Routers: make retry_use_local_part default true when any non-domain condition is...
[exim.git] / src / src / deliver.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* The main code for delivering a message. */
9
10
11 #include "exim.h"
12 #include "transports/smtp.h"
13 #include <sys/uio.h>
14 #include <assert.h>
15
16
17 /* Data block for keeping track of subprocesses for parallel remote
18 delivery. */
19
20 typedef struct pardata {
21 address_item *addrlist; /* chain of addresses */
22 address_item *addr; /* next address data expected for */
23 pid_t pid; /* subprocess pid */
24 int fd; /* pipe fd for getting result from subprocess */
25 int transport_count; /* returned transport count value */
26 BOOL done; /* no more data needed */
27 uschar *msg; /* error message */
28 uschar *return_path; /* return_path for these addresses */
29 } pardata;
30
31 /* Values for the process_recipients variable */
32
33 enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
34 RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
35 RECIP_FAIL_LOOP};
36
37 /* Mutually recursive functions for marking addresses done. */
38
39 static void child_done(address_item *, uschar *);
40 static void address_done(address_item *, uschar *);
41
42 /* Table for turning base-62 numbers into binary */
43
44 static uschar tab62[] =
45 {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
46 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
47 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
48 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
49 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
50 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
51 59,60,61}; /* x-z */
52
53
54 /*************************************************
55 * Local static variables *
56 *************************************************/
57
58 /* addr_duplicate is global because it needs to be seen from the Envelope-To
59 writing code. */
60
61 static address_item *addr_defer = NULL;
62 static address_item *addr_failed = NULL;
63 static address_item *addr_fallback = NULL;
64 static address_item *addr_local = NULL;
65 static address_item *addr_new = NULL;
66 static address_item *addr_remote = NULL;
67 static address_item *addr_route = NULL;
68 static address_item *addr_succeed = NULL;
69 static address_item *addr_senddsn = NULL;
70
71 static FILE *message_log = NULL;
72 static BOOL update_spool;
73 static BOOL remove_journal;
74 static int parcount = 0;
75 static pardata *parlist = NULL;
76 static int return_count;
77 static uschar *frozen_info = US"";
78 static uschar *used_return_path = NULL;
79
80
81
82 /*************************************************
83 * read as much as requested *
84 *************************************************/
85
86 /* The syscall read(2) doesn't always returns as much as we want. For
87 several reasons it might get less. (Not talking about signals, as syscalls
88 are restartable). When reading from a network or pipe connection the sender
89 might send in smaller chunks, with delays between these chunks. The read(2)
90 may return such a chunk.
91
92 The more the writer writes and the smaller the pipe between write and read is,
93 the more we get the chance of reading leass than requested. (See bug 2130)
94
95 This function read(2)s until we got all the data we *requested*.
96
97 Note: This function may block. Use it only if you're sure about the
98 amount of data you will get.
99
100 Argument:
101 fd the file descriptor to read from
102 buffer pointer to a buffer of size len
103 len the requested(!) amount of bytes
104
105 Returns: the amount of bytes read
106 */
107 static ssize_t
108 readn(int fd, void * buffer, size_t len)
109 {
110 uschar * next = buffer;
111 uschar * end = next + len;
112
113 while (next < end)
114 {
115 ssize_t got = read(fd, next, end - next);
116
117 /* I'm not sure if there are signals that can interrupt us,
118 for now I assume the worst */
119 if (got == -1 && errno == EINTR) continue;
120 if (got <= 0) return next - US buffer;
121 next += got;
122 }
123
124 return len;
125 }
126
127
128 /*************************************************
129 * Make a new address item *
130 *************************************************/
131
132 /* This function gets the store and initializes with default values. The
133 transport_return value defaults to DEFER, so that any unexpected failure to
134 deliver does not wipe out the message. The default unique string is set to a
135 copy of the address, so that its domain can be lowercased.
136
137 Argument:
138 address the RFC822 address string
139 copy force a copy of the address
140
141 Returns: a pointer to an initialized address_item
142 */
143
144 address_item *
145 deliver_make_addr(uschar *address, BOOL copy)
146 {
147 address_item *addr = store_get(sizeof(address_item), FALSE);
148 *addr = address_defaults;
149 if (copy) address = string_copy(address);
150 addr->address = address;
151 addr->unique = string_copy(address);
152 return addr;
153 }
154
155
156
157
158 /*************************************************
159 * Set expansion values for an address *
160 *************************************************/
161
162 /* Certain expansion variables are valid only when handling an address or
163 address list. This function sets them up or clears the values, according to its
164 argument.
165
166 Arguments:
167 addr the address in question, or NULL to clear values
168 Returns: nothing
169 */
170
171 void
172 deliver_set_expansions(address_item *addr)
173 {
174 if (!addr)
175 {
176 const uschar ***p = address_expansions;
177 while (*p) **p++ = NULL;
178 return;
179 }
180
181 /* Exactly what gets set depends on whether there is one or more addresses, and
182 what they contain. These first ones are always set, taking their values from
183 the first address. */
184
185 if (!addr->host_list)
186 {
187 deliver_host = deliver_host_address = US"";
188 deliver_host_port = 0;
189 }
190 else
191 {
192 deliver_host = addr->host_list->name;
193 deliver_host_address = addr->host_list->address;
194 deliver_host_port = addr->host_list->port;
195 }
196
197 deliver_recipients = addr;
198 deliver_address_data = addr->prop.address_data;
199 deliver_domain_data = addr->prop.domain_data;
200 deliver_localpart_data = addr->prop.localpart_data;
201 router_var = addr->prop.variables;
202
203 /* These may be unset for multiple addresses */
204
205 deliver_domain = addr->domain;
206 self_hostname = addr->self_hostname;
207
208 #ifdef EXPERIMENTAL_BRIGHTMAIL
209 bmi_deliver = 1; /* deliver by default */
210 bmi_alt_location = NULL;
211 bmi_base64_verdict = NULL;
212 bmi_base64_tracker_verdict = NULL;
213 #endif
214
215 /* If there's only one address we can set everything. */
216
217 if (!addr->next)
218 {
219 address_item *addr_orig;
220
221 deliver_localpart = addr->local_part;
222 deliver_localpart_prefix = addr->prefix;
223 deliver_localpart_suffix = addr->suffix;
224
225 for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
226 deliver_domain_orig = addr_orig->domain;
227
228 /* Re-instate any prefix and suffix in the original local part. In all
229 normal cases, the address will have a router associated with it, and we can
230 choose the caseful or caseless version accordingly. However, when a system
231 filter sets up a pipe, file, or autoreply delivery, no router is involved.
232 In this case, though, there won't be any prefix or suffix to worry about. */
233
234 deliver_localpart_orig = !addr_orig->router
235 ? addr_orig->local_part
236 : addr_orig->router->caseful_local_part
237 ? addr_orig->cc_local_part
238 : addr_orig->lc_local_part;
239
240 /* If there's a parent, make its domain and local part available, and if
241 delivering to a pipe or file, or sending an autoreply, get the local
242 part from the parent. For pipes and files, put the pipe or file string
243 into address_pipe and address_file. */
244
245 if (addr->parent)
246 {
247 deliver_domain_parent = addr->parent->domain;
248 deliver_localpart_parent = !addr->parent->router
249 ? addr->parent->local_part
250 : addr->parent->router->caseful_local_part
251 ? addr->parent->cc_local_part
252 : addr->parent->lc_local_part;
253
254 /* File deliveries have their own flag because they need to be picked out
255 as special more often. */
256
257 if (testflag(addr, af_pfr))
258 {
259 if (testflag(addr, af_file)) address_file = addr->local_part;
260 else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
261 deliver_localpart = addr->parent->local_part;
262 deliver_localpart_prefix = addr->parent->prefix;
263 deliver_localpart_suffix = addr->parent->suffix;
264 }
265 }
266
267 #ifdef EXPERIMENTAL_BRIGHTMAIL
268 /* Set expansion variables related to Brightmail AntiSpam */
269 bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
270 bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
271 /* get message delivery status (0 - don't deliver | 1 - deliver) */
272 bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
273 /* if message is to be delivered, get eventual alternate location */
274 if (bmi_deliver == 1)
275 bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
276 #endif
277
278 }
279
280 /* For multiple addresses, don't set local part, and leave the domain and
281 self_hostname set only if it is the same for all of them. It is possible to
282 have multiple pipe and file addresses, but only when all addresses have routed
283 to the same pipe or file. */
284
285 else
286 {
287 if (testflag(addr, af_pfr))
288 {
289 if (testflag(addr, af_file)) address_file = addr->local_part;
290 else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
291 }
292 for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
293 {
294 if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
295 deliver_domain = NULL;
296 if ( self_hostname
297 && ( !addr2->self_hostname
298 || Ustrcmp(self_hostname, addr2->self_hostname) != 0
299 ) )
300 self_hostname = NULL;
301 if (!deliver_domain && !self_hostname) break;
302 }
303 }
304 }
305
306
307
308
309 /*************************************************
310 * Open a msglog file *
311 *************************************************/
312
313 /* This function is used both for normal message logs, and for files in the
314 msglog directory that are used to catch output from pipes. Try to create the
315 directory if it does not exist. From release 4.21, normal message logs should
316 be created when the message is received.
317
318 Called from deliver_message(), can be operating as root.
319
320 Argument:
321 filename the file name
322 mode the mode required
323 error used for saying what failed
324
325 Returns: a file descriptor, or -1 (with errno set)
326 */
327
328 static int
329 open_msglog_file(uschar *filename, int mode, uschar **error)
330 {
331 for (int i = 2; i > 0; i--)
332 {
333 int fd = Uopen(filename,
334 #ifdef O_CLOEXEC
335 O_CLOEXEC |
336 #endif
337 #ifdef O_NOFOLLOW
338 O_NOFOLLOW |
339 #endif
340 O_WRONLY|O_APPEND|O_CREAT, mode);
341 if (fd >= 0)
342 {
343 /* Set the close-on-exec flag and change the owner to the exim uid/gid (this
344 function is called as root). Double check the mode, because the group setting
345 doesn't always get set automatically. */
346
347 #ifndef O_CLOEXEC
348 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
349 #endif
350 if (exim_fchown(fd, exim_uid, exim_gid, filename) < 0)
351 {
352 *error = US"chown";
353 return -1;
354 }
355 if (fchmod(fd, mode) < 0)
356 {
357 *error = US"chmod";
358 return -1;
359 }
360 return fd;
361 }
362 if (errno != ENOENT)
363 break;
364
365 (void)directory_make(spool_directory,
366 spool_sname(US"msglog", message_subdir),
367 MSGLOG_DIRECTORY_MODE, TRUE);
368 }
369
370 *error = US"create or open";
371 return -1;
372 }
373
374
375
376
377 /*************************************************
378 * Write to msglog if required *
379 *************************************************/
380
381 /* Write to the message log, if configured. This function may also be called
382 from transports.
383
384 Arguments:
385 format a string format
386
387 Returns: nothing
388 */
389
390 void
391 deliver_msglog(const char *format, ...)
392 {
393 va_list ap;
394 if (!message_logs) return;
395 va_start(ap, format);
396 vfprintf(message_log, format, ap);
397 fflush(message_log);
398 va_end(ap);
399 }
400
401
402
403
404 /*************************************************
405 * Replicate status for batch *
406 *************************************************/
407
408 /* When a transport handles a batch of addresses, it may treat them
409 individually, or it may just put the status in the first one, and return FALSE,
410 requesting that the status be copied to all the others externally. This is the
411 replication function. As well as the status, it copies the transport pointer,
412 which may have changed if appendfile passed the addresses on to a different
413 transport.
414
415 Argument: pointer to the first address in a chain
416 Returns: nothing
417 */
418
419 static void
420 replicate_status(address_item *addr)
421 {
422 for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
423 {
424 addr2->transport = addr->transport;
425 addr2->transport_return = addr->transport_return;
426 addr2->basic_errno = addr->basic_errno;
427 addr2->more_errno = addr->more_errno;
428 addr2->delivery_usec = addr->delivery_usec;
429 addr2->special_action = addr->special_action;
430 addr2->message = addr->message;
431 addr2->user_message = addr->user_message;
432 }
433 }
434
435
436
437 /*************************************************
438 * Compare lists of hosts *
439 *************************************************/
440
441 /* This function is given two pointers to chains of host items, and it yields
442 TRUE if the lists refer to the same hosts in the same order, except that
443
444 (1) Multiple hosts with the same non-negative MX values are permitted to appear
445 in different orders. Round-robinning nameservers can cause this to happen.
446
447 (2) Multiple hosts with the same negative MX values less than MX_NONE are also
448 permitted to appear in different orders. This is caused by randomizing
449 hosts lists.
450
451 This enables Exim to use a single SMTP transaction for sending to two entirely
452 different domains that happen to end up pointing at the same hosts.
453
454 Arguments:
455 one points to the first host list
456 two points to the second host list
457
458 Returns: TRUE if the lists refer to the same host set
459 */
460
461 static BOOL
462 same_hosts(host_item *one, host_item *two)
463 {
464 while (one && two)
465 {
466 if (Ustrcmp(one->name, two->name) != 0)
467 {
468 int mx = one->mx;
469 host_item *end_one = one;
470 host_item *end_two = two;
471
472 /* Batch up only if there was no MX and the list was not randomized */
473
474 if (mx == MX_NONE) return FALSE;
475
476 /* Find the ends of the shortest sequence of identical MX values */
477
478 while ( end_one->next && end_one->next->mx == mx
479 && end_two->next && end_two->next->mx == mx)
480 {
481 end_one = end_one->next;
482 end_two = end_two->next;
483 }
484
485 /* If there aren't any duplicates, there's no match. */
486
487 if (end_one == one) return FALSE;
488
489 /* For each host in the 'one' sequence, check that it appears in the 'two'
490 sequence, returning FALSE if not. */
491
492 for (;;)
493 {
494 host_item *hi;
495 for (hi = two; hi != end_two->next; hi = hi->next)
496 if (Ustrcmp(one->name, hi->name) == 0) break;
497 if (hi == end_two->next) return FALSE;
498 if (one == end_one) break;
499 one = one->next;
500 }
501
502 /* All the hosts in the 'one' sequence were found in the 'two' sequence.
