0817a4eda62a784ba66229de589339ba68442714
[exim.git] / src / src / route.c
1 /*************************************************
2 * Exim - an Internet mail transport agent *
3 *************************************************/
4
5 /* Copyright (c) University of Cambridge 1995 - 2018 */
6 /* See the file NOTICE for conditions of use and distribution. */
7
8 /* Functions concerned with routing, and the list of generic router options. */
9
10
11 #include "exim.h"
12
13
14
15 /* Generic options for routers, all of which live inside router_instance
16 data blocks and which therefore have the opt_public flag set. */
17
18 optionlist optionlist_routers[] = {
19 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
20 (void *)(offsetof(router_instance, expand_gid)) },
21 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
22 (void *)(offsetof(router_instance, expand_more)) },
23 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
24 (void *)(offsetof(router_instance, expand_unseen)) },
25 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
26 (void *)(offsetof(router_instance, expand_uid)) },
27 { "*set_group", opt_bool | opt_hidden | opt_public,
28 (void *)(offsetof(router_instance, gid_set)) },
29 { "*set_user", opt_bool | opt_hidden | opt_public,
30 (void *)(offsetof(router_instance, uid_set)) },
31 { "address_data", opt_stringptr|opt_public,
32 (void *)(offsetof(router_instance, address_data)) },
33 { "address_test", opt_bool|opt_public,
34 (void *)(offsetof(router_instance, address_test)) },
35 #ifdef EXPERIMENTAL_BRIGHTMAIL
36 { "bmi_deliver_alternate", opt_bool | opt_public,
37 (void *)(offsetof(router_instance, bmi_deliver_alternate)) },
38 { "bmi_deliver_default", opt_bool | opt_public,
39 (void *)(offsetof(router_instance, bmi_deliver_default)) },
40 { "bmi_dont_deliver", opt_bool | opt_public,
41 (void *)(offsetof(router_instance, bmi_dont_deliver)) },
42 { "bmi_rule", opt_stringptr|opt_public,
43 (void *)(offsetof(router_instance, bmi_rule)) },
44 #endif
45 { "cannot_route_message", opt_stringptr | opt_public,
46 (void *)(offsetof(router_instance, cannot_route_message)) },
47 { "caseful_local_part", opt_bool | opt_public,
48 (void *)(offsetof(router_instance, caseful_local_part)) },
49 { "check_local_user", opt_bool | opt_public,
50 (void *)(offsetof(router_instance, check_local_user)) },
51 { "condition", opt_stringptr|opt_public|opt_rep_con,
52 (void *)offsetof(router_instance, condition) },
53 { "debug_print", opt_stringptr | opt_public,
54 (void *)offsetof(router_instance, debug_string) },
55 { "disable_logging", opt_bool | opt_public,
56 (void *)offsetof(router_instance, disable_logging) },
57 { "dnssec_request_domains", opt_stringptr|opt_public,
58 (void *)offsetof(router_instance, dnssec.request) },
59 { "dnssec_require_domains", opt_stringptr|opt_public,
60 (void *)offsetof(router_instance, dnssec.require) },
61 { "domains", opt_stringptr|opt_public,
62 (void *)offsetof(router_instance, domains) },
63 { "driver", opt_stringptr|opt_public,
64 (void *)offsetof(router_instance, driver_name) },
65 { "dsn_lasthop", opt_bool|opt_public,
66 (void *)offsetof(router_instance, dsn_lasthop) },
67 { "errors_to", opt_stringptr|opt_public,
68 (void *)(offsetof(router_instance, errors_to)) },
69 { "expn", opt_bool|opt_public,
70 (void *)offsetof(router_instance, expn) },
71 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
72 (void *)offsetof(router_instance, fail_verify_sender) },
73 { "fail_verify_recipient", opt_bool|opt_public,
74 (void *)offsetof(router_instance, fail_verify_recipient) },
75 { "fail_verify_sender", opt_bool|opt_public,
76 (void *)offsetof(router_instance, fail_verify_sender) },
77 { "fallback_hosts", opt_stringptr|opt_public,
78 (void *)offsetof(router_instance, fallback_hosts) },
79 { "group", opt_expand_gid | opt_public,
80 (void *)(offsetof(router_instance, gid)) },
81 { "headers_add", opt_stringptr|opt_public|opt_rep_str,
82 (void *)offsetof(router_instance, extra_headers) },
83 { "headers_remove", opt_stringptr|opt_public|opt_rep_str,
84 (void *)offsetof(router_instance, remove_headers) },
85 { "ignore_target_hosts",opt_stringptr|opt_public,
86 (void *)offsetof(router_instance, ignore_target_hosts) },
87 { "initgroups", opt_bool | opt_public,
88 (void *)(offsetof(router_instance, initgroups)) },
89 { "local_part_prefix", opt_stringptr|opt_public,
90 (void *)offsetof(router_instance, prefix) },
91 { "local_part_prefix_optional",opt_bool|opt_public,
92 (void *)offsetof(router_instance, prefix_optional) },
93 { "local_part_suffix", opt_stringptr|opt_public,
94 (void *)offsetof(router_instance, suffix) },
95 { "local_part_suffix_optional",opt_bool|opt_public,
96 (void *)offsetof(router_instance, suffix_optional) },
97 { "local_parts", opt_stringptr|opt_public,
98 (void *)offsetof(router_instance, local_parts) },
99 { "log_as_local", opt_bool|opt_public,
100 (void *)offsetof(router_instance, log_as_local) },
101 { "more", opt_expand_bool|opt_public,
102 (void *)offsetof(router_instance, more) },
103 { "pass_on_timeout", opt_bool|opt_public,
104 (void *)offsetof(router_instance, pass_on_timeout) },
105 { "pass_router", opt_stringptr|opt_public,
106 (void *)offsetof(router_instance, pass_router_name) },
107 { "redirect_router", opt_stringptr|opt_public,
108 (void *)offsetof(router_instance, redirect_router_name) },
109 { "require_files", opt_stringptr|opt_public,
110 (void *)offsetof(router_instance, require_files) },
111 { "retry_use_local_part", opt_bool|opt_public,
112 (void *)offsetof(router_instance, retry_use_local_part) },
113 { "router_home_directory", opt_stringptr|opt_public,
114 (void *)offsetof(router_instance, router_home_directory) },
115 { "self", opt_stringptr|opt_public,
116 (void *)(offsetof(router_instance, self)) },
117 { "senders", opt_stringptr|opt_public,
118 (void *)offsetof(router_instance, senders) },
119 { "set", opt_stringptr|opt_public|opt_rep_str,
120 (void *)offsetof(router_instance, set) },
121 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
122 { "translate_ip_address", opt_stringptr|opt_public,
123 (void *)offsetof(router_instance, translate_ip_address) },
124 #endif
125 { "transport", opt_stringptr|opt_public,
126 (void *)offsetof(router_instance, transport_name) },
127 { "transport_current_directory", opt_stringptr|opt_public,
128 (void *)offsetof(router_instance, current_directory) },
129 { "transport_home_directory", opt_stringptr|opt_public,
130 (void *)offsetof(router_instance, home_directory) },
131 { "unseen", opt_expand_bool|opt_public,
132 (void *)offsetof(router_instance, unseen) },
133 { "user", opt_expand_uid | opt_public,
134 (void *)(offsetof(router_instance, uid)) },
135 { "verify", opt_bool_verify|opt_hidden|opt_public,
136 (void *)offsetof(router_instance, verify_sender) },
137 { "verify_only", opt_bool|opt_public,
138 (void *)offsetof(router_instance, verify_only) },
139 { "verify_recipient", opt_bool|opt_public,
140 (void *)offsetof(router_instance, verify_recipient) },
141 { "verify_sender", opt_bool|opt_public,
142 (void *)offsetof(router_instance, verify_sender) }
143 };
144
145 int optionlist_routers_size = nelem(optionlist_routers);
146
147
148 #ifdef MACRO_PREDEF
149
150 # include "macro_predef.h"
151
152 void
153 options_routers(void)
154 {
155 uschar buf[64];
156
157 options_from_list(optionlist_routers, nelem(optionlist_routers), US"ROUTERS", NULL);
158
159 for (router_info * ri = routers_available; ri->driver_name[0]; ri++)
160 {
161 spf(buf, sizeof(buf), US"_DRIVER_ROUTER_%T", ri->driver_name);
162 builtin_macro_create(buf);
163 options_from_list(ri->options, (unsigned)*ri->options_count, US"ROUTER", ri->driver_name);
164 }
165 }
166
167 #else /*!MACRO_PREDEF*/
168
169 /*************************************************
170 * Set router pointer from name *
171 *************************************************/
172
173 /* This function is used for the redirect_router and pass_router options and
174 called from route_init() below.
