dc616a1db8dd5b989618c132f24a294bd17e9daf
[exim.git] / src / src / deliver.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2016 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* The main code for delivering a message. */
9
10
11 #include "exim.h"
12 #include <assert.h>
13
14
15 /* Data block for keeping track of subprocesses for parallel remote
16 delivery. */
17
18 typedef struct pardata {
19 address_item *addrlist; /* chain of addresses */
20 address_item *addr; /* next address data expected for */
21 pid_t pid; /* subprocess pid */
22 int fd; /* pipe fd for getting result from subprocess */
23 int transport_count; /* returned transport count value */
24 BOOL done; /* no more data needed */
25 uschar *msg; /* error message */
26 uschar *return_path; /* return_path for these addresses */
27 } pardata;
28
29 /* Values for the process_recipients variable */
30
31 enum { RECIP_ACCEPT, RECIP_IGNORE, RECIP_DEFER,
32 RECIP_FAIL, RECIP_FAIL_FILTER, RECIP_FAIL_TIMEOUT,
33 RECIP_FAIL_LOOP};
34
35 /* Mutually recursive functions for marking addresses done. */
36
37 static void child_done(address_item *, uschar *);
38 static void address_done(address_item *, uschar *);
39
40 /* Table for turning base-62 numbers into binary */
41
42 static uschar tab62[] =
43 {0,1,2,3,4,5,6,7,8,9,0,0,0,0,0,0, /* 0-9 */
44 0,10,11,12,13,14,15,16,17,18,19,20, /* A-K */
45 21,22,23,24,25,26,27,28,29,30,31,32, /* L-W */
46 33,34,35, 0, 0, 0, 0, 0, /* X-Z */
47 0,36,37,38,39,40,41,42,43,44,45,46, /* a-k */
48 47,48,49,50,51,52,53,54,55,56,57,58, /* l-w */
49 59,60,61}; /* x-z */
50
51
52 /*************************************************
53 * Local static variables *
54 *************************************************/
55
56 /* addr_duplicate is global because it needs to be seen from the Envelope-To
57 writing code. */
58
59 static address_item *addr_defer = NULL;
60 static address_item *addr_failed = NULL;
61 static address_item *addr_fallback = NULL;
62 static address_item *addr_local = NULL;
63 static address_item *addr_new = NULL;
64 static address_item *addr_remote = NULL;
65 static address_item *addr_route = NULL;
66 static address_item *addr_succeed = NULL;
67 static address_item *addr_dsntmp = NULL;
68 static address_item *addr_senddsn = NULL;
69
70 static FILE *message_log = NULL;
71 static BOOL update_spool;
72 static BOOL remove_journal;
73 static int parcount = 0;
74 static pardata *parlist = NULL;
75 static int return_count;
76 static uschar *frozen_info = US"";
77 static uschar *used_return_path = NULL;
78
79
80
81 /*************************************************
82 * Make a new address item *
83 *************************************************/
84
85 /* This function gets the store and initializes with default values. The
86 transport_return value defaults to DEFER, so that any unexpected failure to
87 deliver does not wipe out the message. The default unique string is set to a
88 copy of the address, so that its domain can be lowercased.
89
90 Argument:
91 address the RFC822 address string
92 copy force a copy of the address
93
94 Returns: a pointer to an initialized address_item
95 */
96
97 address_item *
98 deliver_make_addr(uschar *address, BOOL copy)
99 {
100 address_item *addr = store_get(sizeof(address_item));
101 *addr = address_defaults;
102 if (copy) address = string_copy(address);
103 addr->address = address;
104 addr->unique = string_copy(address);
105 return addr;
106 }
107
108
109
110
111 /*************************************************
112 * Set expansion values for an address *
113 *************************************************/
114
115 /* Certain expansion variables are valid only when handling an address or
116 address list. This function sets them up or clears the values, according to its
117 argument.
118
119 Arguments:
120 addr the address in question, or NULL to clear values
121 Returns: nothing
122 */
123
124 void
125 deliver_set_expansions(address_item *addr)
126 {
127 if (!addr)
128 {
129 const uschar ***p = address_expansions;
130 while (*p) **p++ = NULL;
131 return;
132 }
133
134 /* Exactly what gets set depends on whether there is one or more addresses, and
135 what they contain. These first ones are always set, taking their values from
136 the first address. */
137
138 if (!addr->host_list)
139 {
140 deliver_host = deliver_host_address = US"";
141 deliver_host_port = 0;
142 }
143 else
144 {
145 deliver_host = addr->host_list->name;
146 deliver_host_address = addr->host_list->address;
147 deliver_host_port = addr->host_list->port;
148 }
149
150 deliver_recipients = addr;
151 deliver_address_data = addr->prop.address_data;
152 deliver_domain_data = addr->prop.domain_data;
153 deliver_localpart_data = addr->prop.localpart_data;
154
155 /* These may be unset for multiple addresses */
156
157 deliver_domain = addr->domain;
158 self_hostname = addr->self_hostname;
159
160 #ifdef EXPERIMENTAL_BRIGHTMAIL
161 bmi_deliver = 1; /* deliver by default */
162 bmi_alt_location = NULL;
163 bmi_base64_verdict = NULL;
164 bmi_base64_tracker_verdict = NULL;
165 #endif
166
167 /* If there's only one address we can set everything. */
168
169 if (!addr->next)
170 {
171 address_item *addr_orig;
172
173 deliver_localpart = addr->local_part;
174 deliver_localpart_prefix = addr->prefix;
175 deliver_localpart_suffix = addr->suffix;
176
177 for (addr_orig = addr; addr_orig->parent; addr_orig = addr_orig->parent) ;
178 deliver_domain_orig = addr_orig->domain;
179
180 /* Re-instate any prefix and suffix in the original local part. In all
181 normal cases, the address will have a router associated with it, and we can
182 choose the caseful or caseless version accordingly. However, when a system
183 filter sets up a pipe, file, or autoreply delivery, no router is involved.
184 In this case, though, there won't be any prefix or suffix to worry about. */
185
186 deliver_localpart_orig = !addr_orig->router
187 ? addr_orig->local_part
188 : addr_orig->router->caseful_local_part
189 ? addr_orig->cc_local_part
190 : addr_orig->lc_local_part;
191
192 /* If there's a parent, make its domain and local part available, and if
193 delivering to a pipe or file, or sending an autoreply, get the local
194 part from the parent. For pipes and files, put the pipe or file string
195 into address_pipe and address_file. */
196
197 if (addr->parent)
198 {
199 deliver_domain_parent = addr->parent->domain;
200 deliver_localpart_parent = !addr->parent->router
201 ? addr->parent->local_part
202 : addr->parent->router->caseful_local_part
203 ? addr->parent->cc_local_part
204 : addr->parent->lc_local_part;
205
206 /* File deliveries have their own flag because they need to be picked out
207 as special more often. */
208
209 if (testflag(addr, af_pfr))
210 {
211 if (testflag(addr, af_file)) address_file = addr->local_part;
212 else if (deliver_localpart[0] == '|') address_pipe = addr->local_part;
213 deliver_localpart = addr->parent->local_part;
214 deliver_localpart_prefix = addr->parent->prefix;
215 deliver_localpart_suffix = addr->parent->suffix;
216 }
217 }
218
219 #ifdef EXPERIMENTAL_BRIGHTMAIL
220 /* Set expansion variables related to Brightmail AntiSpam */
221 bmi_base64_verdict = bmi_get_base64_verdict(deliver_localpart_orig, deliver_domain_orig);
222 bmi_base64_tracker_verdict = bmi_get_base64_tracker_verdict(bmi_base64_verdict);
223 /* get message delivery status (0 - don't deliver | 1 - deliver) */
224 bmi_deliver = bmi_get_delivery_status(bmi_base64_verdict);
225 /* if message is to be delivered, get eventual alternate location */
226 if (bmi_deliver == 1)
227 bmi_alt_location = bmi_get_alt_location(bmi_base64_verdict);
228 #endif
229
230 }
231
232 /* For multiple addresses, don't set local part, and leave the domain and
233 self_hostname set only if it is the same for all of them. It is possible to
234 have multiple pipe and file addresses, but only when all addresses have routed
235 to the same pipe or file. */
236
237 else
238 {
239 address_item *addr2;
240 if (testflag(addr, af_pfr))
241 {
242 if (testflag(addr, af_file)) address_file = addr->local_part;
243 else if (addr->local_part[0] == '|') address_pipe = addr->local_part;
244 }
245 for (addr2 = addr->next; addr2; addr2 = addr2->next)
246 {
247 if (deliver_domain && Ustrcmp(deliver_domain, addr2->domain) != 0)
248 deliver_domain = NULL;
249 if ( self_hostname
250 && ( !addr2->self_hostname
251 || Ustrcmp(self_hostname, addr2->self_hostname) != 0
252 ) )
253 self_hostname = NULL;
254 if (!deliver_domain && !self_hostname) break;
255 }
256 }
257 }
258
259
260
261
262 /*************************************************
263 * Open a msglog file *
264 *************************************************/
265
266 /* This function is used both for normal message logs, and for files in the
267 msglog directory that are used to catch output from pipes. Try to create the
268 directory if it does not exist. From release 4.21, normal message logs should
269 be created when the message is received.
270
271 Argument:
272 filename the file name
273 mode the mode required
274 error used for saying what failed
275
276 Returns: a file descriptor, or -1 (with errno set)
277 */
278
279 static int
280 open_msglog_file(uschar *filename, int mode, uschar **error)
281 {
282 int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
283
284 if (fd < 0 && errno == ENOENT)
285 {
286 (void)directory_make(spool_directory,
287 spool_sname(US"msglog", message_subdir),
288 MSGLOG_DIRECTORY_MODE, TRUE);
289 fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
290 }
291
292 /* Set the close-on-exec flag and change the owner to the exim uid/gid (this
293 function is called as root). Double check the mode, because the group setting
294 doesn't always get set automatically. */
295
296 if (fd >= 0)
297 {
298 (void)fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
299 if (fchown(fd, exim_uid, exim_gid) < 0)
300 {
301 *error = US"chown";
302 return -1;
303 }
304 if (fchmod(fd, mode) < 0)
305 {
306 *error = US"chmod";
307 return -1;
308 }
309 }
310 else *error = US"create";
311
312 return fd;
313 }
314
315
316
317
318 /*************************************************
319 * Write to msglog if required *
320 *************************************************/
321
322 /* Write to the message log, if configured. This function may also be called
323 from transports.
324
325 Arguments:
326 format a string format
327
328 Returns: nothing
329 */
330
331 void
332 deliver_msglog(const char *format, ...)
333 {
334 va_list ap;
335 if (!message_logs) return;
336 va_start(ap, format);
337 vfprintf(message_log, format, ap);
338 fflush(message_log);
339 va_end(ap);
340 }
341
342
343
344
345 /*************************************************
346 * Replicate status for batch *
347 *************************************************/
348
349 /* When a transport handles a batch of addresses, it may treat them
350 individually, or it may just put the status in the first one, and return FALSE,
351 requesting that the status be copied to all the others externally. This is the
352 replication function. As well as the status, it copies the transport pointer,
353 which may have changed if appendfile passed the addresses on to a different
354 transport.
355
356 Argument: pointer to the first address in a chain
357 Returns: nothing
358 */
359
360 static void
361 replicate_status(address_item *addr)
362 {
363 address_item *addr2;
364 for (addr2 = addr->next; addr2; addr2 = addr2->next)
365 {
366 addr2->transport = addr->transport;
367 addr2->transport_return = addr->transport_return;
368 addr2->basic_errno = addr->basic_errno;
369 addr2->more_errno = addr->more_errno;
370 addr2->special_action = addr->special_action;
371 addr2->message = addr->message;
372 addr2->user_message = addr->user_message;
373 }
374 }
375
376
377
378 /*************************************************
379 * Compare lists of hosts *
380 *************************************************/
381
382 /* This function is given two pointers to chains of host items, and it yields
383 TRUE if the lists refer to the same hosts in the same order, except that
384
385 (1) Multiple hosts with the same non-negative MX values are permitted to appear
386 in different orders. Round-robinning nameservers can cause this to happen.
387
388 (2) Multiple hosts with the same negative MX values less than MX_NONE are also
389 permitted to appear in different orders. This is caused by randomizing
390 hosts lists.
391
392 This enables Exim to use a single SMTP transaction for sending to two entirely
393 different domains that happen to end up pointing at the same hosts.
394
395 Arguments:
396 one points to the first host list
397 two points to the second host list
398
399 Returns: TRUE if the lists refer to the same host set
400 */
401
402 static BOOL
403 same_hosts(host_item *one, host_item *two)
404 {
405 while (one && two)
406 {
407 if (Ustrcmp(one->name, two->name) != 0)
408 {
409 int mx = one->mx;
410 host_item *end_one = one;
411 host_item *end_two = two;
412
413 /* Batch up only if there was no MX and the list was not randomized */
414
415 if (mx == MX_NONE) return FALSE;
416
417 /* Find the ends of the shortest sequence of identical MX values */
418
419 while ( end_one->next && end_one->next->mx == mx
420 && end_two->next && end_two->next->mx == mx)
421 {
422 end_one = end_one->next;
423 end_two = end_two->next;
424 }
425
426 /* If there aren't any duplicates, there's no match. */
427
428 if (end_one == one) return FALSE;
429
430 /* For each host in the 'one' sequence, check that it appears in the 'two'
431 sequence, returning FALSE if not. */
432
433 for (;;)
434 {
435 host_item *hi;
436 for (hi = two; hi != end_two->next; hi = hi->next)
437 if (Ustrcmp(one->name, hi->name) == 0) break;
438 if (hi == end_two->next) return FALSE;
439 if (one == end_one) break;
440 one = one->next;
441 }
442
443 /* All the hosts in the 'one' sequence were found in the 'two' sequence.
444 Ensure both are pointing at the last host, and carry on as for equality. */
445
446 two = end_two;
447 }
448
449 /* if the names matched but ports do not, mismatch */
450 else if (one->port != two->port)
451 return FALSE;
452
453 /* Hosts matched */
454
455 one = one->next;
456 two = two->next;
457 }
458
459 /* True if both are NULL */
460
461 return (one == two);
462 }
463
464
465
466 /*************************************************
467 * Compare header lines *
468 *************************************************/
469
470 /* This function is given two pointers to chains of header items, and it yields
471 TRUE if they are the same header texts in the same order.
472
473 Arguments:
474 one points to the first header list
475 two points to the second header list
476
477 Returns: TRUE if the lists refer to the same header set
478 */
479
480 static BOOL
481 same_headers(header_line *one, header_line *two)
482 {
483 for (;; one = one->next, two = two->next)
484 {
485 if (one == two) return TRUE; /* Includes the case where both NULL */
486 if (!one || !two) return FALSE;
487 if (Ustrcmp(one->text, two->text) != 0) return FALSE;
488 }
489 }
490
491
492
493 /*************************************************
494 * Compare string settings *
495 *************************************************/
496
497 /* This function is given two pointers to strings, and it returns
498 TRUE if they are the same pointer, or if the two strings are the same.
499
500 Arguments:
501 one points to the first string
502 two points to the second string
503
504 Returns: TRUE or FALSE
505 */
506
507 static BOOL
508 same_strings(uschar *one, uschar *two)
509 {
510 if (one == two) return TRUE; /* Includes the case where both NULL */
511 if (!one || !two) return FALSE;
512 return (Ustrcmp(one, two) == 0);
513 }
514
515
516
517 /*************************************************
518 * Compare uid/gid for addresses *
519 *************************************************/
520
521 /* This function is given a transport and two addresses. It yields TRUE if the
522 uid/gid/initgroups settings for the two addresses are going to be the same when
523 they are delivered.
524
525 Arguments:
526 tp the transort
527 addr1 the first address
528 addr2 the second address
529
530 Returns: TRUE or FALSE
531 */
532
533 static BOOL
534 same_ugid(transport_instance *tp, address_item *addr1, address_item *addr2)
535 {
536 if ( !tp->uid_set && !tp->expand_uid
537 && !tp->deliver_as_creator
538 && ( testflag(addr1, af_uid_set) != testflag(addr2, af_gid_set)
539 || ( testflag(addr1, af_uid_set)
540 && ( addr1->uid != addr2->uid
541 || testflag(addr1, af_initgroups) != testflag(addr2, af_initgroups)
542 ) ) ) )
543 return FALSE;
544
545 if ( !tp->gid_set && !tp->expand_gid
546 && ( testflag(addr1, af_gid_set) != testflag(addr2, af_gid_set)
547 || ( testflag(addr1, af_gid_set)
548 && addr1->gid != addr2->gid
549 ) ) )
550 return FALSE;
551
552 return TRUE;
553 }
554
555
556
557
558 /*************************************************
559 * Record that an address is complete *
560 *************************************************/
561
562 /* This function records that an address is complete. This is straightforward
563 for most addresses, where the unique address is just the full address with the
564 domain lower cased. For homonyms (addresses that are the same as one of their
565 ancestors) their are complications. Their unique addresses have \x\ prepended
566 (where x = 0, 1, 2...), so that de-duplication works correctly for siblings and
567 cousins.
568
569 Exim used to record the unique addresses of homonyms as "complete". This,
570 however, fails when the pattern of redirection varies over time (e.g. if taking
571 unseen copies at only some times of day) because the prepended numbers may vary
572 from one delivery run to the next. This problem is solved by never recording
573 prepended unique addresses as complete. Instead, when a homonymic address has
574 actually been delivered via a transport, we record its basic unique address
575 followed by the name of the transport. This is checked in subsequent delivery
576 runs whenever an address is routed to a transport.
