324de2ab8800c0bcb91dcce5789473cec67f28ea
[exim.git] / src / src / route.c
1 /* $Cambridge: exim/src/src/route.c,v 1.14 2009/11/16 19:50:37 nm4 Exp $ */
2
3 /*************************************************
4 * Exim - an Internet mail transport agent *
5 *************************************************/
6
7 /* Copyright (c) University of Cambridge 1995 - 2009 */
8 /* See the file NOTICE for conditions of use and distribution. */
9
10 /* Functions concerned with routing, and the list of generic router options. */
11
12
13 #include "exim.h"
14
15
16
17 /* Generic options for routers, all of which live inside router_instance
18 data blocks and which therefore have the opt_public flag set. */
19
20 optionlist optionlist_routers[] = {
21 { "*expand_group", opt_stringptr | opt_hidden | opt_public,
22 (void *)(offsetof(router_instance, expand_gid)) },
23 { "*expand_more", opt_stringptr | opt_hidden | opt_public,
24 (void *)(offsetof(router_instance, expand_more)) },
25 { "*expand_unseen", opt_stringptr | opt_hidden | opt_public,
26 (void *)(offsetof(router_instance, expand_unseen)) },
27 { "*expand_user", opt_stringptr | opt_hidden | opt_public,
28 (void *)(offsetof(router_instance, expand_uid)) },
29 { "*set_group", opt_bool | opt_hidden | opt_public,
30 (void *)(offsetof(router_instance, gid_set)) },
31 { "*set_user", opt_bool | opt_hidden | opt_public,
32 (void *)(offsetof(router_instance, uid_set)) },
33 { "address_data", opt_stringptr|opt_public,
34 (void *)(offsetof(router_instance, address_data)) },
35 { "address_test", opt_bool|opt_public,
36 (void *)(offsetof(router_instance, address_test)) },
37 #ifdef EXPERIMENTAL_BRIGHTMAIL
38 { "bmi_deliver_alternate", opt_bool | opt_public,
39 (void *)(offsetof(router_instance, bmi_deliver_alternate)) },
40 { "bmi_deliver_default", opt_bool | opt_public,
41 (void *)(offsetof(router_instance, bmi_deliver_default)) },
42 { "bmi_dont_deliver", opt_bool | opt_public,
43 (void *)(offsetof(router_instance, bmi_dont_deliver)) },
44 { "bmi_rule", opt_stringptr|opt_public,
45 (void *)(offsetof(router_instance, bmi_rule)) },
46 #endif
47 { "cannot_route_message", opt_stringptr | opt_public,
48 (void *)(offsetof(router_instance, cannot_route_message)) },
49 { "caseful_local_part", opt_bool | opt_public,
50 (void *)(offsetof(router_instance, caseful_local_part)) },
51 { "check_local_user", opt_bool | opt_public,
52 (void *)(offsetof(router_instance, check_local_user)) },
53 { "condition", opt_stringptr|opt_public,
54 (void *)offsetof(router_instance, condition) },
55 { "debug_print", opt_stringptr | opt_public,
56 (void *)offsetof(router_instance, debug_string) },
57 { "disable_logging", opt_bool | opt_public,
58 (void *)offsetof(router_instance, disable_logging) },
59 { "domains", opt_stringptr|opt_public,
60 (void *)offsetof(router_instance, domains) },
61 { "driver", opt_stringptr|opt_public,
62 (void *)offsetof(router_instance, driver_name) },
63 { "errors_to", opt_stringptr|opt_public,
64 (void *)(offsetof(router_instance, errors_to)) },
65 { "expn", opt_bool|opt_public,
66 (void *)offsetof(router_instance, expn) },
67 { "fail_verify", opt_bool_verify|opt_hidden|opt_public,
68 (void *)offsetof(router_instance, fail_verify_sender) },
69 { "fail_verify_recipient", opt_bool|opt_public,
70 (void *)offsetof(router_instance, fail_verify_recipient) },
71 { "fail_verify_sender", opt_bool|opt_public,
72 (void *)offsetof(router_instance, fail_verify_sender) },
73 { "fallback_hosts", opt_stringptr|opt_public,
74 (void *)offsetof(router_instance, fallback_hosts) },
75 { "group", opt_expand_gid | opt_public,
76 (void *)(offsetof(router_instance, gid)) },
77 { "headers_add", opt_stringptr|opt_public,
78 (void *)offsetof(router_instance, extra_headers) },
79 { "headers_remove", opt_stringptr|opt_public,
80 (void *)offsetof(router_instance, remove_headers) },
81 { "ignore_target_hosts",opt_stringptr|opt_public,
82 (void *)offsetof(router_instance, ignore_target_hosts) },
83 { "initgroups", opt_bool | opt_public,
84 (void *)(offsetof(router_instance, initgroups)) },
85 { "local_part_prefix", opt_stringptr|opt_public,
86 (void *)offsetof(router_instance, prefix) },
87 { "local_part_prefix_optional",opt_bool|opt_public,
88 (void *)offsetof(router_instance, prefix_optional) },
89 { "local_part_suffix", opt_stringptr|opt_public,
90 (void *)offsetof(router_instance, suffix) },
91 { "local_part_suffix_optional",opt_bool|opt_public,
92 (void *)offsetof(router_instance, suffix_optional) },
93 { "local_parts", opt_stringptr|opt_public,
94 (void *)offsetof(router_instance, local_parts) },
95 { "log_as_local", opt_bool|opt_public,
96 (void *)offsetof(router_instance, log_as_local) },
97 { "more", opt_expand_bool|opt_public,
98 (void *)offsetof(router_instance, more) },
99 { "pass_on_timeout", opt_bool|opt_public,
100 (void *)offsetof(router_instance, pass_on_timeout) },
101 { "pass_router", opt_stringptr|opt_public,
102 (void *)offsetof(router_instance, pass_router_name) },
103 { "redirect_router", opt_stringptr|opt_public,
104 (void *)offsetof(router_instance, redirect_router_name) },
105 { "require_files", opt_stringptr|opt_public,
106 (void *)offsetof(router_instance, require_files) },
107 { "retry_use_local_part", opt_bool|opt_public,
108 (void *)offsetof(router_instance, retry_use_local_part) },
109 { "router_home_directory", opt_stringptr|opt_public,
110 (void *)offsetof(router_instance, router_home_directory) },
111 { "self", opt_stringptr|opt_public,
112 (void *)(offsetof(router_instance, self)) },
113 { "senders", opt_stringptr|opt_public,
114 (void *)offsetof(router_instance, senders) },
115 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
116 { "translate_ip_address", opt_stringptr|opt_public,
117 (void *)offsetof(router_instance, translate_ip_address) },
118 #endif
119 { "transport", opt_stringptr|opt_public,
120 (void *)offsetof(router_instance, transport_name) },
121 { "transport_current_directory", opt_stringptr|opt_public,
122 (void *)offsetof(router_instance, current_directory) },
123 { "transport_home_directory", opt_stringptr|opt_public,
124 (void *)offsetof(router_instance, home_directory) },
125 { "unseen", opt_expand_bool|opt_public,
126 (void *)offsetof(router_instance, unseen) },
127 { "user", opt_expand_uid | opt_public,
128 (void *)(offsetof(router_instance, uid)) },
129 { "verify", opt_bool_verify|opt_hidden|opt_public,
130 (void *)offsetof(router_instance, verify_sender) },
131 { "verify_only", opt_bool|opt_public,
132 (void *)offsetof(router_instance, verify_only) },
133 { "verify_recipient", opt_bool|opt_public,
134 (void *)offsetof(router_instance, verify_recipient) },
135 { "verify_sender", opt_bool|opt_public,
136 (void *)offsetof(router_instance, verify_sender) }
137 };
138
139 int optionlist_routers_size = sizeof(optionlist_routers)/sizeof(optionlist);
140
141
142
143 /*************************************************
144 * Set router pointer from name *
145 *************************************************/
146
147 /* This function is used for the redirect_router and pass_router options and
148 called from route_init() below.
