tidying
[exim.git] / src / src / transports / pipe.c
CommitLineData
0756eb3c
PH
1/*************************************************
2* Exim - an Internet mail transport agent *
3*************************************************/
4
3386088d 5/* Copyright (c) University of Cambridge 1995 - 2015 */
0756eb3c
PH
6/* See the file NOTICE for conditions of use and distribution. */
7
8
9#include "../exim.h"
10#include "pipe.h"
11
79378e0f 12#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
13#include <login_cap.h>
14#endif
15
0756eb3c
PH
16
17
18/* Options specific to the pipe transport. They must be in alphabetic
19order (note that "_" comes before the lower case letters). Those starting
20with "*" are not settable by the user but are used by the option-reading
21software for alternative value types. Some options are stored in the transport
22instance block so as to be publicly visible; these are flagged with opt_public.
23*/
24
25optionlist pipe_transport_options[] = {
26 { "allow_commands", opt_stringptr,
27 (void *)offsetof(pipe_transport_options_block, allow_commands) },
28 { "batch_id", opt_stringptr | opt_public,
29 (void *)offsetof(transport_instance, batch_id) },
30 { "batch_max", opt_int | opt_public,
31 (void *)offsetof(transport_instance, batch_max) },
32 { "check_string", opt_stringptr,
33 (void *)offsetof(pipe_transport_options_block, check_string) },
34 { "command", opt_stringptr,
35 (void *)offsetof(pipe_transport_options_block, cmd) },
36 { "environment", opt_stringptr,
37 (void *)offsetof(pipe_transport_options_block, environment) },
38 { "escape_string", opt_stringptr,
39 (void *)offsetof(pipe_transport_options_block, escape_string) },
09792322
NK
40 { "force_command", opt_bool,
41 (void *)offsetof(pipe_transport_options_block, force_command) },
0756eb3c
PH
42 { "freeze_exec_fail", opt_bool,
43 (void *)offsetof(pipe_transport_options_block, freeze_exec_fail) },
2fe76745
PP
44 { "freeze_signal", opt_bool,
45 (void *)offsetof(pipe_transport_options_block, freeze_signal) },
0756eb3c
PH
46 { "ignore_status", opt_bool,
47 (void *)offsetof(pipe_transport_options_block, ignore_status) },
48 { "log_defer_output", opt_bool | opt_public,
49 (void *)offsetof(transport_instance, log_defer_output) },
50 { "log_fail_output", opt_bool | opt_public,
51 (void *)offsetof(transport_instance, log_fail_output) },
52 { "log_output", opt_bool | opt_public,
53 (void *)offsetof(transport_instance, log_output) },
54 { "max_output", opt_mkint,
55 (void *)offsetof(pipe_transport_options_block, max_output) },
56 { "message_prefix", opt_stringptr,
57 (void *)offsetof(pipe_transport_options_block, message_prefix) },
58 { "message_suffix", opt_stringptr,
59 (void *)offsetof(pipe_transport_options_block, message_suffix) },
60 { "path", opt_stringptr,
61 (void *)offsetof(pipe_transport_options_block, path) },
a29e5231
PP
62 { "permit_coredump", opt_bool,
63 (void *)offsetof(pipe_transport_options_block, permit_coredump) },
0756eb3c
PH
64 { "pipe_as_creator", opt_bool | opt_public,
65 (void *)offsetof(transport_instance, deliver_as_creator) },
66 { "restrict_to_path", opt_bool,
67 (void *)offsetof(pipe_transport_options_block, restrict_to_path) },
68 { "return_fail_output",opt_bool | opt_public,
69 (void *)offsetof(transport_instance, return_fail_output) },
70 { "return_output", opt_bool | opt_public,
71 (void *)offsetof(transport_instance, return_output) },
72 { "temp_errors", opt_stringptr,
73 (void *)offsetof(pipe_transport_options_block, temp_errors) },
74 { "timeout", opt_time,
75 (void *)offsetof(pipe_transport_options_block, timeout) },
2e2a30b4
PH
76 { "timeout_defer", opt_bool,
77 (void *)offsetof(pipe_transport_options_block, timeout_defer) },
0756eb3c
PH
78 { "umask", opt_octint,
79 (void *)offsetof(pipe_transport_options_block, umask) },
80 { "use_bsmtp", opt_bool,
81 (void *)offsetof(pipe_transport_options_block, use_bsmtp) },
79378e0f 82 #ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
83 { "use_classresources", opt_bool,
84 (void *)offsetof(pipe_transport_options_block, use_classresources) },
85 #endif
0756eb3c
PH
86 { "use_crlf", opt_bool,
87 (void *)offsetof(pipe_transport_options_block, use_crlf) },
88 { "use_shell", opt_bool,
89 (void *)offsetof(pipe_transport_options_block, use_shell) },
90};
91
92/* Size of the options list. An extern variable has to be used so that its
93address can appear in the tables drtables.c. */
94
95int pipe_transport_options_count =
96 sizeof(pipe_transport_options)/sizeof(optionlist);
97
d185889f
JH
98
99#ifdef MACRO_PREDEF
100
101/* Dummy values */
102pipe_transport_options_block pipe_transport_option_defaults = {0};
103void pipe_transport_init(transport_instance *tblock) {}
104BOOL pipe_transport_entry(transport_instance *tblock, address_item *addr) {return FALSE;}
105
106#else /*!MACRO_PREDEF*/
107
108
0756eb3c
PH
109/* Default private options block for the pipe transport. */
110
111pipe_transport_options_block pipe_transport_option_defaults = {
112 NULL, /* cmd */
113 NULL, /* allow_commands */
114 NULL, /* environment */
cb741023 115 US"/bin:/usr/bin", /* path */
0756eb3c
PH
116 NULL, /* message_prefix (reset in init if not bsmtp) */
117 NULL, /* message_suffix (ditto) */
118 US mac_expanded_string(EX_TEMPFAIL) ":" /* temp_errors */
119 mac_expanded_string(EX_CANTCREAT),
120 NULL, /* check_string */
121 NULL, /* escape_string */
122 022, /* umask */
123 20480, /* max_output */
124 60*60, /* timeout */
125 0, /* options */
09792322 126 FALSE, /* force_command */
0756eb3c 127 FALSE, /* freeze_exec_fail */
2fe76745 128 FALSE, /* freeze_signal */
0756eb3c 129 FALSE, /* ignore_status */
a29e5231 130 FALSE, /* permit_coredump */
0756eb3c 131 FALSE, /* restrict_to_path */
2e2a30b4 132 FALSE, /* timeout_defer */
0756eb3c
PH
133 FALSE, /* use_shell */
134 FALSE, /* use_bsmtp */
929ba01c 135 FALSE, /* use_classresources */
0756eb3c
PH
136 FALSE /* use_crlf */
137};
138
139
140
141/*************************************************
929ba01c
PH
142* Setup entry point *
143*************************************************/
144
145/* Called for each delivery in the privileged state, just before the uid/gid
146are changed and the main entry point is called. In a system that supports the
147login_cap facilities, this function is used to set the class resource limits
a29e5231 148for the user. It may also re-enable coredumps.