503 Ensure both are pointing at the last host, and carry on as for equality. */
504
505 two = end_two;
506 }
507
508 /* if the names matched but ports do not, mismatch */
509 else if (one->port != two->port)
510 return FALSE;
511
512 /* Hosts matched */
513
514 one = one->next;
515 two = two->next;
516 }
517
518 /* True if both are NULL */
519
520 return (one == two);
521 }
522
523
524
525 /*************************************************
526 * Compare header lines *
527 *************************************************/
528
529 /* This function is given two pointers to chains of header items, and it yields
530 TRUE if they are the same header texts in the same order.
531
532 Arguments:
533 one points to the first header list
534 two points to the second header list
535
536 Returns: TRUE if the lists refer to the same header set
537 */
538
539 static BOOL
540 same_headers(header_line *one, header_line *two)
541 {
542 for (;; one = one->next, two = two->next)
543 {
544 if (one == two) return TRUE; /* Includes the case where both NULL */
545 if (!one || !two) return FALSE;
546 if (Ustrcmp(one->text, two->text) != 0) return FALSE;
547 }
548 }
549
550
551
552 /*************************************************
553 * Compare string settings *
554 *************************************************/
555
556 /* This function is given two pointers to strings, and it returns
557 TRUE if they are the same pointer, or if the two strings are the same.
558
559 Arguments:
560 one points to the first string
561 two points to the second string
562
563 Returns: TRUE or FALSE
564 */
565
566 static BOOL
567 same_strings(uschar *one, uschar *two)
568 {
569 if (one == two) return TRUE; /* Includes the case where both NULL */
570 if (!one || !two) return FALSE;
571 return (Ustrcmp(one, two) == 0);
572 }
573
574
575
576 /*************************************************
577 * Compare uid/gid for addresses *
578 *************************************************/
579
580 /* This function is given a transport and two addresses. It yields TRUE if the
581 uid/gid/initgroups settings for the two addresses are going to be the same when
582 they are delivered.
583
584 Arguments:
585 tp the transort
586 addr1 the first address
587 addr2 the second address
588
589 Returns: TRUE or FALSE
590 */
591
592 static BOOL
593 same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
594 {
595 if ( !tp->uid_set && !tp->expand_uid
596 && !tp->deliver_as_creator
597 && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
598 || ( testflag(addr1, af_uid_set)
599 && ( addr1->uid != addr2->uid
600 || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
601 ) ) ) )
602 return FALSE;
603
604 if ( !tp->gid_set && !tp->expand_gid
605 && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
606 || ( testflag(addr1, af_gid_set)
607 && addr1->gid != addr2->gid
608 ) ) )
609 return FALSE;
610
611 return TRUE;
612 }
613
614
615
616
617 /*************************************************
618 * Record that an address is complete *
619 *************************************************/
620
621 /* This function records that an address is complete. This is straightforward
622 for most addresses, where the unique address is just the full address with the
623 domain lower cased. For homonyms (addresses that are the same as one of their
624 ancestors) their are complications. Their unique addresses have \x\ prepended
625 (where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
626 cousins.
627
628 Exim used to record the unique addresses of homonyms as "complete". This,
629 however, fails when the pattern of redirection varies over time (e.g. if taking
630 unseen copies at only some times of day) because the prepended numbers may vary
631 from one delivery run to the next. This problem is solved by never recording
632 prepended unique addresses as complete. Instead, when a homonymic address has
633 actually been delivered via a transport, we record its basic unique address
634 followed by the name of the transport. This is checked in subsequent delivery
635 runs whenever an address is routed to a transport.
636
637 If the completed address is a top-level one (has no parent, which means it
638 cannot be homonymic) we also add the original address to the non-recipients
639 tree, so that it gets recorded in the spool file and therefore appears as
640 "done" in any spool listings. The original address may differ from the unique
641 address in the case of the domain.
642
643 Finally, this function scans the list of duplicates, marks as done any that
644 match this address, and calls child_done() for their ancestors.
645
646 Arguments:
647 addr address item that has been completed
648 now current time as a string
649
650 Returns: nothing
651 */
652
653 static void
654 address_done(address_item *addr, uschar *now)
655 {
656 update_spool = TRUE; /* Ensure spool gets updated */
657
658 /* Top-level address */
659
660 if (!addr->parent)
661 {
662 tree_add_nonrecipient(addr->unique);
663 tree_add_nonrecipient(addr->address);
664 }
665
666 /* Homonymous child address */
667
668 else if (testflag(addr, af_homonym))
669 {
670 if (addr->transport)
671 tree_add_nonrecipient(
672 string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
673 }
674
675 /* Non-homonymous child address */
676
677 else tree_add_nonrecipient(addr->unique);
678
679 /* Check the list of duplicate addresses and ensure they are now marked
680 done as well. */
681
682 for (address_item * dup = addr_duplicate; dup; dup = dup->next)
683 if (Ustrcmp(addr->unique, dup->unique) == 0)
684 {
685 tree_add_nonrecipient(dup->unique);
686 child_done(dup, now);
687 }
688 }
689
690
691
692
693 /*************************************************
694 * Decrease counts in parents and mark done *
695 *************************************************/
696
697 /* This function is called when an address is complete. If there is a parent
698 address, its count of children is decremented. If there are still other
699 children outstanding, the function exits. Otherwise, if the count has become
700 zero, address_done() is called to mark the parent and its duplicates complete.
701 Then loop for any earlier ancestors.
702
703 Arguments:
704 addr points to the completed address item
705 now the current time as a string, for writing to the message log
706
707 Returns: nothing
708 */
709
710 static void
711 child_done(address_item *addr, uschar *now)
712 {
713 while (addr->parent)
714 {
715 address_item *aa;
716
717 addr = addr->parent;
718 if (--addr->child_count > 0) return; /* Incomplete parent */
719 address_done(addr, now);
720
721 /* Log the completion of all descendents only when there is no ancestor with
722 the same original address. */
723
724 for (aa = addr->parent; aa; aa = aa->parent)
725 if (Ustrcmp(aa->address, addr->address) == 0) break;
726 if (aa) continue;
727
728 deliver_msglog("%s %s: children all complete\n", now, addr->address);
729 DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
730 }
731 }
732
733
734
735 /*************************************************
736 * Delivery logging support functions *
737 *************************************************/
738
739 /* The LOGGING() checks in d_log_interface() are complicated for backwards
740 compatibility. When outgoing interface logging was originally added, it was
741 conditional on just incoming_interface (which is off by default). The
742 outgoing_interface option is on by default to preserve this behaviour, but
743 you can enable incoming_interface and disable outgoing_interface to get I=
744 fields on incoming lines only.
745
746 Arguments:
747 g The log line
748 addr The address to be logged
749
750 Returns: New value for s
751 */
752
753 static gstring *
754 d_log_interface(gstring * g)
755 {
756 if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
757 && sending_ip_address)
758 {
759 g = string_fmt_append(g, " I=[%s]", sending_ip_address);
760 if (LOGGING(outgoing_port))
761 g = string_fmt_append(g, ":%d", sending_port);
762 }
763 return g;
764 }
765
766
767
768 static gstring *
769 d_hostlog(gstring * g, address_item * addr)
770 {
771 host_item * h = addr->host_used;
772
773 g = string_append(g, 2, US" H=", h->name);
774
775 if (LOGGING(dnssec) && h->dnssec == DS_YES)
776 g = string_catn(g, US" DS", 3);
777
778 g = string_append(g, 3, US" [", h->address, US"]");
779
780 if (LOGGING(outgoing_port))
781 g = string_fmt_append(g, ":%d", h->port);
782
783 #ifdef SUPPORT_SOCKS
784 if (LOGGING(proxy) && proxy_local_address)
785 {
786 g = string_append(g, 3, US" PRX=[", proxy_local_address, US"]");
787 if (LOGGING(outgoing_port))
788 g = string_fmt_append(g, ":%d", proxy_local_port);
789 }
790 #endif
791
792 g = d_log_interface(g);
793
794 if (testflag(addr, af_tcp_fastopen))
795 g = string_catn(g, US" TFO*", testflag(addr, af_tcp_fastopen_data) ? 5 : 4);
796
797 return g;
798 }
799
800
801
802
803
804 #ifndef DISABLE_TLS
805 static gstring *
806 d_tlslog(gstring * g, address_item * addr)
807 {
808 if (LOGGING(tls_cipher) && addr->cipher)
809 {
810 g = string_append(g, 2, US" X=", addr->cipher);
811 #ifdef EXPERIMENTAL_TLS_RESUME
812 if (LOGGING(tls_resumption) && testflag(addr, af_tls_resume))
813 g = string_catn(g, US"*", 1);
814 #endif
815 }
816 if (LOGGING(tls_certificate_verified) && addr->cipher)
817 g = string_append(g, 2, US" CV=",
818 testflag(addr, af_cert_verified)
819 ?
820 #ifdef SUPPORT_DANE
821 testflag(addr, af_dane_verified)
822 ? "dane"
823 :
824 #endif
825 "yes"
826 : "no");
827 if (LOGGING(tls_peerdn) && addr->peerdn)
828 g = string_append(g, 3, US" DN=\"", string_printing(addr->peerdn), US"\"");
829 return g;
830 }
831 #endif
832
833
834
835
836 #ifndef DISABLE_EVENT
837 uschar *
838 event_raise(uschar * action, const uschar * event, uschar * ev_data)
839 {
840 uschar * s;
841 if (action)
842 {
843 DEBUG(D_deliver)
844 debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
845 event,
846 action, deliver_host_address);
847
848 event_name = event;
849 event_data = ev_data;
850
851 if (!(s = expand_string(action)) && *expand_string_message)
852 log_write(0, LOG_MAIN|LOG_PANIC,
853 "failed to expand event_action %s in %s: %s\n",
854 event, transport_name ? transport_name : US"main", expand_string_message);
855
856 event_name = event_data = NULL;
857
858 /* If the expansion returns anything but an empty string, flag for
859 the caller to modify his normal processing
860 */
861 if (s && *s)
862 {
863 DEBUG(D_deliver)
864 debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
865 errno = ERRNO_EVENT;
866 return s;
867 }
868 }
869 return NULL;
870 }
871
872 void
873 msg_event_raise(const uschar * event, const address_item * addr)
874 {
875 const uschar * save_domain = deliver_domain;
876 uschar * save_local = deliver_localpart;
877 const uschar * save_host = deliver_host;
878 const uschar * save_address = deliver_host_address;
879 const int save_port = deliver_host_port;
880
881 router_name = addr->router ? addr->router->name : NULL;
882 deliver_domain = addr->domain;
883 deliver_localpart = addr->local_part;
884 deliver_host = addr->host_used ? addr->host_used->name : NULL;
885
886 if (!addr->transport)
887 {
888 if (Ustrcmp(event, "msg:fail:delivery") == 0)
889 {
890 /* An address failed with no transport involved. This happens when
891 a filter was used which triggered a fail command (in such a case
892 a transport isn't needed). Convert it to an internal fail event. */
893
894 (void) event_raise(event_action, US"msg:fail:internal", addr->message);
895 }
896 }
897 else
898 {
899 transport_name = addr->transport->name;
900
901 (void) event_raise(addr->transport->event_action, event,
902 addr->host_used
903 || Ustrcmp(addr->transport->driver_name, "smtp") == 0
904 || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
905 || Ustrcmp(addr->transport->driver_name, "autoreply") == 0
906 ? addr->message : NULL);
907 }
908
909 deliver_host_port = save_port;
910 deliver_host_address = save_address;
911 deliver_host = save_host;
912 deliver_localpart = save_local;
913 deliver_domain = save_domain;
914 router_name = transport_name = NULL;
915 }
916 #endif /*DISABLE_EVENT*/
917
918
919
920 /******************************************************************************/
921
922
923 /*************************************************
924 * Generate local prt for logging *
925 *************************************************/
926
927 /* This function is a subroutine for use in string_log_address() below.
928
929 Arguments:
930 addr the address being logged
931 yield the current dynamic buffer pointer
932
933 Returns: the new value of the buffer pointer
934 */
935
936 static gstring *
937 string_get_localpart(address_item * addr, gstring * yield)
938 {
939 uschar * s;
940
941 s = addr->prefix;
942 if (testflag(addr, af_include_affixes) && s)
943 {
944 #ifdef SUPPORT_I18N
945 if (testflag(addr, af_utf8_downcvt))
946 s = string_localpart_utf8_to_alabel(s, NULL);
947 #endif
948 yield = string_cat(yield, s);
949 }
950
951 s = addr->local_part;
952 #ifdef SUPPORT_I18N
953 if (testflag(addr, af_utf8_downcvt))
954 s = string_localpart_utf8_to_alabel(s, NULL);
955 #endif
956 yield = string_cat(yield, s);
957
958 s = addr->suffix;
959 if (testflag(addr, af_include_affixes) && s)
960 {
961 #ifdef SUPPORT_I18N
962 if (testflag(addr, af_utf8_downcvt))
963 s = string_localpart_utf8_to_alabel(s, NULL);
964 #endif
965 yield = string_cat(yield, s);
966 }
967
968 return yield;
969 }
970
971
972 /*************************************************
973 * Generate log address list *
974 *************************************************/
975
976 /* This function generates a list consisting of an address and its parents, for
977 use in logging lines. For saved onetime aliased addresses, the onetime parent
978 field is used. If the address was delivered by a transport with rcpt_include_
979 affixes set, the af_include_affixes bit will be set in the address. In that
980 case, we include the affixes here too.
