transport. They must be in alphabetic
20order (note that "_" comes before the lower case letters). Those starting
21with "*" are not settable by the user but are used by the option-reading
22software for alternative value types. Some options are stored in the transport
23instance block so as to be publicly visible; these are flagged with opt_public.
24*/
25
26optionlist pipe_transport_options[] = {
27 { "allow_commands", opt_stringptr,
28 (void *)offsetof(pipe_transport_options_block, allow_commands) },
29 { "batch_id", opt_stringptr | opt_public,
30 (void *)offsetof(transport_instance, batch_id) },
31 { "batch_max", opt_int | opt_public,
32 (void *)offsetof(transport_instance, batch_max) },
33 { "check_string", opt_stringptr,
34 (void *)offsetof(pipe_transport_options_block, check_string) },
35 { "command", opt_stringptr,
36 (void *)offsetof(pipe_transport_options_block, cmd) },
37 { "environment", opt_stringptr,
38 (void *)offsetof(pipe_transport_options_block, environment) },
39 { "escape_string", opt_stringptr,
40 (void *)offsetof(pipe_transport_options_block, escape_string) },
09792322
NK
41 { "force_command", opt_bool,
42 (void *)offsetof(pipe_transport_options_block, force_command) },
0756eb3c
PH
43 { "freeze_exec_fail", opt_bool,
44 (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
2fe76745
PP
45 { "freeze_signal", opt_bool,
46 (void *)offsetof(pipe_transport_options_block, freeze_signal) },
0756eb3c
PH
47 { "ignore_status", opt_bool,
48 (void *)offsetof(pipe_transport_options_block, ignore_status) },
49 { "log_defer_output", opt_bool | opt_public,
50 (void *)offsetof(transport_instance, log_defer_output) },
51 { "log_fail_output", opt_bool | opt_public,
52 (void *)offsetof(transport_instance, log_fail_output) },
53 { "log_output", opt_bool | opt_public,
54 (void *)offsetof(transport_instance, log_output) },
55 { "max_output", opt_mkint,
56 (void *)offsetof(pipe_transport_options_block, max_output) },
57 { "message_prefix", opt_stringptr,
58 (void *)offsetof(pipe_transport_options_block, message_prefix) },
59 { "message_suffix", opt_stringptr,
60 (void *)offsetof(pipe_transport_options_block, message_suffix) },
61 { "path", opt_stringptr,
62 (void *)offsetof(pipe_transport_options_block, path) },
a29e5231
PP
63 { "permit_coredump", opt_bool,
64 (void *)offsetof(pipe_transport_options_block, permit_coredump) },
0756eb3c
PH
65 { "pipe_as_creator", opt_bool | opt_public,
66 (void *)offsetof(transport_instance, deliver_as_creator) },
67 { "restrict_to_path", opt_bool,
68 (void *)offsetof(pipe_transport_options_block, restrict_to_path) },
69 { "return_fail_output",opt_bool | opt_public,
70 (void *)offsetof(transport_instance, return_fail_output) },
71 { "return_output", opt_bool | opt_public,
72 (void *)offsetof(transport_instance, return_output) },
73 { "temp_errors", opt_stringptr,
74 (void *)offsetof(pipe_transport_options_block, temp_errors) },
75 { "timeout", opt_time,
76 (void *)offsetof(pipe_transport_options_block, timeout) },
2e2a30b4
PH
77 { "timeout_defer", opt_bool,
78 (void *)offsetof(pipe_transport_options_block, timeout_defer) },
0756eb3c
PH
79 { "umask", opt_octint,
80 (void *)offsetof(pipe_transport_options_block, umask) },
81 { "use_bsmtp", opt_bool,
82 (void *)offsetof(pipe_transport_options_block, use_bsmtp) },
79378e0f 83 #ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
84 { "use_classresources", opt_bool,
85 (void *)offsetof(pipe_transport_options_block, use_classresources) },
86 #endif
0756eb3c
PH
87 { "use_crlf", opt_bool,
88 (void *)offsetof(pipe_transport_options_block, use_crlf) },
89 { "use_shell", opt_bool,
90 (void *)offsetof(pipe_transport_options_block, use_shell) },
91};
92
93/* Size of the options list. An extern variable has to be used so that its
94address can appear in the tables drtables.c. */
95
96int pipe_transport_options_count =
97 sizeof(pipe_transport_options)/sizeof(optionlist);
98
d185889f
JH
99
100#ifdef MACRO_PREDEF
101
102/* Dummy values */
103pipe_transport_options_block pipe_transport_option_defaults = {0};
104void pipe_transport_init(transport_instance *tblock) {}
105BOOL pipe_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
106
107#else /*!MACRO_PREDEF*/
108
109
0756eb3c
PH
110/* Default private options block for the pipe transport. */
111
112pipe_transport_options_block pipe_transport_option_defaults = {
113 NULL, /* cmd */
114 NULL, /* allow_commands */
115 NULL, /* environment */
cb741023 116 US"/bin:/usr/bin", /* path */
0756eb3c
PH
117 NULL, /* message_prefix (reset in init if not bsmtp) */
118 NULL, /* message_suffix (ditto) */
119 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
120 mac_expanded_string(EX_CANTCREAT),
121 NULL, /* check_string */
122 NULL, /* escape_string */
123 022, /* umask */
124 20480, /* max_output */
125 60*60, /* timeout */
126 0, /* options */
09792322 127 FALSE, /* force_command */
0756eb3c 128 FALSE, /* freeze_exec_fail */
2fe76745 129 FALSE, /* freeze_signal */
0756eb3c 130 FALSE, /* ignore_status */
a29e5231 131 FALSE, /* permit_coredump */
0756eb3c 132 FALSE, /* restrict_to_path */
2e2a30b4 133 FALSE, /* timeout_defer */
0756eb3c
PH
134 FALSE, /* use_shell */
135 FALSE, /* use_bsmtp */
929ba01c 136 FALSE, /* use_classresources */
0756eb3c
PH
137 FALSE /* use_crlf */
138};
139
140
141
142/*************************************************
929ba01c
PH
143* Setup entry point *
144*************************************************/
145
146/* Called for each delivery in the privileged state, just before the uid/gid
147are changed and the main entry point is called. In a system that supports the
148login_cap facilities, this function is used to set the class resource limits
a29e5231 149for the user. It may also re-enable coredumps.