149
150 Arguments:
151 r the current router
152 name new router name
153 ptr where to put the pointer
154 after TRUE if router must follow this one
155
156 Returns: nothing.
157 */
158
159 static void
160 set_router(router_instance *r, uschar *name, router_instance **ptr, BOOL after)
161 {
162 BOOL afterthis = FALSE;
163 router_instance *rr;
164
165 for (rr = routers; rr != NULL; rr = rr->next)
166 {
167 if (Ustrcmp(name, rr->name) == 0)
168 {
169 *ptr = rr;
170 break;
171 }
172 if (rr == r) afterthis = TRUE;
173 }
174
175 if (rr == NULL)
176 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
177 "new_router \"%s\" not found for \"%s\" router", name, r->name);
178
179 if (after && !afterthis)
180 log_write(0, LOG_PANIC_DIE|LOG_CONFIG,
181 "new_router \"%s\" does not follow \"%s\" router", name, r->name);
182 }
183
184
185
186 /*************************************************
187 * Initialize router list *
188 *************************************************/
189
190 /* Read the routers section of the configuration file, and set up a chain of
191 router instances according to its contents. Each router has generic options and
192 may also have its own private options. This function is only ever called when
193 routers == NULL. We use generic code in readconf to do the work. It will set
194 values from the configuration file, and then call the driver's initialization
195 function. */
196
197 void
198 route_init(void)
199 {
200 router_instance *r;
201
202 readconf_driver_init(US"router",
203 (driver_instance **)(&routers), /* chain anchor */
204 (driver_info *)routers_available, /* available drivers */
205 sizeof(router_info), /* size of info blocks */
206 &router_defaults, /* default values for generic options */
207 sizeof(router_instance), /* size of instance block */
208 optionlist_routers, /* generic options */
209 optionlist_routers_size);
210
211 for (r = routers; r != NULL; r = r->next)
212 {
213 uschar *s = r->self;
214
215 /* If log_as_local is unset, its overall default is FALSE. (The accept
216 router defaults it to TRUE.) */
217
218 if (r->log_as_local == TRUE_UNSET) r->log_as_local = FALSE;
219
220 /* Check for transport or no transport on certain routers */
221
222 if ((r->info->ri_flags & ri_yestransport) != 0 &&
223 r->transport_name == NULL &&
224 !r->verify_only)
225 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
226 "a transport is required for this router", r->name);
227
228 if ((r->info->ri_flags & ri_notransport) != 0 &&
229 r->transport_name != NULL)
230 log_write(0, LOG_PANIC_DIE|LOG_CONFIG, "%s router:\n "
231 "a transport must not be defined for this router", r->name);
232
233 /* The "self" option needs to be decoded into a code value and possibly a
234 new domain string and a rewrite boolean. */
235
236 if (Ustrcmp(s, "freeze") == 0) r->self_code = self_freeze;
237 else if (Ustrcmp(s, "defer") == 0) r->self_code = self_defer;
238 else if (Ustrcmp(s, "send") == 0) r->self_code = self_send;
239 else if (Ustrcmp(s, "pass") == 0) r->self_code = self_pass;
240 else if (Ustrcmp(s, "fail") == 0) r->self_code = self_fail;
241 else if (Ustrncmp(s, "reroute:", 8) == 0)
242 {
243 s += 8;
244 while (isspace(*s)) s++;
245 if (Ustrncmp(s, "rewrite:", 8) == 0)
246 {
247 r->self_rewrite = TRUE;
248 s += 8;
249 while (isspace(*s)) s++;
250 }
251 r->self = s;
252 r->self_code = self_reroute;
253 }
254
255 else log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s router:\n "
256 "%s is not valid for the self option", r->name, s);
257
258 /* If any router has check_local_user set, default retry_use_local_part
259 TRUE; otherwise its default is FALSE. */
260
261 if (r->retry_use_local_part == TRUE_UNSET)
262 r->retry_use_local_part = r->check_local_user;
263
264 /* Build a host list if fallback hosts is set. */
265
266 host_build_hostlist(&(r->fallback_hostlist), r->fallback_hosts, FALSE);
267
268 /* Check redirect_router and pass_router are valid */
269
270 if (r->redirect_router_name != NULL)
271 set_router(r, r->redirect_router_name, &(r->redirect_router), FALSE);
272
273 if (r->pass_router_name != NULL)
274 set_router(r, r->pass_router_name, &(r->pass_router), TRUE);
275 }
276 }
277
278
279
280 /*************************************************
281 * Tidy up after routing *
282 *************************************************/
283
284 /* Routers are entitled to keep hold of certain resources in their instance
285 blocks so as to save setting them up each time. An example is an open file.
286 Such routers must provide a tidyup entry point which is called when all routing
287 is finished, via this function. */
288
289 void
290 route_tidyup(void)
291 {
292 router_instance *r;
293 for (r = routers; r != NULL; r = r->next)
294 if (r->info->tidyup != NULL) (r->info->tidyup)(r);
295 }
296
297
298
299 /*************************************************
300 * Check local part for prefix *
301 *************************************************/
302
303 /* This function is handed a local part and a list of possible prefixes; if any
304 one matches, return the prefix length. A prefix beginning with '*' is a
305 wildcard.
306
307 Arguments:
308 local_part the local part to check
309 prefixes the list of prefixes
310
311 Returns: length of matching prefix or zero
312 */
313
314 int
315 route_check_prefix(uschar *local_part, uschar *prefixes)
316 {
317 int sep = 0;
318 uschar *prefix;
319 uschar *listptr = prefixes;
320 uschar prebuf[64];
321
322 while ((prefix = string_nextinlist(&listptr, &sep, prebuf, sizeof(prebuf)))
323 != NULL)
324 {
325 int plen = Ustrlen(prefix);
326 if (prefix[0] == '*')
327 {
328 uschar *p;
329 prefix++;
330 for (p = local_part + Ustrlen(local_part) - (--plen);
331 p >= local_part; p--)
332 if (strncmpic(prefix, p, plen) == 0) return plen + p - local_part;
333 }
334 else
335 if (strncmpic(prefix, local_part, plen) == 0) return plen;
336 }
337
338 return 0;
339 }
340
341
342
343 /*************************************************
344 * Check local part for suffix *
345 *************************************************/
346
347 /* This function is handed a local part and a list of possible suffixes;
348 if any one matches, return the suffix length. A suffix ending with '*'
349 is a wildcard.
350
351 Arguments:
352 local_part the local part to check
353 suffixes the list of suffixes
354
355 Returns: length of matching suffix or zero
356 */
357
358 int
359 route_check_suffix(uschar *local_part, uschar *suffixes)
360 {
361 int sep = 0;
362 int alen = Ustrlen(local_part);
363 uschar *suffix;
364 uschar *listptr = suffixes;
365 uschar sufbuf[64];
366
367 while ((suffix = string_nextinlist(&listptr, &sep, sufbuf, sizeof(sufbuf)))
368 != NULL)
369 {
370 int slen = Ustrlen(suffix);
371 if (suffix[slen-1] == '*')
372 {
373 uschar *p, *pend;
374 pend = local_part + alen - (--slen) + 1;
375 for (p = local_part; p < pend; p++)
376 if (strncmpic(suffix, p, slen) == 0) return alen - (p - local_part);
377 }
378 else
379 if (alen > slen && strncmpic(suffix, local_part + alen - slen, slen) == 0)
380 return slen;
381 }
382
383 return 0;
384 }
385
386
387
388
389 /*************************************************
390 * Check local part, domain, or sender *
391 *************************************************/
392
393 /* The checks in check_router_conditions() require similar code, so we use
394 this function to save repetition.
395
396 Arguments:
397 rname router name for error messages
398 type type of check, for error message
399 list domains, local_parts, or senders list
400 anchorptr -> tree for possibly cached items (domains)
401 cache_bits cached bits pointer
402 listtype MCL_DOMAIN for domain check
403 MCL_LOCALPART for local part check
404 MCL_ADDRESS for sender check
405 domloc current domain, current local part, or NULL for sender check
406 ldata where to put lookup data
407 caseless passed on to match_isinlist()
408 perror where to put an error message
409
410 Returns: OK item is in list
411 SKIP item is not in list, router is to be skipped
412 DEFER lookup or other defer
413 */
414
415 static int
416 route_check_dls(uschar *rname, uschar *type, uschar *list, tree_node
417 **anchorptr, unsigned int *cache_bits, int listtype, uschar *domloc,
418 uschar **ldata, BOOL caseless, uschar **perror)
419 {
420 int rc;
421
422 if (list == NULL) return OK; /* Empty list always succeeds */
423
424 DEBUG(D_route) debug_printf("checking %s\n", type);
425
426 /* The domain and local part use the same matching function, whereas sender
427 has its own code. */
428
429 if (domloc != NULL)
430 {
431 rc = match_isinlist(domloc, &list, 0, anchorptr, cache_bits, listtype,
432 caseless, ldata);
433 }
434 else
435 {
436 uschar *address = (sender_address == NULL)? US"" : sender_address;
437 rc = match_address_list(address, TRUE, TRUE, &list, cache_bits, -1, 0,
438 &sender_data);
439 }
440
441 switch(rc)
442 {
443 case OK:
444 return OK;
445
446 case FAIL:
447 *perror = string_sprintf("%s router skipped: %s mismatch", rname, type);
448 DEBUG(D_route) debug_printf("%s\n", *perror);
449 return SKIP;
450
451 default: /* Paranoia, and keeps compilers happy */
452 case DEFER:
453 *perror = string_sprintf("%s check lookup or other defer", type);
454 DEBUG(D_route) debug_printf("%s\n", *perror);
455 return DEFER;
456 }
457 }
458
459
460
461 /*************************************************
462 * Check access by a given uid/gid *
463 *************************************************/
464
465 /* This function checks whether a given uid/gid has access to a given file or
466 directory. It is called only from check_files() below. This is hopefully a
467 cheapish check that does the job most of the time. Exim does *not* rely on this
468 test when actually accessing any file. The test is used when routing to make it
469 possible to take actions such as "if user x can access file y then run this
470 router".