981
982 Arguments:
983 g points to growing-string struct
984 addr bottom (ultimate) address
985 all_parents if TRUE, include all parents
986 success TRUE for successful delivery
987
988 Returns: a growable string in dynamic store
989 */
990
991 static gstring *
992 string_log_address(gstring * g,
993 address_item *addr, BOOL all_parents, BOOL success)
994 {
995 BOOL add_topaddr = TRUE;
996 address_item *topaddr;
997
998 /* Find the ultimate parent */
999
1000 for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
1001
1002 /* We start with just the local part for pipe, file, and reply deliveries, and
1003 for successful local deliveries from routers that have the log_as_local flag
1004 set. File deliveries from filters can be specified as non-absolute paths in
1005 cases where the transport is going to complete the path. If there is an error
1006 before this happens (expansion failure) the local part will not be updated, and
1007 so won't necessarily look like a path. Add extra text for this case. */
1008
1009 if ( testflag(addr, af_pfr)
1010 || ( success
1011 && addr->router && addr->router->log_as_local
1012 && addr->transport && addr->transport->info->local
1013 ) )
1014 {
1015 if (testflag(addr, af_file) && addr->local_part[0] != '/')
1016 g = string_catn(g, CUS"save ", 5);
1017 g = string_get_localpart(addr, g);
1018 }
1019
1020 /* Other deliveries start with the full address. It we have split it into local
1021 part and domain, use those fields. Some early failures can happen before the
1022 splitting is done; in those cases use the original field. */
1023
1024 else
1025 {
1026 uschar * cmp;
1027 int off = g->ptr; /* start of the "full address" */
1028
1029 if (addr->local_part)
1030 {
1031 const uschar * s;
1032 g = string_get_localpart(addr, g);
1033 g = string_catn(g, US"@", 1);
1034 s = addr->domain;
1035 #ifdef SUPPORT_I18N
1036 if (testflag(addr, af_utf8_downcvt))
1037 s = string_localpart_utf8_to_alabel(s, NULL);
1038 #endif
1039 g = string_cat(g, s);
1040 }
1041 else
1042 g = string_cat(g, addr->address);
1043
1044 /* If the address we are going to print is the same as the top address,
1045 and all parents are not being included, don't add on the top address. First
1046 of all, do a caseless comparison; if this succeeds, do a caseful comparison
1047 on the local parts. */
1048
1049 cmp = g->s + off; /* only now, as rebuffer likely done */
1050 string_from_gstring(g); /* ensure nul-terminated */
1051 if ( strcmpic(cmp, topaddr->address) == 0
1052 && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
1053 && !addr->onetime_parent
1054 && (!all_parents || !addr->parent || addr->parent == topaddr)
1055 )
1056 add_topaddr = FALSE;
1057 }
1058
1059 /* If all parents are requested, or this is a local pipe/file/reply, and
1060 there is at least one intermediate parent, show it in brackets, and continue
1061 with all of them if all are wanted. */
1062
1063 if ( (all_parents || testflag(addr, af_pfr))
1064 && addr->parent
1065 && addr->parent != topaddr)
1066 {
1067 uschar *s = US" (";
1068 for (address_item * addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
1069 {
1070 g = string_catn(g, s, 2);
1071 g = string_cat (g, addr2->address);
1072 if (!all_parents) break;
1073 s = US", ";
1074 }
1075 g = string_catn(g, US")", 1);
1076 }
1077
1078 /* Add the top address if it is required */
1079
1080 if (add_topaddr)
1081 g = string_append(g, 3,
1082 US" <",
1083 addr->onetime_parent ? addr->onetime_parent : topaddr->address,
1084 US">");
1085
1086 return g;
1087 }
1088
1089
1090
1091 void
1092 timesince(struct timeval * diff, struct timeval * then)
1093 {
1094 gettimeofday(diff, NULL);
1095 diff->tv_sec -= then->tv_sec;
1096 if ((diff->tv_usec -= then->tv_usec) < 0)
1097 {
1098 diff->tv_sec--;
1099 diff->tv_usec += 1000*1000;
1100 }
1101 }
1102
1103
1104
1105 uschar *
1106 string_timediff(struct timeval * diff)
1107 {
1108 static uschar buf[sizeof("0.000s")];
1109
1110 if (diff->tv_sec >= 5 || !LOGGING(millisec))
1111 return readconf_printtime((int)diff->tv_sec);
1112
1113 sprintf(CS buf, "%u.%03us", (uint)diff->tv_sec, (uint)diff->tv_usec/1000);
1114 return buf;
1115 }
1116
1117
1118 uschar *
1119 string_timesince(struct timeval * then)
1120 {
1121 struct timeval diff;
1122
1123 timesince(&diff, then);
1124 return string_timediff(&diff);
1125 }
1126
1127 /******************************************************************************/
1128
1129
1130
1131 /* If msg is NULL this is a delivery log and logchar is used. Otherwise
1132 this is a nonstandard call; no two-character delivery flag is written
1133 but sender-host and sender are prefixed and "msg" is inserted in the log line.
1134
1135 Arguments:
1136 flags passed to log_write()
1137 */
1138 void
1139 delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
1140 {
1141 gstring * g; /* Used for a temporary, expanding buffer, for building log lines */
1142 rmark reset_point;
1143
1144 /* Log the delivery on the main log. We use an extensible string to build up
1145 the log line, and reset the store afterwards. Remote deliveries should always
1146 have a pointer to the host item that succeeded; local deliveries can have a
1147 pointer to a single host item in their host list, for use by the transport. */
1148
1149 #ifndef DISABLE_EVENT
1150 /* presume no successful remote delivery */
1151 lookup_dnssec_authenticated = NULL;
1152 #endif
1153
1154 reset_point = store_mark();
1155 g = string_get_tainted(256, TRUE); /* addrs will be tainted, so avoid copy */
1156
1157 if (msg)
1158 g = string_append(g, 2, host_and_ident(TRUE), US" ");
1159 else
1160 {
1161 g->s[0] = logchar; g->ptr = 1;
1162 g = string_catn(g, US"> ", 2);
1163 }
1164 g = string_log_address(g, addr, LOGGING(all_parents), TRUE);
1165
1166 if (LOGGING(sender_on_delivery) || msg)
1167 g = string_append(g, 3, US" F=<",
1168 #ifdef SUPPORT_I18N
1169 testflag(addr, af_utf8_downcvt)
1170 ? string_address_utf8_to_alabel(sender_address, NULL)
1171 :
1172 #endif
1173 sender_address,
1174 US">");
1175
1176 if (*queue_name)
1177 g = string_append(g, 2, US" Q=", queue_name);
1178
1179 #ifdef EXPERIMENTAL_SRS
1180 if(addr->prop.srs_sender)
1181 g = string_append(g, 3, US" SRS=<", addr->prop.srs_sender, US">");
1182 #endif
1183
1184 /* You might think that the return path must always be set for a successful
1185 delivery; indeed, I did for some time, until this statement crashed. The case
1186 when it is not set is for a delivery to /dev/null which is optimised by not
1187 being run at all. */
1188
1189 if (used_return_path && LOGGING(return_path_on_delivery))
1190 g = string_append(g, 3, US" P=<", used_return_path, US">");
1191
1192 if (msg)
1193 g = string_append(g, 2, US" ", msg);
1194
1195 /* For a delivery from a system filter, there may not be a router */
1196 if (addr->router)
1197 g = string_append(g, 2, US" R=", addr->router->name);
1198
1199 g = string_append(g, 2, US" T=", addr->transport->name);
1200
1201 if (LOGGING(delivery_size))
1202 g = string_fmt_append(g, " S=%d", transport_count);
1203
1204 /* Local delivery */
1205
1206 if (addr->transport->info->local)
1207 {
1208 if (addr->host_list)
1209 g = string_append(g, 2, US" H=", addr->host_list->name);
1210 g = d_log_interface(g);
1211 if (addr->shadow_message)
1212 g = string_cat(g, addr->shadow_message);
1213 }
1214
1215 /* Remote delivery */
1216
1217 else
1218 {
1219 if (addr->host_used)
1220 {
1221 g = d_hostlog(g, addr);
1222 if (continue_sequence > 1)
1223 g = string_catn(g, US"*", 1);
1224
1225 #ifndef DISABLE_EVENT
1226 deliver_host_address = addr->host_used->address;
1227 deliver_host_port = addr->host_used->port;
1228 deliver_host = addr->host_used->name;
1229
1230 /* DNS lookup status */
1231 lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
1232 : addr->host_used->dnssec==DS_NO ? US"no"
1233 : NULL;
1234 #endif
1235 }
1236
1237 #ifndef DISABLE_TLS
1238 g = d_tlslog(g, addr);
1239 #endif
1240
1241 if (addr->authenticator)
1242 {
1243 g = string_append(g, 2, US" A=", addr->authenticator);
1244 if (addr->auth_id)
1245 {
1246 g = string_append(g, 2, US":", addr->auth_id);
1247 if (LOGGING(smtp_mailauth) && addr->auth_sndr)
1248 g = string_append(g, 2, US":", addr->auth_sndr);
1249 }
1250 }
1251
1252 if (LOGGING(pipelining))
1253 {
1254 if (testflag(addr, af_pipelining))
1255 g = string_catn(g, US" L", 2);
1256 #ifdef SUPPORT_PIPE_CONNECT
1257 if (testflag(addr, af_early_pipe))
1258 g = string_catn(g, US"*", 1);
1259 #endif
1260 }
1261
1262 #ifndef DISABLE_PRDR
1263 if (testflag(addr, af_prdr_used))
1264 g = string_catn(g, US" PRDR", 5);
1265 #endif
1266
1267 if (testflag(addr, af_chunking_used))
1268 g = string_catn(g, US" K", 2);
1269 }
1270
1271 /* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
1272
1273 if ( LOGGING(smtp_confirmation)
1274 && addr->message
1275 && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
1276 )
1277 {
1278 unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
1279 uschar *p = big_buffer;
1280 uschar *ss = addr->message;
1281 *p++ = '\"';
1282 for (int i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
1283 {
1284 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
1285 *p++ = ss[i];
1286 }
1287 *p++ = '\"';
1288 *p = 0;
1289 g = string_append(g, 2, US" C=", big_buffer);
1290 }
1291
1292 /* Time on queue and actual time taken to deliver */
1293
1294 if (LOGGING(queue_time))
1295 g = string_append(g, 2, US" QT=",
1296 string_timesince(&received_time));
1297
1298 if (LOGGING(deliver_time))
1299 {
1300 struct timeval diff = {.tv_sec = addr->more_errno, .tv_usec = addr->delivery_usec};
1301 g = string_append(g, 2, US" DT=", string_timediff(&diff));
1302 }
1303
1304 /* string_cat() always leaves room for the terminator. Release the
1305 store we used to build the line after writing it. */
1306
1307 log_write(0, flags, "%s", string_from_gstring(g));
1308
1309 #ifndef DISABLE_EVENT
1310 if (!msg) msg_event_raise(US"msg:delivery", addr);
1311 #endif
1312
1313 store_reset(reset_point);
1314 return;
1315 }
1316
1317
1318
1319 static void
1320 deferral_log(address_item * addr, uschar * now,
1321 int logflags, uschar * driver_name, uschar * driver_kind)
1322 {
1323 rmark reset_point = store_mark();
1324 gstring * g = string_get(256);
1325
1326 /* Build up the line that is used for both the message log and the main
1327 log. */
1328
1329 /* Create the address string for logging. Must not do this earlier, because
1330 an OK result may be changed to FAIL when a pipe returns text. */
1331
1332 g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
1333
1334 if (*queue_name)
1335 g = string_append(g, 2, US" Q=", queue_name);
1336
1337 /* Either driver_name contains something and driver_kind contains
1338 " router" or " transport" (note the leading space), or driver_name is
1339 a null string and driver_kind contains "routing" without the leading
1340 space, if all routing has been deferred. When a domain has been held,
1341 so nothing has been done at all, both variables contain null strings. */
1342
1343 if (driver_name)
1344 {
1345 if (driver_kind[1] == 't' && addr->router)
1346 g = string_append(g, 2, US" R=", addr->router->name);
1347 g = string_fmt_append(g, " %c=%s", toupper(driver_kind[1]), driver_name);
1348 }
1349 else if (driver_kind)
1350 g = string_append(g, 2, US" ", driver_kind);
1351
1352 g = string_fmt_append(g, " defer (%d)", addr->basic_errno);
1353
1354 if (addr->basic_errno > 0)
1355 g = string_append(g, 2, US": ",
1356 US strerror(addr->basic_errno));
1357
1358 if (addr->host_used)
1359 {
1360 g = string_append(g, 5,
1361 US" H=", addr->host_used->name,
1362 US" [", addr->host_used->address, US"]");
1363 if (LOGGING(outgoing_port))
1364 {
1365 int port = addr->host_used->port;
1366 g = string_fmt_append(g, ":%d", port == PORT_NONE ? 25 : port);
1367 }
1368 }
1369
1370 if (addr->message)
1371 g = string_append(g, 2, US": ", addr->message);
1372
1373 (void) string_from_gstring(g);
1374
1375 /* Log the deferment in the message log, but don't clutter it
1376 up with retry-time defers after the first delivery attempt. */
1377
1378 if (f.deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
1379 deliver_msglog("%s %s\n", now, g->s);
1380
1381 /* Write the main log and reset the store.