929ba01c
PH
150
151Arguments:
152 tblock points to the transport instance
153 addrlist addresses about to be delivered (not used)
154 dummy not used (doesn't pass back data)
155 uid the uid that will be set (not used)
156 gid the gid that will be set (not used)
157 errmsg where to put an error message
158
159Returns: OK, FAIL, or DEFER
160*/
161
162static int
163pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
164 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
165{
166pipe_transport_options_block *ob =
167 (pipe_transport_options_block *)(tblock->options_block);
168
169addrlist = addrlist; /* Keep compiler happy */
170dummy = dummy;
171uid = uid;
172gid = gid;
173errmsg = errmsg;
174ob = ob;
175
79378e0f 176#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
177if (ob->use_classresources)
178 {
179 struct passwd *pw = getpwuid(uid);
180 if (pw != NULL)
181 {
182 login_cap_t *lc = login_getpwclass(pw);
183 if (lc != NULL)
184 {
185 setclassresources(lc);
186 login_close(lc);
187 }
188 }
189 }
190#endif
191
a29e5231
PP
192#ifdef RLIMIT_CORE
193if (ob->permit_coredump)
194 {
195 struct rlimit rl;
196 rl.rlim_cur = RLIM_INFINITY;
197 rl.rlim_max = RLIM_INFINITY;
198 if (setrlimit(RLIMIT_CORE, &rl) < 0)
199 {
200#ifdef SETRLIMIT_NOT_SUPPORTED
201 if (errno != ENOSYS && errno != ENOTSUP)
202#endif
203 log_write(0, LOG_MAIN,
762ca6f3 204 "delivery setrlimit(RLIMIT_CORE, RLIM_INFINITY) failed: %s",
a29e5231
PP
205 strerror(errno));
206 }
207 }
208#endif
209
929ba01c
PH
210return OK;
211}
212
213
214
215/*************************************************
0756eb3c
PH
216* Initialization entry point *
217*************************************************/
218
219/* Called for each instance, after its options have been read, to
220enable consistency checks to be done, or anything else that needs
221to be set up. */
222
223void
224pipe_transport_init(transport_instance *tblock)
225{
226pipe_transport_options_block *ob =
227 (pipe_transport_options_block *)(tblock->options_block);
228
929ba01c
PH
229/* Set up the setup entry point, to be called in the privileged state */
230
231tblock->setup = pipe_transport_setup;
232
0756eb3c
PH
233/* If pipe_as_creator is set, then uid/gid should not be set. */
234
235if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
236 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
237 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
238 "both pipe_as_creator and an explicit uid/gid are set for the %s "
239 "transport", tblock->name);
240
241/* If a fixed uid field is set, then a gid field must also be set. */
242
243if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
244 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
245 "user set without group for the %s transport", tblock->name);
246
247/* Temp_errors must consist only of digits and colons, but there can be
248spaces round the colons, so allow them too. */
249
250if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
251 {
252 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
253 if (ob->temp_errors[p] != 0)
254 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
255 "temp_errors must be a list of numbers or an asterisk for the %s "
256 "transport", tblock->name);
257 }
258
259/* Only one of return_output/return_fail_output or log_output/log_fail_output
260should be set. */
261
262if (tblock->return_output && tblock->return_fail_output)
263 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
264 "both return_output and return_fail_output set for %s transport",
265 tblock->name);
266
267if (tblock->log_output && tblock->log_fail_output)
268 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
269 "both log_output and log_fail_output set for the %s transport",
270 tblock->name);
271
272/* If batch SMTP is set, force the check and escape strings, and arrange that
273headers are also escaped. */
274
275if (ob->use_bsmtp)
276 {
277 ob->check_string = US".";
278 ob->escape_string = US"..";
279 ob->options |= topt_escape_headers;
280 }
281
282/* If not batch SMTP, and message_prefix or message_suffix are unset, insert
283default values for them. */
284
285else
286 {
287 if (ob->message_prefix == NULL) ob->message_prefix =
288 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
289 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
290 }
291
292/* The restrict_to_path and use_shell options are incompatible */
293
294if (ob->restrict_to_path && ob->use_shell)
295 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
296 "both restrict_to_path and use_shell set for %s transport",
297 tblock->name);
298
299/* The allow_commands and use_shell options are incompatible */
300
301if (ob->allow_commands && ob->use_shell)
302 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
303 "both allow_commands and use_shell set for %s transport",
304 tblock->name);
305
306/* Set up the bitwise options for transport_write_message from the various
307driver options. Only one of body_only and headers_only can be set. */
308
309ob->options |=
310 (tblock->body_only? topt_no_headers : 0) |
311 (tblock->headers_only? topt_no_body : 0) |
312 (tblock->return_path_add? topt_add_return_path : 0) |
313 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
314 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
315 (ob->use_crlf? topt_use_crlf : 0);
316}
317
318
319
320/*************************************************
321* Set up direct (non-shell) command *
322*************************************************/
323
324/* This function is called when a command line is to be parsed by the transport
325and executed directly, without the use of /bin/sh.