929ba01c
PH
149
150Arguments:
151 tblock points to the transport instance
152 addrlist addresses about to be delivered (not used)
153 dummy not used (doesn't pass back data)
154 uid the uid that will be set (not used)
155 gid the gid that will be set (not used)
156 errmsg where to put an error message
157
158Returns: OK, FAIL, or DEFER
159*/
160
161static int
162pipe_transport_setup(transport_instance *tblock, address_item *addrlist,
163 transport_feedback *dummy, uid_t uid, gid_t gid, uschar **errmsg)
164{
165pipe_transport_options_block *ob =
166 (pipe_transport_options_block *)(tblock->options_block);
167
168addrlist = addrlist; /* Keep compiler happy */
169dummy = dummy;
170uid = uid;
171gid = gid;
172errmsg = errmsg;
173ob = ob;
174
79378e0f 175#ifdef HAVE_SETCLASSRESOURCES
929ba01c
PH
176if (ob->use_classresources)
177 {
178 struct passwd *pw = getpwuid(uid);
179 if (pw != NULL)
180 {
181 login_cap_t *lc = login_getpwclass(pw);
182 if (lc != NULL)
183 {
184 setclassresources(lc);
185 login_close(lc);
186 }
187 }
188 }
189#endif
190
a29e5231
PP
191#ifdef RLIMIT_CORE
192if (ob->permit_coredump)
193 {
194 struct rlimit rl;
195 rl.rlim_cur = RLIM_INFINITY;
196 rl.rlim_max = RLIM_INFINITY;
197 if (setrlimit(RLIMIT_CORE, &rl) < 0)
198 {
199#ifdef SETRLIMIT_NOT_SUPPORTED
200 if (errno != ENOSYS && errno != ENOTSUP)
201#endif
202 log_write(0, LOG_MAIN,
762ca6f3 203 "delivery setrlimit(RLIMIT_CORE, RLIM_INFINITY) failed: %s",
a29e5231
PP
204 strerror(errno));
205 }
206 }
207#endif
208
929ba01c
PH
209return OK;
210}
211
212
213
214/*************************************************
0756eb3c
PH
215* Initialization entry point *
216*************************************************/
217
218/* Called for each instance, after its options have been read, to
219enable consistency checks to be done, or anything else that needs
220to be set up. */
221
222void
223pipe_transport_init(transport_instance *tblock)
224{
225pipe_transport_options_block *ob =
226 (pipe_transport_options_block *)(tblock->options_block);
227
929ba01c
PH
228/* Set up the setup entry point, to be called in the privileged state */
229
230tblock->setup = pipe_transport_setup;
231
0756eb3c
PH
232/* If pipe_as_creator is set, then uid/gid should not be set. */
233
234if (tblock->deliver_as_creator && (tblock->uid_set || tblock->gid_set ||
235 tblock->expand_uid != NULL || tblock->expand_gid != NULL))
236 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
237 "both pipe_as_creator and an explicit uid/gid are set for the %s "
238 "transport", tblock->name);
239
240/* If a fixed uid field is set, then a gid field must also be set. */
241
242if (tblock->uid_set && !tblock->gid_set && tblock->expand_gid == NULL)
243 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
244 "user set without group for the %s transport", tblock->name);
245
246/* Temp_errors must consist only of digits and colons, but there can be
247spaces round the colons, so allow them too. */
248
249if (ob->temp_errors != NULL && Ustrcmp(ob->temp_errors, "*") != 0)
250 {
251 size_t p = Ustrspn(ob->temp_errors, "0123456789: ");
252 if (ob->temp_errors[p] != 0)
253 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
254 "temp_errors must be a list of numbers or an asterisk for the %s "
255 "transport", tblock->name);
256 }
257
258/* Only one of return_output/return_fail_output or log_output/log_fail_output
259should be set. */
260
261if (tblock->return_output && tblock->return_fail_output)
262 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
263 "both return_output and return_fail_output set for %s transport",
264 tblock->name);
265
266if (tblock->log_output && tblock->log_fail_output)
267 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
268 "both log_output and log_fail_output set for the %s transport",
269 tblock->name);
270
271/* If batch SMTP is set, force the check and escape strings, and arrange that
272headers are also escaped. */
273
274if (ob->use_bsmtp)
275 {
276 ob->check_string = US".";
277 ob->escape_string = US"..";
278 ob->options |= topt_escape_headers;
279 }
280
281/* If not batch SMTP, and message_prefix or message_suffix are unset, insert
282default values for them. */
283
284else
285 {
286 if (ob->message_prefix == NULL) ob->message_prefix =
287 US"From ${if def:return_path{$return_path}{MAILER-DAEMON}} ${tod_bsdinbox}\n";
288 if (ob->message_suffix == NULL) ob->message_suffix = US"\n";
289 }
290
291/* The restrict_to_path and use_shell options are incompatible */
292
293if (ob->restrict_to_path && ob->use_shell)
294 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
295 "both restrict_to_path and use_shell set for %s transport",
296 tblock->name);
297
298/* The allow_commands and use_shell options are incompatible */
299
300if (ob->allow_commands && ob->use_shell)
301 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
302 "both allow_commands and use_shell set for %s transport",
303 tblock->name);
304
305/* Set up the bitwise options for transport_write_message from the various
306driver options. Only one of body_only and headers_only can be set. */
307
308ob->options |=
309 (tblock->body_only? topt_no_headers : 0) |
310 (tblock->headers_only? topt_no_body : 0) |
311 (tblock->return_path_add? topt_add_return_path : 0) |
312 (tblock->delivery_date_add? topt_add_delivery_date : 0) |
313 (tblock->envelope_to_add? topt_add_envelope_to : 0) |
314 (ob->use_crlf? topt_use_crlf : 0);
315}
316
317
318
319/*************************************************
320* Set up direct (non-shell) command *
321*************************************************/
322
323/* This function is called when a command line is to be parsed by the transport
324and executed directly, without the use of /bin/sh.