471
472 During routing, Exim is normally running as root, and so the test will work
473 except for NFS non-root mounts. When verifying during message reception, Exim
474 is running as "exim", so the test may not work. This is a limitation of the
475 Exim design.
476
477 Code in check_files() below detects the case when it cannot stat() the file (as
478 root), and in that situation it uses a setuid subprocess in which to run this
479 test.
480
481 Arguments:
482 path the path to check
483 uid the user
484 gid the group
485 bits the bits required in the final component
486
487 Returns: TRUE
488 FALSE errno=EACCES or ENOENT (or others from realpath or stat)
489 */
490
491 static BOOL
492 route_check_access(uschar *path, uid_t uid, gid_t gid, int bits)
493 {
494 struct stat statbuf;
495 uschar *slash;
496 uschar *rp = US realpath(CS path, CS big_buffer);
497 uschar *sp = rp + 1;
498
499 DEBUG(D_route) debug_printf("route_check_access(%s,%d,%d,%o)\n", path,
500 (int)uid, (int)gid, bits);
501
502 if (rp == NULL) return FALSE;
503
504 while ((slash = Ustrchr(sp, '/')) != NULL)
505 {
506 *slash = 0;
507 DEBUG(D_route) debug_printf("stat %s\n", rp);
508 if (Ustat(rp, &statbuf) < 0) return FALSE;
509 if ((statbuf.st_mode &
510 ((statbuf.st_uid == uid)? 0100 : (statbuf.st_gid == gid)? 0010 : 001)
511 ) == 0)
512 {
513 errno = EACCES;
514 return FALSE;
515 }
516 *slash = '/';
517 sp = slash + 1;
518 }
519
520 /* Down to the final component */
521
522 DEBUG(D_route) debug_printf("stat %s\n", rp);
523
524 if (Ustat(rp, &statbuf) < 0) return FALSE;
525
526 if (statbuf.st_uid == uid) bits = bits << 6;
527 else if (statbuf.st_gid == gid) bits = bits << 3;
528 if ((statbuf.st_mode & bits) != bits)
529 {
530 errno = EACCES;
531 return FALSE;
532 }
533
534 DEBUG(D_route) debug_printf("route_check_access() succeeded\n");
535 return TRUE;
536 }
537
538
539
540 /*************************************************
541 * Do file existence tests *
542 *************************************************/
543
544 /* This function is given a colon-separated list of file tests, each of which
545 is expanded before use. A test consists of a file name, optionally preceded by
546 ! (require non-existence) and/or + for handling permission denied (+ means
547 treat as non-existing).
548
549 An item that contains no slashes is interpreted as a username or id, with an
550 optional group id, for checking access to the file. This cannot be done
551 "perfectly", but it is good enough for a number of applications.
552
553 Arguments:
554 s a colon-separated list of file tests or NULL
555 perror a pointer to an anchor for an error text in the case of a DEFER
556
557 Returns: OK if s == NULL or all tests are as required
558 DEFER if the existence of at least one of the files is
559 unclear (an error other than non-existence occurred);
560 DEFER if an expansion failed
561 DEFER if a name is not absolute
562 DEFER if problems with user/group
563 SKIP otherwise
564 */
565
566 int
567 check_files(uschar *s, uschar **perror)
568 {
569 int sep = 0; /* List has default separators */
570 uid_t uid = 0; /* For picky compilers */
571 gid_t gid = 0; /* For picky compilers */
572 BOOL ugid_set = FALSE;
573 uschar *check, *listptr;
574 uschar buffer[1024];
575
576 if (s == NULL) return OK;
577
578 DEBUG(D_route) debug_printf("checking require_files\n");
579
580 listptr = s;
581 while ((check = string_nextinlist(&listptr, &sep, buffer, sizeof(buffer)))
582 != NULL)
583 {
584 int rc;
585 int eacces_code = 0;
586 BOOL invert = FALSE;
587 struct stat statbuf;
588 uschar *ss = expand_string(check);
589
590 if (ss == NULL)
591 {
592 if (expand_string_forcedfail) continue;
593 *perror = string_sprintf("failed to expand \"%s\" for require_files: %s",
594 check, expand_string_message);
595 goto RETURN_DEFER;
596 }
597
598 /* Empty items are just skipped */
599
600 if (*ss == 0) continue;
601
602 /* If there are no slashes in the string, we have a user name or uid, with
603 optional group/gid. */
604
605 if (Ustrchr(ss, '/') == NULL)
606 {
607 BOOL ok;
608 struct passwd *pw;
609 uschar *comma = Ustrchr(ss, ',');
610
611 /* If there's a comma, temporarily terminate the user name/number
612 at that point. Then set the uid. */
613
614 if (comma != NULL) *comma = 0;
615 ok = route_finduser(ss, &pw, &uid);
616 if (comma != NULL) *comma = ',';
617
618 if (!ok)
619 {
620 *perror = string_sprintf("user \"%s\" for require_files not found", ss);
621 goto RETURN_DEFER;
622 }
623
624 /* If there was no comma, the gid is that associated with the user. */
625
626 if (comma == NULL)
627 {
628 if (pw != NULL) gid = pw->pw_gid; else
629 {
630 *perror = string_sprintf("group missing after numerical uid %d for "
631 "require_files", (int)uid);
632 goto RETURN_DEFER;
633 }
634 }
635 else
636 {
637 if (!route_findgroup(comma + 1, &gid))
638 {
639 *perror = string_sprintf("group \"%s\" for require_files not found\n",
640 comma + 1);
641 goto RETURN_DEFER;
642 }
643 }
644
645 /* Note that we have values set, and proceed to next item */
646
647 DEBUG(D_route)
648 debug_printf("check subsequent files for access by %s\n", ss);
649 ugid_set = TRUE;
650 continue;
651 }
652
653 /* Path, possibly preceded by + and ! */
654
655 if (*ss == '+')
656 {
657 eacces_code = 1;
658 while (isspace((*(++ss))));
659 }
660
661 if (*ss == '!')
662 {
663 invert = TRUE;
664 while (isspace((*(++ss))));
665 }
666
667 if (*ss != '/')
668 {
669 *perror = string_sprintf("require_files: \"%s\" is not absolute", ss);
670 goto RETURN_DEFER;
671 }
672
673 /* Stat the file, either as root (while routing) or as exim (while verifying
674 during message reception). */
675
676 rc = Ustat(ss, &statbuf);
677
678 DEBUG(D_route)
679 {
680 debug_printf("file check: %s\n", check);
681 if (ss != check) debug_printf("expanded file: %s\n", ss);
682 debug_printf("stat() yielded %d\n", rc);
683 }
684
685 /* If permission is denied, and we are running as root (i.e. routing for
686 delivery rather than verifying), and the requirement is to test for access by
687 a particular uid/gid, it must mean that the file is on a non-root-mounted NFS
688 system. In this case, we have to use a subprocess that runs as the relevant
689 uid in order to do the test. */
690
691 if (rc != 0 && errno == EACCES && ugid_set && getuid() == root_uid)
692 {
693 int status;
694 pid_t pid;
695 void (*oldsignal)(int);
696
697 DEBUG(D_route) debug_printf("root is denied access: forking to check "
698 "in subprocess\n");
699
700 /* Before forking, ensure that SIGCHLD is set to SIG_DFL before forking, so
701 that the child process can be waited for, just in case get here with it set
702 otherwise. Save the old state for resetting on the wait. */
703
704 oldsignal = signal(SIGCHLD, SIG_DFL);
705 pid = fork();
706
707 /* If fork() fails, reinstate the original error and behave as if
708 this block of code were not present. This is the same behavious as happens
709 when Exim is not running as root at this point. */
710
711 if (pid < 0)
712 {
713 DEBUG(D_route)
714 debug_printf("require_files: fork failed: %s\n", strerror(errno));
715 errno = EACCES;
716 goto HANDLE_ERROR;
717 }
718
719 /* In the child process, change uid and gid, and then do the check using
720 the route_check_access() function. This does more than just stat the file;
721 it tests permissions as well. Return 0 for OK and 1 for failure. */
722
723 if (pid == 0)
724 {
725 exim_setugid(uid, gid, TRUE,
726 string_sprintf("require_files check, file=%s", ss));
727 if (route_check_access(ss, uid, gid, 4)) _exit(0);
728 DEBUG(D_route) debug_printf("route_check_access() failed\n");
729 _exit(1);
730 }
731
732 /* In the parent, wait for the child to finish */
733
734 while (waitpid(pid, &status, 0) < 0)
735 {
736 if (errno != EINTR) /* unexpected error, interpret as failure */
737 {
738 status = 1;
739 break;
740 }
741 }
742
743 signal(SIGCHLD, oldsignal); /* restore */
744 if ((status == 0) == invert) return SKIP;
745 continue; /* to test the next file */
746 }
747
748 /* Control reaches here if the initial stat() succeeds, or fails with an
749 error other than EACCES, or no uid/gid is set, or we are not running as root.