326
327Arguments:
328 argvptr pointer to anchor for argv vector
329 cmd points to the command string
330 expand_arguments true if expansion is to occur
331 expand_fail error if expansion fails
332 addr chain of addresses
333 tname the transport name
334 ob the transport options block
335
336Returns: TRUE if all went well; otherwise an error will be
337 set in the first address and FALSE returned
338*/
339
340static BOOL
55414b25
JH
341set_up_direct_command(const uschar ***argvptr, uschar *cmd,
342 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname,
0756eb3c
PH
343 pipe_transport_options_block *ob)
344{
345BOOL permitted = FALSE;
55414b25 346const uschar **argv;
0756eb3c
PH
347
348/* Set up "transport <name>" to be put in any error messages, and then
349call the common function for creating an argument list and expanding
350the items if necessary. If it fails, this function fails (error information
351is in the addresses). */
352
0756eb3c 353if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
7b283890 354 addr, string_sprintf("%.50s transport", tname), NULL))
0756eb3c
PH
355 return FALSE;
356
357/* Point to the set-up arguments. */
358
359argv = *argvptr;
360
361/* If allow_commands is set, see if the command is in the permitted list. */
362
7b283890 363if (ob->allow_commands)
0756eb3c
PH
364 {
365 int sep = 0;
55414b25
JH
366 const uschar *s;
367 uschar *p;
0756eb3c 368
55414b25 369 if (!(s = expand_string(ob->allow_commands)))
0756eb3c
PH
370 {
371 addr->transport_return = DEFER;
372 addr->message = string_sprintf("failed to expand string \"%s\" "
373 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
374 return FALSE;
375 }
376
7b283890 377 while ((p = string_nextinlist(&s, &sep, NULL, 0)))
0756eb3c 378 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
0756eb3c
PH
379 }
380
381/* If permitted is TRUE it means the command was found in the allowed list, and
382no further checks are done. If permitted = FALSE, it either means
383allow_commands wasn't set, or that the command didn't match anything in the
384list. In both cases, if restrict_to_path is set, we fail if the command
385contains any slashes, but if restrict_to_path is not set, we must fail the
386command only if allow_commands is set. */
387
388if (!permitted)
389 {
390 if (ob->restrict_to_path)
391 {
392 if (Ustrchr(argv[0], '/') != NULL)
393 {
394 addr->transport_return = FAIL;
395 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
396 "transport) - failed for security reasons", cmd, tname);
397 return FALSE;
398 }
399 }
400
7b283890 401 else if (ob->allow_commands)
0756eb3c
PH
402 {
403 addr->transport_return = FAIL;
404 addr->message = string_sprintf("\"%s\" command not permitted by %s "
405 "transport", argv[0], tname);
406 return FALSE;
407 }
408 }
409
410/* If the command is not an absolute path, search the PATH directories
411for it. */
412
413if (argv[0][0] != '/')
414 {
415 int sep = 0;
416 uschar *p;
7b283890 417 const uschar *listptr = expand_string(ob->path);
0756eb3c 418
7b283890 419 while ((p = string_nextinlist(&listptr, &sep, NULL, 0)))
0756eb3c
PH
420 {
421 struct stat statbuf;
422 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
423 if (Ustat(big_buffer, &statbuf) == 0)
424 {
425 argv[0] = string_copy(big_buffer);
426 break;
427 }
428 }
7b283890 429 if (!p)
0756eb3c
PH
430 {
431 addr->transport_return = FAIL;
432 addr->message = string_sprintf("\"%s\" command not found for %s transport",
433 argv[0], tname);
434 return FALSE;
435 }
436 }
437
438return TRUE;
439}
440
441
442/*************************************************
443* Set up shell command *
444*************************************************/
445
446/* This function is called when a command line is to be passed to /bin/sh
447without parsing inside the transport.