175
176 Arguments:
177 r the current router
178 name new router name
179 ptr where to put the pointer
180 after TRUE if router must follow this one
181
182 Returns: nothing.
183 */
184
185 static void
186 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
187 {
188 BOOL afterthis = FALSE;
189 router_instance *rr;
190
191 for (rr = routers; rr; rr = rr->next)
192 {
193 if (Ustrcmp(name, rr->name) == 0)
194 {
195 *ptr = rr;
196 break;
197 }
198 if (rr == r) afterthis = TRUE;
199 }
200
201 if (!rr)
202 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
203 "new_router \"%s\" not found for \"%s\" router", name, r->name);
204
205 if (after && !afterthis)
206 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
207 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
208 }
209
210
211
212 /*************************************************
213 * Initialize router list *
214 *************************************************/
215
216 /* Read the routers section of the configuration file, and set up a chain of
217 router instances according to its contents. Each router has generic options and
218 may also have its own private options. This function is only ever called when
219 routers == NULL. We use generic code in readconf to do the work. It will set
220 values from the configuration file, and then call the driver's initialization
221 function. */
222
223 void
224 route_init(void)
225 {
226 readconf_driver_init(US"router",
227 (driver_instance **)(&routers), /* chain anchor */
228 (driver_info *)routers_available, /* available drivers */
229 sizeof(router_info), /* size of info blocks */
230 &router_defaults, /* default values for generic options */
231 sizeof(router_instance), /* size of instance block */
232 optionlist_routers, /* generic options */
233 optionlist_routers_size);
234
235 for (router_instance * r = routers; r; r = r->next)
236 {
237 uschar *s = r->self;
238
239 /* If log_as_local is unset, its overall default is FALSE. (The accept
240 router defaults it to TRUE.) */
241
242 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
243
244 /* Check for transport or no transport on certain routers */
245
246 if ( (r->info->ri_flags & ri_yestransport)
247 && !r->transport_name && !r->verify_only)
248 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
249 "a transport is required for this router", r->name);
250
251 if ((r->info->ri_flags & ri_notransport) && r->transport_name)
252 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
253 "a transport must not be defined for this router", r->name);
254
255 /* The "self" option needs to be decoded into a code value and possibly a
256 new domain string and a rewrite boolean. */
257
258 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
259 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
260 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
261 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
262 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
263 else if (Ustrncmp(s, "reroute:", 8) == 0)
264 {
265 s += 8;
266 while (isspace(*s)) s++;
267 if (Ustrncmp(s, "rewrite:", 8) == 0)
268 {
269 r->self_rewrite = TRUE;
270 s += 8;
271 while (isspace(*s)) s++;
272 }
273 r->self = s;
274 r->self_code = self_reroute;
275 }
276
277 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
278 "%s is not valid for the self option", r->name, s);
279
280 /* If any router has check_local_user set, default retry_use_local_part
281 TRUE; otherwise its default is FALSE. */
282
283 if (r->retry_use_local_part == TRUE_UNSET)
284 r->retry_use_local_part = r->check_local_user;
285
286 /* Build a host list if fallback hosts is set. */
287
288 host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE);
289
290 /* Check redirect_router and pass_router are valid */
291
292 if (r->redirect_router_name)
293 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
294
295 if (r->pass_router_name)
296 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
297
298 #ifdef notdef
299 DEBUG(D_route) debug_printf("DSN: %s %s\n", r->name,
300 r->dsn_lasthop ? "lasthop set" : "propagating DSN");
301 #endif
302 }
303 }
304
305
306
307 /*************************************************
308 * Tidy up after routing *
309 *************************************************/
310
311 /* Routers are entitled to keep hold of certain resources in their instance
312 blocks so as to save setting them up each time. An example is an open file.
313 Such routers must provide a tidyup entry point which is called when all routing
314 is finished, via this function. */
315
316 void
317 route_tidyup(void)
318 {
319 for (router_instance * r = routers; r; r = r->next)
320 if (r->info->tidyup) (r->info->tidyup)(r);
321 }
322
323
324
325 /*************************************************
326 * Check local part for prefix *
327 *************************************************/
328
329 /* This function is handed a local part and a list of possible prefixes; if any
330 one matches, return the prefix length. A prefix beginning with '*' is a
331 wildcard.
332
333 Arguments:
334 local_part the local part to check
335 prefixes the list of prefixes
336
337 Returns: length of matching prefix or zero
338 */
339
340 int
341 route_check_prefix(const uschar *local_part, const uschar *prefixes)
342 {
343 int sep = 0;
344 uschar *prefix;
345 const uschar *listptr = prefixes;
346 uschar prebuf[64];
347
348 while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf))))
349 {
350 int plen = Ustrlen(prefix);
351 if (prefix[0] == '*')
352 {
353 prefix++;
354 for (const uschar * p = local_part + Ustrlen(local_part) - (--plen);
355 p >= local_part; p--)
356 if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part;
357 }
358 else
359 if (strncmpic(prefix, local_part, plen) == 0) return plen;
360 }
361
362 return 0;
363 }
364
365
366
367 /*************************************************
368 * Check local part for suffix *
369 *************************************************/
370
371 /* This function is handed a local part and a list of possible suffixes;
372 if any one matches, return the suffix length. A suffix ending with '*'
373 is a wildcard.
374
375 Arguments:
376 local_part the local part to check
377 suffixes the list of suffixes
378
379 Returns: length of matching suffix or zero
380 */
381
382 int
383 route_check_suffix(const uschar *local_part, const uschar *suffixes)
384 {
385 int sep = 0;
386 int alen = Ustrlen(local_part);
387 uschar *suffix;
388 const uschar *listptr = suffixes;
389 uschar sufbuf[64];
390
391 while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf))))
392 {
393 int slen = Ustrlen(suffix);
394 if (suffix[slen-1] == '*')
395 {
396 const uschar *pend = local_part + alen - (--slen) + 1;
397 for (const uschar * p = local_part; p < pend; p++)
398 if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part);
399 }
400 else
401 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
402 return slen;
403 }
404
405 return 0;
406 }
407
408
409
410
411 /*************************************************
412 * Check local part, domain, or sender *
413 *************************************************/
414
415 /* The checks in check_router_conditions() require similar code, so we use
416 this function to save repetition.
417
418 Arguments:
419 rname router name for error messages
420 type type of check, for error message
421 list domains, local_parts, or senders list
422 anchorptr -> tree for possibly cached items (domains)
423 cache_bits cached bits pointer
424 listtype MCL_DOMAIN for domain check
425 MCL_LOCALPART for local part check
426 MCL_ADDRESS for sender check
427 domloc current domain, current local part, or NULL for sender check
428 ldata where to put lookup data
429 caseless passed on to match_isinlist()
430 perror where to put an error message
431
432 Returns: OK item is in list
433 SKIP item is not in list, router is to be skipped
434 DEFER lookup or other defer
435 */
436
437 static int
438 route_check_dls(uschar *rname, uschar *type, const uschar *list,
439 tree_node **anchorptr, unsigned int *cache_bits, int listtype,
440 const uschar *domloc, const uschar **ldata, BOOL caseless, uschar **perror)
441 {
442 if (!list) return OK; /* Empty list always succeeds */
443
444 DEBUG(D_route) debug_printf("checking %s\n", type);
445
446 /* The domain and local part use the same matching function, whereas sender
447 has its own code. */
448
449 switch(domloc
450 ? match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
451 caseless, ldata)
452 : match_address_list(sender_address ? sender_address : US"",
453 TRUE, TRUE, &list, cache_bits, -1, 0, CUSS &sender_data)
454 )
455 {
456 case OK:
457 return OK;
458
459 case FAIL:
460 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
461 DEBUG(D_route) debug_printf("%s\n", *perror);
462 return SKIP;
463
464 default: /* Paranoia, and keeps compilers happy */
465 case DEFER:
466 *perror = string_sprintf("%s check lookup or other defer", type);
467 DEBUG(D_route) debug_printf("%s\n", *perror);
468 return DEFER;
469 }
470 }
471
472
473
474 /*************************************************
475 * Check access by a given uid/gid *
476 *************************************************/
477
478 /* This function checks whether a given uid/gid has access to a given file or
479 directory. It is called only from check_files() below. This is hopefully a
480 cheapish check that does the job most of the time. Exim does *not* rely on this
481 test when actually accessing any file. The test is used when routing to make it
482 possible to take actions such as "if user x can access file y then run this
483 router".