577
578 If the completed address is a top-level one (has no parent, which means it
579 cannot be homonymic) we also add the original address to the non-recipients
580 tree, so that it gets recorded in the spool file and therefore appears as
581 "done" in any spool listings. The original address may differ from the unique
582 address in the case of the domain.
583
584 Finally, this function scans the list of duplicates, marks as done any that
585 match this address, and calls child_done() for their ancestors.
586
587 Arguments:
588 addr address item that has been completed
589 now current time as a string
590
591 Returns: nothing
592 */
593
594 static void
595 address_done(address_item *addr, uschar *now)
596 {
597 address_item *dup;
598
599 update_spool = TRUE; /* Ensure spool gets updated */
600
601 /* Top-level address */
602
603 if (!addr->parent)
604 {
605 tree_add_nonrecipient(addr->unique);
606 tree_add_nonrecipient(addr->address);
607 }
608
609 /* Homonymous child address */
610
611 else if (testflag(addr, af_homonym))
612 {
613 if (addr->transport)
614 tree_add_nonrecipient(
615 string_sprintf("%s/%s", addr->unique + 3, addr->transport->name));
616 }
617
618 /* Non-homonymous child address */
619
620 else tree_add_nonrecipient(addr->unique);
621
622 /* Check the list of duplicate addresses and ensure they are now marked
623 done as well. */
624
625 for (dup = addr_duplicate; dup; dup = dup->next)
626 if (Ustrcmp(addr->unique, dup->unique) == 0)
627 {
628 tree_add_nonrecipient(dup->unique);
629 child_done(dup, now);
630 }
631 }
632
633
634
635
636 /*************************************************
637 * Decrease counts in parents and mark done *
638 *************************************************/
639
640 /* This function is called when an address is complete. If there is a parent
641 address, its count of children is decremented. If there are still other
642 children outstanding, the function exits. Otherwise, if the count has become
643 zero, address_done() is called to mark the parent and its duplicates complete.
644 Then loop for any earlier ancestors.
645
646 Arguments:
647 addr points to the completed address item
648 now the current time as a string, for writing to the message log
649
650 Returns: nothing
651 */
652
653 static void
654 child_done(address_item *addr, uschar *now)
655 {
656 address_item *aa;
657 while (addr->parent)
658 {
659 addr = addr->parent;
660 if ((addr->child_count -= 1) > 0) return; /* Incomplete parent */
661 address_done(addr, now);
662
663 /* Log the completion of all descendents only when there is no ancestor with
664 the same original address. */
665
666 for (aa = addr->parent; aa; aa = aa->parent)
667 if (Ustrcmp(aa->address, addr->address) == 0) break;
668 if (aa) continue;
669
670 deliver_msglog("%s %s: children all complete\n", now, addr->address);
671 DEBUG(D_deliver) debug_printf("%s: children all complete\n", addr->address);
672 }
673 }
674
675
676
677 /*************************************************
678 * Delivery logging support functions *
679 *************************************************/
680
681 /* The LOGGING() checks in d_log_interface() are complicated for backwards
682 compatibility. When outgoing interface logging was originally added, it was
683 conditional on just incoming_interface (which is off by default). The
684 outgoing_interface option is on by default to preserve this behaviour, but
685 you can enable incoming_interface and disable outgoing_interface to get I=
686 fields on incoming lines only.
687
688 Arguments:
689 s The log line buffer
690 sizep Pointer to the buffer size
691 ptrp Pointer to current index into buffer
692 addr The address to be logged
693
694 Returns: New value for s
695 */
696
697 static uschar *
698 d_log_interface(uschar *s, int *sizep, int *ptrp)
699 {
700 if (LOGGING(incoming_interface) && LOGGING(outgoing_interface)
701 && sending_ip_address)
702 {
703 s = string_append(s, sizep, ptrp, 2, US" I=[", sending_ip_address);
704 s = LOGGING(outgoing_port)
705 ? string_append(s, sizep, ptrp, 2, US"]:",
706 string_sprintf("%d", sending_port))
707 : string_catn(s, sizep, ptrp, US"]", 1);
708 }
709 return s;
710 }
711
712
713
714 static uschar *
715 d_hostlog(uschar * s, int * sp, int * pp, address_item * addr)
716 {
717 host_item * h = addr->host_used;
718
719 s = string_append(s, sp, pp, 2, US" H=", h->name);
720
721 if (LOGGING(dnssec) && h->dnssec == DS_YES)
722 s = string_catn(s, sp, pp, US" DS", 3);
723
724 s = string_append(s, sp, pp, 3, US" [", h->address, US"]");
725
726 if (LOGGING(outgoing_port))
727 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d", h->port));
728
729 #ifdef SUPPORT_SOCKS
730 if (LOGGING(proxy) && proxy_local_address)
731 {
732 s = string_append(s, sp, pp, 3, US" PRX=[", proxy_local_address, US"]");
733 if (LOGGING(outgoing_port))
734 s = string_append(s, sp, pp, 2, US":", string_sprintf("%d",
735 proxy_local_port));
736 }
737 #endif
738
739 return d_log_interface(s, sp, pp);
740 }
741
742
743
744
745
746 #ifdef SUPPORT_TLS
747 static uschar *
748 d_tlslog(uschar * s, int * sizep, int * ptrp, address_item * addr)
749 {
750 if (LOGGING(tls_cipher) && addr->cipher)
751 s = string_append(s, sizep, ptrp, 2, US" X=", addr->cipher);
752 if (LOGGING(tls_certificate_verified) && addr->cipher)
753 s = string_append(s, sizep, ptrp, 2, US" CV=",
754 testflag(addr, af_cert_verified)
755 ?
756 #ifdef EXPERIMENTAL_DANE
757 testflag(addr, af_dane_verified)
758 ? "dane"
759 :
760 #endif
761 "yes"
762 : "no");
763 if (LOGGING(tls_peerdn) && addr->peerdn)
764 s = string_append(s, sizep, ptrp, 3, US" DN=\"",
765 string_printing(addr->peerdn), US"\"");
766 return s;
767 }
768 #endif
769
770
771
772
773 #ifndef DISABLE_EVENT
774 uschar *
775 event_raise(uschar * action, const uschar * event, uschar * ev_data)
776 {
777 uschar * s;
778 if (action)
779 {
780 DEBUG(D_deliver)
781 debug_printf("Event(%s): event_action=|%s| delivery_IP=%s\n",
782 event,
783 action, deliver_host_address);
784
785 event_name = event;
786 event_data = ev_data;
787
788 if (!(s = expand_string(action)) && *expand_string_message)
789 log_write(0, LOG_MAIN|LOG_PANIC,
790 "failed to expand event_action %s in %s: %s\n",
791 event, transport_name, expand_string_message);
792
793 event_name = event_data = NULL;
794
795 /* If the expansion returns anything but an empty string, flag for
796 the caller to modify his normal processing
797 */
798 if (s && *s)
799 {
800 DEBUG(D_deliver)
801 debug_printf("Event(%s): event_action returned \"%s\"\n", event, s);
802 return s;
803 }
804 }
805 return NULL;
806 }
807
808 void
809 msg_event_raise(const uschar * event, const address_item * addr)
810 {
811 const uschar * save_domain = deliver_domain;
812 uschar * save_local = deliver_localpart;
813 const uschar * save_host = deliver_host;
814 const uschar * save_address = deliver_host_address;
815 const int save_port = deliver_host_port;
816
817 if (!addr->transport)
818 return;
819
820 router_name = addr->router ? addr->router->name : NULL;
821 transport_name = addr->transport->name;
822 deliver_domain = addr->domain;
823 deliver_localpart = addr->local_part;
824 deliver_host = addr->host_used ? addr->host_used->name : NULL;
825
826 (void) event_raise(addr->transport->event_action, event,
827 addr->host_used
828 || Ustrcmp(addr->transport->driver_name, "smtp") == 0
829 || Ustrcmp(addr->transport->driver_name, "lmtp") == 0
830 ? addr->message : NULL);
831
832 deliver_host_port = save_port;
833 deliver_host_address = save_address;
834 deliver_host = save_host;
835 deliver_localpart = save_local;
836 deliver_domain = save_domain;
837 router_name = transport_name = NULL;
838 }
839 #endif /*DISABLE_EVENT*/
840
841
842
843 /******************************************************************************/
844
845
846 /*************************************************
847 * Generate local prt for logging *
848 *************************************************/
849
850 /* This function is a subroutine for use in string_log_address() below.
851
852 Arguments:
853 addr the address being logged
854 yield the current dynamic buffer pointer
855 sizeptr points to current size
856 ptrptr points to current insert pointer
857
858 Returns: the new value of the buffer pointer
859 */
860
861 static uschar *
862 string_get_localpart(address_item *addr, uschar *yield, int *sizeptr,
863 int *ptrptr)
864 {
865 uschar * s;
866
867 s = addr->prefix;
868 if (testflag(addr, af_include_affixes) && s)
869 {
870 #ifdef SUPPORT_I18N
871 if (testflag(addr, af_utf8_downcvt))
872 s = string_localpart_utf8_to_alabel(s, NULL);
873 #endif
874 yield = string_cat(yield, sizeptr, ptrptr, s);
875 }
876
877 s = addr->local_part;
878 #ifdef SUPPORT_I18N
879 if (testflag(addr, af_utf8_downcvt))
880 s = string_localpart_utf8_to_alabel(s, NULL);
881 #endif
882 yield = string_cat(yield, sizeptr, ptrptr, s);
883
884 s = addr->suffix;
885 if (testflag(addr, af_include_affixes) && s)
886 {
887 #ifdef SUPPORT_I18N
888 if (testflag(addr, af_utf8_downcvt))
889 s = string_localpart_utf8_to_alabel(s, NULL);
890 #endif
891 yield = string_cat(yield, sizeptr, ptrptr, s);
892 }
893
894 return yield;
895 }
896
897
898 /*************************************************
899 * Generate log address list *
900 *************************************************/
901
902 /* This function generates a list consisting of an address and its parents, for
903 use in logging lines. For saved onetime aliased addresses, the onetime parent
904 field is used. If the address was delivered by a transport with rcpt_include_
905 affixes set, the af_include_affixes bit will be set in the address. In that
906 case, we include the affixes here too.
907
908 Arguments:
909 str points to start of growing string, or NULL
910 size points to current allocation for string
911 ptr points to offset for append point; updated on exit
912 addr bottom (ultimate) address
913 all_parents if TRUE, include all parents
914 success TRUE for successful delivery
915
916 Returns: a growable string in dynamic store
917 */
918
919 static uschar *
920 string_log_address(uschar * str, int * size, int * ptr,
921 address_item *addr, BOOL all_parents, BOOL success)
922 {
923 BOOL add_topaddr = TRUE;
924 address_item *topaddr;
925
926 /* Find the ultimate parent */
927
928 for (topaddr = addr; topaddr->parent; topaddr = topaddr->parent) ;
929
930 /* We start with just the local part for pipe, file, and reply deliveries, and
931 for successful local deliveries from routers that have the log_as_local flag
932 set. File deliveries from filters can be specified as non-absolute paths in
933 cases where the transport is goin to complete the path. If there is an error
934 before this happens (expansion failure) the local part will not be updated, and
935 so won't necessarily look like a path. Add extra text for this case. */
936
937 if ( testflag(addr, af_pfr)
938 || ( success
939 && addr->router && addr->router->log_as_local
940 && addr->transport && addr->transport->info->local
941 ) )
942 {
943 if (testflag(addr, af_file) && addr->local_part[0] != '/')
944 str = string_catn(str, size, ptr, CUS"save ", 5);
945 str = string_get_localpart(addr, str, size, ptr);
946 }
947
948 /* Other deliveries start with the full address. It we have split it into local
949 part and domain, use those fields. Some early failures can happen before the
950 splitting is done; in those cases use the original field. */
951
952 else
953 {
954 uschar * cmp = str + *ptr;
955
956 if (addr->local_part)
957 {
958 const uschar * s;
959 str = string_get_localpart(addr, str, size, ptr);
960 str = string_catn(str, size, ptr, US"@", 1);
961 s = addr->domain;
962 #ifdef SUPPORT_I18N
963 if (testflag(addr, af_utf8_downcvt))
964 s = string_localpart_utf8_to_alabel(s, NULL);
965 #endif
966 str = string_cat(str, size, ptr, s);
967 }
968 else
969 str = string_cat(str, size, ptr, addr->address);
970
971 /* If the address we are going to print is the same as the top address,
972 and all parents are not being included, don't add on the top address. First
973 of all, do a caseless comparison; if this succeeds, do a caseful comparison
974 on the local parts. */
975
976 str[*ptr] = 0;
977 if ( strcmpic(cmp, topaddr->address) == 0
978 && Ustrncmp(cmp, topaddr->address, Ustrchr(cmp, '@') - cmp) == 0
979 && !addr->onetime_parent
980 && (!all_parents || !addr->parent || addr->parent == topaddr)
981 )
982 add_topaddr = FALSE;
983 }
984
985 /* If all parents are requested, or this is a local pipe/file/reply, and
986 there is at least one intermediate parent, show it in brackets, and continue
987 with all of them if all are wanted. */
988
989 if ( (all_parents || testflag(addr, af_pfr))
990 && addr->parent
991 && addr->parent != topaddr)
992 {
993 uschar *s = US" (";
994 address_item *addr2;
995 for (addr2 = addr->parent; addr2 != topaddr; addr2 = addr2->parent)
996 {
997 str = string_catn(str, size, ptr, s, 2);
998 str = string_cat (str, size, ptr, addr2->address);
999 if (!all_parents) break;
1000 s = US", ";
1001 }
1002 str = string_catn(str, size, ptr, US")", 1);
1003 }
1004
1005 /* Add the top address if it is required */
1006
1007 if (add_topaddr)
1008 str = string_append(str, size, ptr, 3,
1009 US" <",
1010 addr->onetime_parent ? addr->onetime_parent : topaddr->address,
1011 US">");
1012
1013 return str;
1014 }
1015
1016
1017 /******************************************************************************/
1018
1019
1020
1021 /* If msg is NULL this is a delivery log and logchar is used. Otherwise
1022 this is a nonstandard call; no two-character delivery flag is written
1023 but sender-host and sender are prefixed and "msg" is inserted in the log line.