325
326Arguments:
327 argvptr pointer to anchor for argv vector
328 cmd points to the command string
329 expand_arguments true if expansion is to occur
330 expand_fail error if expansion fails
331 addr chain of addresses
332 tname the transport name
333 ob the transport options block
334
335Returns: TRUE if all went well; otherwise an error will be
336 set in the first address and FALSE returned
337*/
338
339static BOOL
55414b25
JH
340set_up_direct_command(const uschar ***argvptr, uschar *cmd,
341 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname,
0756eb3c
PH
342 pipe_transport_options_block *ob)
343{
344BOOL permitted = FALSE;
55414b25 345const uschar **argv;
0756eb3c
PH
346
347/* Set up "transport <name>" to be put in any error messages, and then
348call the common function for creating an argument list and expanding
349the items if necessary. If it fails, this function fails (error information
350is in the addresses). */
351
0756eb3c 352if (!transport_set_up_command(argvptr, cmd, expand_arguments, expand_fail,
7b283890 353 addr, string_sprintf("%.50s transport", tname), NULL))
0756eb3c
PH
354 return FALSE;
355
356/* Point to the set-up arguments. */
357
358argv = *argvptr;
359
360/* If allow_commands is set, see if the command is in the permitted list. */
361
7b283890 362if (ob->allow_commands)
0756eb3c
PH
363 {
364 int sep = 0;
55414b25
JH
365 const uschar *s;
366 uschar *p;
0756eb3c 367
55414b25 368 if (!(s = expand_string(ob->allow_commands)))
0756eb3c
PH
369 {
370 addr->transport_return = DEFER;
371 addr->message = string_sprintf("failed to expand string \"%s\" "
372 "for %s transport: %s", ob->allow_commands, tname, expand_string_message);
373 return FALSE;
374 }
375
7b283890 376 while ((p = string_nextinlist(&s, &sep, NULL, 0)))
0756eb3c 377 if (Ustrcmp(p, argv[0]) == 0) { permitted = TRUE; break; }
0756eb3c
PH
378 }
379
380/* If permitted is TRUE it means the command was found in the allowed list, and
381no further checks are done. If permitted = FALSE, it either means
382allow_commands wasn't set, or that the command didn't match anything in the
383list. In both cases, if restrict_to_path is set, we fail if the command
384contains any slashes, but if restrict_to_path is not set, we must fail the
385command only if allow_commands is set. */
386
387if (!permitted)
388 {
389 if (ob->restrict_to_path)
390 {
391 if (Ustrchr(argv[0], '/') != NULL)
392 {
393 addr->transport_return = FAIL;
394 addr->message = string_sprintf("\"/\" found in \"%s\" (command for %s "
395 "transport) - failed for security reasons", cmd, tname);
396 return FALSE;
397 }
398 }
399
7b283890 400 else if (ob->allow_commands)
0756eb3c
PH
401 {
402 addr->transport_return = FAIL;
403 addr->message = string_sprintf("\"%s\" command not permitted by %s "
404 "transport", argv[0], tname);
405 return FALSE;
406 }
407 }
408
409/* If the command is not an absolute path, search the PATH directories
410for it. */
411
412if (argv[0][0] != '/')
413 {
414 int sep = 0;
415 uschar *p;
7b283890 416 const uschar *listptr = expand_string(ob->path);
0756eb3c 417
7b283890 418 while ((p = string_nextinlist(&listptr, &sep, NULL, 0)))
0756eb3c
PH
419 {
420 struct stat statbuf;
421 sprintf(CS big_buffer, "%.256s/%.256s", p, argv[0]);
422 if (Ustat(big_buffer, &statbuf) == 0)
423 {
424 argv[0] = string_copy(big_buffer);
425 break;
426 }
427 }
7b283890 428 if (!p)
0756eb3c
PH
429 {
430 addr->transport_return = FAIL;
431 addr->message = string_sprintf("\"%s\" command not found for %s transport",
432 argv[0], tname);
433 return FALSE;
434 }
435 }
436
437return TRUE;
438}
439
440
441/*************************************************
442* Set up shell command *
443*************************************************/
444
445/* This function is called when a command line is to be passed to /bin/sh
446without parsing inside the transport.