484
485 During routing, Exim is normally running as root, and so the test will work
486 except for NFS non-root mounts. When verifying during message reception, Exim
487 is running as "exim", so the test may not work. This is a limitation of the
488 Exim design.
489
490 Code in check_files() below detects the case when it cannot stat() the file (as
491 root), and in that situation it uses a setuid subprocess in which to run this
492 test.
493
494 Arguments:
495 path the path to check
496 uid the user
497 gid the group
498 bits the bits required in the final component
499
500 Returns: TRUE
501 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
502 */
503
504 static BOOL
505 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
506 {
507 struct stat statbuf;
508 uschar *slash;
509 uschar *rp = US realpath(CS path, CS big_buffer);
510 uschar *sp = rp + 1;
511
512 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
513 (int)uid, (int)gid, bits);
514
515 if (!rp) return FALSE;
516
517 while ((slash = Ustrchr(sp, '/')))
518 {
519 *slash = 0;
520 DEBUG(D_route) debug_printf("stat %s\n", rp);
521 if (Ustat(rp, &statbuf) < 0) return FALSE;
522 if ((statbuf.st_mode &
523 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
524 ) == 0)
525 {
526 errno = EACCES;
527 return FALSE;
528 }
529 *slash = '/';
530 sp = slash + 1;
531 }
532
533 /* Down to the final component */
534
535 DEBUG(D_route) debug_printf("stat %s\n", rp);
536
537 if (Ustat(rp, &statbuf) < 0) return FALSE;
538
539 if (statbuf.st_uid == uid) bits = bits << 6;
540 else if (statbuf.st_gid == gid) bits = bits << 3;
541 if ((statbuf.st_mode & bits) != bits)
542 {
543 errno = EACCES;
544 return FALSE;
545 }
546
547 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
548 return TRUE;
549 }
550
551
552
553 /*************************************************
554 * Do file existence tests *
555 *************************************************/
556
557 /* This function is given a colon-separated list of file tests, each of which
558 is expanded before use. A test consists of a file name, optionally preceded by
559 ! (require non-existence) and/or + for handling permission denied (+ means
560 treat as non-existing).
561
562 An item that contains no slashes is interpreted as a username or id, with an
563 optional group id, for checking access to the file. This cannot be done
564 "perfectly", but it is good enough for a number of applications.
565
566 Arguments:
567 s a colon-separated list of file tests or NULL
568 perror a pointer to an anchor for an error text in the case of a DEFER
569
570 Returns: OK if s == NULL or all tests are as required
571 DEFER if the existence of at least one of the files is
572 unclear (an error other than non-existence occurred);
573 DEFER if an expansion failed
574 DEFER if a name is not absolute
575 DEFER if problems with user/group
576 SKIP otherwise
577 */
578
579 static int
580 check_files(const uschar *s, uschar **perror)
581 {
582 int sep = 0; /* List has default separators */
583 uid_t uid = 0; /* For picky compilers */
584 gid_t gid = 0; /* For picky compilers */
585 BOOL ugid_set = FALSE;
586 const uschar *listptr;
587 uschar *check;
588 uschar buffer[1024];
589
590 if (!s) return OK;
591
592 DEBUG(D_route) debug_printf("checking require_files\n");
593
594 listptr = s;
595 while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer))))
596 {
597 int rc;
598 int eacces_code = 0;
599 BOOL invert = FALSE;
600 struct stat statbuf;
601 uschar *ss = expand_string(check);
602
603 if (!ss)
604 {
605 if (f.expand_string_forcedfail) continue;
606 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
607 check, expand_string_message);
608 goto RETURN_DEFER;
609 }
610
611 /* Empty items are just skipped */
612
613 if (*ss == 0) continue;
614
615 /* If there are no slashes in the string, we have a user name or uid, with
616 optional group/gid. */
617
618 if (Ustrchr(ss, '/') == NULL)
619 {
620 BOOL ok;
621 struct passwd *pw;
622 uschar *comma = Ustrchr(ss, ',');
623
624 /* If there's a comma, temporarily terminate the user name/number
625 at that point. Then set the uid. */
626
627 if (comma != NULL) *comma = 0;
628 ok = route_finduser(ss, &pw, &uid);
629 if (comma != NULL) *comma = ',';
630
631 if (!ok)
632 {
633 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
634 goto RETURN_DEFER;
635 }
636
637 /* If there was no comma, the gid is that associated with the user. */
638
639 if (comma == NULL)
640 {
641 if (pw != NULL) gid = pw->pw_gid; else
642 {
643 *perror = string_sprintf("group missing after numerical uid %d for "
644 "require_files", (int)uid);
645 goto RETURN_DEFER;
646 }
647 }
648 else
649 {
650 if (!route_findgroup(comma + 1, &gid))
651 {
652 *perror = string_sprintf("group \"%s\" for require_files not found\n",
653 comma + 1);
654 goto RETURN_DEFER;
655 }
656 }
657
658 /* Note that we have values set, and proceed to next item */
659
660 DEBUG(D_route)
661 debug_printf("check subsequent files for access by %s\n", ss);
662 ugid_set = TRUE;
663 continue;
664 }
665
666 /* Path, possibly preceded by + and ! */
667
668 if (*ss == '+')
669 {
670 eacces_code = 1;
671 while (isspace((*(++ss))));
672 }
673
674 if (*ss == '!')
675 {
676 invert = TRUE;
677 while (isspace((*(++ss))));
678 }
679
680 if (*ss != '/')
681 {
682 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
683 goto RETURN_DEFER;
684 }
685
686 /* Stat the file, either as root (while routing) or as exim (while verifying
687 during message reception). */
688
689 rc = Ustat(ss, &statbuf);
690
691 DEBUG(D_route)
692 {
693 debug_printf("file check: %s\n", check);
694 if (ss != check) debug_printf("expanded file: %s\n", ss);
695 debug_printf("stat() yielded %d\n", rc);
696 }
697
698 /* If permission is denied, and we are running as root (i.e. routing for
699 delivery rather than verifying), and the requirement is to test for access by
700 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
701 system. In this case, we have to use a subprocess that runs as the relevant
702 uid in order to do the test. */
703
704 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
705 {
706 int status;
707 pid_t pid;
708 void (*oldsignal)(int);
709
710 DEBUG(D_route) debug_printf("root is denied access: forking to check "
711 "in subprocess\n");
712
713 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
714 that the child process can be waited for, just in case get here with it set
715 otherwise. Save the old state for resetting on the wait. */
716
717 oldsignal = signal(SIGCHLD, SIG_DFL);
718 pid = fork();
719
720 /* If fork() fails, reinstate the original error and behave as if
721 this block of code were not present. This is the same behaviour as happens
722 when Exim is not running as root at this point. */
723
724 if (pid < 0)
725 {
726 DEBUG(D_route)
727 debug_printf("require_files: fork failed: %s\n", strerror(errno));
728 errno = EACCES;
729 goto HANDLE_ERROR;
730 }
731
732 /* In the child process, change uid and gid, and then do the check using
733 the route_check_access() function. This does more than just stat the file;
734 it tests permissions as well. Return 0 for OK and 1 for failure. */
735
736 if (pid == 0)
737 {
738 exim_setugid(uid, gid, TRUE,
739 string_sprintf("require_files check, file=%s", ss));
740 if (route_check_access(ss, uid, gid, 4)) _exit(0);
741 DEBUG(D_route) debug_printf("route_check_access() failed\n");
742 _exit(1);
743 }
744
745 /* In the parent, wait for the child to finish */
746
747 while (waitpid(pid, &status, 0) < 0)
748 {
749 if (errno != EINTR) /* unexpected error, interpret as failure */
750 {
751 status = 1;
752 break;
753 }
754 }
755
756 signal(SIGCHLD, oldsignal); /* restore */
757 if ((status == 0) == invert) return SKIP;
758 continue; /* to test the next file */
759 }
760
761 /* Control reaches here if the initial stat() succeeds, or fails with an
762 error other than EACCES, or no uid/gid is set, or we are not running as root.