1024
1025 Arguments:
1026 flags passed to log_write()
1027 */
1028 void
1029 delivery_log(int flags, address_item * addr, int logchar, uschar * msg)
1030 {
1031 int size = 256; /* Used for a temporary, */
1032 int ptr = 0; /* expanding buffer, for */
1033 uschar * s; /* building log lines; */
1034 void * reset_point; /* released afterwards. */
1035
1036 /* Log the delivery on the main log. We use an extensible string to build up
1037 the log line, and reset the store afterwards. Remote deliveries should always
1038 have a pointer to the host item that succeeded; local deliveries can have a
1039 pointer to a single host item in their host list, for use by the transport. */
1040
1041 #ifndef DISABLE_EVENT
1042 /* presume no successful remote delivery */
1043 lookup_dnssec_authenticated = NULL;
1044 #endif
1045
1046 s = reset_point = store_get(size);
1047
1048 if (msg)
1049 s = string_append(s, &size, &ptr, 2, host_and_ident(TRUE), US" ");
1050 else
1051 {
1052 s[ptr++] = logchar;
1053 s = string_catn(s, &size, &ptr, US"> ", 2);
1054 }
1055 s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), TRUE);
1056
1057 if (LOGGING(sender_on_delivery) || msg)
1058 s = string_append(s, &size, &ptr, 3, US" F=<",
1059 #ifdef SUPPORT_I18N
1060 testflag(addr, af_utf8_downcvt)
1061 ? string_address_utf8_to_alabel(sender_address, NULL)
1062 :
1063 #endif
1064 sender_address,
1065 US">");
1066
1067 if (*queue_name)
1068 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1069
1070 #ifdef EXPERIMENTAL_SRS
1071 if(addr->prop.srs_sender)
1072 s = string_append(s, &size, &ptr, 3, US" SRS=<", addr->prop.srs_sender, US">");
1073 #endif
1074
1075 /* You might think that the return path must always be set for a successful
1076 delivery; indeed, I did for some time, until this statement crashed. The case
1077 when it is not set is for a delivery to /dev/null which is optimised by not
1078 being run at all. */
1079
1080 if (used_return_path && LOGGING(return_path_on_delivery))
1081 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
1082
1083 if (msg)
1084 s = string_append(s, &size, &ptr, 2, US" ", msg);
1085
1086 /* For a delivery from a system filter, there may not be a router */
1087 if (addr->router)
1088 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1089
1090 s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
1091
1092 if (LOGGING(delivery_size))
1093 s = string_append(s, &size, &ptr, 2, US" S=",
1094 string_sprintf("%d", transport_count));
1095
1096 /* Local delivery */
1097
1098 if (addr->transport->info->local)
1099 {
1100 if (addr->host_list)
1101 s = string_append(s, &size, &ptr, 2, US" H=", addr->host_list->name);
1102 s = d_log_interface(s, &size, &ptr);
1103 if (addr->shadow_message)
1104 s = string_cat(s, &size, &ptr, addr->shadow_message);
1105 }
1106
1107 /* Remote delivery */
1108
1109 else
1110 {
1111 if (addr->host_used)
1112 {
1113 s = d_hostlog(s, &size, &ptr, addr);
1114 if (continue_sequence > 1)
1115 s = string_catn(s, &size, &ptr, US"*", 1);
1116
1117 #ifndef DISABLE_EVENT
1118 deliver_host_address = addr->host_used->address;
1119 deliver_host_port = addr->host_used->port;
1120 deliver_host = addr->host_used->name;
1121
1122 /* DNS lookup status */
1123 lookup_dnssec_authenticated = addr->host_used->dnssec==DS_YES ? US"yes"
1124 : addr->host_used->dnssec==DS_NO ? US"no"
1125 : NULL;
1126 #endif
1127 }
1128
1129 #ifdef SUPPORT_TLS
1130 s = d_tlslog(s, &size, &ptr, addr);
1131 #endif
1132
1133 if (addr->authenticator)
1134 {
1135 s = string_append(s, &size, &ptr, 2, US" A=", addr->authenticator);
1136 if (addr->auth_id)
1137 {
1138 s = string_append(s, &size, &ptr, 2, US":", addr->auth_id);
1139 if (LOGGING(smtp_mailauth) && addr->auth_sndr)
1140 s = string_append(s, &size, &ptr, 2, US":", addr->auth_sndr);
1141 }
1142 }
1143
1144 #ifndef DISABLE_PRDR
1145 if (addr->flags & af_prdr_used)
1146 s = string_catn(s, &size, &ptr, US" PRDR", 5);
1147 #endif
1148
1149 if (addr->flags & af_chunking_used)
1150 s = string_catn(s, &size, &ptr, US" K", 2);
1151 }
1152
1153 /* confirmation message (SMTP (host_used) and LMTP (driver_name)) */
1154
1155 if ( LOGGING(smtp_confirmation)
1156 && addr->message
1157 && (addr->host_used || Ustrcmp(addr->transport->driver_name, "lmtp") == 0)
1158 )
1159 {
1160 unsigned i;
1161 unsigned lim = big_buffer_size < 1024 ? big_buffer_size : 1024;
1162 uschar *p = big_buffer;
1163 uschar *ss = addr->message;
1164 *p++ = '\"';
1165 for (i = 0; i < lim && ss[i] != 0; i++) /* limit logged amount */
1166 {
1167 if (ss[i] == '\"' || ss[i] == '\\') *p++ = '\\'; /* quote \ and " */
1168 *p++ = ss[i];
1169 }
1170 *p++ = '\"';
1171 *p = 0;
1172 s = string_append(s, &size, &ptr, 2, US" C=", big_buffer);
1173 }
1174
1175 /* Time on queue and actual time taken to deliver */
1176
1177 if (LOGGING(queue_time))
1178 s = string_append(s, &size, &ptr, 2, US" QT=",
1179 readconf_printtime( (int) ((long)time(NULL) - (long)received_time)) );
1180
1181 if (LOGGING(deliver_time))
1182 s = string_append(s, &size, &ptr, 2, US" DT=",
1183 readconf_printtime(addr->more_errno));
1184
1185 /* string_cat() always leaves room for the terminator. Release the
1186 store we used to build the line after writing it. */
1187
1188 s[ptr] = 0;
1189 log_write(0, flags, "%s", s);
1190
1191 #ifndef DISABLE_EVENT
1192 if (!msg) msg_event_raise(US"msg:delivery", addr);
1193 #endif
1194
1195 store_reset(reset_point);
1196 return;
1197 }
1198
1199
1200
1201 static void
1202 deferral_log(address_item * addr, uschar * now,
1203 int logflags, uschar * driver_name, uschar * driver_kind)
1204 {
1205 int size = 256; /* Used for a temporary, */
1206 int ptr = 0; /* expanding buffer, for */
1207 uschar * s; /* building log lines; */
1208 void * reset_point; /* released afterwards. */
1209
1210 uschar ss[32];
1211
1212 /* Build up the line that is used for both the message log and the main
1213 log. */
1214
1215 s = reset_point = store_get(size);
1216
1217 /* Create the address string for logging. Must not do this earlier, because
1218 an OK result may be changed to FAIL when a pipe returns text. */
1219
1220 s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
1221
1222 if (*queue_name)
1223 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1224
1225 /* Either driver_name contains something and driver_kind contains
1226 " router" or " transport" (note the leading space), or driver_name is
1227 a null string and driver_kind contains "routing" without the leading
1228 space, if all routing has been deferred. When a domain has been held,
1229 so nothing has been done at all, both variables contain null strings. */
1230
1231 if (driver_name)
1232 {
1233 if (driver_kind[1] == 't' && addr->router)
1234 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1235 Ustrcpy(ss, " ?=");
1236 ss[1] = toupper(driver_kind[1]);
1237 s = string_append(s, &size, &ptr, 2, ss, driver_name);
1238 }
1239 else if (driver_kind)
1240 s = string_append(s, &size, &ptr, 2, US" ", driver_kind);
1241
1242 /*XXX need an s+s+p sprintf */
1243 sprintf(CS ss, " defer (%d)", addr->basic_errno);
1244 s = string_cat(s, &size, &ptr, ss);
1245
1246 if (addr->basic_errno > 0)
1247 s = string_append(s, &size, &ptr, 2, US": ",
1248 US strerror(addr->basic_errno));
1249
1250 if (addr->host_used)
1251 {
1252 s = string_append(s, &size, &ptr, 5,
1253 US" H=", addr->host_used->name,
1254 US" [", addr->host_used->address, US"]");
1255 if (LOGGING(outgoing_port))
1256 {
1257 int port = addr->host_used->port;
1258 s = string_append(s, &size, &ptr, 2,
1259 US":", port == PORT_NONE ? US"25" : string_sprintf("%d", port));
1260 }
1261 }
1262
1263 if (addr->message)
1264 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1265
1266 s[ptr] = 0;
1267
1268 /* Log the deferment in the message log, but don't clutter it
1269 up with retry-time defers after the first delivery attempt. */
1270
1271 if (deliver_firsttime || addr->basic_errno > ERRNO_RETRY_BASE)
1272 deliver_msglog("%s %s\n", now, s);
1273
1274 /* Write the main log and reset the store.
1275 For errors of the type "retry time not reached" (also remotes skipped
1276 on queue run), logging is controlled by L_retry_defer. Note that this kind
1277 of error number is negative, and all the retry ones are less than any
1278 others. */
1279
1280
1281 log_write(addr->basic_errno <= ERRNO_RETRY_BASE ? L_retry_defer : 0, logflags,
1282 "== %s", s);
1283
1284 store_reset(reset_point);
1285 return;
1286 }
1287
1288
1289
1290 static void
1291 failure_log(address_item * addr, uschar * driver_kind, uschar * now)
1292 {
1293 int size = 256; /* Used for a temporary, */
1294 int ptr = 0; /* expanding buffer, for */
1295 uschar * s; /* building log lines; */
1296 void * reset_point; /* released afterwards. */
1297
1298 /* Build up the log line for the message and main logs */
1299
1300 s = reset_point = store_get(size);
1301
1302 /* Create the address string for logging. Must not do this earlier, because
1303 an OK result may be changed to FAIL when a pipe returns text. */
1304
1305 s = string_log_address(s, &size, &ptr, addr, LOGGING(all_parents), FALSE);
1306
1307 if (LOGGING(sender_on_delivery))
1308 s = string_append(s, &size, &ptr, 3, US" F=<", sender_address, US">");
1309
1310 if (*queue_name)
1311 s = string_append(s, &size, &ptr, 2, US" Q=", queue_name);
1312
1313 /* Return path may not be set if no delivery actually happened */
1314
1315 if (used_return_path && LOGGING(return_path_on_delivery))
1316 s = string_append(s, &size, &ptr, 3, US" P=<", used_return_path, US">");
1317
1318 if (addr->router)
1319 s = string_append(s, &size, &ptr, 2, US" R=", addr->router->name);
1320 if (addr->transport)
1321 s = string_append(s, &size, &ptr, 2, US" T=", addr->transport->name);
1322
1323 if (addr->host_used)
1324 s = d_hostlog(s, &size, &ptr, addr);
1325
1326 #ifdef SUPPORT_TLS
1327 s = d_tlslog(s, &size, &ptr, addr);
1328 #endif
1329
1330 if (addr->basic_errno > 0)
1331 s = string_append(s, &size, &ptr, 2, US": ", US strerror(addr->basic_errno));
1332
1333 if (addr->message)
1334 s = string_append(s, &size, &ptr, 2, US": ", addr->message);
1335
1336 s[ptr] = 0;
1337
1338 /* Do the logging. For the message log, "routing failed" for those cases,
1339 just to make it clearer. */
1340
1341 if (driver_kind)
1342 deliver_msglog("%s %s failed for %s\n", now, driver_kind, s);
1343 else
1344 deliver_msglog("%s %s\n", now, s);
1345
1346 log_write(0, LOG_MAIN, "** %s", s);
1347
1348 #ifndef DISABLE_EVENT
1349 msg_event_raise(US"msg:fail:delivery", addr);
1350 #endif
1351
1352 store_reset(reset_point);
1353 return;
1354 }
1355
1356
1357
1358 /*************************************************
1359 * Actions at the end of handling an address *
1360 *************************************************/
1361
1362 /* This is a function for processing a single address when all that can be done
1363 with it has been done.
1364
1365 Arguments:
1366 addr points to the address block
1367 result the result of the delivery attempt
1368 logflags flags for log_write() (LOG_MAIN and/or LOG_PANIC)
1369 driver_type indicates which type of driver (transport, or router) was last
1370 to process the address
1371 logchar '=' or '-' for use when logging deliveries with => or ->
1372
1373 Returns: nothing
1374 */
1375
1376 static void
1377 post_process_one(address_item *addr, int result, int logflags, int driver_type,
1378 int logchar)
1379 {
1380 uschar *now = tod_stamp(tod_log);
1381 uschar *driver_kind = NULL;
1382 uschar *driver_name = NULL;
1383
1384 DEBUG(D_deliver) debug_printf("post-process %s (%d)\n", addr->address, result);
1385
1386 /* Set up driver kind and name for logging. Disable logging if the router or
1387 transport has disabled it. */
1388
1389 if (driver_type == DTYPE_TRANSPORT)
1390 {
1391 if (addr->transport)
1392 {
1393 driver_name = addr->transport->name;
1394 driver_kind = US" transport";
1395 disable_logging = addr->transport->disable_logging;
1396 }
1397 else driver_kind = US"transporting";
1398 }
1399 else if (driver_type == DTYPE_ROUTER)
1400 {
1401 if (addr->router)
1402 {
1403 driver_name = addr->router->name;
1404 driver_kind = US" router";
1405 disable_logging = addr->router->disable_logging;
1406 }
1407 else driver_kind = US"routing";
1408 }
1409
1410 /* If there's an error message set, ensure that it contains only printing
1411 characters - it should, but occasionally things slip in and this at least
1412 stops the log format from getting wrecked. We also scan the message for an LDAP
1413 expansion item that has a password setting, and flatten the password. This is a
1414 fudge, but I don't know a cleaner way of doing this. (If the item is badly
1415 malformed, it won't ever have gone near LDAP.) */
1416
1417 if (addr->message)
1418 {
1419 const uschar * s = string_printing(addr->message);
1420
1421 /* deconst cast ok as string_printing known to have alloc'n'copied */
1422 addr->message = expand_hide_passwords(US s);
1423 }
1424
1425 /* If we used a transport that has one of the "return_output" options set, and
1426 if it did in fact generate some output, then for return_output we treat the
1427 message as failed if it was not already set that way, so that the output gets
1428 returned to the sender, provided there is a sender to send it to. For
1429 return_fail_output, do this only if the delivery failed. Otherwise we just
1430 unlink the file, and remove the name so that if the delivery failed, we don't
1431 try to send back an empty or unwanted file. The log_output options operate only
1432 on a non-empty file.
1433
1434 In any case, we close the message file, because we cannot afford to leave a
1435 file-descriptor for one address while processing (maybe very many) others. */
1436
1437 if (addr->return_file >= 0 && addr->return_filename)
1438 {
1439 BOOL return_output = FALSE;
1440 struct stat statbuf;
1441 (void)EXIMfsync(addr->return_file);
1442
1443 /* If there is no output, do nothing. */
1444
1445 if (fstat(addr->return_file, &statbuf) == 0 && statbuf.st_size > 0)
1446 {
1447 transport_instance *tb = addr->transport;
1448
1449 /* Handle logging options */
1450
1451 if ( tb->log_output
1452 || result == FAIL && tb->log_fail_output
1453 || result == DEFER && tb->log_defer_output
1454 )
1455 {
1456 uschar *s;
1457 FILE *f = Ufopen(addr->return_filename, "rb");
1458 if (!f)
1459 log_write(0, LOG_MAIN|LOG_PANIC, "failed to open %s to log output "
1460 "from %s transport: %s", addr->return_filename, tb->name,
1461 strerror(errno));
1462 else
1463 if ((s = US Ufgets(big_buffer, big_buffer_size, f)))
1464 {
1465 uschar *p = big_buffer + Ustrlen(big_buffer);
1466 const uschar * sp;
1467 while (p > big_buffer && isspace(p[-1])) p--;
1468 *p = 0;
1469 sp = string_printing(big_buffer);
1470 log_write(0, LOG_MAIN, "<%s>: %s transport output: %s",
1471 addr->address, tb->name, sp);
1472 }
1473 (void)fclose(f);
1474 }
1475
1476 /* Handle returning options, but only if there is an address to return
1477 the text to. */
1478
1479 if (sender_address[0] != 0 || addr->prop.errors_address)
1480 if (tb->return_output)
1481 {
1482 addr->transport_return = result = FAIL;
1483 if (addr->basic_errno == 0 && !addr->message)
1484 addr->message = US"return message generated";
1485 return_output = TRUE;
1486 }
1487 else
1488 if (tb->return_fail_output && result == FAIL) return_output = TRUE;
1489 }
1490
1491 /* Get rid of the file unless it might be returned, but close it in
1492 all cases. */
1493
1494 if (!return_output)
1495 {
1496 Uunlink(addr->return_filename);
1497 addr->return_filename = NULL;
1498 addr->return_file = -1;
1499 }
1500
1501 (void)close(addr->return_file);
1502 }
1503
1504 /* The success case happens only after delivery by a transport. */
1505
1506 if (result == OK)
1507 {
1508 addr->next = addr_succeed;
1509 addr_succeed = addr;
1510
1511 /* Call address_done() to ensure that we don't deliver to this address again,
1512 and write appropriate things to the message log. If it is a child address, we
1513 call child_done() to scan the ancestors and mark them complete if this is the
1514 last child to complete. */
1515
1516 address_done(addr, now);
1517 DEBUG(D_deliver) debug_printf("%s delivered\n", addr->address);
1518
1519 if (!addr->parent)
1520 deliver_msglog("%s %s: %s%s succeeded\n", now, addr->address,
1521 driver_name, driver_kind);
1522 else
1523 {
1524 deliver_msglog("%s %s <%s>: %s%s succeeded\n", now, addr->address,
1525 addr->parent->address, driver_name, driver_kind);
1526 child_done(addr, now);
1527 }
1528
1529 /* Certificates for logging (via events) */
1530 #ifdef SUPPORT_TLS
1531 tls_out.ourcert = addr->ourcert;
1532 addr->ourcert = NULL;
1533 tls_out.peercert = addr->peercert;
1534 addr->peercert = NULL;
1535
1536 tls_out.cipher = addr->cipher;
1537 tls_out.peerdn = addr->peerdn;
1538 tls_out.ocsp = addr->ocsp;
1539 # ifdef EXPERIMENTAL_DANE
1540 tls_out.dane_verified = testflag(addr, af_dane_verified);
1541 # endif
1542 #endif
1543
1544 delivery_log(LOG_MAIN, addr, logchar, NULL);
1545
1546 #ifdef SUPPORT_TLS
1547 tls_free_cert(&tls_out.ourcert);
1548 tls_free_cert(&tls_out.peercert);
1549 tls_out.cipher = NULL;
1550 tls_out.peerdn = NULL;
1551 tls_out.ocsp = OCSP_NOT_REQ;
1552 # ifdef EXPERIMENTAL_DANE
1553 tls_out.dane_verified = FALSE;
1554 # endif
1555 #endif
1556 }
1557
1558
1559 /* Soft failure, or local delivery process failed; freezing may be
1560 requested. */
1561
1562 else if (result == DEFER || result == PANIC)
1563 {
1564 if (result == PANIC) logflags |= LOG_PANIC;
1565
1566 /* This puts them on the chain in reverse order. Do not change this, because
1567 the code for handling retries assumes that the one with the retry
1568 information is last. */
1569
1570 addr->next = addr_defer;
1571 addr_defer = addr;
1572
1573 /* The only currently implemented special action is to freeze the
1574 message. Logging of this is done later, just before the -H file is
1575 updated. */
1576
1577 if (addr->special_action == SPECIAL_FREEZE)
1578 {
1579 deliver_freeze = TRUE;
1580 deliver_frozen_at = time(NULL);
1581 update_spool = TRUE;
1582 }
1583
1584 /* If doing a 2-stage queue run, we skip writing to either the message
1585 log or the main log for SMTP defers. */
1586
1587 if (!queue_2stage || addr->basic_errno != 0)
1588 deferral_log(addr, now, logflags, driver_name, driver_kind);
1589 }
1590
1591
1592 /* Hard failure. If there is an address to which an error message can be sent,
1593 put this address on the failed list. If not, put it on the deferred list and
1594 freeze the mail message for human attention. The latter action can also be
1595 explicitly requested by a router or transport. */
1596
1597 else
1598 {
1599 /* If this is a delivery error, or a message for which no replies are
1600 wanted, and the message's age is greater than ignore_bounce_errors_after,
1601 force the af_ignore_error flag. This will cause the address to be discarded
1602 later (with a log entry). */
1603
1604 if (!*sender_address && message_age >= ignore_bounce_errors_after)
1605 setflag(addr, af_ignore_error);
1606
1607 /* Freeze the message if requested, or if this is a bounce message (or other
1608 message with null sender) and this address does not have its own errors
1609 address. However, don't freeze if errors are being ignored. The actual code
1610 to ignore occurs later, instead of sending a message. Logging of freezing
1611 occurs later, just before writing the -H file. */
1612
1613 if ( !testflag(addr, af_ignore_error)
1614 && ( addr->special_action == SPECIAL_FREEZE
1615 || (sender_address[0] == 0 && !addr->prop.errors_address)
1616 ) )
1617 {
1618 frozen_info = addr->special_action == SPECIAL_FREEZE
1619 ? US""
1620 : sender_local && !local_error_message
1621 ? US" (message created with -f <>)"
1622 : US" (delivery error message)";
1623 deliver_freeze = TRUE;
1624 deliver_frozen_at = time(NULL);
1625 update_spool = TRUE;
1626
1627 /* The address is put on the defer rather than the failed queue, because
1628 the message is being retained. */
1629
1630 addr->next = addr_defer;
1631 addr_defer = addr;
1632 }
1633
1634 /* Don't put the address on the nonrecipients tree yet; wait until an
1635 error message has been successfully sent. */
1636
1637 else
1638 {
1639 addr->next = addr_failed;
1640 addr_failed = addr;
1641 }
1642
1643 failure_log(addr, driver_name ? NULL : driver_kind, now);
1644 }
1645
1646 /* Ensure logging is turned on again in all cases */
1647
1648 disable_logging = FALSE;
1649 }
1650
1651
1652
1653
1654 /*************************************************
1655 * Address-independent error *
1656 *************************************************/
1657
1658 /* This function is called when there's an error that is not dependent on a
1659 particular address, such as an expansion string failure. It puts the error into
1660 all the addresses in a batch, logs the incident on the main and panic logs, and
1661 clears the expansions. It is mostly called from local_deliver(), but can be
1662 called for a remote delivery via findugid().