448
449Arguments:
450 argvptr pointer to anchor for argv vector
451 cmd points to the command string
452 expand_arguments true if expansion is to occur
453 expand_fail error if expansion fails
454 addr chain of addresses
455 tname the transport name
456
457Returns: TRUE if all went well; otherwise an error will be
458 set in the first address and FALSE returned
459*/
460
461static BOOL
55414b25
JH
462set_up_shell_command(const uschar ***argvptr, uschar *cmd,
463 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname)
0756eb3c 464{
55414b25 465const uschar **argv;
0756eb3c 466
f3ebb786 467*argvptr = argv = store_get((4)*sizeof(uschar *), FALSE);
0756eb3c
PH
468
469argv[0] = US"/bin/sh";
470argv[1] = US"-c";
471
472/* We have to take special action to handle the special "variable" called
473$pipe_addresses, which is not recognized by the normal expansion function. */
474
0756eb3c
PH
475if (expand_arguments)
476 {
b2bcdd35 477 uschar * p = Ustrstr(cmd, "pipe_addresses");
acec9514
JH
478 gstring * g = NULL;
479
480 DEBUG(D_transport)
481 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
482
483 /* Allow $recipients in the expansion iff it comes from a system filter */
484
8768d548 485 f.enable_dollar_recipients = addr && addr->parent &&
acec9514 486 Ustrcmp(addr->parent->address, "system-filter") == 0;
0756eb3c
PH
487
488 if (p != NULL && (
489 (p > cmd && p[-1] == '$') ||
490 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
491 {
0756eb3c 492 uschar *q = p + 14;
0756eb3c
PH
493
494 if (p[-1] == '{') { q++; p--; }
495
acec9514
JH
496 g = string_get(Ustrlen(cmd) + 64);
497 g = string_catn(g, cmd, p - cmd - 1);
0756eb3c 498
d7978c0f 499 for (address_item * ad = addr; ad; ad = ad->next)
0756eb3c 500 {
a5bdc7ee 501 /*XXX string_append_listele() ? */
acec9514
JH
502 if (ad != addr) g = string_catn(g, US" ", 1);
503 g = string_cat(g, ad->address);
0756eb3c
PH
504 }
505
acec9514
JH
506 g = string_cat(g, q);
507 argv[2] = (cmd = string_from_gstring(g)) ? expand_string(cmd) : NULL;
0756eb3c 508 }
acec9514
JH
509 else
510 argv[2] = expand_string(cmd);
0756eb3c 511
8768d548 512 f.enable_dollar_recipients = FALSE;
0756eb3c 513
acec9514 514 if (!argv[2])
0756eb3c 515 {
8768d548 516 addr->transport_return = f.search_find_defer ? DEFER : expand_fail;
0756eb3c
PH
517 addr->message = string_sprintf("Expansion of command \"%s\" "
518 "in %s transport failed: %s",
519 cmd, tname, expand_string_message);
520 return FALSE;
521 }
522
523 DEBUG(D_transport)
524 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
525 }
acec9514
JH
526else
527 {
528 DEBUG(D_transport)
529 debug_printf("shell pipe command (no expansion):\n %s\n", cmd);
530 argv[2] = cmd;
531 }
0756eb3c 532
5903c6ff 533argv[3] = US 0;
0756eb3c
PH
534return TRUE;
535}
536
537
538
539
540/*************************************************
541* Main entry point *
542*************************************************/
543
544/* See local README for interface details. This transport always returns FALSE,
545indicating that the status in the first address is the status for all addresses
546in a batch. */
547
548BOOL
549pipe_transport_entry(
550 transport_instance *tblock, /* data for this instantiation */
551 address_item *addr) /* address(es) we are working on */
552{
553pid_t pid, outpid;
554int fd_in, fd_out, rc;
555int envcount = 0;
556int envsep = 0;
557int expand_fail;
558pipe_transport_options_block *ob =
559 (pipe_transport_options_block *)(tblock->options_block);
560int timeout = ob->timeout;
561BOOL written_ok = FALSE;
562BOOL expand_arguments;
55414b25 563const uschar **argv;
0756eb3c 564uschar *envp[50];
55414b25 565const uschar *envlist = ob->environment;
0756eb3c 566uschar *cmd, *ss;
6d5c916c 567uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
65de12cc 568transport_ctx tctx = {
b3b37076
JH
569 .tblock = tblock,
570 .addr = addr,
571 .check_string = ob->check_string,
572 .escape_string = ob->escape_string,
573 ob->options | topt_not_socket /* set at initialization time */
65de12cc 574};
0756eb3c
PH
575
576DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
577
578/* Set up for the good case */
579
580addr->transport_return = OK;
581addr->basic_errno = 0;
582
583/* Pipes are not accepted as general addresses, but they can be generated from
584.forward files or alias files. In those cases, the pfr flag is set, and the
585command to be obeyed is pointed to by addr->local_part; it starts with the pipe
586symbol. In other cases, the command is supplied as one of the pipe transport's
587options. */
588
589if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
700d22f3
PP
590 if (ob->force_command)
591 {
4c04137d 592 /* Enables expansion of $address_pipe into separate arguments */
700d22f3
PP
593 setflag(addr, af_force_command);
594 cmd = ob->cmd;
595 expand_arguments = TRUE;
596 expand_fail = PANIC;
597 }
598 else
599 {
600 cmd = addr->local_part + 1;
601 while (isspace(*cmd)) cmd++;
602 expand_arguments = testflag(addr, af_expand_pipe);
603 expand_fail = FAIL;
09792322 604 }
0756eb3c
PH
605else
606 {
607 cmd = ob->cmd;
608 expand_arguments = TRUE;
609 expand_fail = PANIC;
610 }
611
09792322
NK
612/* If no command has been supplied, we are in trouble.