763 If we know the file exists and uid/gid are set, try to check read access for
764 that uid/gid as best we can. */
765
766 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
767 {
768 DEBUG(D_route) debug_printf("route_check_access() failed\n");
769 rc = -1;
770 }
771
772 /* Handle error returns from stat() or route_check_access(). The EACCES error
773 is handled specially. At present, we can force it to be treated as
774 non-existence. Write the code so that it will be easy to add forcing for
775 existence if required later. */
776
777 HANDLE_ERROR:
778 if (rc < 0)
779 {
780 DEBUG(D_route) debug_printf("errno = %d\n", errno);
781 if (errno == EACCES)
782 {
783 if (eacces_code == 1)
784 {
785 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
786 errno = ENOENT; /* Treat as non-existent */
787 }
788 }
789 if (errno != ENOENT)
790 {
791 *perror = string_sprintf("require_files: error for %s: %s", ss,
792 strerror(errno));
793 goto RETURN_DEFER;
794 }
795 }
796
797 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
798
799 if ((rc >= 0) == invert) return SKIP;
800 }
801
802 return OK;
803
804 /* Come here on any of the errors that return DEFER. */
805
806 RETURN_DEFER:
807 DEBUG(D_route) debug_printf("%s\n", *perror);
808 return DEFER;
809 }
810
811
812
813
814
815 /*************************************************
816 * Check for router skipping *
817 *************************************************/
818
819 /* This function performs various checks to see whether a router should be
820 skipped. The order in which they are performed is important.
821
822 Arguments:
823 r pointer to router instance block
824 addr address that is being handled
825 verify the verification type
826 pw ptr to ptr to passwd structure for local user
827 perror for lookup errors
828
829 Returns: OK if all the tests succeed
830 SKIP if router is to be skipped
831 DEFER for a lookup defer
832 FAIL for address to be failed
833 */
834
835 static BOOL
836 check_router_conditions(router_instance *r, address_item *addr, int verify,
837 struct passwd **pw, uschar **perror)
838 {
839 int rc;
840 uschar *check_local_part;
841 unsigned int *localpart_cache;
842
843 /* Reset variables to hold a home directory and data from lookup of a domain or
844 local part, and ensure search_find_defer is unset, in case there aren't any
845 actual lookups. */
846
847 deliver_home = NULL;
848 deliver_domain_data = NULL;
849 deliver_localpart_data = NULL;
850 sender_data = NULL;
851 local_user_gid = (gid_t)(-1);
852 local_user_uid = (uid_t)(-1);
853 f.search_find_defer = FALSE;
854
855 /* Skip this router if not verifying and it has verify_only set */
856
857 if ((verify == v_none || verify == v_expn) && r->verify_only)
858 {
859 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
860 return SKIP;
861 }
862
863 /* Skip this router if testing an address (-bt) and address_test is not set */
864
865 if (f.address_test_mode && !r->address_test)
866 {
867 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
868 r->name);
869 return SKIP;
870 }
871
872 /* Skip this router if verifying and it hasn't got the appropriate verify flag
873 set. */
874
875 if ((verify == v_sender && !r->verify_sender) ||
876 (verify == v_recipient && !r->verify_recipient))
877 {
878 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
879 r->name, verify, r->verify_sender, r->verify_recipient);
880 return SKIP;
881 }
882
883 /* Skip this router if processing EXPN and it doesn't have expn set */
884
885 if (verify == v_expn && !r->expn)
886 {
887 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
888 return SKIP;
889 }
890
891 /* Skip this router if there's a domain mismatch. */
892
893 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
894 addr->domain_cache, TRUE, addr->domain, CUSS &deliver_domain_data,
895 MCL_DOMAIN, perror)) != OK)
896 return rc;
897
898 /* Skip this router if there's a local part mismatch. We want to pass over the
899 caseful local part, so that +caseful can restore it, even if this router is
900 handling local parts caselessly. However, we can't just pass cc_local_part,
901 because that doesn't have the prefix or suffix stripped. A bit of massaging is
902 required. Also, we only use the match cache for local parts that have not had
903 a prefix or suffix stripped. */
904
905 if (!addr->prefix && !addr->suffix)
906 {
907 localpart_cache = addr->localpart_cache;
908 check_local_part = addr->cc_local_part;
909 }
910 else
911 {
912 localpart_cache = NULL;
913 check_local_part = string_copy(addr->cc_local_part);
914 if (addr->prefix)
915 check_local_part += Ustrlen(addr->prefix);
916 if (addr->suffix)
917 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
918 }
919
920 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
921 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
922 check_local_part, CUSS &deliver_localpart_data,
923 !r->caseful_local_part, perror)) != OK)
924 return rc;
925
926 /* If the check_local_user option is set, check that the local_part is the
927 login of a local user. Note: the third argument to route_finduser() must be
928 NULL here, to prevent a numeric string being taken as a numeric uid. If the
929 user is found, set deliver_home to the home directory, and also set
930 local_user_{uid,gid}. */
931
932 if (r->check_local_user)
933 {
934 DEBUG(D_route) debug_printf("checking for local user\n");
935 if (!route_finduser(addr->local_part, pw, NULL))
936 {
937 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
938 r->name, addr->local_part);
939 return SKIP;
940 }
941 deliver_home = string_copy(US (*pw)->pw_dir);
942 local_user_gid = (*pw)->pw_gid;
943 local_user_uid = (*pw)->pw_uid;
944 }
945
946 /* Set (or override in the case of check_local_user) the home directory if
947 router_home_directory is set. This is done here so that it overrides $home from
948 check_local_user before any subsequent expansions are done. Otherwise, $home
949 could mean different things for different options, which would be extremely
950 confusing. */
951
952 if (r->router_home_directory)
953 {
954 uschar *router_home = expand_string(r->router_home_directory);
955 if (!router_home)
956 {
957 if (!f.expand_string_forcedfail)
958 {
959 *perror = string_sprintf("failed to expand \"%s\" for "
960 "router_home_directory: %s", r->router_home_directory,
961 expand_string_message);
962 return DEFER;
963 }
964 }
965 else
966 {
967 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
968 deliver_home = router_home;
969 }
970 }
971
972 /* Skip if the sender condition is not met. We leave this one till after the
973 local user check so that $home is set - enabling the possibility of letting
974 individual recipients specify lists of acceptable/unacceptable senders. */
975
976 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
977 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
978 return rc;
979
980 /* This is the point at which we print out the router's debugging string if it
981 is set. We wait till here so as to have $home available for local users (and
982 anyway, we don't want too much stuff for skipped routers). */
983
984 debug_print_string(r->debug_string);
985
986 /* Perform file existence tests. */
987
988 if ((rc = check_files(r->require_files, perror)) != OK)
989 {
990 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
991 (rc == SKIP)? "skipped" : "deferred");
992 return rc;
993 }
994
995 /* Now the general condition test. */
996
997 if (r->condition)
998 {
999 DEBUG(D_route) debug_printf("checking \"condition\" \"%.80s\"...\n", r->condition);
1000 if (!expand_check_condition(r->condition, r->name, US"router"))
1001 {
1002 if (f.search_find_defer)
1003 {
1004 *perror = US"condition check lookup defer";
1005 DEBUG(D_route) debug_printf("%s\n", *perror);
1006 return DEFER;
1007 }
1008 DEBUG(D_route)
1009 debug_printf("%s router skipped: condition failure\n", r->name);
1010 return SKIP;
1011 }
1012 }
1013
1014 #ifdef EXPERIMENTAL_BRIGHTMAIL
1015 /* check if a specific Brightmail AntiSpam rule fired on the message */
1016 if (r->bmi_rule)
1017 {
1018 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1019 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0)
1020 { /* none of the rules fired */
1021 DEBUG(D_route)
1022 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1023 return SKIP;
1024 }
1025 }
1026
1027 /* check if message should not be delivered */
1028 if (r->bmi_dont_deliver && bmi_deliver == 1)
1029 {
1030 DEBUG(D_route)
1031 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1032 return SKIP;
1033 }
1034
1035 /* check if message should go to an alternate location */
1036 if ( r->bmi_deliver_alternate
1037 && (bmi_deliver == 0 || !bmi_alt_location)
1038 )
1039 {
1040 DEBUG(D_route)
1041 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1042 return SKIP;
1043 }
1044
1045 /* check if message should go to default location */
1046 if ( r->bmi_deliver_default
1047 && (bmi_deliver == 0 || bmi_alt_location)
1048 )
1049 {
1050 DEBUG(D_route)
1051 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1052 return SKIP;
1053 }
1054 #endif
1055
1056 /* All the checks passed. */
1057
1058 return OK;
1059 }
1060
1061
1062
1063
1064 /*************************************************
1065 * Find a local user *
1066 *************************************************/
1067
1068 /* Try several times (if configured) to find a local user, in case delays in
1069 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1070 doesn't have some kind of indication as to why it has failed. If the string
1071 given consists entirely of digits, and the third argument is not NULL, assume
1072 the string is the numerical value of the uid. Otherwise it is looked up using
1073 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1074 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1075
1076 Because this may be called several times in succession for the same user for
1077 different routers, cache the result of the previous getpwnam call so that it
1078 can be re-used. Note that we can't just copy the structure, as the store it
1079 points to can get trashed.