447
448Arguments:
449 argvptr pointer to anchor for argv vector
450 cmd points to the command string
451 expand_arguments true if expansion is to occur
452 expand_fail error if expansion fails
453 addr chain of addresses
454 tname the transport name
455
456Returns: TRUE if all went well; otherwise an error will be
457 set in the first address and FALSE returned
458*/
459
460static BOOL
55414b25
JH
461set_up_shell_command(const uschar ***argvptr, uschar *cmd,
462 BOOL expand_arguments, int expand_fail, address_item *addr, uschar *tname)
0756eb3c 463{
55414b25 464const uschar **argv;
0756eb3c
PH
465
466*argvptr = argv = store_get((4)*sizeof(uschar *));
467
468argv[0] = US"/bin/sh";
469argv[1] = US"-c";
470
471/* We have to take special action to handle the special "variable" called
472$pipe_addresses, which is not recognized by the normal expansion function. */
473
474DEBUG(D_transport)
475 debug_printf("shell pipe command before expansion:\n %s\n", cmd);
476
477if (expand_arguments)
478 {
479 uschar *s = cmd;
480 uschar *p = Ustrstr(cmd, "pipe_addresses");
481
482 if (p != NULL && (
483 (p > cmd && p[-1] == '$') ||
484 (p > cmd + 1 && p[-2] == '$' && p[-1] == '{' && p[14] == '}')))
485 {
486 address_item *ad;
487 uschar *q = p + 14;
488 int size = Ustrlen(cmd) + 64;
489 int offset;
490
491 if (p[-1] == '{') { q++; p--; }
492
493 s = store_get(size);
494 offset = p - cmd - 1;
495 Ustrncpy(s, cmd, offset);
496
497 for (ad = addr; ad != NULL; ad = ad->next)
498 {
a5bdc7ee
JH
499 /*XXX string_append_listele() ? */
500 if (ad != addr) s = string_catn(s, &size, &offset, US" ", 1);
501 s = string_cat(s, &size, &offset, ad->address);
0756eb3c
PH
502 }
503
a5bdc7ee 504 s = string_cat(s, &size, &offset, q);
0756eb3c
PH
505 s[offset] = 0;
506 }
507
508 /* Allow $recipients in the expansion iff it comes from a system filter */
509
510 enable_dollar_recipients = addr != NULL &&
511 addr->parent != NULL &&
512 Ustrcmp(addr->parent->address, "system-filter") == 0;
513 argv[2] = expand_string(s);
514 enable_dollar_recipients = FALSE;
515
516 if (argv[2] == NULL)
517 {
518 addr->transport_return = search_find_defer? DEFER : expand_fail;
519 addr->message = string_sprintf("Expansion of command \"%s\" "
520 "in %s transport failed: %s",
521 cmd, tname, expand_string_message);
522 return FALSE;
523 }
524
525 DEBUG(D_transport)
526 debug_printf("shell pipe command after expansion:\n %s\n", argv[2]);
527 }
528else argv[2] = cmd;
529
530argv[3] = (uschar *)0;
531return TRUE;
532}
533
534
535
536
537/*************************************************
538* Main entry point *
539*************************************************/
540
541/* See local README for interface details. This transport always returns FALSE,
542indicating that the status in the first address is the status for all addresses
543in a batch. */
544
545BOOL
546pipe_transport_entry(
547 transport_instance *tblock, /* data for this instantiation */
548 address_item *addr) /* address(es) we are working on */
549{
550pid_t pid, outpid;
551int fd_in, fd_out, rc;
552int envcount = 0;
553int envsep = 0;
554int expand_fail;
555pipe_transport_options_block *ob =
556 (pipe_transport_options_block *)(tblock->options_block);
557int timeout = ob->timeout;
558BOOL written_ok = FALSE;
559BOOL expand_arguments;
55414b25 560const uschar **argv;
0756eb3c 561uschar *envp[50];
55414b25 562const uschar *envlist = ob->environment;
0756eb3c 563uschar *cmd, *ss;
6d5c916c 564uschar *eol = ob->use_crlf ? US"\r\n" : US"\n";
65de12cc 565transport_ctx tctx = {
cab0c277 566 {0},
65de12cc
JH
567 tblock,
568 addr,
569 ob->check_string,
570 ob->escape_string,
571 ob->options /* set at initialization time */
572};
0756eb3c
PH
573
574DEBUG(D_transport) debug_printf("%s transport entered\n", tblock->name);
575
576/* Set up for the good case */
577
578addr->transport_return = OK;
579addr->basic_errno = 0;
580
581/* Pipes are not accepted as general addresses, but they can be generated from
582.forward files or alias files. In those cases, the pfr flag is set, and the
583command to be obeyed is pointed to by addr->local_part; it starts with the pipe
584symbol. In other cases, the command is supplied as one of the pipe transport's
585options. */
586
587if (testflag(addr, af_pfr) && addr->local_part[0] == '|')
588 {
700d22f3
PP
589 if (ob->force_command)
590 {
4c04137d 591 /* Enables expansion of $address_pipe into separate arguments */
700d22f3
PP
592 setflag(addr, af_force_command);
593 cmd = ob->cmd;
594 expand_arguments = TRUE;
595 expand_fail = PANIC;
596 }
597 else
598 {
599 cmd = addr->local_part + 1;
600 while (isspace(*cmd)) cmd++;
601 expand_arguments = testflag(addr, af_expand_pipe);
602 expand_fail = FAIL;
09792322 603 }
0756eb3c
PH
604 }
605else
606 {
607 cmd = ob->cmd;
608 expand_arguments = TRUE;
609 expand_fail = PANIC;
610 }
611
09792322
NK
612/* If no command has been supplied, we are in trouble.