1663
1664 Arguments:
1665 logit TRUE if (MAIN+PANIC) logging required
1666 addr the first of the chain of addresses
1667 code the error code
1668 format format string for error message, or NULL if already set in addr
1669 ... arguments for the format
1670
1671 Returns: nothing
1672 */
1673
1674 static void
1675 common_error(BOOL logit, address_item *addr, int code, uschar *format, ...)
1676 {
1677 address_item *addr2;
1678 addr->basic_errno = code;
1679
1680 if (format)
1681 {
1682 va_list ap;
1683 uschar buffer[512];
1684 va_start(ap, format);
1685 if (!string_vformat(buffer, sizeof(buffer), CS format, ap))
1686 log_write(0, LOG_MAIN|LOG_PANIC_DIE,
1687 "common_error expansion was longer than " SIZE_T_FMT, sizeof(buffer));
1688 va_end(ap);
1689 addr->message = string_copy(buffer);
1690 }
1691
1692 for (addr2 = addr->next; addr2; addr2 = addr2->next)
1693 {
1694 addr2->basic_errno = code;
1695 addr2->message = addr->message;
1696 }
1697
1698 if (logit) log_write(0, LOG_MAIN|LOG_PANIC, "%s", addr->message);
1699 deliver_set_expansions(NULL);
1700 }
1701
1702
1703
1704
1705 /*************************************************
1706 * Check a "never users" list *
1707 *************************************************/
1708
1709 /* This function is called to check whether a uid is on one of the two "never
1710 users" lists.
1711
1712 Arguments:
1713 uid the uid to be checked
1714 nusers the list to be scanned; the first item in the list is the count
1715
1716 Returns: TRUE if the uid is on the list
1717 */
1718
1719 static BOOL
1720 check_never_users(uid_t uid, uid_t *nusers)
1721 {
1722 int i;
1723 if (!nusers) return FALSE;
1724 for (i = 1; i <= (int)(nusers[0]); i++) if (nusers[i] == uid) return TRUE;
1725 return FALSE;
1726 }
1727
1728
1729
1730 /*************************************************
1731 * Find uid and gid for a transport *
1732 *************************************************/
1733
1734 /* This function is called for both local and remote deliveries, to find the
1735 uid/gid under which to run the delivery. The values are taken preferentially
1736 from the transport (either explicit or deliver_as_creator), then from the
1737 address (i.e. the router), and if nothing is set, the exim uid/gid are used. If
1738 the resulting uid is on the "never_users" or the "fixed_never_users" list, a
1739 panic error is logged, and the function fails (which normally leads to delivery
1740 deferral).
1741
1742 Arguments:
1743 addr the address (possibly a chain)
1744 tp the transport
1745 uidp pointer to uid field
1746 gidp pointer to gid field
1747 igfp pointer to the use_initgroups field
1748
1749 Returns: FALSE if failed - error has been set in address(es)
1750 */
1751
1752 static BOOL
1753 findugid(address_item *addr, transport_instance *tp, uid_t *uidp, gid_t *gidp,
1754 BOOL *igfp)
1755 {
1756 uschar *nuname;
1757 BOOL gid_set = FALSE;
1758
1759 /* Default initgroups flag comes from the transport */
1760
1761 *igfp = tp->initgroups;
1762
1763 /* First see if there's a gid on the transport, either fixed or expandable.
1764 The expanding function always logs failure itself. */
1765
1766 if (tp->gid_set)
1767 {
1768 *gidp = tp->gid;
1769 gid_set = TRUE;
1770 }
1771 else if (tp->expand_gid)
1772 {
1773 if (!route_find_expanded_group(tp->expand_gid, tp->name, US"transport", gidp,
1774 &(addr->message)))
1775 {
1776 common_error(FALSE, addr, ERRNO_GIDFAIL, NULL);
1777 return FALSE;
1778 }
1779 gid_set = TRUE;
1780 }
1781
1782 /* If the transport did not set a group, see if the router did. */
1783
1784 if (!gid_set && testflag(addr, af_gid_set))
1785 {
1786 *gidp = addr->gid;
1787 gid_set = TRUE;
1788 }
1789
1790 /* Pick up a uid from the transport if one is set. */
1791
1792 if (tp->uid_set) *uidp = tp->uid;
1793
1794 /* Otherwise, try for an expandable uid field. If it ends up as a numeric id,
1795 it does not provide a passwd value from which a gid can be taken. */
1796
1797 else if (tp->expand_uid)
1798 {
1799 struct passwd *pw;
1800 if (!route_find_expanded_user(tp->expand_uid, tp->name, US"transport", &pw,
1801 uidp, &(addr->message)))
1802 {
1803 common_error(FALSE, addr, ERRNO_UIDFAIL, NULL);
1804 return FALSE;
1805 }
1806 if (!gid_set && pw)
1807 {
1808 *gidp = pw->pw_gid;
1809 gid_set = TRUE;
1810 }
1811 }
1812
1813 /* If the transport doesn't set the uid, test the deliver_as_creator flag. */
1814
1815 else if (tp->deliver_as_creator)
1816 {
1817 *uidp = originator_uid;
1818 if (!gid_set)
1819 {
1820 *gidp = originator_gid;
1821 gid_set = TRUE;
1822 }
1823 }
1824
1825 /* Otherwise see if the address specifies the uid and if so, take it and its
1826 initgroups flag. */
1827
1828 else if (testflag(addr, af_uid_set))
1829 {
1830 *uidp = addr->uid;
1831 *igfp = testflag(addr, af_initgroups);
1832 }
1833
1834 /* Nothing has specified the uid - default to the Exim user, and group if the
1835 gid is not set. */
1836
1837 else
1838 {
1839 *uidp = exim_uid;
1840 if (!gid_set)
1841 {
1842 *gidp = exim_gid;
1843 gid_set = TRUE;
1844 }
1845 }
1846
1847 /* If no gid is set, it is a disaster. We default to the Exim gid only if
1848 defaulting to the Exim uid. In other words, if the configuration has specified
1849 a uid, it must also provide a gid. */
1850
1851 if (!gid_set)
1852 {
1853 common_error(TRUE, addr, ERRNO_GIDFAIL, US"User set without group for "
1854 "%s transport", tp->name);
1855 return FALSE;
1856 }
1857
1858 /* Check that the uid is not on the lists of banned uids that may not be used
1859 for delivery processes. */
1860
1861 nuname = check_never_users(*uidp, never_users)
1862 ? US"never_users"
1863 : check_never_users(*uidp, fixed_never_users)
1864 ? US"fixed_never_users"
1865 : NULL;
1866 if (nuname)
1867 {
1868 common_error(TRUE, addr, ERRNO_UIDFAIL, US"User %ld set for %s transport "
1869 "is on the %s list", (long int)(*uidp), tp->name, nuname);
1870 return FALSE;
1871 }
1872
1873 /* All is well */
1874
1875 return TRUE;
1876 }
1877
1878
1879
1880
1881 /*************************************************
1882 * Check the size of a message for a transport *
1883 *************************************************/
1884
1885 /* Checks that the message isn't too big for the selected transport.
1886 This is called only when it is known that the limit is set.
1887
1888 Arguments:
1889 tp the transport
1890 addr the (first) address being delivered
1891
1892 Returns: OK
1893 DEFER expansion failed or did not yield an integer
1894 FAIL message too big
1895 */
1896
1897 int
1898 check_message_size(transport_instance *tp, address_item *addr)
1899 {
1900 int rc = OK;
1901 int size_limit;
1902
1903 deliver_set_expansions(addr);
1904 size_limit = expand_string_integer(tp->message_size_limit, TRUE);
1905 deliver_set_expansions(NULL);
1906
1907 if (expand_string_message)
1908 {
1909 rc = DEFER;
1910 addr->message = size_limit == -1
1911 ? string_sprintf("failed to expand message_size_limit "
1912 "in %s transport: %s", tp->name, expand_string_message)
1913 : string_sprintf("invalid message_size_limit "
1914 "in %s transport: %s", tp->name, expand_string_message);
1915 }
1916 else if (size_limit > 0 && message_size > size_limit)
1917 {
1918 rc = FAIL;
1919 addr->message =
1920 string_sprintf("message is too big (transport limit = %d)",
1921 size_limit);
1922 }
1923
1924 return rc;
1925 }
1926
1927
1928
1929 /*************************************************
1930 * Transport-time check for a previous delivery *
1931 *************************************************/
1932
1933 /* Check that this base address hasn't previously been delivered to its routed
1934 transport. If it has been delivered, mark it done. The check is necessary at
1935 delivery time in order to handle homonymic addresses correctly in cases where
1936 the pattern of redirection changes between delivery attempts (so the unique
1937 fields change). Non-homonymic previous delivery is detected earlier, at routing
1938 time (which saves unnecessary routing).
1939
1940 Arguments:
1941 addr the address item
1942 testing TRUE if testing wanted only, without side effects
1943
1944 Returns: TRUE if previously delivered by the transport
1945 */
1946
1947 static BOOL
1948 previously_transported(address_item *addr, BOOL testing)
1949 {
1950 (void)string_format(big_buffer, big_buffer_size, "%s/%s",
1951 addr->unique + (testflag(addr, af_homonym)? 3:0), addr->transport->name);
1952
1953 if (tree_search(tree_nonrecipients, big_buffer) != 0)
1954 {
1955 DEBUG(D_deliver|D_route|D_transport)
1956 debug_printf("%s was previously delivered (%s transport): discarded\n",
1957 addr->address, addr->transport->name);
1958 if (!testing) child_done(addr, tod_stamp(tod_log));
1959 return TRUE;
1960 }
1961
1962 return FALSE;
1963 }
1964
1965
1966
1967 /******************************************************
1968 * Check for a given header in a header string *
1969 ******************************************************/
1970
1971 /* This function is used when generating quota warnings. The configuration may
1972 specify any header lines it likes in quota_warn_message. If certain of them are
1973 missing, defaults are inserted, so we need to be able to test for the presence
1974 of a given header.
1975
1976 Arguments:
1977 hdr the required header name
1978 hstring the header string
1979
1980 Returns: TRUE the header is in the string
1981 FALSE the header is not in the string
1982 */
1983
1984 static BOOL
1985 contains_header(uschar *hdr, uschar *hstring)
1986 {
1987 int len = Ustrlen(hdr);
1988 uschar *p = hstring;
1989 while (*p != 0)
1990 {
1991 if (strncmpic(p, hdr, len) == 0)
1992 {
1993 p += len;
1994 while (*p == ' ' || *p == '\t') p++;
1995 if (*p == ':') return TRUE;
1996 }
1997 while (*p != 0 && *p != '\n') p++;
1998 if (*p == '\n') p++;
1999 }
2000 return FALSE;
2001 }
2002
2003
2004
2005
2006 /*************************************************
2007 * Perform a local delivery *
2008 *************************************************/
2009
2010 /* Each local delivery is performed in a separate process which sets its
2011 uid and gid as specified. This is a safer way than simply changing and
2012 restoring using seteuid(); there is a body of opinion that seteuid() cannot be
2013 used safely. From release 4, Exim no longer makes any use of it. Besides, not
2014 all systems have seteuid().
2015
2016 If the uid/gid are specified in the transport_instance, they are used; the
2017 transport initialization must ensure that either both or neither are set.
2018 Otherwise, the values associated with the address are used. If neither are set,
2019 it is a configuration error.
2020
2021 The transport or the address may specify a home directory (transport over-
2022 rides), and if they do, this is set as $home. If neither have set a working
2023 directory, this value is used for that as well. Otherwise $home is left unset
2024 and the cwd is set to "/" - a directory that should be accessible to all users.
2025
2026 Using a separate process makes it more complicated to get error information
2027 back. We use a pipe to pass the return code and also an error code and error
2028 text string back to the parent process.
2029
2030 Arguments:
2031 addr points to an address block for this delivery; for "normal" local
2032 deliveries this is the only address to be delivered, but for
2033 pseudo-remote deliveries (e.g. by batch SMTP to a file or pipe)
2034 a number of addresses can be handled simultaneously, and in this
2035 case addr will point to a chain of addresses with the same
2036 characteristics.
2037
2038 shadowing TRUE if running a shadow transport; this causes output from pipes
2039 to be ignored.
2040
2041 Returns: nothing
2042 */
2043
2044 static void
2045 deliver_local(address_item *addr, BOOL shadowing)
2046 {
2047 BOOL use_initgroups;
2048 uid_t uid;
2049 gid_t gid;
2050 int status, len, rc;
2051 int pfd[2];
2052 pid_t pid;
2053 uschar *working_directory;
2054 address_item *addr2;
2055 transport_instance *tp = addr->transport;
2056
2057 /* Set up the return path from the errors or sender address. If the transport
2058 has its own return path setting, expand it and replace the existing value. */
2059
2060 if(addr->prop.errors_address)
2061 return_path = addr->prop.errors_address;
2062 #ifdef EXPERIMENTAL_SRS
2063 else if (addr->prop.srs_sender)
2064 return_path = addr->prop.srs_sender;
2065 #endif
2066 else
2067 return_path = sender_address;
2068
2069 if (tp->return_path)
2070 {
2071 uschar *new_return_path = expand_string(tp->return_path);
2072 if (!new_return_path)
2073 {
2074 if (!expand_string_forcedfail)
2075 {
2076 common_error(TRUE, addr, ERRNO_EXPANDFAIL,
2077 US"Failed to expand return path \"%s\" in %s transport: %s",
2078 tp->return_path, tp->name, expand_string_message);
2079 return;
2080 }
2081 }
2082 else return_path = new_return_path;
2083 }
2084
2085 /* For local deliveries, one at a time, the value used for logging can just be
2086 set directly, once and for all. */
2087
2088 used_return_path = return_path;
2089
2090 /* Sort out the uid, gid, and initgroups flag. If an error occurs, the message
2091 gets put into the address(es), and the expansions are unset, so we can just
2092 return. */
2093
2094 if (!findugid(addr, tp, &uid, &gid, &use_initgroups)) return;
2095
2096 /* See if either the transport or the address specifies a home directory. A
2097 home directory set in the address may already be expanded; a flag is set to
2098 indicate that. In other cases we must expand it. */
2099
2100 if ( (deliver_home = tp->home_dir) /* Set in transport, or */
2101 || ( (deliver_home = addr->home_dir) /* Set in address and */
2102 && !testflag(addr, af_home_expanded) /* not expanded */
2103 ) )
2104 {
2105 uschar *rawhome = deliver_home;
2106 deliver_home = NULL; /* in case it contains $home */
2107 if (!(deliver_home = expand_string(rawhome)))
2108 {
2109 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"home directory \"%s\" failed "
2110 "to expand for %s transport: %s", rawhome, tp->name,
2111 expand_string_message);
2112 return;
2113 }
2114 if (*deliver_home != '/')
2115 {
2116 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"home directory path \"%s\" "
2117 "is not absolute for %s transport", deliver_home, tp->name);
2118 return;
2119 }
2120 }
2121
2122 /* See if either the transport or the address specifies a current directory,
2123 and if so, expand it. If nothing is set, use the home directory, unless it is
2124 also unset in which case use "/", which is assumed to be a directory to which
2125 all users have access. It is necessary to be in a visible directory for some
2126 operating systems when running pipes, as some commands (e.g. "rm" under Solaris
2127 2.5) require this. */
2128
2129 working_directory = tp->current_dir ? tp->current_dir : addr->current_dir;
2130 if (working_directory)
2131 {
2132 uschar *raw = working_directory;
2133 if (!(working_directory = expand_string(raw)))
2134 {
2135 common_error(TRUE, addr, ERRNO_EXPANDFAIL, US"current directory \"%s\" "
2136 "failed to expand for %s transport: %s", raw, tp->name,
2137 expand_string_message);
2138 return;
2139 }
2140 if (*working_directory != '/')
2141 {
2142 common_error(TRUE, addr, ERRNO_NOTABSOLUTE, US"current directory path "
2143 "\"%s\" is not absolute for %s transport", working_directory, tp->name);
2144 return;
2145 }
2146 }
2147 else working_directory = deliver_home ? deliver_home : US"/";
2148
2149 /* If one of the return_output flags is set on the transport, create and open a
2150 file in the message log directory for the transport to write its output onto.