1080
1081 Arguments:
1082 s the login name or textual form of the numerical uid of the user
1083 pw if not NULL, return the result of getpwnam here, or set NULL
1084 if no call to getpwnam is made (s numeric, return_uid != NULL)
1085 return_uid if not NULL, return the uid via this address
1086
1087 Returns: TRUE if s is numerical or was looked up successfully
1088
1089 */
1090
1091 static struct passwd pwcopy;
1092 static struct passwd *lastpw = NULL;
1093 static uschar lastname[48] = { 0 };
1094 static uschar lastdir[128];
1095 static uschar lastgecos[128];
1096 static uschar lastshell[128];
1097
1098 BOOL
1099 route_finduser(const uschar *s, struct passwd **pw, uid_t *return_uid)
1100 {
1101 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1102
1103 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1104 cache_set? "using cached result" : "cache not available");
1105
1106 if (!cache_set)
1107 {
1108 int i = 0;
1109
1110 if (return_uid && (isdigit(*s) || *s == '-') &&
1111 s[Ustrspn(s+1, "0123456789")+1] == 0)
1112 {
1113 *return_uid = (uid_t)Uatoi(s);
1114 if (pw) *pw = NULL;
1115 return TRUE;
1116 }
1117
1118 (void)string_format(lastname, sizeof(lastname), "%s", s);
1119
1120 /* Force failure if string length is greater than given maximum */
1121
1122 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1123 {
1124 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1125 "length of %s is greater than %d\n", lastname, max_username_length);
1126 lastpw = NULL;
1127 }
1128
1129 /* Try a few times if so configured; this handles delays in NIS etc. */
1130
1131 else for (;;)
1132 {
1133 errno = 0;
1134 if ((lastpw = getpwnam(CS s))) break;
1135 if (++i > finduser_retries) break;
1136 sleep(1);
1137 }
1138
1139 if (lastpw)
1140 {
1141 pwcopy.pw_uid = lastpw->pw_uid;
1142 pwcopy.pw_gid = lastpw->pw_gid;
1143 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1144 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1145 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1146 pwcopy.pw_name = CS lastname;
1147 pwcopy.pw_dir = CS lastdir;
1148 pwcopy.pw_gecos = CS lastgecos;
1149 pwcopy.pw_shell = CS lastshell;
1150 lastpw = &pwcopy;
1151 }
1152
1153 else DEBUG(D_uid) if (errno != 0)
1154 debug_printf("getpwnam(%s) failed: %s\n", s, strerror(errno));
1155 }
1156
1157 if (!lastpw)
1158 {
1159 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1160 return FALSE;
1161 }
1162
1163 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1164 lastpw->pw_uid, lastpw->pw_gid);
1165
1166 if (return_uid) *return_uid = lastpw->pw_uid;
1167 if (pw) *pw = lastpw;
1168
1169 return TRUE;
1170 }
1171
1172
1173
1174
1175 /*************************************************
1176 * Find a local group *
1177 *************************************************/
1178
1179 /* Try several times (if configured) to find a local group, in case delays in
1180 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1181 doesn't have some kind of indication as to why it has failed.
1182
1183 Arguments:
1184 s the group name or textual form of the numerical gid
1185 return_gid return the gid via this address
1186
1187 Returns: TRUE if the group was found; FALSE otherwise
1188
1189 */
1190
1191 BOOL
1192 route_findgroup(uschar *s, gid_t *return_gid)
1193 {
1194 int i = 0;
1195 struct group *gr;
1196
1197 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1198 {
1199 *return_gid = (gid_t)Uatoi(s);
1200 return TRUE;
1201 }
1202
1203 for (;;)
1204 {
1205 if ((gr = getgrnam(CS s)))
1206 {
1207 *return_gid = gr->gr_gid;
1208 return TRUE;
1209 }
1210 if (++i > finduser_retries) break;
1211 sleep(1);
1212 }
1213
1214 return FALSE;
1215 }
1216
1217
1218
1219
1220 /*************************************************
1221 * Find user by expanding string *
1222 *************************************************/
1223
1224 /* Expands a string, and then looks up the result in the passwd file.
1225
1226 Arguments:
1227 string the string to be expanded, yielding a login name or a numerical
1228 uid value (to be passed to route_finduser())
1229 driver_name caller name for panic error message (only)
1230 driver_type caller type for panic error message (only)
1231 pw return passwd entry via this pointer
1232 uid return uid via this pointer
1233 errmsg where to point a message on failure
1234
1235 Returns: TRUE if user found, FALSE otherwise
1236 */
1237
1238 BOOL
1239 route_find_expanded_user(uschar *string, uschar *driver_name,
1240 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1241 {
1242 uschar *user = expand_string(string);
1243
1244 if (!user)
1245 {
1246 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1247 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1248 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1249 return FALSE;
1250 }
1251
1252 if (route_finduser(user, pw, uid)) return TRUE;
1253
1254 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1255 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1256 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1257 return FALSE;
1258 }
1259
1260
1261
1262 /*************************************************
1263 * Find group by expanding string *
1264 *************************************************/
1265
1266 /* Expands a string and then looks up the result in the group file.
1267
1268 Arguments:
1269 string the string to be expanded, yielding a group name or a numerical
1270 gid value (to be passed to route_findgroup())
1271 driver_name caller name for panic error message (only)
1272 driver_type caller type for panic error message (only)
1273 gid return gid via this pointer
1274 errmsg return error message via this pointer
1275
1276 Returns: TRUE if found group, FALSE otherwise
1277 */
1278
1279 BOOL
1280 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1281 gid_t *gid, uschar **errmsg)
1282 {
1283 BOOL yield = TRUE;
1284 uschar *group = expand_string(string);
1285
1286 if (!group)
1287 {
1288 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1289 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1290 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1291 return FALSE;
1292 }
1293
1294 if (!route_findgroup(group, gid))
1295 {
1296 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1297 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1298 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1299 yield = FALSE;
1300 }
1301
1302 return yield;
1303 }
1304
1305
1306
1307 /*************************************************
1308 * Handle an unseen routing *
1309 *************************************************/
1310
1311 /* This function is called when an address is routed by a router with "unseen"
1312 set. It must make a clone of the address, for handling by subsequent drivers.