1382 For errors of the type "retry time not reached" (also remotes skipped
1383 on queue run), logging is controlled by L_retry_defer. Note that this kind
1384 of error number is negative, and all the retry ones are less than any
1385 others. */
1386
1387
1388 log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
1389 "== %s", g->s);
1390
1391 store_reset(reset_point);
1392 return;
1393 }
1394
1395
1396
1397 static void
1398 failure_log(address_item * addr, uschar * driver_kind, uschar * now)
1399 {
1400 rmark reset_point = store_mark();
1401 gstring * g = string_get(256);
1402
1403 #ifndef DISABLE_EVENT
1404 /* Message failures for which we will send a DSN get their event raised
1405 later so avoid doing it here. */
1406
1407 if ( !addr->prop.ignore_error
1408 && !(addr->dsn_flags & (rf_dsnflags & ~rf_notify_failure))
1409 )
1410 msg_event_raise(US"msg:fail:delivery", addr);
1411 #endif
1412
1413 /* Build up the log line for the message and main logs */
1414
1415 /* Create the address string for logging. Must not do this earlier, because
1416 an OK result may be changed to FAIL when a pipe returns text. */
1417
1418 g = string_log_address(g, addr, LOGGING(all_parents), FALSE);
1419
1420 if (LOGGING(sender_on_delivery))
1421 g = string_append(g, 3, US" F=<", sender_address, US">");
1422
1423 if (*queue_name)
1424 g = string_append(g, 2, US" Q=", queue_name);
1425
1426 /* Return path may not be set if no delivery actually happened */
1427
1428 if (used_return_path && LOGGING(return_path_on_delivery))
1429 g = string_append(g, 3, US" P=<", used_return_path, US">");
1430
1431 if (addr->router)
1432 g = string_append(g, 2, US" R=", addr->router->name);
1433 if (addr->transport)
1434 g = string_append(g, 2, US" T=", addr->transport->name);
1435
1436 if (addr->host_used)
1437 g = d_hostlog(g, addr);
1438
1439 #ifndef DISABLE_TLS
1440 g = d_tlslog(g, addr);
1441 #endif
1442
1443 if (addr->basic_errno > 0)
1444 g = string_append(g, 2, US": ", US strerror(addr->basic_errno));
1445
1446 if (addr->message)
1447 g = string_append(g, 2, US": ", addr->message);
1448
1449 (void) string_from_gstring(g);
1450
1451 /* Do the logging. For the message log, "routing failed" for those cases,
1452 just to make it clearer. */
1453
1454 if (driver_kind)
1455 deliver_msglog("%s %s failed for %s\n", now, driver_kind, g->s);
1456 else
1457 deliver_msglog("%s %s\n", now, g->s);
1458
1459 log_write(0, LOG_MAIN, "** %s", g->s);
1460
1461 store_reset(reset_point);
1462 return;
1463 }
1464
1465
1466
1467 /*************************************************
1468 * Actions at the end of handling an address *
1469 *************************************************/
1470
1471 /* This is a function for processing a single address when all that can be done
1472 with it has been done.
1473
1474 Arguments:
1475 addr points to the address block
1476 result the result of the delivery attempt
1477 logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
1478 driver_type indicates which type of driver (transport, or router) was last
1479 to process the address
1480 logchar '=' or '-' for use when logging deliveries with => or ->
1481
1482 Returns: nothing
1483 */
1484
1485 static void
1486 post_process_one(address_item *addr, int result, int logflags, int driver_type,
1487 int logchar)
1488 {
1489 uschar *now = tod_stamp(tod_log);
1490 uschar *driver_kind = NULL;
1491 uschar *driver_name = NULL;
1492
1493 DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
1494
1495 /* Set up driver kind and name for logging. Disable logging if the router or
1496 transport has disabled it. */
1497
1498 if (driver_type == EXIM_DTYPE_TRANSPORT)
1499 {
1500 if (addr->transport)
1501 {
1502 driver_name = addr->transport->name;
1503 driver_kind = US" transport";
1504 f.disable_logging = addr->transport->disable_logging;
1505 }
1506 else driver_kind = US"transporting";
1507 }
1508 else if (driver_type == EXIM_DTYPE_ROUTER)
1509 {
1510 if (addr->router)
1511 {
1512 driver_name = addr->router->name;
1513 driver_kind = US" router";
1514 f.disable_logging = addr->router->disable_logging;
1515 }
1516 else driver_kind = US"routing";
1517 }
1518
1519 /* If there's an error message set, ensure that it contains only printing
1520 characters - it should, but occasionally things slip in and this at least
1521 stops the log format from getting wrecked. We also scan the message for an LDAP
1522 expansion item that has a password setting, and flatten the password. This is a
1523 fudge, but I don't know a cleaner way of doing this. (If the item is badly
1524 malformed, it won't ever have gone near LDAP.) */
1525
1526 if (addr->message)
1527 {
1528 const uschar * s = string_printing(addr->message);
1529
1530 /* deconst cast ok as string_printing known to have alloc'n'copied */
1531 addr->message = expand_hide_passwords(US s);
1532 }
1533
1534 /* If we used a transport that has one of the "return_output" options set, and
1535 if it did in fact generate some output, then for return_output we treat the
1536 message as failed if it was not already set that way, so that the output gets
1537 returned to the sender, provided there is a sender to send it to. For
1538 return_fail_output, do this only if the delivery failed. Otherwise we just
1539 unlink the file, and remove the name so that if the delivery failed, we don't
1540 try to send back an empty or unwanted file. The log_output options operate only
1541 on a non-empty file.
1542
1543 In any case, we close the message file, because we cannot afford to leave a
1544 file-descriptor for one address while processing (maybe very many) others. */
1545
1546 if (addr->return_file >= 0 && addr->return_filename)
1547 {
1548 BOOL return_output = FALSE;
1549 struct stat statbuf;
1550 (void)EXIMfsync(addr->return_file);
1551
1552 /* If there is no output, do nothing. */
1553
1554 if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
1555 {
1556 transport_instance *tb = addr->transport;
1557
1558 /* Handle logging options */
1559
1560 if ( tb->log_output
1561 || result == FAIL && tb->log_fail_output
1562 || result == DEFER && tb->log_defer_output
1563 )
1564 {
1565 uschar *s;
1566 FILE *f = Ufopen(addr->return_filename, "rb");
1567 if (!f)
1568 log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
1569 "from %s transport: %s", addr->return_filename, tb->name,
1570 strerror(errno));
1571 else
1572 if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
1573 {
1574 uschar *p = big_buffer + Ustrlen(big_buffer);
1575 const uschar * sp;
1576 while (p > big_buffer && isspace(p[-1])) p--;
1577 *p = 0;
1578 sp = string_printing(big_buffer);
1579 log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
1580 addr->address, tb->name, sp);
1581 }
1582 (void)fclose(f);
1583 }
1584
1585 /* Handle returning options, but only if there is an address to return
1586 the text to. */
1587
1588 if (sender_address[0] != 0 || addr->prop.errors_address)
1589 if (tb->return_output)
1590 {
1591 addr->transport_return = result = FAIL;
1592 if (addr->basic_errno == 0 && !addr->message)
1593 addr->message = US"return message generated";
1594 return_output = TRUE;
1595 }
1596 else
1597 if (tb->return_fail_output && result == FAIL) return_output = TRUE;
1598 }
1599
1600 /* Get rid of the file unless it might be returned, but close it in
1601 all cases. */
1602
1603 if (!return_output)
1604 {
1605 Uunlink(addr->return_filename);
1606 addr->return_filename = NULL;
1607 addr->return_file = -1;
1608 }
1609
1610 (void)close(addr->return_file);
1611 }
1612
1613 /* The success case happens only after delivery by a transport. */
1614
1615 if (result == OK)
1616 {
1617 addr->next = addr_succeed;
1618 addr_succeed = addr;
1619
1620 /* Call address_done() to ensure that we don't deliver to this address again,
1621 and write appropriate things to the message log. If it is a child address, we
1622 call child_done() to scan the ancestors and mark them complete if this is the
1623 last child to complete. */
1624
1625 address_done(addr, now);
1626 DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
1627
1628 if (!addr->parent)
1629 deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
1630 driver_name, driver_kind);
1631 else
1632 {
1633 deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
1634 addr->parent->address, driver_name, driver_kind);
1635 child_done(addr, now);
1636 }
1637
1638 /* Certificates for logging (via events) */
1639 #ifndef DISABLE_TLS
1640 tls_out.ourcert = addr->ourcert;
1641 addr->ourcert = NULL;
1642 tls_out.peercert = addr->peercert;
1643 addr->peercert = NULL;
1644
1645 tls_out.cipher = addr->cipher;
1646 tls_out.peerdn = addr->peerdn;
1647 tls_out.ocsp = addr->ocsp;
1648 # ifdef SUPPORT_DANE
1649 tls_out.dane_verified = testflag(addr, af_dane_verified);
1650 # endif
1651 #endif
1652
1653 delivery_log(LOG_MAIN, addr, logchar, NULL);
1654
1655 #ifndef DISABLE_TLS
1656 tls_free_cert(&tls_out.ourcert);
1657 tls_free_cert(&tls_out.peercert);
1658 tls_out.cipher = NULL;
1659 tls_out.peerdn = NULL;
1660 tls_out.ocsp = OCSP_NOT_REQ;
1661 # ifdef SUPPORT_DANE
1662 tls_out.dane_verified = FALSE;
1663 # endif
1664 #endif
1665 }
1666
1667
1668 /* Soft failure, or local delivery process failed; freezing may be
1669 requested. */
1670
1671 else if (result == DEFER || result == PANIC)
1672 {
1673 if (result == PANIC) logflags |= LOG_PANIC;
1674
1675 /* This puts them on the chain in reverse order. Do not change this, because
1676 the code for handling retries assumes that the one with the retry
1677 information is last. */
1678
1679 addr->next = addr_defer;
1680 addr_defer = addr;
1681
1682 /* The only currently implemented special action is to freeze the
1683 message. Logging of this is done later, just before the -H file is
1684 updated. */
1685
1686 if (addr->special_action == SPECIAL_FREEZE)
1687 {
1688 f.deliver_freeze = TRUE;
1689 deliver_frozen_at = time(NULL);
1690 update_spool = TRUE;
1691 }
1692
1693 /* If doing a 2-stage queue run, we skip writing to either the message
1694 log or the main log for SMTP defers. */
1695
1696 if (!f.queue_2stage || addr->basic_errno != 0)
1697 deferral_log(addr, now, logflags, driver_name, driver_kind);
1698 }
1699
1700
1701 /* Hard failure. If there is an address to which an error message can be sent,
1702 put this address on the failed list. If not, put it on the deferred list and
1703 freeze the mail message for human attention. The latter action can also be
1704 explicitly requested by a router or transport. */
1705
1706 else
1707 {
1708 /* If this is a delivery error, or a message for which no replies are
1709 wanted, and the message's age is greater than ignore_bounce_errors_after,
1710 force the af_ignore_error flag. This will cause the address to be discarded
1711 later (with a log entry). */
1712
1713 if (!*sender_address && message_age >= ignore_bounce_errors_after)
1714 addr->prop.ignore_error = TRUE;
1715
1716 /* Freeze the message if requested, or if this is a bounce message (or other
1717 message with null sender) and this address does not have its own errors
1718 address. However, don't freeze if errors are being ignored. The actual code
1719 to ignore occurs later, instead of sending a message. Logging of freezing
1720 occurs later, just before writing the -H file. */
1721
1722 if ( !addr->prop.ignore_error
1723 && ( addr->special_action == SPECIAL_FREEZE
1724 || (sender_address[0] == 0 && !addr->prop.errors_address)
1725 ) )
1726 {
1727 frozen_info = addr->special_action == SPECIAL_FREEZE
1728 ? US""
1729 : f.sender_local && !f.local_error_message
1730 ? US" (message created with -f <>)"
1731 : US" (delivery error message)";
1732 f.deliver_freeze = TRUE;
1733 deliver_frozen_at = time(NULL);
1734 update_spool = TRUE;
1735
1736 /* The address is put on the defer rather than the failed queue, because
1737 the message is being retained. */
1738
1739 addr->next = addr_defer;
1740 addr_defer = addr;
1741 }
1742
1743 /* Don't put the address on the nonrecipients tree yet; wait until an
1744 error message has been successfully sent. */
1745
1746 else
1747 {
1748 addr->next = addr_failed;
1749 addr_failed = addr;
1750 }
1751
1752 failure_log(addr, driver_name ? NULL : driver_kind, now);
1753 }
1754
1755 /* Ensure logging is turned on again in all cases */
1756
1757 f.disable_logging = FALSE;
1758 }
1759
1760
1761
1762
1763 /*************************************************
1764 * Address-independent error *
1765 *************************************************/
1766
1767 /* This function is called when there's an error that is not dependent on a
1768 particular address, such as an expansion string failure. It puts the error into
1769 all the addresses in a batch, logs the incident on the main and panic logs, and
1770 clears the expansions. It is mostly called from local_deliver(), but can be
1771 called for a remote delivery via findugid().
1772
1773 Arguments:
1774 logit TRUE if (MAIN+PANIC) logging required
1775 addr the first of the chain of addresses
1776 code the error code
1777 format format string for error message, or NULL if already set in addr
1778 ... arguments for the format
1779
1780 Returns: nothing
1781 */
1782
1783 static void
1784 common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
1785 {
1786 addr->basic_errno = code;
1787
1788 if (format)
1789 {
1790 va_list ap;
1791 gstring * g;
1792
1793 va_start(ap, format);
1794 g = string_vformat(NULL, SVFMT_EXTEND|SVFMT_REBUFFER, CS format, ap);
1795 va_end(ap);
1796 addr->message = string_from_gstring(g);
1797 }
1798
1799 for (address_item * addr2 = addr->next; addr2; addr2 = addr2->next)
1800 {
1801 addr2->basic_errno = code;
1802 addr2->message = addr->message;
1803 }
1804
1805 if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
1806 deliver_set_expansions(NULL);
1807 }
1808
1809
1810
1811
1812 /*************************************************
1813 * Check a "never users" list *
1814 *************************************************/
1815
1816 /* This function is called to check whether a uid is on one of the two "never
1817 users" lists.