613 * We also check for an empty string since it may be
614 * coming from addr->local_part[0] == '|'
615 */
0756eb3c 616
09792322 617if (cmd == NULL || *cmd == '\0')
0756eb3c
PH
618 {
619 addr->transport_return = DEFER;
620 addr->message = string_sprintf("no command specified for %s transport",
621 tblock->name);
622 return FALSE;
623 }
624
625/* When a pipe is set up by a filter file, there may be values for $thisaddress
626and numerical the variables in existence. These are passed in
627addr->pipe_expandn for use here. */
628
7b283890 629if (expand_arguments && addr->pipe_expandn)
0756eb3c
PH
630 {
631 uschar **ss = addr->pipe_expandn;
632 expand_nmax = -1;
633 if (*ss != NULL) filter_thisaddress = *ss++;
634 while (*ss != NULL)
635 {
636 expand_nstring[++expand_nmax] = *ss;
637 expand_nlength[expand_nmax] = Ustrlen(*ss++);
638 }
639 }
640
641/* The default way of processing the command is to split it up into arguments
642here, and run it directly. This offers some security advantages. However, there
643are installations that want by default to run commands under /bin/sh always, so
644there is an option to do that. */
645
646if (ob->use_shell)
647 {
648 if (!set_up_shell_command(&argv, cmd, expand_arguments, expand_fail, addr,
649 tblock->name)) return FALSE;
650 }
651else if (!set_up_direct_command(&argv, cmd, expand_arguments, expand_fail, addr,
652 tblock->name, ob)) return FALSE;
653
654expand_nmax = -1; /* Reset */
655filter_thisaddress = NULL;
656
657/* Set up the environment for the command. */
658
659envp[envcount++] = string_sprintf("LOCAL_PART=%s", deliver_localpart);
660envp[envcount++] = string_sprintf("LOGNAME=%s", deliver_localpart);
661envp[envcount++] = string_sprintf("USER=%s", deliver_localpart);
662envp[envcount++] = string_sprintf("LOCAL_PART_PREFIX=%#s",
663 deliver_localpart_prefix);
664envp[envcount++] = string_sprintf("LOCAL_PART_SUFFIX=%#s",
665 deliver_localpart_suffix);
666envp[envcount++] = string_sprintf("DOMAIN=%s", deliver_domain);
667envp[envcount++] = string_sprintf("HOME=%#s", deliver_home);
668envp[envcount++] = string_sprintf("MESSAGE_ID=%s", message_id);
7b283890 669envp[envcount++] = string_sprintf("PATH=%s", expand_string(ob->path));
0756eb3c
PH
670envp[envcount++] = string_sprintf("RECIPIENT=%#s%#s%#s@%#s",
671 deliver_localpart_prefix, deliver_localpart, deliver_localpart_suffix,
672 deliver_domain);
673envp[envcount++] = string_sprintf("QUALIFY_DOMAIN=%s", qualify_domain_sender);
674envp[envcount++] = string_sprintf("SENDER=%s", sender_address);
675envp[envcount++] = US"SHELL=/bin/sh";
676
677if (addr->host_list != NULL)
678 envp[envcount++] = string_sprintf("HOST=%s", addr->host_list->name);
679
680if (timestamps_utc) envp[envcount++] = US"TZ=UTC";
681else if (timezone_string != NULL && timezone_string[0] != 0)
682 envp[envcount++] = string_sprintf("TZ=%s", timezone_string);
683
684/* Add any requested items */
685
55414b25 686if (envlist)
0756eb3c 687 {
55414b25 688 envlist = expand_cstring(envlist);
0756eb3c
PH
689 if (envlist == NULL)
690 {
691 addr->transport_return = DEFER;
692 addr->message = string_sprintf("failed to expand string \"%s\" "
693 "for %s transport: %s", ob->environment, tblock->name,
694 expand_string_message);
695 return FALSE;
696 }
697 }
698
699while ((ss = string_nextinlist(&envlist, &envsep, big_buffer, big_buffer_size))
700 != NULL)
701 {
702 if (envcount > sizeof(envp)/sizeof(uschar *) - 2)
703 {
704 addr->transport_return = DEFER;
705 addr->message = string_sprintf("too many environment settings for "
706 "%s transport", tblock->name);
707 return FALSE;
708 }
709 envp[envcount++] = string_copy(ss);
710 }
711
712envp[envcount] = NULL;
713
714/* If the -N option is set, can't do any more. */
715
716if (dont_deliver)
717 {
718 DEBUG(D_transport)
719 debug_printf("*** delivery by %s transport bypassed by -N option",
720 tblock->name);
721 return FALSE;
722 }
723
724
725/* Handling the output from the pipe is tricky. If a file for catching this
726output is provided, we could in theory just hand that fd over to the process,
727but this isn't very safe because it might loop and carry on writing for
728ever (which is exactly what happened in early versions of Exim). Therefore we
729use the standard child_open() function, which creates pipes. We can then read
730our end of the output pipe and count the number of bytes that come through,
731chopping the sub-process if it exceeds some limit.