1313 The clone is set to start routing at the next router.
1314
1315 The original address must be replaced by an invented "parent" which has the
1316 routed address plus the clone as its children. This is necessary in case the
1317 address is at the top level - we don't want to mark it complete until both
1318 deliveries have been done.
1319
1320 A new unique field must be made, so that the record of the delivery isn't a
1321 record of the original address, and checking for already delivered has
1322 therefore to be done here. If the delivery has happened, then take the base
1323 address off whichever delivery queue it is on - it will always be the top item.
1324
1325 Arguments:
1326 name router name
1327 addr address that was routed
1328 paddr_local chain of local-delivery addresses
1329 paddr_remote chain of remote-delivery addresses
1330 addr_new chain for newly created addresses
1331
1332 Returns: nothing
1333 */
1334
1335 static void
1336 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1337 address_item **paddr_remote, address_item **addr_new)
1338 {
1339 address_item *parent = deliver_make_addr(addr->address, TRUE);
1340 address_item *new = deliver_make_addr(addr->address, TRUE);
1341
1342 /* The invented parent is a copy that replaces the original; note that
1343 this copies its parent pointer. It has two children, and its errors_address is
1344 from the original address' parent, if present, otherwise unset. */
1345
1346 *parent = *addr;
1347 parent->child_count = 2;
1348 parent->prop.errors_address =
1349 addr->parent ? addr->parent->prop.errors_address : NULL;
1350
1351 /* The routed address gets a new parent. */
1352
1353 addr->parent = parent;
1354
1355 /* The clone has this parent too. Set its errors address from the parent. This
1356 was set from the original parent (or to NULL) - see above. We do NOT want to
1357 take the errors address from the unseen router. */
1358
1359 new->parent = parent;
1360 new->prop.errors_address = parent->prop.errors_address;
1361
1362 /* Copy the propagated flags and address_data from the original. */
1363
1364 new->prop.ignore_error = addr->prop.ignore_error;
1365 new->prop.address_data = addr->prop.address_data;
1366 new->prop.variables = NULL;
1367 tree_dup((tree_node **)&new->prop.variables, addr->prop.variables);
1368 new->dsn_flags = addr->dsn_flags;
1369 new->dsn_orcpt = addr->dsn_orcpt;
1370
1371
1372 /* As it has turned out, we haven't set headers_add or headers_remove for the
1373 * clone. Thinking about it, it isn't entirely clear whether they should be
1374 * copied from the original parent, like errors_address, or taken from the
1375 * unseen router, like address_data and the flags. Until somebody brings this
1376 * up, I propose to leave the code as it is.
1377 */
1378
1379
1380 /* Set the cloned address to start at the next router, and put it onto the
1381 chain of new addresses. */
1382
1383 new->start_router = addr->router->next;
1384 new->next = *addr_new;
1385 *addr_new = new;
1386
1387 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1388
1389 /* Make a new unique field, to distinguish from the normal one. */
1390
1391 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1392
1393 /* If the address has been routed to a transport, see if it was previously
1394 delivered. If so, we take it off the relevant queue so that it isn't delivered
1395 again. Otherwise, it was an alias or something, and the addresses it generated
1396 are handled in the normal way. */
1397
1398 if (addr->transport && tree_search(tree_nonrecipients, addr->unique))
1399 {
1400 DEBUG(D_route)
1401 debug_printf("\"unseen\" delivery previously done - discarded\n");
1402 parent->child_count--;
1403 if (*paddr_remote == addr) *paddr_remote = addr->next;
1404 if (*paddr_local == addr) *paddr_local = addr->next;
1405 }
1406 }
1407
1408
1409
1410 /************************************************/
1411 /* Add router-assigned variables
1412 Return OK/DEFER/FAIL/PASS */
1413
1414 static int
1415 set_router_vars(address_item * addr, const router_instance * r)
1416 {
1417 const uschar * varlist = r->set;
1418 tree_node ** root = (tree_node **) &addr->prop.variables;
1419 int sep = 0;
1420
1421 if (!varlist) return OK;
1422
1423 /* Walk the varlist, creating variables */
1424
1425 for (uschar * ele; (ele = string_nextinlist(&varlist, &sep, NULL, 0)); )
1426 {
1427 const uschar * assignment = ele;
1428 int esep = '=';
1429 uschar * name = string_nextinlist(&assignment, &esep, NULL, 0);
1430 uschar * val;
1431 tree_node * node;
1432
1433 /* Variable name must exist and start "r_". */
1434
1435 if (!name || name[0] != 'r' || name[1] != '_' || !name[2])
1436 return FAIL;
1437 name += 2;
1438
1439 if (!(val = expand_string(US assignment)))
1440 if (f.expand_string_forcedfail)
1441 {
1442 int yield;
1443 BOOL more;
1444 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1445 "(router variable): decline action taken\n", ele);
1446
1447 /* Expand "more" if necessary; DEFER => an expansion failed */
1448
1449 yield = exp_bool(addr, US"router", r->name, D_route,
1450 US"more", r->more, r->expand_more, &more);
1451 if (yield != OK) return yield;
1452
1453 if (!more)
1454 {
1455 DEBUG(D_route)
1456 debug_printf("\"more\"=false: skipping remaining routers\n");
1457 router_name = NULL;
1458 r = NULL;
1459 return FAIL;
1460 }
1461 return PASS;
1462 }
1463 else
1464 {
1465 addr->message = string_sprintf("expansion of \"%s\" failed "
1466 "in %s router: %s", ele, r->name, expand_string_message);
1467 return DEFER;
1468 }
1469
1470 if (!(node = tree_search(*root, name)))
1471 {
1472 node = store_get(sizeof(tree_node) + Ustrlen(name));
1473 Ustrcpy(node->name, name);
1474 (void)tree_insertnode(root, node);
1475 }
1476 node->data.ptr = US val;
1477 DEBUG(D_route) debug_printf("set r_%s = '%s'\n", name, val);
1478 }
1479 return OK;
1480 }
1481
1482
1483 /*************************************************
1484 * Route one address *
1485 *************************************************/
1486
1487 /* This function is passed in one address item, for processing by the routers.
1488 The verify flag is set if this is being called for verification rather than
1489 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1490
1491 Arguments:
1492 addr address to route
1493 paddr_local chain of local-delivery addresses
1494 paddr_remote chain of remote-delivery addresses
1495 addr_new chain for newly created addresses
1496 addr_succeed chain for completed addresses
1497 verify v_none if not verifying
1498 v_sender if verifying a sender address
1499 v_recipient if verifying a recipient address
1500 v_expn if processing an EXPN address
1501
1502 Returns: OK => address successfully routed
1503 DISCARD => address was discarded
1504 FAIL => address could not be routed
1505 DEFER => some temporary problem
1506 ERROR => some major internal or configuration failure
1507 */
1508
1509 int
1510 route_address(address_item *addr, address_item **paddr_local,
1511 address_item **paddr_remote, address_item **addr_new,
1512 address_item **addr_succeed, int verify)
1513 {
1514 int yield = OK;
1515 BOOL unseen;
1516 router_instance *r, *nextr;
1517 const uschar *old_domain = addr->domain;
1518
1519 HDEBUG(D_route)
1520 {
1521 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1522 debug_printf("routing %s\n", addr->address);
1523 }
1524
1525 /* Loop through all router instances until a router succeeds, fails, defers, or
1526 encounters an error. If the address has start_router set, we begin from there
1527 instead of at the first router. */
1528
1529 for (r = addr->start_router ? addr->start_router : routers; r; r = nextr)
1530 {
1531 uschar *error;
1532 struct passwd *pw = NULL;
1533 struct passwd pwcopy;
1534 BOOL loop_detected = FALSE;
1535 BOOL more;
1536 int loopcount = 0;
1537 int rc;
1538
1539 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1540
1541 /* Reset any search error message from the previous router. */
1542
1543 search_error_message = NULL;
1544
1545 /* There are some weird cases where logging is disabled */
1546
1547 f.disable_logging = r->disable_logging;
1548
1549 /* Record the last router to handle the address, and set the default
1550 next router. */
1551
1552 addr->router = r;
1553 nextr = r->next;
1554
1555 /* Loop protection: If this address has an ancestor with the same address,
1556 and that ancestor was routed by this router, we skip this router. This
1557 prevents a variety of looping states when a new address is created by
1558 redirection or by the use of "unseen" on a router.