750 If we know the file exists and uid/gid are set, try to check read access for
751 that uid/gid as best we can. */
752
753 if (rc == 0 && ugid_set && !route_check_access(ss, uid, gid, 4))
754 {
755 DEBUG(D_route) debug_printf("route_check_access() failed\n");
756 rc = -1;
757 }
758
759 /* Handle error returns from stat() or route_check_access(). The EACESS error
760 is handled specially. At present, we can force it to be treated as
761 non-existence. Write the code so that it will be easy to add forcing for
762 existence if required later. */
763
764 HANDLE_ERROR:
765 if (rc < 0)
766 {
767 DEBUG(D_route) debug_printf("errno = %d\n", errno);
768 if (errno == EACCES)
769 {
770 if (eacces_code == 1)
771 {
772 DEBUG(D_route) debug_printf("EACCES => ENOENT\n");
773 errno = ENOENT; /* Treat as non-existent */
774 }
775 }
776 if (errno != ENOENT)
777 {
778 *perror = string_sprintf("require_files: error for %s: %s", ss,
779 strerror(errno));
780 goto RETURN_DEFER;
781 }
782 }
783
784 /* At this point, rc < 0 => non-existence; rc >= 0 => existence */
785
786 if ((rc >= 0) == invert) return SKIP;
787 }
788
789 return OK;
790
791 /* Come here on any of the errors that return DEFER. */
792
793 RETURN_DEFER:
794 DEBUG(D_route) debug_printf("%s\n", *perror);
795 return DEFER;
796 }
797
798
799
800
801
802 /*************************************************
803 * Check for router skipping *
804 *************************************************/
805
806 /* This function performs various checks to see whether a router should be
807 skipped. The order in which they are performed is important.
808
809 Arguments:
810 r pointer to router instance block
811 addr address that is being handled
812 verify the verification type
813 pw ptr to ptr to passwd structure for local user
814 perror for lookup errors
815
816 Returns: OK if all the tests succeed
817 SKIP if router is to be skipped
818 DEFER for a lookup defer
819 FAIL for address to be failed
820 */
821
822 static BOOL
823 check_router_conditions(router_instance *r, address_item *addr, int verify,
824 struct passwd **pw, uschar **perror)
825 {
826 int rc;
827 uschar *check_local_part;
828 unsigned int *localpart_cache;
829
830 /* Reset variables to hold a home directory and data from lookup of a domain or
831 local part, and ensure search_find_defer is unset, in case there aren't any
832 actual lookups. */
833
834 deliver_home = NULL;
835 deliver_domain_data = NULL;
836 deliver_localpart_data = NULL;
837 sender_data = NULL;
838 local_user_gid = (gid_t)(-1);
839 local_user_uid = (uid_t)(-1);
840 search_find_defer = FALSE;
841
842 /* Skip this router if not verifying and it has verify_only set */
843
844 if ((verify == v_none || verify == v_expn) && r->verify_only)
845 {
846 DEBUG(D_route) debug_printf("%s router skipped: verify_only set\n", r->name);
847 return SKIP;
848 }
849
850 /* Skip this router if testing an address (-bt) and address_test is not set */
851
852 if (address_test_mode && !r->address_test)
853 {
854 DEBUG(D_route) debug_printf("%s router skipped: address_test is unset\n",
855 r->name);
856 return SKIP;
857 }
858
859 /* Skip this router if verifying and it hasn't got the appropriate verify flag
860 set. */
861
862 if ((verify == v_sender && !r->verify_sender) ||
863 (verify == v_recipient && !r->verify_recipient))
864 {
865 DEBUG(D_route) debug_printf("%s router skipped: verify %d %d %d\n",
866 r->name, verify, r->verify_sender, r->verify_recipient);
867 return SKIP;
868 }
869
870 /* Skip this router if processing EXPN and it doesn't have expn set */
871
872 if (verify == v_expn && !r->expn)
873 {
874 DEBUG(D_route) debug_printf("%s router skipped: no_expn set\n", r->name);
875 return SKIP;
876 }
877
878 /* Skip this router if there's a domain mismatch. */
879
880 if ((rc = route_check_dls(r->name, US"domains", r->domains, &domainlist_anchor,
881 addr->domain_cache, TRUE, addr->domain, &deliver_domain_data, MCL_DOMAIN,
882 perror)) != OK)
883 return rc;
884
885 /* Skip this router if there's a local part mismatch. We want to pass over the
886 caseful local part, so that +caseful can restore it, even if this router is
887 handling local parts caselessly. However, we can't just pass cc_local_part,
888 because that doesn't have the prefix or suffix stripped. A bit of massaging is
889 required. Also, we only use the match cache for local parts that have not had
890 a prefix or suffix stripped. */
891
892 if (addr->prefix == NULL && addr->suffix == NULL)
893 {
894 localpart_cache = addr->localpart_cache;
895 check_local_part = addr->cc_local_part;
896 }
897 else
898 {
899 localpart_cache = NULL;
900 check_local_part = string_copy(addr->cc_local_part);
901 if (addr->prefix != NULL)
902 check_local_part += Ustrlen(addr->prefix);
903 if (addr->suffix != NULL)
904 check_local_part[Ustrlen(check_local_part) - Ustrlen(addr->suffix)] = 0;
905 }
906
907 if ((rc = route_check_dls(r->name, US"local_parts", r->local_parts,
908 &localpartlist_anchor, localpart_cache, MCL_LOCALPART,
909 check_local_part, &deliver_localpart_data, !r->caseful_local_part,
910 perror)) != OK)
911 return rc;
912
913 /* If the check_local_user option is set, check that the local_part is the
914 login of a local user. Note: the third argument to route_finduser() must be
915 NULL here, to prevent a numeric string being taken as a numeric uid. If the
916 user is found, set deliver_home to the home directory, and also set
917 local_user_{uid,gid}. */
918
919 if (r->check_local_user)
920 {
921 DEBUG(D_route) debug_printf("checking for local user\n");
922 if (!route_finduser(addr->local_part, pw, NULL))
923 {
924 DEBUG(D_route) debug_printf("%s router skipped: %s is not a local user\n",
925 r->name, addr->local_part);
926 return SKIP;
927 }
928 deliver_home = string_copy(US (*pw)->pw_dir);
929 local_user_gid = (*pw)->pw_gid;
930 local_user_uid = (*pw)->pw_uid;
931 }
932
933 /* Set (or override in the case of check_local_user) the home directory if
934 router_home_directory is set. This is done here so that it overrides $home from
935 check_local_user before any subsequent expansions are done. Otherwise, $home
936 could mean different things for different options, which would be extremely
937 confusing. */
938
939 if (r->router_home_directory != NULL)
940 {
941 uschar *router_home = expand_string(r->router_home_directory);
942 if (router_home == NULL)
943 {
944 if (!expand_string_forcedfail)
945 {
946 *perror = string_sprintf("failed to expand \"%s\" for "
947 "router_home_directory: %s", r->router_home_directory,
948 expand_string_message);
949 return DEFER;
950 }
951 }
952 else
953 {
954 setflag(addr, af_home_expanded); /* Note set from router_home_directory */
955 deliver_home = router_home;
956 }
957 }
958
959 /* Skip if the sender condition is not met. We leave this one till after the
960 local user check so that $home is set - enabling the possiblity of letting
961 individual recipients specify lists of acceptable/unacceptable senders. */
962
963 if ((rc = route_check_dls(r->name, US"senders", r->senders, NULL,
964 sender_address_cache, MCL_ADDRESS, NULL, NULL, FALSE, perror)) != OK)
965 return rc;
966
967 /* This is the point at which we print out the router's debugging string if it
968 is set. We wait till here so as to have $home available for local users (and
969 anyway, we don't want too much stuff for skipped routers). */
970
971 debug_print_string(r->debug_string);
972
973 /* Perform file existence tests. */
974
975 if ((rc = check_files(r->require_files, perror)) != OK)
976 {
977 DEBUG(D_route) debug_printf("%s router %s: file check\n", r->name,
978 (rc == SKIP)? "skipped" : "deferred");
979 return rc;
980 }
981
982 /* Now the general condition test. */
983
984 if (r->condition != NULL)
985 {
986 DEBUG(D_route) debug_printf("checking \"condition\"\n");
987 if (!expand_check_condition(r->condition, r->name, US"router"))
988 {
989 if (search_find_defer)
990 {
991 *perror = US"condition check lookup defer";
992 DEBUG(D_route) debug_printf("%s\n", *perror);
993 return DEFER;
994 }
995 DEBUG(D_route)
996 debug_printf("%s router skipped: condition failure\n", r->name);