613 * We also check for an empty string since it may be
614 * coming from addr->local_part[0] == '|'
615 */
0756eb3c 616
9214d2e4 617if (!cmd || !*cmd)
0756eb3c
PH
618 {
619 addr->transport_return = DEFER;
620 addr->message = string_sprintf("no command specified for %s transport",
621 tblock->name);
622 return FALSE;
623 }
9214d2e4
JH
624if (is_tainted(cmd))
625 {
626 addr->message = string_sprintf("Tainted '%s' (command "
627 "for %s transport) not permitted", cmd, tblock->name);
628 addr->transport_return = PANIC;
629 return FALSE;
630 }
0756eb3c
PH
631
632/* When a pipe is set up by a filter file, there may be values for $thisaddress
633and numerical the variables in existence. These are passed in
634addr->pipe_expandn for use here. */
635
7b283890 636if (expand_arguments && addr->pipe_expandn)
0756eb3c
PH
637 {
638 uschar **ss = addr->pipe_expandn;
639 expand_nmax = -1;
9214d2e4
JH
640 if (*ss) filter_thisaddress = *ss++;
641 while (*ss)
0756eb3c
PH
642 {
643 expand_nstring[++expand_nmax] = *ss;
644 expand_nlength[expand_nmax] = Ustrlen(*ss++);
645 }
646 }
647
648/* The default way of processing the command is to split it up into arguments
649here, and run it directly. This offers some security advantages. However, there
650are installations that want by default to run commands under /bin/sh always, so
651there is an option to do that. */
652
653if (ob->use_shell)
654 {
655 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
656 tblock->name)) return FALSE;
657 }
658else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
659 tblock->name, ob)) return FALSE;
660
661expand_nmax = -1; /* Reset */
662filter_thisaddress = NULL;
663
664/* Set up the environment for the command. */
665
666envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
667envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
668envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
669envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
670 deliver_localpart_prefix);
671envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
672 deliver_localpart_suffix);
673envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
674envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
675envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
7b283890 676envp[envcount++] = string_sprintf("PATH=%s", expand_string(ob->path));
0756eb3c
PH
677envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
678 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
679 deliver_domain);
680envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
681envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
682envp[envcount++] = US"SHELL=/bin/sh";
683
684if (addr->host_list != NULL)
685 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
686
8768d548 687if (f.timestamps_utc) envp[envcount++] = US"TZ=UTC";
0756eb3c
PH
688else if (timezone_string != NULL && timezone_string[0] != 0)
689 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
690
691/* Add any requested items */
692
55414b25 693if (envlist)
6e0fddef 694 if (!(envlist = expand_cstring(envlist)))
0756eb3c
PH
695 {
696 addr->transport_return = DEFER;
697 addr->message = string_sprintf("failed to expand string \"%s\" "
698 "for %s transport: %s", ob->environment, tblock->name,
699 expand_string_message);
700 return FALSE;
701 }
0756eb3c 702
5903c6ff 703while ((ss = string_nextinlist(&envlist, &envsep, big_buffer, big_buffer_size)))
0756eb3c 704 {
5903c6ff 705 if (envcount > nelem(envp) - 2)
0756eb3c
PH
706 {
707 addr->transport_return = DEFER;
6e0fddef 708 addr->basic_errno = E2BIG;
0756eb3c
PH
709 addr->message = string_sprintf("too many environment settings for "
710 "%s transport", tblock->name);
711 return FALSE;
712 }
713 envp[envcount++] = string_copy(ss);
714 }
715
716envp[envcount] = NULL;
717
718/* If the -N option is set, can't do any more. */
719
8768d548 720if (f.dont_deliver)
0756eb3c
PH
721 {
722 DEBUG(D_transport)
723 debug_printf("*** delivery by %s transport bypassed by -N option",
724 tblock->name);
725 return FALSE;
726 }
727
728
729/* Handling the output from the pipe is tricky. If a file for catching this
730output is provided, we could in theory just hand that fd over to the process,
731but this isn't very safe because it might loop and carry on writing for
732ever (which is exactly what happened in early versions of Exim). Therefore we
733use the standard child_open() function, which creates pipes. We can then read
734our end of the output pipe and count the number of bytes that come through,
735chopping the sub-process if it exceeds some limit.