1818
1819 Arguments:
1820 uid the uid to be checked
1821 nusers the list to be scanned; the first item in the list is the count
1822
1823 Returns: TRUE if the uid is on the list
1824 */
1825
1826 static BOOL
1827 check_never_users(uid_t uid, uid_t *nusers)
1828 {
1829 if (!nusers) return FALSE;
1830 for (int i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
1831 return FALSE;
1832 }
1833
1834
1835
1836 /*************************************************
1837 * Find uid and gid for a transport *
1838 *************************************************/
1839
1840 /* This function is called for both local and remote deliveries, to find the
1841 uid/gid under which to run the delivery. The values are taken preferentially
1842 from the transport (either explicit or deliver_as_creator), then from the
1843 address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
1844 the resulting uid is on the "never_users" or the "fixed_never_users" list, a
1845 panic error is logged, and the function fails (which normally leads to delivery
1846 deferral).
1847
1848 Arguments:
1849 addr the address (possibly a chain)
1850 tp the transport
1851 uidp pointer to uid field
1852 gidp pointer to gid field
1853 igfp pointer to the use_initgroups field
1854
1855 Returns: FALSE if failed - error has been set in address(es)
1856 */
1857
1858 static BOOL
1859 findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
1860 BOOL *igfp)
1861 {
1862 uschar *nuname;
1863 BOOL gid_set = FALSE;
1864
1865 /* Default initgroups flag comes from the transport */
1866
1867 *igfp = tp->initgroups;
1868
1869 /* First see if there's a gid on the transport, either fixed or expandable.
1870 The expanding function always logs failure itself. */
1871
1872 if (tp->gid_set)
1873 {
1874 *gidp = tp->gid;
1875 gid_set = TRUE;
1876 }
1877 else if (tp->expand_gid)
1878 {
1879 if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
1880 &(addr->message)))
1881 {
1882 common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
1883 return FALSE;
1884 }
1885 gid_set = TRUE;
1886 }
1887
1888 /* If the transport did not set a group, see if the router did. */
1889
1890 if (!gid_set && testflag(addr, af_gid_set))
1891 {
1892 *gidp = addr->gid;
1893 gid_set = TRUE;
1894 }
1895
1896 /* Pick up a uid from the transport if one is set. */
1897
1898 if (tp->uid_set) *uidp = tp->uid;
1899
1900 /* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
1901 it does not provide a passwd value from which a gid can be taken. */
1902
1903 else if (tp->expand_uid)
1904 {
1905 struct passwd *pw;
1906 if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
1907 uidp, &(addr->message)))
1908 {
1909 common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
1910 return FALSE;
1911 }
1912 if (!gid_set && pw)
1913 {
1914 *gidp = pw->pw_gid;
1915 gid_set = TRUE;
1916 }
1917 }
1918
1919 /* If the transport doesn't set the uid, test the deliver_as_creator flag. */
1920
1921 else if (tp->deliver_as_creator)
1922 {
1923 *uidp = originator_uid;
1924 if (!gid_set)
1925 {
1926 *gidp = originator_gid;
1927 gid_set = TRUE;
1928 }
1929 }
1930
1931 /* Otherwise see if the address specifies the uid and if so, take it and its
1932 initgroups flag. */
1933
1934 else if (testflag(addr, af_uid_set))
1935 {
1936 *uidp = addr->uid;
1937 *igfp = testflag(addr, af_initgroups);
1938 }
1939
1940 /* Nothing has specified the uid - default to the Exim user, and group if the
1941 gid is not set. */
1942
1943 else
1944 {
1945 *uidp = exim_uid;
1946 if (!gid_set)
1947 {
1948 *gidp = exim_gid;
1949 gid_set = TRUE;
1950 }
1951 }
1952
1953 /* If no gid is set, it is a disaster. We default to the Exim gid only if
1954 defaulting to the Exim uid. In other words, if the configuration has specified
1955 a uid, it must also provide a gid. */
1956
1957 if (!gid_set)
1958 {
1959 common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
1960 "%s transport", tp->name);
1961 return FALSE;
1962 }
1963
1964 /* Check that the uid is not on the lists of banned uids that may not be used
1965 for delivery processes. */
1966
1967 nuname = check_never_users(*uidp, never_users)
1968 ? US"never_users"
1969 : check_never_users(*uidp, fixed_never_users)
1970 ? US"fixed_never_users"
1971 : NULL;
1972 if (nuname)
1973 {
1974 common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
1975 "is on the %s list", (long int)(*uidp), tp->name, nuname);
1976 return FALSE;
1977 }
1978
1979 /* All is well */
1980
1981 return TRUE;
1982 }
1983
1984
1985
1986
1987 /*************************************************
1988 * Check the size of a message for a transport *
1989 *************************************************/
1990
1991 /* Checks that the message isn't too big for the selected transport.
1992 This is called only when it is known that the limit is set.
1993
1994 Arguments:
1995 tp the transport
1996 addr the (first) address being delivered
1997
1998 Returns: OK
1999 DEFER expansion failed or did not yield an integer
2000 FAIL message too big
2001 */
2002
2003 int
2004 check_message_size(transport_instance *tp, address_item *addr)
2005 {
2006 int rc = OK;
2007 int size_limit;
2008
2009 deliver_set_expansions(addr);
2010 size_limit = expand_string_integer(tp->message_size_limit, TRUE);
2011 deliver_set_expansions(NULL);
2012
2013 if (expand_string_message)
2014 {
2015 rc = DEFER;
2016 addr->message = size_limit == -1
2017 ? string_sprintf("failed to expand message_size_limit "
2018 "in %s transport: %s", tp->name, expand_string_message)
2019 : string_sprintf("invalid message_size_limit "
2020 "in %s transport: %s", tp->name, expand_string_message);
2021 }
2022 else if (size_limit > 0 && message_size > size_limit)
2023 {
2024 rc = FAIL;
2025 addr->message =
2026 string_sprintf("message is too big (transport limit = %d)",
2027 size_limit);
2028 }
2029
2030 return rc;
2031 }
2032
2033
2034
2035 /*************************************************
2036 * Transport-time check for a previous delivery *
2037 *************************************************/
2038
2039 /* Check that this base address hasn't previously been delivered to its routed
2040 transport. If it has been delivered, mark it done. The check is necessary at
2041 delivery time in order to handle homonymic addresses correctly in cases where
2042 the pattern of redirection changes between delivery attempts (so the unique
2043 fields change). Non-homonymic previous delivery is detected earlier, at routing
2044 time (which saves unnecessary routing).
2045
2046 Arguments:
2047 addr the address item
2048 testing TRUE if testing wanted only, without side effects
2049
2050 Returns: TRUE if previously delivered by the transport
2051 */
2052
2053 static BOOL
2054 previously_transported(address_item *addr, BOOL testing)
2055 {
2056 uschar * s = string_sprintf("%s/%s",
2057 addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
2058
2059 if (tree_search(tree_nonrecipients, s) != 0)
2060 {
2061 DEBUG(D_deliver|D_route|D_transport)
2062 debug_printf("%s was previously delivered (%s transport): discarded\n",
2063 addr->address, addr->transport->name);
2064 if (!testing) child_done(addr, tod_stamp(tod_log));
2065 return TRUE;
2066 }
2067
2068 return FALSE;
2069 }
2070
2071
2072
2073 /******************************************************
2074 * Check for a given header in a header string *
2075 ******************************************************/
2076
2077 /* This function is used when generating quota warnings. The configuration may
2078 specify any header lines it likes in quota_warn_message. If certain of them are
2079 missing, defaults are inserted, so we need to be able to test for the presence
2080 of a given header.
2081
2082 Arguments:
2083 hdr the required header name
2084 hstring the header string
2085
2086 Returns: TRUE the header is in the string
2087 FALSE the header is not in the string
2088 */
2089
2090 static BOOL
2091 contains_header(uschar *hdr, uschar *hstring)
2092 {
2093 int len = Ustrlen(hdr);
2094 uschar *p = hstring;
2095 while (*p != 0)
2096 {
2097 if (strncmpic(p, hdr, len) == 0)
2098 {
2099 p += len;
2100 while (*p == ' ' || *p == '\t') p++;
2101 if (*p == ':') return TRUE;
2102 }
2103 while (*p != 0 && *p != '\n') p++;
2104 if (*p == '\n') p++;
2105 }
2106 return FALSE;
2107 }
2108
2109
2110
2111
2112 /*************************************************
2113 * Perform a local delivery *
2114 *************************************************/
2115
2116 /* Each local delivery is performed in a separate process which sets its
2117 uid and gid as specified. This is a safer way than simply changing and
2118 restoring using seteuid(); there is a body of opinion that seteuid() cannot be
2119 used safely. From release 4, Exim no longer makes any use of it. Besides, not
2120 all systems have seteuid().
2121
2122 If the uid/gid are specified in the transport_instance, they are used; the
2123 transport initialization must ensure that either both or neither are set.
2124 Otherwise, the values associated with the address are used. If neither are set,
2125 it is a configuration error.
2126
2127 The transport or the address may specify a home directory (transport over-
2128 rides), and if they do, this is set as $home. If neither have set a working
2129 directory, this value is used for that as well. Otherwise $home is left unset
2130 and the cwd is set to "/" - a directory that should be accessible to all users.
2131
2132 Using a separate process makes it more complicated to get error information
2133 back. We use a pipe to pass the return code and also an error code and error
2134 text string back to the parent process.
2135
2136 Arguments:
2137 addr points to an address block for this delivery; for "normal" local
2138 deliveries this is the only address to be delivered, but for
2139 pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
2140 a number of addresses can be handled simultaneously, and in this
2141 case addr will point to a chain of addresses with the same
2142 characteristics.
2143
2144 shadowing TRUE if running a shadow transport; this causes output from pipes
2145 to be ignored.
2146
2147 Returns: nothing
2148 */
2149
2150 static void
2151 deliver_local(address_item *addr, BOOL shadowing)
2152 {
2153 BOOL use_initgroups;
2154 uid_t uid;
2155 gid_t gid;
2156 int status, len, rc;
2157 int pfd[2];
2158 pid_t pid;
2159 uschar *working_directory;
2160 address_item *addr2;
2161 transport_instance *tp = addr->transport;
2162
2163 /* Set up the return path from the errors or sender address. If the transport
2164 has its own return path setting, expand it and replace the existing value. */
2165
2166 if(addr->prop.errors_address)
2167 return_path = addr->prop.errors_address;
2168 #ifdef EXPERIMENTAL_SRS
2169 else if (addr->prop.srs_sender)
2170 return_path = addr->prop.srs_sender;
2171 #endif
2172 else
2173 return_path = sender_address;
2174
2175 if (tp->return_path)
2176 {
2177 uschar *new_return_path = expand_string(tp->return_path);
2178 if (!new_return_path)
2179 {
2180 if (!f.expand_string_forcedfail)
2181 {
2182 common_error(TRUE, addr, ERRNO_EXPANDFAIL,
2183 US"Failed to expand return path \"%s\" in %s transport: %s",
2184 tp->return_path, tp->name, expand_string_message);
2185 return;
2186 }
2187 }
2188 else return_path = new_return_path;
2189 }
2190
2191 /* For local deliveries, one at a time, the value used for logging can just be
2192 set directly, once and for all. */
2193
2194 used_return_path = return_path;
2195
2196 /* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
2197 gets put into the address(es), and the expansions are unset, so we can just
2198 return. */
2199
2200 if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
2201
2202 /* See if either the transport or the address specifies a home directory. A
2203 home directory set in the address may already be expanded; a flag is set to
2204 indicate that. In other cases we must expand it. */
2205
2206 if ( (deliver_home = tp->home_dir) /* Set in transport, or */
2207 || ( (deliver_home = addr->home_dir) /* Set in address and */
2208 && !testflag(addr, af_home_expanded) /* not expanded */
2209 ) )
2210 {
2211 uschar *rawhome = deliver_home;
2212 deliver_home = NULL; /* in case it contains $home */
2213 if (!(deliver_home = expand_string(rawhome)))
2214 {
2215 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
2216 "to expand for %s transport: %s", rawhome, tp->name,
2217 expand_string_message);
2218 return;
2219 }
2220 if (*deliver_home != '/')
2221 {
2222 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
2223 "is not absolute for %s transport", deliver_home, tp->name);
2224 return;
2225 }
2226 }
2227
2228 /* See if either the transport or the address specifies a current directory,
2229 and if so, expand it. If nothing is set, use the home directory, unless it is
2230 also unset in which case use "/", which is assumed to be a directory to which
2231 all users have access. It is necessary to be in a visible directory for some
2232 operating systems when running pipes, as some commands (e.g. "rm" under Solaris
2233 2.5) require this. */
2234
2235 working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
2236 if (working_directory)
2237 {
2238 uschar *raw = working_directory;
2239 if (!(working_directory = expand_string(raw)))
2240 {
2241 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
2242 "failed to expand for %s transport: %s", raw, tp->name,
2243 expand_string_message);
2244 return;
2245 }
2246 if (*working_directory != '/')
2247 {
2248 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
2249 "\"%s\" is not absolute for %s transport", working_directory, tp->name);
2250 return;
2251 }
2252 }
2253 else working_directory = deliver_home ? deliver_home : US"/";
2254
2255 /* If one of the return_output flags is set on the transport, create and open a
2256 file in the message log directory for the transport to write its output onto.