997 return SKIP;
998 }
999 }
1000
1001 #ifdef EXPERIMENTAL_BRIGHTMAIL
1002 /* check if a specific Brightmail AntiSpam rule fired on the message */
1003 if (r->bmi_rule != NULL) {
1004 DEBUG(D_route) debug_printf("checking bmi_rule\n");
1005 if (bmi_check_rule(bmi_base64_verdict, r->bmi_rule) == 0) {
1006 /* none of the rules fired */
1007 DEBUG(D_route)
1008 debug_printf("%s router skipped: none of bmi_rule rules fired\n", r->name);
1009 return SKIP;
1010 };
1011 };
1012
1013 /* check if message should not be delivered */
1014 if (r->bmi_dont_deliver) {
1015 if (bmi_deliver == 1) {
1016 DEBUG(D_route)
1017 debug_printf("%s router skipped: bmi_dont_deliver is FALSE\n", r->name);
1018 return SKIP;
1019 };
1020 };
1021
1022 /* check if message should go to an alternate location */
1023 if (r->bmi_deliver_alternate) {
1024 if ((bmi_deliver == 0) || (bmi_alt_location == NULL)) {
1025 DEBUG(D_route)
1026 debug_printf("%s router skipped: bmi_deliver_alternate is FALSE\n", r->name);
1027 return SKIP;
1028 };
1029 };
1030
1031 /* check if message should go to default location */
1032 if (r->bmi_deliver_default) {
1033 if ((bmi_deliver == 0) || (bmi_alt_location != NULL)) {
1034 DEBUG(D_route)
1035 debug_printf("%s router skipped: bmi_deliver_default is FALSE\n", r->name);
1036 return SKIP;
1037 };
1038 };
1039 #endif
1040
1041 /* All the checks passed. */
1042
1043 return OK;
1044 }
1045
1046
1047
1048
1049 /*************************************************
1050 * Find a local user *
1051 *************************************************/
1052
1053 /* Try several times (if configured) to find a local user, in case delays in
1054 NIS or NFS whatever cause an incorrect refusal. It's a pity that getpwnam()
1055 doesn't have some kind of indication as to why it has failed. If the string
1056 given consists entirely of digits, and the third argument is not NULL, assume
1057 the string is the numerical value of the uid. Otherwise it is looked up using
1058 getpwnam(). The uid is passed back via return_uid, if not NULL, and the
1059 pointer to a passwd structure, if found, is passed back via pw, if not NULL.
1060
1061 Because this may be called several times in succession for the same user for
1062 different routers, cache the result of the previous getpwnam call so that it
1063 can be re-used. Note that we can't just copy the structure, as the store it
1064 points to can get trashed.
1065
1066 Arguments:
1067 s the login name or textual form of the numerical uid of the user
1068 pw if not NULL, return the result of getpwnam here, or set NULL
1069 if no call to getpwnam is made (s numeric, return_uid != NULL)
1070 return_uid if not NULL, return the uid via this address
1071
1072 Returns: TRUE if s is numerical or was looked up successfully
1073
1074 */
1075
1076 static struct passwd pwcopy;
1077 static struct passwd *lastpw = NULL;
1078 static uschar lastname[48] = { 0 };
1079 static uschar lastdir[128];
1080 static uschar lastgecos[128];
1081 static uschar lastshell[128];
1082
1083 BOOL
1084 route_finduser(uschar *s, struct passwd **pw, uid_t *return_uid)
1085 {
1086 BOOL cache_set = (Ustrcmp(lastname, s) == 0);
1087
1088 DEBUG(D_uid) debug_printf("seeking password data for user \"%s\": %s\n", s,
1089 cache_set? "using cached result" : "cache not available");
1090
1091 if (!cache_set)
1092 {
1093 int i = 0;
1094
1095 if (return_uid != NULL && (isdigit(*s) || *s == '-') &&
1096 s[Ustrspn(s+1, "0123456789")+1] == 0)
1097 {
1098 *return_uid = (uid_t)Uatoi(s);
1099 if (pw != NULL) *pw = NULL;
1100 return TRUE;
1101 }
1102
1103 (void)string_format(lastname, sizeof(lastname), "%s", s);
1104
1105 /* Force failure if string length is greater than given maximum */
1106
1107 if (max_username_length > 0 && Ustrlen(lastname) > max_username_length)
1108 {
1109 DEBUG(D_uid) debug_printf("forced failure of finduser(): string "
1110 "length of %s is greater than %d\n", lastname, max_username_length);
1111 lastpw = NULL;
1112 }
1113
1114 /* Try a few times if so configured; this handles delays in NIS etc. */
1115
1116 else for (;;)
1117 {
1118 errno = 0;
1119 if ((lastpw = getpwnam(CS s)) != NULL) break;
1120 if (++i > finduser_retries) break;
1121 sleep(1);
1122 }
1123
1124 if (lastpw != NULL)
1125 {
1126 pwcopy.pw_uid = lastpw->pw_uid;
1127 pwcopy.pw_gid = lastpw->pw_gid;
1128 (void)string_format(lastdir, sizeof(lastdir), "%s", lastpw->pw_dir);
1129 (void)string_format(lastgecos, sizeof(lastgecos), "%s", lastpw->pw_gecos);
1130 (void)string_format(lastshell, sizeof(lastshell), "%s", lastpw->pw_shell);
1131 pwcopy.pw_name = CS lastname;
1132 pwcopy.pw_dir = CS lastdir;
1133 pwcopy.pw_gecos = CS lastgecos;
1134 pwcopy.pw_shell = CS lastshell;
1135 lastpw = &pwcopy;
1136 }
1137
1138 else DEBUG(D_uid)
1139 {
1140 if (errno != 0) debug_printf("getpwnam(%s) failed: %s\n", s,
1141 strerror(errno));
1142 }
1143 }
1144
1145 if (lastpw == NULL)
1146 {
1147 DEBUG(D_uid) debug_printf("getpwnam() returned NULL (user not found)\n");
1148 return FALSE;
1149 }
1150 else
1151 {
1152 DEBUG(D_uid) debug_printf("getpwnam() succeeded uid=%d gid=%d\n",
1153 lastpw->pw_uid, lastpw->pw_gid);
1154 }
1155
1156 if (return_uid != NULL) *return_uid = lastpw->pw_uid;
1157 if (pw != NULL) *pw = lastpw;
1158
1159 return TRUE;
1160 }
1161
1162
1163
1164
1165 /*************************************************
1166 * Find a local group *
1167 *************************************************/
1168
1169 /* Try several times (if configured) to find a local group, in case delays in
1170 NIS or NFS whatever cause an incorrect refusal. It's a pity that getgrnam()
1171 doesn't have some kind of indication as to why it has failed.
1172
1173 Arguments:
1174 s the group namd or textual form of the numerical gid
1175 return_gid return the gid via this address
1176
1177 Returns: TRUE if the group was found; FALSE otherwise
1178
1179 */
1180
1181 BOOL
1182 route_findgroup(uschar *s, gid_t *return_gid)
1183 {
1184 int i = 0;
1185 struct group *gr;
1186
1187 if ((isdigit(*s) || *s == '-') && s[Ustrspn(s+1, "0123456789")+1] == 0)
1188 {
1189 *return_gid = (gid_t)Uatoi(s);
1190 return TRUE;
1191 }
1192
1193 for (;;)
1194 {
1195 if ((gr = getgrnam(CS s)) != NULL)
1196 {
1197 *return_gid = gr->gr_gid;
1198 return TRUE;
1199 }
1200 if (++i > finduser_retries) break;
1201 sleep(1);
1202 }
1203
1204 return FALSE;
1205 }
1206
1207
1208
1209
1210 /*************************************************
1211 * Find user by expanding string *
1212 *************************************************/
1213
1214 /* Expands a string, and then looks up the result in the passwd file.
1215
1216 Arguments:
1217 string the string to be expanded, yielding a login name or a numerical
1218 uid value (to be passed to route_finduser())
1219 driver_name caller name for panic error message (only)
1220 driver_type caller type for panic error message (only)
1221 pw return passwd entry via this pointer
1222 uid return uid via this pointer
1223 errmsg where to point a message on failure
1224
1225 Returns: TRUE if user found, FALSE otherwise
1226 */
1227
1228 BOOL
1229 route_find_expanded_user(uschar *string, uschar *driver_name,
1230 uschar *driver_type, struct passwd **pw, uid_t *uid, uschar **errmsg)
1231 {
1232 uschar *user = expand_string(string);
1233
1234 if (user == NULL)
1235 {
1236 *errmsg = string_sprintf("Failed to expand user string \"%s\" for the "
1237 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1238 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1239 return FALSE;
1240 }
1241
1242 if (route_finduser(user, pw, uid)) return TRUE;
1243
1244 *errmsg = string_sprintf("Failed to find user \"%s\" from expanded string "
1245 "\"%s\" for the %s %s", user, string, driver_name, driver_type);
1246 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1247 return FALSE;
1248 }
1249
1250
1251
1252 /*************************************************
1253 * Find group by expanding string *
1254 *************************************************/
1255
1256 /* Expands a string and then looks up the result in the group file.