736
737However, this means we want to run a sub-process with both its input and output
738attached to pipes. We can't handle that easily from a single parent process
739using straightforward code such as the transport_write_message() function
740because the subprocess might not be reading its input because it is trying to
741write to a full output pipe. The complication of redesigning the world to
742handle this is too great - simpler just to run another process to do the
743reading of the output pipe. */
744
745
746/* As this is a local transport, we are already running with the required
747uid/gid and current directory. Request that the new process be a process group
748leader, so we can kill it and all its children on a timeout. */
749
55414b25 750if ((pid = child_open(USS argv, envp, ob->umask, &fd_in, &fd_out, TRUE)) < 0)
0756eb3c
PH
751 {
752 addr->transport_return = DEFER;
753 addr->message = string_sprintf(
754 "Failed to create child process for %s transport: %s", tblock->name,
755 strerror(errno));
756 return FALSE;
757 }
42055a33 758tctx.u.fd = fd_in;
0756eb3c
PH
759
760/* Now fork a process to handle the output that comes down the pipe. */
761
762if ((outpid = fork()) < 0)
763 {
764 addr->basic_errno = errno;
765 addr->transport_return = DEFER;
766 addr->message = string_sprintf(
767 "Failed to create process for handling output in %s transport",
768 tblock->name);
f1e894f3
PH
769 (void)close(fd_in);
770 (void)close(fd_out);
0756eb3c
PH
771 return FALSE;
772 }
773
774/* This is the code for the output-handling subprocess. Read from the pipe
775in chunks, and write to the return file if one is provided. Keep track of
776the number of bytes handled. If the limit is exceeded, try to kill the
777subprocess group, and in any case close the pipe and exit, which should cause
778the subprocess to fail. */
779
780if (outpid == 0)
781 {
782 int count = 0;
f1e894f3 783 (void)close(fd_in);
0756eb3c
PH
784 set_process_info("reading output from |%s", cmd);
785 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
786 {
787 if (addr->return_file >= 0)
1ac6b2e7
JH
788 if(write(addr->return_file, big_buffer, rc) != rc)
789 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
0756eb3c
PH
790 count += rc;
791 if (count > ob->max_output)
792 {
0756eb3c
PH
793 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
794 if (addr->return_file >= 0)
1ac6b2e7
JH
795 {
796 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
797 rc = Ustrlen(message);
798 if(write(addr->return_file, message, rc) != rc)
799 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
800 }
0756eb3c
PH
801 killpg(pid, SIGKILL);
802 break;
803 }
804 }
f1e894f3 805 (void)close(fd_out);
0756eb3c
PH
806 _exit(0);
807 }
808
f1e894f3 809(void)close(fd_out); /* Not used in this process */
0756eb3c
PH
810
811
812/* Carrying on now with the main parent process. Attempt to write the message
813to it down the pipe. It is a fallacy to think that you can detect write errors
814when the sub-process fails to read the pipe. The parent process may complete
815writing and close the pipe before the sub-process completes. We could sleep a
816bit here to let the sub-process get going, but it may still not complete. So we
817ignore all writing errors. (When in the test harness, we do do a short sleep so
818any debugging output is likely to be in the same order.) */
819
9f01e50d 820testharness_pause_ms(500);
0756eb3c
PH
821
822DEBUG(D_transport) debug_printf("Writing message to pipe\n");
823
824/* Arrange to time out writes if there is a timeout set. */
825
826if (timeout > 0)
827 {
828 sigalrm_seen = FALSE;
829 transport_write_timeout = timeout;
830 }
831
832/* Reset the counter of bytes written */
833
834transport_count = 0;
835
836/* First write any configured prefix information */
837
9214d2e4 838if (ob->message_prefix)
0756eb3c
PH
839 {
840 uschar *prefix = expand_string(ob->message_prefix);
9214d2e4 841 if (!prefix)
0756eb3c 842 {
8768d548 843 addr->transport_return = f.search_find_defer? DEFER : PANIC;
0756eb3c
PH
844 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
845 "transport) failed: %s", ob->message_prefix, tblock->name,
846 expand_string_message);
847 return FALSE;
848 }
42055a33 849 if (!transport_write_block(&tctx, prefix, Ustrlen(prefix), FALSE))
0756eb3c
PH
850 goto END_WRITE;
851 }
852
853/* If the use_bsmtp option is set, we need to write SMTP prefix information.
854The various different values for batching are handled outside; if there is more
855than one address available here, all must be included. Force SMTP dot-handling.
856*/
857
858if (ob->use_bsmtp)
859 {
0756eb3c
PH
860 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
861 goto END_WRITE;
862
d7978c0f 863 for (address_item * a = addr; a; a = a->next)
0756eb3c
PH
864 if (!transport_write_string(fd_in,
865 "RCPT TO:<%s>%s",
866 transport_rcpt_address(a, tblock->rcpt_include_affixes),
867 eol))
868 goto END_WRITE;
0756eb3c
PH
869
870 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
871 }
872
65de12cc 873/* Now the actual message */
0756eb3c 874
42055a33 875if (!transport_write_message(&tctx, 0))
0756eb3c
PH
876 goto END_WRITE;
877
878/* Now any configured suffix */
879
7b283890 880if (ob->message_suffix)
0756eb3c
PH
881 {
882 uschar *suffix = expand_string(ob->message_suffix);
7b283890 883 if (!suffix)
0756eb3c 884 {
8768d548 885 addr->transport_return = f.search_find_defer? DEFER : PANIC;
0756eb3c
PH
886 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
887 "transport) failed: %s", ob->message_suffix, tblock->name,
888 expand_string_message);
889 return FALSE;
890 }
42055a33 891 if (!transport_write_block(&tctx, suffix, Ustrlen(suffix), FALSE))
0756eb3c
PH
892 goto END_WRITE;
893 }
894
895/* If local_smtp, write the terminating dot. */
896
897if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
898 goto END_WRITE;
899
900/* Flag all writing completed successfully. */
901
902written_ok = TRUE;
903
904/* Come here if there are errors during writing. */
905
906END_WRITE:
907
908/* OK, the writing is now all done. Close the pipe. */
909
910(void) close(fd_in);
911
912/* Handle errors during writing. For timeouts, set the timeout for waiting for
913the child process to 1 second. If the process at the far end of the pipe died
914without reading all of it, we expect an EPIPE error, which should be ignored.