732
733However, this means we want to run a sub-process with both its input and output
734attached to pipes. We can't handle that easily from a single parent process
735using straightforward code such as the transport_write_message() function
736because the subprocess might not be reading its input because it is trying to
737write to a full output pipe. The complication of redesigning the world to
738handle this is too great - simpler just to run another process to do the
739reading of the output pipe. */
740
741
742/* As this is a local transport, we are already running with the required
743uid/gid and current directory. Request that the new process be a process group
744leader, so we can kill it and all its children on a timeout. */
745
55414b25 746if ((pid = child_open(USS argv, envp, ob->umask, &fd_in, &fd_out, TRUE)) < 0)
0756eb3c
PH
747 {
748 addr->transport_return = DEFER;
749 addr->message = string_sprintf(
750 "Failed to create child process for %s transport: %s", tblock->name,
751 strerror(errno));
752 return FALSE;
753 }
42055a33 754tctx.u.fd = fd_in;
0756eb3c
PH
755
756/* Now fork a process to handle the output that comes down the pipe. */
757
758if ((outpid = fork()) < 0)
759 {
760 addr->basic_errno = errno;
761 addr->transport_return = DEFER;
762 addr->message = string_sprintf(
763 "Failed to create process for handling output in %s transport",
764 tblock->name);
f1e894f3
PH
765 (void)close(fd_in);
766 (void)close(fd_out);
0756eb3c
PH
767 return FALSE;
768 }
769
770/* This is the code for the output-handling subprocess. Read from the pipe
771in chunks, and write to the return file if one is provided. Keep track of
772the number of bytes handled. If the limit is exceeded, try to kill the
773subprocess group, and in any case close the pipe and exit, which should cause
774the subprocess to fail. */
775
776if (outpid == 0)
777 {
778 int count = 0;
f1e894f3 779 (void)close(fd_in);
0756eb3c
PH
780 set_process_info("reading output from |%s", cmd);
781 while ((rc = read(fd_out, big_buffer, big_buffer_size)) > 0)
782 {
783 if (addr->return_file >= 0)
1ac6b2e7
JH
784 if(write(addr->return_file, big_buffer, rc) != rc)
785 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
0756eb3c
PH
786 count += rc;
787 if (count > ob->max_output)
788 {
0756eb3c
PH
789 DEBUG(D_transport) debug_printf("Too much output from pipe - killed\n");
790 if (addr->return_file >= 0)
1ac6b2e7
JH
791 {
792 uschar *message = US"\n\n*** Too much output - remainder discarded ***\n";
793 rc = Ustrlen(message);
794 if(write(addr->return_file, message, rc) != rc)
795 DEBUG(D_transport) debug_printf("Problem writing to return_file\n");
796 }
0756eb3c
PH
797 killpg(pid, SIGKILL);
798 break;
799 }
800 }
f1e894f3 801 (void)close(fd_out);
0756eb3c
PH
802 _exit(0);
803 }
804
f1e894f3 805(void)close(fd_out); /* Not used in this process */
0756eb3c
PH
806
807
808/* Carrying on now with the main parent process. Attempt to write the message
809to it down the pipe. It is a fallacy to think that you can detect write errors
810when the sub-process fails to read the pipe. The parent process may complete
811writing and close the pipe before the sub-process completes. We could sleep a
812bit here to let the sub-process get going, but it may still not complete. So we
813ignore all writing errors. (When in the test harness, we do do a short sleep so
814any debugging output is likely to be in the same order.) */
815
816if (running_in_test_harness) millisleep(500);
817
818DEBUG(D_transport) debug_printf("Writing message to pipe\n");
819
820/* Arrange to time out writes if there is a timeout set. */
821
822if (timeout > 0)
823 {
824 sigalrm_seen = FALSE;
825 transport_write_timeout = timeout;
826 }
827
828/* Reset the counter of bytes written */
829
830transport_count = 0;
831
832/* First write any configured prefix information */
833
834if (ob->message_prefix != NULL)
835 {
836 uschar *prefix = expand_string(ob->message_prefix);
837 if (prefix == NULL)
838 {
839 addr->transport_return = search_find_defer? DEFER : PANIC;
840 addr->message = string_sprintf("Expansion of \"%s\" (prefix for %s "
841 "transport) failed: %s", ob->message_prefix, tblock->name,
842 expand_string_message);
843 return FALSE;
844 }
42055a33 845 if (!transport_write_block(&tctx, prefix, Ustrlen(prefix), FALSE))
0756eb3c
PH
846 goto END_WRITE;
847 }
848
849/* If the use_bsmtp option is set, we need to write SMTP prefix information.
850The various different values for batching are handled outside; if there is more
851than one address available here, all must be included. Force SMTP dot-handling.
852*/
853
854if (ob->use_bsmtp)
855 {
856 address_item *a;
857
858 if (!transport_write_string(fd_in, "MAIL FROM:<%s>%s", return_path, eol))
859 goto END_WRITE;
860
65de12cc 861 for (a = addr; a; a = a->next)
0756eb3c
PH
862 if (!transport_write_string(fd_in,
863 "RCPT TO:<%s>%s",
864 transport_rcpt_address(a, tblock->rcpt_include_affixes),
865 eol))
866 goto END_WRITE;
0756eb3c
PH
867
868 if (!transport_write_string(fd_in, "DATA%s", eol)) goto END_WRITE;
869 }
870
65de12cc 871/* Now the actual message */
0756eb3c 872
42055a33 873if (!transport_write_message(&tctx, 0))
0756eb3c
PH
874 goto END_WRITE;
875
876/* Now any configured suffix */
877
7b283890 878if (ob->message_suffix)
0756eb3c
PH
879 {
880 uschar *suffix = expand_string(ob->message_suffix);
7b283890 881 if (!suffix)
0756eb3c
PH
882 {
883 addr->transport_return = search_find_defer? DEFER : PANIC;
884 addr->message = string_sprintf("Expansion of \"%s\" (suffix for %s "
885 "transport) failed: %s", ob->message_suffix, tblock->name,
886 expand_string_message);
887 return FALSE;
888 }
42055a33 889 if (!transport_write_block(&tctx, suffix, Ustrlen(suffix), FALSE))
0756eb3c
PH
890 goto END_WRITE;
891 }
892
893/* If local_smtp, write the terminating dot. */
894
895if (ob->use_bsmtp && !transport_write_string(fd_in, ".%s", eol))
896 goto END_WRITE;
897
898/* Flag all writing completed successfully. */
899
900written_ok = TRUE;
901
902/* Come here if there are errors during writing. */
903
904END_WRITE:
905
906/* OK, the writing is now all done. Close the pipe. */
907
908(void) close(fd_in);
909
910/* Handle errors during writing. For timeouts, set the timeout for waiting for
911the child process to 1 second. If the process at the far end of the pipe died
912without reading all of it, we expect an EPIPE error, which should be ignored.