2257 This is mainly used by pipe transports. The file needs to be unique to the
2258 address. This feature is not available for shadow transports. */
2259
2260 if ( !shadowing
2261 && ( tp->return_output || tp->return_fail_output
2262 || tp->log_output || tp->log_fail_output || tp->log_defer_output
2263 ) )
2264 {
2265 uschar * error;
2266
2267 addr->return_filename =
2268 spool_fname(US"msglog", message_subdir, message_id,
2269 string_sprintf("-%d-%d", getpid(), return_count++));
2270
2271 if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
2272 {
2273 common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
2274 "to return message: %s", error, tp->name, strerror(errno));
2275 return;
2276 }
2277 }
2278
2279 /* Create the pipe for inter-process communication. */
2280
2281 if (pipe(pfd) != 0)
2282 {
2283 common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
2284 strerror(errno));
2285 return;
2286 }
2287
2288 /* Now fork the process to do the real work in the subprocess, but first
2289 ensure that all cached resources are freed so that the subprocess starts with
2290 a clean slate and doesn't interfere with the parent process. */
2291
2292 search_tidyup();
2293
2294 if ((pid = fork()) == 0)
2295 {
2296 BOOL replicate = TRUE;
2297
2298 /* Prevent core dumps, as we don't want them in users' home directories.
2299 HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
2300 system. Some experimental/developing systems (e.g. GNU/Hurd) may define
2301 RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
2302 complain if the error is "not supported".
2303
2304 There are two scenarios where changing the max limit has an effect. In one,
2305 the user is using a .forward and invoking a command of their choice via pipe;
2306 for these, we do need the max limit to be 0 unless the admin chooses to
2307 permit an increased limit. In the other, the command is invoked directly by
2308 the transport and is under administrator control, thus being able to raise
2309 the limit aids in debugging. So there's no general always-right answer.
2310
2311 Thus we inhibit core-dumps completely but let individual transports, while
2312 still root, re-raise the limits back up to aid debugging. We make the
2313 default be no core-dumps -- few enough people can use core dumps in
2314 diagnosis that it's reasonable to make them something that has to be explicitly requested.
2315 */
2316
2317 #ifdef RLIMIT_CORE
2318 struct rlimit rl;
2319 rl.rlim_cur = 0;
2320 rl.rlim_max = 0;
2321 if (setrlimit(RLIMIT_CORE, &rl) < 0)
2322 {
2323 # ifdef SETRLIMIT_NOT_SUPPORTED
2324 if (errno != ENOSYS && errno != ENOTSUP)
2325 # endif
2326 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
2327 strerror(errno));
2328 }
2329 #endif
2330
2331 /* Reset the random number generator, so different processes don't all
2332 have the same sequence. */
2333
2334 random_seed = 0;
2335
2336 /* If the transport has a setup entry, call this first, while still
2337 privileged. (Appendfile uses this to expand quota, for example, while
2338 able to read private files.) */
2339
2340 if (addr->transport->setup)
2341 switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
2342 &(addr->message)))
2343 {
2344 case DEFER:
2345 addr->transport_return = DEFER;
2346 goto PASS_BACK;
2347
2348 case FAIL:
2349 addr->transport_return = PANIC;
2350 goto PASS_BACK;
2351 }
2352
2353 /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
2354 when the process becomes unprivileged, it won't be able to write to the
2355 process log. SIGHUP is ignored throughout exim, except when it is being
2356 run as a daemon. */
2357
2358 signal(SIGINT, SIG_IGN);
2359 signal(SIGTERM, SIG_IGN);
2360 signal(SIGUSR1, SIG_IGN);
2361
2362 /* Close the unwanted half of the pipe, and set close-on-exec for the other
2363 half - for transports that exec things (e.g. pipe). Then set the required
2364 gid/uid. */
2365
2366 (void)close(pfd[pipe_read]);
2367 (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
2368 FD_CLOEXEC);
2369 exim_setugid(uid, gid, use_initgroups,
2370 string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
2371 addr->address, addr->transport->name));
2372
2373 DEBUG(D_deliver)
2374 {
2375 debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
2376 for (address_item * batched = addr->next; batched; batched = batched->next)
2377 debug_printf("additional batched address: %s\n", batched->address);
2378 }
2379
2380 /* Set an appropriate working directory. */
2381
2382 if (Uchdir(working_directory) < 0)
2383 {
2384 addr->transport_return = DEFER;
2385 addr->basic_errno = errno;
2386 addr->message = string_sprintf("failed to chdir to %s", working_directory);
2387 }
2388
2389 /* If successful, call the transport */
2390
2391 else
2392 {
2393 BOOL ok = TRUE;
2394 set_process_info("delivering %s to %s using %s", message_id,
2395 addr->local_part, addr->transport->name);
2396
2397 /* Setting this global in the subprocess means we need never clear it */
2398 transport_name = addr->transport->name;
2399
2400 /* If a transport filter has been specified, set up its argument list.
2401 Any errors will get put into the address, and FALSE yielded. */
2402
2403 if (addr->transport->filter_command)
2404 {
2405 ok = transport_set_up_command(&transport_filter_argv,
2406 addr->transport->filter_command,
2407 TRUE, PANIC, addr, US"transport filter", NULL);
2408 transport_filter_timeout = addr->transport->filter_timeout;
2409 }
2410 else transport_filter_argv = NULL;
2411
2412 if (ok)
2413 {
2414 debug_print_string(addr->transport->debug_string);
2415 replicate = !(addr->transport->info->code)(addr->transport, addr);
2416 }
2417 }
2418
2419 /* Pass the results back down the pipe. If necessary, first replicate the
2420 status in the top address to the others in the batch. The label is the
2421 subject of a goto when a call to the transport's setup function fails. We
2422 pass the pointer to the transport back in case it got changed as a result of
2423 file_format in appendfile. */
2424
2425 PASS_BACK:
2426
2427 if (replicate) replicate_status(addr);
2428 for (addr2 = addr; addr2; addr2 = addr2->next)
2429 {
2430 int i;
2431 int local_part_length = Ustrlen(addr2->local_part);
2432 uschar *s;
2433 int ret;
2434
2435 if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
2436 || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
2437 || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
2438 || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
2439 || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
2440 || (ret = write(pfd[pipe_write], &addr2->delivery_usec, sizeof(int))) != sizeof(int)
2441 || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
2442 || (ret = write(pfd[pipe_write], &addr2->transport,
2443 sizeof(transport_instance *))) != sizeof(transport_instance *)
2444
2445 /* For a file delivery, pass back the local part, in case the original
2446 was only part of the final delivery path. This gives more complete
2447 logging. */
2448
2449 || (testflag(addr2, af_file)
2450 && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
2451 || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
2452 )
2453 )
2454 )
2455 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
2456 ret == -1 ? strerror(errno) : "short write");
2457
2458 /* Now any messages */
2459
2460 for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
2461 {
2462 int message_length = s ? Ustrlen(s) + 1 : 0;
2463 if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
2464 || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
2465 )
2466 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s",
2467 ret == -1 ? strerror(errno) : "short write");
2468 }
2469 }
2470
2471 /* OK, this process is now done. Free any cached resources that it opened,
2472 and close the pipe we were writing down before exiting. */
2473
2474 (void)close(pfd[pipe_write]);
2475 search_tidyup();
2476 exit(EXIT_SUCCESS);
2477 }
2478
2479 /* Back in the main process: panic if the fork did not succeed. This seems
2480 better than returning an error - if forking is failing it is probably best
2481 not to try other deliveries for this message. */
2482
2483 if (pid < 0)
2484 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
2485 addr->address);
2486
2487 /* Read the pipe to get the delivery status codes and error messages. Our copy
2488 of the writing end must be closed first, as otherwise read() won't return zero
2489 on an empty pipe. We check that a status exists for each address before
2490 overwriting the address structure. If data is missing, the default DEFER status
2491 will remain. Afterwards, close the reading end. */
2492
2493 (void)close(pfd[pipe_write]);
2494
2495 for (addr2 = addr; addr2; addr2 = addr2->next)
2496 {
2497 if ((len = read(pfd[pipe_read], &status, sizeof(int))) > 0)
2498 {
2499 int i;
2500 uschar **sptr;
2501
2502 addr2->transport_return = status;
2503 len = read(pfd[pipe_read], &transport_count,
2504 sizeof(transport_count));
2505 len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
2506 len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
2507 len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
2508 len = read(pfd[pipe_read], &addr2->delivery_usec, sizeof(int));
2509 len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
2510 len = read(pfd[pipe_read], &addr2->transport,
2511 sizeof(transport_instance *));
2512
2513 if (testflag(addr2, af_file))
2514 {
2515 int llen;
2516 if ( read(pfd[pipe_read], &llen, sizeof(int)) != sizeof(int)
2517 || llen > 64*4 /* limit from rfc 5821, times I18N factor */
2518 )
2519 {
2520 log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part length read"
2521 " from delivery subprocess");
2522 break;
2523 }
2524 /* sanity-checked llen so disable the Coverity error */
2525 /* coverity[tainted_data] */
2526 if (read(pfd[pipe_read], big_buffer, llen) != llen)
2527 {
2528 log_write(0, LOG_MAIN|LOG_PANIC, "bad local_part read"
2529 " from delivery subprocess");
2530 break;
2531 }
2532 big_buffer[llen] = 0;
2533 addr2->local_part = string_copy(big_buffer);
2534 }
2535
2536 for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
2537 {
2538 int message_length;
2539 len = read(pfd[pipe_read], &message_length, sizeof(int));
2540 if (message_length > 0)
2541 {
2542 len = read(pfd[pipe_read], big_buffer, message_length);
2543 big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
2544 if (len > 0) *sptr = string_copy(big_buffer);
2545 }
2546 }
2547 }
2548
2549 else
2550 {
2551 log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
2552 "from delivery subprocess", addr2->unique);
2553 break;
2554 }
2555 }
2556
2557 (void)close(pfd[pipe_read]);
2558
2559 /* Unless shadowing, write all successful addresses immediately to the journal
2560 file, to ensure they are recorded asap. For homonymic addresses, use the base
2561 address plus the transport name. Failure to write the journal is panic-worthy,
2562 but don't stop, as it may prove possible subsequently to update the spool file
2563 in order to record the delivery. */
2564
2565 if (!shadowing)
2566 {
2567 for (addr2 = addr; addr2; addr2 = addr2->next)
2568 if (addr2->transport_return == OK)
2569 {
2570 if (testflag(addr2, af_homonym))
2571 sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
2572 else
2573 sprintf(CS big_buffer, "%.500s\n", addr2->unique);
2574
2575 /* In the test harness, wait just a bit to let the subprocess finish off
2576 any debug output etc first. */
2577
2578 if (f.running_in_test_harness) millisleep(300);
2579
2580 DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
2581 len = Ustrlen(big_buffer);
2582 if (write(journal_fd, big_buffer, len) != len)
2583 log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
2584 big_buffer, strerror(errno));
2585 }
2586
2587 /* Ensure the journal file is pushed out to disk. */
2588
2589 if (EXIMfsync(journal_fd) < 0)
2590 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2591 strerror(errno));
2592 }
2593
2594 /* Wait for the process to finish. If it terminates with a non-zero code,
2595 freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
2596 status values of all the addresses as they are. Take care to handle the case
2597 when the subprocess doesn't seem to exist. This has been seen on one system
2598 when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
2599 happens, wait() doesn't recognize the termination of child processes. Exim now
2600 resets SIGCHLD to SIG_DFL, but this code should still be robust. */
2601
2602 while ((rc = wait(&status)) != pid)
2603 if (rc < 0 && errno == ECHILD) /* Process has vanished */
2604 {
2605 log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
2606 addr->transport->driver_name);
2607 status = 0;
2608 break;
2609 }
2610
2611 if ((status & 0xffff) != 0)
2612 {
2613 int msb = (status >> 8) & 255;
2614 int lsb = status & 255;
2615 int code = (msb == 0)? (lsb & 0x7f) : msb;
2616 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
2617 addr->special_action = SPECIAL_FREEZE;
2618 log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
2619 "status 0x%04x: %s %d",
2620 addr->transport->driver_name,
2621 status,
2622 msb == 0 ? "terminated by signal" : "exit code",
2623 code);
2624 }
2625
2626 /* If SPECIAL_WARN is set in the top address, send a warning message. */
2627
2628 if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
2629 {
2630 int fd;
2631 uschar *warn_message;
2632 pid_t pid;
2633
2634 DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
2635
2636 if (!(warn_message = expand_string(addr->transport->warn_message)))
2637 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
2638 "message for %s transport): %s", addr->transport->warn_message,
2639 addr->transport->name, expand_string_message);
2640
2641 else if ((pid = child_open_exim(&fd)) > 0)
2642 {
2643 FILE *f = fdopen(fd, "wb");
2644 if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
2645 fprintf(f, "Reply-To: %s\n", errors_reply_to);
2646 fprintf(f, "Auto-Submitted: auto-replied\n");
2647 if (!contains_header(US"From", warn_message))
2648 moan_write_from(f);
2649 fprintf(f, "%s", CS warn_message);
2650
2651 /* Close and wait for child process to complete, without a timeout. */
2652
2653 (void)fclose(f);
2654 (void)child_close(pid, 0);
2655 }
2656
2657 addr->special_action = SPECIAL_NONE;
2658 }
2659 }
2660
2661
2662
2663
2664 /* Check transport for the given concurrency limit. Return TRUE if over
2665 the limit (or an expansion failure), else FALSE and if there was a limit,
2666 the key for the hints database used for the concurrency count. */
2667
2668 static BOOL
2669 tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
2670 {
2671 unsigned max_parallel;
2672
2673 if (!tp->max_parallel) return FALSE;
2674
2675 max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
2676 if (expand_string_message)
2677 {
2678 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
2679 "in %s transport (%s): %s", tp->name, addr->address,
2680 expand_string_message);
2681 return TRUE;
2682 }
2683
2684 if (max_parallel > 0)
2685 {
2686 uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
2687 if (!enq_start(serialize_key, max_parallel))
2688 {
2689 address_item * next;
2690 DEBUG(D_transport)
2691 debug_printf("skipping tpt %s because concurrency limit %u reached\n",
2692 tp->name, max_parallel);
2693 do
2694 {
2695 next = addr->next;
2696 addr->message = US"concurrency limit reached for transport";
2697 addr->basic_errno = ERRNO_TRETRY;
2698 post_process_one(addr, DEFER, LOG_MAIN, EXIM_DTYPE_TRANSPORT, 0);
2699 } while ((addr = next));
2700 return TRUE;
2701 }
2702 *key = serialize_key;
2703 }
2704 return FALSE;
2705 }
2706
2707
2708
2709 /*************************************************
2710 * Do local deliveries *
2711 *************************************************/
2712
2713 /* This function processes the list of addresses in addr_local. True local
2714 deliveries are always done one address at a time. However, local deliveries can
2715 be batched up in some cases. Typically this is when writing batched SMTP output
2716 files for use by some external transport mechanism, or when running local
2717 deliveries over LMTP.