915We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
916at handling OS where the death of a pipe doesn't give EPIPE immediately. See
2e2a30b4 917comments therein. */
0756eb3c
PH
918
919if (!written_ok)
920 {
921 if (errno == ETIMEDOUT)
2e2a30b4
PH
922 {
923 addr->message = string_sprintf("%stimeout while writing to pipe",
8768d548 924 f.transport_filter_timed_out ? "transport filter " : "");
2e2a30b4 925 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
0756eb3c 926 timeout = 1;
2e2a30b4
PH
927 }
928 else if (errno == EPIPE)
0756eb3c 929 {
2e2a30b4 930 debug_printf("transport error EPIPE ignored\n");
0756eb3c
PH
931 }
932 else
933 {
8e669ac1 934 addr->transport_return = PANIC;
0756eb3c
PH
935 addr->basic_errno = errno;
936 if (errno == ERRNO_CHHEADER_FAIL)
937 addr->message =
938 string_sprintf("Failed to expand headers_add or headers_remove: %s",
939 expand_string_message);
940 else if (errno == ERRNO_FILTER_FAIL)
35af9f61
PH
941 addr->message = string_sprintf("Transport filter process failed (%d)%s",
942 addr->more_errno,
943 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
0756eb3c 944 else if (errno == ERRNO_WRITEINCOMPLETE)
f3ebb786 945 addr->message = US"Failed repeatedly to write data";
0756eb3c
PH
946 else
947 addr->message = string_sprintf("Error %d", errno);
948 return FALSE;
949 }
950 }
951
952/* Wait for the child process to complete and take action if the returned
953status is nonzero. The timeout will be just 1 second if any of the writes
954above timed out. */
955
956if ((rc = child_close(pid, timeout)) != 0)
957 {
9214d2e4
JH
958 uschar * tmsg = addr->message
959 ? string_sprintf(" (preceded by %s)", addr->message) : US"";
22c3b60b 960
0756eb3c
PH
961 /* The process did not complete in time; kill its process group and fail
962 the delivery. It appears to be necessary to kill the output process too, as
963 otherwise it hangs on for some time if the actual pipe process is sleeping.
964 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
965 the delivery, that shouldn't cause any problem. */
966
967 if (rc == -256)
968 {
969 killpg(pid, SIGKILL);
970 kill(outpid, SIGKILL);
2e2a30b4 971 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
22c3b60b 972 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
0756eb3c
PH
973 }
974
975 /* Wait() failed. */
976
977 else if (rc == -257)
978 {
979 addr->transport_return = PANIC;
980 addr->message = string_sprintf("Wait() failed for child process of %s "
22c3b60b 981 "transport: %s%s", tblock->name, strerror(errno), tmsg);
0756eb3c
PH
982 }
983
52383f8f
NM
984 /* Since the transport_filter timed out we assume it has sent the child process
985 a malformed or incomplete data stream. Kill off the child process
986 and prevent checking its exit status as it will has probably exited in error.
987 This prevents the transport_filter timeout message from getting overwritten
988 by the exit error which is not the cause of the problem. */
989
8768d548 990 else if (f.transport_filter_timed_out)
52383f8f
NM
991 {
992 killpg(pid, SIGKILL);
993 kill(outpid, SIGKILL);
994 }
995
0756eb3c
PH
996 /* Either the process completed, but yielded a non-zero (necessarily
997 positive) status, or the process was terminated by a signal (rc will contain
998 the negation of the signal number). Treat killing by signal as failure unless
2fe76745
PP
999 status is being ignored. By default, the message is bounced back, unless
1000 freeze_signal is set, in which case it is frozen instead. */
0756eb3c
PH
1001
1002 else if (rc < 0)
1003 {
2fe76745
PP
1004 if (ob->freeze_signal)
1005 {
1006 addr->transport_return = DEFER;
1007 addr->special_action = SPECIAL_FREEZE;
1008 addr->message = string_sprintf("Child process of %s transport (running "
1009 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1010 -rc, os_strsignal(-rc), tmsg);
1011 }
1012 else if (!ob->ignore_status)
0756eb3c
PH
1013 {
1014 addr->transport_return = FAIL;
1015 addr->message = string_sprintf("Child process of %s transport (running "
22c3b60b
PH
1016 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1017 -rc, os_strsignal(-rc), tmsg);
0756eb3c
PH
1018 }
1019 }
1020
1021 /* For positive values (process terminated with non-zero status), we need a
1022 status code to request deferral. A number of systems contain the following
1023 line in sysexits.h:
1024
1025 #define EX_TEMPFAIL 75
1026
1027 with the description
1028
1029 EX_TEMPFAIL -- temporary failure, indicating something that
1030 is not really an error. In sendmail, this means
1031 that a mailer (e.g.) could not create a connection,
1032 and the request should be reattempted later.