913We used also to ignore WRITEINCOMPLETE but the writing function is now cleverer
914at handling OS where the death of a pipe doesn't give EPIPE immediately. See
2e2a30b4 915comments therein. */
0756eb3c
PH
916
917if (!written_ok)
918 {
919 if (errno == ETIMEDOUT)
2e2a30b4
PH
920 {
921 addr->message = string_sprintf("%stimeout while writing to pipe",
922 transport_filter_timed_out? "transport filter " : "");
923 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
0756eb3c 924 timeout = 1;
2e2a30b4
PH
925 }
926 else if (errno == EPIPE)
0756eb3c 927 {
2e2a30b4 928 debug_printf("transport error EPIPE ignored\n");
0756eb3c
PH
929 }
930 else
931 {
8e669ac1 932 addr->transport_return = PANIC;
0756eb3c
PH
933 addr->basic_errno = errno;
934 if (errno == ERRNO_CHHEADER_FAIL)
935 addr->message =
936 string_sprintf("Failed to expand headers_add or headers_remove: %s",
937 expand_string_message);
938 else if (errno == ERRNO_FILTER_FAIL)
35af9f61
PH
939 addr->message = string_sprintf("Transport filter process failed (%d)%s",
940 addr->more_errno,
941 (addr->more_errno == EX_EXECFAILED)? ": unable to execute command" : "");
0756eb3c
PH
942 else if (errno == ERRNO_WRITEINCOMPLETE)
943 addr->message = string_sprintf("Failed repeatedly to write data");
944 else
945 addr->message = string_sprintf("Error %d", errno);
946 return FALSE;
947 }
948 }
949
950/* Wait for the child process to complete and take action if the returned
951status is nonzero. The timeout will be just 1 second if any of the writes
952above timed out. */
953
954if ((rc = child_close(pid, timeout)) != 0)
955 {
22c3b60b
PH
956 uschar *tmsg = (addr->message == NULL)? US"" :
957 string_sprintf(" (preceded by %s)", addr->message);
958
0756eb3c
PH
959 /* The process did not complete in time; kill its process group and fail
960 the delivery. It appears to be necessary to kill the output process too, as
961 otherwise it hangs on for some time if the actual pipe process is sleeping.
962 (At least, that's what I observed on Solaris 2.5.1.) Since we are failing
963 the delivery, that shouldn't cause any problem. */
964
965 if (rc == -256)
966 {
967 killpg(pid, SIGKILL);
968 kill(outpid, SIGKILL);
2e2a30b4 969 addr->transport_return = ob->timeout_defer? DEFER : FAIL;
22c3b60b 970 addr->message = string_sprintf("pipe delivery process timed out%s", tmsg);
0756eb3c
PH
971 }
972
973 /* Wait() failed. */
974
975 else if (rc == -257)
976 {
977 addr->transport_return = PANIC;
978 addr->message = string_sprintf("Wait() failed for child process of %s "
22c3b60b 979 "transport: %s%s", tblock->name, strerror(errno), tmsg);
0756eb3c
PH
980 }
981
52383f8f
NM
982 /* Since the transport_filter timed out we assume it has sent the child process
983 a malformed or incomplete data stream. Kill off the child process
984 and prevent checking its exit status as it will has probably exited in error.
985 This prevents the transport_filter timeout message from getting overwritten
986 by the exit error which is not the cause of the problem. */
987
988 else if (transport_filter_timed_out)
989 {
990 killpg(pid, SIGKILL);
991 kill(outpid, SIGKILL);
992 }
993
0756eb3c
PH
994 /* Either the process completed, but yielded a non-zero (necessarily
995 positive) status, or the process was terminated by a signal (rc will contain
996 the negation of the signal number). Treat killing by signal as failure unless
2fe76745
PP
997 status is being ignored. By default, the message is bounced back, unless
998 freeze_signal is set, in which case it is frozen instead. */
0756eb3c
PH
999
1000 else if (rc < 0)
1001 {
2fe76745
PP
1002 if (ob->freeze_signal)
1003 {
1004 addr->transport_return = DEFER;
1005 addr->special_action = SPECIAL_FREEZE;
1006 addr->message = string_sprintf("Child process of %s transport (running "
1007 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1008 -rc, os_strsignal(-rc), tmsg);
1009 }
1010 else if (!ob->ignore_status)
0756eb3c
PH
1011 {
1012 addr->transport_return = FAIL;
1013 addr->message = string_sprintf("Child process of %s transport (running "
22c3b60b
PH
1014 "command \"%s\") was terminated by signal %d (%s)%s", tblock->name, cmd,
1015 -rc, os_strsignal(-rc), tmsg);
0756eb3c
PH
1016 }
1017 }
1018
1019 /* For positive values (process terminated with non-zero status), we need a
1020 status code to request deferral. A number of systems contain the following
1021 line in sysexits.h:
1022
1023 #define EX_TEMPFAIL 75
1024
1025 with the description
1026
1027 EX_TEMPFAIL -- temporary failure, indicating something that
1028 is not really an error. In sendmail, this means
1029 that a mailer (e.g.) could not create a connection,
1030 and the request should be reattempted later.