2151 This is mainly used by pipe transports. The file needs to be unique to the
2152 address. This feature is not available for shadow transports. */
2153
2154 if ( !shadowing
2155 && ( tp->return_output || tp->return_fail_output
2156 || tp->log_output || tp->log_fail_output || tp->log_defer_output
2157 ) )
2158 {
2159 uschar * error;
2160
2161 addr->return_filename =
2162 spool_fname(US"msglog", message_subdir, message_id,
2163 string_sprintf("-%d-%d", getpid(), return_count++));
2164
2165 if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
2166 {
2167 common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
2168 "to return message: %s", error, tp->name, strerror(errno));
2169 return;
2170 }
2171 }
2172
2173 /* Create the pipe for inter-process communication. */
2174
2175 if (pipe(pfd) != 0)
2176 {
2177 common_error(TRUE, addr, ERRNO_PIPEFAIL, US"Creation of pipe failed: %s",
2178 strerror(errno));
2179 return;
2180 }
2181
2182 /* Now fork the process to do the real work in the subprocess, but first
2183 ensure that all cached resources are freed so that the subprocess starts with
2184 a clean slate and doesn't interfere with the parent process. */
2185
2186 search_tidyup();
2187
2188 if ((pid = fork()) == 0)
2189 {
2190 BOOL replicate = TRUE;
2191
2192 /* Prevent core dumps, as we don't want them in users' home directories.
2193 HP-UX doesn't have RLIMIT_CORE; I don't know how to do this in that
2194 system. Some experimental/developing systems (e.g. GNU/Hurd) may define
2195 RLIMIT_CORE but not support it in setrlimit(). For such systems, do not
2196 complain if the error is "not supported".
2197
2198 There are two scenarios where changing the max limit has an effect. In one,
2199 the user is using a .forward and invoking a command of their choice via pipe;
2200 for these, we do need the max limit to be 0 unless the admin chooses to
2201 permit an increased limit. In the other, the command is invoked directly by
2202 the transport and is under administrator control, thus being able to raise
2203 the limit aids in debugging. So there's no general always-right answer.
2204
2205 Thus we inhibit core-dumps completely but let individual transports, while
2206 still root, re-raise the limits back up to aid debugging. We make the
2207 default be no core-dumps -- few enough people can use core dumps in
2208 diagnosis that it's reasonable to make them something that has to be explicitly requested.
2209 */
2210
2211 #ifdef RLIMIT_CORE
2212 struct rlimit rl;
2213 rl.rlim_cur = 0;
2214 rl.rlim_max = 0;
2215 if (setrlimit(RLIMIT_CORE, &rl) < 0)
2216 {
2217 # ifdef SETRLIMIT_NOT_SUPPORTED
2218 if (errno != ENOSYS && errno != ENOTSUP)
2219 # endif
2220 log_write(0, LOG_MAIN|LOG_PANIC, "setrlimit(RLIMIT_CORE) failed: %s",
2221 strerror(errno));
2222 }
2223 #endif
2224
2225 /* Reset the random number generator, so different processes don't all
2226 have the same sequence. */
2227
2228 random_seed = 0;
2229
2230 /* If the transport has a setup entry, call this first, while still
2231 privileged. (Appendfile uses this to expand quota, for example, while
2232 able to read private files.) */
2233
2234 if (addr->transport->setup)
2235 switch((addr->transport->setup)(addr->transport, addr, NULL, uid, gid,
2236 &(addr->message)))
2237 {
2238 case DEFER:
2239 addr->transport_return = DEFER;
2240 goto PASS_BACK;
2241
2242 case FAIL:
2243 addr->transport_return = PANIC;
2244 goto PASS_BACK;
2245 }
2246
2247 /* Ignore SIGINT and SIGTERM during delivery. Also ignore SIGUSR1, as
2248 when the process becomes unprivileged, it won't be able to write to the
2249 process log. SIGHUP is ignored throughout exim, except when it is being
2250 run as a daemon. */
2251
2252 signal(SIGINT, SIG_IGN);
2253 signal(SIGTERM, SIG_IGN);
2254 signal(SIGUSR1, SIG_IGN);
2255
2256 /* Close the unwanted half of the pipe, and set close-on-exec for the other
2257 half - for transports that exec things (e.g. pipe). Then set the required
2258 gid/uid. */
2259
2260 (void)close(pfd[pipe_read]);
2261 (void)fcntl(pfd[pipe_write], F_SETFD, fcntl(pfd[pipe_write], F_GETFD) |
2262 FD_CLOEXEC);
2263 exim_setugid(uid, gid, use_initgroups,
2264 string_sprintf("local delivery to %s <%s> transport=%s", addr->local_part,
2265 addr->address, addr->transport->name));
2266
2267 DEBUG(D_deliver)
2268 {
2269 address_item *batched;
2270 debug_printf(" home=%s current=%s\n", deliver_home, working_directory);
2271 for (batched = addr->next; batched; batched = batched->next)
2272 debug_printf("additional batched address: %s\n", batched->address);
2273 }
2274
2275 /* Set an appropriate working directory. */
2276
2277 if (Uchdir(working_directory) < 0)
2278 {
2279 addr->transport_return = DEFER;
2280 addr->basic_errno = errno;
2281 addr->message = string_sprintf("failed to chdir to %s", working_directory);
2282 }
2283
2284 /* If successful, call the transport */
2285
2286 else
2287 {
2288 BOOL ok = TRUE;
2289 set_process_info("delivering %s to %s using %s", message_id,
2290 addr->local_part, addr->transport->name);
2291
2292 /* Setting this global in the subprocess means we need never clear it */
2293 transport_name = addr->transport->name;
2294
2295 /* If a transport filter has been specified, set up its argument list.
2296 Any errors will get put into the address, and FALSE yielded. */
2297
2298 if (addr->transport->filter_command)
2299 {
2300 ok = transport_set_up_command(&transport_filter_argv,
2301 addr->transport->filter_command,
2302 TRUE, PANIC, addr, US"transport filter", NULL);
2303 transport_filter_timeout = addr->transport->filter_timeout;
2304 }
2305 else transport_filter_argv = NULL;
2306
2307 if (ok)
2308 {
2309 debug_print_string(addr->transport->debug_string);
2310 replicate = !(addr->transport->info->code)(addr->transport, addr);
2311 }
2312 }
2313
2314 /* Pass the results back down the pipe. If necessary, first replicate the
2315 status in the top address to the others in the batch. The label is the
2316 subject of a goto when a call to the transport's setup function fails. We
2317 pass the pointer to the transport back in case it got changed as a result of
2318 file_format in appendfile. */
2319
2320 PASS_BACK:
2321
2322 if (replicate) replicate_status(addr);
2323 for (addr2 = addr; addr2; addr2 = addr2->next)
2324 {
2325 int i;
2326 int local_part_length = Ustrlen(addr2->local_part);
2327 uschar *s;
2328 int ret;
2329
2330 if( (ret = write(pfd[pipe_write], &addr2->transport_return, sizeof(int))) != sizeof(int)
2331 || (ret = write(pfd[pipe_write], &transport_count, sizeof(transport_count))) != sizeof(transport_count)
2332 || (ret = write(pfd[pipe_write], &addr2->flags, sizeof(addr2->flags))) != sizeof(addr2->flags)
2333 || (ret = write(pfd[pipe_write], &addr2->basic_errno, sizeof(int))) != sizeof(int)
2334 || (ret = write(pfd[pipe_write], &addr2->more_errno, sizeof(int))) != sizeof(int)
2335 || (ret = write(pfd[pipe_write], &addr2->special_action, sizeof(int))) != sizeof(int)
2336 || (ret = write(pfd[pipe_write], &addr2->transport,
2337 sizeof(transport_instance *))) != sizeof(transport_instance *)
2338
2339 /* For a file delivery, pass back the local part, in case the original
2340 was only part of the final delivery path. This gives more complete
2341 logging. */
2342
2343 || (testflag(addr2, af_file)
2344 && ( (ret = write(pfd[pipe_write], &local_part_length, sizeof(int))) != sizeof(int)
2345 || (ret = write(pfd[pipe_write], addr2->local_part, local_part_length)) != local_part_length
2346 )
2347 )
2348 )
2349 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2350 ret == -1 ? strerror(errno) : "short write");
2351
2352 /* Now any messages */
2353
2354 for (i = 0, s = addr2->message; i < 2; i++, s = addr2->user_message)
2355 {
2356 int message_length = s ? Ustrlen(s) + 1 : 0;
2357 if( (ret = write(pfd[pipe_write], &message_length, sizeof(int))) != sizeof(int)
2358 || message_length > 0 && (ret = write(pfd[pipe_write], s, message_length)) != message_length
2359 )
2360 log_write(0, LOG_MAIN|LOG_PANIC, "Failed writing transport results to pipe: %s\n",
2361 ret == -1 ? strerror(errno) : "short write");
2362 }
2363 }
2364
2365 /* OK, this process is now done. Free any cached resources that it opened,
2366 and close the pipe we were writing down before exiting. */
2367
2368 (void)close(pfd[pipe_write]);
2369 search_tidyup();
2370 exit(EXIT_SUCCESS);
2371 }
2372
2373 /* Back in the main process: panic if the fork did not succeed. This seems
2374 better than returning an error - if forking is failing it is probably best
2375 not to try other deliveries for this message. */
2376
2377 if (pid < 0)
2378 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Fork failed for local delivery to %s",
2379 addr->address);
2380
2381 /* Read the pipe to get the delivery status codes and error messages. Our copy
2382 of the writing end must be closed first, as otherwise read() won't return zero
2383 on an empty pipe. We check that a status exists for each address before
2384 overwriting the address structure. If data is missing, the default DEFER status
2385 will remain. Afterwards, close the reading end. */
2386
2387 (void)close(pfd[pipe_write]);
2388
2389 for (addr2 = addr; addr2; addr2 = addr2->next)
2390 {
2391 len = read(pfd[pipe_read], &status, sizeof(int));
2392 if (len > 0)
2393 {
2394 int i;
2395 uschar **sptr;
2396
2397 addr2->transport_return = status;
2398 len = read(pfd[pipe_read], &transport_count,
2399 sizeof(transport_count));
2400 len = read(pfd[pipe_read], &addr2->flags, sizeof(addr2->flags));
2401 len = read(pfd[pipe_read], &addr2->basic_errno, sizeof(int));
2402 len = read(pfd[pipe_read], &addr2->more_errno, sizeof(int));
2403 len = read(pfd[pipe_read], &addr2->special_action, sizeof(int));
2404 len = read(pfd[pipe_read], &addr2->transport,
2405 sizeof(transport_instance *));
2406
2407 if (testflag(addr2, af_file))
2408 {
2409 int local_part_length;
2410 len = read(pfd[pipe_read], &local_part_length, sizeof(int));
2411 len = read(pfd[pipe_read], big_buffer, local_part_length);
2412 big_buffer[local_part_length] = 0;
2413 addr2->local_part = string_copy(big_buffer);
2414 }
2415
2416 for (i = 0, sptr = &addr2->message; i < 2; i++, sptr = &addr2->user_message)
2417 {
2418 int message_length;
2419 len = read(pfd[pipe_read], &message_length, sizeof(int));
2420 if (message_length > 0)
2421 {
2422 len = read(pfd[pipe_read], big_buffer, message_length);
2423 big_buffer[big_buffer_size-1] = '\0'; /* guard byte */
2424 if (len > 0) *sptr = string_copy(big_buffer);
2425 }
2426 }
2427 }
2428
2429 else
2430 {
2431 log_write(0, LOG_MAIN|LOG_PANIC, "failed to read delivery status for %s "
2432 "from delivery subprocess", addr2->unique);
2433 break;
2434 }
2435 }
2436
2437 (void)close(pfd[pipe_read]);
2438
2439 /* Unless shadowing, write all successful addresses immediately to the journal
2440 file, to ensure they are recorded asap. For homonymic addresses, use the base
2441 address plus the transport name. Failure to write the journal is panic-worthy,
2442 but don't stop, as it may prove possible subsequently to update the spool file
2443 in order to record the delivery. */
2444
2445 if (!shadowing)
2446 {
2447 for (addr2 = addr; addr2; addr2 = addr2->next)
2448 if (addr2->transport_return == OK)
2449 {
2450 if (testflag(addr2, af_homonym))
2451 sprintf(CS big_buffer, "%.500s/%s\n", addr2->unique + 3, tp->name);
2452 else
2453 sprintf(CS big_buffer, "%.500s\n", addr2->unique);
2454
2455 /* In the test harness, wait just a bit to let the subprocess finish off
2456 any debug output etc first. */
2457
2458 if (running_in_test_harness) millisleep(300);
2459
2460 DEBUG(D_deliver) debug_printf("journalling %s", big_buffer);
2461 len = Ustrlen(big_buffer);
2462 if (write(journal_fd, big_buffer, len) != len)
2463 log_write(0, LOG_MAIN|LOG_PANIC, "failed to update journal for %s: %s",
2464 big_buffer, strerror(errno));
2465 }
2466
2467 /* Ensure the journal file is pushed out to disk. */
2468
2469 if (EXIMfsync(journal_fd) < 0)
2470 log_write(0, LOG_MAIN|LOG_PANIC, "failed to fsync journal: %s",
2471 strerror(errno));
2472 }
2473
2474 /* Wait for the process to finish. If it terminates with a non-zero code,
2475 freeze the message (except for SIGTERM, SIGKILL and SIGQUIT), but leave the
2476 status values of all the addresses as they are. Take care to handle the case
2477 when the subprocess doesn't seem to exist. This has been seen on one system
2478 when Exim was called from an MUA that set SIGCHLD to SIG_IGN. When that
2479 happens, wait() doesn't recognize the termination of child processes. Exim now
2480 resets SIGCHLD to SIG_DFL, but this code should still be robust. */
2481
2482 while ((rc = wait(&status)) != pid)
2483 if (rc < 0 && errno == ECHILD) /* Process has vanished */
2484 {
2485 log_write(0, LOG_MAIN, "%s transport process vanished unexpectedly",
2486 addr->transport->driver_name);
2487 status = 0;
2488 break;
2489 }
2490
2491 if ((status & 0xffff) != 0)
2492 {
2493 int msb = (status >> 8) & 255;
2494 int lsb = status & 255;
2495 int code = (msb == 0)? (lsb & 0x7f) : msb;
2496 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
2497 addr->special_action = SPECIAL_FREEZE;
2498 log_write(0, LOG_MAIN|LOG_PANIC, "%s transport process returned non-zero "
2499 "status 0x%04x: %s %d",
2500 addr->transport->driver_name,
2501 status,
2502 msb == 0 ? "terminated by signal" : "exit code",
2503 code);
2504 }
2505
2506 /* If SPECIAL_WARN is set in the top address, send a warning message. */
2507
2508 if (addr->special_action == SPECIAL_WARN && addr->transport->warn_message)
2509 {
2510 int fd;
2511 uschar *warn_message;
2512 pid_t pid;
2513
2514 DEBUG(D_deliver) debug_printf("Warning message requested by transport\n");
2515
2516 if (!(warn_message = expand_string(addr->transport->warn_message)))
2517 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand \"%s\" (warning "
2518 "message for %s transport): %s", addr->transport->warn_message,
2519 addr->transport->name, expand_string_message);
2520
2521 else if ((pid = child_open_exim(&fd)) > 0)
2522 {
2523 FILE *f = fdopen(fd, "wb");
2524 if (errors_reply_to && !contains_header(US"Reply-To", warn_message))
2525 fprintf(f, "Reply-To: %s\n", errors_reply_to);
2526 fprintf(f, "Auto-Submitted: auto-replied\n");
2527 if (!contains_header(US"From", warn_message))
2528 moan_write_from(f);
2529 fprintf(f, "%s", CS warn_message);
2530
2531 /* Close and wait for child process to complete, without a timeout. */
2532
2533 (void)fclose(f);
2534 (void)child_close(pid, 0);
2535 }
2536
2537 addr->special_action = SPECIAL_NONE;
2538 }
2539 }
2540
2541
2542
2543
2544 /* Check transport for the given concurrency limit. Return TRUE if over
2545 the limit (or an expansion failure), else FALSE and if there was a limit,
2546 the key for the hints database used for the concurrency count. */
2547
2548 static BOOL
2549 tpt_parallel_check(transport_instance * tp, address_item * addr, uschar ** key)
2550 {
2551 unsigned max_parallel;
2552
2553 if (!tp->max_parallel) return FALSE;
2554
2555 max_parallel = (unsigned) expand_string_integer(tp->max_parallel, TRUE);
2556 if (expand_string_message)
2557 {
2558 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand max_parallel option "
2559 "in %s transport (%s): %s", tp->name, addr->address,
2560 expand_string_message);
2561 return TRUE;
2562 }
2563
2564 if (max_parallel > 0)
2565 {
2566 uschar * serialize_key = string_sprintf("tpt-serialize-%s", tp->name);
2567 if (!enq_start(serialize_key, max_parallel))
2568 {
2569 address_item * next;
2570 DEBUG(D_transport)
2571 debug_printf("skipping tpt %s because concurrency limit %u reached\n",
2572 tp->name, max_parallel);
2573 do
2574 {
2575 next = addr->next;
2576 addr->message = US"concurrency limit reached for transport";
2577 addr->basic_errno = ERRNO_TRETRY;
2578 post_process_one(addr, DEFER, LOG_MAIN, DTYPE_TRANSPORT, 0);
2579 } while ((addr = next));
2580 return TRUE;
2581 }
2582 *key = serialize_key;
2583 }
2584 return FALSE;
2585 }
2586
2587
2588
2589 /*************************************************
2590 * Do local deliveries *
2591 *************************************************/
2592
2593 /* This function processes the list of addresses in addr_local. True local
2594 deliveries are always done one address at a time. However, local deliveries can
2595 be batched up in some cases. Typically this is when writing batched SMTP output
2596 files for use by some external transport mechanism, or when running local
2597 deliveries over LMTP.