1257
1258 Arguments:
1259 string the string to be expanded, yielding a group name or a numerical
1260 gid value (to be passed to route_findgroup())
1261 driver_name caller name for panic error message (only)
1262 driver_type caller type for panic error message (only)
1263 gid return gid via this pointer
1264 errmsg return error message via this pointer
1265
1266 Returns: TRUE if found group, FALSE otherwise
1267 */
1268
1269 BOOL
1270 route_find_expanded_group(uschar *string, uschar *driver_name, uschar *driver_type,
1271 gid_t *gid, uschar **errmsg)
1272 {
1273 BOOL yield = TRUE;
1274 uschar *group = expand_string(string);
1275
1276 if (group == NULL)
1277 {
1278 *errmsg = string_sprintf("Failed to expand group string \"%s\" for the "
1279 "%s %s: %s", string, driver_name, driver_type, expand_string_message);
1280 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1281 return FALSE;
1282 }
1283
1284 if (!route_findgroup(group, gid))
1285 {
1286 *errmsg = string_sprintf("Failed to find group \"%s\" from expanded string "
1287 "\"%s\" for the %s %s", group, string, driver_name, driver_type);
1288 log_write(0, LOG_MAIN|LOG_PANIC, "%s", *errmsg);
1289 yield = FALSE;
1290 }
1291
1292 return yield;
1293 }
1294
1295
1296
1297 /*************************************************
1298 * Sort out "more" or "unseen" *
1299 *************************************************/
1300
1301 /* These values are usually fixed boolean values, but they are permitted to be
1302 expanded strings.
1303
1304 Arguments:
1305 addr address being routed
1306 rname the router name
1307 oname the option name
1308 bvalue the router's boolean value
1309 svalue the router's string value
1310 rvalue where to put the returned value
1311
1312 Returns: OK value placed in rvalue
1313 DEFER expansion failed
1314 */
1315
1316 static int
1317 exp_bool(address_item *addr, uschar *rname, uschar *oname, BOOL bvalue,
1318 uschar *svalue, BOOL *rvalue)
1319 {
1320 uschar *expanded;
1321 if (svalue == NULL) { *rvalue = bvalue; return OK; }
1322
1323 expanded = expand_string(svalue);
1324 if (expanded == NULL)
1325 {
1326 if (expand_string_forcedfail)
1327 {
1328 DEBUG(D_route) debug_printf("expansion of \"%s\" forced failure\n", oname);
1329 *rvalue = bvalue;
1330 return OK;
1331 }
1332 addr->message = string_sprintf("failed to expand \"%s\" in %s router: %s",
1333 oname, rname, expand_string_message);
1334 DEBUG(D_route) debug_printf("%s\n", addr->message);
1335 return DEFER;
1336 }
1337
1338 DEBUG(D_route) debug_printf("expansion of \"%s\" yields \"%s\"\n", oname,
1339 expanded);
1340
1341 if (strcmpic(expanded, US"true") == 0 || strcmpic(expanded, US"yes") == 0)
1342 *rvalue = TRUE;
1343 else if (strcmpic(expanded, US"false") == 0 || strcmpic(expanded, US"no") == 0)
1344 *rvalue = FALSE;
1345 else
1346 {
1347 addr->message = string_sprintf("\"%s\" is not a valid value for the "
1348 "\"%s\" option in the %s router", expanded, oname, rname);
1349 return DEFER;
1350 }
1351
1352 return OK;
1353 }
1354
1355
1356
1357
1358 /*************************************************
1359 * Handle an unseen routing *
1360 *************************************************/
1361
1362 /* This function is called when an address is routed by a router with "unseen"
1363 set. It must make a clone of the address, for handling by subsequent drivers.
1364 The clone is set to start routing at the next router.
1365
1366 The original address must be replaced by an invented "parent" which has the
1367 routed address plus the clone as its children. This is necessary in case the
1368 address is at the top level - we don't want to mark it complete until both
1369 deliveries have been done.
1370
1371 A new unique field must be made, so that the record of the delivery isn't a
1372 record of the original address, and checking for already delivered has
1373 therefore to be done here. If the delivery has happened, then take the base
1374 address off whichever delivery queue it is on - it will always be the top item.
1375
1376 Arguments:
1377 name router name
1378 addr address that was routed
1379 paddr_local chain of local-delivery addresses
1380 paddr_remote chain of remote-delivery addresses
1381 addr_new chain for newly created addresses
1382
1383 Returns: nothing
1384 */
1385
1386 static void
1387 route_unseen(uschar *name, address_item *addr, address_item **paddr_local,
1388 address_item **paddr_remote, address_item **addr_new)
1389 {
1390 address_item *parent = deliver_make_addr(addr->address, TRUE);
1391 address_item *new = deliver_make_addr(addr->address, TRUE);
1392
1393 /* The invented parent is a copy that replaces the original; note that
1394 this copies its parent pointer. It has two children, and its errors_address is
1395 from the original address' parent, if present, otherwise unset. */
1396
1397 *parent = *addr;
1398 parent->child_count = 2;
1399 parent->p.errors_address =
1400 (addr->parent == NULL)? NULL : addr->parent->p.errors_address;
1401
1402 /* The routed address gets a new parent. */
1403
1404 addr->parent = parent;
1405
1406 /* The clone has this parent too. Set its errors address from the parent. This
1407 was set from the original parent (or to NULL) - see above. We do NOT want to
1408 take the errors address from the unseen router. */
1409
1410 new->parent = parent;
1411 new->p.errors_address = parent->p.errors_address;
1412
1413 /* Copy the propagated flags and address_data from the original. */
1414
1415 copyflag(new, addr, af_propagate);
1416 new->p.address_data = addr->p.address_data;
1417
1418
1419 /* As it has turned out, we haven't set headers_add or headers_remove for the
1420 * clone. Thinking about it, it isn't entirely clear whether they should be
1421 * copied from the original parent, like errors_address, or taken from the
1422 * unseen router, like address_data and the flags. Until somebody brings this
1423 * up, I propose to leave the code as it is.
1424 */
1425
1426
1427 /* Set the cloned address to start at the next router, and put it onto the
1428 chain of new addresses. */
1429
1430 new->start_router = addr->router->next;
1431 new->next = *addr_new;
1432 *addr_new = new;
1433
1434 DEBUG(D_route) debug_printf("\"unseen\" set: replicated %s\n", addr->address);
1435
1436 /* Make a new unique field, to distinguish from the normal one. */
1437
1438 addr->unique = string_sprintf("%s/%s", addr->unique, name);
1439
1440 /* If the address has been routed to a transport, see if it was previously
1441 delivered. If so, we take it off the relevant queue so that it isn't delivered
1442 again. Otherwise, it was an alias or something, and the addresses it generated
1443 are handled in the normal way. */
1444
1445 if (addr->transport != NULL &&
1446 tree_search(tree_nonrecipients, addr->unique) != NULL)
1447 {
1448 DEBUG(D_route)
1449 debug_printf("\"unseen\" delivery previously done - discarded\n");
1450 parent->child_count--;
1451 if (*paddr_remote == addr) *paddr_remote = addr->next;
1452 if (*paddr_local == addr) *paddr_local = addr->next;
1453 }
1454 }
1455
1456
1457
1458 /*************************************************
1459 * Route one address *
1460 *************************************************/
1461
1462 /* This function is passed in one address item, for processing by the routers.
1463 The verify flag is set if this is being called for verification rather than
1464 delivery. If the router doesn't have its "verify" flag set, it is skipped.