2718
2719 Arguments: None
2720 Returns: Nothing
2721 */
2722
2723 static void
2724 do_local_deliveries(void)
2725 {
2726 open_db dbblock;
2727 open_db *dbm_file = NULL;
2728 time_t now = time(NULL);
2729
2730 /* Loop until we have exhausted the supply of local deliveries */
2731
2732 while (addr_local)
2733 {
2734 struct timeval delivery_start;
2735 struct timeval deliver_time;
2736 address_item *addr2, *addr3, *nextaddr;
2737 int logflags = LOG_MAIN;
2738 int logchar = f.dont_deliver? '*' : '=';
2739 transport_instance *tp;
2740 uschar * serialize_key = NULL;
2741
2742 /* Pick the first undelivered address off the chain */
2743
2744 address_item *addr = addr_local;
2745 addr_local = addr->next;
2746 addr->next = NULL;
2747
2748 DEBUG(D_deliver|D_transport)
2749 debug_printf("--------> %s <--------\n", addr->address);
2750
2751 /* An internal disaster if there is no transport. Should not occur! */
2752
2753 if (!(tp = addr->transport))
2754 {
2755 logflags |= LOG_PANIC;
2756 f.disable_logging = FALSE; /* Jic */
2757 addr->message = addr->router
2758 ? string_sprintf("No transport set by %s router", addr->router->name)
2759 : US"No transport set by system filter";
2760 post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
2761 continue;
2762 }
2763
2764 /* Check that this base address hasn't previously been delivered to this
2765 transport. The check is necessary at this point to handle homonymic addresses
2766 correctly in cases where the pattern of redirection changes between delivery
2767 attempts. Non-homonymic previous delivery is detected earlier, at routing
2768 time. */
2769
2770 if (previously_transported(addr, FALSE)) continue;
2771
2772 /* There are weird cases where logging is disabled */
2773
2774 f.disable_logging = tp->disable_logging;
2775
2776 /* Check for batched addresses and possible amalgamation. Skip all the work
2777 if either batch_max <= 1 or there aren't any other addresses for local
2778 delivery. */
2779
2780 if (tp->batch_max > 1 && addr_local)
2781 {
2782 int batch_count = 1;
2783 BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
2784 BOOL uses_lp = ( testflag(addr, af_pfr)
2785 && (testflag(addr, af_file) || addr->local_part[0] == '|')
2786 )
2787 || readconf_depends((driver_instance *)tp, US"local_part");
2788 uschar *batch_id = NULL;
2789 address_item **anchor = &addr_local;
2790 address_item *last = addr;
2791 address_item *next;
2792
2793 /* Expand the batch_id string for comparison with other addresses.
2794 Expansion failure suppresses batching. */
2795
2796 if (tp->batch_id)
2797 {
2798 deliver_set_expansions(addr);
2799 batch_id = expand_string(tp->batch_id);
2800 deliver_set_expansions(NULL);
2801 if (!batch_id)
2802 {
2803 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2804 "in %s transport (%s): %s", tp->name, addr->address,
2805 expand_string_message);
2806 batch_count = tp->batch_max;
2807 }
2808 }
2809
2810 /* Until we reach the batch_max limit, pick off addresses which have the
2811 same characteristics. These are:
2812
2813 same transport
2814 not previously delivered (see comment about 50 lines above)
2815 same local part if the transport's configuration contains $local_part
2816 or if this is a file or pipe delivery from a redirection
2817 same domain if the transport's configuration contains $domain
2818 same errors address
2819 same additional headers
2820 same headers to be removed
2821 same uid/gid for running the transport
2822 same first host if a host list is set
2823 */
2824
2825 while ((next = *anchor) && batch_count < tp->batch_max)
2826 {
2827 BOOL ok =
2828 tp == next->transport
2829 && !previously_transported(next, TRUE)
2830 && testflag(addr, af_pfr) == testflag(next, af_pfr)
2831 && testflag(addr, af_file) == testflag(next, af_file)
2832 && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
2833 && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
2834 && same_strings(next->prop.errors_address, addr->prop.errors_address)
2835 && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
2836 && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
2837 && same_ugid(tp, addr, next)
2838 && ( !addr->host_list && !next->host_list
2839 || addr->host_list
2840 && next->host_list
2841 && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
2842 );
2843
2844 /* If the transport has a batch_id setting, batch_id will be non-NULL
2845 from the expansion outside the loop. Expand for this address and compare.
2846 Expansion failure makes this address ineligible for batching. */
2847
2848 if (ok && batch_id)
2849 {
2850 uschar *bid;
2851 address_item *save_nextnext = next->next;
2852 next->next = NULL; /* Expansion for a single address */
2853 deliver_set_expansions(next);
2854 next->next = save_nextnext;
2855 bid = expand_string(tp->batch_id);
2856 deliver_set_expansions(NULL);
2857 if (!bid)
2858 {
2859 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2860 "in %s transport (%s): %s", tp->name, next->address,
2861 expand_string_message);
2862 ok = FALSE;
2863 }
2864 else ok = (Ustrcmp(batch_id, bid) == 0);
2865 }
2866
2867 /* Take address into batch if OK. */
2868
2869 if (ok)
2870 {
2871 *anchor = next->next; /* Include the address */
2872 next->next = NULL;
2873 last->next = next;
2874 last = next;
2875 batch_count++;
2876 }
2877 else anchor = &next->next; /* Skip the address */
2878 }
2879 }
2880
2881 /* We now have one or more addresses that can be delivered in a batch. Check
2882 whether the transport is prepared to accept a message of this size. If not,
2883 fail them all forthwith. If the expansion fails, or does not yield an
2884 integer, defer delivery. */
2885
2886 if (tp->message_size_limit)
2887 {
2888 int rc = check_message_size(tp, addr);
2889 if (rc != OK)
2890 {
2891 replicate_status(addr);
2892 while (addr)
2893 {
2894 addr2 = addr->next;
2895 post_process_one(addr, rc, logflags, EXIM_DTYPE_TRANSPORT, 0);
2896 addr = addr2;
2897 }
2898 continue; /* With next batch of addresses */
2899 }
2900 }
2901
2902 /* If we are not running the queue, or if forcing, all deliveries will be
2903 attempted. Otherwise, we must respect the retry times for each address. Even
2904 when not doing this, we need to set up the retry key string, and determine
2905 whether a retry record exists, because after a successful delivery, a delete
2906 retry item must be set up. Keep the retry database open only for the duration
2907 of these checks, rather than for all local deliveries, because some local
2908 deliveries (e.g. to pipes) can take a substantial time. */
2909
2910 if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE, TRUE)))
2911 {
2912 DEBUG(D_deliver|D_retry|D_hints_lookup)
2913 debug_printf("no retry data available\n");
2914 }
2915
2916 addr2 = addr;
2917 addr3 = NULL;
2918 while (addr2)
2919 {
2920 BOOL ok = TRUE; /* to deliver this address */
2921 uschar *retry_key;
2922
2923 /* Set up the retry key to include the domain or not, and change its
2924 leading character from "R" to "T". Must make a copy before doing this,
2925 because the old key may be pointed to from a "delete" retry item after
2926 a routing delay. */
2927
2928 retry_key = string_copy(
2929 tp->retry_use_local_part ? addr2->address_retry_key :
2930 addr2->domain_retry_key);
2931 *retry_key = 'T';
2932
2933 /* Inspect the retry data. If there is no hints file, delivery happens. */
2934
2935 if (dbm_file)
2936 {
2937 dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
2938
2939 /* If there is no retry record, delivery happens. If there is,
2940 remember it exists so it can be deleted after a successful delivery. */
2941
2942 if (retry_record)
2943 {
2944 setflag(addr2, af_lt_retry_exists);
2945
2946 /* A retry record exists for this address. If queue running and not
2947 forcing, inspect its contents. If the record is too old, or if its
2948 retry time has come, or if it has passed its cutoff time, delivery
2949 will go ahead. */
2950
2951 DEBUG(D_retry)
2952 {
2953 debug_printf("retry record exists: age=%s ",
2954 readconf_printtime(now - retry_record->time_stamp));
2955 debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
2956 debug_printf(" time to retry = %s expired = %d\n",
2957 readconf_printtime(retry_record->next_try - now),
2958 retry_record->expired);
2959 }
2960
2961 if (f.queue_running && !f.deliver_force)
2962 {
2963 ok = (now - retry_record->time_stamp > retry_data_expire)
2964 || (now >= retry_record->next_try)
2965 || retry_record->expired;
2966
2967 /* If we haven't reached the retry time, there is one more check
2968 to do, which is for the ultimate address timeout. */
2969
2970 if (!ok)
2971 ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
2972 retry_record, now);
2973 }
2974 }
2975 else DEBUG(D_retry) debug_printf("no retry record exists\n");
2976 }
2977
2978 /* This address is to be delivered. Leave it on the chain. */
2979
2980 if (ok)
2981 {
2982 addr3 = addr2;
2983 addr2 = addr2->next;
2984 }
2985
2986 /* This address is to be deferred. Take it out of the chain, and
2987 post-process it as complete. Must take it out of the chain first,
2988 because post processing puts it on another chain. */
2989
2990 else
2991 {
2992 address_item *this = addr2;
2993 this->message = US"Retry time not yet reached";
2994 this->basic_errno = ERRNO_LRETRY;
2995 addr2 = addr3 ? (addr3->next = addr2->next)
2996 : (addr = addr2->next);
2997 post_process_one(this, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
2998 }
2999 }
3000
3001 if (dbm_file) dbfn_close(dbm_file);
3002
3003 /* If there are no addresses left on the chain, they all deferred. Loop
3004 for the next set of addresses. */
3005
3006 if (!addr) continue;
3007
3008 /* If the transport is limited for parallellism, enforce that here.
3009 We use a hints DB entry, incremented here and decremented after
3010 the transport (and any shadow transport) completes. */
3011
3012 if (tpt_parallel_check(tp, addr, &serialize_key))
3013 {
3014 if (expand_string_message)
3015 {
3016 logflags |= LOG_PANIC;
3017 do
3018 {
3019 addr = addr->next;
3020 post_process_one(addr, DEFER, logflags, EXIM_DTYPE_TRANSPORT, 0);
3021 } while ((addr = addr2));
3022 }
3023 continue; /* Loop for the next set of addresses. */
3024 }
3025
3026
3027 /* So, finally, we do have some addresses that can be passed to the
3028 transport. Before doing so, set up variables that are relevant to a
3029 single delivery. */
3030
3031 deliver_set_expansions(addr);
3032
3033 gettimeofday(&delivery_start, NULL);
3034 deliver_local(addr, FALSE);
3035 timesince(&deliver_time, &delivery_start);
3036
3037 /* If a shadow transport (which must perforce be another local transport), is
3038 defined, and its condition is met, we must pass the message to the shadow
3039 too, but only those addresses that succeeded. We do this by making a new
3040 chain of addresses - also to keep the original chain uncontaminated. We must
3041 use a chain rather than doing it one by one, because the shadow transport may
3042 batch.