2598
2599 Arguments: None
2600 Returns: Nothing
2601 */
2602
2603 static void
2604 do_local_deliveries(void)
2605 {
2606 open_db dbblock;
2607 open_db *dbm_file = NULL;
2608 time_t now = time(NULL);
2609
2610 /* Loop until we have exhausted the supply of local deliveries */
2611
2612 while (addr_local)
2613 {
2614 time_t delivery_start;
2615 int deliver_time;
2616 address_item *addr2, *addr3, *nextaddr;
2617 int logflags = LOG_MAIN;
2618 int logchar = dont_deliver? '*' : '=';
2619 transport_instance *tp;
2620 uschar * serialize_key = NULL;
2621
2622 /* Pick the first undelivered address off the chain */
2623
2624 address_item *addr = addr_local;
2625 addr_local = addr->next;
2626 addr->next = NULL;
2627
2628 DEBUG(D_deliver|D_transport)
2629 debug_printf("--------> %s <--------\n", addr->address);
2630
2631 /* An internal disaster if there is no transport. Should not occur! */
2632
2633 if (!(tp = addr->transport))
2634 {
2635 logflags |= LOG_PANIC;
2636 disable_logging = FALSE; /* Jic */
2637 addr->message = addr->router
2638 ? string_sprintf("No transport set by %s router", addr->router->name)
2639 : string_sprintf("No transport set by system filter");
2640 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
2641 continue;
2642 }
2643
2644 /* Check that this base address hasn't previously been delivered to this
2645 transport. The check is necessary at this point to handle homonymic addresses
2646 correctly in cases where the pattern of redirection changes between delivery
2647 attempts. Non-homonymic previous delivery is detected earlier, at routing
2648 time. */
2649
2650 if (previously_transported(addr, FALSE)) continue;
2651
2652 /* There are weird cases where logging is disabled */
2653
2654 disable_logging = tp->disable_logging;
2655
2656 /* Check for batched addresses and possible amalgamation. Skip all the work
2657 if either batch_max <= 1 or there aren't any other addresses for local
2658 delivery. */
2659
2660 if (tp->batch_max > 1 && addr_local)
2661 {
2662 int batch_count = 1;
2663 BOOL uses_dom = readconf_depends((driver_instance *)tp, US"domain");
2664 BOOL uses_lp = ( testflag(addr, af_pfr)
2665 && (testflag(addr, af_file) || addr->local_part[0] == '|')
2666 )
2667 || readconf_depends((driver_instance *)tp, US"local_part");
2668 uschar *batch_id = NULL;
2669 address_item **anchor = &addr_local;
2670 address_item *last = addr;
2671 address_item *next;
2672
2673 /* Expand the batch_id string for comparison with other addresses.
2674 Expansion failure suppresses batching. */
2675
2676 if (tp->batch_id)
2677 {
2678 deliver_set_expansions(addr);
2679 batch_id = expand_string(tp->batch_id);
2680 deliver_set_expansions(NULL);
2681 if (!batch_id)
2682 {
2683 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2684 "in %s transport (%s): %s", tp->name, addr->address,
2685 expand_string_message);
2686 batch_count = tp->batch_max;
2687 }
2688 }
2689
2690 /* Until we reach the batch_max limit, pick off addresses which have the
2691 same characteristics. These are:
2692
2693 same transport
2694 not previously delivered (see comment about 50 lines above)
2695 same local part if the transport's configuration contains $local_part
2696 or if this is a file or pipe delivery from a redirection
2697 same domain if the transport's configuration contains $domain
2698 same errors address
2699 same additional headers
2700 same headers to be removed
2701 same uid/gid for running the transport
2702 same first host if a host list is set
2703 */
2704
2705 while ((next = *anchor) && batch_count < tp->batch_max)
2706 {
2707 BOOL ok =
2708 tp == next->transport
2709 && !previously_transported(next, TRUE)
2710 && (addr->flags & (af_pfr|af_file)) == (next->flags & (af_pfr|af_file))
2711 && (!uses_lp || Ustrcmp(next->local_part, addr->local_part) == 0)
2712 && (!uses_dom || Ustrcmp(next->domain, addr->domain) == 0)
2713 && same_strings(next->prop.errors_address, addr->prop.errors_address)
2714 && same_headers(next->prop.extra_headers, addr->prop.extra_headers)
2715 && same_strings(next->prop.remove_headers, addr->prop.remove_headers)
2716 && same_ugid(tp, addr, next)
2717 && ( !addr->host_list && !next->host_list
2718 || addr->host_list
2719 && next->host_list
2720 && Ustrcmp(addr->host_list->name, next->host_list->name) == 0
2721 );
2722
2723 /* If the transport has a batch_id setting, batch_id will be non-NULL
2724 from the expansion outside the loop. Expand for this address and compare.
2725 Expansion failure makes this address ineligible for batching. */
2726
2727 if (ok && batch_id)
2728 {
2729 uschar *bid;
2730 address_item *save_nextnext = next->next;
2731 next->next = NULL; /* Expansion for a single address */
2732 deliver_set_expansions(next);
2733 next->next = save_nextnext;
2734 bid = expand_string(tp->batch_id);
2735 deliver_set_expansions(NULL);
2736 if (!bid)
2737 {
2738 log_write(0, LOG_MAIN|LOG_PANIC, "Failed to expand batch_id option "
2739 "in %s transport (%s): %s", tp->name, next->address,
2740 expand_string_message);
2741 ok = FALSE;
2742 }
2743 else ok = (Ustrcmp(batch_id, bid) == 0);
2744 }
2745
2746 /* Take address into batch if OK. */
2747
2748 if (ok)
2749 {
2750 *anchor = next->next; /* Include the address */
2751 next->next = NULL;
2752 last->next = next;
2753 last = next;
2754 batch_count++;
2755 }
2756 else anchor = &next->next; /* Skip the address */
2757 }
2758 }
2759
2760 /* We now have one or more addresses that can be delivered in a batch. Check
2761 whether the transport is prepared to accept a message of this size. If not,
2762 fail them all forthwith. If the expansion fails, or does not yield an
2763 integer, defer delivery. */
2764
2765 if (tp->message_size_limit)
2766 {
2767 int rc = check_message_size(tp, addr);
2768 if (rc != OK)
2769 {
2770 replicate_status(addr);
2771 while (addr)
2772 {
2773 addr2 = addr->next;
2774 post_process_one(addr, rc, logflags, DTYPE_TRANSPORT, 0);
2775 addr = addr2;
2776 }
2777 continue; /* With next batch of addresses */
2778 }
2779 }
2780
2781 /* If we are not running the queue, or if forcing, all deliveries will be
2782 attempted. Otherwise, we must respect the retry times for each address. Even
2783 when not doing this, we need to set up the retry key string, and determine
2784 whether a retry record exists, because after a successful delivery, a delete
2785 retry item must be set up. Keep the retry database open only for the duration
2786 of these checks, rather than for all local deliveries, because some local
2787 deliveries (e.g. to pipes) can take a substantial time. */
2788
2789 if (!(dbm_file = dbfn_open(US"retry", O_RDONLY, &dbblock, FALSE)))
2790 {
2791 DEBUG(D_deliver|D_retry|D_hints_lookup)
2792 debug_printf("no retry data available\n");
2793 }
2794
2795 addr2 = addr;
2796 addr3 = NULL;
2797 while (addr2)
2798 {
2799 BOOL ok = TRUE; /* to deliver this address */
2800 uschar *retry_key;
2801
2802 /* Set up the retry key to include the domain or not, and change its
2803 leading character from "R" to "T". Must make a copy before doing this,
2804 because the old key may be pointed to from a "delete" retry item after
2805 a routing delay. */
2806
2807 retry_key = string_copy(
2808 tp->retry_use_local_part ? addr2->address_retry_key :
2809 addr2->domain_retry_key);
2810 *retry_key = 'T';
2811
2812 /* Inspect the retry data. If there is no hints file, delivery happens. */
2813
2814 if (dbm_file)
2815 {
2816 dbdata_retry *retry_record = dbfn_read(dbm_file, retry_key);
2817
2818 /* If there is no retry record, delivery happens. If there is,
2819 remember it exists so it can be deleted after a successful delivery. */
2820
2821 if (retry_record)
2822 {
2823 setflag(addr2, af_lt_retry_exists);
2824
2825 /* A retry record exists for this address. If queue running and not
2826 forcing, inspect its contents. If the record is too old, or if its
2827 retry time has come, or if it has passed its cutoff time, delivery
2828 will go ahead. */
2829
2830 DEBUG(D_retry)
2831 {
2832 debug_printf("retry record exists: age=%s ",
2833 readconf_printtime(now - retry_record->time_stamp));
2834 debug_printf("(max %s)\n", readconf_printtime(retry_data_expire));
2835 debug_printf(" time to retry = %s expired = %d\n",
2836 readconf_printtime(retry_record->next_try - now),
2837 retry_record->expired);
2838 }
2839
2840 if (queue_running && !deliver_force)
2841 {
2842 ok = (now - retry_record->time_stamp > retry_data_expire)
2843 || (now >= retry_record->next_try)
2844 || retry_record->expired;
2845
2846 /* If we haven't reached the retry time, there is one more check
2847 to do, which is for the ultimate address timeout. */
2848
2849 if (!ok)
2850 ok = retry_ultimate_address_timeout(retry_key, addr2->domain,
2851 retry_record, now);
2852 }
2853 }
2854 else DEBUG(D_retry) debug_printf("no retry record exists\n");
2855 }
2856
2857 /* This address is to be delivered. Leave it on the chain. */
2858
2859 if (ok)
2860 {
2861 addr3 = addr2;
2862 addr2 = addr2->next;
2863 }
2864
2865 /* This address is to be deferred. Take it out of the chain, and
2866 post-process it as complete. Must take it out of the chain first,
2867 because post processing puts it on another chain. */
2868
2869 else
2870 {
2871 address_item *this = addr2;
2872 this->message = US"Retry time not yet reached";
2873 this->basic_errno = ERRNO_LRETRY;
2874 addr2 = addr3 ? (addr3->next = addr2->next)
2875 : (addr = addr2->next);
2876 post_process_one(this, DEFER, logflags, DTYPE_TRANSPORT, 0);
2877 }
2878 }
2879
2880 if (dbm_file) dbfn_close(dbm_file);
2881
2882 /* If there are no addresses left on the chain, they all deferred. Loop
2883 for the next set of addresses. */
2884
2885 if (!addr) continue;
2886
2887 /* If the transport is limited for parallellism, enforce that here.
2888 We use a hints DB entry, incremented here and decremented after
2889 the transport (and any shadow transport) completes. */
2890
2891 if (tpt_parallel_check(tp, addr, &serialize_key))
2892 {
2893 if (expand_string_message)
2894 {
2895 logflags |= LOG_PANIC;
2896 do
2897 {
2898 addr = addr->next;
2899 post_process_one(addr, DEFER, logflags, DTYPE_TRANSPORT, 0);
2900 } while ((addr = addr2));
2901 }
2902 continue; /* Loop for the next set of addresses. */
2903 }
2904
2905
2906 /* So, finally, we do have some addresses that can be passed to the
2907 transport. Before doing so, set up variables that are relevant to a
2908 single delivery. */
2909
2910 deliver_set_expansions(addr);
2911 delivery_start = time(NULL);
2912 deliver_local(addr, FALSE);
2913 deliver_time = (int)(time(NULL) - delivery_start);
2914
2915 /* If a shadow transport (which must perforce be another local transport), is
2916 defined, and its condition is met, we must pass the message to the shadow
2917 too, but only those addresses that succeeded. We do this by making a new
2918 chain of addresses - also to keep the original chain uncontaminated. We must
2919 use a chain rather than doing it one by one, because the shadow transport may
2920 batch.
2921
2922 NOTE: if the condition fails because of a lookup defer, there is nothing we
2923 can do! */
2924
2925 if ( tp->shadow
2926 && ( !tp->shadow_condition
2927 || expand_check_condition(tp->shadow_condition, tp->name, US"transport")
2928 ) )
2929 {
2930 transport_instance *stp;
2931 address_item *shadow_addr = NULL;
2932 address_item **last = &shadow_addr;
2933
2934 for (stp = transports; stp; stp = stp->next)
2935 if (Ustrcmp(stp->name, tp->shadow) == 0) break;
2936
2937 if (!stp)
2938 log_write(0, LOG_MAIN|LOG_PANIC, "shadow transport \"%s\" not found ",
2939 tp->shadow);
2940
2941 /* Pick off the addresses that have succeeded, and make clones. Put into
2942 the shadow_message field a pointer to the shadow_message field of the real
2943 address. */
2944
2945 else for (addr2 = addr; addr2; addr2 = addr2->next)
2946 if (addr2->transport_return == OK)
2947 {
2948 addr3 = store_get(sizeof(address_item));
2949 *addr3 = *addr2;
2950 addr3->next = NULL;
2951 addr3->shadow_message = (uschar *) &(addr2->shadow_message);
2952 addr3->transport = stp;
2953 addr3->transport_return = DEFER;
2954 addr3->return_filename = NULL;
2955 addr3->return_file = -1;
2956 *last = addr3;
2957 last = &(addr3->next);
2958 }
2959
2960 /* If we found any addresses to shadow, run the delivery, and stick any
2961 message back into the shadow_message field in the original. */
2962
2963 if (shadow_addr)
2964 {
2965 int save_count = transport_count;
2966
2967 DEBUG(D_deliver|D_transport)
2968 debug_printf(">>>>>>>>>>>>>>>> Shadow delivery >>>>>>>>>>>>>>>>\n");
2969 deliver_local(shadow_addr, TRUE);
2970
2971 for(; shadow_addr; shadow_addr = shadow_addr->next)
2972 {
2973 int sresult = shadow_addr->transport_return;
2974 *(uschar **)shadow_addr->shadow_message =
2975 sresult == OK
2976 ? string_sprintf(" ST=%s", stp->name)
2977 : string_sprintf(" ST=%s (%s%s%s)", stp->name,
2978 shadow_addr->basic_errno <= 0
2979 ? US""
2980 : US strerror(shadow_addr->basic_errno),
2981 shadow_addr->basic_errno <= 0 || !shadow_addr->message
2982 ? US""
2983 : US": ",
2984 shadow_addr->message
2985 ? shadow_addr->message
2986 : shadow_addr->basic_errno <= 0
2987 ? US"unknown error"
2988 : US"");
2989
2990 DEBUG(D_deliver|D_transport)
2991 debug_printf("%s shadow transport returned %s for %s\n",
2992 stp->name,
2993 sresult == OK ? "OK" :
2994 sresult == DEFER ? "DEFER" :
2995 sresult == FAIL ? "FAIL" :
2996 sresult == PANIC ? "PANIC" : "?",
2997 shadow_addr->address);
2998 }
2999
3000 DEBUG(D_deliver|D_transport)
3001 debug_printf(">>>>>>>>>>>>>>>> End shadow delivery >>>>>>>>>>>>>>>>\n");
3002
3003 transport_count = save_count; /* Restore original transport count */
3004 }
3005 }
3006
3007 /* Cancel the expansions that were set up for the delivery. */
3008
3009 deliver_set_expansions(NULL);
3010
3011 /* If the transport was parallelism-limited, decrement the hints DB record. */
3012
3013 if (serialize_key) enq_end(serialize_key);
3014
3015 /* Now we can process the results of the real transport. We must take each
3016 address off the chain first, because post_process_one() puts it on another
3017 chain. */
3018
3019 for (addr2 = addr; addr2; addr2 = nextaddr)
3020 {
3021 int result = addr2->transport_return;
3022 nextaddr = addr2->next;
3023
3024 DEBUG(D_deliver|D_transport)
3025 debug_printf("%s transport returned %s for %s\n",
3026 tp->name,
3027 result == OK ? "OK" :
3028 result == DEFER ? "DEFER" :
3029 result == FAIL ? "FAIL" :
3030 result == PANIC ? "PANIC" : "?",
3031 addr2->address);
3032
3033 /* If there is a retry_record, or if delivery is deferred, build a retry
3034 item for setting a new retry time or deleting the old retry record from
3035 the database. These items are handled all together after all addresses
3036 have been handled (so the database is open just for a short time for
3037 updating). */
3038
3039 if (result == DEFER || testflag(addr2, af_lt_retry_exists))
3040 {
3041 int flags = result == DEFER ? 0 : rf_delete;
3042 uschar *retry_key = string_copy(tp->retry_use_local_part
3043 ? addr2->address_retry_key : addr2->domain_retry_key);
3044 *retry_key = 'T';
3045 retry_add_item(addr2, retry_key, flags);
3046 }
3047
3048 /* Done with this address */
3049
3050 if (result == OK) addr2->more_errno = deliver_time;
3051 post_process_one(addr2, result, logflags, DTYPE_TRANSPORT, logchar);
3052
3053 /* If a pipe delivery generated text to be sent back, the result may be
3054 changed to FAIL, and we must copy this for subsequent addresses in the
3055 batch. */
3056
3057 if (addr2->transport_return != result)
3058 {
3059 for (addr3 = nextaddr; addr3; addr3 = addr3->next)
3060 {
3061 addr3->transport_return = addr2->transport_return;
3062 addr3->basic_errno = addr2->basic_errno;
3063 addr3->message = addr2->message;
3064 }
3065 result = addr2->transport_return;
3066 }
3067
3068 /* Whether or not the result was changed to FAIL, we need to copy the
3069 return_file value from the first address into all the addresses of the
3070 batch, so they are all listed in the error message. */
3071
3072 addr2->return_file = addr->return_file;
3073
3074 /* Change log character for recording successful deliveries. */
3075
3076 if (result == OK) logchar = '-';
3077 }
3078 } /* Loop back for next batch of addresses */
3079 }
3080
3081
3082
3083
3084 /*************************************************
3085 * Sort remote deliveries *
3086 *************************************************/
3087
3088 /* This function is called if remote_sort_domains is set. It arranges that the
3089 chain of addresses for remote deliveries is ordered according to the strings
3090 specified. Try to make this shuffling reasonably efficient by handling
3091 sequences of addresses rather than just single ones.