1465
1466 Arguments:
1467 addr address to route
1468 paddr_local chain of local-delivery addresses
1469 paddr_remote chain of remote-delivery addresses
1470 addr_new chain for newly created addresses
1471 addr_succeed chain for completed addresses
1472 verify v_none if not verifying
1473 v_sender if verifying a sender address
1474 v_recipient if verifying a recipient address
1475 v_expn if processing an EXPN address
1476
1477 Returns: OK => address successfully routed
1478 DISCARD => address was discarded
1479 FAIL => address could not be routed
1480 DEFER => some temporary problem
1481 ERROR => some major internal or configuration failure
1482 */
1483
1484 int
1485 route_address(address_item *addr, address_item **paddr_local,
1486 address_item **paddr_remote, address_item **addr_new,
1487 address_item **addr_succeed, int verify)
1488 {
1489 int yield = OK;
1490 BOOL unseen;
1491 router_instance *r, *nextr;
1492 uschar *old_domain = addr->domain;
1493
1494 HDEBUG(D_route)
1495 {
1496 debug_printf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
1497 debug_printf("routing %s\n", addr->address);
1498 }
1499
1500 /* Loop through all router instances until a router succeeds, fails, defers, or
1501 encounters an error. If the address has start_router set, we begin from there
1502 instead of at the first router. */
1503
1504 for (r = (addr->start_router == NULL)? routers : addr->start_router;
1505 r != NULL; r = nextr)
1506 {
1507 uschar *error;
1508 struct passwd *pw = NULL;
1509 struct passwd pwcopy;
1510 address_item *parent;
1511 BOOL loop_detected = FALSE;
1512 BOOL more;
1513 int loopcount = 0;
1514 int rc;
1515
1516 DEBUG(D_route) debug_printf("--------> %s router <--------\n", r->name);
1517
1518 /* Reset any search error message from the previous router. */
1519
1520 search_error_message = NULL;
1521
1522 /* There are some weird cases where logging is disabled */
1523
1524 disable_logging = r->disable_logging;
1525
1526 /* Record the last router to handle the address, and set the default
1527 next router. */
1528
1529 addr->router = r;
1530 nextr = r->next;
1531
1532 /* Loop protection: If this address has an ancestor with the same address,
1533 and that ancestor was routed by this router, we skip this router. This
1534 prevents a variety of looping states when a new address is created by
1535 redirection or by the use of "unseen" on a router.
1536
1537 If no_repeat_use is set on the router, we skip if _any_ ancestor was routed
1538 by this router, even if it was different to the current address.
1539
1540 Just in case someone does put it into a loop (possible with redirection
1541 continally adding to an address, for example), put a long stop counter on
1542 the number of parents. */
1543
1544 for (parent = addr->parent; parent != NULL; parent = parent->parent)
1545 {
1546 if (parent->router == r)
1547 {
1548 BOOL break_loop = !r->repeat_use;
1549
1550 /* When repeat_use is set, first check the active addresses caselessly.
1551 If they match, we have to do a further caseful check of the local parts
1552 when caseful_local_part is set. This is assumed to be rare, which is why
1553 the code is written this way. */
1554
1555 if (!break_loop)
1556 {
1557 break_loop = strcmpic(parent->address, addr->address) == 0;
1558 if (break_loop && r->caseful_local_part)
1559 break_loop = Ustrncmp(parent->address, addr->address,
1560 Ustrrchr(addr->address, '@') - addr->address) == 0;
1561 }
1562
1563 if (break_loop)
1564 {
1565 DEBUG(D_route) debug_printf("%s router skipped: previously routed %s\n",
1566 r->name, parent->address);
1567 loop_detected = TRUE;
1568 break;
1569 }
1570 }
1571
1572 /* Continue with parents, limiting the size of the dynasty. */
1573
1574 if (loopcount++ > 100)
1575 {
1576 log_write(0, LOG_MAIN|LOG_PANIC, "routing loop for %s", addr->address);
1577 yield = DEFER;
1578 goto ROUTE_EXIT;
1579 }
1580 }
1581
1582 if (loop_detected) continue;
1583
1584 /* Default no affixes and select whether to use a caseful or caseless local
1585 part in this router. */
1586
1587 addr->prefix = addr->suffix = NULL;
1588 addr->local_part = r->caseful_local_part?
1589 addr->cc_local_part : addr->lc_local_part;
1590
1591 DEBUG(D_route) debug_printf("local_part=%s domain=%s\n", addr->local_part,
1592 addr->domain);
1593
1594 /* Handle any configured prefix by replacing the local_part address,
1595 and setting the prefix. Skip the router if the prefix doesn't match,
1596 unless the prefix is optional. */
1597
1598 if (r->prefix != NULL)
1599 {
1600 int plen = route_check_prefix(addr->local_part, r->prefix);
1601 if (plen > 0)
1602 {
1603 addr->prefix = string_copyn(addr->local_part, plen);
1604 addr->local_part += plen;
1605 DEBUG(D_route) debug_printf("stripped prefix %s\n", addr->prefix);
1606 }
1607 else if (!r->prefix_optional)
1608 {
1609 DEBUG(D_route) debug_printf("%s router skipped: prefix mismatch\n",
1610 r->name);
1611 continue;
1612 }
1613 }
1614
1615 /* Handle any configured suffix likewise. */
1616
1617 if (r->suffix != NULL)
1618 {
1619 int slen = route_check_suffix(addr->local_part, r->suffix);
1620 if (slen > 0)
1621 {
1622 int lplen = Ustrlen(addr->local_part) - slen;
1623 addr->suffix = addr->local_part + lplen;
1624 addr->local_part = string_copyn(addr->local_part, lplen);
1625 DEBUG(D_route) debug_printf("stripped suffix %s\n", addr->suffix);
1626 }
1627 else if (!r->suffix_optional)
1628 {
1629 DEBUG(D_route) debug_printf("%s router skipped: suffix mismatch\n",
1630 r->name);
1631 continue;
1632 }
1633 }
1634
1635 /* Set the expansion variables now that we have the affixes and the case of
1636 the local part sorted. */
1637
1638 deliver_set_expansions(addr);
1639
1640 /* For convenience, the pre-router checks are in a separate function, which
1641 returns OK, SKIP, FAIL, or DEFER. */
1642
1643 if ((rc = check_router_conditions(r, addr, verify, &pw, &error)) != OK)
1644 {
1645 if (rc == SKIP) continue;
1646 addr->message = error;
1647 yield = rc;
1648 goto ROUTE_EXIT;
1649 }
1650
1651 /* All pre-conditions have been met. Reset any search error message from
1652 pre-condition tests. These can arise in negated tests where the failure of
1653 the lookup leads to a TRUE pre-condition. */
1654
1655 search_error_message = NULL;
1656
1657 /* Finally, expand the address_data field in the router. Forced failure
1658 behaves as if the router declined. Any other failure is more serious. On
1659 success, the string is attached to the address for all subsequent processing.