3043
3044 NOTE: if the condition fails because of a lookup defer, there is nothing we
3045 can do! */
3046
3047 if ( tp->shadow
3048 && ( !tp->shadow_condition
3049 || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
3050 ) )
3051 {
3052 transport_instance *stp;
3053 address_item *shadow_addr = NULL;
3054 address_item **last = &shadow_addr;
3055
3056 for (stp = transports; stp; stp = stp->next)
3057 if (Ustrcmp(stp->name, tp->shadow) == 0) break;
3058
3059 if (!stp)
3060 log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
3061 tp->shadow);
3062
3063 /* Pick off the addresses that have succeeded, and make clones. Put into
3064 the shadow_message field a pointer to the shadow_message field of the real
3065 address. */
3066
3067 else for (addr2 = addr; addr2; addr2 = addr2->next)
3068 if (addr2->transport_return == OK)
3069 {
3070 addr3 = store_get(sizeof(address_item), FALSE);
3071 *addr3 = *addr2;
3072 addr3->next = NULL;
3073 addr3->shadow_message = US &addr2->shadow_message;
3074 addr3->transport = stp;
3075 addr3->transport_return = DEFER;
3076 addr3->return_filename = NULL;
3077 addr3->return_file = -1;
3078 *last = addr3;
3079 last = &addr3->next;
3080 }
3081
3082 /* If we found any addresses to shadow, run the delivery, and stick any
3083 message back into the shadow_message field in the original. */
3084
3085 if (shadow_addr)
3086 {
3087 int save_count = transport_count;
3088
3089 DEBUG(D_deliver|D_transport)
3090 debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
3091 deliver_local(shadow_addr, TRUE);
3092
3093 for(; shadow_addr; shadow_addr = shadow_addr->next)
3094 {
3095 int sresult = shadow_addr->transport_return;
3096 *(uschar **)shadow_addr->shadow_message =
3097 sresult == OK
3098 ? string_sprintf(" ST=%s", stp->name)
3099 : string_sprintf(" ST=%s (%s%s%s)", stp->name,
3100 shadow_addr->basic_errno <= 0
3101 ? US""
3102 : US strerror(shadow_addr->basic_errno),
3103 shadow_addr->basic_errno <= 0 || !shadow_addr->message
3104 ? US""
3105 : US": ",
3106 shadow_addr->message
3107 ? shadow_addr->message
3108 : shadow_addr->basic_errno <= 0
3109 ? US"unknown error"
3110 : US"");
3111
3112 DEBUG(D_deliver|D_transport)
3113 debug_printf("%s shadow transport returned %s for %s\n",
3114 stp->name, rc_to_string(sresult), shadow_addr->address);
3115 }
3116
3117 DEBUG(D_deliver|D_transport)
3118 debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
3119
3120 transport_count = save_count; /* Restore original transport count */
3121 }
3122 }
3123
3124 /* Cancel the expansions that were set up for the delivery. */
3125
3126 deliver_set_expansions(NULL);
3127
3128 /* If the transport was parallelism-limited, decrement the hints DB record. */
3129
3130 if (serialize_key) enq_end(serialize_key);
3131
3132 /* Now we can process the results of the real transport. We must take each
3133 address off the chain first, because post_process_one() puts it on another
3134 chain. */
3135
3136 for (addr2 = addr; addr2; addr2 = nextaddr)
3137 {
3138 int result = addr2->transport_return;
3139 nextaddr = addr2->next;
3140
3141 DEBUG(D_deliver|D_transport)
3142 debug_printf("%s transport returned %s for %s\n",
3143 tp->name, rc_to_string(result), addr2->address);
3144
3145 /* If there is a retry_record, or if delivery is deferred, build a retry
3146 item for setting a new retry time or deleting the old retry record from
3147 the database. These items are handled all together after all addresses
3148 have been handled (so the database is open just for a short time for
3149 updating). */
3150
3151 if (result == DEFER || testflag(addr2, af_lt_retry_exists))
3152 {
3153 int flags = result == DEFER ? 0 : rf_delete;
3154 uschar *retry_key = string_copy(tp->retry_use_local_part
3155 ? addr2->address_retry_key : addr2->domain_retry_key);
3156 *retry_key = 'T';
3157 retry_add_item(addr2, retry_key, flags);
3158 }
3159
3160 /* Done with this address */
3161
3162 if (result == OK)
3163 {
3164 addr2->more_errno = deliver_time.tv_sec;
3165 addr2->delivery_usec = deliver_time.tv_usec;
3166 }
3167 post_process_one(addr2, result, logflags, EXIM_DTYPE_TRANSPORT, logchar);
3168
3169 /* If a pipe delivery generated text to be sent back, the result may be
3170 changed to FAIL, and we must copy this for subsequent addresses in the
3171 batch. */
3172
3173 if (addr2->transport_return != result)
3174 {
3175 for (addr3 = nextaddr; addr3; addr3 = addr3->next)
3176 {
3177 addr3->transport_return = addr2->transport_return;
3178 addr3->basic_errno = addr2->basic_errno;
3179 addr3->message = addr2->message;
3180 }
3181 result = addr2->transport_return;
3182 }
3183
3184 /* Whether or not the result was changed to FAIL, we need to copy the
3185 return_file value from the first address into all the addresses of the
3186 batch, so they are all listed in the error message. */
3187
3188 addr2->return_file = addr->return_file;
3189
3190 /* Change log character for recording successful deliveries. */
3191
3192 if (result == OK) logchar = '-';
3193 }
3194 } /* Loop back for next batch of addresses */
3195 }
3196
3197
3198
3199
3200 /*************************************************
3201 * Sort remote deliveries *
3202 *************************************************/
3203
3204 /* This function is called if remote_sort_domains is set. It arranges that the
3205 chain of addresses for remote deliveries is ordered according to the strings
3206 specified. Try to make this shuffling reasonably efficient by handling
3207 sequences of addresses rather than just single ones.
3208
3209 Arguments: None
3210 Returns: Nothing
3211 */
3212
3213 static void
3214 sort_remote_deliveries(void)
3215 {
3216 int sep = 0;
3217 address_item **aptr = &addr_remote;
3218 const uschar *listptr = remote_sort_domains;
3219 uschar *pattern;
3220 uschar patbuf[256];
3221
3222 while ( *aptr
3223 && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
3224 )
3225 {
3226 address_item *moved = NULL;
3227 address_item **bptr = &moved;
3228
3229 while (*aptr)
3230 {
3231 address_item **next;
3232 deliver_domain = (*aptr)->domain; /* set $domain */
3233 if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
3234 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
3235 {
3236 aptr = &(*aptr)->next;
3237 continue;
3238 }
3239
3240 next = &(*aptr)->next;
3241 while ( *next
3242 && (deliver_domain = (*next)->domain, /* Set $domain */
3243 match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
3244 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
3245 )
3246 next = &(*next)->next;
3247
3248 /* If the batch of non-matchers is at the end, add on any that were
3249 extracted further up the chain, and end this iteration. Otherwise,
3250 extract them from the chain and hang on the moved chain. */
3251
3252 if (!*next)
3253 {
3254 *next = moved;
3255 break;
3256 }
3257
3258 *bptr = *aptr;
3259 *aptr = *next;
3260 *next = NULL;
3261 bptr = next;
3262 aptr = &(*aptr)->next;
3263 }
3264
3265 /* If the loop ended because the final address matched, *aptr will
3266 be NULL. Add on to the end any extracted non-matching addresses. If
3267 *aptr is not NULL, the loop ended via "break" when *next is null, that
3268 is, there was a string of non-matching addresses at the end. In this
3269 case the extracted addresses have already been added on the end. */
3270
3271 if (!*aptr) *aptr = moved;
3272 }
3273
3274 DEBUG(D_deliver)
3275 {
3276 debug_printf("remote addresses after sorting:\n");
3277 for (address_item * addr = addr_remote; addr; addr = addr->next)
3278 debug_printf(" %s\n", addr->address);
3279 }
3280 }
3281
3282
3283
3284 /*************************************************
3285 * Read from pipe for remote delivery subprocess *
3286 *************************************************/
3287
3288 /* This function is called when the subprocess is complete, but can also be
3289 called before it is complete, in order to empty a pipe that is full (to prevent
3290 deadlock). It must therefore keep track of its progress in the parlist data
3291 block.
3292
3293 We read the pipe to get the delivery status codes and a possible error message
3294 for each address, optionally preceded by unusability data for the hosts and
3295 also by optional retry data.
3296
3297 Read in large chunks into the big buffer and then scan through, interpreting
3298 the data therein. In most cases, only a single read will be necessary. No
3299 individual item will ever be anywhere near 2500 bytes in length, so by ensuring
3300 that we read the next chunk when there is less than 2500 bytes left in the
3301 non-final chunk, we can assume each item is complete in the buffer before
3302 handling it. Each item is written using a single write(), which is atomic for
3303 small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
3304 often bigger) so even if we are reading while the subprocess is still going, we
3305 should never have only a partial item in the buffer.
3306
3307 hs12: This assumption is not true anymore, since we get quite large items (certificate
3308 information and such).
3309
3310 Argument:
3311 poffset the offset of the parlist item
3312 eop TRUE if the process has completed
3313
3314 Returns: TRUE if the terminating 'Z' item has been read,
3315 or there has been a disaster (i.e. no more data needed);
3316 FALSE otherwise
3317 */
3318
3319 static BOOL
3320 par_read_pipe(int poffset, BOOL eop)
3321 {
3322 host_item *h;
3323 pardata *p = parlist + poffset;
3324 address_item *addrlist = p->addrlist;
3325 address_item *addr = p->addr;
3326 pid_t pid = p->pid;
3327 int fd = p->fd;
3328
3329 uschar *msg = p->msg;
3330 BOOL done = p->done;
3331
3332 /* Loop through all items, reading from the pipe when necessary. The pipe
3333 used to be non-blocking. But I do not see a reason for using non-blocking I/O
3334 here, as the preceding select() tells us, if data is available for reading.
3335
3336 A read() on a "selected" handle should never block, but(!) it may return
3337 less data then we expected. (The buffer size we pass to read() shouldn't be
3338 understood as a "request", but as a "limit".)
3339
3340 Each separate item is written to the pipe in a timely manner. But, especially for
3341 larger items, the read(2) may already return partial data from the write(2).
3342
3343 The write is atomic mostly (depending on the amount written), but atomic does
3344 not imply "all or noting", it just is "not intermixed" with other writes on the
3345 same channel (pipe).
3346
3347 */
3348
3349 DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
3350 (int)p->pid, eop? "ended" : "not ended yet");
3351
3352 while (!done)
3353 {
3354 retry_item *r, **rp;
3355 uschar pipeheader[PIPE_HEADER_SIZE+1];
3356 uschar *id = &pipeheader[0];
3357 uschar *subid = &pipeheader[1];
3358 uschar *ptr = big_buffer;
3359 size_t required = PIPE_HEADER_SIZE; /* first the pipehaeder, later the data */
3360 ssize_t got;
3361
3362 DEBUG(D_deliver) debug_printf(
3363 "expect %lu bytes (pipeheader) from tpt process %d\n", (u_long)required, pid);
3364
3365 /* We require(!) all the PIPE_HEADER_SIZE bytes here, as we know,
3366 they're written in a timely manner, so waiting for the write shouldn't hurt a lot.
3367 If we get less, we can assume the subprocess do be done and do not expect any further
3368 information from it. */
3369
3370 if ((got = readn(fd, pipeheader, required)) != required)
3371 {
3372 msg = string_sprintf("got " SSIZE_T_FMT " of %d bytes (pipeheader) "
3373 "from transport process %d for transport %s",
3374 got, PIPE_HEADER_SIZE, pid, addr->transport->driver_name);
3375 done = TRUE;
3376 break;
3377 }
3378
3379 pipeheader[PIPE_HEADER_SIZE] = '\0';
3380 DEBUG(D_deliver)
3381 debug_printf("got %ld bytes (pipeheader) from transport process %d\n",
3382 (long) got, pid);
3383
3384 {
3385 /* If we can't decode the pipeheader, the subprocess seems to have a
3386 problem, we do not expect any furher information from it. */
3387 char *endc;
3388 required = Ustrtol(pipeheader+2, &endc, 10);
3389 if (*endc)
3390 {
3391 msg = string_sprintf("failed to read pipe "
3392 "from transport process %d for transport %s: error decoding size from header",
3393 pid, addr->transport->driver_name);
3394 done = TRUE;
3395 break;
3396 }
3397 }
3398
3399 DEBUG(D_deliver)
3400 debug_printf("expect %lu bytes (pipedata) from transport process %d\n",
3401 (u_long)required, pid);
3402
3403 /* Same as above, the transport process will write the bytes announced
3404 in a timely manner, so we can just wait for the bytes, getting less than expected
3405 is considered a problem of the subprocess, we do not expect anything else from it. */
3406 if ((got = readn(fd, big_buffer, required)) != required)
3407 {
3408 msg = string_sprintf("got only " SSIZE_T_FMT " of " SIZE_T_FMT
3409 " bytes (pipedata) from transport process %d for transport %s",
3410 got, required, pid, addr->transport->driver_name);
3411 done = TRUE;
3412 break;
3413 }
3414
3415 /* Handle each possible type of item, assuming the complete item is
3416 available in store. */
3417
3418 switch (*id)
3419 {
3420 /* Host items exist only if any hosts were marked unusable. Match
3421 up by checking the IP address. */
3422
3423 case 'H':
3424 for (h = addrlist->host_list; h; h = h->next)
3425 {
3426 if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
3427 h->status = ptr[0];
3428 h->why = ptr[1];
3429 }
3430 ptr += 2;
3431 while (*ptr++);
3432 break;
3433
3434 /* Retry items are sent in a preceding R item for each address. This is
3435 kept separate to keep each message short enough to guarantee it won't
3436 be split in the pipe. Hopefully, in the majority of cases, there won't in
3437 fact be any retry items at all.
3438
3439 The complete set of retry items might include an item to delete a
3440 routing retry if there was a previous routing delay. However, routing
3441 retries are also used when a remote transport identifies an address error.
3442 In that case, there may also be an "add" item for the same key. Arrange
3443 that a "delete" item is dropped in favour of an "add" item. */
3444
3445 case 'R':
3446 if (!addr) goto ADDR_MISMATCH;
3447
3448 DEBUG(D_deliver|D_retry)
3449 debug_printf("reading retry information for %s from subprocess\n",
3450 ptr+1);
3451
3452 /* Cut out any "delete" items on the list. */
3453
3454 for (rp = &addr->retries; (r = *rp); rp = &r->next)
3455 if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
3456 {
3457 if (!(r->flags & rf_delete)) break; /* It was not "delete" */
3458 *rp = r->next; /* Excise a delete item */
3459 DEBUG(D_deliver|D_retry)
3460 debug_printf(" existing delete item dropped\n"