1033
1034 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
1035 not ignoring the returned status. However, there is now an option that
1036 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
1037
1038 Another case that needs special treatment is if execve() failed (typically
1039 the command that was given is a non-existent path). By default this is
1040 treated as just another failure, but if freeze_exec_fail is set, the reaction
1041 is to freeze the message rather than bounce the address. Exim used to signal
4c04137d 1042 this failure with EX_UNAVAILABLE, which is defined in many systems as
0756eb3c
PH
1043
1044 #define EX_UNAVAILABLE 69
1045
1046 with the description
1047
1048 EX_UNAVAILABLE -- A service is unavailable. This can occur
1049 if a support program or file does not exist. This
1050 can also be used as a catchall message when something
1051 you wanted to do doesn't work, but you don't know why.
1052
1053 However, this can be confused with a command that actually returns 69 because
1054 something *it* wanted is unavailable. At release 4.21, Exim was changed to
1055 use return code 127 instead, because this is what the shell returns when it
1056 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
1057 child.c to signal execve() failure and other unexpected failures such as
1058 setuid() not working - though that won't be the case here because we aren't
1059 changing uid. */
1060
1061 else
1062 {
1063 /* Always handle execve() failure specially if requested to */
1064
9214d2e4 1065 if (ob->freeze_exec_fail && rc == EX_EXECFAILED)
0756eb3c
PH
1066 {
1067 addr->transport_return = DEFER;
1068 addr->special_action = SPECIAL_FREEZE;
22c3b60b
PH
1069 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
1070 cmd, tmsg);
0756eb3c
PH
1071 }
1072
1073 /* Otherwise take action only if not ignoring status */
1074
1075 else if (!ob->ignore_status)
1076 {
1077 uschar *ss;
acec9514 1078 gstring * g;
0756eb3c 1079
4c04137d 1080 /* If temp_errors is "*" all codes are temporary. Initialization checks
0756eb3c
PH
1081 that it's either "*" or a list of numbers. If not "*", scan the list of
1082 temporary failure codes; if any match, the result is DEFER. */
1083
1084 if (ob->temp_errors[0] == '*')
1085 addr->transport_return = DEFER;
1086
1087 else
1088 {
55414b25 1089 const uschar *s = ob->temp_errors;
0756eb3c 1090 uschar *p;
0756eb3c
PH
1091 int sep = 0;
1092
1093 addr->transport_return = FAIL;
7b283890 1094 while ((p = string_nextinlist(&s,&sep,NULL,0)))
0756eb3c 1095 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
0756eb3c
PH
1096 }
1097
1098 /* Ensure the message contains the expanded command and arguments. This
1099 doesn't have to be brilliantly efficient - it is an error situation. */
1100
1101 addr->message = string_sprintf("Child process of %s transport returned "
1102 "%d", tblock->name, rc);
acec9514 1103 g = string_cat(NULL, addr->message);
0756eb3c
PH
1104
1105 /* If the return code is > 128, it often means that a shell command
1106 was terminated by a signal. */
1107
1108 ss = (rc > 128)?
1109 string_sprintf("(could mean shell command ended by signal %d (%s))",
1110 rc-128, os_strsignal(rc-128)) :
1111 US os_strexit(rc);
1112
9214d2e4 1113 if (*ss)
0756eb3c 1114 {
acec9514
JH
1115 g = string_catn(g, US" ", 1);
1116 g = string_cat (g, ss);
0756eb3c
PH
1117 }
1118
1119 /* Now add the command and arguments */
1120
acec9514 1121 g = string_catn(g, US" from command:", 14);
0756eb3c 1122
d7978c0f 1123 for (int i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
0756eb3c
PH
1124 {
1125 BOOL quote = FALSE;
acec9514 1126 g = string_catn(g, US" ", 1);
0756eb3c
PH
1127 if (Ustrpbrk(argv[i], " \t") != NULL)
1128 {
1129 quote = TRUE;
acec9514 1130 g = string_catn(g, US"\"", 1);
0756eb3c 1131 }
acec9514 1132 g = string_cat(g, argv[i]);
0756eb3c 1133 if (quote)
acec9514 1134 g = string_catn(g, US"\"", 1);
0756eb3c 1135 }
22c3b60b
PH
1136
1137 /* Add previous filter timeout message, if present. */
1138
c2f669a4 1139 if (*tmsg)
acec9514 1140 g = string_cat(g, tmsg);
22c3b60b 1141
acec9514 1142 addr->message = string_from_gstring(g);
0756eb3c
PH
1143 }
1144 }
1145 }
1146
1147/* Ensure all subprocesses (in particular, the output handling process)
1148are complete before we pass this point. */
1149
1150while (wait(&rc) >= 0);
1151
1152DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1153 addr->transport_return);
1154
1155/* If there has been a problem, the message in addr->message contains details
1156of the pipe command. We don't want to expose these to the world, so we set up
1157something bland to return to the sender. */
1158
1159if (addr->transport_return != OK)
1160 addr->user_message = US"local delivery failed";
1161
1162return FALSE;
1163}
1164
d185889f 1165#endif /*!MACRO_PREDEF*/
0756eb3c 1166/* End of transport/pipe.c */