3092
3093 Arguments: None
3094 Returns: Nothing
3095 */
3096
3097 static void
3098 sort_remote_deliveries(void)
3099 {
3100 int sep = 0;
3101 address_item **aptr = &addr_remote;
3102 const uschar *listptr = remote_sort_domains;
3103 uschar *pattern;
3104 uschar patbuf[256];
3105
3106 while ( *aptr
3107 && (pattern = string_nextinlist(&listptr, &sep, patbuf, sizeof(patbuf)))
3108 )
3109 {
3110 address_item *moved = NULL;
3111 address_item **bptr = &moved;
3112
3113 while (*aptr)
3114 {
3115 address_item **next;
3116 deliver_domain = (*aptr)->domain; /* set $domain */
3117 if (match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
3118 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL) == OK)
3119 {
3120 aptr = &(*aptr)->next;
3121 continue;
3122 }
3123
3124 next = &(*aptr)->next;
3125 while ( *next
3126 && (deliver_domain = (*next)->domain, /* Set $domain */
3127 match_isinlist(deliver_domain, (const uschar **)&pattern, UCHAR_MAX+1,
3128 &domainlist_anchor, NULL, MCL_DOMAIN, TRUE, NULL)) != OK
3129 )
3130 next = &(*next)->next;
3131
3132 /* If the batch of non-matchers is at the end, add on any that were
3133 extracted further up the chain, and end this iteration. Otherwise,
3134 extract them from the chain and hang on the moved chain. */
3135
3136 if (!*next)
3137 {
3138 *next = moved;
3139 break;
3140 }
3141
3142 *bptr = *aptr;
3143 *aptr = *next;
3144 *next = NULL;
3145 bptr = next;
3146 aptr = &(*aptr)->next;
3147 }
3148
3149 /* If the loop ended because the final address matched, *aptr will
3150 be NULL. Add on to the end any extracted non-matching addresses. If
3151 *aptr is not NULL, the loop ended via "break" when *next is null, that
3152 is, there was a string of non-matching addresses at the end. In this
3153 case the extracted addresses have already been added on the end. */
3154
3155 if (!*aptr) *aptr = moved;
3156 }
3157
3158 DEBUG(D_deliver)
3159 {
3160 address_item *addr;
3161 debug_printf("remote addresses after sorting:\n");
3162 for (addr = addr_remote; addr; addr = addr->next)
3163 debug_printf(" %s\n", addr->address);
3164 }
3165 }
3166
3167
3168
3169 /*************************************************
3170 * Read from pipe for remote delivery subprocess *
3171 *************************************************/
3172
3173 /* This function is called when the subprocess is complete, but can also be
3174 called before it is complete, in order to empty a pipe that is full (to prevent
3175 deadlock). It must therefore keep track of its progress in the parlist data
3176 block.
3177
3178 We read the pipe to get the delivery status codes and a possible error message
3179 for each address, optionally preceded by unusability data for the hosts and
3180 also by optional retry data.
3181
3182 Read in large chunks into the big buffer and then scan through, interpreting
3183 the data therein. In most cases, only a single read will be necessary. No
3184 individual item will ever be anywhere near 2500 bytes in length, so by ensuring
3185 that we read the next chunk when there is less than 2500 bytes left in the
3186 non-final chunk, we can assume each item is complete in the buffer before
3187 handling it. Each item is written using a single write(), which is atomic for
3188 small items (less than PIPE_BUF, which seems to be at least 512 in any Unix and
3189 often bigger) so even if we are reading while the subprocess is still going, we
3190 should never have only a partial item in the buffer.
3191
3192 Argument:
3193 poffset the offset of the parlist item
3194 eop TRUE if the process has completed
3195
3196 Returns: TRUE if the terminating 'Z' item has been read,
3197 or there has been a disaster (i.e. no more data needed);
3198 FALSE otherwise
3199 */
3200
3201 static BOOL
3202 par_read_pipe(int poffset, BOOL eop)
3203 {
3204 host_item *h;
3205 pardata *p = parlist + poffset;
3206 address_item *addrlist = p->addrlist;
3207 address_item *addr = p->addr;
3208 pid_t pid = p->pid;
3209 int fd = p->fd;
3210 uschar *endptr = big_buffer;
3211 uschar *ptr = endptr;
3212 uschar *msg = p->msg;
3213 BOOL done = p->done;
3214 BOOL unfinished = TRUE;
3215 /* minimum size to read is header size including id, subid and length */
3216 int required = PIPE_HEADER_SIZE;
3217
3218 /* Loop through all items, reading from the pipe when necessary. The pipe
3219 is set up to be non-blocking, but there are two different Unix mechanisms in
3220 use. Exim uses O_NONBLOCK if it is defined. This returns 0 for end of file,
3221 and EAGAIN for no more data. If O_NONBLOCK is not defined, Exim uses O_NDELAY,
3222 which returns 0 for both end of file and no more data. We distinguish the
3223 two cases by taking 0 as end of file only when we know the process has
3224 completed.
3225
3226 Each separate item is written to the pipe in a single write(), and as they are
3227 all short items, the writes will all be atomic and we should never find
3228 ourselves in the position of having read an incomplete item. "Short" in this
3229 case can mean up to about 1K in the case when there is a long error message
3230 associated with an address. */
3231
3232 DEBUG(D_deliver) debug_printf("reading pipe for subprocess %d (%s)\n",
3233 (int)p->pid, eop? "ended" : "not ended");
3234
3235 while (!done)
3236 {
3237 retry_item *r, **rp;
3238 int remaining = endptr - ptr;
3239 uschar header[PIPE_HEADER_SIZE + 1];
3240 uschar id, subid;
3241 uschar *endc;
3242
3243 /* Read (first time) or top up the chars in the buffer if necessary.
3244 There will be only one read if we get all the available data (i.e. don't
3245 fill the buffer completely). */
3246
3247 if (remaining < required && unfinished)
3248 {
3249 int len;
3250 int available = big_buffer_size - remaining;
3251
3252 if (remaining > 0) memmove(big_buffer, ptr, remaining);
3253
3254 ptr = big_buffer;
3255 endptr = big_buffer + remaining;
3256 len = read(fd, endptr, available);
3257
3258 DEBUG(D_deliver) debug_printf("read() yielded %d\n", len);
3259
3260 /* If the result is EAGAIN and the process is not complete, just
3261 stop reading any more and process what we have already. */
3262
3263 if (len < 0)
3264 {
3265 if (!eop && errno == EAGAIN) len = 0; else
3266 {
3267 msg = string_sprintf("failed to read pipe from transport process "
3268 "%d for transport %s: %s", pid, addr->transport->driver_name,
3269 strerror(errno));
3270 break;
3271 }
3272 }
3273
3274 /* If the length is zero (eof or no-more-data), just process what we
3275 already have. Note that if the process is still running and we have
3276 read all the data in the pipe (but less that "available") then we
3277 won't read any more, as "unfinished" will get set FALSE. */
3278
3279 endptr += len;
3280 remaining += len;
3281 unfinished = len == available;
3282 }
3283
3284 /* If we are at the end of the available data, exit the loop. */
3285 if (ptr >= endptr) break;
3286
3287 /* copy and read header */
3288 memcpy(header, ptr, PIPE_HEADER_SIZE);
3289 header[PIPE_HEADER_SIZE] = '\0';
3290 id = header[0];
3291 subid = header[1];
3292 required = Ustrtol(header + 2, &endc, 10) + PIPE_HEADER_SIZE; /* header + data */
3293 if (*endc)
3294 {
3295 msg = string_sprintf("failed to read pipe from transport process "
3296 "%d for transport %s: error reading size from header", pid, addr->transport->driver_name);
3297 done = TRUE;
3298 break;
3299 }
3300
3301 DEBUG(D_deliver)
3302 debug_printf("header read id:%c,subid:%c,size:%s,required:%d,remaining:%d,unfinished:%d\n",
3303 id, subid, header+2, required, remaining, unfinished);
3304
3305 /* is there room for the dataset we want to read ? */
3306 if (required > big_buffer_size - PIPE_HEADER_SIZE)
3307 {
3308 msg = string_sprintf("failed to read pipe from transport process "
3309 "%d for transport %s: big_buffer too small! required size=%d buffer size=%d", pid, addr->transport->driver_name,
3310 required, big_buffer_size - PIPE_HEADER_SIZE);
3311 done = TRUE;
3312 break;
3313 }
3314
3315 /* we wrote all datasets with atomic write() calls
3316 remaining < required only happens if big_buffer was too small
3317 to get all available data from pipe. unfinished has to be true
3318 as well. */
3319 if (remaining < required)
3320 {
3321 if (unfinished)
3322 continue;
3323 msg = string_sprintf("failed to read pipe from transport process "
3324 "%d for transport %s: required size=%d > remaining size=%d and unfinished=false",
3325 pid, addr->transport->driver_name, required, remaining);
3326 done = TRUE;
3327 break;
3328 }
3329
3330 /* step behind the header */
3331 ptr += PIPE_HEADER_SIZE;
3332
3333 /* Handle each possible type of item, assuming the complete item is
3334 available in store. */
3335
3336 switch (id)
3337 {
3338 /* Host items exist only if any hosts were marked unusable. Match
3339 up by checking the IP address. */
3340
3341 case 'H':
3342 for (h = addrlist->host_list; h; h = h->next)
3343 {
3344 if (!h->address || Ustrcmp(h->address, ptr+2) != 0) continue;
3345 h->status = ptr[0];
3346 h->why = ptr[1];
3347 }
3348 ptr += 2;
3349 while (*ptr++);
3350 break;
3351
3352 /* Retry items are sent in a preceding R item for each address. This is
3353 kept separate to keep each message short enough to guarantee it won't
3354 be split in the pipe. Hopefully, in the majority of cases, there won't in
3355 fact be any retry items at all.
3356
3357 The complete set of retry items might include an item to delete a
3358 routing retry if there was a previous routing delay. However, routing
3359 retries are also used when a remote transport identifies an address error.
3360 In that case, there may also be an "add" item for the same key. Arrange
3361 that a "delete" item is dropped in favour of an "add" item. */
3362
3363 case 'R':
3364 if (!addr) goto ADDR_MISMATCH;
3365
3366 DEBUG(D_deliver|D_retry)
3367 debug_printf("reading retry information for %s from subprocess\n",
3368 ptr+1);
3369
3370 /* Cut out any "delete" items on the list. */
3371
3372 for (rp = &(addr->retries); (r = *rp); rp = &r->next)
3373 if (Ustrcmp(r->key, ptr+1) == 0) /* Found item with same key */
3374 {
3375 if ((r->flags & rf_delete) == 0) break; /* It was not "delete" */
3376 *rp = r->next; /* Excise a delete item */
3377 DEBUG(D_deliver|D_retry)
3378 debug_printf(" existing delete item dropped\n");
3379 }
3380
3381 /* We want to add a delete item only if there is no non-delete item;
3382 however we still have to step ptr through the data. */
3383
3384 if (!r || (*ptr & rf_delete) == 0)
3385 {
3386 r = store_get(sizeof(retry_item));
3387 r->next = addr->retries;
3388 addr->retries = r;
3389 r->flags = *ptr++;
3390 r->key = string_copy(ptr);
3391 while (*ptr++);
3392 memcpy(&(r->basic_errno), ptr, sizeof(r->basic_errno));
3393 ptr += sizeof(r->basic_errno);
3394 memcpy(&(r->more_errno), ptr, sizeof(r->more_errno));
3395 ptr += sizeof(r->more_errno);
3396 r->message = (*ptr)? string_copy(ptr) : NULL;
3397 DEBUG(D_deliver|D_retry)
3398 debug_printf(" added %s item\n",
3399 ((r->flags & rf_delete) == 0)? "retry" : "delete");
3400 }
3401
3402 else
3403 {
3404 DEBUG(D_deliver|D_retry)
3405 debug_printf(" delete item not added: non-delete item exists\n");
3406 ptr++;
3407 while(*ptr++);
3408 ptr += sizeof(r->basic_errno) + sizeof(r->more_errno);
3409 }
3410
3411 while(*ptr++);
3412 break;
3413
3414 /* Put the amount of data written into the parlist block */
3415
3416 case 'S':
3417 memcpy(&(p->transport_count), ptr, sizeof(transport_count));
3418 ptr += sizeof(transport_count);
3419 break;
3420
3421 /* Address items are in the order of items on the address chain. We
3422 remember the current address value in case this function is called
3423 several times to empty the pipe in stages. Information about delivery
3424 over TLS is sent in a preceding X item for each address. We don't put
3425 it in with the other info, in order to keep each message short enough to
3426 guarantee it won't be split in the pipe. */
3427
3428 #ifdef SUPPORT_TLS
3429 case 'X':
3430 if (!addr) goto ADDR_MISMATCH; /* Below, in 'A' handler */
3431 switch (subid)
3432 {
3433 case '1':
3434 addr->cipher = NULL;
3435 addr->peerdn = NULL;
3436
3437 if (*ptr)
3438 addr->cipher = string_copy(ptr);
3439 while (*ptr++);
3440 if (*ptr)
3441 addr->peerdn = string_copy(ptr);
3442 break;
3443
3444 case '2':
3445 if (*ptr)
3446 (void) tls_import_cert(ptr, &addr->peercert);
3447 else
3448 addr->peercert = NULL;
3449 break;
3450
3451 case '3':
3452 if (*ptr)
3453 (void) tls_import_cert(ptr, &addr->ourcert);
3454 else
3455 addr->ourcert = NULL;
3456 break;
3457
3458 # ifndef DISABLE_OCSP
3459 case '4':
3460 addr->ocsp = OCSP_NOT_REQ;
3461 if (*ptr)
3462 addr->ocsp = *ptr - '0';
3463 break;
3464 # endif
3465 }
3466 while (*ptr++);
3467 break;
3468 #endif /*SUPPORT_TLS*/
3469
3470 case 'C': /* client authenticator information */
3471 switch (subid)
3472 {
3473 case '1':
3474 addr->authenticator = (*ptr)? string_copy(ptr) : NULL;
3475 break;
3476 case '2':
3477 addr->auth_id = (*ptr)? string_copy(ptr) : NULL;
3478 break;
3479 case '3':
3480 addr->auth_sndr = (*ptr)? string_copy(ptr) : NULL;
3481 break;
3482 }
3483 while (*ptr++);
3484 break;
3485
3486 #ifndef DISABLE_PRDR
3487 case 'P':
3488 addr->flags |= af_prdr_used;
3489 break;
3490 #endif
3491
3492 case 'K':
3493 addr->flags |= af_chunking_used;
3494 break;
3495
3496 case 'D':
3497 if (!addr) goto ADDR_MISMATCH;
3498 memcpy(&(addr->dsn_aware), ptr, sizeof(addr->dsn_aware));
3499 ptr += sizeof(addr->dsn_aware);
3500 DEBUG(D_deliver) debug_printf("DSN read: addr->dsn_aware = %d\n", addr->dsn_aware);
3501 break;
3502
3503 case 'A':
3504 if (!addr)
3505 {
3506 ADDR_MISMATCH:
3507 msg = string_sprintf("address count mismatch for data read from pipe "
3508 "for transport process %d for transport %s", pid,
3509 addrlist->transport->driver_name);
3510 done = TRUE;
3511 break;
3512 }
3513
3514 switch (subid)
3515 {
3516 #ifdef SUPPORT_SOCKS
3517 case '2': /* proxy information; must arrive before A0 and applies to that addr XXX oops*/
3518 proxy_session = TRUE; /*XXX shouod this be cleared somewhere? */
3519 if (*ptr == 0)
3520 ptr++;
3521 else
3522 {
3523 proxy_local_address = string_copy(ptr);
3524 while(*ptr++);
3525 memcpy(&proxy_local_port, ptr, sizeof(proxy_local_port));
3526 ptr += sizeof(proxy_local_port);
3527 }
3528 break;
3529 #endif
3530
3531 #ifdef EXPERIMENTAL_DSN_INFO
3532 case '1': /* must arrive before A0, and applies to that addr */
3533 /* Two strings: smtp_greeting and helo_response */
3534 addr->smtp_greeting = string_copy(ptr);
3535 while(*ptr++);
3536 addr->helo_response = string_copy(ptr);
3537 while(*ptr++);
3538 break;
3539 #endif
3540
3541 case '0':
3542 addr->transport_return = *ptr++;
3543 addr->special_action = *ptr++;
3544 memcpy(&(addr->basic_errno), ptr, sizeof(addr->basic_errno));
3545 ptr += sizeof(addr->basic_errno);
3546 memcpy(&(addr->more_errno), ptr, sizeof(addr->more_errno));
3547 ptr += sizeof(addr->more_errno);
3548 memcpy(&(addr->flags), ptr, sizeof(addr->flags));
3549 ptr += sizeof(addr->flags);
3550 addr->message = (*ptr)? string_copy(ptr) : NULL;
3551 while(*ptr++);
3552 addr->user_message = (*ptr)? string_copy(ptr) : NULL;
3553 while(*ptr++);
3554
3555 /* Always two strings for host information, followed by the port number and DNSSEC mark */
3556
3557 if (*ptr != 0)
3558 {
3559 h = store_get(sizeof(host_item));
3560 h->name = string_copy(ptr);
3561 while (*ptr++);
3562 h->address = string_copy(ptr);
3563 while(*ptr++);
3564 memcpy(&(h->port), ptr, sizeof(h->port));
3565 ptr += sizeof(h->port);
3566 h->dnssec = *ptr == '2' ? DS_YES
3567 : *ptr == '1' ? DS_NO
3568 : DS_UNK;
3569 ptr++;
3570 addr->host_used = h;
3571 }
3572 else ptr++;
3573
3574 /* Finished with this address */
3575
3576 addr = addr->next;
3577 break;
3578 }
3579 break;
3580
3581 /* Local interface address/port */
3582 case 'I':
3583 if (*ptr) sending_ip_address = string_copy(ptr);
3584 while (*ptr++) ;
3585 if (*ptr) sending_port = atoi(CS ptr);
3586 while (*ptr++) ;
3587 break;
3588
3589 /* Z marks the logical end of the data. It is followed by '0' if
3590 continue_transport was NULL at the end of transporting, otherwise '1'.