1559
1560 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1561 by this router, even if it was different to the current address.
1562
1563 Just in case someone does put it into a loop (possible with redirection
1564 continually adding to an address, for example), put a long stop counter on
1565 the number of parents. */
1566
1567 for (address_item * parent = addr->parent; parent; parent = parent->parent)
1568 {
1569 if (parent->router == r)
1570 {
1571 BOOL break_loop = !r->repeat_use;
1572
1573 /* When repeat_use is set, first check the active addresses caselessly.
1574 If they match, we have to do a further caseful check of the local parts
1575 when caseful_local_part is set. This is assumed to be rare, which is why
1576 the code is written this way. */
1577
1578 if (!break_loop)
1579 {
1580 break_loop = strcmpic(parent->address, addr->address) == 0;
1581 if (break_loop && r->caseful_local_part)
1582 break_loop = Ustrncmp(parent->address, addr->address,
1583 Ustrrchr(addr->address, '@') - addr->address) == 0;
1584 }
1585
1586 if (break_loop)
1587 {
1588 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1589 r->name, parent->address);
1590 loop_detected = TRUE;
1591 break;
1592 }
1593 }
1594
1595 /* Continue with parents, limiting the size of the dynasty. */
1596
1597 if (loopcount++ > 100)
1598 {
1599 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1600 yield = DEFER;
1601 goto ROUTE_EXIT;
1602 }
1603 }
1604
1605 if (loop_detected) continue;
1606
1607 /* Default no affixes and select whether to use a caseful or caseless local
1608 part in this router. */
1609
1610 addr->prefix = addr->suffix = NULL;
1611 addr->local_part = r->caseful_local_part?
1612 addr->cc_local_part : addr->lc_local_part;
1613
1614 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1615 addr->domain);
1616
1617 /* Handle any configured prefix by replacing the local_part address,
1618 and setting the prefix. Skip the router if the prefix doesn't match,
1619 unless the prefix is optional. */
1620
1621 if (r->prefix)
1622 {
1623 int plen = route_check_prefix(addr->local_part, r->prefix);
1624 if (plen > 0)
1625 {
1626 addr->prefix = string_copyn(addr->local_part, plen);
1627 addr->local_part += plen;
1628 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1629 }
1630 else if (!r->prefix_optional)
1631 {
1632 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1633 r->name);
1634 continue;
1635 }
1636 }
1637
1638 /* Handle any configured suffix likewise. */
1639
1640 if (r->suffix)
1641 {
1642 int slen = route_check_suffix(addr->local_part, r->suffix);
1643 if (slen > 0)
1644 {
1645 int lplen = Ustrlen(addr->local_part) - slen;
1646 addr->suffix = addr->local_part + lplen;
1647 addr->local_part = string_copyn(addr->local_part, lplen);
1648 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1649 }
1650 else if (!r->suffix_optional)
1651 {
1652 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1653 r->name);
1654 continue;
1655 }
1656 }
1657
1658 /* Set the expansion variables now that we have the affixes and the case of
1659 the local part sorted. */
1660
1661 router_name = r->name;
1662 deliver_set_expansions(addr);
1663
1664 /* For convenience, the pre-router checks are in a separate function, which
1665 returns OK, SKIP, FAIL, or DEFER. */
1666
1667 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1668 {
1669 router_name = NULL;
1670 if (rc == SKIP) continue;
1671 addr->message = error;
1672 yield = rc;
1673 goto ROUTE_EXIT;
1674 }
1675
1676 /* All pre-conditions have been met. Reset any search error message from
1677 pre-condition tests. These can arise in negated tests where the failure of
1678 the lookup leads to a TRUE pre-condition. */
1679
1680 search_error_message = NULL;
1681
1682 /* Add any variable-settings that are on the router, to the set on the
1683 addr. Expansion is done here and not later when the addr is used. There may
1684 be multiple settings, gathered during readconf; this code gathers them during
1685 router traversal. On the addr string they are held as a variable tree, so
1686 as to maintain the post-expansion taints separate. */
1687
1688 if ((yield = set_router_vars(addr, r)) != OK)
1689 if (yield == PASS)
1690 continue; /* with next router */
1691 else
1692 goto ROUTE_EXIT;
1693
1694 #ifdef notdef
1695 if (r->set)
1696 {
1697 const uschar * list = r->set;
1698 int sep = 0;
1699 for (uschar * ele; (ele = string_nextinlist(&list, &sep, NULL, 0)); )
1700 {
1701 uschar * ee;
1702 if (!(ee = expand_string(ele)))
1703 if (f.expand_string_forcedfail)
1704 {
1705 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1706 "(router variable): decline action taken\n", ele);
1707
1708 /* Expand "more" if necessary; DEFER => an expansion failed */
1709
1710 yield = exp_bool(addr, US"router", r->name, D_route,
1711 US"more", r->more, r->expand_more, &more);
1712 if (yield != OK) goto ROUTE_EXIT;
1713
1714 if (!more)
1715 {
1716 DEBUG(D_route)
1717 debug_printf("\"more\"=false: skipping remaining routers\n");
1718 router_name = NULL;
1719 r = NULL;
1720 break;
1721 }
1722 else continue; /* With next router */
1723 }
1724 else
1725 {
1726 addr->message = string_sprintf("expansion of \"%s\" failed "
1727 "in %s router: %s", ele, r->name, expand_string_message);
1728 yield = DEFER;
1729 goto ROUTE_EXIT;
1730 }
1731
1732 addr->prop.set = string_append_listele(addr->prop.set, ':', ee);
1733 }
1734 }
1735 #endif
1736
1737 /* Finally, expand the address_data field in the router. Forced failure
1738 behaves as if the router declined. Any other failure is more serious. On
1739 success, the string is attached to the address for all subsequent processing.