1660 */
1661
1662 if (r->address_data != NULL)
1663 {
1664 DEBUG(D_route) debug_printf("processing address_data\n");
1665 deliver_address_data = expand_string(r->address_data);
1666 if (deliver_address_data == NULL)
1667 {
1668 if (expand_string_forcedfail)
1669 {
1670 DEBUG(D_route) debug_printf("forced failure in expansion of \"%s\" "
1671 "(address_data): decline action taken\n", r->address_data);
1672
1673 /* Expand "more" if necessary; DEFER => an expansion failed */
1674
1675 yield = exp_bool(addr, r->name, US"more", r->more, r->expand_more,
1676 &more);
1677 if (yield != OK) goto ROUTE_EXIT;
1678
1679 if (!more)
1680 {
1681 DEBUG(D_route)
1682 debug_printf("\"more\"=false: skipping remaining routers\n");
1683 r = NULL;
1684 break;
1685 }
1686 else continue; /* With next router */
1687 }
1688
1689 else
1690 {
1691 addr->message = string_sprintf("expansion of \"%s\" failed "
1692 "in %s router: %s", r->address_data, r->name, expand_string_message);
1693 yield = DEFER;
1694 goto ROUTE_EXIT;
1695 }
1696 }
1697 addr->p.address_data = deliver_address_data;
1698 }
1699
1700 /* We are finally cleared for take-off with this router. Clear the the flag
1701 that records that a local host was removed from a routed host list. Make a
1702 copy of relevant fields in the password information from check_local_user,
1703 because it will be overwritten if check_local_user is invoked again while
1704 verifying an errors_address setting. */
1705
1706 clearflag(addr, af_local_host_removed);
1707
1708 if (pw != NULL)
1709 {
1710 pwcopy.pw_name = CS string_copy(US pw->pw_name);
1711 pwcopy.pw_uid = pw->pw_uid;
1712 pwcopy.pw_gid = pw->pw_gid;
1713 pwcopy.pw_gecos = CS string_copy(US pw->pw_gecos);
1714 pwcopy.pw_dir = CS string_copy(US pw->pw_dir);
1715 pwcopy.pw_shell = CS string_copy(US pw->pw_shell);
1716 pw = &pwcopy;
1717 }
1718
1719 /* Run the router, and handle the consequences. */
1720
1721 HDEBUG(D_route) debug_printf("calling %s router\n", r->name);
1722
1723 yield = (r->info->code)(r, addr, pw, verify, paddr_local, paddr_remote,
1724 addr_new, addr_succeed);
1725
1726 if (yield == FAIL)
1727 {
1728 HDEBUG(D_route) debug_printf("%s router forced address failure\n", r->name);
1729 goto ROUTE_EXIT;
1730 }
1731
1732 /* If succeeded while verifying but fail_verify is set, convert into
1733 a failure, and take it off the local or remote delivery list. */
1734
1735 if (((verify == v_sender && r->fail_verify_sender) ||
1736 (verify == v_recipient && r->fail_verify_recipient)) &&
1737 (yield == OK || yield == PASS))
1738 {
1739 addr->message = string_sprintf("%s router forced verify failure", r->name);
1740 if (*paddr_remote == addr) *paddr_remote = addr->next;
1741 if (*paddr_local == addr) *paddr_local = addr->next;
1742 yield = FAIL;
1743 goto ROUTE_EXIT;
1744 }
1745
1746 /* PASS and DECLINE are the only two cases where the loop continues. For all
1747 other returns, we break the loop and handle the result below. */
1748
1749 if (yield != PASS && yield != DECLINE) break;
1750
1751 HDEBUG(D_route)
1752 {
1753 debug_printf("%s router %s for %s\n", r->name,
1754 (yield == PASS)? "passed" : "declined", addr->address);
1755 if (Ustrcmp(old_domain, addr->domain) != 0)
1756 debug_printf("domain %s rewritten\n", old_domain);
1757 }
1758
1759 /* PASS always continues to another router; DECLINE does so if "more"
1760 is true. Initialization insists that pass_router is always a following
1761 router. Otherwise, break the loop as if at the end of the routers. */
1762
1763 if (yield == PASS)
1764 {
1765 if (r->pass_router != NULL) nextr = r->pass_router;
1766 }
1767 else
1768 {
1769 /* Expand "more" if necessary */
1770
1771 yield = exp_bool(addr, r->name, US"more", r->more, r->expand_more, &more);
1772 if (yield != OK) goto ROUTE_EXIT;
1773
1774 if (!more)
1775 {
1776 HDEBUG(D_route)
1777 debug_printf("\"more\" is false: skipping remaining routers\n");
1778 r = NULL;
1779 break;
1780 }
1781 }
1782 } /* Loop for all routers */
1783
1784 /* On exit from the routers loop, if r == NULL we have run out of routers,
1785 either genuinely, or as a result of no_more. Otherwise, the loop ended
1786 prematurely, either because a router succeeded, or because of some special
1787 router response. Note that FAIL errors and errors detected before actually
1788 running a router go direct to ROUTE_EXIT from code above. */
1789
1790 if (r == NULL)
1791 {
1792 HDEBUG(D_route) debug_printf("no more routers\n");
1793 if (addr->message == NULL)
1794 {
1795 uschar *message = US"Unrouteable address";
1796 if (addr->router != NULL && addr->router->cannot_route_message != NULL)
1797 {
1798 uschar *expmessage = expand_string(addr->router->cannot_route_message);
1799 if (expmessage == NULL)
1800 {
1801 if (!expand_string_forcedfail)
1802 log_write(0, LOG_MAIN|LOG_PANIC, "failed to expand "
1803 "cannot_route_message in %s router: %s", addr->router->name,
1804 expand_string_message);
1805 }
1806 else message = expmessage;
1807 }
1808 addr->user_message = addr->message = message;
1809 }
1810 addr->router = NULL; /* For logging */
1811 yield = FAIL;
1812 goto ROUTE_EXIT;
1813 }
1814
1815 if (yield == DEFER)
1816 {
1817 HDEBUG(D_route)
1818 {
1819 debug_printf("%s router: defer for %s\n", r->name, addr->address);
1820 debug_printf(" message: %s\n", (addr->message == NULL)?
1821 US"<none>" : addr->message);
1822 }
1823 goto ROUTE_EXIT;
1824 }
1825
1826 if (yield == DISCARD) goto ROUTE_EXIT;
1827
1828 /* The yield must be either OK or REROUTED. */
1829
1830 if (yield != OK && yield != REROUTED)
1831 log_write(0, LOG_MAIN|LOG_PANIC_DIE, "%s router returned unknown value %d",
1832 r->name, yield);
1833
1834 /* If the yield was REROUTED, the router put a child address on the new chain
1835 as a result of a domain change of some sort (widening, typically). */
1836
1837 if (yield == REROUTED)
1838 {
1839 HDEBUG(D_route) debug_printf("re-routed to %s\n", addr->address);
1840 yield = OK;
1841 goto ROUTE_EXIT;
1842 }
1843
1844 /* The only remaining possibility is that the router succeeded. If the
1845 translate_ip_address options is set and host addresses were associated with the
1846 address, run them through the translation. This feature is for weird and
1847 wonderful situations (the amateur packet radio people need it) or very broken
1848 networking, so it is included in the binary only if requested. */
1849
1850 #ifdef SUPPORT_TRANSLATE_IP_ADDRESS
1851
1852 if (r->translate_ip_address != NULL)
1853 {
1854 int rc;
1855 int old_pool = store_pool;
1856 host_item *h;
1857 for (h = addr->host_list; h != NULL; h = h->next)
1858 {
1859 uschar *newaddress;
1860 uschar *oldaddress, *oldname;
1861
1862 if (h->address == NULL) continue;
1863
1864 deliver_host_address = h->address;
1865 newaddress = expand_string(r->translate_ip_address);
1866 deliver_host_address = NULL;
1867
1868 if (newaddress == NULL)
1869 {
1870 if (expand_string_forcedfail) continue;
1871 addr->basic_errno = ERRNO_EXPANDFAIL;
1872 addr->message = string_sprintf("translate_ip_address expansion "
1873 "failed: %s", expand_string_message);
1874 yield = DEFER;
1875 goto ROUTE_EXIT;
1876 }
1877
1878 DEBUG(D_route) debug_printf("%s [%s] translated to %s\n",
1879 h->name, h->address, newaddress);
1880 if (string_is_ip_address(newaddress, NULL) != 0)
1881 {
1882 h->address = newaddress;
1883 continue;
1884 }
1885
1886 oldname = h->name;
1887 oldaddress = h->address;
1888 h->name = newaddress;
1889 h->address = NULL;
1890 h->mx = MX_NONE;
1891
1892 store_pool = POOL_PERM;
1893 rc = host_find_byname(h, NULL, HOST_FIND_QUALIFY_SINGLE, NULL, TRUE);
1894 store_pool = old_pool;
1895
1896 if (rc == HOST_FIND_FAILED || rc == HOST_FIND_AGAIN)
1897 {
1898 addr->basic_errno = ERRNO_UNKNOWNHOST;
1899 addr->message = string_sprintf("host %s not found when "
1900 "translating %s [%s]", h->name, oldname, oldaddress);
1901 yield = DEFER;
1902 goto ROUTE_EXIT;
1903 }
1904 }
1905 }
1906 #endif /* SUPPORT_TRANSLATE_IP_ADDRESS */
1907
1908 /* See if this is an unseen routing; first expand the option if necessary.
1909 DEFER can be given if the expansion fails */
1910
1911 yield = exp_bool(addr, r->name, US"unseen", r->unseen, r->expand_unseen,
1912 &unseen);
1913 if (yield != OK) goto ROUTE_EXIT;
1914
1915 /* Debugging output recording a successful routing */
1916
1917 HDEBUG(D_route)
1918 {
1919 debug_printf("routed by %s router%s\n", r->name,
1920 unseen? " (unseen)" : "");
1921 }
1922
1923 DEBUG(D_route)
1924 {
1925 host_item *h;
1926
1927 debug_printf(" envelope to: %s\n", addr->address);
1928 debug_printf(" transport: %s\n", (addr->transport == NULL)?
1929 US"<none>" : addr->transport->name);
1930
1931 if (addr->p.errors_address != NULL)
1932 debug_printf(" errors to %s\n", addr->p.errors_address);
1933
1934 for (h = addr->host_list; h != NULL; h = h->next)
1935 {
1936 debug_printf(" host %s", h->name);
1937 if (h->address != NULL) debug_printf(" [%s]", h->address);
1938 if (h->mx >= 0) debug_printf(" MX=%d", h->mx);
1939 else if (h->mx != MX_NONE) debug_printf(" rgroup=%d", h->mx);
1940 if (h->port != PORT_NONE) debug_printf(" port=%d", h->port);
1941 debug_printf("\n");
1942 }
1943 }
1944
1945 /* Clear any temporary error message set by a router that declined, and handle
1946 the "unseen" option (ignore if there are no further routers). */
1947
1948 addr->message = NULL;
1949 if (unseen && r->next != NULL)
1950 route_unseen(r->name, addr, paddr_local, paddr_remote, addr_new);
1951
1952 /* Unset the address expansions, and return the final result. */
1953
1954 ROUTE_EXIT:
1955 deliver_set_expansions(NULL);
1956 disable_logging = FALSE;
1957 return yield;
1958 }
1959
1960 /* End of route.c */