1031
1032 Based on this, we use exit code EX_TEMPFAIL as a default to mean "defer" when
1033 not ignoring the returned status. However, there is now an option that
1034 contains a list of temporary codes, with TEMPFAIL and CANTCREAT as defaults.
1035
1036 Another case that needs special treatment is if execve() failed (typically
1037 the command that was given is a non-existent path). By default this is
1038 treated as just another failure, but if freeze_exec_fail is set, the reaction
1039 is to freeze the message rather than bounce the address. Exim used to signal
4c04137d 1040 this failure with EX_UNAVAILABLE, which is defined in many systems as
0756eb3c
PH
1041
1042 #define EX_UNAVAILABLE 69
1043
1044 with the description
1045
1046 EX_UNAVAILABLE -- A service is unavailable. This can occur
1047 if a support program or file does not exist. This
1048 can also be used as a catchall message when something
1049 you wanted to do doesn't work, but you don't know why.
1050
1051 However, this can be confused with a command that actually returns 69 because
1052 something *it* wanted is unavailable. At release 4.21, Exim was changed to
1053 use return code 127 instead, because this is what the shell returns when it
1054 is unable to exec a command. We define it as EX_EXECFAILED, and use it in
1055 child.c to signal execve() failure and other unexpected failures such as
1056 setuid() not working - though that won't be the case here because we aren't
1057 changing uid. */
1058
1059 else
1060 {
1061 /* Always handle execve() failure specially if requested to */
1062
1063 if (ob->freeze_exec_fail && (rc == EX_EXECFAILED))
1064 {
1065 addr->transport_return = DEFER;
1066 addr->special_action = SPECIAL_FREEZE;
22c3b60b
PH
1067 addr->message = string_sprintf("pipe process failed to exec \"%s\"%s",
1068 cmd, tmsg);
0756eb3c
PH
1069 }
1070
1071 /* Otherwise take action only if not ignoring status */
1072
1073 else if (!ob->ignore_status)
1074 {
1075 uschar *ss;
1076 int size, ptr, i;
1077
4c04137d 1078 /* If temp_errors is "*" all codes are temporary. Initialization checks
0756eb3c
PH
1079 that it's either "*" or a list of numbers. If not "*", scan the list of
1080 temporary failure codes; if any match, the result is DEFER. */
1081
1082 if (ob->temp_errors[0] == '*')
1083 addr->transport_return = DEFER;
1084
1085 else
1086 {
55414b25 1087 const uschar *s = ob->temp_errors;
0756eb3c 1088 uschar *p;
0756eb3c
PH
1089 int sep = 0;
1090
1091 addr->transport_return = FAIL;
7b283890 1092 while ((p = string_nextinlist(&s,&sep,NULL,0)))
0756eb3c 1093 if (rc == Uatoi(p)) { addr->transport_return = DEFER; break; }
0756eb3c
PH
1094 }
1095
1096 /* Ensure the message contains the expanded command and arguments. This
1097 doesn't have to be brilliantly efficient - it is an error situation. */
1098
1099 addr->message = string_sprintf("Child process of %s transport returned "
1100 "%d", tblock->name, rc);
1101
1102 ptr = Ustrlen(addr->message);
1103 size = ptr + 1;
1104
1105 /* If the return code is > 128, it often means that a shell command
1106 was terminated by a signal. */
1107
1108 ss = (rc > 128)?
1109 string_sprintf("(could mean shell command ended by signal %d (%s))",
1110 rc-128, os_strsignal(rc-128)) :
1111 US os_strexit(rc);
1112
1113 if (*ss != 0)
1114 {
c2f669a4
JH
1115 addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
1116 addr->message = string_cat (addr->message, &size, &ptr, ss);
0756eb3c
PH
1117 }
1118
1119 /* Now add the command and arguments */
1120
c2f669a4 1121 addr->message = string_catn(addr->message, &size, &ptr,
0756eb3c
PH
1122 US" from command:", 14);
1123
1124 for (i = 0; i < sizeof(argv)/sizeof(int *) && argv[i] != NULL; i++)
1125 {
1126 BOOL quote = FALSE;
c2f669a4 1127 addr->message = string_catn(addr->message, &size, &ptr, US" ", 1);
0756eb3c
PH
1128 if (Ustrpbrk(argv[i], " \t") != NULL)
1129 {
1130 quote = TRUE;
c2f669a4 1131 addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
0756eb3c 1132 }
c2f669a4 1133 addr->message = string_cat(addr->message, &size, &ptr, argv[i]);
0756eb3c 1134 if (quote)
c2f669a4 1135 addr->message = string_catn(addr->message, &size, &ptr, US"\"", 1);
0756eb3c 1136 }
22c3b60b
PH
1137
1138 /* Add previous filter timeout message, if present. */
1139
c2f669a4
JH
1140 if (*tmsg)
1141 addr->message = string_cat(addr->message, &size, &ptr, tmsg);
22c3b60b 1142
0756eb3c
PH
1143 addr->message[ptr] = 0; /* Ensure concatenated string terminated */
1144 }
1145 }
1146 }
1147
1148/* Ensure all subprocesses (in particular, the output handling process)
1149are complete before we pass this point. */
1150
1151while (wait(&rc) >= 0);
1152
1153DEBUG(D_transport) debug_printf("%s transport yielded %d\n", tblock->name,
1154 addr->transport_return);
1155
1156/* If there has been a problem, the message in addr->message contains details
1157of the pipe command. We don't want to expose these to the world, so we set up
1158something bland to return to the sender. */
1159
1160if (addr->transport_return != OK)
1161 addr->user_message = US"local delivery failed";
1162
1163return FALSE;
1164}
1165
d185889f 1166#endif /*!MACRO_PREDEF*/
0756eb3c 1167/* End of transport/pipe.c */