1740 */
1741
1742 if (r->address_data)
1743 {
1744 DEBUG(D_route) debug_printf("processing address_data\n");
1745 if (!(deliver_address_data = expand_string(r->address_data)))
1746 {
1747 if (f.expand_string_forcedfail)
1748 {
1749 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1750 "(address_data): decline action taken\n", r->address_data);
1751
1752 /* Expand "more" if necessary; DEFER => an expansion failed */
1753
1754 yield = exp_bool(addr, US"router", r->name, D_route,
1755 US"more", r->more, r->expand_more, &more);
1756 if (yield != OK) goto ROUTE_EXIT;
1757
1758 if (!more)
1759 {
1760 DEBUG(D_route)
1761 debug_printf("\"more\"=false: skipping remaining routers\n");
1762 router_name = NULL;
1763 r = NULL;
1764 break;
1765 }
1766 else continue; /* With next router */
1767 }
1768
1769 else
1770 {
1771 addr->message = string_sprintf("expansion of \"%s\" failed "
1772 "in %s router: %s", r->address_data, r->name, expand_string_message);
1773 yield = DEFER;
1774 goto ROUTE_EXIT;
1775 }
1776 }
1777 addr->prop.address_data = deliver_address_data;
1778 }
1779
1780 /* We are finally cleared for take-off with this router. Clear the the flag
1781 that records that a local host was removed from a routed host list. Make a
1782 copy of relevant fields in the password information from check_local_user,
1783 because it will be overwritten if check_local_user is invoked again while
1784 verifying an errors_address setting. */
1785
1786 clearflag(addr, af_local_host_removed);
1787
1788 if (pw)
1789 {
1790 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1791 pwcopy.pw_uid = pw->pw_uid;
1792 pwcopy.pw_gid = pw->pw_gid;
1793 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1794 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1795 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1796 pw = &pwcopy;
1797 }
1798
1799 /* If this should be the last hop for DSN flag the addr. */
1800
1801 if (r->dsn_lasthop && !(addr->dsn_flags & rf_dsnlasthop))
1802 {
1803 addr->dsn_flags |= rf_dsnlasthop;
1804 HDEBUG(D_route) debug_printf("DSN: last hop for %s\n", addr->address);
1805 }
1806
1807 /* Run the router, and handle the consequences. */
1808
1809 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1810
1811 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1812 addr_new, addr_succeed);
1813
1814 router_name = NULL;
1815
1816 if (yield == FAIL)
1817 {
1818 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1819 goto ROUTE_EXIT;
1820 }
1821
1822 /* If succeeded while verifying but fail_verify is set, convert into
1823 a failure, and take it off the local or remote delivery list. */
1824
1825 if (((verify == v_sender && r->fail_verify_sender) ||
1826 (verify == v_recipient && r->fail_verify_recipient)) &&
1827 (yield == OK || yield == PASS))
1828 {
1829 addr->message = string_sprintf("%s router forced verify failure", r->name);
1830 if (*paddr_remote == addr) *paddr_remote = addr->next;
1831 if (*paddr_local == addr) *paddr_local = addr->next;
1832 yield = FAIL;
1833 goto ROUTE_EXIT;
1834 }
1835
1836 /* PASS and DECLINE are the only two cases where the loop continues. For all
1837 other returns, we break the loop and handle the result below. */
1838
1839 if (yield != PASS && yield != DECLINE) break;
1840
1841 HDEBUG(D_route)
1842 {
1843 debug_printf("%s router %s for %s\n", r->name,
1844 (yield == PASS)? "passed" : "declined", addr->address);
1845 if (Ustrcmp(old_domain, addr->domain) != 0)
1846 debug_printf("domain %s rewritten\n", old_domain);
1847 }
1848
1849 /* PASS always continues to another router; DECLINE does so if "more"
1850 is true. Initialization insists that pass_router is always a following
1851 router. Otherwise, break the loop as if at the end of the routers. */
1852
1853 if (yield == PASS)
1854 {
1855 if (r->pass_router != NULL) nextr = r->pass_router;
1856 }
1857 else
1858 {
1859 /* Expand "more" if necessary */
1860
1861 yield = exp_bool(addr, US"router", r->name, D_route,
1862 US"more", r->more, r->expand_more, &more);
1863 if (yield != OK) goto ROUTE_EXIT;
1864
1865 if (!more)
1866 {
1867 HDEBUG(D_route)
1868 debug_printf("\"more\" is false: skipping remaining routers\n");
1869 r = NULL;
1870 break;
1871 }
1872 }
1873 } /* Loop for all routers */
1874
1875 /* On exit from the routers loop, if r == NULL we have run out of routers,
1876 either genuinely, or as a result of no_more. Otherwise, the loop ended
1877 prematurely, either because a router succeeded, or because of some special
1878 router response. Note that FAIL errors and errors detected before actually
1879 running a router go direct to ROUTE_EXIT from code above. */
1880
1881 if (!r)
1882 {
1883 HDEBUG(D_route) debug_printf("no more routers\n");
1884 if (!addr->message)
1885 {
1886 uschar *message = US"Unrouteable address";
1887 if (addr->router && addr->router->cannot_route_message)
1888 {
1889 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1890 if (!expmessage)
1891 {
1892 if (!f.expand_string_forcedfail)
1893 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1894 "cannot_route_message in %s router: %s", addr->router->name,
1895 expand_string_message);
1896 }
1897 else message = expmessage;
1898 }
1899 addr->user_message = addr->message = message;
1900 }
1901 addr->router = NULL; /* For logging */
1902 yield = FAIL;
1903 goto ROUTE_EXIT;
1904 }
1905
1906 if (yield == DEFER)
1907 {
1908 HDEBUG(D_route)
1909 {
1910 debug_printf("%s router: defer for %s\n", r->name, addr->address);
1911 debug_printf(" message: %s\n", (addr->message == NULL)?
1912 US"<none>" : addr->message);
1913 }
1914 goto ROUTE_EXIT;
1915 }
1916
1917 if (yield == DISCARD) goto ROUTE_EXIT;
1918
1919 /* The yield must be either OK or REROUTED. */
1920
1921 if (yield != OK && yield != REROUTED)
1922 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1923 r->name, yield);
1924
1925 /* If the yield was REROUTED, the router put a child address on the new chain
1926 as a result of a domain change of some sort (widening, typically). */
1927
1928 if (yield == REROUTED)
1929 {
1930 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1931 yield = OK;
1932 goto ROUTE_EXIT;
1933 }
1934
1935 /* The only remaining possibility is that the router succeeded. If the
1936 translate_ip_address options is set and host addresses were associated with the
1937 address, run them through the translation. This feature is for weird and
1938 wonderful situations (the amateur packet radio people need it) or very broken
1939 networking, so it is included in the binary only if requested. */
1940
1941 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1942
1943 if (r->translate_ip_address)
1944 {
1945 int rc;
1946 int old_pool = store_pool;
1947 for (host_item * h = addr->host_list; h; h = h->next)
1948 {
1949 uschar *newaddress;
1950 uschar *oldaddress, *oldname;
1951
1952 if (!h->address) continue;
1953
1954 deliver_host_address = h->address;
1955 newaddress = expand_string(r->translate_ip_address);
1956 deliver_host_address = NULL;
1957
1958 if (!newaddress)
1959 {
1960 if (f.expand_string_forcedfail) continue;
1961 addr->basic_errno = ERRNO_EXPANDFAIL;
1962 addr->message = string_sprintf("translate_ip_address expansion "
1963 "failed: %s", expand_string_message);
1964 yield = DEFER;
1965 goto ROUTE_EXIT;
1966 }
1967
1968 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1969 h->name, h->address, newaddress);
1970 if (string_is_ip_address(newaddress, NULL) != 0)
1971 {
1972 h->address = newaddress;
1973 continue;
1974 }
1975
1976 oldname = h->name;
1977 oldaddress = h->address;
1978 h->name = newaddress;
1979 h->address = NULL;
1980 h->mx = MX_NONE;
1981
1982 store_pool = POOL_PERM;
1983 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1984 store_pool = old_pool;
1985
1986 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1987 {
1988 addr->basic_errno = ERRNO_UNKNOWNHOST;
1989 addr->message = string_sprintf("host %s not found when "
1990 "translating %s [%s]", h->name, oldname, oldaddress);
1991 yield = DEFER;
1992 goto ROUTE_EXIT;
1993 }
1994 }
1995 }
1996 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
1997
1998 /* See if this is an unseen routing; first expand the option if necessary.
1999 DEFER can be given if the expansion fails */
2000
2001 yield = exp_bool(addr, US"router", r->name, D_route,
2002 US"unseen", r->unseen, r->expand_unseen, &unseen);
2003 if (yield != OK) goto ROUTE_EXIT;
2004
2005 /* Debugging output recording a successful routing */
2006
2007 HDEBUG(D_route) debug_printf("routed by %s router%s\n", r->name,
2008 unseen? " (unseen)" : "");
2009
2010 DEBUG(D_route)
2011 {
2012 debug_printf(" envelope to: %s\n", addr->address);
2013 debug_printf(" transport: %s\n", addr->transport
2014 ? addr->transport->name : US"<none>");
2015
2016 if (addr->prop.errors_address)
2017 debug_printf(" errors to %s\n", addr->prop.errors_address);
2018
2019 for (host_item * h = addr->host_list; h; h = h->next)
2020 {
2021 debug_printf(" host %s", h->name);
2022 if (h->address) debug_printf(" [%s]", h->address);
2023 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
2024 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
2025 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
2026 if (h->dnssec != DS_UNK) debug_printf(" dnssec=%s", h->dnssec==DS_YES ? "yes" : "no");
2027 debug_printf("\n");
2028 }
2029 }
2030
2031 /* Clear any temporary error message set by a router that declined, and handle
2032 the "unseen" option (ignore if there are no further routers). */
2033
2034 addr->message = NULL;
2035 if (unseen && r->next)
2036 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
2037
2038 /* Unset the address expansions, and return the final result. */
2039
2040 ROUTE_EXIT:
2041 if (yield == DEFER && addr->message)
2042 addr->message = expand_hide_passwords(addr->message);
2043
2044 deliver_set_expansions(NULL);
2045 router_name = NULL;
2046 f.disable_logging = FALSE;
2047 return yield;
2048 }
2049
2050 #endif /*!MACRO_PREDEF*/
2051 /* End of route.c */