3591 We need to know when it becomes NULL during a delivery down a passed SMTP
3592 channel so that we don't try to pass anything more down it. Of course, for
3593 most normal messages it will remain NULL all the time. */
3594
3595 case 'Z':
3596 if (*ptr == '0')
3597 {
3598 continue_transport = NULL;
3599 continue_hostname = NULL;
3600 }
3601 done = TRUE;
3602 DEBUG(D_deliver) debug_printf("Z0%c item read\n", *ptr);
3603 break;
3604
3605 /* Anything else is a disaster. */
3606
3607 default:
3608 msg = string_sprintf("malformed data (%d) read from pipe for transport "
3609 "process %d for transport %s", ptr[-1], pid,
3610 addr->transport->driver_name);
3611 done = TRUE;
3612 break;
3613 }
3614 }
3615
3616 /* The done flag is inspected externally, to determine whether or not to
3617 call the function again when the process finishes. */
3618
3619 p->done = done;
3620
3621 /* If the process hadn't finished, and we haven't seen the end of the data
3622 or suffered a disaster, update the rest of the state, and return FALSE to
3623 indicate "not finished". */
3624
3625 if (!eop && !done)
3626 {
3627 p->addr = addr;
3628 p->msg = msg;
3629 return FALSE;
3630 }
3631
3632 /* Close our end of the pipe, to prevent deadlock if the far end is still
3633 pushing stuff into it. */
3634
3635 (void)close(fd);
3636 p->fd = -1;
3637
3638 /* If we have finished without error, but haven't had data for every address,
3639 something is wrong. */
3640
3641 if (!msg && addr)
3642 msg = string_sprintf("insufficient address data read from pipe "
3643 "for transport process %d for transport %s", pid,
3644 addr->transport->driver_name);
3645
3646 /* If an error message is set, something has gone wrong in getting back
3647 the delivery data. Put the message into each address and freeze it. */
3648
3649 if (msg)
3650 for (addr = addrlist; addr; addr = addr->next)
3651 {
3652 addr->transport_return = DEFER;
3653 addr->special_action = SPECIAL_FREEZE;
3654 addr->message = msg;
3655 }
3656
3657 /* Return TRUE to indicate we have got all we need from this process, even
3658 if it hasn't actually finished yet. */
3659
3660 return TRUE;
3661 }
3662
3663
3664
3665 /*************************************************
3666 * Post-process a set of remote addresses *
3667 *************************************************/
3668
3669 /* Do what has to be done immediately after a remote delivery for each set of
3670 addresses, then re-write the spool if necessary. Note that post_process_one
3671 puts the address on an appropriate queue; hence we must fish off the next
3672 one first. This function is also called if there is a problem with setting
3673 up a subprocess to do a remote delivery in parallel. In this case, the final
3674 argument contains a message, and the action must be forced to DEFER.
3675
3676 Argument:
3677 addr pointer to chain of address items
3678 logflags flags for logging
3679 msg NULL for normal cases; -> error message for unexpected problems
3680 fallback TRUE if processing fallback hosts
3681
3682 Returns: nothing
3683 */
3684
3685 static void
3686 remote_post_process(address_item *addr, int logflags, uschar *msg,
3687 BOOL fallback)
3688 {
3689 host_item *h;
3690
3691 /* If any host addresses were found to be unusable, add them to the unusable
3692 tree so that subsequent deliveries don't try them. */
3693
3694 for (h = addr->host_list; h; h = h->next)
3695 if (h->address)
3696 if (h->status >= hstatus_unusable) tree_add_unusable(h);
3697
3698 /* Now handle each address on the chain. The transport has placed '=' or '-'
3699 into the special_action field for each successful delivery. */
3700
3701 while (addr)
3702 {
3703 address_item *next = addr->next;
3704
3705 /* If msg == NULL (normal processing) and the result is DEFER and we are
3706 processing the main hosts and there are fallback hosts available, put the
3707 address on the list for fallback delivery. */
3708
3709 if ( addr->transport_return == DEFER
3710 && addr->fallback_hosts
3711 && !fallback
3712 && !msg
3713 )
3714 {
3715 addr->host_list = addr->fallback_hosts;
3716 addr->next = addr_fallback;
3717 addr_fallback = addr;
3718 DEBUG(D_deliver) debug_printf("%s queued for fallback host(s)\n", addr->address);
3719 }
3720
3721 /* If msg is set (=> unexpected problem), set it in the address before
3722 doing the ordinary post processing. */
3723
3724 else
3725 {
3726 if (msg)
3727 {
3728 addr->message = msg;
3729 addr->transport_return = DEFER;
3730 }
3731 (void)post_process_one(addr, addr->transport_return, logflags,
3732 DTYPE_TRANSPORT, addr->special_action);
3733 }
3734
3735 /* Next address */
3736
3737 addr = next;
3738 }
3739
3740 /* If we have just delivered down a passed SMTP channel, and that was
3741 the last address, the channel will have been closed down. Now that
3742 we have logged that delivery, set continue_sequence to 1 so that
3743 any subsequent deliveries don't get "*" incorrectly logged. */
3744
3745 if (!continue_transport) continue_sequence = 1;
3746 }
3747
3748
3749
3750 /*************************************************
3751 * Wait for one remote delivery subprocess *
3752 *************************************************/
3753
3754 /* This function is called while doing remote deliveries when either the
3755 maximum number of processes exist and we need one to complete so that another
3756 can be created, or when waiting for the last ones to complete. It must wait for
3757 the completion of one subprocess, empty the control block slot, and return a
3758 pointer to the address chain.
3759
3760 Arguments: none
3761 Returns: pointer to the chain of addresses handled by the process;
3762 NULL if no subprocess found - this is an unexpected error
3763 */
3764
3765 static address_item *
3766 par_wait(void)
3767 {
3768 int poffset, status;
3769 address_item *addr, *addrlist;
3770 pid_t pid;
3771
3772 set_process_info("delivering %s: waiting for a remote delivery subprocess "
3773 "to finish", message_id);
3774
3775 /* Loop until either a subprocess completes, or there are no subprocesses in
3776 existence - in which case give an error return. We cannot proceed just by
3777 waiting for a completion, because a subprocess may have filled up its pipe, and
3778 be waiting for it to be emptied. Therefore, if no processes have finished, we
3779 wait for one of the pipes to acquire some data by calling select(), with a
3780 timeout just in case.
3781
3782 The simple approach is just to iterate after reading data from a ready pipe.
3783 This leads to non-ideal behaviour when the subprocess has written its final Z
3784 item, closed the pipe, and is in the process of exiting (the common case). A
3785 call to waitpid() yields nothing completed, but select() shows the pipe ready -
3786 reading it yields EOF, so you end up with busy-waiting until the subprocess has
3787 actually finished.
3788
3789 To avoid this, if all the data that is needed has been read from a subprocess
3790 after select(), an explicit wait() for it is done. We know that all it is doing
3791 is writing to the pipe and then exiting, so the wait should not be long.
3792
3793 The non-blocking waitpid() is to some extent just insurance; if we could
3794 reliably detect end-of-file on the pipe, we could always know when to do a
3795 blocking wait() for a completed process. However, because some systems use
3796 NDELAY, which doesn't distinguish between EOF and pipe empty, it is easier to
3797 use code that functions without the need to recognize EOF.
3798
3799 There's a double loop here just in case we end up with a process that is not in
3800 the list of remote delivery processes. Something has obviously gone wrong if
3801 this is the case. (For example, a process that is incorrectly left over from
3802 routing or local deliveries might be found.) The damage can be minimized by
3803 looping back and looking for another process. If there aren't any, the error
3804 return will happen. */
3805
3806 for (;;) /* Normally we do not repeat this loop */
3807 {
3808 while ((pid = waitpid(-1, &status, WNOHANG)) <= 0)
3809 {
3810 struct timeval tv;
3811 fd_set select_pipes;
3812 int maxpipe, readycount;
3813
3814 /* A return value of -1 can mean several things. If errno != ECHILD, it
3815 either means invalid options (which we discount), or that this process was
3816 interrupted by a signal. Just loop to try the waitpid() again.
3817
3818 If errno == ECHILD, waitpid() is telling us that there are no subprocesses
3819 in existence. This should never happen, and is an unexpected error.
3820 However, there is a nasty complication when running under Linux. If "strace
3821 -f" is being used under Linux to trace this process and its children,
3822 subprocesses are "stolen" from their parents and become the children of the
3823 tracing process. A general wait such as the one we've just obeyed returns
3824 as if there are no children while subprocesses are running. Once a
3825 subprocess completes, it is restored to the parent, and waitpid(-1) finds
3826 it. Thanks to Joachim Wieland for finding all this out and suggesting a
3827 palliative.
3828
3829 This does not happen using "truss" on Solaris, nor (I think) with other
3830 tracing facilities on other OS. It seems to be specific to Linux.
3831
3832 What we do to get round this is to use kill() to see if any of our
3833 subprocesses are still in existence. If kill() gives an OK return, we know
3834 it must be for one of our processes - it can't be for a re-use of the pid,
3835 because if our process had finished, waitpid() would have found it. If any
3836 of our subprocesses are in existence, we proceed to use select() as if
3837 waitpid() had returned zero. I think this is safe. */
3838
3839 if (pid < 0)
3840 {
3841 if (errno != ECHILD) continue; /* Repeats the waitpid() */
3842
3843 DEBUG(D_deliver)
3844 debug_printf("waitpid() returned -1/ECHILD: checking explicitly "
3845 "for process existence\n");
3846
3847 for (poffset = 0; poffset < remote_max_parallel; poffset++)
3848 {
3849 if ((pid = parlist[poffset].pid) != 0 && kill(pid, 0) == 0)
3850 {
3851 DEBUG(D_deliver) debug_printf("process %d still exists: assume "
3852 "stolen by strace\n", (int)pid);
3853 break; /* With poffset set */
3854 }
3855 }
3856
3857 if (poffset >= remote_max_parallel)
3858 {
3859 DEBUG(D_deliver) debug_printf("*** no delivery children found\n");
3860 return NULL; /* This is the error return */
3861 }
3862 }
3863
3864 /* A pid value greater than 0 breaks the "while" loop. A negative value has
3865 been handled above. A return value of zero means that there is at least one
3866 subprocess, but there are no completed subprocesses. See if any pipes are
3867 ready with any data for reading. */
3868
3869 DEBUG(D_deliver) debug_printf("selecting on subprocess pipes\n");
3870
3871 maxpipe = 0;
3872 FD_ZERO(&select_pipes);
3873 for (poffset = 0; poffset < remote_max_parallel; poffset++)
3874 {
3875 if (parlist[poffset].pid != 0)
3876 {
3877 int fd = parlist[poffset].fd;
3878 FD_SET(fd, &select_pipes);
3879 if (fd > maxpipe) maxpipe = fd;
3880 }
3881 }
3882
3883 /* Stick in a 60-second timeout, just in case. */
3884
3885 tv.tv_sec = 60;
3886 tv.tv_usec = 0;
3887
3888 readycount = select(maxpipe + 1, (SELECT_ARG2_TYPE *)&select_pipes,
3889 NULL, NULL, &tv);
3890
3891 /* Scan through the pipes and read any that are ready; use the count
3892 returned by select() to stop when there are no more. Select() can return
3893 with no processes (e.g. if interrupted). This shouldn't matter.
3894
3895 If par_read_pipe() returns TRUE, it means that either the terminating Z was
3896 read, or there was a disaster. In either case, we are finished with this
3897 process. Do an explicit wait() for the process and break the main loop if
3898 it succeeds.
3899
3900 It turns out that we have to deal with the case of an interrupted system
3901 call, which can happen on some operating systems if the signal handling is
3902 set up to do that by default. */
3903
3904 for (poffset = 0;
3905 readycount > 0 && poffset < remote_max_parallel;
3906 poffset++)
3907 {
3908 if ( (pid = parlist[poffset].pid) != 0
3909 && FD_ISSET(parlist[poffset].fd, &select_pipes)
3910 )
3911 {
3912 readycount--;
3913 if (par_read_pipe(poffset, FALSE)) /* Finished with this pipe */
3914 {
3915 for (;;) /* Loop for signals */
3916 {
3917 pid_t endedpid = waitpid(pid, &status, 0);
3918 if (endedpid == pid) goto PROCESS_DONE;
3919 if (endedpid != (pid_t)(-1) || errno != EINTR)
3920 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Unexpected error return "
3921 "%d (errno = %d) from waitpid() for process %d",
3922 (int)endedpid, errno, (int)pid);
3923 }
3924 }
3925 }
3926 }
3927
3928 /* Now go back and look for a completed subprocess again. */
3929 }
3930
3931 /* A completed process was detected by the non-blocking waitpid(). Find the
3932 data block that corresponds to this subprocess. */
3933
3934 for (poffset = 0; poffset < remote_max_parallel; poffset++)
3935 if (pid == parlist[poffset].pid) break;
3936
3937 /* Found the data block; this is a known remote delivery process. We don't
3938 need to repeat the outer loop. This should be what normally happens. */
3939
3940 if (poffset < remote_max_parallel) break;
3941
3942 /* This situation is an error, but it's probably better to carry on looking
3943 for another process than to give up (as we used to do). */
3944
3945 log_write(0, LOG_MAIN|LOG_PANIC, "Process %d finished: not found in remote "
3946 "transport process list", pid);
3947 } /* End of the "for" loop */
3948
3949 /* Come here when all the data was completely read after a select(), and
3950 the process in pid has been wait()ed for. */
3951
3952 PROCESS_DONE:
3953
3954 DEBUG(D_deliver)
3955 {
3956 if (status == 0)
3957 debug_printf("remote delivery process %d ended\n", (int)pid);
3958 else
3959 debug_printf("remote delivery process %d ended: status=%04x\n", (int)pid,
3960 status);
3961 }
3962
3963 set_process_info("delivering %s", message_id);
3964
3965 /* Get the chain of processed addresses */
3966
3967 addrlist = parlist[poffset].addrlist;
3968
3969 /* If the process did not finish cleanly, record an error and freeze (except
3970 for SIGTERM, SIGKILL and SIGQUIT), and also ensure the journal is not removed,
3971 in case the delivery did actually happen. */
3972
3973 if ((status & 0xffff) != 0)
3974 {
3975 uschar *msg;
3976 int msb = (status >> 8) & 255;
3977 int lsb = status & 255;
3978 int code = (msb == 0)? (lsb & 0x7f) : msb;
3979
3980 msg = string_sprintf("%s transport process returned non-zero status 0x%04x: "
3981 "%s %d",
3982 addrlist->transport->driver_name,
3983 status,
3984 (msb == 0)? "terminated by signal" : "exit code",
3985 code);
3986
3987 if (msb != 0 || (code != SIGTERM && code != SIGKILL && code != SIGQUIT))
3988 addrlist->special_action = SPECIAL_FREEZE;
3989
3990 for (addr = addrlist; addr; addr = addr->next)
3991 {
3992 addr->transport_return = DEFER;
3993 addr->message = msg;
3994 }
3995
3996 remove_journal = FALSE;
3997 }
3998
3999 /* Else complete reading the pipe to get the result of the delivery, if all
4000 the data has not yet been obtained. */
4001
4002 else if (!parlist[poffset].done) (void)par_read_pipe(poffset, TRUE);
4003
4004 /* Put the data count and return path into globals, mark the data slot unused,
4005 decrement the count of subprocesses, and return the address chain. */
4006
4007 transport_count = parlist[poffset].transport_count;
4008 used_return_path = parlist[poffset].return_path;
4009 parlist[poffset].pid = 0;
4010 parcount--;
4011 return addrlist;
4012 }
4013
4014
4015
4016 /*************************************************
4017 * Wait for subprocesses and post-process *
4018 *************************************************/
4019
4020 /* This function waits for subprocesses until the number that are still running
4021 is below a given threshold. For each complete subprocess, the addresses are
4022 post-processed. If we can't find a running process, there is some shambles.
4023 Better not bomb out, as that might lead to multiple copies of the message. Just
4024 log and proceed as if all done.
4025
4026 Arguments:
4027 max maximum number of subprocesses to leave running
4028 fallback TRUE if processing fallback hosts
4029
4030 Returns: nothing
4031 */
4032
4033 static void
4034 par_reduce(int max, BOOL fallback)
4035 {
4036 while (parcount > max)
4037 {
4038 address_item *doneaddr = par_wait();
4039 if (!doneaddr)
4040 {
4041 log_write(0, LOG_MAIN|LOG_PANIC,
4042 "remote delivery process count got out of step"